WO2020073712A1 - 一种移动终端中共享安全应用的方法及移动终端 - Google Patents

一种移动终端中共享安全应用的方法及移动终端 Download PDF

Info

Publication number
WO2020073712A1
WO2020073712A1 PCT/CN2019/097061 CN2019097061W WO2020073712A1 WO 2020073712 A1 WO2020073712 A1 WO 2020073712A1 CN 2019097061 W CN2019097061 W CN 2019097061W WO 2020073712 A1 WO2020073712 A1 WO 2020073712A1
Authority
WO
WIPO (PCT)
Prior art keywords
application
security
key
mobile
mobile application
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
PCT/CN2019/097061
Other languages
English (en)
French (fr)
Inventor
孙曦
落红卫
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Alibaba Group Holding Ltd
Original Assignee
Alibaba Group Holding Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Alibaba Group Holding Ltd filed Critical Alibaba Group Holding Ltd
Priority to SG11202100127SA priority Critical patent/SG11202100127SA/en
Priority to EP19871495.8A priority patent/EP3866384B1/en
Publication of WO2020073712A1 publication Critical patent/WO2020073712A1/zh
Priority to US17/158,702 priority patent/US11258610B2/en
Anticipated expiration legal-status Critical
Ceased legal-status Critical Current

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
    • H04L9/0819—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s)
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
    • H04L9/0819—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s)
    • H04L9/0825—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
    • H04L9/0819—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s)
    • H04L9/0827—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) involving distinctive intermediate devices or communication paths
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0894—Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage
    • H04L9/0897—Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage involving additional devices, e.g. trusted platform module [TPM], smartcard or USB
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3234—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token

Definitions

  • the present application relates to the field of mobile terminals, and in particular, to a method for sharing security applications in a mobile terminal and a mobile terminal.
  • the mobile terminal With the development of the mobile Internet, the functions of mobile terminals such as smart phones or tablet computers are becoming more and more powerful, and the processing performance is becoming stronger and stronger. It can access the mobile communication network, provide an open operating system for application development interfaces, and The installation and operation of various application software have led to more attention and attention to the security of mobile terminals.
  • the mobile terminal integrates a security chip (SecureElement, SE), which provides a secure data storage and computing environment.
  • SE SecureElement
  • Embodiments of the present application provide a method for sharing security applications in a mobile terminal and a mobile terminal, which are used to solve the problem of high cost of research and development and promotion of security applications.
  • Embodiments of the present application provide a method for sharing security applications in a mobile terminal.
  • the mobile terminal can run multiple mobile applications.
  • the mobile terminal further includes a security application.
  • the method includes:
  • the security application receives service keys of multiple mobile applications
  • the security application receives encrypted service data sent by multiple mobile applications and decrypts it to obtain the decrypted service data;
  • the security application uses the service keys of the multiple mobile applications to process their respective service data
  • the security application sends the processed corresponding service data to the corresponding mobile application.
  • the method further includes:
  • the mobile application receives the communication security protection key of the mobile application
  • the security application receiving encrypted service data sent by multiple mobile applications and decrypting includes:
  • the security application receives service data sent by multiple mobile applications and encrypted using respective communication security protection keys
  • the security application obtains the respective service data after decrypting using respective communication security protection keys of the multiple mobile applications.
  • the security application includes a first security application and a second security application
  • a part of the mobile applications in the plurality of mobile applications communicates with the first security application, and another part of the mobile applications in the plurality of mobile applications communicates with the second security application.
  • the method further includes:
  • the management server of the mobile application generates a communication security protection key of the mobile application, and sends the communication security protection key of the mobile application to the mobile application and the security application management server; the security application management server will The communication security protection key of the mobile application is sent to the security application; and / or,
  • the management server of the mobile application generates a service key of the mobile application and sends the service key of the mobile application to the security application management server; the security application management server encrypts the service of the mobile application The key is sent to the security application.
