WO2019095864A1 - 一种业务授权的方法、装置及设备 - Google Patents

一种业务授权的方法、装置及设备 Download PDF

Info

Publication number
WO2019095864A1
WO2019095864A1 PCT/CN2018/107569 CN2018107569W WO2019095864A1 WO 2019095864 A1 WO2019095864 A1 WO 2019095864A1 CN 2018107569 W CN2018107569 W CN 2018107569W WO 2019095864 A1 WO2019095864 A1 WO 2019095864A1
Authority
WO
WIPO (PCT)
Prior art keywords
execution unit
verification
signature information
public key
information
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
PCT/CN2018/107569
Other languages
English (en)
French (fr)
Inventor
孙曦
落红卫
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Alibaba Group Holding Ltd
Original Assignee
Alibaba Group Holding Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Alibaba Group Holding Ltd filed Critical Alibaba Group Holding Ltd
Priority to SG11202000396QA priority Critical patent/SG11202000396QA/en
Priority to KR1020207001503A priority patent/KR102382928B1/ko
Priority to EP18878119.9A priority patent/EP3641218B1/en
Publication of WO2019095864A1 publication Critical patent/WO2019095864A1/zh
Priority to US16/805,316 priority patent/US10892900B2/en
Anticipated expiration legal-status Critical
Priority to US17/145,889 priority patent/US11316702B2/en
Ceased legal-status Critical Current

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3263—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/52—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
    • G06F21/53—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow by executing in a restricted environment, e.g. sandbox or secure virtual machine
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/083—Network architectures or network communication protocols for network security for authentication of entities using passwords
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0861—Network architectures or network communication protocols for network security for authentication of entities using biometrical features, e.g. fingerprint, retina-scan
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0892—Network architectures or network communication protocols for network security for authentication of entities by using authentication-authorization-accounting [AAA] servers or protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/12—Applying verification of the received information
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
    • H04L9/0819—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s)
    • H04L9/0825—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3226—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using a predetermined code, e.g. password, passphrase or PIN
    • H04L9/3231—Biological data, e.g. fingerprint, voice or retina
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3247—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving digital signatures

