Secure multimedia information transmission method and apparatus, electronic device, and server

Abstract

The present application relates to the technical field of electronic devices, and discloses a secure multimedia information transmission method and apparatus, an electronic device, and a server. The secure multimedia information transmission method is applied to an electronic device, wherein a virtual machine and a target object are deployed on the electronic device, and the target object comprises a trusted execution environment (TEE) and / or a secure element (SE). The method comprises: a multimedia information verification trusted application module running in a virtual machine invokes a camera hardware module on the basis of a multimedia recording request message to acquire multimedia information, wherein the multimedia recording request message is determined on the basis of a camera use request message sent by a server; a multimedia digital signature application module running in a target object signs the multimedia information and multimedia attribute information to acquire multimedia signature information; and the multimedia information verification trusted application module running in the virtual machine sends the multimedia signature information and the multimedia information to the server.

Description

Multimedia information secure transmission method and device, electronic equipment and server

[0001] Cross-reference to Related Applications

[0002] The present application claims priority to the Chinese patent application No. 202410812177.5, filed on June 21, 2024, and entitled "Multimedia information secure transmission method and device, electronic equipment and server", the whole content of which is incorporated herein by reference. TECHNICAL FIELD

[0003] The present application belongs to the technical field of electronic equipment, and particularly relates to a multimedia information secure transmission method and device, electronic equipment and server. BACKGROUND

[0004] With the popularization of intelligent terminals, the application of camera capabilities on terminals is also becoming more and more widespread, for example, the camera will be used for remote identity authentication, such as face recognition, collecting certificate information, etc. However, the current terminal system framework has the risk of camera-captured images or videos being attacked, and cannot guarantee the security of remotely using the camera. SUMMARY

[0005] The present application provides a multimedia information secure transmission method and device, electronic equipment and server, which guarantees the security of remotely using the camera.

[0006] In order to solve the above technical problems, the present application is implemented as follows:

[0007] In a first aspect, the present application provides a multimedia information secure transmission method, applied to an electronic equipment, wherein the electronic equipment is deployed with a virtual machine and a target object, and the target object includes a trusted execution environment (TEE) and / or a secure element (SE); and the method comprises:

[0008] A multimedia information verification trusted application module running in the virtual machine acquires multimedia information by calling a camera hardware module according to a multimedia recording request message, wherein the multimedia recording request message is determined based on a camera use request message sent by a server;

[0009] A multimedia digital signature application module running in the target object signs the multimedia information to acquire multimedia signature information;

[0010] The multimedia information verification trusted application module running in the virtual machine sends the multimedia signature information and the multimedia information to the server.

[0011] Optionally, the method further comprises:

[0012] The multimedia information verification application module running in the general execution environment (REE) receives a camera use request message sent by a server;

[0013] The multimedia information verification application module running in the general execution environment (REE) sends a multimedia recording request message to the multimedia information verification trusted application module through a client application module of a camera framework layer running in the REE when it is determined that the camera hardware module needs to be invoked in a trusted environment.

[0014] Optionally, the multimedia recording request message comprises at least one of the following:

[0015] Indication information of taking a photo in a trusted environment;

[0016] Information of needing to take a photo;

[0017] Business information.

[0018] Optionally, the multimedia information verification trusted application module running in the virtual machine invokes the camera hardware module to obtain multimedia information according to the multimedia recording request message, comprising:

[0019] The multimedia information verification trusted application module running in the virtual machine invokes a trusted camera driver module according to the multimedia recording request message to obtain multimedia information.

[0020] The trusted camera driver module runs in the virtual machine or the TEE.

[0021] Optionally, the multimedia information verification trusted application module running in the virtual machine invokes the trusted camera driver module to obtain multimedia information according to the multimedia recording request message, comprising:

[0022] The multimedia information verification trusted application module running in the virtual machine sends a multimedia recording request message to a trusted camera service module, and the trusted camera service module runs in the virtual machine or the TEE.

[0023] The trusted camera service module invokes a trusted camera driver module according to the multimedia recording request message to initiate a multimedia recording request.

[0024] The trusted camera driver module invokes the camera hardware module.

[0025] The multimedia information verification trusted application module running in the virtual machine obtains multimedia information.

[0026] The multimedia information includes original data collected by the camera hardware module and multimedia attribute information generated by the multimedia information verification trusted application module, and the multimedia attribute information includes at least one of the following: a service name triggering multimedia recording, a shooting location, a shooting time, and a shooting device model.

[0027] Optionally, the multimedia digital signature application module running in the target object signs the multimedia information to obtain multimedia signature information, including:

[0028] The multimedia digital signature application module running in the target object receives a signature request message sent by the multimedia information verification trusted application module, and the signature request message includes a hash value obtained based on the multimedia information.

[0029] The multimedia digital signature application module running in the target object signs the hash value using a device private key to obtain multimedia signature information.

[0030] The multimedia digital signature application module running in the target object sends target information to the multimedia information verification trusted application module, and the target information includes multimedia signature information and certificate information, and the certificate information includes a device certificate and / or a server certificate.

[0031] The multimedia digital signature application module runs in a TEE and / or an SE.

[0032] Optionally, in a case where the multimedia digital signature application module includes a multimedia digital signature trusted application module and a key management module, and the multimedia digital signature trusted application module runs in a TEE and the key management module runs in an SE, the multimedia digital signature application module running in the target object signs the hash value using a device private key to obtain multimedia signature information, including:

[0033] The multimedia digital signature trusted application module sends the signature request message to the key management module.

[0034] The key management module signs the hash value according to a device private key to obtain multimedia signature information.

[0035] Optionally, the multimedia information verification trusted application module running in the virtual machine sends the multimedia signature information and the multimedia information to the server, including:

[0036] The multimedia information verification trusted application module running in the virtual machine transmits the multimedia signature information and the multimedia information to a multimedia information verification application module running in a REE.

[0037] The multimedia information verification application module running in the REE sends the multimedia signature information and the multimedia information to the server.

[0038] Optionally, the multimedia information verification trusted application module running in the virtual machine delivers the multimedia signature information and the multimedia information to the multimedia information verification application module running in the REE, comprising:

[0039] The multimedia information verification trusted application module running in the virtual machine sends the multimedia signature information and the multimedia information to the multimedia information verification application module running in the REE through a client application module running in a camera framework layer in the REE.

[0040] In a second aspect, the embodiments of the present application provide a multimedia information secure transmission method, comprising:

[0041] sending a camera use request message to an electronic device;

[0042] receiving multimedia signature information and multimedia information fed back by a multimedia information verification trusted application module running in a virtual machine of the electronic device;

[0043] verifying the multimedia signature information;

[0044] processing the multimedia information after verification.

[0045] Optionally, the verifying the multimedia signature information comprises:

[0046] verifying whether a server certificate is valid according to a root certificate of the server;

[0047] verifying whether a device certificate is valid according to the server certificate in the case that the server certificate is valid;

[0048] verifying whether the multimedia signature information is valid according to the device certificate in the case that the device certificate is valid.

[0049] In a third aspect, the embodiments of the present application provide a multimedia information secure transmission device, applied to an electronic device, wherein the electronic device is deployed with a virtual machine and a target object, and the target object comprises a trusted execution environment (TEE) and / or a secure element (SE); comprising:

[0050] a multimedia information verification trusted application module, running in the virtual machine, configured to acquire multimedia information by calling a camera hardware module according to a multimedia recording request message, wherein the multimedia recording request message is determined based on a camera use request message sent by a server;

[0051] The multimedia digital signature application module runs in the target object, and is configured to sign the multimedia information and obtain multimedia signature information.

[0052] The multimedia information verification trusted application module is further configured to send the multimedia signature information and the multimedia information to the server.

[0053] Optionally, the apparatus further comprises:

[0054] The multimedia information verification application module runs in the REE, and is configured to receive a camera use request message sent by the server.

[0055] When it is determined that the camera hardware module needs to be invoked in the trusted environment, the multimedia information verification trusted application module is sent a multimedia recording request message by a client application module running in the camera framework layer in the REE.

[0056] Optionally, the multimedia recording request message comprises at least one of the following:

[0057] Indication information of taking a photo in the trusted environment;

[0058] Information to be photographed;

[0059] Business information.

