WO2017167166A1 - 一种tee访问控制方法以及实现该方法的移动终端 - Google Patents

一种tee访问控制方法以及实现该方法的移动终端 Download PDF

Info

Publication number
WO2017167166A1
WO2017167166A1 PCT/CN2017/078347 CN2017078347W WO2017167166A1 WO 2017167166 A1 WO2017167166 A1 WO 2017167166A1 CN 2017078347 W CN2017078347 W CN 2017078347W WO 2017167166 A1 WO2017167166 A1 WO 2017167166A1
Authority
WO
WIPO (PCT)
Prior art keywords
application
malicious
access
operating system
client
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
PCT/CN2017/078347
Other languages
English (en)
French (fr)
Inventor
陈成钱
周钰
郭伟
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
China Unionpay Co Ltd
Original Assignee
China Unionpay Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by China Unionpay Co Ltd filed Critical China Unionpay Co Ltd
Priority to US16/088,929 priority Critical patent/US11544378B2/en
Priority to EP17773196.5A priority patent/EP3438868B1/en
Priority to CA3026781A priority patent/CA3026781C/en
Publication of WO2017167166A1 publication Critical patent/WO2017167166A1/zh
Anticipated expiration legal-status Critical
Ceased legal-status Critical Current

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55—Detecting local intrusion or implementing counter-measures
    • G06F21/56—Computer malware detection or handling, e.g. anti-virus arrangements
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55—Detecting local intrusion or implementing counter-measures
    • G06F21/56—Computer malware detection or handling, e.g. anti-virus arrangements
    • G06F21/562—Static detection
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
    • G06F21/31—User authentication
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/52—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
    • G06F21/53—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow by executing in a restricted environment, e.g. sandbox or secure virtual machine
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/70—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer
    • G06F21/71—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure computing or processing of information
    • G06F21/74—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure computing or processing of information operating in dual or compartmented mode, i.e. at least one secure mode
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/03—Indexing scheme relating to G06F21/50, monitoring users, programs or devices to maintain the integrity of platforms
    • G06F2221/033—Test or assess software
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/21—Indexing scheme relating to G06F21/00 and subgroups addressing additional information or applications relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/2149—Restricted operating environment