  • the method further includes:
  • the management server of the mobile application generates a communication security protection key and a service key of the mobile application, and sends the communication security protection key and the service key of the mobile application to the security application management server;
  • the security application management server sends the communication security protection key and the service key of the mobile application to the security application;
  • the management server of the mobile application sends the communication security protection key of the mobile application to the mobile application.
  • the method further includes:
  • the management server of the security application generates a communication security protection key of the mobile application, and sends the communication security protection key of the mobile application to the management server of the mobile application;
  • the management server of the mobile application generates a service key of the mobile application, and sends the service key of the mobile application to the management server of the security application;
  • the management server of the mobile application sends the communication security protection key of the mobile application to the mobile application, and the management server of the security application sends the communication security protection key and the service key of the mobile application to all Describe security applications.
  • the service keys of several mobile applications are safely isolated in the security application; and / or the communication security protection keys of several mobile applications are safely isolated in the security application.
  • the service key of the mobile application is a symmetric key or an asymmetric key
  • the processing of the corresponding service data includes encrypting the service data or decrypting the service data;
  • the processing of the corresponding business data includes encrypting the business data, decrypting the business data, signing the business data, or verifying the business office The signature of the data.
  • the communication security protection key of the mobile application is a symmetric key or an asymmetric key; where the mobile application communication security protection key is an asymmetric key, the mobile application receives
  • the communication security protection key of the mobile application is a public key, and the communication security protection key of the mobile application received by the security application is a private key.
  • the security application sending the processed service data to the mobile application includes:
  • the security application uses the private key to sign the processed service data and send it to the mobile application.
  • the execution environment is a rich execution environment and / or a trusted execution environment.
  • the several mobile applications communicate with the security application through a security application proxy.
  • An embodiment of the present application provides a mobile terminal, where the mobile terminal can run multiple mobile applications, and the mobile terminal further includes a security application;
  • the security application is used to receive service keys of multiple mobile applications; receive encrypted service data sent by multiple mobile applications and decrypt them to obtain respective decrypted service data;
  • the security application is also used to process the corresponding service data using the service keys of the multiple mobile applications; and send the processed service data to the corresponding mobile applications.
  • the mobile application is also used to receive communication security protection keys of the multiple mobile applications;
  • the security application is also used to receive service data encrypted by using respective communication security protection keys sent by multiple mobile applications; the respective communication security protection keys of the multiple mobile applications are decrypted to obtain the respective Business data.
  • An embodiment of the present application provides a mobile terminal, including a processor, a first memory, a security chip, and a second memory, the first memory stores programs corresponding to multiple mobile applications, and the second memory stores security applications The corresponding program,
  • the security chip is used to execute a program corresponding to the security application to receive service keys of multiple mobile applications; receive encrypted service data sent by a processor and decrypt it to obtain respective decrypted service data;
  • the security chip is also used to process service data corresponding to each other using service keys of multiple mobile applications; and send the corresponding service data processed to the corresponding mobile applications.
  • the processor is also used to receive communication security protection keys of multiple mobile applications
  • the security chip is also used to receive the business data sent by the processor and encrypted by using the respective communication security protection keys of multiple security applications; and obtained after decrypting using the respective communication security protection keys of the multiple mobile applications Respective business data.
  • the security application includes a first security application and a second security application
  • a part of the plurality of mobile applications communicates with the first security application, and another part of the plurality of mobile applications communicates with the second security application.
  • service keys of multiple mobile applications are securely isolated in the second memory; and / or communication security protection keys of multiple mobile applications are securely isolated in the second memory.
  • the service keys of multiple mobile applications are symmetric keys or asymmetric keys; when the service keys of the mobile applications are symmetric keys, the processing of the corresponding service data includes encrypting the service data Or decrypt the business data; when the business key of the mobile application is an asymmetric key, the processing of the corresponding business data includes encrypting the business data, decrypting the business data, and signing the business data Or verify the signature of the business data.
  • the communication security protection keys of the plurality of mobile applications are symmetric keys or asymmetric keys; where the communication security protection keys of the mobile applications are asymmetric keys, the The communication security protection key of the mobile application is a public key, and the communication security protection key of the mobile application received by the security chip is a private key.