[0060] Optionally, the multimedia information verification trusted application module is configured to:

[0061] Invoke a trusted camera driver module according to the multimedia recording request message, and obtain multimedia information;

[0062] The trusted camera driver module runs in the virtual machine or the TEE.

[0063] Optionally, the multimedia information verification trusted application module is configured to:

[0064] Send a multimedia recording request message to a trusted camera service module, the trusted camera service module running in the virtual machine or the TEE;

[0065] The trusted camera service module is configured to invoke a trusted camera driver module according to the multimedia recording request message, and initiate a multimedia recording request.

[0066] The trusted camera driver module is configured to invoke the camera hardware module.

[0067] The multimedia information verification trusted application module is further configured to obtain multimedia information.

[0068] The multimedia information includes raw data collected by the camera hardware module and multimedia attribute information generated by the multimedia information verification trusted application module, and the multimedia attribute information includes at least one of the following: a service name triggering multimedia recording, a shooting location, a shooting time, and a shooting device model.

[0069] Optionally, the multimedia digital signature application module is configured to:

[0070] receive a signature request message sent by the multimedia information verification trusted application module, wherein the signature request message includes a hash value obtained based on the multimedia information;

[0071] sign the hash value by using a device private key to obtain multimedia signature information;

[0072] send target information to the multimedia information verification trusted application module, wherein the target information includes the multimedia signature information and certificate information, and the certificate information includes a device certificate and / or a server certificate;

[0073] The multimedia digital signature application module runs in a TEE and / or an SE.

[0074] Optionally, in a case where the multimedia digital signature application module includes a multimedia digital signature trusted application module and a key management module, and the multimedia digital signature trusted application module runs in a TEE and the key management module runs in an SE, the multimedia digital signature trusted application module is configured to send the signature request message to the key management module.

[0075] The key management module is configured to sign the hash value by using a device private key to obtain multimedia signature information.

[0076] Optionally, the multimedia information verification trusted application module is configured to:

[0077] deliver the multimedia signature information and the multimedia information to a multimedia information verification application module running in a REE;

[0078] The multimedia information verification application module is configured to send the multimedia signature information and the multimedia information to the server.

[0079] Optionally, the multimedia information verification trusted application module is configured to:

[0080] send the multimedia signature information and the multimedia information to a multimedia information verification application module running in a REE by a client application module running in a camera framework layer in the REE.

[0081] In a fourth aspect, an electronic device is provided, which includes a processor, a memory, and a program or instructions stored in the memory and executable on the processor, and the program or instructions, when executed by the processor, implement the steps of the multimedia information secure transmission method.

[0082] In a fifth aspect, a multimedia information secure transmission apparatus is provided, which includes:

[0083] a sending module configured to send a camera use request message to an electronic device;

[0084] a receiving module configured to receive multimedia signature information and multimedia information fed back by a multimedia information verification trusted application module running in a virtual machine of the electronic device;

[0085] a verification module configured to verify the multimedia signature information;

[0086] a processing module configured to process the multimedia information after verification.

[0087] Optionally, the verification module is configured to:

[0088] verify whether a server certificate is valid according to a root certificate of the server;

[0089] verify whether a device certificate is valid according to the server certificate in a case where the server certificate is valid;

[0090] verify whether the multimedia signature information is valid according to the device certificate in a case where the device certificate is valid.

[0091] In a sixth aspect, a server is provided, which includes a processor, a memory, and a program or instructions stored in the memory and executable on the processor, and the program or instructions, when executed by the processor, implement the steps of the multimedia information secure transmission method.

[0092] In a seventh aspect, a readable storage medium is provided, which stores a program or instructions, and the program or instructions, when executed by a processor, implement the steps of the multimedia information secure transmission method.

[0093] In an eighth aspect, a computer program product is provided, which includes computer instructions, and the computer instructions, when executed by a processor, implement the steps of the multimedia information secure transmission method.

[0094] In the embodiment of the present application, the multimedia information verification trusted application module running in the virtual machine calls the camera hardware module according to the multimedia recording request message, acquires the multimedia information, the multimedia digital signature application module running in the target object signs the multimedia information, acquires the multimedia signature information, and the multimedia information verification trusted application module running in the virtual machine sends the multimedia signature information and the multimedia information to the server; the signature of the multimedia information collected by the camera on the electronic device side is ensured, information tampering is avoided, and the security of the remote camera use is improved. BRIEF DESCRIPTION OF DRAWINGS

[0095] Fig. 1 is a flow diagram of a multimedia information secure transmission method according to an embodiment of the present application;

[0096] Fig. 2 is a communication architecture diagram according to an embodiment of the present application;

[0097] Fig. 3 is a communication architecture diagram according to another embodiment of the present application;

[0098] Fig. 4 is a flow diagram of the architecture shown in Fig. 3;

[0099] Fig. 5 is a communication architecture diagram according to another embodiment of the present application;

[0100] Fig. 6 is a communication architecture diagram according to another embodiment of the present application;

[0101] Fig. 7 is a communication architecture diagram according to another embodiment of the present application;

[0102] Fig. 8 is a flow diagram of a multimedia information secure transmission method according to another embodiment of the present application;

[0103] Fig. 9 is a module diagram of a multimedia information secure transmission device according to an embodiment of the present application;

[0104] Fig. 10 is a structural diagram of an electronic device according to an embodiment of the present application;

[0105] Fig. 11 is a module diagram of a multimedia information secure transmission device according to another embodiment of the present application;

[0106] Fig. 12 is a structural diagram of a server according to an embodiment of the present application. DETAILED DESCRIPTION

[0107] The technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only some of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative work fall within the scope of the present application.

[0108] The terms "first", "second", etc. in the specification and claims of the present application are used to distinguish similar objects, and are not used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged under appropriate circumstances, so that the embodiments of the present application can be implemented in an order other than those illustrated or described herein, and the objects distinguished by "first", "second", etc. are generally a class, not limited to the number of objects, for example, the first object can be one or more. In addition, "and / or" in the specification and claims indicates at least one of the connected objects, and the character " / ", generally indicates that the objects before and after are in a "or" relationship.

[0109] The multimedia information security transmission method, device, electronic device and server provided by the embodiments of the present application will be described in detail below in combination with the drawings, through specific embodiments and application scenarios.

[0110] As shown in FIG. 1, the present application provides a multimedia information security transmission method, applied to an electronic device, the electronic device is deployed with a virtual machine (Virtual Machine, VM) and a target object, the target object includes a trusted execution environment (Trusted Execution Environment, TEE) and / or a secure element (Secure Element, SE); the method comprises:

[0111] Step 101, the multimedia information verification trusted application module running in the virtual machine acquires multimedia information according to a multimedia recording request message, the camera hardware module is called based on the camera usage request message sent by the server;

[0112] It should be noted that the multimedia recording mentioned in the embodiments of the present application can include photographing, video recording and other operations.

[0113] Optionally, the multimedia information includes original data and multimedia attribute information, and optionally, the multimedia attribute information includes at least one of the following: business name triggering multimedia recording, shooting location, shooting time, and shooting device model.

[0114] Optionally, the multimedia attribute information can be understood as metadata.

[0115] Step 102, the multimedia digital signature application module running in the target object signs the multimedia information to obtain multimedia signature information;

[0116] Step 103, the multimedia information verification trusted application module running in the virtual machine sends the multimedia signature information and the multimedia information to the server.

[0117] It should be noted that, in the embodiment of the application, the multimedia information verification trusted application module is added in the virtual machine, so that the electronic device can safely call the camera hardware module, and the multimedia information collected by the camera is signed by the multimedia digital signature application module in the TEE and / or SE, which can avoid tampering of the information and improve the security of remote use of the camera.

[0118] Optionally, the multimedia information in the embodiment of the application includes but is not limited to at least one of the following: image information, video information.

[0119] It should be noted that the camera hardware module in the embodiment of the application can also be referred to as a camera.

[0120] Optionally, in an implementation manner, the method further includes:

[0121] The multimedia information verification application module running in the Rich Execution Environment (REE) receives a camera use request message sent by a server;

[0122] The multimedia information verification application module running in the REE sends a multimedia recording request message to the multimedia information verification trusted application module through a client application module of a camera framework layer running in the REE, in a case where it is determined that the camera hardware module needs to be called in a trusted environment.