Definitions

  • the present specification relates to the field of computer technology, and in particular, to a method, device and device for service authorization.
  • the traditional password-based authentication method has gradually failed to meet the user's convenience and security requirements for identity verification because of its easy to be forgotten, easy to steal, and inconvenient to input.
  • the authentication method of biometrics such as lines and facial recognition has been widely used in various scenarios because it is safer and more convenient.
  • a system running on a device usually includes two environments, one is a Trusted Execution Environment (TEE), and an execution environment provided for a Secure Element (SE), where Business applications for business processing typically run in the TEE.
  • TEE Trusted Execution Environment
  • SE Secure Element
  • the terminal needs to verify the biometric information to be verified input by the user, and obtain the verification result, and the verification result needs to be sent to the security application for verification, and only the security application determines that the verification result passes the verification, and the security application
  • the business executed by the business application is authorized, so that the business application executes the business.
  • the present specification provides a method for service authorization, which solves the problem that the verification result of the identity verification generated by a security environment in the prior art cannot be authenticated by another security environment.
  • the present specification provides a method for service authorization, where the system includes at least a first security environment and a second security environment, the first execution unit operates in the first security environment, and the second execution unit is in the second Running in a secure environment, the method includes:
  • the present specification provides a device for service authorization, which solves the problem that the verification result of the identity verification generated by a security environment in the prior art cannot be authenticated by another security environment.
  • the present specification provides a device for service authorization, the system including the device of the device includes at least a first security environment and a second security environment, the first execution unit operates in the first security environment, and the second execution unit Operating in the second secure environment, the apparatus includes:
  • the receiving module receives, by the first execution unit, signature information obtained by signing the verification result by the verification private key
  • the sending module sends the signature information to the second execution unit, so that the second execution unit verifies the signature information by using the verification public key corresponding to the verification private key, and determines After the verification of the signature information is passed, the service authorization is performed according to the verification result.
  • the present specification provides a device for service authorization, which solves the problem that the verification result of the identity verification generated by a security environment in the prior art cannot be authenticated by another security environment.
  • the present specification provides a service authorized device comprising one or more memories and a processor that stores a program and is configured to perform the following steps by the one or more processors:
  • the second execution unit Sending the signature information to the second execution unit, so that the second execution unit verifies the signature information by using the verification public key corresponding to the verification private key, and determines the signature information verification After passing, the service authorization is performed according to the verification result, wherein the second execution unit runs in a second security environment included in the system of the device.
  • the present specification provides a method for service authorization, which solves the problem that the verification result of the identity verification generated by a security environment in the prior art cannot be authenticated by another security environment.
  • the present specification provides a method for service authorization, where the system includes at least a first security environment and a second security environment, the first execution unit operates in the first security environment, and the second execution unit is in the second Running in a secure environment, the method includes:
  • the first execution unit receives the to-be-verified information sent by the service application
  • the present specification provides a device for service authorization, which solves the problem that the verification result of the identity verification generated by a security environment in the prior art cannot be authenticated by another security environment.
  • the present specification provides a device for service authorization, the system of the device includes at least a first security environment and a second security environment, the device operates in the first security environment, and the second execution unit is in the second security Operating in an environment, the device comprises:
  • the receiving module receives the information to be verified sent by the service application
  • a verification module verifying the to-be-verified information, and signing the obtained verification result by using the saved verification private key to obtain signature information
  • the sending module sends the signature information to the second execution unit by using the service application, so that the second execution unit performs the signature information by using the verification public key corresponding to the verification private key. Verification, and after the verification of the signature information is passed, the service authorization is performed according to the verification result.
  • the present specification provides a device for service authorization, which solves the problem that the verification result of the identity verification generated by a security environment in the prior art cannot be authenticated by another security environment.
  • the present specification provides a service authorized device comprising one or more memories and a processor that stores a program and is configured to perform the following steps by the one or more processors:
  • the first execution unit receives the to-be-verified information sent by the service application, where the first execution unit runs in a first security environment included in the system of the device;
  • the present specification provides a method for service authorization, which solves the problem that the verification result of the identity verification generated by a security environment in the prior art cannot be authenticated by another security environment.
  • the present specification provides a method for service authorization, where the system includes at least a first security environment and a second security environment, the first execution unit operates in the first security environment, and the second execution unit is in the second Running in a secure environment, the method includes:
  • the second execution unit acquires signature information that is sent by the first execution unit by using a service application, where the signature information is obtained by the first execution unit signing the verification result by verifying the private key, and the verification result is obtained. And being obtained by the first execution unit verifying the to-be-verified information sent by the service application;
  • the present specification provides a device for service authorization, which solves the problem that the verification result of the identity verification generated by a security environment in the prior art cannot be authenticated by another security environment.
  • the present specification provides a device for service authorization, the system of the device includes at least a first security environment and a second security environment, the first execution unit operates in the first security environment, and the device is in the second security Operating in an environment, the device comprises:
  • the verification module validates the signature information by using the verification public key corresponding to the verification private key, and after determining that the signature information passes the verification, according to the verification result parsed from the signature information Conduct business authorization.
  • the present specification provides a device for service authorization, which solves the problem that the verification result of the identity verification generated by a security environment in the prior art cannot be authenticated by another security environment.
  • the present specification provides a service authorized device comprising one or more memories and a processor, the memory storing a program and configured to perform the following steps by the one or more processors:
  • the second execution unit obtains the signature information sent by the first execution unit by using the service application, where the signature information is obtained by the first execution unit signing the verification result by using the verification private key, and the verification result is the An execution unit is configured to verify the information to be verified sent by the service application, where the first execution unit runs in a first security environment included in a system of the device, and the second execution unit is in the The system of the device includes a second security environment;
  • the first execution unit running in the first security environment may verify the acquired information to be verified, and sign the obtained verification result through the saved verification private key.
  • the second execution unit running in the second security environment can perform the credit authentication on the verification result obtained by the first execution unit running in the first security environment, so that the second The execution unit can determine whether to authorize the service executed by the business application based on the verification result obtained by the first execution unit, thereby providing the user with a safer and more effective authentication mode.
  • FIG. 1 is a schematic diagram of a service authorization process provided by the present specification
  • FIG. 2 is a schematic diagram of a process of applying for a service authorization to a second execution unit by using a dynamic parameter sent by a service application provided by a second execution unit;
  • FIG. 3 is a schematic diagram of verifying signature information by using a public key certificate according to the present specification
  • FIG. 4 is a schematic diagram of a device for service authorization provided by the present specification
  • FIG. 5 is a schematic diagram of a device for service authorization provided by the present specification.
  • FIG. 6 is a schematic diagram of a device for service authorization provided by the present specification.
  • FIG. 7 is a schematic diagram of a device for service authorization provided by the present specification.
  • FIG. 8 is a schematic diagram of a device for service authorization provided by the present specification.
  • FIG. 9 is a schematic diagram of a device for service authorization provided by the present specification.
  • a system running on a device usually includes different security environments. In actual applications, it is often necessary to cooperate with execution units or applications in different security environments to complete the entire service execution process.
  • the service application running in the first security environment may send the information to be verified obtained by the device to the first execution unit running in the first security environment, and the first execution unit may verify the information to be verified. And the obtained verification result is sent to the second execution unit running in the second security environment, and the second execution unit may determine, by using the verification result, whether to authorize the service currently executed by the service application.
  • the second execution unit operating in the second security environment generally cannot guarantee that the first execution unit operating in the first security environment will treat The verification result obtained after the verification information is sent to the second execution unit is not falsified, so how the second execution unit can obtain the verification result sent by the first execution unit is a A question worth considering.
  • the present specification provides a method for service authorization.
  • the information to be verified may be sent to the first execution unit, so that the first execution unit verifies the information to be verified.
  • the obtained verification result is signed by the verification private key held by the first execution unit to obtain signature information.
  • the service application can obtain the signature information returned by the first execution unit, and then send the signature information to the second execution unit, so that the second execution unit passes the verification certificate corresponding to the verification private key.
  • the key is used to verify the signature information, and after determining that the signature information is verified, the service authorization is performed according to the verification result.
  • the second execution unit running in the second security environment can perform the credit authentication on the verification result obtained by the first execution unit running in the first security environment, thereby enabling the second execution unit to enable the second execution unit to Based on the verification result obtained by the first execution unit, it is determined whether to authorize the service performed by the business application, thereby providing the user with a more secure and effective identity verification mode.
  • FIG. 1 is a schematic diagram of a service authorization process provided by the present specification, specifically including the following steps:
  • S100 Acquire information to be verified, and send the information to be verified to the first execution unit for verification.
  • the information to be verified that needs to be authenticated may be input to the service application in the device, so that the service application verifies the information to be verified through the first execution unit in the device.
  • the device mentioned here may be a mobile terminal device such as a smart phone or a tablet computer.
  • the information to be verified mentioned here may refer to information such as a fingerprint, voiceprint, and facial information waiting to be verified, or may be information to be verified in the form of characters.
  • the device can also directly send the collected information to be verified to the first execution unit through a preset interface.
  • the first execution unit may verify the information to be verified, and obtain a corresponding verification result. For example, after acquiring the fingerprint to be verified, the first execution unit may match the fingerprint to be verified with the fingerprint information of the user saved in advance, and determine whether the user passes the fingerprint verification according to the matching result.
  • the first security environment may refer to a TEE
  • the first execution unit that runs in the first security environment may refer to a module for performing information verification, and the module may be in the form of software. It can also be in the form of hardware.
  • the second security environment may refer to an execution environment provided by the SE.
  • the second execution unit may refer to a security application running in the SE.
  • S102 Receive signature information obtained by signing the verification result by the check private key returned by the first execution unit.
  • the obtained verification result may be signed by the self-checked private key, and the corresponding signature information is obtained, and the signature information is returned in a subsequent process. For business applications.
  • the first execution unit may acquire, from the first management server corresponding to the first execution unit, a check private key for signing the verification result.
  • the first management server may generate a unique pair of the check private key and the check public key for the first execution unit, and deliver the check private key to the first execution unit.
  • the check public key may be sent by the first management server to the second management server corresponding to the second execution unit, to send the check public key to the second execution unit by using the second management server,
  • the second execution unit is configured to verify the signature information generated by the first execution unit by using the check public key.
  • the first execution unit may return the obtained signature information to the service application, so that the service application subsequently sends the signature information to the second execution unit for verification.
  • the reason why the first execution unit needs to send the signature information to the second execution unit by using the service application is that the first execution unit and the second execution unit are located in different security environments, and the second execution unit is not
  • the first execution unit performs access authorization, so normally, the first execution unit cannot send information to the second execution unit running in the second security environment. Since the second execution unit needs to authorize the service executed by the service application, the second execution unit usually grants access authorization to the service application, and allows the service application to access the second execution unit. Based on this, the first execution unit needs to send the signature information to the second execution unit through the service application.
  • S104 Send the signature information to the second execution unit, so that the second execution unit verifies the signature information by using the verification public key corresponding to the verification private key, and determines After the verification of the signature information is passed, the service authorization is performed according to the verification result.
  • the service application may send the signature information returned by the first execution unit to the second execution unit running in the second security environment, and the second execution unit may verify the signature information by using the obtained verification public key. After determining that the signature information is verified, the verified verification result may be used to determine whether to authorize the service performed by the service application.
  • the first execution unit running in the first security environment can verify the obtained information to be verified, and the obtained verification result is signed by the saved verification private key, and then the obtained verification result is obtained.
  • the signature information is sent by the service application to the second execution unit running in the second security environment, and the second execution unit can verify the signature information by using the verification public key corresponding to the verification private key, and determine the signature information. After the verification is passed, the business authorization is performed according to the verification result.
  • the second execution unit running in the second security environment can perform the credit authentication on the verification result obtained by the first execution unit running in the first security environment, so that the second The execution unit can determine whether to authorize the service executed by the business application based on the verification result obtained by the first execution unit, thereby providing the user with a safer and more effective authentication mode.
  • the device used by the user may face a replay attack. That is, after the illegal agent obtains the verification result passed by the verification, the verification result may be continuously applied to the second execution unit.
  • Authorization which may result in loss of information or property of the user.
  • the service application may obtain the dynamic parameter generated by the second execution unit from the second execution unit, and send the dynamic parameter to the first execution unit, so that the first execution unit
  • the dynamic parameters and the obtained verification results are signed together to obtain signature information, as shown in FIG. 2 .
  • FIG. 2 is a schematic diagram of a process of applying for a service authorization to a second execution unit by a dynamic parameter sent by a service application provided by a second execution unit.
  • the service application can access a second execution unit running in the second security environment to obtain dynamic parameters such as random numbers, time information, etc., wherein the dynamic parameters can be generated by the second execution unit and The set time is saved in the second execution unit, and after the set time is reached, the second execution unit may delete the dynamic parameter.
  • the second execution unit sets an effective time for the generated dynamic parameter, that is, the service application sends the signature information obtained by signing the dynamic parameter and the verification result by the first execution unit within the valid time.
  • the second execution unit can verify the dynamic parameter parsed from the signature information by using the saved dynamic parameter, and once the valid time is exceeded, the dynamic parameter is invalidated, so that The dynamic parameters parsed in the signature information will not be verified by the second execution unit.
  • the first execution unit may verify the to-be-verified information sent by the service application, obtain a corresponding verification result, and sign the verification result and the obtained dynamic parameter by using the saved verification private key to obtain signature information.