Definitions

  • the present invention relates to computer technology, and more particularly to an access control method for implementing a secure operating system from a multimedia operating system in a mobile terminal and a mobile terminal implementing the access control method.
  • TEE Trusted Execution Environment Due to the emergence of TEE, more and more external security carriers are under the control of TEE for security reasons. These external security carriers are managed by TEE, which also improves the security of these external security carriers. To ensure that the external security carrier used by the user is the correct external security carrier, the operation of the user and the external security carrier is not tampered with by other malicious third parties.
  • TEE is a secure operating system coexisting with the multimedia operating system (for example, Android system in the description of this application).
  • the various trusted applications running on it can provide various reliable security for Android applications. service.
  • the TEE trusted application controls access to its security service, that is, which Android application can be accessed by the TEE trusted application.
  • the existing technical method is a username/password based access mechanism, that is, when Each Android application selects a specific TEE trusted application, and attaches a username and password.
  • the TEE forwards the selection command to the selected trusted application according to the trusted application identifier, and the trusted application pairs the username and the user name.
  • the password is judged. If the judgment is valid, the TEE is successfully returned, and the TEE generates a valid credential.
  • the subsequent Android application can access the security service of the trusted application by using the credential; if the judgment is invalid, the TEE returns a failure, and the TEE does not. Generate credentials and eventually return a notification to the Android app that the trusted application
  • the present invention provides a TEE access control method and a mobile terminal that implements the TEE access control method.
  • the TEE access control method can effectively avoid the problem that the TEE trusted application cannot be accessed due to malicious access, and can improve the TEE system. Overall availability and reliability.
  • the access permission judging step determines whether the currently launched client application is a malicious application, and if it is not a malicious application, continues the following application request sending step, and if it is a malicious application, returns a selection failure to the client application and interrupts the processing;
  • the application retrieval step acquires the trusted application according to the application access request and returns to the multimedia system.
  • the following substeps are included in the access authority determining step:
  • the following application request sending step is continued; if it is a malicious application, the selection return fails to the client application and the processing is interrupted.
  • the malicious application registry stored in the multimedia system is used to determine whether the client application is a malicious application according to the application identifier, wherein the malicious application registry stores at least the application identifier of the malicious application.
  • the user name and password are obtained from the application access request and the user name and password are legally determined; and the result of the legality determination is returned from the secure operating system to the multimedia system as a trusted application selection result.
  • the multimedia system obtains the trusted application selection result, determines whether the client application is a malicious application according to the pre-stored rule condition, and if the client application is determined to be a malicious application, Register the client app in the malicious app registry.
  • the mobile terminal capable of realizing access control of a multimedia operating system to a secure operating system, the mobile terminal comprising a multimedia system and a security operating system, wherein
  • the multimedia system has:
  • a client application that initiates an application access request for selecting a trusted application to the secure operating system
  • An interaction module configured to provide an application access interface for accessing the secure operating system to the client application
  • Controlling an access module configured to determine whether the currently accessed client application is a malicious application, and on the other hand, for monitoring a client application to select a trusted application processing result and according to a prescribed rule, whether the access initiated by the client application is Determine for malicious access;
  • a first communication module configured to implement data transmission between the multimedia system and the secure operating system
  • the secure operating system includes:
  • One or more trusted applications are One or more trusted applications.
  • a command distribution module which distributes an application access request from the multimedia operating system to a corresponding trusted application; the user rights management module is invoked by the trusted application to determine the legality of the application access request;
  • the second communication module is configured to implement data transmission between the secure operating system and the multimedia system.
  • the interaction module acquires an application identifier of the client application from the application access request sent by the client application and provides the control identifier to the control access module.
  • control access module comprises:
  • a malicious application registry for storing at least an application identifier of a malicious application
  • a rules file for storing at least a prescribed rule for determining whether it is a malicious application
  • the control processing module determines, according to the application identifier of the malicious application stored in the malicious application registry, whether the currently accessed client application provided by the interaction module is a malicious application, and on the other hand, is used for monitoring client application selection.
  • control processing module obtains, from the first communication module, a processing result of the client application selecting the trusted application.
  • the user rights management module determines, according to the call of the trusted application, whether the username and password included in the application access request are correct.
  • the access control access of the present invention is capable of controlling malicious access from the multimedia system to the secure operating system, and using the control access module to obtain the processing result of the trusted application of the upper-layer multimedia system to the secure operating system, when controlling access
  • the module finds that the trusted application selection of the client application fails multiple times it may determine that the multimedia system is initiating a malicious access, identify the client application of the multimedia system as a malicious application, and launch the multimedia system after the application to the secure operating system. Any access request is considered a malicious visit. Therefore, when the interaction module is invoked to initiate access to the secure operating system after being identified as the client application of the malicious application, the interaction module directly rejects the access of the client application according to the identification result of the control access module, and does not need to switch to the security operation.
  • the system can avoid various problems caused by the system switching when the terminal performs the system.
  • the TEE access control method of the present invention is a supplement to the existing TEE trusted application access control mechanism, and can prevent malicious applications from maliciously initiating TEE trusted applications without switching the system, and also avoids malicious
  • the problem of inaccessibility of the TEE trusted application caused by the access improves the overall availability and reliability of the TEE system.
  • FIG. 1 is a block diagram showing the structure of a mobile terminal according to an embodiment of the present invention.
  • FIG. 2 is a flow chart of an access control method according to an embodiment of the present invention.
  • the access control method of the present invention and the mobile terminal implementing the access control method will be described below.
  • the Android system is taken as an example of the multimedia operating system
  • the TEE system is taken as an example of the security operating system.
  • the present invention is not limited to the Android system, but may be other multimedia operating systems.
  • FIG. 1 is a block diagram showing the structure of a mobile terminal according to an embodiment of the present invention.
  • a mobile terminal includes a multimedia operating system and a secure operating system.
  • the multimedia application system (for example, the Android system) includes: a client application 100, an interaction module 200, a control access module 300, and a first communication module 400.