  • the security chip is also used to sign the processed service data to the processor using a private key.
  • An embodiment of the present application provides a system for sharing security applications.
  • the mobile terminal, multiple mobile application management servers, and security application management servers described in the system are characterized by:
  • the management server of the mobile application is used for generating communication security protection keys and service keys of multiple mobile applications, sending communication security protection keys of multiple mobile applications to the mobile application, and transmitting multiple mobile application
  • the communication security protection key and the service key are sent to the management server of the security application;
  • the management server of the security application is configured to send communication security protection keys and service keys of multiple mobile applications to the security application.
  • An embodiment of the present application provides a system for sharing security applications.
  • the mobile terminal, multiple mobile application management servers, and security application management servers described in the system are characterized by:
  • Multiple mobile application management servers used to generate multiple mobile application service keys, and send multiple mobile application service keys to the security application management server;
  • the management server of the security application is also used to send a service key to the security application.
  • the management server of the security application is also used to generate communication security protection keys of multiple mobile applications; the communication security protection keys of multiple mobile applications are sent to the management servers of multiple mobile applications, and the multiple The communication security protection keys of the mobile application are sent to the security application; the management servers of multiple mobile applications are also used to send the communication security protection keys of the multiple mobile applications to the mobile application.
  • An embodiment of the present application provides a system for sharing a program corresponding to a security application.
  • the mobile terminal, a management server for programs corresponding to multiple mobile applications, and a management server for programs corresponding to security applications in the system are characterized by:
  • a management server for programs corresponding to multiple mobile applications, for generating service keys for multiple mobile applications, and sending service keys for multiple mobile applications to the management server corresponding to the security application;
  • the management server of the program corresponding to the security application is used to send service keys of multiple mobile applications to the security chip.
  • the management server of the program corresponding to multiple mobile applications is also used to generate communication security protection keys for multiple mobile applications; send the communication security protection keys for multiple mobile applications to the processor; The communication security protection key of the mobile application is sent to the management server of the program corresponding to the security application;
  • the management server of the program corresponding to the security application is also used to send communication security protection keys of multiple mobile applications to the security chip.
  • An embodiment of the present application provides a system for sharing a program corresponding to a security application.
  • the system includes the mobile terminal, a management server for programs corresponding to multiple mobile applications, and a management server for programs corresponding to security applications.
  • the management server of the program corresponding to the mobile application is used to generate service keys of multiple mobile applications and send the service keys of multiple mobile applications to the management server of the program corresponding to the security application;
  • the management server of the program corresponding to the security application is also used to send service keys of multiple mobile applications to the security chip.
  • the management server of the program corresponding to the security application is also used to generate communication security protection keys of multiple mobile applications; and the communication security protection keys of multiple mobile applications are sent to the management server of the program corresponding to the mobile application Send the communication security protection keys of multiple mobile applications to the security chip;
  • the management server of the program corresponding to the mobile application is also used to send the communication security protection keys of multiple mobile applications to the processor.
  • the embodiments of the present application by enabling these mobile applications to share one security application in the security chip, there is no need to independently develop application software development kits for these mobile applications, which can greatly reduce the cost of mobile applications using security chips to perform security operations and accelerate the security chip-based
  • the popularization of secure computing ensures the safety of products and businesses.
  • the embodiments of the present application can also ensure the independence and security of the secure computing and data of different mobile applications through security isolation within the shared security application.
  • FIG. 1 is a schematic diagram of a method for sharing a security application provided by the first embodiment of this application
  • FIG. 2 is a schematic diagram of a method for sharing a security application provided by a second embodiment of this application
  • FIG. 3 is a schematic diagram of a mobile terminal provided by a third embodiment of this application.
  • FIG. 4 is a schematic diagram of a mobile terminal provided by a fourth embodiment of the present application.
  • FIG. 5 is a schematic diagram of a mobile terminal provided by a fifth embodiment of the present application.