[0123] It should be noted that the virtual machine in the embodiment of the application cannot directly communicate with the server, but the multimedia information verification application module in the REE first receives the camera use request message sent by the server. The multimedia information verification application module needs to identify based on the camera use request message to determine whether the camera hardware module needs to be called in a trusted environment. If the camera hardware module needs to be called in a trusted environment, the multimedia recording request message needs to be sent to the client application module of the camera framework layer. The client application module of the camera framework layer determines that the photographing needs to be performed in a trusted environment according to the multimedia recording request message, and then forwards the multimedia recording request message to the multimedia information verification trusted application module.

[0124] It should be noted that the multimedia information verification application module can determine whether the camera hardware module needs to be called in a trusted environment according to the business information of using the camera. For example, it can be defined in advance which businesses need to call the camera hardware module in a trusted environment. When the multimedia information verification application module obtains the business information, the business information is compared with the predefined business. If it belongs to the predefined business, it is determined that the business needs to call the camera hardware module in a trusted environment.

[0125] It should be noted that the implementation manner of the multimedia information verification application module determining whether the camera hardware module needs to be called in the trusted environment in the embodiments of the present application is merely an example, and the embodiments of the present application are not limited to the implementation manner of the example, and other implementation manners capable of determining whether the camera hardware module needs to be called in the trusted environment also belong to the protection scope of the embodiments of the present application.

[0126] Optionally, in an implementation manner, the multimedia recording request message comprises at least one of the following:

[0127] A11, instruction information of taking a picture in a trusted environment;

[0128] It should be noted that taking a picture in a trusted environment can be understood as taking a picture in a TEE hardware isolation manner, in which case any application on the REE side cannot tamper with the information taken by the camera.

[0129] A12, information to be taken;

[0130] It should be noted that the information to be taken includes but is not limited to the user's facial features, ID photos, etc.

[0131] A13, service information;

[0132] Optionally, the service information includes but is not limited to service name, service attribute, etc.

[0133] Optionally, in an implementation manner, the multimedia information verification trusted application module running in the virtual machine calls the camera hardware module according to the multimedia recording request message to obtain multimedia information, comprising:

[0134] The multimedia information verification trusted application module running in the virtual machine calls the trusted camera driver module according to the multimedia recording request message to obtain multimedia information.

[0135] The trusted camera driver module runs in the virtual machine or the TEE.

[0136] It should be noted that in this case, the multimedia information verification trusted application module calls the trusted camera driver module in the virtual machine or the TEE, that is, the trusted camera driver module needs to be added in the virtual machine or the TEE, and the multimedia information collected in this case cannot be tampered with by other applications.

[0137] Further optionally, in an implementation manner, the multimedia information verification trusted application module running in the virtual machine calls the trusted camera driver module according to the multimedia recording request message to obtain multimedia information, comprising:

[0138] Step 11, the multimedia information verification trusted application module running in the virtual machine sends a multimedia recording request message to a trusted camera service module, the trusted camera service module running in the virtual machine or in the TEE;

[0139] It should be noted that in this case, a trusted camera service module is added to the trusted camera driver module, and the trusted camera service module and the trusted camera driver module are located in the virtual machine or the TEE.

[0140] Optionally, if the trusted camera service module and the trusted camera driver module are located in the TEE, the trusted camera service module can directly communicate with the multimedia information verification trusted application module in the virtual machine; or the trusted camera service module cannot directly communicate with the multimedia information verification trusted application module in the virtual machine, but communicates with the multimedia information verification trusted application module through the multimedia digital signature trusted application module in the multimedia digital signature application module.

[0141] Step 12, the trusted camera service module calls the trusted camera driver module according to the multimedia recording request message to initiate a multimedia recording request;

[0142] Step 13, the trusted camera driver module calls the camera hardware module;

[0143] Step 14, the multimedia information verification trusted application module running in the virtual machine acquires multimedia information;

[0144] The multimedia information includes raw data collected by the camera hardware module and multimedia attribute information generated by the multimedia information verification trusted application module, and the multimedia attribute information includes at least one of the following: a service name triggering multimedia recording, a shooting location, a shooting time, and a device model.

[0145] It should be noted that after the camera hardware module collects the raw data, the raw data is usually stored in the memory, and the trusted camera driver module feeds back a memory address storing the raw data to the multimedia information verification trusted application module through the trusted camera service module. The multimedia information verification trusted application module can directly acquire the raw data from the memory based on the memory address.

[0146] Optionally, in an implementation, the multimedia digital signature application module running in the target object signs the multimedia information to acquire multimedia signature information, including:

[0147] Step 21, the multimedia digital signature application module running in the target object receives a signature request message sent by the multimedia information verification trusted application module, and the signature request message includes a hash value acquired based on the multimedia information;

[0148] It should be noted that after the multimedia information verification trusted application module obtains the original data, the multimedia information verification trusted application module processes the obtained original data, such as compressing the original data, obtaining the time and location at which the original data is captured, and the like, and then performs a hash calculation on multimedia information that needs to be returned to the server, including the original data and multimedia attribute information (such as the time, location, device information (such as the OS version, device model, and the like), and service information (such as the name, attribute, and the like) of this access) corresponding to the multimedia information, to obtain a hash value; and then the hash value is sent to the multimedia digital signature application module.

[0149] Step 22, the multimedia digital signature application module running in the target object signs the hash value using a device private key to obtain multimedia signature information.

[0150] Step 23, the multimedia digital signature application module running in the target object sends target information to the multimedia information verification trusted application module, the target information including the multimedia signature information and certificate information, and the certificate information including a device certificate and / or a server certificate.

[0151] Optionally, the multimedia digital signature application module runs in the TEE and / or the SE.

[0152] It should be noted that by signing the hash value by the multimedia digital signature application module running in the TEE and / or the SE, the server can verify whether the sent multimedia information is tampered with, thereby ensuring the reliability of the sent information.

[0153] Optionally, in one implementation, the multimedia digital signature application module includes a key management module, and the key management module runs in the TEE or the SE. Optionally, in another implementation, in one case, the multimedia digital signature application module includes a multimedia digital signature trusted application module and a key management module, and the multimedia digital signature trusted application module and the key management module both run in the TEE or the SE; in another case, the multimedia digital signature trusted application module runs in the TEE, and the key management module runs in the SE. Optionally, in this case, the multimedia digital signature application module running in the target object signs the hash value using a device private key to obtain multimedia signature information, and the specific implementation includes the following steps.

[0154] The multimedia digital signature trusted application module sends the signature request message to the key management module.

[0155] The key management module signs the hash value according to the device private key to obtain the multimedia signature information.

[0156] It should be noted that when the multimedia digital signature trusted application module and the key management module run in different environments, the hash value needs to be signed by the key management module running in the SE.

[0157] Optionally, in an implementation, the multimedia information verification trusted application module running in the virtual machine sends the multimedia signature information and the multimedia information to the server, comprising:

[0158] The multimedia information verification trusted application module running in the virtual machine passes the multimedia signature information and the multimedia information to the multimedia information verification application module running in the REE.

[0159] The multimedia information verification application module running in the REE sends the multimedia signature information and the multimedia information to the server.

[0160] Further optionally, in an implementation, the multimedia information verification trusted application module running in the virtual machine passes the multimedia signature information and the multimedia information to the multimedia information verification application module running in the REE, comprising:

[0161] The multimedia information verification trusted application module running in the virtual machine sends the multimedia signature information and the multimedia information to the multimedia information verification application module running in the REE through a client application module running in the camera framework layer of the REE.

[0162] It should be noted that after the multimedia information verification trusted application module obtains the multimedia signature information, the multimedia information verification trusted application module needs to first send the multimedia signature information and the multimedia information to the client application module of the camera framework layer, the client application module sends the multimedia signature information and the multimedia information to the multimedia information verification application module, and the multimedia information verification application module sends the multimedia signature information and the multimedia information to the server; optionally, the multimedia information verification application module can also obtain some additional information (such as device information, service information, address information, etc.), and send the additional information together with the multimedia signature information and the multimedia information to the server. It should be noted that the information sent by the multimedia information verification application module to the server needs to be securely protected according to an existing security protocol (such as the Transport Layer Security (TLS) or the Hypertext Transfer Protocol Secure (HTTPs)), such as encrypting the message to prevent the information from being stolen during transmission, and integrity protecting the message to prevent the information from being tampered with during transmission.