  • the first execution unit may return the obtained signature information to the service application, and the service application sends the signature information to the second execution unit.
  • the second execution unit may verify the signature information by using the verification public key acquired from the second management server, and after determining that the signature information is verified, the dynamic information parsed from the signature information according to the pre-stored dynamic parameters.
  • the parameter is verified, that is, the parsed dynamic parameter is compared with the saved dynamic parameter to determine whether the two are consistent. When the consistency is determined, the parsed dynamic parameter is determined to be verified. If the inconsistency is determined, the parsed dynamic parameter is determined to be unsuccessful. verification. After determining that the dynamic parameter passes the verification, it may determine whether to authorize the service performed by the service application according to the verification result parsed from the signature information.
  • the verification public key and the verification private key mentioned herein are generated by the first management server corresponding to the first execution unit, and the first management server may send the generated verification private key to the first execution unit.
  • the save is performed, and the check public key is sent to the second execution unit by using the second management server corresponding to the second execution unit.
  • the second execution unit applies for business authorization, thereby ensuring the user's information and property security.
  • the first management server may generate a unique pair of check key pairs for different first execution units, or may generate the first execution unit of the batch for the first execution unit of one batch.
  • the required check key pair In other words, the first management server may generate a pair of check key pairs corresponding to the device for each device, or generate a pair of check marks corresponding to the batch device for a batch of devices. Key pair.
  • the timing at which the service application obtains the dynamic parameter from the second execution unit may be many.
  • the service application may first obtain the dynamic parameter from the second execution unit, and then the dynamic parameter and the acquired
  • the verification information is sent to the first execution unit, and the information to be verified is sent to the first execution unit, and then the dynamic parameter is acquired from the second execution unit and sent to the first execution unit.
  • the verification public key generated by the first management server may be sent to a certificate authority (CA) center for notarization, and a corresponding public key certificate is obtained, and the subsequent second execution unit may pass the public key certificate. , verify the signature information sent by the business application, as shown in Figure 3.
  • CA certificate authority
  • FIG. 3 is a schematic diagram of verifying signature information by a public key certificate provided in the present specification.
  • the check public key in the check key pair may be sent to the CA center for notarization, and the CA center may perform the test according to the test. Sign the public key and other information (such as the applicant's information, time information, etc., which is notarized for the certificate public key), and generate a public key certificate signed by the CA private key saved by itself. Then, the CA center can send the public key certificate to the first execution unit for saving by using the first management server, and send the CA public key corresponding to the CA private key to the second execution unit for storage.
  • the CA center can send the public key certificate to the first execution unit for saving by using the first management server, and send the CA public key corresponding to the CA private key to the second execution unit for storage.
  • the signature information and the public key certificate may be sent to the second execution unit through the service application, and the second execution unit may obtain the public key certificate by using the obtained CA public key.
  • the verification is performed, and the signature information is verified by the verification public key parsed from the public key certificate.
  • the dynamic parameter parsed from the signature information is further verified, and after determining that the dynamic parameter passes the verification, determining whether to apply to the service according to the verification result parsed from the signature information The currently executed business is authorized.
  • the first execution unit may, after determining that the information to be verified sent by the service application passes the verification, sign the acquired dynamic parameter to obtain corresponding signature information.
  • the second execution unit may determine that the previous to-be-verified information has passed the verification of the first execution unit, and further, when determining that the dynamic parameter parsed from the signature information passes the verification, Authorize the business currently being executed by the business application.
  • the business application can display data such as signature information acquired from the first execution unit to the user through an interface that the service application can provide when running in the first security environment.
  • the first execution unit may also display the verification result after the verification of the information to be verified by using the interface that the first execution unit can run in the first security environment, so that the user can Verify the results to view.
  • the second execution unit running in the second security environment can perform credit authentication on the verification result obtained by the first execution unit running in the first security environment.
  • the second execution unit is capable of determining whether to authorize the service performed by the business application based on the verification result obtained by the first execution unit.
  • the second execution unit can authorize the biometric verification performed by the first execution unit, so that for a service that requires two different security environments to cooperate with each other, the user can pass the biometric identification,
  • An easy-to-use authentication method for authentication which brings a good user experience to the user during the execution of the business.
  • the above is a service authorization method provided by one or more embodiments of the present specification. Based on the same idea, the present specification further provides a corresponding service authorization device, as shown in FIGS. 4, 5, and 6.
  • FIG. 4 is a schematic diagram of a device for service authorization provided by the present specification, specifically including:
  • the obtaining module 401 is configured to obtain information to be verified, and send the information to be verified to the first execution unit for verification;
  • the receiving module 402 receives, by the first execution unit, signature information obtained by signing the verification result by the verification private key;
  • the sending module 403 is configured to send the signature information to the second execution unit, so that the second execution unit verifies the signature information by using the verification public key corresponding to the verification private key, and After determining that the signature information is verified, the service authorization is performed according to the verification result.
  • the first security environment includes: a trusted execution environment TEE; and the second security environment includes an execution environment provided by the secure element SE.
  • the information to be verified includes: biometric information to be verified.
  • the acquiring module 401 is configured to acquire the dynamic parameter that is sent by the second execution unit, where the dynamic parameter includes: at least one of a random number and time information; and the dynamic parameter is sent to the first execution unit, so that The first execution unit signs the verification result and the dynamic parameter by using the check private key.
  • FIG. 5 is a schematic diagram of a device for service authorization provided by the present disclosure, specifically including:
  • the receiving module 501 is configured to receive information to be verified sent by the service application.
  • the verification module 502 verifies the to-be-verified information, and signs the obtained verification result by using the saved verification private key to obtain signature information.
  • the sending module 503 is configured to send the signature information to the second execution unit by using the service application, so that the second execution unit passes the verification public key corresponding to the verification private key to the signature information.
  • the verification is performed, and after the verification of the signature information is passed, the service authorization is performed according to the verification result.
  • the business application runs in the first secure environment.
  • the receiving module 501 receives a dynamic parameter that is sent by the second execution unit by using the service application.
  • the verification module 502 signs the verification result and the dynamic parameter by using the verification private key to obtain signature information.
  • the device also includes:
  • the obtaining module 504 is configured to obtain the check private key from a first management server corresponding to the device.
  • the obtaining module 504 is configured to obtain, from the first management server, a public key certificate of the check public key, where the public key certificate is obtained by the first management server from a certificate authority CA center, and the public key The certificate is obtained after the CA center authenticates the check public key according to the saved CA private key.
  • the sending module 503 sends the public key certificate and the signature information to the second execution unit through the service application, so that the second execution unit passes the CA publicly obtained from the CA center. Key, verifying the public key certificate, and verifying the signature information by verifying the public key that is parsed from the public key certificate after determining that the public key certificate is verified.
  • FIG. 6 is a schematic diagram of a device for service authorization provided by the present specification, specifically including:
  • the obtaining module 601 is configured to obtain signature information that is sent by the first execution unit by using a service application, where the signature information is obtained by the first execution unit signing the verification result by using the verification private key, where the verification result is The first execution unit obtains the verification information to be verified sent by the service application, and obtains the information;
  • the verification module 602 is configured to verify the signature information by using the verification public key corresponding to the verification private key, and after determining that the signature information is verified, according to the verification that is parsed from the signature information.
  • the result is a business authorization.
  • the check public key is obtained by the device from the first management server corresponding to the first execution unit by using a second management server corresponding to the device.
  • the obtaining module 601 obtains a CA public key from a certificate authority CA center by using a second management server corresponding to the device.
  • the verification module 602 is configured to verify, by using the CA public key, a public key certificate sent by the service application, where the public key certificate is a CA private key pair corresponding to the CA public key by the CA center.
  • the public key certificate is obtained by the first execution unit, and the public key certificate is obtained by the first execution unit by the first execution unit.
  • the first management server corresponding to the unit is obtained from the CA center; and after determining that the public key certificate passes the verification, verifying the signature information by using the verification public key parsed from the public key certificate And after determining that the signature information is verified, performing service authorization according to the verification result parsed from the signature information.
  • the device also includes:
  • the sending module 603 sends a dynamic parameter to the service application, so that the first execution unit signs the verification result and the dynamic parameter acquired from the service application by using the check private key. Get the signature information.
  • the verification module 602 by using the CA public key, to verify the public key certificate; after determining that the public key certificate passes the verification, by verifying the public key from the public key certificate, The signature information is verified; after the verification of the signature information is verified, the dynamic parameters parsed from the signature information are verified, and after determining that the dynamic parameters are verified, according to the signature information
  • the verified verification result is used for business authorization.
  • the present specification further provides a device for service authorization, as shown in FIG. 7.
  • the device includes one or more memories and a processor that stores the program and is configured to perform the following steps by the one or more processors:
  • the second execution unit Sending the signature information to the second execution unit, so that the second execution unit verifies the signature information by using the verification public key corresponding to the verification private key, and determines the signature information verification After passing, the service authorization is performed according to the verification result, wherein the second execution unit runs in a second security environment included in the system of the device.
  • the present specification also provides a device for service authorization, as shown in FIG.
  • the device includes one or more memories and a processor that stores the program and is configured to perform the following steps by the one or more processors:
  • the first execution unit receives the to-be-verified information sent by the service application, where the first execution unit runs in a first security environment included in the system of the device;
  • the present specification further provides a device for service authorization, as shown in FIG.
  • the device includes one or more memories and a processor that stores the program and is configured to perform the following steps by the one or more processors:
  • the second execution unit obtains the signature information sent by the first execution unit by using the service application, where the signature information is obtained by the first execution unit signing the verification result by using the verification private key, and the verification result is the An execution unit is configured to verify the information to be verified sent by the service application, where the first execution unit runs in a first security environment included in a system of the device, and the second execution unit is in the The system of the device includes a second security environment;
  • the information to be verified may be sent to the first execution unit, so that the first execution unit verifies the information to be verified, and The obtained verification result is signed by the verification private key held by the first execution unit to obtain signature information.
  • the service application can obtain the signature information returned by the first execution unit, and then send the signature information to the second execution unit, so that the second execution unit passes the verification certificate corresponding to the verification private key.
  • the key is used to verify the signature information, and after determining that the signature information is verified, the service authorization is performed according to the verification result.
  • the second execution unit running in the second security environment can perform the credit authentication on the verification result obtained by the first execution unit running in the first security environment, thereby enabling the second execution unit to enable the second execution unit to Based on the verification result obtained by the first execution unit, it is determined whether to authorize the service performed by the business application, thereby providing the user with a more secure and effective identity verification mode.
  • PLD Programmable Logic Device
  • FPGA Field Programmable Gate Array
  • HDL Hardware Description Language
  • the controller can be implemented in any suitable manner, for example, the controller can take the form of, for example, a microprocessor or processor and a computer readable medium storing computer readable program code (eg, software or firmware) executable by the (micro)processor.
  • computer readable program code eg, software or firmware
  • examples of controllers include, but are not limited to, the following microcontrollers: ARC 625D, Atmel AT91SAM, The Microchip PIC18F26K20 and the Silicone Labs C8051F320, the memory controller can also be implemented as part of the memory's control logic.
  • the controller can be logically programmed by means of logic gates, switches, ASICs, programmable logic controllers, and embedding.
  • Such a controller can therefore be considered a hardware component, and the means for implementing various functions included therein can also be considered as a structure within the hardware component.
  • a device for implementing various functions can be considered as a software module that can be both a method of implementation and a structure within a hardware component.
  • the system, device, module or unit illustrated in the above embodiments may be implemented by a computer chip or an entity, or by a product having a certain function.
  • a typical implementation device is a computer.
  • the computer can be, for example, a personal computer, a laptop computer, a cellular phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or A combination of any of these devices.
  • embodiments of the present specification can be provided as a method, system, or computer program product. Accordingly, the description may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment in combination of software and hardware. Moreover, the description may take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) including computer usable program code.
  • computer-usable storage media including but not limited to disk storage, CD-ROM, optical storage, etc.
  • the computer program instructions can also be stored in a computer readable memory that can direct a computer or other programmable data processing device to operate in a particular manner, such that the instructions stored in the computer readable memory produce an article of manufacture comprising the instruction device.
  • the apparatus implements the functions specified in one or more blocks of a flow or a flow and/or block diagram of the flowchart.
  • These computer program instructions can also be loaded onto a computer or other programmable data processing device such that a series of operational steps are performed on a computer or other programmable device to produce computer-implemented processing for execution on a computer or other programmable device.
  • the instructions provide steps for implementing the functions specified in one or more of the flow or in a block or blocks of a flow diagram.
  • a computing device includes one or more processors (CPUs), input/output interfaces, network interfaces, and memory.
  • processors CPUs
  • input/output interfaces network interfaces
  • memory volatile and non-volatile memory
  • the memory may include non-persistent memory, random access memory (RAM), and/or non-volatile memory in a computer readable medium, such as read only memory (ROM) or flash memory.
  • RAM random access memory
  • ROM read only memory
  • Memory is an example of a computer readable medium.
  • Computer readable media includes both permanent and non-persistent, removable and non-removable media.
  • Information storage can be implemented by any method or technology.
  • the information can be computer readable instructions, data structures, modules of programs, or other data.
  • Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read only memory. (ROM), electrically erasable programmable read only memory (EEPROM), flash memory or other memory technology, compact disk read only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, Magnetic tape cartridges, magnetic tape storage or other magnetic storage devices or any other non-transportable media can be used to store information that can be accessed by a computing device.
  • computer readable media does not include temporary storage of computer readable media, such as modulated data signals and carrier waves.
  • program modules include routines, programs, objects, components, data structures, and the like that perform particular tasks or implement particular abstract data types.
  • One or more embodiments of the present specification may also be practiced in distributed computing environments where tasks are performed by remote processing devices that are connected through a communication network.
  • program modules can be located in both local and remote computer storage media including storage devices.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • General Engineering & Computer Science (AREA)
  • Computing Systems (AREA)
  • Biomedical Technology (AREA)
  • Health & Medical Sciences (AREA)
  • General Health & Medical Sciences (AREA)
  • Software Systems (AREA)
  • Theoretical Computer Science (AREA)
  • Life Sciences & Earth Sciences (AREA)
  • Biodiversity & Conservation Biology (AREA)
  • Accounting & Taxation (AREA)
  • Business, Economics & Management (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Storage Device Security (AREA)
  • Management, Administration, Business Operations System, And Electronic Commerce (AREA)