  • FIG. 6 is a schematic diagram of a mobile terminal provided in a sixth embodiment of the present application.
  • FIG. 7 is a schematic diagram of a mobile terminal provided in a seventh embodiment of the present application.
  • FIG. 8 is a schematic diagram of a system for sharing security applications provided by an eighth embodiment of the present application.
  • FIG. 9 is a schematic diagram of a system for sharing security applications provided by a ninth embodiment of this application.
  • FIG. 10 is a schematic diagram of a system for sharing security applications provided in a tenth embodiment of the present application.
  • FIG. 11 is a system schematic diagram of a shared security application provided by the eleventh embodiment of the present application.
  • the mobile terminal contains an execution environment (Execution Environment), which is a collection of software and hardware present in the mobile device. It can provide the necessary capability support for the operation of the application in the mobile device. It generally includes a hardware processing unit and volatile storage. Unit, non-volatile storage unit, operating system, call interface and other components.
  • the execution environment may be a rich execution environment (Rich Execution Environment) or a trusted execution environment (Trusted Execution Environment).
  • the rich execution environment is an open execution environment that runs on mobile devices. It provides open and rich support for running applications, but the security protection capability is relatively weak.
  • a trusted execution environment is an isolated execution environment that runs on mobile devices. Compared with a rich execution environment, it has strong security capabilities to ensure that applications and sensitive data running in it are stored and processed in a relatively trusted environment. And protection.
  • the mobile application may be run or installed in the execution environment, for example, may include at least mobile application A and mobile application B.
  • a mobile terminal installed with a security chip by installing a security application in the security chip, the security of the mobile terminal device is improved.
  • the security application can be preset or later downloaded to the user's mobile phone, and the security application can be used to manage the keys of each mobile application and realize the business
  • the processing of data thus realizes the use of one security application to provide security services for multiple mobile applications, and thus the sharing of security applications.
  • this application takes two mobile applications as examples for illustration, for example, mobile application A is a Taobao mobile application, and mobile application B is a Suning mobile application.
  • the security application can be managed in the same way for each mobile application. The communication security protection key and business key of each mobile application are safely isolated in the security application, and each mobile application is requesting service from the security application At this time, you can only access the communication security key and service key corresponding to the mobile application.
  • the method for sharing a security application provided by an embodiment of the present application is shown in FIG. 1 and includes the following steps:
  • Step 105 The mobile application receives the communication security protection key of the mobile application; the secure communication protection key can be generated by the management server of the mobile application or by the management server of the security application, and then synchronized to the management server of the mobile application; the mobile application (E.g. mobile application A and mobile application B) can receive respective communication security protection keys (e.g. mobile application A's communication security protection keys) from corresponding mobile application servers (e.g.
  • the communication security protection key can be a symmetric key or an asymmetric key; when the communication security protection key is a symmetric key, the communication security protection key is mainly It is used to encrypt or decrypt the service data to be transmitted; in the case where the communication security protection key is an asymmetric key, the public key in the communication security protection key is mainly used to encrypt the service data to be transmitted and the returned signature Verify that the private key in the communication security protection key is mainly used for the encrypted business After the data is decrypted and processed with the service key, the processed business data is signed; in general, the public key of the communication security protection key can be stored in the mobile application, and the private key of the communication security protection key is stored in In safety applications;
  • Step 110 the security application receives the communication security protection key and the service key of the mobile application; as described above, the security communication protection key may be generated by the mobile application management server or the security application management server, and then synchronized to Mobile application management server; when the mobile application communication security protection key is generated by the mobile application management server, it can be sent to the security application after the mobile application communication security protection key is received by the mobile application management server; the mobile application (For example, mobile application A and mobile application B) the service key is generated by the mobile application management server, and then the mobile application management server sets the mobile application service key (for example, mobile application A service key and mobile application B service Key) is sent to the management server of the security application; the security application can receive the communication security protection key and the service key of the mobile application from the security application management server (for example, the communication security protection key and the service key of the mobile application A, and (Mobile application B's communication security protection key and service key) ; The security application can safely isolate the communication security protection key and / or service key of each received mobile application, for example, the communication
  • each mobile application can use the same public key as the security application can use the corresponding private key as the communication security protection key; the mobile application's business key
  • Step 115 the mobile application uses the communication security protection key of the mobile application to encrypt the business data and then sends it to the secure application; when the mobile application itself has business data that needs to be decrypted, because the mobile application itself does not have a business key, the mobile application needs Request a security application to decrypt business data.