  • the client application 100 is in the multimedia operating system, and the application of various security access requests is initiated by the interaction module 200 to the trusted application 800 in the security operating system (for example, the TEE system).
  • the trusted application 800 for example, the TEE system.
  • the interaction module 200 provides a client application 100 on the multimedia operating system with a specific application access interface for accessing the trusted application of the secure operating system.
  • the interaction module 200 obtains the identifier of the client application and forwards it to the control access module 300, and the control access module 300 determines whether it is a malicious application.
  • the control access module 300 includes a control processing module 301, a rules file 302, and a malicious application registry 303 (shown in FIG. 2).
  • the control processing module 301 accepts the identifier of the client application from the interaction module 200, and refers to the identifier of the malicious application stored in the malicious application registry 303 to determine whether the currently accessed client application is a malicious application, and on the other hand, the control processing.
  • the module 301 monitors the processing result of the client application selecting the trusted application, and reads the corresponding determination rule from the rule file 302, and determines whether the access initiated by the client application is a malicious access according to the determination rule, and if the determination is yes
  • the malicious application identifies the client application as a malicious application and stores it in the malicious application registry 303.
  • the first communication module 400 implements system switching between the multimedia system and the secure operating system, and provides a data transmission channel in which the client application 100 accesses the request data to the trusted application of the secure operating system.
  • the secure operating system includes: a second communication module 500, a command distribution module 600, a user rights management module 700, and a plurality of trusted applications 800.
  • the second communication module 500 implements system switching between the secure operating system and the multimedia system, and provides a trusted application of the secure operating system to the data transmission channel of the multimedia operating system.
  • the command distribution module 600 accesses the trusted application in the data according to the request from the multimedia operating system. Identify, forward the access request data to the designated trusted application 800.
  • the user rights module 700 is called by the trusted application 800 to determine whether the user name and password in the normal application access request are correct, to determine whether to accept the access request sent by the normal application.
  • the trusted application 800 is located in a secure operating system and can be multiple. It is an application that provides various security services for common applications.
  • FIG. 2 is a flow chart of an access control method according to an embodiment of the present invention.
  • step S100 when a client application 100 initiates a security service access request to the trusted application 800, first, the calling interaction module 200 sends a TEE trusted application selection command to select a specific trusted application to initiate a security service request. .
  • step S101 the interaction module 200 obtains an application identifier of the client application 100 that initiates the call from an API (Application Programming Interface) provided by the multimedia operating system layer (for example, using an application hash value, an application package name, etc.)
  • the application identifier is sent to the control access module 300 to obtain whether the currently launched client application belongs to a malicious application.
  • API Application Programming Interface
  • step S102 the control access module 300 queries the stored malicious application registry, and determines, according to the received application identifier of the client application 100, whether the application identifier of the client application 100 exists in the malicious application registry, if the application identifier If it exists in the malicious application registry, it is determined to be a malicious application, otherwise it is determined to be a non-malicious application, and the judgment result is returned to the interaction module 200.
  • step S103 the interaction module 200 returns an application selection failure directly to the current client application 100 if the result of the return is that the current application is a malicious application, and if it is not a malicious application, in step S104, according to the return result from the control access module 300.
  • the interaction module 200 transmits the selection application request data to the secure operating system via the first communication module 400 and the second communication module 500.
  • step S105 the command distribution module 600 selects a corresponding trusted application according to the application identifier of the trusted application in the selection application request data, and sends the request data to the corresponding trusted application for processing.
  • step S106 the selected trusted application extracts the username and password from the request data, and invokes the user rights management module 700 to determine the legality of the username and password, and the user rights management mode. Block 700 returns the determination to the trusted application, which returns the decision to command distribution module 600.
  • step S107 the command distribution module 600 returns the determination result to the multimedia operating system via the second communication module 500 and the first communication module 400, returns to the interaction module 200 in step S109, and then proceeds stepwise, in step S110. And finally returned to the client application 100.
  • step S108 the control access module 300 obtains the trusted application selection result from the first communication module 400 during the selection process of the trusted application of the secure operating system. If the result is that the trusted application selection fails, Then, the control processing module 301 in the control access module 300 reads the condition description read from the rule file 302 stored in the control access module 300 (for example, the number of failures must not exceed three times, etc.), and determines whether the client application is a malicious application.
  • the control processing module 301 registers the user identifier of the client application into the malicious application registry 302.
  • the background system 900 (the background system 900 may be a third party disposed outside the mobile terminal, or may be another application in the mobile terminal) is in communication with the control access module 300, and the background system 900 can control the access module 300.
  • the rule file 302 and the malicious application registry 302 are updated.
  • the rule file 302 stores a condition for determining whether it is a malicious application
  • the malicious application registry 303 stores at least the identifier of the malicious application.
  • the present invention provides an access control method for performing such malicious access in a multimedia operating system. control.
  • the main inventive point of the present invention is that the control access module 300 is added to the Android system, and the control access module 300 obtains the processing result of selecting the TEE trusted application by the upper Android application, and finds that the Android application has multiple TEE trusted When the application selection fails, it may be determined that the Android is initiating a malicious access, and the Android application is identified as a malicious application, and any access request initiated by the Android application after the TEE is regarded as a malicious access.
  • the interaction module 200 when the interaction module 200 is invoked to initiate the access to the TEE trusted application after the android application is identified as the malicious application, the interaction module 200 directly rejects the access of the Android application according to the identification result of the control access module 300, without switching to The TEE system avoids the problems caused by the system switching when the terminal is described in the above problem description.
  • the access control method of the present invention is a supplement to the existing TEE trusted application access control mechanism, and can prevent malicious applications from maliciously initiating TEE trusted applications without switching the system, and also avoids malicious access.
  • the problem that the TEE trusted application is inaccessible has improved the TEE system. Overall availability and reliability.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Theoretical Computer Science (AREA)
  • Software Systems (AREA)
  • Computer Hardware Design (AREA)
  • General Engineering & Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Health & Medical Sciences (AREA)
  • General Health & Medical Sciences (AREA)
  • Virology (AREA)
  • Mathematical Physics (AREA)
  • Telephone Function (AREA)
  • Mobile Radio Communication Systems (AREA)
  • Computer And Data Communications (AREA)