[0163] Optionally, after receiving the information sent by the multimedia information verification application module, the server needs to verify the multimedia signature information, and after verification, the multimedia information is processed.

[0164] Optionally, in an implementation, the server verifies the multimedia signature information, and the specific implementation includes:

[0165] According to the root certificate of the server, it is verified whether the server certificate is valid;

[0166] In the case that the server certificate is valid, it is verified whether the device certificate is valid according to the server certificate;

[0167] In the case that the device certificate is valid, it is verified whether the multimedia signature information is valid according to the device certificate.

[0168] It should be noted that, in the case that the signature is verified to be valid, the server needs to process the multimedia information, and the processing mode includes: according to the original business logic, it is further verified whether the multimedia information meets the business access requirements, such as whether the time and place of shooting the multimedia information are reasonable, whether the multimedia information is shot for the business, whether the shot information is valid, whether the biological feature verification is successful, and the like.

[0169] Optionally, in an implementation, the server mentioned in the embodiments of the present application can include: a mobile service server and a mobile device management server; wherein the mobile service server includes an improved multimedia information verification service module, which is used to communicate with the multimedia information verification application module on the electronic device side; the mobile device management server includes: a certificate management module, which is used to generate a server public / private key pair, store the server private key in a hardware security module (HSM), and generate a server certificate according to the server public key and send it to the electronic device.

[0170] It should be noted that, in the embodiments of the present application, the camera hardware module is driven to shoot in a hardware isolation manner in the TEE; and the shot multimedia information is processed (such as face detection / interaction judgment, ID photo area selection, compression, and the like) in a software isolation manner in a virtualized environment; then the processed multimedia information is digitally signed based on the key management of the TEE; finally, the multimedia information and the multimedia signature information of the digital signature are sent to the server. In the process of transmitting the multimedia information, any tampering will cause the digital signature verification to fail in the server, thereby realizing the security protection of the whole link of the electronic device shooting to obtain the multimedia information, that is, the integrity and security protection from the camera shooting driven in a trusted manner, to obtaining the trusted multimedia information, and finally transmitting to the server.

[0171] The specific implementation of the embodiments of the present application is described as follows.

[0172] It should be noted that the embodiments of the present application mainly involve the following functional modules:

[0173] The multimedia information verification service module of the server can verify the digital signature of the multimedia information from the electronic device, and determine whether the multimedia information is captured by the claimed electronic device.

[0174] The multimedia information verification application module of the electronic device and the client application module of the camera framework layer support that the electronic device can use the camera to capture the required information in a hardware isolated environment, and support the identification of when and where the multimedia information is captured by which electronic device.

[0175] The trusted camera service module of the electronic device supports driving the camera to take pictures in a hardware isolated manner, in which case any application on the REE side has no access to the camera resources, thereby reducing the attack of malicious applications on the REE side when taking pictures with the camera.

[0176] The multimedia digital signature trusted application module of the electronic device and the key management module support the digital signature of the multimedia information to prove to the verifier of the digital signature that the multimedia information is captured by the claimed electronic device; wherein the key management module generates a pair of public / private keys (which can be one pair for each electronic device, or one pair shared by electronic devices of the same chip platform) for the multimedia information verification service, which is called device public / private key pair in the embodiments of the present application, and there are device public key, device private key and device certificate accordingly; the multimedia digital signature trusted application module signs the multimedia information using the device private key.

[0177] The multimedia information verification trusted application module of the electronic device supports corresponding processing (such as face detection / interaction judgment, ID photo area selection, compression, etc.) of the captured multimedia information, and triggers related operations such as digital signature.

[0178] The certificate management module of the server needs to generate a pair of public / private keys with the help of key management service (KMS) and hardware security module (such as HSM), which is called server public / private key pair in the embodiments of the present application, and mainly implements: generating a server certificate based on the server public key; signing the device public key with the server private key to generate a device certificate; the server certificate is used for certificate chain signature verification, that is, the server certificate verifies whether the device certificate is correct and effective, and the device certificate verifies whether the signature of the multimedia information is correct and effective.

[0179] It should be noted that, before the embodiments of the present application are performed, initialization based on end-side virtualization information security protection needs to be performed, specifically including:

[0180] The electronic device implements the following processes:

[0181] The TEE generates a device public / private key pair, encrypts the device private key using a device root key (from the hardware trust root), and then securely stores it;

[0182] The electronic device securely sends (e.g., based on TLS, HTTPS protocol) the device public key to the mobile device management server, generates a device certificate, and securely stores it;

[0183] The electronic device obtains the server certificate and securely stores it.

[0184] The certificate management module of the mobile device management server implements the following processes:

[0185] Generate a server public / private key pair and store the server private key in the HSM;

[0186] Generate a server certificate based on the server public key and send it to the electronic device.

[0187] An architecture of an embodiment of the present application is shown in FIGS. 2 and 3. The difference between FIGS. 2 and 3 is that in FIG. 2, the trusted camera service module and the trusted camera driver module are located in the VM, and in FIG. 3, the trusted camera service module and the trusted camera driver module are located in the TEE. Optionally, if the trusted camera service module and the trusted camera driver module are located in the TEE, the trusted camera service module can directly communicate with the multimedia information verification trusted application module in the VM; or the trusted camera service module cannot directly communicate with the multimedia information verification trusted application module in the VM, but communicates with the multimedia information verification trusted application module through the multimedia digital signature trusted application module in the multimedia digital signature application module.

[0188] For example, taking the architecture shown in FIG. 3 as an example, taking camera acquisition of multimedia as an example, the specific communication process is shown in FIG. 4, which mainly includes:

[0189] Step 401, the multimedia information verification service module of the server sends a camera use request message to the multimedia information verification application module in the REE of the electronic device, requesting the electronic device to take a photo of the required information (such as a face, an ID photo, etc.) to provide multimedia information for business verification;

[0190] Step 402, the multimedia information verification application module of the REE of the electronic device identifies that the photographing needs to be performed in a trusted environment, and forwards a multimedia recording request message to the client application module of the camera framework layer, the message containing (but not limited to): an instruction to perform photographing in a trusted environment (i.e. a hardware isolation manner of the TEE, in this case, any application on the REE side cannot tamper with the information photographed by the camera), the information to be photographed, service information, etc.

[0191] Step 403, the client application module of the camera framework layer identifies that the multimedia recording request message needs to be performed in a trusted environment, and forwards the multimedia recording request message to the multimedia information verification trusted application module of the VM;

[0192] Step 404, the multimedia information verification trusted application module sends a multimedia recording request message to the trusted camera service module of the TEE;

[0193] Step 405, the trusted camera service module calls the trusted camera driver module to initiate a multimedia recording request;

[0194] Step 406, the trusted camera driver module starts the hardware camera function to photograph the required information in a hardware isolated manner; in this step, many interactive information is omitted, such as the need for liveness detection and face comparison when face recognition is performed, the need to verify the photographing range and clarity of an ID photo when an ID photo is photographed, etc.

[0195] Step 407, the camera driver module returns the photographed raw data to the trusted camera service module;

[0196] Step 408, the trusted camera service module returns the photographed raw data to the multimedia information verification trusted application module;

[0197] Step 409, the multimedia information verification trusted application module processes the obtained raw data, such as compressing the raw data, obtaining the time and location of photographing the raw data, etc., and then performs a hash calculation on the multimedia information including the raw data and the multimedia attribute information (such as the time, location, device information (such as the OS version, device model, etc.), and service information (such as the name, attribute, etc.) of this access) to be returned to the server, to obtain a hash value;

[0198] Step 410, the multimedia information verification trusted application module sends a signature request message to the multimedia digital signature trusted application module, the message containing the hash value calculated in the previous step;

[0199] Step 411, the multimedia digital signature trusted application module requests a device private key from the key management module;

[0200] Step 412, the multimedia digital signature trusted application module signs the hash value using the device private key;

[0201] Step 413, the multimedia digital signature trusted application module returns the multimedia signature information to the multimedia information verification trusted application module;

[0202] Step 414, the multimedia information verification trusted application module returns the multimedia information and the corresponding multimedia signature information to the client application module of the camera framework layer;

[0203] Step 415, the client application module of the camera framework layer returns the multimedia information and the corresponding multimedia signature information to the multimedia information verification application module;

[0204] Step 416, the multimedia information verification application module obtains some additional information (such as device information, service information, address information, etc.);

[0205] Step 417, the multimedia information verification application module returns the additional information, the multimedia information and the corresponding multimedia signature information to the multimedia information verification service module of the server, and these returned information is securely protected according to an existing security protocol (such as TLS, HTTPs), such as encrypting the message to prevent information from being stolen during transmission, and integrity protection of the message to prevent information from being tampered with during transmission;

[0206] Step 418, after receiving the returned message, the multimedia information verification service module of the server performs verification and processing operations, which specifically include the following operations:

[0207] Verify whether the server certificate is valid based on the root certificate of the server;

[0208] Verify whether the device certificate is valid based on the server certificate;

[0209] Verify whether the signature of the multimedia information is valid or tampered with based on the device certificate.