  • the mobile application's communication security protection key can be used to encrypt the business data; in general, the mobile application's communication security protection key uses an asymmetric encryption
  • the key for example, the key saved by the mobile application is a public key, and the key saved by the security application is a private key.
  • Mobile applications (such as mobile application A and mobile application B) use their own public keys (such as mobile application A's communication security protection public key and mobile application B's communication security protection public key) to encrypt business data and send it to the security application ;
  • the asymmetric key algorithm can include any of RSA, Elgamal, knapsack algorithm, Rabin, DH, ECC;
  • Step 120 the security application uses the mobile application's communication security protection key to decrypt to obtain the business data; the security application receives the mobile application's mobile communication security protection key (such as the mobile application A's communication security protection private key and Mobile application B's communication security protection private key), so that the mobile application's mobile communication security protection key can be used to decrypt the received data to obtain business data;
  • the mobile application's mobile communication security protection key such as the mobile application A's communication security protection private key and Mobile application B's communication security protection private key
  • the security application uses the service key of the mobile application to process the service data; the security application can use the service key stored by itself (for example, the service key of the mobile application A and the service key of the mobile application B) to process the service data;
  • the service key can be a symmetric key or an asymmetric key.
  • the algorithm of the symmetric key can include any of DES, AES, and MD5.
  • the algorithm of the asymmetric key can include RSA, Elgamal, knapsack algorithm, Rabin, Either DH or ECC.
  • the processing method of business data can be determined according to specific needs. For example, business data needs to be encrypted, then the public key of the business key can be used for encryption, and the business data itself is encrypted data.
  • the processing method can also include signing the business data or verifying the signature of the business data; for example, the business data itself is the data that contains the signature, you can use the public key of the business key To verify the signature, if the business data needs to be signed, you can use the private key of the business key to sign.
  • a symmetric key if the business data needs to be encrypted, the business key can be used for encryption, and the business data itself is encrypted data, then the business key can be used for decryption.
  • there can be multiple sets of service keys For example, for multiple sets of asymmetric keys, security applications can store public or private keys in different key pairs, and use the corresponding secret keys according to specific business needs. key.
  • Step 130 the security application sends the processed service data to the mobile application.
  • the security application may send the processed business data to the corresponding mobile application, for example, send the processed business data of mobile application A to mobile application A, and send the processed business data of mobile application B To mobile application B; then mobile application A and mobile application B can perform subsequent business processes based on the processed business data.
  • the security application may also use the communication security protection key of the mobile application (such as the mobile application A's communication security protection private key and the mobile application B's communication security protection private key when sending the processed service data to the mobile application ) To sign the processed business data to further improve security.
  • the communication security protection key of the mobile application such as the mobile application A's communication security protection private key and the mobile application B's communication security protection private key when sending the processed service data to the mobile application
  • the above-mentioned embodiment can realize the unified management of the communication security protection key and the service key of several mobile applications by the security application, thereby realizing the sharing of the security application and avoiding installing each security application in the security chip for each mobile application .
  • the mobile application management server generates the communication security protection key and the service key without any restriction on the order, and the communication can be generated first
  • the security protection key may also generate the service key first, or the communication security protection key and the service key at the same time; similarly, when sending the communication security protection key and the service key to the security application management server, the business order Restrictions, you can send the communication security protection key first, you can also send the service key first, you can also send the letter security protection key and the service key.
  • the communication security protection key may not be generated by the management server of the mobile application or the management server of the security application, and therefore the steps related to the security communication protection key in this embodiment may be omitted.