Abstract

本发明涉及多媒体系统对安全操作系统的访问控制方法以及实现该方法的移动终端。该方法包步骤：从多媒体系统的客户端应用对安全操作系统发起用于选择可信应用的应用访问请求；判断当前发起调用的客户端应用是否为恶意应用，若不是恶意应用则继续下述步骤，若是恶意应用，则向客户端应用返回选择失败并中断处理；将所述应用访问请求从多媒体系统发送到安全操作系统；在安全操作系统根据所述应用访问请求获取可信应用并返回到多媒体系统。根据本发明能够在不切换系统的情况下防止恶意应用对安全操作系统中可信应用发起的恶意访问，能够避免恶意访问造成的可信应用不可访问的问题。

Description

一种TEE访问控制方法以及实现该方法的移动终端 技术领域
本发明涉及计算机技术，特别涉及在移动终端中实现从多媒体操作系统访问安全操作系统的访问控制方法以及实现该访问控制方法的移动终端。
背景技术
随着计算机和网络应用的日益广泛以及不同领域的业务种类的日益丰富，用于安全性信息交互(即对安全性要求较高的信息交互，例如金融领域中的交易处理过程)的设备(尤其是基于移动终端的安全性信息交互设备)变得越来越重要。
在传统的技术方案中，为了提高信息交互设备的安全性，已经提出了可信执行环境(Trusted Execution Environment，TEE)的概念。由于TEE的出现，越来越多的外部安全载体出于安全性考虑，都会处于TEE控制下，由TEE来对这些外部安全载体进行管理，这样也很好地提高了这些外部安全载体的安全性，确保用户使用的外部安全载体是正确的外部安全载体，用户与外部安全载体的操作不被其他恶意第三方所篡改。
TEE作为智能终端上与多媒体操作系统(在本申请的之后的描写中都以Android系统为例)并存的一个安全操作系统，上面运行的各类可信应用可为Android应用提供各种可靠的安全服务。TEE可信应用对其安全服务的访问权限控制上，即TEE可信应用允许哪些Android应用可以访问它的安全服务，现有采用的技术方式是一种基于用户名/密码的访问机制，即当每个Android应用在选择具体TEE可信应用时，同时附上用户名与密码，TEE根据可信应用标识，转发该选择命令到选定的可信应用中，由该可信应用对用户名与密码进行判定，若判定有效，则给TEE返回成功，由TEE生成一个有效的凭证，后续Android应用可凭此凭证访问该可信应用的安全服务；若判定无效，则给TEE返回失败，TEE不生成凭证，并最终向Android应用返回可信应用选择失败的通知。
然而，该方式存在以下不足：
当一个Android应用使用该机制对TEE可信应用进行不间断地恶意访问时，由于每次选择都需要由TEE进行判定访问是否有效，导致终端要不停地切换到TEE上执行，造成终端在Android与TEE之间来回不停的切换，容易造成系统抖动现象，导致Android系统反应迟钝。同时，对于TEE应用的发起不停地恶意选择访问时，也易使TEE可信应用一直处于用户权限判断状态中，不能响应合法应用的正常访问请求。
发明内容
鉴于上述问题，本发明提出一种TEE访问控制方法以及实现该TEE访问控制方法的移动终端，该TEE访问控制方法能够有效避免恶意访问造成的TEE可信应用不可访问的问题，能够提高TEE系统的整体可用性和可靠性。
本发明的多媒体系统对安全操作系统的访问控制方法，其特征在于，包括下列步骤：
安全服务请求步骤，从多媒体系统的客户端应用对安全操作系统发起用于选择可信应用的应用访问请求；
访问权限判断步骤，判断当前发起调用的客户端应用是否为恶意应用，若不是恶意应用则继续下述应用请求发送步骤，若是恶意应用，则向客户端应用返回选择失败并中断处理；
应用请求发送步骤，将所述应用访问请求从多媒体系统发送到安全操作系统；以及
应用调取步骤，在安全操作系统根据所述应用访问请求获取可信应用并返回到多媒体系统。
优选地，在所述访问权限判断步骤中包括下述子步骤：
获取当前发起调用的客户端应用的应用标识；
根据应用标识判断该客户端应是否为恶意应用；以及
若不是恶意应用则继续下述应用请求发送步骤，若是恶意应用，则向客户端应用返回选择失败并中断处理。
优选地，在根据应用标识判断该客户端应是否为恶意应用的子步骤中，查 询多媒体系统中存储的恶意应用注册表，根据应用标识来判断该客户端应用是否为恶意应用，其中，所述恶意应用注册表至少存储恶意应用的应用标识。
优选地，在所述应用调取步骤中包括下述子步骤：
在安全操作系统根据所述应用访问请求中的可信应用标识，选定相应的可信应用并将应用访问请求发送到相应的可信应用；
从应用访问请求中获取用户名和密码并对用户名和密码进行合法性判定；以及将合法性判定的结果作为可信应用选择结果从安全操作系统返回到多媒体系统。
优选地，在所述应用调取步骤中，多媒体系统获取可信应用选择结果，根据预先存储的规则条件判定该客户端应用是否为恶意应用，如果判定该客户端应用为恶意应用的情况下，将该客户端应用注册到恶意应用注册表中。
本发明的能够实现多媒体系统对安全操作系统的访问控制的移动终端，该移动终端包括多媒体系统和安全操作系统，其特征在于，
所述多媒体系统具备：
客户端应用，对安全操作系统发起用于选择可信应用的应用访问请求；
交互模块，用于对所述客户端应用提供访问安全操作系统的应用访问接口；
控制访问模块，用于判定当前进行访问的客户端应用是否为恶意应用，另一方面，用于监听客户端应用选择可信应用的处理结果并且根据规定规则对当该客户端应用发起的访问是否为恶意访问进行判定；以及
第一通信模块，用于实现多媒体系统和安全操作系统之间的数据传输，
所述安全操作系统包括：
一个或者多个可信应用；
命令分发模块，将来自多媒体操作系统的应用访问请求分发到相应的可信应用；用户权限管理模块，由所述可信应用调用，用于对所述应用访问请求的合法性进行判定；以及
第二通信模块，用于实现安全操作系统和多媒体系统之间的数据传输。
优选地，所述交互模块从所述客户端应用发送来的应用访问请求中获取客户端应用的应用标识并且提供给所述控制访问模块。
优选地，所述控制访问模块包括：
恶意应用注册表，用于至少存储恶意应用的应用标识；
规则文件，用于至少存储用于判定是否为恶意应用的规定规则；以及
控制处理模块，根据所述恶意应用注册表中存储的恶意应用的应用标识判定从所述交互模块提供的当前进行访问的客户端应用是否为恶意应用，另一方面，用于监听客户端应用选择可信应用的处理结果并且根据所述规则文件中存储的规定规则对当该客户端应用发起的访问是否为恶意访问进行判定。
优选地，所述控制处理模块从所述第一通信模块获得客户端应用选择可信应用的处理结果。
优选地，所述用户权限管理模块根据所述可信应用的调用，判定所述应用访问请求中包含的用户名和密码是否正确。
如上所述，本发明的访问控制访问，能够对从多媒体系统向安全操作系统进行的恶意访问进行控制，利用控制访问模块获取上层多媒体系统对安全操作系统的可信应用的处理结果，当控制访问模块发现该客户端应用出现多次的可信应用选择失败时，则可判定该多媒体系统正在发起恶意访问，标识该多媒体系统的客户应用为恶意应用，把该多媒体系统应用之后对安全操作系统发起的任何访问请求都视为是恶意访问。因而，当被标识为恶意应用的客户端应用之后再次调用交互模块发起对安全操作系统的访问时，交互模块根据控制访问模块的标识结果，直接拒绝该客户端应用的访问，无需切换到安全操作系统，这样能够避免由于终端进行系统切换时所造成的各个问题。
本发明的TEE访问控制方法以是对现有TEE可信应用访问控制机制的一种补充，能够在不切换系统的情况下防止恶意应用对TEE可信应用发起的恶意访问，也避免了由于恶意访问造成的TEE可信应用不可访问的问题，提高了TEE系统的整体可用性与可靠性。