Abstract

本说明书公开一种业务授权的方法、装置及设备，该方法中在获取到待验证信息后，可将该待验证信息发送至第一执行单元，以使该第一执行单元对该待验证信息进行验证，并将得到的验证结果通过该第一执行单元所保存的验签私钥进行签名，得到签名信息。而后，业务应用可以获取到该第一执行单元所返回的该签名信息，进而该将签名信息发送给第二执行单元，以使该第二执行单元通过该验签私钥所对应的验签公钥，对该签名信息进行验证，并在确定该签名信息验证通过后，根据该验证结果进行业务授权。

Description

一种业务授权的方法、装置及设备 技术领域
本说明书涉及计算机技术领域，尤其涉及一种业务授权的方法、装置及设备。
背景技术
当前，传统基于密码的身份验证方式由于其存在易被遗忘、易被窃取、不便于输入等问题，已逐渐无法满足用户在进行身份验证时的便利性和安全性的需求，而基于指纹、声纹、面部识别等生物特征的身份验证方式由于其更为安全、更为便捷，已在各种场景中广泛应用。
在实际应用中，设备运行的系统中通常包括两种环境，一种是可信执行环境(Trusted Execution Environment，TEE)，一种为安全元件(Secure Element，SE)所提供的执行环境，其中，用于进行业务处理的业务应用通常运行在该TEE中。而用于对用户所要执行的业务进行授权的安全应用则运行在SE中。通常情况下，终端需要对用户输入的待验证生物特征信息进行验证，得到验证结果，该验证结果需要发送至该安全应用进行验证，而只有该安全应用确定该验证结果通过验证后，该安全应用才会对此次业务应用所执行的业务进行授权，进而使得业务应用执行该业务。
然而，由于验证结果在从TEE传递至SE的过程中可能会存在被篡改的可能，所以，安全应用如何取信从TEE发来的验证结果则是一个值得考虑的问题。
基于现有技术，需要更为有效的业务授权方式。
发明内容
本说明书提供一种业务授权的方法，用以解决现有技术中一种安全环境所产生的身份验证的验证结果无法得到另一个安全环境授信认证的问题。
本说明书提供了一种业务授权的方法，设备的系统中至少包括第一安全环境以及第二安全环境，第一执行单元在所述第一安全环境中运行，第二执行单元在所述第二安全环境中运行，所述方法包括：
获取待验证信息，并将所述待验证信息发送给所述第一执行单元进行验证；
接收所述第一执行单元返回的通过验签私钥对验证结果进行签名得到的签名信息；
将所述签名信息发送给所述第二执行单元，以使所述第二执行单元通过所述验签私钥对应的验签公钥，对所述签名信息进行验证，并在确定所述签名信息验证通过后，根据所述验证结果进行业务授权。
本说明书提供一种业务授权的装置，用以解决现有技术中一种安全环境所产生的身份验证的验证结果无法得到另一个安全环境授信认证的问题。
本说明书提供了一种业务授权的装置，包含所述装置的设备的系统中至少包括第一安全环境以及第二安全环境，第一执行单元在所述第一安全环境中运行，第二执行单元在所述第二安全环境中运行，所述装置包括：
获取模块，获取待验证信息，并将所述待验证信息发送给所述第一执行单元进行验证；
接收模块，接收所述第一执行单元返回的通过验签私钥对验证结果进行签名得到的签名信息；
发送模块，将所述签名信息发送给所述第二执行单元，以使所述第二执行单元通过所述验签私钥对应的验签公钥，对所述签名信息进行验证，并在确定所述签名信息验证通过后，根据所述验证结果进行业务授权。
本说明书提供一种业务授权的设备，用以解决现有技术中一种安全环境所产生的身份验证的验证结果无法得到另一个安全环境授信认证的问题。
本说明书提供了一种业务授权的设备，包括一个或多个存储器以及处理器，所述存储器存储程序，并且被配置成由所述一个或多个处理器执行以下步骤：
获取待验证信息，并将所述待验证信息发送给第一执行单元进行验证，其中，所述第一执行单元在所述设备的系统包括的第一安全环境中运行；
接收所述第一执行单元返回的通过验签私钥对验证结果进行签名得到的签名信息；
将所述签名信息发送给第二执行单元，以使所述第二执行单元通过所述验签私钥对应的验签公钥，对所述签名信息进行验证，并在确定所述签名信息验证通过后，根据所述验证结果进行业务授权，其中，所述第二执行单元在所述设备的系统包括的第二安全环境中运行。
本说明书提供一种业务授权的方法，用以解决现有技术中一种安全环境所产生的身份验证的验证结果无法得到另一个安全环境授信认证的问题。
本说明书提供了一种业务授权的方法，设备的系统中至少包括第一安全环境以及第二安全环境，第一执行单元在所述第一安全环境中运行，第二执行单元在所述第二安全环境中运行，所述方法包括：
所述第一执行单元接收业务应用发送的待验证信息；
对所述待验证信息进行验证，并将得到的验证结果通过保存的验签私钥进行签名，得到签名信息；
将所述签名信息通过所述业务应用发送给所述第二执行单元，以使所述第二执行单元通过所述验签私钥对应的验签公钥，对所述签名信息进行验证，并在所述签名信息验证通过后，根据所述验证结果进行业务授权。
本说明书提供一种业务授权的装置，用以解决现有技术中一种安全环境所产生的身份验证的验证结果无法得到另一个安全环境授信认证的问题。
本说明书提供了一种业务授权的装置，设备的系统中至少包括第一安全环境以及第二安全环境，所述装置在所述第一安全环境中运行，第二执行单元在所述第二安全环境中运行，所述装置包括：
接收模块，接收业务应用发送的待验证信息；
验证模块，对所述待验证信息进行验证，并将得到的验证结果通过保存的验签私钥进行签名，得到签名信息；
发送模块，将所述签名信息通过所述业务应用发送给所述第二执行单元，以使所述第二执行单元通过所述验签私钥对应的验签公钥，对所述签名信息进行验证，并在所述签名信息验证通过后，根据所述验证结果进行业务授权。
本说明书提供一种业务授权的设备，用以解决现有技术中一种安全环境所产生的身份验证的验证结果无法得到另一个安全环境授信认证的问题。
本说明书提供了一种业务授权的设备，包括一个或多个存储器以及处理器，所述存储器存储程序，并且被配置成由所述一个或多个处理器执行以下步骤：
第一执行单元接收业务应用发送的待验证信息，其中，所述第一执行单元在所述设备的系统包括的第一安全环境中运行；
对所述待验证信息进行验证，并将得到的验证结果通过保存的验签私钥进行签名，得到签名信息；
将所述签名信息通过所述业务应用发送给第二执行单元，以使所述第二执行单元通过所述验签私钥对应的验签公钥，对所述签名信息进行验证，并在所述签名信息验证通过后，根据所述验证结果进行业务授权，其中，所述第二执行单元在所述设备的系统包括的第二安全环境中运行。
本说明书提供一种业务授权的方法，用以解决现有技术中一种安全环境所产生的身份验证的验证结果无法得到另一个安全环境授信认证的问题。
本说明书提供了一种业务授权的方法，设备的系统中至少包括第一安全环境以及第二安全环境，第一执行单元在所述第一安全环境中运行，第二执行单元在所述第二安全环境中运行，所述方法包括：
所述第二执行单元获取所述第一执行单元通过业务应用发送的签名信息，所述签名信息是所述第一执行单元通过验签私钥对验证结果进行签名后得到的，所述验证结果是所述第一执行单元对所述业务应用发送的待验证信息进行验证后得到的；
通过所述验签私钥对应的验签公钥，对所述签名信息进行验证，并在确定所述签名信息通过验证后，根据从所述签名信息中解析出的所述验证结果进行业务授权。
本说明书提供一种业务授权的装置，用以解决现有技术中一种安全环境所产生的身份验证的验证结果无法得到另一个安全环境授信认证的问题。
本说明书提供了一种业务授权的装置，设备的系统中至少包括第一安全环境以及第二安全环境，第一执行单元在所述第一安全环境中运行，所述装置在所述第二安全环境中运行，所述装置包括：
获取模块，获取所述第一执行单元通过业务应用发送的签名信息，所述签名信息是所述第一执行单元通过验签私钥对验证结果进行签名后得到的，所述验证结果是所述第一执行单元对所述业务应用发送的待验证信息进行验证后得到的；
验证模块，通过所述验签私钥对应的验签公钥，对所述签名信息进行验证，并在确定所述签名信息通过验证后，根据从所述签名信息中解析出的所述验证结果进行业务授权。
本说明书提供一种业务授权的设备，用以解决现有技术中一种安全环境所产生的身份验证的验证结果无法得到另一个安全环境授信认证的问题。
本说明书提供了一种业务授权的设备，包括一个或多个存储器以及处理器，所述存 储器存储程序，并且被配置成由所述一个或多个处理器执行以下步骤：
第二执行单元获取第一执行单元通过业务应用发送的签名信息，所述签名信息是所述第一执行单元通过验签私钥对验证结果进行签名后得到的，所述验证结果是所述第一执行单元对所述业务应用发送的待验证信息进行验证后得到的，其中，所述第一执行单元在所述设备的系统包括的第一安全环境中运行，所述第二执行单元在所述设备的系统包括的第二安全环境中运行；
通过所述验签私钥对应的验签公钥，对所述签名信息进行验证，并在确定所述签名信息通过验证后，根据从所述签名信息中解析出的所述验证结果进行业务授权。
本说明书采用的上述至少一个技术方案能够达到以下有益效果：
在本说明书一个或多个实施例中，运行于第一安全环境中的第一执行单元可以对获取到的待验证信息进行验证，将得到的验证结果通过保存的验签私钥进行签名，进而将得到的签名信息通过业务应用发送给运行在第二安全环境中的第二执行单元，第二执行单元可以通过该验签私钥对应的验签公钥对该签名信息进行验证，并在确定该签名信息验证通过后，根据该验证结果进行业务授权。换句话说，利用非对称加密方式，可以使运行于第二安全环境中的第二执行单元对运行在第一安全环境中的第一执行单元所得到的验证结果进行授信认证，从而使得第二执行单元能够基于第一执行单元所得到的验证结果，确定是否对业务应用所执行的业务进行授权，进而向用户提供了更为安全、有效的身份验证方式。
附图说明
此处所说明的附图用来提供对本说明书的进一步理解，构成本说明书的一部分，本说明书的示意性实施例及其说明用于解释本说明书，并不构成对本说明书的不当限定。在附图中：
图1为本说明书提供的业务授权过程的示意图；
图2为本说明书提供的业务应用通过第二执行单元发送的动态参数向第二执行单元申请业务授权的过程示意图；
图3为本说明书提供的通过公钥证书对签名信息进行验证的示意图；
图4为本说明书提供的一种业务授权的装置示意图；
图5为本说明书提供的一种业务授权的装置示意图；
图6为本说明书提供的一种业务授权的装置示意图；
图7为本说明书提供的一种业务授权的设备示意图；
图8为本说明书提供的一种业务授权的设备示意图；
图9为本说明书提供的一种业务授权的设备示意图。
具体实施方式
通常情况下，设备运行的系统中通常包括不同的安全环境，而在实际应用中，往往需要通过不同安全环境中执行单元或应用的相互协作，才能完成整个的业务执行过程。具体的，运行于第一安全环境中的业务应用，可以将设备获取到的待验证信息发送给运行在第一安全环境中的第一执行单元，第一执行单元可以对该待验证信息进行验证，并将得到的验证结果发送给运行于第二安全环境中的第二执行单元，第二执行单元可以通过该验证结果，确定是否对业务应用当前执行的业务进行授权。
由于第一执行单元和第二执行单元位于不同的安全环境中，所以，通常情况下，运行于第二安全环境的第二执行单元通常无法保证运行于第一安全环境的第一执行单元将对待验证信息进行验证后得到的验证结果发送至第二执行单元的过程中，该验证结果不会被篡改，所以，第二执行单元如何对第一执行单元所发送的验证结果进行取信，则是一个值得考虑的问题。
为此，本说明书提供了一种业务授权的方法，在获取到待验证信息后，可将该待验证信息发送至第一执行单元，以使该第一执行单元对该待验证信息进行验证，并将得到的验证结果通过该第一执行单元所保存的验签私钥进行签名，得到签名信息。而后，业务应用可以获取到该第一执行单元所返回的该签名信息，进而该将签名信息发送给第二执行单元，以使该第二执行单元通过该验签私钥所对应的验签公钥，对该签名信息进行验证，并在确定该签名信息验证通过后，根据该验证结果进行业务授权。
由于利用非对称加密方式，可以使运行于第二安全环境中的第二执行单元对运行于第一安全环境中的第一执行单元所得到的验证结果进行授信认证，从而使得第二执行单元能够基于第一执行单元所得到的验证结果，确定是否对业务应用所执行的业务进行授权，进而向用户提供了更为安全、有效的身份验证方式。
为了使本技术领域的人员更好地理解本说明书一个或多个实施例中的技术方案，下 面将结合本说明书一个或多个实施例中的附图，对本说明书一个或多个实施例中的技术方案进行清楚、完整地描述，显然，所描述的实施例仅仅是本说明书一部分实施例，而不是全部的实施例。基于本说明书中的实施例，本领域普通技术人员在没有作出创造性劳动前提下所获得的所有其他实施例，都应当属于本说明书保护的范围。
图1为本说明书提供的业务授权过程的示意图，具体包括以下步骤：