[0210] In the case that the signature of the multimedia information is valid or not tampered with, further verify whether the multimedia information meets the access requirements of the service according to the original service logic, such as whether the time and place of shooting the multimedia are reasonable, whether the multimedia information is shot for the service, whether the ID photo information is valid, whether the biological feature verification is successful, etc.

[0211] It should be noted that the SE-based key management is more secure than the TEE-based key management. Therefore, if the device public / private key pair in the present application and the signature of the multimedia information are performed in the SE, the security of the system can be improved.

[0212] As shown in FIG. 5, FIG. 6 and FIG. 7, which are three different architecture diagrams, in FIG. 5, all units of the multimedia digital signature application module are located in the SE, the trusted camera service module and the trusted camera driver module are located in the VM; in FIG. 6, the multimedia digital signature trusted application module in the multimedia digital signature application module is located in the TEE, the key management module is located in the SE, and the trusted camera service module and the trusted camera driver module are located in the VM; in FIG. 7, the multimedia digital signature trusted application module in the multimedia digital signature application module is located in the TEE, the key management module is located in the SE, and the trusted camera service module and the trusted camera driver module are located in the TEE.

[0213] It should be noted that, when only the key management module is located in the SE, the hash value needs to be signed by the key management module.

[0214] It should be noted that, the embodiments of the present application can achieve the following beneficial effects:

[0215] When remote identity verification is performed based on biometric recognition (such as face recognition), attacks in the form of synthesis or editing of face multimedia are prevented or reduced;

[0216] When an effective certificate is registered online, attacks in the form of tampering or replacing of a certificate photo are prevented or reduced.

[0217] As shown in FIG. 8, at least one embodiment of the present application further provides a multimedia information secure transmission method, comprising:

[0218] Step 801, sending a camera use request message to an electronic device;

[0219] Step 802, receiving multimedia signature information and multimedia information fed back by a multimedia information verification trusted application module running in a virtual machine of the electronic device;

[0220] Step 803, verifying the multimedia signature information;

[0221] Step 804, processing the multimedia information after verification.

[0222] Optionally, the verification of the multimedia signature information comprises:

[0223] Verifying whether a server certificate is valid according to a root certificate of the server;

[0224] In the case that the server certificate is valid, verifying whether a device certificate is valid according to the server certificate;

[0225] In the case that the device certificate is valid, verifying whether the multimedia signature information is valid according to the device certificate.

[0226] It should be noted that all the server-side descriptions in the above embodiments are applicable to the embodiments of the multimedia information secure transmission method applied to the server, and the same technical effects can be achieved, and will not be repeated here.

[0227] As shown in FIG. 9, at least one embodiment of the present application further provides a multimedia information secure transmission device applied to an electronic device, wherein the electronic device is deployed with a virtual machine and a target object, and the target object includes a TEE and / or a SE; the device includes:

[0228] a multimedia information verification trusted application module 901 running in the virtual machine, configured to call a camera hardware module to obtain multimedia information according to a multimedia recording request message, wherein the multimedia recording request message is determined based on a camera use request message sent by a server;

[0229] a multimedia digital signature application module 902 running in the target object, configured to sign the multimedia information to obtain multimedia signature information;

[0230] The multimedia information verification trusted application module 901 is further configured to send the multimedia signature information and the multimedia information to the server.

[0231] Optionally, the device further includes:

[0232] a multimedia information verification application module running in a general execution environment (REE), configured to receive a camera use request message sent by a server;

[0233] When it is determined that the camera hardware module needs to be called in a trusted environment, a multimedia recording request message is sent to the multimedia information verification trusted application module by a client application module running in a camera framework layer in the REE.

[0234] Optionally, the multimedia recording request message includes at least one of the following:

[0235] indication information of photographing in a trusted environment;

[0236] information to be photographed;

[0237] service information.

[0238] Optionally, the multimedia information verification trusted application module is configured to:

[0239] call a trusted camera driver module according to the multimedia recording request message to obtain multimedia information;

[0240] The trusted camera driver module runs in the virtual machine or the TEE.

[0241] Optionally, the multimedia information verification trusted application module is configured to:

[0242] send a multimedia recording request message to a trusted camera service module, the trusted camera service module being run in the virtual machine or the TEE;

[0243] a trusted camera service module configured to invoke a trusted camera driver module according to the multimedia recording request message to initiate a multimedia recording request;

[0244] a trusted camera driver module configured to invoke the camera hardware module;

[0245] the multimedia information verification trusted application module is further configured to acquire multimedia information;

[0246] wherein the multimedia information comprises raw data collected by the camera hardware module and multimedia attribute information generated by the multimedia information verification trusted application module, and the multimedia attribute information comprises at least one of the following: a service name triggering the multimedia recording, a location of shooting, a time of shooting, and a device model of shooting.

[0247] Optionally, the multimedia digital signature application module is configured to:

[0248] receive a signature request message sent by the multimedia information verification trusted application module, the signature request message comprising a hash value acquired based on the multimedia information;

[0249] sign the hash value with a device private key to acquire multimedia signature information;

[0250] send target information to the multimedia information verification trusted application module, the target information comprising multimedia signature information and certificate information, and the certificate information comprising a device certificate and / or a server certificate;

[0251] wherein the multimedia digital signature application module is run in the TEE and / or the SE.

[0252] Optionally, in a case where the multimedia digital signature application module comprises a multimedia digital signature trusted application module and a key management module, and the multimedia digital signature trusted application module is run in the TEE and the key management module is run in the SE, the multimedia digital signature trusted application module is configured to send the signature request message to the key management module.

[0253] the key management module is configured to sign the hash value with a device private key to acquire multimedia signature information.

[0254] Optionally, the multimedia information verification trusted application module is configured to:

[0255] The multimedia signature information and the multimedia information are transmitted to a multimedia information verification application module running in the REE.

[0256] The multimedia information verification application module is configured to transmit the multimedia signature information and the multimedia information to the server.

[0257] Optionally, the multimedia information verification trusted application module is configured to:

[0258] The multimedia signature information and the multimedia information are transmitted to a multimedia information verification application module running in the REE by a client application module running in a camera framework layer of the REE.

[0259] It should be noted that the apparatus embodiment corresponds to the method described above, and all implementation manners in the method embodiment are applicable to the apparatus embodiment, and the same technical effects can be achieved.

[0260] The multimedia information security transmission apparatus provided in the embodiments of the present application can implement each process achieved by the method embodiment of FIG. 1, and achieve the same technical effects. To avoid repetition, details are not described herein.

[0261] The embodiments of the present application further provide an electronic device, which is deployed with a virtual machine and a target object, the target object including a TEE and / or a SE; and includes a processor and a communication interface, the processor being configured to:

[0262] The multimedia information verification trusted application module running in the virtual machine acquires multimedia information by invoking a camera hardware module according to a multimedia recording request message, the multimedia recording request message being determined based on a camera use request message sent by the server;

[0263] The multimedia digital signature application module running in the target object signs the multimedia information to acquire multimedia signature information.

[0264] The multimedia information verification trusted application module running in the virtual machine transmits the multimedia signature information and the multimedia information to the server.

[0265] Optionally, the processor is configured to:

[0266] The multimedia information verification application module running in the REE receives a camera use request message sent by the server.