附图说明
图1是本发明一个实施方式的移动终端的结构框图。
图2是本发明一个实施方式的访问控制方法的流程图。
具体实施方式
下面介绍的是本发明的多个实施例中的一些，旨在提供对本发明的基本了解。并不旨在确认本发明的关键或决定性的要素或限定所要保护的范围。
下面对于本发明的访问控制方法以及实现该访问控制方法的移动终端进行说明。在本说明书中作为多媒体操作系统以Android系统为例、作为安全操作系统以TEE系统为例进行说明。当然，本发明不仅限于Android系统，还可以是其他多媒体操作系统。
图1是本发明一个实施方式的移动终端的结构框图。
如图1所示，本发明一个实施方式的移动终端包括多媒体操作系统系统和安全操作系统系统。
其中，在多媒体操作系统(例如，Android系统)中包括：客户端应用100、交互模块200、控制访问模块300以及第一通信模块400。
其中，客户端应用100处于多媒体操作系统内，通过交互模块200向安全操作系统(例如，TEE系统)中的可信应用800发起各种安全访问请求的应用。
交互模块200向多媒体操作系统上的客户端应用100提供访问安全操作系统的可信应用的具体应用访问接口。交互模块200获取客户端应用的标识，转发给控制访问模块300，由控制访问模块300进行是否为恶意应用的判定。
控制访问模块300包括：控制处理模块301、规则文件302以及恶意应用注册表303(如图2所示)。控制处理模块301一方面接受来自交互模块200的客户应用的标识，参照恶意应用注册表303中存储的恶意应用的标识，判定当前进行访问的客户端应用是否为恶意应用，另一方面，控制处理模块301监听客户端应用选择可信应用的处理结果，并从规则文件302中读取相应的判定规则，根据判定规则对当该客户端应用发起的访问是否为恶意访问进行判定，如果判定为是恶意应用，则将该客户端应用作为恶意应用进行标识并且存储到恶意应用注册表303中。
第一通信模块400实现多媒体系统和安全操作系统之间的系统切换，提供客户端应用100访问请求数据到安全操作系统的可信应用中的数据传输通道。
安全操作系统包括：第二通信模块500、命令分发模块600、用户权限管理模块700以及多个可信应用800。
其中，第二通信模块500实现安全操作系统与多媒体系统之间的系统切换，提供安全操作系统的可信应用到多媒体操作系统的数据传输通道。
命令分发模块600根据来自多媒体操作系统的请求访问数据中的可信应用 标识，转送访问请求数据到指定的可信应用800中。
用户权限模块700由可信应用800调用，用以判断普通应用访问请求中的用户名与密码是否正确，以决定是否接受处理普通应用发送来的访问请求。可信应用800位于安全操作系统内，可以为多个，它是为普通应用提供各种安全服务的应用。
接着，对于利用上述移动终端实现的本发明一个实施方式的访问控制方法进行具体说明。
图2是本发明一个实施方式的访问控制方法的流程图。
下面参照图2对于该实施方式的访问控制方法的具体流程进行说明。
在步骤S100中，当一个客户端应用100要对可信应用800发起安全服务访问请求时，首先，调用交互模块200发送TEE可信应用选择命令用以选择要发起安全服务请求的具体可信应用。
在步骤S101中，交互模块200从多媒体操作系统层提供的API(Application Programming Interface，应用编程接口)获取发起调用的客户端应用100的应用标识(例如以应用哈希值、应用包名等方式作为应用标识)，并将该客户端应用标识发给控制访问模块300，用以获取当前发起调用的客户端应用是否属于恶意应用。
步骤S102中，控制访问模块300查询其存储的恶意应用注册表，根据收到的客户端应用100的应用标识，判断该客户端应用100的应用标识是否存在于恶意应用注册表，如果该应用标识存在于该恶意应用注册表中则判断为恶意应用，否则判断为非恶意应用，将判断结果返回交互模块200。
步骤S103中，交互模块200根据来自控制访问模块300的返回结果，若是返回结果为当前应用为恶意应用，则直接向当前客户端应用100返回应用选择失败；若不是恶意应用，则在步骤S104中交互模块200经由第一通信模块400和第二通信模块500将选择应用请求数据发送给安全操作系统。
步骤S105中，命令分发模块600根据选择应用请求数据中的可信应用的应用标识，选择对应的可信应用，将请求数据发往对应的可信应用进行处理。
步骤S106中，被选择的可信应用从请求数据中取出用户名与密码，并调用用户权限管理模块700对该用户名与密码的合法性进行判定，用户权限管理模 块700将判断结果返回至可信应用，可信应用将判定结果返回命令分发模块600。
在步骤S107中，命令分发模块600将判断结果通过经由第二通信模块500和第一通信模块400返回到多媒体操作系统，在步骤S109中返回到交互模块200，接着逐步上送，在步骤S110中，最终返回给客户端应用100。其中，在步骤S108中，在安全操作系统的可信应用每次的选择过程中，控制访问模块300从第一通信模块400中获取可信应用选择结果，若该结果为可信应用选择失败，则控制访问模块300中的控制处理模块301从控制访问模块300中存储的规则文件302中读取的条件描述(例如，失败次数不得超过三次等)，判断该客户端应用是否为恶意应用。若满足条件描述的情况下，则标识当前客户端应用为恶意应用，并且控制处理模块301将该客户端应用的用户标识注册到恶意应用注册表302中。另一方面，后台系统900(后台系统900可以是设置在移动终端外的第三方，也可以是移动终端中的其他应用程序)与控制访问模块300通信连接，后台系统900能够对控制访问模块300中的规则文件302以及恶意应用注册表302进行更新。在本发明的控制访问模块300中，如上所述，规则文件302中存储有用于判断是否为恶意应用的条件，恶意应用注册表303至少存储有恶意应用的标识。
如上所述，为了防止多媒体操作系统例如Android系统的客户端应用对安全操作系统例如TEE系统发起频繁恶意的访问，本发明提出一种的访问控制方法，在多媒体操作系统就对这种恶意访问进行控制。具体地，本发明的主要发明点在于，在Android系统增加控制访问模块300，该控制访问模块300获取上层Android应用选择TEE可信应用的处理结果，当发现该Android应用出现多次的TEE可信应用选择失败时，则可判定该Android正在发起恶意访问，标识该Android应用为恶意应用，把该Android应用之后对TEE发起的任何访问请求都视为是恶意访问。因而，当被标识为恶意应用的android应用之后再次调用交互模块200发起对TEE可信应用发起访问时，交互模块200根据控制访问模块300的标识结果，直接拒绝该Android应用的访问，无需切换到TEE系统，避免了上述问题描述时所涉及的由于终端进行系统切换时所造成的各个问题。
本发明的访问控制方法以是对现有TEE可信应用访问控制机制的一种补充，能够在不切换系统的情况下防止恶意应用对TEE可信应用发起的恶意访问，也避免了由于恶意访问造成的TEE可信应用不可访问的问题，提高了TEE系统 的整体可用性与可靠性。
以上例子主要说明了本发明的访问控制方法以及实现该访问控制方法的移动终端。尽管只对其中一些本发明的具体实施方式进行了描述，但是本领域普通技术人员应当了解，本发明可以在不偏离其主旨与范围内以许多其他的形式实施。因此，所展示的例子与实施方式被视为示意性的而非限制性的，在不脱离如所附各权利要求所定义的本发明精神及范围的情况下，本发明可能涵盖各种的修改与替换。