S100：获取待验证信息，并将所述待验证信息发送给所述第一执行单元进行验证。
在本说明书中，用户在执行业务时，可以将需要进行身份验证的待验证信息输入到设备中业务应用，以使该业务应用通过该设备中的第一执行单元对该待验证信息进行验证。其中，这里提到的设备可以是诸如智能手机、平板电脑等移动终端设备。而这里提到的待验证信息可以是指诸如指纹、声纹、面部信息等待验证生物特征信息，也可以是指字符形式的待验证信息。当然，设备也可通过预设的接口，将采集到的待验证信息直接发送给第一执行单元。
第一执行单元在获取到该待验证信息后，可以对其进行验证，并得到相应的验证结果。例如，第一执行单元在获取到待验证指纹后，可以将该待验证指纹与预先保存的用户的指纹信息进行匹配，并根据匹配结果，确定用户是否通过指纹验证。
需要说明的是，在本说明书中，第一安全环境可以是指TEE，运行于第一安全环境中的第一执行单元可以是指用于进行信息验证的模块，该模块可以是软件的形式，也可以是硬件的形式。第二安全环境可以是指SE所提供的执行环境，相应的，第二执行单元可以是指运行在SE中的安全应用。
S102：接收所述第一执行单元返回的通过验签私钥对验证结果进行签名得到的签名信息。
第一执行单元对该待验证信息进行验证后，可将得到的验证结果通过自己所保存的验签私钥进行签名，得到的相应的签名信息，并在后续的过程中，将该签名信息返回给业务应用。
在本说明书中，第一执行单元可以从该第一执行单元所对应的第一管理服务器获取到用于对验证结果进行签名的验签私钥。其中，该第一管理服务器可以针对该第一执行单元，生成唯一的一对验签私钥和验签公钥，并将该验签私钥下发至该第一执行单元中。而该验签公钥则可由该第一管理服务器发送给第二执行单元所对应的第二管理服务器中，以通过该第二管理服务器，将该验签公钥发送至第二执行单元，以在后续过程中， 使该第二执行单元通过该验签公钥对第一执行单元所生成的签名信息进行验证。
在本说明书中，第一执行单元可以将得到的签名信息返回给该业务应用，以使该业务应用在后续将该签名信息发送给第二执行单元进行验证。其中，第一执行单元需要通过该业务应用将该签名信息发送给第二执行单元的原因在于，由于第一执行单元和第二执行单元位于不同的安全环境中，且，第二执行单元未对该第一执行单元进行访问授权，所以，通常情况下，第一执行单元是无法向运行于第二安全环境中的第二执行单元发送信息的。而由于第二执行单元需要对业务应用所执行的业务进行授权，所以，通常第二执行单元会对业务应用进行访问授权，允许业务应用向该第二执行单元进行访问。基于此，第一执行单元需要通过业务应用，将该签名信息发送给该第二执行单元。
S104：将所述签名信息发送给所述第二执行单元，以使所述第二执行单元通过所述验签私钥对应的验签公钥，对所述签名信息进行验证，并在确定所述签名信息验证通过后，根据所述验证结果进行业务授权。
业务应用可将第一执行单元返回的签名信息发送给运行于第二安全环境中的第二执行单元，该第二执行单元可以通过获取到的验签公钥，对该签名信息进行验证，进而在确定该签名信息通过验证后，可以通过解析出的验证结果，确定是否对该业务应用所执行的业务进行授权。
从上述方法中可以看出，运行于第一安全环境中的第一执行单元可以对获取到的待验证信息进行验证，将得到的验证结果通过保存的验签私钥进行签名，进而将得到的签名信息通过业务应用发送给运行在第二安全环境中的第二执行单元，第二执行单元可以通过该验签私钥对应的验签公钥对该签名信息进行验证，并在确定该签名信息验证通过后，根据该验证结果进行业务授权。换句话说，利用非对称加密方式，可以使运行于第二安全环境中的第二执行单元对运行在第一安全环境中的第一执行单元所得到的验证结果进行授信认证，从而使得第二执行单元能够基于第一执行单元所得到的验证结果，确定是否对业务应用所执行的业务进行授权，进而向用户提供了更为安全、有效的身份验证方式。
在上述说明的业务授权过程中，用户所使用的设备可能会面临重放攻击的可能，即，不法份子获取到验证通过的验证结果后，可以通过该验证结果不断的向第二执行单元申请业务授权，从而可能导致用户的信息或财产遭到损失。
为了防止上述情况的发生，业务应用可以从该第二执行单元获取到由该第二执行单 元生成的动态参数，并将该动态参数发送给第一执行单元，以使该第一执行单元对该动态参数以及得到的验证结果一并进行签名，得到签名信息，如图2所示。
图2为本说明书提供的业务应用通过第二执行单元发送的动态参数向第二执行单元申请业务授权的过程示意图。
在图2中，业务应用可以访问运行于第二安全环境的第二执行单元，以获取到诸如随机数、时间信息等动态参数，其中，该动态参数可以由第二执行单元生成并在该第二执行单元中保存设定时间，在到达设定时间后，该第二执行单元可以将该动态参数删除。这里可以理解成，该第二执行单元对生成的动态参数设置了一个有效时间，即，业务应用只有在该有效时间内将第一执行单元对动态参数以及验证结果进行签名后得到的签名信息发送至第二执行单元中，第二执行单元才可以通过保存的动态参数对从该签名信息中解析出的动态参数进行验证，而一旦超过该有效时间，该动态参数将被作废，这样，从该签名信息中解析出的动态参数将无法通过第二执行单元的验证。
第一执行单元可以对业务应用发送的待验证信息进行验证，得到相应的验证结果，并通过保存的验签私钥，对该验证结果以及获取到的动态参数进行签名，得到签名信息。
第一执行单元可以将得到的签名信息返回给业务应用，由该业务应用将该签名信息发送给第二执行单元。第二执行单元可以通过从第二管理服务器获取到的验签公钥对该签名信息进行验证，并在确定该签名信息通过验证后，根据预先保存的动态参数对从该签名信息解析出的动态参数进行验证，即，对解析出的动态参数与保存的动态参数进行比对，确定两者是否一致，一致时，确定解析出的动态参数通过验证，不一致时，确定解析出的动态参数未通过验证。在确定该动态参数通过验证后，则可以根据从该签名信息中解析出的验证结果，确定是否对业务应用所执行的业务进行授权。
其中，这里提到的验签公钥以及验签私钥是由第一执行单元所对应的第一管理服务器生成的，该第一管理服务器可以将生成的验签私钥发送给第一执行单元进行保存，并将该验签公钥通过第二执行单元所对应的第二管理服务器下发给第二执行单元。
由于在每次业务执行过程中，业务应用向第二执行单元获取的动态参数均不相同，所以，即使不法份子利用某一次验证通过的验证结果，也无法通过重放攻击的方式，不断向第二执行单元申请业务授权，从而保证了用户的信息以及财产的安全。
需要说明的是，第一管理服务器可以针对不同的第一执行单元，生成唯一的一对验签密钥对，也可以针对一个批次的第一执行单元，生成这一批次第一执行单元所需的验 签密钥对。换句话说，第一管理服务器可以针对每一个设备，生成唯一对应该设备的一对验签密钥对，也可以针对一批次的设备，生成对应这一批次设备的一对验签密钥对。
在本说明书中，业务应用从第二执行单元获取上述动态参数的时机可以有很多，例如，业务应用可以先从第二执行单元中获取该动态参数，而后再将该动态参数和获取到的待验证信息发送给第一执行单元，也可以先将该待验证信息发送给第一执行单元，而后再从第二执行单元获取该动态参数并发送给第一执行单元。
在本说明书中，第一管理服务器生成的验签公钥可以发送至证书授权(Certificate Authority，CA)中心进行公证，并得到相应的公钥证书，而后续第二执行单元可以通过该公钥证书，对业务应用发送的签名信息进行验证，如图3所示。
图3为本说明书提供的通过公钥证书对签名信息进行验证的示意图。
第一执行单元所对应的第一管理服务器在生成一对验签密钥对后，可以将该验签密钥对中的验签公钥发送至CA中心进行公证，该CA中心可以根据该验签公钥以及其他信息(如申请对该验签公钥进行公证的申请人的信息、时间信息等)，生成被自己所保存的CA私钥进行签名的公钥证书。而后，CA中心可以将该公钥证书通过第一管理服务器发送给第一执行单元进行保存，同时将该CA私钥所对应的CA公钥通过第二管理服务器发送给第二执行单元进行保存。
这样一来，第一执行单元生成签名信息后，可以将该签名信息以及公钥证书通过业务应用发送给第二执行单元，第二执行单元可以通过获取到的CA公钥，对该公钥证书进行验证，并通过从该公钥证书解析出的验签公钥，对该签名信息进行验证。在确定该签名信息验证通过后，进一步对从该签名信息中解析出的动态参数进行验证，并在确定该动态参数通过验证后，根据从该签名信息解析出的验证结果，确定是否对业务应用当前所执行的业务进行授权。
在本说明书中，第一执行单元可以在确定业务应用发送的待验证信息通过验证后，对获取到的动态参数进行签名，得到相应的签名信息。而第二执行单元通过业务应用接收到该签名信息时，则可以确定先前的待验证信息已通过第一执行单元的验证，进而在确定从该签名信息中解析出的动态参数通过验证时，可以对该业务应用当前所执行的业务进行授权。
在本说明书中，业务应用可以通过该业务应用在第一安全环境中运行时所能提供的界面，将从第一执行单元获取到的签名信息等数据展示给用户。同理，第一执行单元也 可以通过该第一执行单元在第一安全环境中运行时所能提供的界面，将对该待验证信息进行验证后的验证结果进行展示，以使用户可以对该验证结果进行查看。
从上述方法中可以看出，通过非对称加密方式，可以使运行于第二安全环境中的第二执行单元对运行在第一安全环境中的第一执行单元所得到的验证结果进行授信认证，从而使得第二执行单元能够基于第一执行单元所得到的验证结果，确定是否对业务应用所执行的业务进行授权。
并且通过上述方式，第二执行单元可以授信第一执行单元所进行的生物识别验证，这样一来，对于需要两个不同安全环境相互协作完成的业务来说，用户可以通过生物识别这种简单、易操作的身份验证方式，进行身份验证，从而给用户在业务执行的过程中，带来了良好的用户体验。
以上为本说明书的一个或多个实施例提供的业务授权方法，基于同样的思路，本说明书还提供了相应的业务授权的装置，如图4、5、6所示。
图4为本说明书提供的一种业务授权的装置示意图，具体包括：
获取模块401，获取待验证信息，并将所述待验证信息发送给所述第一执行单元进行验证；
接收模块402，接收所述第一执行单元返回的通过验签私钥对验证结果进行签名得到的签名信息；
发送模块403，将所述签名信息发送给所述第二执行单元，以使所述第二执行单元通过所述验签私钥对应的验签公钥，对所述签名信息进行验证，并在确定所述签名信息验证通过后，根据所述验证结果进行业务授权。
所述第一安全环境包括：可信执行环境TEE；所述第二安全环境包括：安全元件SE提供的执行环境。
所述待验证信息包括：待验证生物特征信息。
所述获取模块401，获取所述第二执行单元发送的动态参数，所述动态参数包括：随机数、时间信息中的至少一种；将所述动态参数发送给所述第一执行单元，使所述第一执行单元通过所述验签私钥对所述验证结果和所述动态参数进行签名。
图5为本说明书提供的一种业务授权的装置示意图，具体包括：
接收模块501，接收业务应用发送的待验证信息；
验证模块502，对所述待验证信息进行验证，并将得到的验证结果通过保存的验签私钥进行签名，得到签名信息；
发送模块503，将所述签名信息通过所述业务应用发送给所述第二执行单元，以使所述第二执行单元通过所述验签私钥对应的验签公钥，对所述签名信息进行验证，并在所述签名信息验证通过后，根据所述验证结果进行业务授权。
所述业务应用在所述第一安全环境中运行。
所述接收模块501，接收所述第二执行单元通过所述业务应用发送的动态参数。
所述验证模块502，将所述验证结果以及所述动态参数通过所述验签私钥进行签名，得到签名信息。
所述装置还包括：
获取模块504，从所述装置对应的第一管理服务器，获取所述验签私钥。
所述获取模块504，从所述第一管理服务器获取所述验签公钥的公钥证书，所述公钥证书是所述第一管理服务器从证书授权CA中心获取到的，所述公钥证书是所述CA中心根据保存的CA私钥对所述验签公钥进行认证后得到的。
所述发送模块503，将所述公钥证书以及所述签名信息通过所述业务应用发送给所述第二执行单元，以使所述第二执行单元通过从所述CA中心获取到的CA公钥，对所述公钥证书进行验证，并在确定所述公钥证书验证通过后，通过从所述公钥证书中解析出的验签公钥，对所述签名信息进行验证。
图6为本说明书提供的一种业务授权的装置示意图，具体包括：
获取模块601，获取所述第一执行单元通过业务应用发送的签名信息，所述签名信息是所述第一执行单元通过验签私钥对验证结果进行签名后得到的，所述验证结果是所述第一执行单元对所述业务应用发送的待验证信息进行验证后得到的；
验证模块602，通过所述验签私钥对应的验签公钥，对所述签名信息进行验证，并在确定所述签名信息通过验证后，根据从所述签名信息中解析出的所述验证结果进行业务授权。
所述验签公钥是所述装置通过所述装置对应的第二管理服务器，从所述第一执行单元对应的第一管理服务器获取到的。
所述获取模块601，通过所述装置对应的第二管理服务器，从证书授权CA中心 获取CA公钥。