[0267] The multimedia information verification application module running in a general execution environment (REE) sends a multimedia recording request message to the multimedia information verification trusted application module through a client application module of a camera framework layer running in the REE when it is determined that the camera hardware module needs to be invoked in a trusted environment.

[0268] Optionally, the multimedia recording request message comprises at least one of the following:

[0269] indication information of taking a photo in a trusted environment;

[0270] information needed for taking a photo;

[0271] service information.

[0272] Optionally, the processor is configured to:

[0273] the multimedia information verification trusted application module running in the virtual machine invokes a trusted camera driver module according to the multimedia recording request message to obtain multimedia information;

[0274] The trusted camera driver module runs in the virtual machine or the TEE.

[0275] Optionally, the processor is configured to:

[0276] the multimedia information verification trusted application module running in the virtual machine sends a multimedia recording request message to a trusted camera service module, and the trusted camera service module runs in the virtual machine or the TEE;

[0277] the trusted camera service module invokes a trusted camera driver module according to the multimedia recording request message to initiate a multimedia recording request;

[0278] the trusted camera driver module invokes the camera hardware module;

[0279] the multimedia information verification trusted application module running in the virtual machine obtains multimedia information;

[0280] The multimedia information comprises raw data collected by the camera hardware module and multimedia attribute information generated by the multimedia information verification trusted application module, and the multimedia attribute information comprises at least one of the following: a service name triggering multimedia recording, a location of taking a photo, a time of taking a photo, and a device model of taking a photo.

[0281] Optionally, the processor is configured to:

[0282] The multimedia digital signature application module running in the target object receives a signature request message sent by the multimedia information verification trusted application module, the signature request message including a hash value obtained based on the multimedia information;

[0283] The multimedia digital signature application module running in the target object signs the hash value using a device private key to obtain multimedia signature information;

[0284] The multimedia digital signature application module running in the target object sends target information to the multimedia information verification trusted application module, the target information including multimedia signature information and certificate information, and the certificate information including a device certificate and / or a server certificate;

[0285] The multimedia digital signature application module runs in a TEE and / or an SE.

[0286] Optionally, in a case where the multimedia digital signature application module includes a multimedia digital signature trusted application module and a key management module, and the multimedia digital signature trusted application module runs in the TEE and the key management module runs in the SE, the processor is configured to:

[0287] The multimedia digital signature trusted application module sends the signature request message to the key management module;

[0288] The key management module signs the hash value using a device private key to obtain multimedia signature information.

[0289] Optionally, the processor is configured to:

[0290] The multimedia information verification trusted application module running in the virtual machine passes the multimedia signature information and the multimedia information to a multimedia information verification application module running in the REE;

[0291] The multimedia information verification application module running in the REE sends the multimedia signature information and the multimedia information to the server.

[0292] Optionally, the processor is configured to:

[0293] The multimedia information verification trusted application module running in the virtual machine sends the multimedia signature information and the multimedia information to the multimedia information verification application module running in the REE through a client application module running in a camera framework layer in the REE.

[0294] Preferably, the embodiments of the present application further provide an electronic device, which is deployed with a virtual machine and a target object, the target object comprising a TEE and / or a SE, comprising a processor, a memory, a program or instruction stored on the memory and executable on the processor, which, when executed by the processor, implements each process of the above-mentioned monitoring method embodiments and achieves the same technical effects. The electronic device can be the multimedia information security transmission device shown in FIG. 9. Specifically, FIG. 10 is a schematic diagram of a hardware structure of an electronic device for implementing the embodiments of the present application.

[0295] The electronic device 1000 includes, but is not limited to, at least part of the components such as a radio frequency unit 1001, a network module 1002, an audio output unit 1003, an input unit 1004, a sensor 1005, a display unit 1006, a user input unit 1007, an interface unit 1008, a memory 1009, and a processor 1010.

[0296] Those skilled in the art can understand that the electronic device 1000 can further include a power supply (such as a battery) for supplying power to each component, and the power supply can be logically connected to the processor 1010 through a power management system, so as to realize functions such as management of charging, discharging, and power consumption management through the power management system. The electronic device structure shown in FIG. 10 does not constitute a limitation on the electronic device, and the electronic device can include more or fewer components than those shown, or combine certain components, or different component arrangements, which are not described here.

[0297] It should be understood that in the embodiments of the present application, the input unit 1004 can include a graphics processor 10041 and a microphone 10042, and the graphics processor 10041 processes image data of still multimedia or video obtained by an image capture device (such as a camera) in a video capture mode or an image capture mode. The display unit 1006 can include a display panel 10061, which can be configured in the form of a liquid crystal display, an organic light-emitting diode, etc. The user input unit 1007 includes at least one of a touch panel 10071 and other input devices 10072. The touch panel 10071 is also called a touch screen. The touch panel 10071 can include two parts of a touch detection device and a touch controller. The other input devices 10072 can include, but are not limited to, a physical keyboard, function keys (such as volume control keys, on-off keys, etc.), a trackball, a mouse, a joystick, etc., which are not described here.

[0298] In the embodiments of the present application, the radio frequency unit 1001 can transmit the downlink data received from the access network device to the processor 1010 for processing. In addition, the radio frequency unit 1001 can send uplink data to the network side device. Generally, the radio frequency unit 1001 includes but is not limited to an antenna, an amplifier, a transceiver, a coupler, a low noise amplifier, a duplexer, etc.

[0299] The memory 1009 can be used to store software programs or instructions and various data. The memory 1009 can mainly include a first storage area for storing programs or instructions and a second storage area for storing data, wherein the first storage area can store an operating system, application programs or instructions required by at least one function (such as a sound playing function, an image playing function, etc.), etc. In addition, the memory 1009 can include a volatile memory or a non-volatile memory, or the memory 1009 can include both volatile and non-volatile memories. The non-volatile memory can be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM) or a flash memory. The volatile memory can be a random access memory (RAM), a static random access memory (SRAM), a dynamic random access memory (DRAM), a synchronous dynamic random access memory (SDRAM), a double data rate synchronous dynamic random access memory (DDR SDRAM), an enhanced synchronous dynamic random access memory (ESDRAM), a synch link dynamic random access memory (SLDRAM) and a direct memory bus random access memory (Direct Rambus RAM, DRRAM). The memory 1009 in the embodiments of the present application includes but is not limited to these and any other suitable types of memory.

[0300] The processor 1010 can include one or more processing units; optionally, the processor 1010 integrates an application processor and a modem processor, wherein the application processor mainly processes operations related to an operating system, a user interface and an application program, and the modem processor mainly processes wireless communication signals, such as a baseband processor. It can be understood that the above-mentioned modem processor can also not be integrated into the processor 1010.

[0301] The processor is configured to:

[0302] The multimedia information verification trusted application module running in the virtual machine calls the camera hardware module according to the multimedia recording request message to obtain multimedia information, where the multimedia recording request message is determined based on the camera use request message sent by the server;

[0303] The multimedia digital signature application module running in the target object signs the multimedia information to obtain multimedia signature information;

[0304] The multimedia information verification trusted application module running in the virtual machine sends the multimedia signature information and the multimedia information to the server.

[0305] Optionally, the processor is configured to:

[0306] The multimedia information verification application module running in the general execution environment (REE) receives the camera use request message sent by the server;

[0307] The multimedia information verification application module running in the general execution environment (REE) sends a multimedia recording request message to the multimedia information verification trusted application module through a client application module of a camera framework layer running in the REE when it is determined that the camera hardware module needs to be called in a trusted environment.

[0308] Optionally, the multimedia recording request message comprises at least one of the following:

[0309] Indication information of taking a photo in a trusted environment;

[0310] Information to be photographed;

[0311] Business information.

[0312] Optionally, the processor is configured to:

[0313] The multimedia information verification trusted application module running in the virtual machine calls a trusted camera driver module according to the multimedia recording request message to obtain multimedia information;

[0314] The trusted camera driver module runs in the virtual machine or the TEE.