  • the method for sharing a security application provided by an embodiment of the present application is shown in FIG. 2 and includes the following steps:
  • the secure application receives the communication security protection key and the service key of the mobile application;
  • the secure communication protection key may be generated by the mobile application management server or the secure application management server, and then synchronized to the mobile application management Server; when the mobile application's communication security protection key is generated by the mobile application's management server, the mobile application's communication security protection key can be sent to the security application after the mobile application's management server receives the mobile application's communication security protection key; A and the mobile application B) the service key is generated by the mobile application management server, and then the mobile application management server sends the mobile application service key (for example, the mobile application A service key and the mobile application B service key) To the management server of the security application; the security application can receive the communication security protection key and the service key of the mobile application from the security application management server (for example, the communication security protection key and the service key of the mobile application A, and the mobile application B ’s Communication security protection key and service key); communication security
  • the guard key can be a symmetric key or an asymmetric key; when the communication
  • the mobile application receives the communication security protection key of the mobile application; as described above, the secure communication protection key may be generated by the management server of the mobile application or by the management server of the security application, and then synchronized to the management of the mobile application Server; mobile applications (such as mobile application A and mobile application B) can receive their respective communication security protection keys (such as mobile application A ’s) from corresponding mobile application servers (such as mobile application A ’s server and mobile application B ’s server) Communication security protection key and mobile application B's communication security protection key); It should be noted that when the communication security protection key uses an asymmetric key, each mobile application can use the same public key as the security application can use The corresponding private key is used as the communication security protection key; there can be multiple service keys for mobile applications, such as symmetric keys as service keys and asymmetric keys as service keys, which can be used for different services Different service keys, for example, video services use symmetric keys to handle, voice services enable Asymmetric key processing.
  • Step 215 the mobile application uses the communication security protection key of the mobile application to encrypt the business data and send it to the security application; in the case where the mobile application itself has business data that needs to be decrypted, since the mobile application itself does not have a business key, the mobile application needs Request a security application to decrypt business data.
  • the mobile application's communication security protection key can be used to encrypt the business data; in general, the mobile application's communication security protection key uses an asymmetric encryption
  • the key for example, the key saved by the mobile application is a public key, and the key saved by the security application is a private key.
  • Mobile applications (such as mobile application A and mobile application B) use their own public keys (such as mobile application A's communication security protection public key and mobile application B's communication security protection public key) to encrypt business data and send it to the security application ;
  • the asymmetric key algorithm can include any of RSA, Elgamal, knapsack algorithm, Rabin, DH, ECC;
  • Step 220 the security application uses the mobile application's communication security protection key to decrypt to obtain the business data; the security application receives the mobile application's mobile communication security protection key (for example, the mobile application A's communication security protection private key and Mobile application B's communication security protection private key), so that the mobile application's mobile communication security protection key can be used to decrypt the received data to obtain business data;
  • the mobile application's mobile communication security protection key for example, the mobile application A's communication security protection private key and Mobile application B's communication security protection private key
  • the security application uses the service key of the mobile application to process the service data; the security application can use the service key stored by itself (for example, the service key of the mobile application A and the service key of the mobile application B) to decrypt the service data;
  • the service key can be a symmetric key or an asymmetric key.
  • the algorithm of the symmetric key can include any of DES, AES, and MD5.
  • the algorithm of the asymmetric key can include RSA, Elgamal, knapsack algorithm, Rabin, Either DH or ECC; when an asymmetric key is used as a business key, the processing method of business data can be determined according to specific requirements.
  • the processing method can also include signing the business data or verifying the signature of the business data; for example, the business data itself is the data that contains the signature, You can use the public key of the business key to verify the signature, if the business data needs to be signed, you can use Sign with the private key of the business key.
  • the business key can be used for encryption, and the business data itself is encrypted data, then the business key can be used for decryption.
  • Step 230 The security application sends the processed service data to the mobile application.