所述验证模块602，通过所述CA公钥，对从所述业务应用发送的公钥证书进行验证，所述公钥证书是所述CA中心根据所述CA公钥对应的CA私钥对所述验签公钥进行认证后得到的，所述公钥证书是所述业务应用从所述第一执行单元获取到的，所述公钥证书是所述第一执行单元通过所述第一执行单元对应的第一管理服务器从所述CA中心获取到的；当确定所述公钥证书通过验证后，通过从所述公钥证书中解析出的验签公钥，对所述签名信息进行验证，并在确定所述签名信息通过验证后，根据从所述签名信息中解析出的所述验证结果进行业务授权。
所述装置还包括：
发送模块603，发送动态参数至所述业务应用，以使所述第一执行单元通过所述验签私钥，对所述验证结果以及从所述业务应用获取到的所述动态参数进行签名，得到签名信息。
所述验证模块602，通过所述CA公钥，对所述公钥证书进行验证；当确定所述公钥证书通过验证后，通过从所述公钥证书中解析出的验签公钥，对所述签名信息进行验证；当确定所述签名信息通过验证后，对从所述签名信息中解析出的动态参数进行验证，并在确定所述动态参数通过验证后，根据从所述签名信息中解析出的所述验证结果进行业务授权。
基于上述说明的业务授权的方法，本说明书还对应提供了一种用于业务授权的设备，如图7所示。该设备包括一个或多个存储器以及处理器，所述存储器存储程序，并且被配置成由所述一个或多个处理器执行以下步骤：
获取待验证信息，并将所述待验证信息发送给第一执行单元进行验证，其中，所述第一执行单元在所述设备的系统包括的第一安全环境中运行；
接收所述第一执行单元返回的通过验签私钥对验证结果进行签名得到的签名信息；
将所述签名信息发送给第二执行单元，以使所述第二执行单元通过所述验签私钥对应的验签公钥，对所述签名信息进行验证，并在确定所述签名信息验证通过后，根据所述验证结果进行业务授权，其中，所述第二执行单元在所述设备的系统包括的第二安全环境中运行。
基于上述说明的业务授权的方法，本说明书还对应提供了一种用于业务授权的 设备，如图8所示。该设备包括一个或多个存储器以及处理器，所述存储器存储程序，并且被配置成由所述一个或多个处理器执行以下步骤：
第一执行单元接收业务应用发送的待验证信息，其中，所述第一执行单元在所述设备的系统包括的第一安全环境中运行；
对所述待验证信息进行验证，并将得到的验证结果通过保存的验签私钥进行签名，得到签名信息；
将所述签名信息通过所述业务应用发送给第二执行单元，以使所述第二执行单元通过所述验签私钥对应的验签公钥，对所述签名信息进行验证，并在所述签名信息验证通过后，根据所述验证结果进行业务授权，其中，所述第二执行单元在所述设备的系统包括的第二安全环境中运行。
基于上述说明的业务授权的方法，本说明书还对应提供了一种用于业务授权的设备，如图9所示。该设备包括一个或多个存储器以及处理器，所述存储器存储程序，并且被配置成由所述一个或多个处理器执行以下步骤：
第二执行单元获取第一执行单元通过业务应用发送的签名信息，所述签名信息是所述第一执行单元通过验签私钥对验证结果进行签名后得到的，所述验证结果是所述第一执行单元对所述业务应用发送的待验证信息进行验证后得到的，其中，所述第一执行单元在所述设备的系统包括的第一安全环境中运行，所述第二执行单元在所述设备的系统包括的第二安全环境中运行；
通过所述验签私钥对应的验签公钥，对所述签名信息进行验证，并在确定所述签名信息通过验证后，根据从所述签名信息中解析出的所述验证结果进行业务授权。
在本说明书的一个或多个实施例中，在获取到待验证信息后，可将该待验证信息发送至第一执行单元，以使该第一执行单元对该待验证信息进行验证，并将得到的验证结果通过该第一执行单元所保存的验签私钥进行签名，得到签名信息。而后，业务应用可以获取到该第一执行单元所返回的该签名信息，进而该将签名信息发送给第二执行单元，以使该第二执行单元通过该验签私钥所对应的验签公钥，对该签名信息进行验证，并在确定该签名信息验证通过后，根据该验证结果进行业务授权。
由于利用非对称加密方式，可以使运行于第二安全环境中的第二执行单元对运行于第一安全环境中的第一执行单元所得到的验证结果进行授信认证，从而使得第二执行单元能够基于第一执行单元所得到的验证结果，确定是否对业务应用所执行的业务进 行授权，进而向用户提供了更为安全、有效的身份验证方式。
在20世纪90年代，对于一个技术的改进可以很明显地区分是硬件上的改进(例如，对二极管、晶体管、开关等电路结构的改进)还是软件上的改进(对于方法流程的改进)。然而，随着技术的发展，当今的很多方法流程的改进已经可以视为硬件电路结构的直接改进。设计人员几乎都通过将改进的方法流程编程到硬件电路中来得到相应的硬件电路结构。因此，不能说一个方法流程的改进就不能用硬件实体模块来实现。例如，可编程逻辑器件(Programmable Logic Device，PLD)(例如现场可编程门阵列(Field Programmable Gate Array，FPGA))就是这样一种集成电路，其逻辑功能由用户对器件编程来确定。由设计人员自行编程来把一个数字系统“集成”在一片PLD上，而不需要请芯片制造厂商来设计和制作专用的集成电路芯片。而且，如今，取代手工地制作集成电路芯片，这种编程也多半改用“逻辑编译器(logic compiler)”软件来实现，它与程序开发撰写时所用的软件编译器相类似，而要编译之前的原始代码也得用特定的编程语言来撰写，此称之为硬件描述语言(Hardware Description Language，HDL)，而HDL也并非仅有一种，而是有许多种，如ABEL(Advanced Boolean Expression Language)、AHDL(Altera Hardware Description Language)、Confluence、CUPL(Cornell University Programming Language)、HDCal、JHDL(Java Hardware Description Language)、Lava、Lola、MyHDL、PALASM、RHDL(Ruby Hardware Description Language)等，目前最普遍使用的是VHDL(Very-High-Speed Integrated Circuit Hardware Description Language)与Verilog。本领域技术人员也应该清楚，只需要将方法流程用上述几种硬件描述语言稍作逻辑编程并编程到集成电路中，就可以很容易得到实现该逻辑方法流程的硬件电路。
控制器可以按任何适当的方式实现，例如，控制器可以采取例如微处理器或处理器以及存储可由该(微)处理器执行的计算机可读程序代码(例如软件或固件)的计算机可读介质、逻辑门、开关、专用集成电路(Application Specific Integrated Circuit，ASIC)、可编程逻辑控制器和嵌入微控制器的形式，控制器的例子包括但不限于以下微控制器：ARC 625D、Atmel AT91SAM、Microchip PIC18F26K20以及Silicone Labs C8051F320，存储器控制器还可以被实现为存储器的控制逻辑的一部分。本领域技术人员也知道，除了以纯计算机可读程序代码方式实现控制器以外，完全可以通过将方法步骤进行逻辑编程来使得控制器以逻辑门、开关、专用集成电路、可编程逻辑控制器和嵌入微控制器等的形式来实现相同功能。因此这种控制器可以被认为是一种硬件部件，而对其内包括的用于实现各种功能的装置也可以视为硬件部件内的结构。或者甚至，可以 将用于实现各种功能的装置视为既可以是实现方法的软件模块又可以是硬件部件内的结构。
上述实施例阐明的系统、装置、模块或单元，具体可以由计算机芯片或实体实现，或者由具有某种功能的产品来实现。一种典型的实现设备为计算机。具体的，计算机例如可以为个人计算机、膝上型计算机、蜂窝电话、相机电话、智能电话、个人数字助理、媒体播放器、导航设备、电子邮件设备、游戏控制台、平板计算机、可穿戴设备或者这些设备中的任何设备的组合。
为了描述的方便，描述以上装置时以功能分为各种单元分别描述。当然，在实施本说明书时可以把各单元的功能在同一个或多个软件和/或硬件中实现。
本领域内的技术人员应明白，本说明书的实施例可提供为方法、系统、或计算机程序产品。因此，本说明书可采用完全硬件实施例、完全软件实施例、或结合软件和硬件方面的实施例的形式。而且，本说明书可采用在一个或多个其中包含有计算机可用程序代码的计算机可用存储介质(包括但不限于磁盘存储器、CD-ROM、光学存储器等)上实施的计算机程序产品的形式。
本说明书是参照根据本说明书一个或多个实施例的方法、设备(系统)、和计算机程序产品的流程图和/或方框图来描述的。应理解可由计算机程序指令实现流程图和/或方框图中的每一流程和/或方框、以及流程图和/或方框图中的流程和/或方框的结合。可提供这些计算机程序指令到通用计算机、专用计算机、嵌入式处理机或其他可编程数据处理设备的处理器以产生一个机器，使得通过计算机或其他可编程数据处理设备的处理器执行的指令产生用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的装置。
这些计算机程序指令也可存储在能引导计算机或其他可编程数据处理设备以特定方式工作的计算机可读存储器中，使得存储在该计算机可读存储器中的指令产生包括指令装置的制造品，该指令装置实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能。
这些计算机程序指令也可装载到计算机或其他可编程数据处理设备上，使得在计算机或其他可编程设备上执行一系列操作步骤以产生计算机实现的处理，从而在计算机或其他可编程设备上执行的指令提供用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的步骤。
在一个典型的配置中，计算设备包括一个或多个处理器(CPU)、输入/输出接口、网络接口和内存。
内存可能包括计算机可读介质中的非永久性存储器，随机存取存储器(RAM)和/或非易失性内存等形式，如只读存储器(ROM)或闪存(flash RAM)。内存是计算机可读介质的示例。
计算机可读介质包括永久性和非永久性、可移动和非可移动媒体可以由任何方法或技术来实现信息存储。信息可以是计算机可读指令、数据结构、程序的模块或其他数据。计算机的存储介质的例子包括，但不限于相变内存(PRAM)、静态随机存取存储器(SRAM)、动态随机存取存储器(DRAM)、其他类型的随机存取存储器(RAM)、只读存储器(ROM)、电可擦除可编程只读存储器(EEPROM)、快闪记忆体或其他内存技术、只读光盘只读存储器(CD-ROM)、数字多功能光盘(DVD)或其他光学存储、磁盒式磁带，磁带磁磁盘存储或其他磁性存储设备或任何其他非传输介质，可用于存储可以被计算设备访问的信息。按照本文中的界定，计算机可读介质不包括暂存电脑可读媒体(transitory media)，如调制的数据信号和载波。
还需要说明的是，术语“包括”、“包含”或者其任何其他变体意在涵盖非排他性的包含，从而使得包括一系列要素的过程、方法、商品或者设备不仅包括那些要素，而且还包括没有明确列出的其他要素，或者是还包括为这种过程、方法、商品或者设备所固有的要素。在没有更多限制的情况下，由语句“包括一个……”限定的要素，并不排除在包括所述要素的过程、方法、商品或者设备中还存在另外的相同要素。
本说明书可以在由计算机执行的计算机可执行指令的一般上下文中描述，例如程序模块。一般地，程序模块包括执行特定任务或实现特定抽象数据类型的例程、程序、对象、组件、数据结构等等。也可以在分布式计算环境中实践本说明书的一个或多个实施例，在这些分布式计算环境中，由通过通信网络而被连接的远程处理设备来执行任务。在分布式计算环境中，程序模块可以位于包括存储设备在内的本地和远程计算机存储介质中。
本说明书中的各个实施例均采用递进的方式描述，各个实施例之间相同相似的部分互相参见即可，每个实施例重点说明的都是与其他实施例的不同之处。尤其，对于系统实施例而言，由于其基本相似于方法实施例，所以描述的比较简单，相关之处参见方法实施例的部分说明即可。
上述对本说明书特定实施例进行了描述。其它实施例在所附权利要求书的范围内。在一些情况下，在权利要求书中记载的动作或步骤可以按照不同于实施例中的顺序来执行并且仍然可以实现期望的结果。另外，在附图中描绘的过程不一定要求示出的特定顺序或者连续顺序才能实现期望的结果。在某些实施方式中，多任务处理和并行处理也是可以的或者可能是有利的。
以上所述仅为本说明书的一个或多个实施例而已，并不用于限制本说明书。对于本领域技术人员来说，本说明书的一个或多个实施例可以有各种更改和变化。凡在本说明书的一个或多个实施例的精神和原理之内所作的任何修改、等同替换、改进等，均应包含在本说明书的权利要求范围之内。