[0315] Optionally, the processor is configured to:

[0316] The multimedia information verification trusted application module running in the virtual machine sends a multimedia recording request message to a trusted camera service module, where the trusted camera service module runs in the virtual machine or the TEE;

[0317] The trusted camera service module invokes a trusted camera driver module according to the multimedia recording request message, and initiates the multimedia recording request;

[0318] The trusted camera driver module invokes the camera hardware module;

[0319] A multimedia information verification trusted application module running in the virtual machine acquires multimedia information;

[0320] The multimedia information includes original data collected by the camera hardware module and multimedia attribute information generated by the multimedia information verification trusted application module, and the multimedia attribute information includes at least one of the following: a service name triggering the multimedia recording, a shooting location, a shooting time, and a shooting device model.

[0321] Optionally, the processor is configured to:

[0322] A multimedia digital signature application module running in the target object receives a signature request message sent by the multimedia information verification trusted application module, and the signature request message includes a hash value acquired based on the multimedia information;

[0323] The multimedia digital signature application module running in the target object signs the hash value using a device private key to acquire multimedia signature information;

[0324] The multimedia digital signature application module running in the target object sends target information to the multimedia information verification trusted application module, and the target information includes multimedia signature information and certificate information, and the certificate information includes a device certificate and / or a server certificate;

[0325] The multimedia digital signature application module runs in a TEE and / or an SE.

[0326] Optionally, in a case where the multimedia digital signature application module includes a multimedia digital signature trusted application module and a key management module, and the multimedia digital signature trusted application module runs in the TEE and the key management module runs in the SE, the processor is configured to:

[0327] The multimedia digital signature trusted application module sends the signature request message to the key management module;

[0328] The key management module signs the hash value using a device private key to acquire multimedia signature information.

[0329] Optionally, the processor is configured to:

[0330] The multimedia information verification trusted application module running in the virtual machine transmits the multimedia signature information and the multimedia information to a multimedia information verification application module running in the REE.

[0331] The multimedia information verification application module running in the REE sends the multimedia signature information and the multimedia information to the server.

[0332] Optionally, the processor is configured to:

[0333] The multimedia information verification trusted application module running in the virtual machine transmits the multimedia signature information and the multimedia information to the multimedia information verification application module running in the REE through a client application module of a camera framework layer running in the REE.

[0334] As shown in FIG. 11, at least one embodiment of the present application further provides a multimedia information secure transmission apparatus, comprising:

[0335] The sending module 1101 is configured to send a camera use request message to an electronic device.

[0336] The receiving module 1102 is configured to receive multimedia signature information and multimedia information fed back by a multimedia information verification trusted application module running in a virtual machine of the electronic device.

[0337] The verification module 1103 is configured to verify the multimedia signature information.

[0338] The processing module 1104 is configured to process the multimedia information after the verification is passed.

[0339] Optionally, the verification module 1103 is configured to:

[0340] verify whether the server certificate is valid according to a root certificate of the server;

[0341] verify whether a device certificate is valid according to the server certificate in the case that the server certificate is valid;

[0342] verify whether the multimedia signature information is valid according to the device certificate in the case that the device certificate is valid.

[0343] It should be noted that the apparatus embodiment corresponds to the above method, and all implementation manners in the method embodiment are applicable to the apparatus embodiment, and the same technical effects can be achieved.

[0344] The multimedia information secure transmission apparatus provided in the embodiment of the present application can implement each process implemented by the method embodiment of FIG. 8 and achieve the same technical effects. To avoid repetition, no further description is given here.

[0345] The embodiment of the present application further provides a server, comprising a processor and a communication interface, wherein the communication interface is used for sending a camera use request message to an electronic device; receiving multimedia signature information and multimedia information fed back by a multimedia information verification trusted application module in a virtual machine running on the electronic device;

[0346] The processor is used for verifying the multimedia signature information; and processing the multimedia information after verification.

[0347] Optionally, the processor is used for:

[0348] verifying whether a server certificate is valid according to a root certificate of the server;

[0349] verifying whether a device certificate is valid according to the server certificate in the case that the server certificate is valid;

[0350] verifying whether the multimedia signature information is valid according to the device certificate in the case that the device certificate is valid.

[0351] As shown in Fig. 12, the embodiment of the present application further provides a server, comprising a processor 1200, a transceiver 1210, a memory 1220, and a program stored in the memory 1220 and executable on the processor 1200; wherein the transceiver 1210 is connected with the processor 1200 and the memory 1220 through a bus interface, and the transceiver 1210 is used for receiving and sending data under the control of the processor 1200.

[0352] In Fig. 12, the bus architecture can comprise any number of interconnected buses and bridges, which are linked together by various circuits of the processor 1200 representing one or more processors and the memory 1220 representing a memory. The bus architecture can also link various other circuits such as peripheral devices, voltage stabilizers and power management circuits, which are well known in the art, and thus, no further description is given herein. The bus interface provides an interface. The transceiver 1210 can be a plurality of elements, i.e., comprising a transmitter and a receiver, which provide units for communicating with various other devices on transmission media, including wireless channels, wired channels, optical cables, etc. The user interface 1230 can also be an interface capable of connecting required devices externally or internally for different user devices, including but not limited to a keypad, a display, a speaker, a microphone, a joystick, etc.

[0353] The processor 1200 is responsible for managing the bus architecture and general processing, and the memory 1220 can store data used by the processor 1200 when performing operations.

[0354] Optionally, the processor 1200 can be a CPU (Central Processing Unit), an ASIC (Application Specific Integrated Circuit), an FPGA (Field-Programmable Gate Array) or a CPLD (Complex Programmable Logic Device), and the processor can also adopt a multi-core architecture.

[0355] The processor is configured to execute any of the methods provided by the embodiments of the present application by invoking the computer program stored in the memory.

[0356] The processor is configured to read the computer program in the memory to perform the following operations:

[0357] sending a camera usage request message to the electronic device;

[0358] receiving multimedia signature information and multimedia information fed back by a multimedia information verification trusted application module running in a virtual machine of the electronic device;

[0359] verifying the multimedia signature information;

[0360] processing the multimedia information after verification.

[0361] Optionally, the processor is configured to read the computer program in the memory to perform the following operations:

[0362] verifying whether the server certificate is valid according to the root certificate of the server;

[0363] verifying whether the device certificate is valid according to the server certificate in the case that the server certificate is valid;

[0364] verifying whether the multimedia signature information is valid according to the device certificate in the case that the device certificate is valid.

[0365] The embodiments of the present application also provide a readable storage medium, and the readable storage medium stores a program or instructions, which are executed by a processor to implement each process of the multimedia information security transmission method embodiments and achieve the same technical effects. To avoid repetition, details are not described herein.

[0366] The readable storage medium can be non-volatile and non-transient. The readable storage medium can include a computer readable storage medium, such as a computer readable memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, etc.

[0367] The embodiment of the present application further provides a computer program / program product stored in a storage medium, which is executed by at least one processor to realize each process of the multimedia information secure transmission method embodiment and achieve the same technical effects. To avoid repetition, details are not described herein.

[0368] The embodiment of the present application is described above in combination with the drawings, but the present application is not limited to the specific implementation described above, which is only illustrative but not restrictive. Those skilled in the art can make many forms under the inspiration of the present application without departing from the scope of the present application and the protection scope of the claims.

Claims

1. A method for secure transmission of multimedia information, applied to an electronic device, wherein the electronic device deploys a virtual machine and a target object, the target object including a Trusted Execution Environment (TEE) and / or a Security Element (SE), comprising: The multimedia information verification trusted application module running in the virtual machine calls the camera hardware module to obtain multimedia information based on the multimedia recording request message. The multimedia recording request message is determined based on the camera usage request message sent by the server. The multimedia digital signature application module running in the target object signs the multimedia information and obtains the multimedia signature information; The multimedia information verification trusted application module running in the virtual machine sends the multimedia signature information and the multimedia information to the server.

2. The method according to claim 1, wherein, Also includes: The multimedia information verification application module, running in the general execution environment REE, receives a camera usage request message sent by the server; When the multimedia information verification application module running in the general execution environment REE determines that it needs to call the camera hardware module in the trusted environment, it sends a multimedia recording request message to the multimedia information verification trusted application module through the client application module running in the camera frame layer of REE.

3. The method according to claim 2, wherein, The multimedia recording request message includes at least one of the following: Instructions for taking photos in a trusted environment; Information that needs to be photographed; Business information.