Claims (11)

  1. 一种多媒体系统对安全操作系统的访问控制方法，其特征在于，包括下述步骤：安全服务请求步骤，从多媒体系统的客户端应用对安全操作系统发起用于选择可信应用的应用访问请求；
    访问权限判断步骤，判断当前发起调用的客户端应用是否为恶意应用，若不是恶意应用则继续下述应用请求发送步骤，若是恶意应用，则向客户端应用返回选择失败并中断处理；
    应用请求发送步骤，将所述应用访问请求从多媒体系统发送到安全操作系统；以及
    应用调取步骤，在安全操作系统根据所述应用访问请求获取可信应用并返回到多媒体系统。
  2. 如权利要求1所述的多媒体系统对安全操作系统的访问控制方法，其特征在于，
    在所述访问权限判断步骤中包括下述子步骤：
    获取当前发起调用的客户端应用的应用标识；
    根据应用标识判断该客户端应是否为恶意应用；以及
    若不是恶意应用则继续下述应用请求发送步骤，若是恶意应用，则向客户端应用返回选择失败并中断处理。
  3. 如权利要求1或2所述多媒体系统对安全操作系统的访问控制方法，其特征在于，
    在根据应用标识判断该客户端应是否为恶意应用的子步骤中，查询多媒体系统中存储的恶意应用注册表，根据应用标识来判断该客户端应用是否为恶意应用，其中，所述恶意应用注册表至少存储恶意应用的应用标识。
  4. 如权利要求3所述的多媒体系统对安全操作系统的访问控制方法，其特征在于，
    在所述应用调取步骤中包括下述子步骤：
    在安全操作系统根据所述应用访问请求中的可信应用标识，选定相应的可信应用并将应用访问请求发送到相应的可信应用；
    从应用访问请求中获取用户名和密码并对用户名和密码进行合法性判定；以及
    将合法性判定的结果作为可信应用选择结果从安全操作系统返回到多媒体系统。
  5. 如权利要求4所述的多媒体系统对安全操作系统的访问控制方法，其特征在于，
    在所述应用调取步骤中，多媒体系统获取可信应用选择结果，根据预先存储的规则条件判定该客户端应用是否为恶意应用，如果判定该客户端应用为恶意应用的情况下，将该客户端应用注册到恶意应用注册表中。
  6. 如权利要求5所述的多媒体系统对安全操作系统的访问控制方法，其特征在于，
    设定所述规则条件为该客户端应用调取可信应用失败次数超过规定次数。
  7. 一种能够实现多媒体系统对安全操作系统的访问控制的移动终端，该移动终端包括多媒体系统和安全操作系统，其特征在于，
    所述多媒体系统具备：
    客户端应用，对安全操作系统发起用于选择可信应用的应用访问请求；
    交互模块，用于对所述客户端应用提供访问安全操作系统的应用访问接口；
    控制访问模块，用于判定当前进行访问的客户端应用是否为恶意应用，另一方面，用于监听客户端应用选择可信应用的处理结果并且根据规定规则对当该客户端应用发起的访问是否为恶意访问进行判定；以及
    第一通信模块，用于实现多媒体系统和安全操作系统之间的数据传输，
    所述安全操作系统包括：
    一个或者多个可信应用；
    命令分发模块，将来自多媒体操作系统的应用访问请求分发到相应的可信应用；用户权限管理模块，由所述可信应用调用，用于对所述应用访问请求的合法性进行判定；以及
    第二通信模块，用于实现安全操作系统和多媒体系统之间的数据传输。
  8. 如权利要求7所述的能够实现多媒体系统对安全操作系统的访问控制的移动终端，其特征在于，
    所述交互模块从所述客户端应用发送来的应用访问请求中获取客户端应用的应用标识并且提供给所述控制访问模块。
  9. 如权利要求8所述的能够实现多媒体系统对安全操作系统的访问控制的移动终端，其特征在于，
    所述控制访问模块包括：
    恶意应用注册表，用于至少存储恶意应用的应用标识；
    规则文件，用于至少存储用于判定是否为恶意应用的规定规则；以及
    控制处理模块，根据所述恶意应用注册表中存储的恶意应用的应用标识判定从所述交互模块提供的当前进行访问的客户端应用是否为恶意应用，另一方面，用于监听客户端应用选择可信应用的处理结果并且根据所述规则文件中存储的规定规则对当该客户端应用发起的访问是否为恶意访问进行判定。
  10. 如权利要求9所述的能够实现多媒体系统对安全操作系统的访问控制的移动终端，其特征在于，
    所述控制处理模块从所述第一通信模块获得客户端应用选择可信应用的处理结果。
  11. 如权利要求10所述的能够实现多媒体系统对安全操作系统的访问控制的移动终端，其特征在于，
    所述用户权限管理模块根据所述可信应用的调用，判定所述应用访问请求中包含的用户名和密码是否正确。
PCT/CN2017/078347 2016-04-01 2017-03-28 一种tee访问控制方法以及实现该方法的移动终端 Ceased WO2017167166A1 (zh)