Claims (37)

  1. 一种业务授权的方法，设备的系统中至少包括第一安全环境以及第二安全环境，第一执行单元在所述第一安全环境中运行，第二执行单元在所述第二安全环境中运行，所述方法包括：
    获取待验证信息，并将所述待验证信息发送给所述第一执行单元进行验证；
    接收所述第一执行单元返回的通过验签私钥对验证结果进行签名得到的签名信息；
    将所述签名信息发送给所述第二执行单元，以使所述第二执行单元通过所述验签私钥对应的验签公钥，对所述签名信息进行验证，并在确定所述签名信息验证通过后，根据所述验证结果进行业务授权。
  2. 如权利要求1所述的方法，所述第一安全环境包括：可信执行环境TEE；所述第二安全环境包括：安全元件SE提供的执行环境。
  3. 如权利要求1或2所述的方法，所述待验证信息包括：待验证生物特征信息。
  4. 如权利要求1或2所述的方法，接收所述第一执行单元返回的通过验签私钥对验证结果进行签名得到的签名信息之前，所述方法还包括：
    获取所述第二执行单元发送的动态参数，所述动态参数包括：随机数、时间信息中的至少一种；
    将所述动态参数发送给所述第一执行单元，使所述第一执行单元通过所述验签私钥对所述验证结果和所述动态参数进行签名。
  5. 一种业务授权的方法，设备的系统中至少包括第一安全环境以及第二安全环境，第一执行单元在所述第一安全环境中运行，第二执行单元在所述第二安全环境中运行，所述方法包括：
    所述第一执行单元接收业务应用发送的待验证信息；
    对所述待验证信息进行验证，并将得到的验证结果通过保存的验签私钥进行签名，得到签名信息；
    将所述签名信息通过所述业务应用发送给所述第二执行单元，以使所述第二执行单元通过所述验签私钥对应的验签公钥，对所述签名信息进行验证，并在所述签名信息验证通过后，根据所述验证结果进行业务授权。
  6. 如权利要求5所述的方法，所述业务应用在所述第一安全环境中运行。
  7. 如权利要求5所述的方法，将得到的验证结果通过保存的验签私钥进行签名，得到签名信息之前，所述方法还包括：
    接收所述第二执行单元通过所述业务应用发送的动态参数。
  8. 如权利要求7所述的方法，将得到的验证结果通过保存的验签私钥进行签名，得到签名信息，具体包括：
    将所述验证结果以及所述动态参数通过所述验签私钥进行签名，得到签名信息。
  9. 如权利要求5或8所述的方法，在接收业务应用发送的待验证信息之前，所述方法还包括：
    从所述第一执行单元对应的第一管理服务器，获取所述验签私钥。
  10. 如权利要求9所述的方法，将所述签名信息通过业务应用发送给所述第二执行单元之前，所述方法还包括：
    从所述第一管理服务器获取所述验签公钥的公钥证书，所述公钥证书是所述第一管理服务器从证书授权CA中心获取到的，所述公钥证书是所述CA中心根据保存的CA私钥对所述验签公钥进行认证后得到的。
  11. 如权利要求10所述的方法，将所述签名信息通过业务应用发送给所述第二执行单元，具体包括：
    将所述公钥证书以及所述签名信息通过所述业务应用发送给所述第二执行单元，以使所述第二执行单元通过从所述CA中心获取到的CA公钥，对所述公钥证书进行验证，并在确定所述公钥证书验证通过后，通过从所述公钥证书中解析出的验签公钥，对所述签名信息进行验证。
  12. 一种业务授权的方法，设备的系统中至少包括第一安全环境以及第二安全环境，第一执行单元在所述第一安全环境中运行，第二执行单元在所述第二安全环境中运行，所述方法包括：
    所述第二执行单元获取所述第一执行单元通过业务应用发送的签名信息，所述签名信息是所述第一执行单元通过验签私钥对验证结果进行签名后得到的，所述验证结果是所述第一执行单元对所述业务应用发送的待验证信息进行验证后得到的；
    通过所述验签私钥对应的验签公钥，对所述签名信息进行验证，并在确定所述签名信息通过验证后，根据从所述签名信息中解析出的所述验证结果进行业务授权。
  13. 如权利要求12所述的方法，所述验签公钥是所述第二执行单元通过所述第二执行单元对应的第二管理服务器，从所述第一执行单元对应的第一管理服务器获取到的。
  14. 如权利要求12所述的方法，通过所述验签私钥对应的验签公钥，对所述签名信息进行验证之前，所述方法还包括：
    通过所述第二执行单元对应的第二管理服务器，从证书授权CA中心获取CA公钥。
  15. 如权利要求14所述的方法，通过所述验签私钥对应的验签公钥，对所述签名信息进行验证，并在确定所述签名信息通过验证后，根据从所述签名信息中解析出的所述验证结果进行业务授权，具体包括：
    通过所述CA公钥，对从所述业务应用发送的公钥证书进行验证，所述公钥证书是所述CA中心根据所述CA公钥对应的CA私钥对所述验签公钥进行认证后得到的，所述公钥证书是所述业务应用从所述第一执行单元获取到的，所述公钥证书是所述第一执行单元通过所述第一执行单元对应的第一管理服务器从所述CA中心获取到的；
    当确定所述公钥证书通过验证后，通过从所述公钥证书中解析出的验签公钥，对所述签名信息进行验证，并在确定所述签名信息通过验证后，根据从所述签名信息中解析出的所述验证结果进行业务授权。
  16. 如权利要15所述的方法，获取所述第一执行单元通过业务应用发送的签名信息之前，所述方法还包括：
    发送动态参数至所述业务应用，以使所述第一执行单元通过所述验签私钥，对所述验证结果以及从所述业务应用获取到的所述动态参数进行签名，得到签名信息。
  17. 如权利要求16所述的方法，通过所述验签私钥对应的验签公钥，对所述签名信息进行验证，并在确定所述签名信息通过验证后，根据从所述签名信息中解析出的所述验证结果进行业务授权，具体包括：
    通过所述CA公钥，对所述公钥证书进行验证；
    当确定所述公钥证书通过验证后，通过从所述公钥证书中解析出的验签公钥，对所述签名信息进行验证；
    当确定所述签名信息通过验证后，对从所述签名信息中解析出的动态参数进行验证，并在确定所述动态参数通过验证后，根据从所述签名信息中解析出的所述验证结果进行业务授权。
  18. 一种业务授权的装置，包含所述装置的设备的系统中至少包括第一安全环境以及第二安全环境，第一执行单元在所述第一安全环境中运行，第二执行单元在所述第二安全环境中运行，所述装置包括：
    获取模块，获取待验证信息，并将所述待验证信息发送给所述第一执行单元进行验证；
    接收模块，接收所述第一执行单元返回的通过验签私钥对验证结果进行签名得到的签名信息；
    发送模块，将所述签名信息发送给所述第二执行单元，以使所述第二执行单元通过 所述验签私钥对应的验签公钥，对所述签名信息进行验证，并在确定所述签名信息验证通过后，根据所述验证结果进行业务授权。
  19. 如权利要求18所述的装置，所述第一安全环境包括：可信执行环境TEE；所述第二安全环境包括：安全元件SE提供的执行环境。
  20. 如权利要求18或19所述的装置，所述待验证信息包括：待验证生物特征信息。
  21. 如权利要求18或19所述的装置，所述获取模块，获取所述第二执行单元发送的动态参数，所述动态参数包括：随机数、时间信息中的至少一种；将所述动态参数发送给所述第一执行单元，使所述第一执行单元通过所述验签私钥对所述验证结果和所述动态参数进行签名。
  22. 一种业务授权的装置，设备的系统中至少包括第一安全环境以及第二安全环境，所述装置在所述第一安全环境中运行，第二执行单元在所述第二安全环境中运行，所述装置包括：
    接收模块，接收业务应用发送的待验证信息；
    验证模块，对所述待验证信息进行验证，并将得到的验证结果通过保存的验签私钥进行签名，得到签名信息；
    发送模块，将所述签名信息通过所述业务应用发送给所述第二执行单元，以使所述第二执行单元通过所述验签私钥对应的验签公钥，对所述签名信息进行验证，并在所述签名信息验证通过后，根据所述验证结果进行业务授权。
  23. 如权利要求22所述的装置，所述业务应用在所述第一安全环境中运行。
  24. 如权利要求22所述的装置，所述接收模块，接收所述第二执行单元通过所述业务应用发送的动态参数。
  25. 如权利要求24所述的装置，所述验证模块，将所述验证结果以及所述动态参数通过所述验签私钥进行签名，得到签名信息。
  26. 如权利要求22或25所述的装置，所述装置还包括：
    获取模块，从所述装置对应的第一管理服务器，获取所述验签私钥。
  27. 如权利要求26所述的装置，所述获取模块，从所述第一管理服务器获取所述验签公钥的公钥证书，所述公钥证书是所述第一管理服务器从证书授权CA中心获取到的，所述公钥证书是所述CA中心根据保存的CA私钥对所述验签公钥进行认证后得到的。
  28. 如权利要求27所述的装置，所述发送模块，将所述公钥证书以及所述签名信息通过所述业务应用发送给所述第二执行单元，以使所述第二执行单元通过从所述CA 中心获取到的CA公钥，对所述公钥证书进行验证，并在确定所述公钥证书验证通过后，通过从所述公钥证书中解析出的验签公钥，对所述签名信息进行验证。
  29. 一种业务授权的装置，设备的系统中至少包括第一安全环境以及第二安全环境，第一执行单元在所述第一安全环境中运行，所述装置在所述第二安全环境中运行，所述装置包括：
    获取模块，获取所述第一执行单元通过业务应用发送的签名信息，所述签名信息是所述第一执行单元通过验签私钥对验证结果进行签名后得到的，所述验证结果是所述第一执行单元对所述业务应用发送的待验证信息进行验证后得到的；
    验证模块，通过所述验签私钥对应的验签公钥，对所述签名信息进行验证，并在确定所述签名信息通过验证后，根据从所述签名信息中解析出的所述验证结果进行业务授权。
  30. 如权利要求29所述的装置，所述验签公钥是所述装置通过所述装置对应的第二管理服务器，从所述第一执行单元对应的第一管理服务器获取到的。
  31. 如权利要求29所述的装置，所述获取模块，通过所述装置对应的第二管理服务器，从证书授权CA中心获取CA公钥。
  32. 如权利要求31所述的装置，所述验证模块，通过所述CA公钥，对从所述业务应用发送的公钥证书进行验证，所述公钥证书是所述CA中心根据所述CA公钥对应的CA私钥对所述验签公钥进行认证后得到的，所述公钥证书是所述业务应用从所述第一执行单元获取到的，所述公钥证书是所述第一执行单元通过所述第一执行单元对应的第一管理服务器从所述CA中心获取到的；当确定所述公钥证书通过验证后，通过从所述公钥证书中解析出的验签公钥，对所述签名信息进行验证，并在确定所述签名信息通过验证后，根据从所述签名信息中解析出的所述验证结果进行业务授权。
  33. 如权利要求32所述的装置，所述装置还包括：
    发送模块，发送动态参数至所述业务应用，以使所述第一执行单元通过所述验签私钥，对所述验证结果以及从所述业务应用获取到的所述动态参数进行签名，得到签名信息。
  34. 如权利要求33所述的装置，所述验证模块，通过所述CA公钥，对所述公钥证书进行验证；当确定所述公钥证书通过验证后，通过从所述公钥证书中解析出的验签公钥，对所述签名信息进行验证；当确定所述签名信息通过验证后，对从所述签名信息中解析出的动态参数进行验证，并在确定所述动态参数通过验证后，根据从所述签名信息中解析出的所述验证结果进行业务授权。
  35. 一种业务授权的设备，包括一个或多个存储器以及处理器，所述存储器存储程序，并且被配置成由所述一个或多个处理器执行以下步骤：
    获取待验证信息，并将所述待验证信息发送给第一执行单元进行验证，其中，所述第一执行单元在所述设备的系统包括的第一安全环境中运行；
    接收所述第一执行单元返回的通过验签私钥对验证结果进行签名得到的签名信息；
    将所述签名信息发送给第二执行单元，以使所述第二执行单元通过所述验签私钥对应的验签公钥，对所述签名信息进行验证，并在确定所述签名信息验证通过后，根据所述验证结果进行业务授权，其中，所述第二执行单元在所述设备的系统包括的第二安全环境中运行。
  36. 一种业务授权的设备，包括一个或多个存储器以及处理器，所述存储器存储程序，并且被配置成由所述一个或多个处理器执行以下步骤：
    第一执行单元接收业务应用发送的待验证信息，其中，所述第一执行单元在所述设备的系统包括的第一安全环境中运行；
    对所述待验证信息进行验证，并将得到的验证结果通过保存的验签私钥进行签名，得到签名信息；
    将所述签名信息通过所述业务应用发送给第二执行单元，以使所述第二执行单元通过所述验签私钥对应的验签公钥，对所述签名信息进行验证，并在所述签名信息验证通过后，根据所述验证结果进行业务授权，其中，所述第二执行单元在所述设备的系统包括的第二安全环境中运行。
  37. 一种业务授权的设备，包括一个或多个存储器以及处理器，所述存储器存储程序，并且被配置成由所述一个或多个处理器执行以下步骤：
    第二执行单元获取第一执行单元通过业务应用发送的签名信息，所述签名信息是所述第一执行单元通过验签私钥对验证结果进行签名后得到的，所述验证结果是所述第一执行单元对所述业务应用发送的待验证信息进行验证后得到的，其中，所述第一执行单元在所述设备的系统包括的第一安全环境中运行，所述第二执行单元在所述设备的系统包括的第二安全环境中运行；
    通过所述验签私钥对应的验签公钥，对所述签名信息进行验证，并在确定所述签名信息通过验证后，根据从所述签名信息中解析出的所述验证结果进行业务授权。
PCT/CN2018/107569 2017-11-16 2018-09-26 一种业务授权的方法、装置及设备 Ceased WO2019095864A1 (zh)

Priority Applications (5)

Application Number Priority Date Filing Date Title
SG11202000396QA SG11202000396QA (en) 2017-11-16 2018-09-26 Service authorization method, apparatus, and device
KR1020207001503A KR102382928B1 (ko) 2017-11-16 2018-09-26 서비스 인가 방법, 장치, 및 디바이스
EP18878119.9A EP3641218B1 (en) 2017-11-16 2018-09-26 Service authorization method, apparatus and device
US16/805,316 US10892900B2 (en) 2017-11-16 2020-02-28 Verification-based service authorization
US17/145,889 US11316702B2 (en) 2017-11-16 2021-01-11 Verification-based service authorization

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201711135547.2 2017-11-16
CN201711135547.2A CN108055132B (zh) 2017-11-16 2017-11-16 一种业务授权的方法、装置及设备

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US16/805,316 Continuation US10892900B2 (en) 2017-11-16 2020-02-28 Verification-based service authorization