  • the security application may send the processed business data to the corresponding mobile application, for example, send the processed business data of mobile application A to mobile application A, and send the processed business data of mobile application B To mobile application B; then mobile application A and mobile application B can perform subsequent business processes based on the processed business data.
  • the mobile application management server generates the communication security protection key and the service key without any restriction on the order, and the communication can be generated first
  • the security protection key may also generate the service key first, or the communication security protection key and the service key at the same time; similarly, when sending the communication security protection key and the service key to the security application management server, the business order Restrictions, you can send the communication security protection key first, you can also send the service key first, you can also send the letter security protection key and the service key.
  • the communication security protection key may not be generated by the mobile application management server or the security application management server, so the steps related to the secure communication protection key in this embodiment may be omitted.
  • the security application may include a first security application and a second security application, a part of the mobile application is used to communicate with the first security application, and another part of the mobile application is communicated with the second security application.
  • the mobile application can also communicate with the security application through the security agent.
  • the security application may also use the communication security protection key of the mobile application (such as the mobile application A's communication security protection private key and the mobile application B's communication security protection private key when sending the processed service data to the mobile application ) To sign the processed business data to further improve security.
  • the communication security protection key of the mobile application such as the mobile application A's communication security protection private key and the mobile application B's communication security protection private key when sending the processed service data to the mobile application
  • the above-mentioned embodiment can realize the unified management of the communication security protection key and the service key of several mobile applications by the security application, thereby realizing the sharing of the security application and avoiding installing each security application in the security chip for each mobile application .
  • FIG. 3 is a schematic diagram of a mobile terminal provided by an embodiment of the present application, including an execution environment and a security chip, applications such as mobile application A and mobile application B are installed or running in the execution environment, and security applications are running in the security chip.
  • Mobile applications can receive the mobile application's secure communication protection key (such as mobile application A's secure communication protection key and mobile application B's secure communication protection key) from the mobile application's management server .
  • the communication security protection key of the mobile application uses an asymmetric key.
  • the key saved by the mobile application is a public key
  • the key saved by the security application is a private key.
  • the asymmetric key algorithm may include any one of RSA, Elgamal, knapsack algorithm, Rabin, D-H, ECC.
  • Mobile applications can use the mobile application's communication security protection key (such as mobile application A's communication security protection public key and mobile application in the case that business data needs to be processed (such as decryption) B's communication security protection public key) encrypts the business data, and sends the encrypted business data to the security application.
  • the security application may receive the communication security protection key and service key of the mobile application (for example, mobile application A and mobile application B) from the management server of the security application.
  • the communication security protection key of the mobile application can be an asymmetric key, so the security application can use the communication security protection private key of the mobile application (such as mobile application A and mobile application B) to decrypt the service data sent by the mobile application, Then use the service keys of mobile applications (such as mobile application A and mobile application B) to decrypt.
  • the service key can be a symmetric key or an asymmetric key.
  • the algorithm of the symmetric key can include any of DES, AES, and MD5.
  • the algorithm of the asymmetric key can include RSA, Elgamal, knapsack algorithm, Rabin, Either DH or ECC.
  • the security application can send the decrypted data to the corresponding mobile application (such as mobile application A and mobile application B) for the mobile application to complete the subsequent process.
  • the corresponding mobile application such as mobile application A and mobile application B
  • the security application can also use the communication security protection private key of the mobile application (for example, mobile application A and mobile application B) to sign the decrypted service data after decrypting the service data to improve security.
  • the mobile application for example, mobile application A and mobile application B
  • the mobile application uses the mobile application's communication security protection public key to verify the signature, so as to obtain the decrypted business data, and can complete the subsequent process.
  • the mobile terminal in the above embodiments can implement a security application installed in a security chip, provide security services to several mobile applications installed or running in the execution environment, and provide decryption services for business data of mobile applications, thereby improving the security of the mobile terminal Sex.
  • FIG. 4 is a schematic diagram of a mobile terminal provided by an embodiment of the present application, including a rich execution environment and a security chip, applications such as mobile application A and mobile application B are installed or running in the rich execution environment, and security applications are running in the security chip.