Priority Applications (3)

Application Number Priority Date Filing Date Title
US16/088,929 US11544378B2 (en) 2016-04-01 2017-03-28 Tee access control method and mobile terminal implementing same
EP17773196.5A EP3438868B1 (en) 2016-04-01 2017-03-28 Tee access control method and mobile terminal implementing same
CA3026781A CA3026781C (en) 2016-04-01 2017-03-28 A method for tee access control and a mobile terminal for implementing the method

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201610198543.8A CN105809036B (zh) 2016-04-01 2016-04-01 一种tee访问控制方法以及实现该方法的移动终端
CN201610198543.8 2016-04-01

Publications (1)

Publication Number Publication Date
WO2017167166A1 true WO2017167166A1 (zh) 2017-10-05

Family

ID=56459355

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2017/078347 Ceased WO2017167166A1 (zh) 2016-04-01 2017-03-28 一种tee访问控制方法以及实现该方法的移动终端

Country Status (5)

Country Link
US (1) US11544378B2 (zh)
EP (1) EP3438868B1 (zh)
CN (1) CN105809036B (zh)
CA (1) CA3026781C (zh)
WO (1) WO2017167166A1 (zh)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP3694170A4 (en) * 2017-11-14 2020-10-14 Huawei Technologies Co., Ltd. PROCEDURE AND DEVICE FOR RESISTING A DENIAL OF SERVICE ATTACK
EP3737129A4 (en) * 2018-03-07 2021-03-03 Huawei Technologies Co., Ltd. ADMINISTRATIVE PROCEDURES FOR OFFLINE ADMINISTRATIVE INSTRUCTIONS AND TERMINAL DEVICE

Families Citing this family (14)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106778342B (zh) * 2016-12-09 2020-01-31 北京梆梆安全科技有限公司 可信执行环境安全认证方法和装置及设备
US10387681B2 (en) * 2017-03-20 2019-08-20 Huawei Technologies Co., Ltd. Methods and apparatus for controlling access to secure computing resources
US10528749B2 (en) * 2017-03-20 2020-01-07 Huawei Technologies Co., Ltd. Methods and apparatus for containerized secure computing resources
CN107426174B (zh) * 2017-06-09 2019-12-24 武汉果核科技有限公司 一种可信执行环境的访问控制方法
US11379573B2 (en) 2017-07-13 2022-07-05 Huawei Technologies Co., Ltd. Trusted application access control method and terminal
CN107454112A (zh) * 2017-09-29 2017-12-08 恒宝股份有限公司 一种访问可信应用的方法及其系统
CN110348252B (zh) 2018-04-02 2021-09-03 华为技术有限公司 基于信任区的操作系统和方法
CN109214215B (zh) * 2018-06-19 2021-10-26 中国银联股份有限公司 基于tee和ree的分离式切换方法及其系统
CN111046383B (zh) * 2018-10-12 2023-10-13 华为技术有限公司 终端攻击防御方法、装置、终端及云服务器
CN111382107B (zh) * 2018-12-29 2023-04-25 阿里巴巴集团控股有限公司 一种应用处理器、协处理器及数据处理设备
US11777964B2 (en) * 2019-03-01 2023-10-03 Malikie Innovations Limited Clipboard listener detector
CN111159734A (zh) * 2019-12-20 2020-05-15 青岛海信移动通信技术股份有限公司 通信终端及多应用数据互访处理方法
CN113626818B (zh) * 2020-05-08 2023-10-20 华为技术有限公司 计算机系统、服务处理方法、可读存储介质及芯片
CN116881901A (zh) * 2021-11-11 2023-10-13 荣耀终端有限公司 业务处理的方法和相关装置

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20070118558A1 (en) * 2005-11-21 2007-05-24 Research In Motion Limited System and method for application program operation on a wireless device
CN103780959A (zh) * 2012-10-18 2014-05-07 美国博通公司 不可信的应用程序及框架与安全操作系统环境的整合
CN103793815A (zh) * 2014-01-23 2014-05-14 武汉天喻信息产业股份有限公司 适用于银行卡和行业卡的移动智能终端收单系统及方法
CN104318182A (zh) * 2014-10-29 2015-01-28 中国科学院信息工程研究所 一种基于处理器安全扩展的智能终端隔离系统及方法
CN104683336A (zh) * 2015-02-12 2015-06-03 中国科学院信息工程研究所 一种基于安全域的安卓隐私数据保护方法及系统
US20160080320A1 (en) * 2014-09-14 2016-03-17 Microsoft Corporation Trusted Execution Environment Extensible Computing Device Interface