Publications (1)

Publication Number Publication Date
WO2019095864A1 true WO2019095864A1 (zh) 2019-05-23

Family

ID=62120265

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2018/107569 Ceased WO2019095864A1 (zh) 2017-11-16 2018-09-26 一种业务授权的方法、装置及设备

Country Status (7)

Country Link
US (2) US10892900B2 (zh)
EP (1) EP3641218B1 (zh)
KR (1) KR102382928B1 (zh)
CN (1) CN108055132B (zh)
SG (1) SG11202000396QA (zh)
TW (1) TWI724326B (zh)
WO (1) WO2019095864A1 (zh)

Families Citing this family (17)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN108055132B (zh) 2017-11-16 2020-04-28 阿里巴巴集团控股有限公司 一种业务授权的方法、装置及设备
CN109033790B (zh) * 2018-06-22 2023-03-10 徐镠琪 智能兵符两章两次授权使用方法
US11223485B2 (en) * 2018-07-17 2022-01-11 Huawei Technologies Co., Ltd. Verifiable encryption based on trusted execution environment
CN110020513B (zh) * 2018-11-07 2023-08-22 创新先进技术有限公司 签名记录方法、验证方法、装置及存储介质
US11797673B2 (en) 2020-08-27 2023-10-24 Ventana Micro Systems Inc. Processor that mitigates side channel attacks by expeditiously initiating flushing of instructions dependent upon a load instruction that causes a need for an architectural exception
US11868469B2 (en) * 2020-08-27 2024-01-09 Ventana Micro Systems Inc. Processor that mitigates side channel attacks by preventing all dependent instructions from consuming architectural register result produced by instruction that causes a need for an architectural exception
US11907369B2 (en) 2020-08-27 2024-02-20 Ventana Micro Systems Inc. Processor that mitigates side channel attacks by preventing cache memory state from being affected by a missing load operation by inhibiting or canceling a fill request of the load operation if an older load generates a need for an architectural exception
US11733972B2 (en) 2020-10-06 2023-08-22 Ventana Micro Systems Inc. Processor that mitigates side channel attacks by providing random load data as a result of execution of a load operation that does not have permission to access a load address
TWI749774B (zh) * 2020-09-17 2021-12-11 瑞昱半導體股份有限公司 驗證系統及用於驗證系統之驗證方法
US11734426B2 (en) 2020-10-06 2023-08-22 Ventana Micro Systems Inc. Processor that mitigates side channel attacks by prevents cache line data implicated by a missing load address from being filled into a data cache memory when the load address specifies a location with no valid address translation or no permission to read from the location
US11853424B2 (en) 2020-10-06 2023-12-26 Ventana Micro Systems Inc. Processor that mitigates side channel attacks by refraining from allocating an entry in a data TLB for a missing load address when the load address misses both in a data cache memory and in the data TLB and the load address specifies a location without a valid address translation or without permission to read from the location
EP4002756B1 (en) * 2020-11-24 2022-11-02 Axis AB Systems and methods of managing a certificate associated with a component located at a remote location
CN114756855A (zh) * 2021-01-12 2022-07-15 青岛海信移动通信技术股份有限公司 应用运行鉴权方法及终端设备
CN112600671B (zh) * 2021-03-02 2021-06-01 腾讯科技（深圳）有限公司 一种数据处理方法、装置、设备及存储介质
KR102907352B1 (ko) * 2021-10-19 2026-01-02 삼성디스플레이 주식회사 표시 장치 및 표시 장치의 제조방법
CN113868691B (zh) * 2021-12-02 2022-05-24 北京溪塔科技有限公司 一种基于云原生的区块链的授权运行方法及装置
CN115603943B (zh) * 2022-09-07 2024-08-02 支付宝(杭州)信息技术有限公司 一种离线身份验证的方法、装置、存储介质及电子设备

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN105490997A (zh) * 2014-10-10 2016-04-13 阿里巴巴集团控股有限公司 安全校验方法、装置、终端及服务器
WO2016192774A1 (en) * 2015-06-02 2016-12-08 Huawei Technologies Co., Ltd. Electronic device and method in an electronic device
CN106850201A (zh) * 2017-02-15 2017-06-13 济南晟安信息技术有限公司 智能终端多因子认证方法、智能终端、认证服务器及系统
CN106878280A (zh) * 2017-01-10 2017-06-20 阿里巴巴集团控股有限公司 用户认证的方法和装置、获取用户号码信息的方法和装置
CN108055132A (zh) * 2017-11-16 2018-05-18 阿里巴巴集团控股有限公司 一种业务授权的方法、装置及设备

Family Cites Families (27)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20060149962A1 (en) 2003-07-11 2006-07-06 Ingrian Networks, Inc. Network attached encryption
US8245052B2 (en) * 2006-02-22 2012-08-14 Digitalpersona, Inc. Method and apparatus for a token
CN101108125B (zh) 2007-08-02 2010-06-16 无锡微感科技有限公司 一种身体体征动态监测系统
US8510569B2 (en) * 2009-12-16 2013-08-13 Intel Corporation Providing integrity verification and attestation in a hidden execution environment
US20120124369A1 (en) * 2010-11-09 2012-05-17 Jose Castejon Amenedo Secure publishing of public-key certificates
US8806192B2 (en) * 2011-05-04 2014-08-12 Microsoft Corporation Protected authorization for untrusted clients
EP4322465A3 (en) * 2011-12-15 2024-04-17 Daedalus Prime LLC Method and device for secure communications over a network using a hardware security engine
US8856514B2 (en) * 2012-03-12 2014-10-07 International Business Machines Corporation Renewal processing of digital certificates in an asynchronous messaging environment
US9887983B2 (en) * 2013-10-29 2018-02-06 Nok Nok Labs, Inc. Apparatus and method for implementing composite authenticators
US10064240B2 (en) * 2013-09-12 2018-08-28 The Boeing Company Mobile communication device and method of operating thereof
TWI615798B (zh) 2013-12-17 2018-02-21 動聯國際股份有限公司 基於物聯網的健康照護系統
US10129243B2 (en) * 2013-12-27 2018-11-13 Avaya Inc. Controlling access to traversal using relays around network address translation (TURN) servers using trusted single-use credentials
GB201413836D0 (en) * 2014-08-05 2014-09-17 Arm Ip Ltd Device security apparatus and methods
US20160065374A1 (en) * 2014-09-02 2016-03-03 Apple Inc. Method of using one device to unlock another device
MX2017002988A (es) 2014-09-09 2018-02-01 Torvec Inc Métodos y aparato para monitorear el nivel de alerta de una persona que utiliza un dispositivo portátil, y proporcionar una notificación.
EP3217862A4 (en) 2014-11-11 2018-08-08 Global Stress Index Pty Ltd A system and a method for generating stress level and stress resilience level information for an individual
US20160234176A1 (en) * 2015-02-06 2016-08-11 Samsung Electronics Co., Ltd. Electronic device and data transmission method thereof
TWI540528B (zh) 2015-04-16 2016-07-01 神乎科技股份有限公司 協助使用者進行紀律性操作的證券交易提示方法
CN104900006B (zh) 2015-04-28 2017-10-27 中国科学技术大学先进技术研究院 一种基于可穿戴设备的智能个人安全系统及其实现方法
CN105530099A (zh) * 2015-12-11 2016-04-27 捷德（中国）信息科技有限公司 基于ibc的防伪验证方法、装置、系统和防伪凭证
CN105704123B (zh) * 2016-01-08 2017-09-15 腾讯科技（深圳）有限公司 一种进行业务处理的方法、装置和系统
CN107126203A (zh) 2016-02-28 2017-09-05 南京全时陪伴健康科技有限公司 人体健康信息实时测量显示系统
CN107220246B (zh) 2016-03-21 2020-10-16 创新先进技术有限公司 业务对象的分析方法及装置
CN106373012A (zh) 2016-09-06 2017-02-01 网易乐得科技有限公司 一种理财产品交易控制方法和设备
CN108357497B (zh) 2017-04-18 2021-07-20 黄海虹 一种用于共享汽车的驾驶员身份授权系统
CN107092881B (zh) 2017-04-18 2018-01-09 黄海虹 一种驾驶人员更换系统及方法
CN107203938A (zh) 2017-05-02 2017-09-26 优品财富管理股份有限公司 一种基于心率检测的股民投资指导系统及方法

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN105490997A (zh) * 2014-10-10 2016-04-13 阿里巴巴集团控股有限公司 安全校验方法、装置、终端及服务器
WO2016192774A1 (en) * 2015-06-02 2016-12-08 Huawei Technologies Co., Ltd. Electronic device and method in an electronic device
CN106878280A (zh) * 2017-01-10 2017-06-20 阿里巴巴集团控股有限公司 用户认证的方法和装置、获取用户号码信息的方法和装置
CN106850201A (zh) * 2017-02-15 2017-06-13 济南晟安信息技术有限公司 智能终端多因子认证方法、智能终端、认证服务器及系统
CN108055132A (zh) * 2017-11-16 2018-05-18 阿里巴巴集团控股有限公司 一种业务授权的方法、装置及设备

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP3641218A4 *

Also Published As

Publication number Publication date
US20210135882A1 (en) 2021-05-06
US20200204379A1 (en) 2020-06-25
US11316702B2 (en) 2022-04-26
US10892900B2 (en) 2021-01-12
CN108055132B (zh) 2020-04-28
EP3641218B1 (en) 2022-03-30
KR20200013057A (ko) 2020-02-05
EP3641218A1 (en) 2020-04-22
KR102382928B1 (ko) 2022-04-04
EP3641218A4 (en) 2020-12-02
TW201923640A (zh) 2019-06-16
TWI724326B (zh) 2021-04-11
SG11202000396QA (en) 2020-02-27
CN108055132A (zh) 2018-05-18

Similar Documents

Publication Publication Date Title
WO2019095864A1 (zh) 一种业务授权的方法、装置及设备
KR102180353B1 (ko) 블록체인-기반 트랜잭션 처리 방법 및 장치
CN110222531B (zh) 一种访问数据库的方法、系统及设备
CN110378091B (zh) 一种身份验证方法、装置及设备
CN107196901B (zh) 一种身份注册及认证的方法及装置
KR102258430B1 (ko) 신원 인증을 위한 방법 및 장치
WO2018233536A1 (zh) 一种认证方法、基于区块链的认证数据处理方法及设备
WO2017167093A1 (zh) 基于生物特征的身份注册、认证的方法和装置
US20150244718A1 (en) Biometric authentication
CN113010870A (zh) 基于数字凭证的业务处理方法、装置及设备
TWI724681B (zh) 基於身分資訊管理密碼金鑰
WO2019165875A1 (zh) 一种交易处理方法、服务器、客户端及系统
CN110235140A (zh) 生物特征识别方法以及电子设备
CN110235141B (zh) 生物特征识别方法以及电子设备
WO2017071498A1 (zh) 一种身份验证方法和装置
KR102339949B1 (ko) 인증 정보 처리 방법 및 장치와 인증 정보 처리 방법 장치를 포함한 사용자 단말
US20140090032A1 (en) System and method for real time secure image based key generation using partial polygons assembled into a master composite image
CN111989693B (zh) 生物识别方法及装置
CN115603943B (zh) 一种离线身份验证的方法、装置、存储介质及电子设备
CN111581618A (zh) 用于启用生物识别模板的方法
CN105827625A (zh) 基于生物识别信息的认证方法和认证系统、电子设备
CN116452204A (zh) 基于did的支付方法、装置、可读存储介质及电子设备
CN115640589A (zh) 一种安全保护设备以及业务执行方法、装置及存储介质
HK1254025B (zh) 一种业务授权的方法、装置及设备
HK1254025A1 (zh) 一种业务授权的方法、装置及设备

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 18878119

Country of ref document: EP

Kind code of ref document: A1

ENP Entry into the national phase

Ref document number: 20207001503

Country of ref document: KR

Kind code of ref document: A

ENP Entry into the national phase

Ref document number: 2018878119

Country of ref document: EP

Effective date: 20200116

NENP Non-entry into the national phase

Ref country code: DE