4. The method according to claim 1, wherein, The multimedia information verification trusted application module running in the virtual machine calls the camera hardware module to obtain multimedia information based on the multimedia recording request message, including: The multimedia information verification trusted application module running in the virtual machine calls the trusted camera driver module to obtain multimedia information based on the multimedia recording request message; The trusted camera driver module runs in the virtual machine or the TEE.

5. The method according to claim 4, wherein, The multimedia information verification trusted application module running in the virtual machine calls the trusted camera driver module according to the multimedia recording request message to obtain multimedia information, including: The multimedia information verification trusted application module running in the virtual machine sends a multimedia recording request message to the trusted camera service module, which runs in the virtual machine or the TEE; The trusted camera service module calls the trusted camera driver module to initiate a multimedia recording request based on the multimedia recording request message. The trusted camera driver module calls the camera hardware module; The multimedia information verification trusted application module running in the virtual machine obtains multimedia information; The multimedia information includes the raw data collected by the camera hardware module and the multimedia attribute information generated by the multimedia information verification trusted application module. The multimedia attribute information includes at least one of the following: the name of the service that triggered the multimedia recording, the shooting location, the shooting time, and the shooting device model.

6. The method according to claim 1, wherein, The multimedia digital signature application module running on the target object signs the multimedia information and obtains multimedia signature information, including: The multimedia digital signature application module running in the target object receives a signature request message sent by the multimedia information verification trusted application module. The signature request message includes a hash value obtained based on the multimedia information. The multimedia digital signature application module running in the target object signs the hash value using the device private key to obtain multimedia signature information; The multimedia digital signature application module running on the target object sends the target information to the multimedia information verification trusted application module. The target information includes multimedia signature information and certificate information. The certificate information includes device certificate and / or server certificate. The multimedia digital signature application module runs in TEE and / or SE.

7. The method according to claim 6, wherein, In the case where the multimedia digital signature application module includes a multimedia digital signature trusted application module and a key management module, and the multimedia digital signature trusted application module runs in a TEE and the key management module runs in an SE, the multimedia digital signature application module running in the target object signs the hash value using the device private key to obtain multimedia signature information, including: The multimedia digital signature trusted application module sends the signature request message to the key management module; The key management module signs the hash value based on the device's private key to obtain multimedia signature information.

8. The method according to claim 1, wherein, The multimedia information verification trusted application module running in the virtual machine sends the multimedia signature information and the multimedia information to the server, including: The multimedia information verification trusted application module running in the virtual machine transmits the multimedia signature information and multimedia information to the multimedia information verification application module running in the REE. The multimedia information verification application module running in REE sends multimedia signature information and multimedia information to the server.

9. The method according to claim 8, wherein, The trusted application module for multimedia information verification running in the virtual machine transmits the multimedia signature information and multimedia information to the multimedia information verification application module running in the REE, including: The multimedia information verification trusted application module running in the virtual machine sends the multimedia signature information and multimedia information to the multimedia information verification application module running in the REE through the client application module running in the camera frame layer of the REE.

10. A method for secure transmission of multimedia information, comprising: Send a camera usage request message to the electronic device; Receive multimedia signature information and multimedia information from the multimedia information verification trusted application module running in the virtual machine of the electronic device; The multimedia signature information is verified; After successful verification, the multimedia information is processed.

11. The method according to claim 10, wherein, The verification of the multimedia signature information includes: Verify the validity of the server certificate based on the server's root certificate; If the server certificate is valid, verify the validity of the device certificate based on the server certificate. If the device certificate is valid, verify the validity of the multimedia signature information based on the device certificate.

12. A multimedia information secure transmission device, applied to an electronic device, the electronic device deploying a virtual machine and a target object, the target object including a Trusted Execution Environment (TEE) and / or a Security Element (SE), comprising: The multimedia information verification trusted application module runs in the virtual machine and is used to call the camera hardware module to obtain multimedia information based on the multimedia recording request message. The multimedia recording request message is determined based on the camera usage request message sent by the server. The multimedia digital signature application module runs in the target object and is used to sign the multimedia information and obtain multimedia signature information. The multimedia information verification trusted application module is also used to send the multimedia signature information and the multimedia information to the server.

13. The apparatus according to claim 12, wherein, Also includes: The multimedia information verification application module runs in the general execution environment REE and is used to receive camera usage request messages sent by the server. If it is determined that the camera hardware module needs to be invoked in a trusted environment, a multimedia recording request message is sent to the multimedia information verification trusted application module through the client application module running in the camera frame layer of the REE.

14. The apparatus according to claim 12 or 13, wherein, The multimedia recording request message includes at least one of the following: Instructions for taking photos in a trusted environment; Information that needs to be photographed; Business information.

15. The apparatus according to claim 12, wherein, The multimedia information verification trusted application module is used for: The trusted camera driver module is invoked based on the multimedia recording request message to obtain multimedia information; The trusted camera driver module runs in the virtual machine or the TEE.

16. The apparatus according to claim 15, wherein, The multimedia information verification trusted application module is used for: Send a multimedia recording request message to the trusted camera service module, which runs in the virtual machine or the TEE; The trusted camera service module is used to call the trusted camera driver module based on the multimedia recording request message to initiate a multimedia recording request; A trusted camera driver module is used to call the camera hardware module; The multimedia information verification trusted application module is also used to acquire multimedia information; The multimedia information includes the raw data collected by the camera hardware module and the multimedia attribute information generated by the multimedia information verification trusted application module. The multimedia attribute information includes at least one of the following: the name of the service that triggered the multimedia recording, the shooting location, the shooting time, and the shooting device model.

17. The apparatus according to claim 12, wherein, The multimedia digital signature application module is used for: The system receives a signature request message sent by the multimedia information verification trusted application module, the signature request message including: a hash value obtained based on the multimedia information; The hash value is signed using the device's private key to obtain multimedia signature information; The target information is sent to the multimedia information verification trusted application module. The target information includes multimedia signature information and certificate information. The certificate information includes device certificate and / or server certificate. The multimedia digital signature application module runs in TEE and / or SE.

18. The apparatus according to claim 17, wherein, In the case where the multimedia digital signature application module includes a multimedia digital signature trusted application module and a key management module, and the multimedia digital signature trusted application module runs in a TEE and the key management module runs in an SE, the multimedia digital signature trusted application module is used to send the signature request message to the key management module. The key management module is used to sign the hash value based on the device private key to obtain multimedia signature information.

19. The apparatus according to claim 12, wherein, The multimedia information verification trusted application module is used for: The multimedia signature information and multimedia information are passed to the multimedia information verification application module running in the REE; The multimedia information verification application module is used to send multimedia signature information and multimedia information to the server.

20. The apparatus according to claim 19, wherein, The multimedia information verification trusted application module is used for: The multimedia signature information and multimedia information are sent to the multimedia information verification application module running in the REE via the client application module running in the camera frame layer.

21. An electronic device comprising a processor, a memory, and a program or instructions stored in the memory and executable on the processor, wherein the program or instructions, when executed by the processor, implement the steps of the multimedia information secure transmission method as described in any one of claims 1-9.

22. A multimedia information security transmission device, comprising: The sending module is used to send camera usage request messages to electronic devices; The receiving module is used to receive multimedia signature information and multimedia information fed back by the multimedia information verification trusted application module running in the virtual machine of the electronic device; The verification module is used to verify the multimedia signature information; The processing module is used to process the multimedia information after the verification is passed.

23. The apparatus according to claim 22, wherein, The verification module is used for: Verify the validity of the server certificate based on the server's root certificate; If the server certificate is valid, verify the validity of the device certificate based on the server certificate. If the device certificate is valid, verify the validity of the multimedia signature information based on the device certificate.

24. A server comprising a processor, a memory, and a program or instructions stored in the memory and executable on the processor, wherein the program or instructions, when executed by the processor, implement the steps of the multimedia information secure transmission method as described in any one of claims 10-11.

25. A readable storage medium on which a program or instructions are stored, wherein the program or instructions, when executed by a processor, implement the method as claimed in claims 1-11.

26. A chip comprising a processor and a communication interface coupled to the processor, the processor being configured to run a program or instructions to implement the method as claimed in claims 1-11.

27. A computer program product, said program product being executed by at least one processor to implement the method as claimed in any one of claims 1 to 11.

Images