Family Cites Families (14)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7546376B2 (en) * 2000-11-06 2009-06-09 Telefonaktiebolaget Lm Ericsson (Publ) Media binding to coordinate quality of service requirements for media flows in a multimedia session with IP bearer resources
US7137004B2 (en) * 2001-11-16 2006-11-14 Microsoft Corporation Manifest-based trusted agent management in a trusted operating system environment
US7826353B2 (en) * 2003-05-05 2010-11-02 Nokia Corporation Method, system and network element for authorizing a data transmission
WO2007137353A1 (en) * 2006-05-29 2007-12-06 Symbiotic Technologies Pty Ltd Communications security system
US8291495B1 (en) * 2007-08-08 2012-10-16 Juniper Networks, Inc. Identifying applications for intrusion detection systems
WO2014012106A2 (en) * 2012-07-13 2014-01-16 Sourcefire, Inc. Method and apparatus for retroactively detecting malicious or otherwise undesirable software as well as clean software through intelligent rescanning
US8955039B2 (en) * 2012-09-12 2015-02-10 Intel Corporation Mobile platform with sensor data security
EP2746981A1 (en) * 2012-12-19 2014-06-25 ST-Ericsson SA Trusted execution environment access control rules derivation
US8935746B2 (en) * 2013-04-22 2015-01-13 Oracle International Corporation System with a trusted execution environment component executed on a secure element
CN104348616B (zh) * 2013-07-26 2018-02-23 中国移动通信集团公司 一种访问终端安全组件的方法、装置及系统
CN104125216B (zh) * 2014-06-30 2017-12-15 华为技术有限公司 一种提升可信执行环境安全性的方法、系统及终端
CN104125226B (zh) * 2014-07-28 2018-01-26 北京握奇智能科技有限公司 一种锁定和解锁应用的方法、装置及系统
US9594927B2 (en) * 2014-09-10 2017-03-14 Intel Corporation Providing a trusted execution environment using a processor
CN105138904B (zh) * 2015-08-25 2018-06-15 华为技术有限公司 一种访问控制方法和装置

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20070118558A1 (en) * 2005-11-21 2007-05-24 Research In Motion Limited System and method for application program operation on a wireless device
CN103780959A (zh) * 2012-10-18 2014-05-07 美国博通公司 不可信的应用程序及框架与安全操作系统环境的整合
CN103793815A (zh) * 2014-01-23 2014-05-14 武汉天喻信息产业股份有限公司 适用于银行卡和行业卡的移动智能终端收单系统及方法
US20160080320A1 (en) * 2014-09-14 2016-03-17 Microsoft Corporation Trusted Execution Environment Extensible Computing Device Interface
CN104318182A (zh) * 2014-10-29 2015-01-28 中国科学院信息工程研究所 一种基于处理器安全扩展的智能终端隔离系统及方法
CN104683336A (zh) * 2015-02-12 2015-06-03 中国科学院信息工程研究所 一种基于安全域的安卓隐私数据保护方法及系统

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP3438868A4 *

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP3694170A4 (en) * 2017-11-14 2020-10-14 Huawei Technologies Co., Ltd. PROCEDURE AND DEVICE FOR RESISTING A DENIAL OF SERVICE ATTACK
EP3737129A4 (en) * 2018-03-07 2021-03-03 Huawei Technologies Co., Ltd. ADMINISTRATIVE PROCEDURES FOR OFFLINE ADMINISTRATIVE INSTRUCTIONS AND TERMINAL DEVICE

Also Published As

Publication number Publication date
EP3438868A4 (en) 2019-09-11
CA3026781A1 (en) 2017-10-05
CN105809036B (zh) 2019-05-10
CA3026781C (en) 2020-03-24
US11544378B2 (en) 2023-01-03
CN105809036A (zh) 2016-07-27
EP3438868B1 (en) 2020-07-15
US20190318087A1 (en) 2019-10-17
EP3438868A1 (en) 2019-02-06

Similar Documents

Publication Publication Date Title
WO2017167166A1 (zh) 一种tee访问控制方法以及实现该方法的移动终端
US7617541B2 (en) Method and/or system to authorize access to stored data
US11805112B2 (en) Enhanced multi-factor authentication based on physical and logical proximity to trusted devices and users
US20210173919A1 (en) Systems and methods for controlling privileged operations
US11502828B2 (en) Authenticating chaincode to chaincode invocations of a blockchain
US11770251B2 (en) Continuous integrity validation-based control plane communication in a container-orchestration system
US11652905B2 (en) Systems and methods for controlling real-time traffic surge of application programming interfaces (APIs) at server
US11716323B1 (en) Adaptive step-up authentication for privileged interface invocations
US12028377B2 (en) Active fingerprinting for transport layer security (TLS) servers
US10693863B2 (en) Methods and systems for single sign-on while protecting user privacy
TW200905515A (en) Systems, methods and media for firewall control via remote system information
US11949681B2 (en) Authentication and authorization for cloud file system
US10567387B1 (en) Systems and methods for managing computing device access to local area computer networks
US10841096B2 (en) Encrypted self-identification using a proxy server
WO2018120913A1 (zh) 一种获取证书、鉴权的方法及网络设备
US9948648B1 (en) System and method for enforcing access control to publicly-accessible web applications
US11863549B2 (en) Adjusting security policies based on endpoint locations
US20200014692A1 (en) Network Device Information Validation For Access Control and Information Security
US20230273726A1 (en) Quorum in a distributed system
US20240314138A1 (en) Global positioning system based multi-factor authentication for zero trust network access
US11695769B2 (en) Dynamic user authorization with a service provider
US7886353B2 (en) Accessing a USB host controller security extension using a HCD proxy
US10218659B1 (en) Persistent connections for email web applications
CN111680003B (zh) 基于分布式的文件中心系统及文件管理方法
US9172717B2 (en) Security-aware admission control of requests in a distributed system

Legal Events

Date Code Title Description
NENP Non-entry into the national phase

Ref country code: DE

WWE Wipo information: entry into national phase

Ref document number: 2017773196

Country of ref document: EP

121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 17773196

Country of ref document: EP

Kind code of ref document: A1

ENP Entry into the national phase

Ref document number: 3026781

Country of ref document: CA