  • the rich execution environment is an open execution environment that runs on mobile devices and provides open and rich support for running applications, but the security protection capability is relatively weak.
  • Mobile applications can receive the mobile application's secure communication protection key (such as mobile application A's secure communication protection key and the mobile application management server in the rich execution environment Mobile application B's secure communication protection key).
  • the communication security protection key of the mobile application uses an asymmetric key.
  • the key saved by the mobile application is a public key
  • the key saved by the security application is a private key.
  • the asymmetric key algorithm may include any one of RSA, Elgamal, knapsack algorithm, Rabin, D-H, ECC.
  • Mobile applications can use mobile application communication security protection keys (such as mobile applications in a rich execution environment) when business data needs to be processed (for example, decryption) A's communication security protection public key and mobile application B's communication security protection public key) encrypt the business data, and send the encrypted business data to the security application.
  • the security application may receive the communication security protection key and the service key of the mobile application (e.g., mobile application A and mobile application B in a rich execution environment) from the management server of the security application.
  • the communication security protection key of the mobile application can be an asymmetric key, so the security application can decrypt the mobile application using the communication security protection private key of the mobile application (such as mobile application A and mobile application B in a rich execution environment)
  • the transmitted service data is then decrypted with the service key of the mobile application (such as mobile application A and mobile application B in a rich execution environment).
  • the service key can be a symmetric key or an asymmetric key.
  • the algorithm of the symmetric key can include any of DES, AES, and MD5.
  • the algorithm of the asymmetric key can include RSA, Elgamal, knapsack algorithm, Rabin, Either DH or ECC.
  • the security application can send the decrypted data to the corresponding mobile application (such as mobile application A and mobile application B in a rich execution environment) for the mobile application to complete the subsequent process.
  • the corresponding mobile application such as mobile application A and mobile application B in a rich execution environment
  • the security application can also use the communication security protection private key of the mobile application (such as mobile application A and mobile application B in a rich execution environment) to sign the decrypted business data after decrypting the business data to improve security .
  • the mobile application such as mobile application A and mobile application B in the rich execution environment
  • the mobile application uses the mobile application's communication security protection public key to verify the signature, so as to obtain the decrypted business data, and can complete the subsequent Process.
  • the mobile terminal in the above embodiments can implement a security application installed in a security chip, provide security services to several mobile applications installed or running in the execution environment, and provide decryption services for business data of mobile applications, thereby improving the security of the mobile terminal Sex.
  • FIG. 5 is a schematic diagram of a mobile terminal provided by an embodiment of the present application, including a trusted execution environment and a security chip.
  • Applications such as mobile application A and mobile application B are installed or run in the trusted execution environment, and security applications are run in the security chip.
  • the trusted execution environment is an isolated execution environment that runs on mobile devices. Compared with the rich execution environment, it has strong security capabilities to ensure that applications and sensitive data running in it are stored and processed in a relatively trusted environment. And protection.
  • Mobile applications can receive the mobile application's secure communication protection key (such as mobile application A's secure communication protection key in the trusted execution environment) from the mobile application management server Key and mobile application B's secure communication protection key).
  • the communication security protection key of the mobile application uses an asymmetric key.
  • the key saved by the mobile application is a public key
  • the key saved by the security application is a private key.
  • the asymmetric key algorithm may include any one of RSA, Elgamal, knapsack algorithm, Rabin, D-H, ECC.
  • Mobile applications can use the mobile application's communication security protection key (for example, in a trusted execution environment) when business data needs to be processed (for example, decryption).
  • the mobile application A's communication security protection public key and mobile application B's communication security protection public key) encrypt the service data, and send the encrypted service data to the security application.
  • the security application may receive the communication security protection key and the service key of the mobile application (for example, mobile application A and mobile application B in the trusted execution environment) from the management server of the security application.
  • the communication security protection key of the mobile application can be an asymmetric key, so the security application can decrypt the mobile using the communication security protection private key of the mobile application (such as mobile application A and mobile application B in a trusted execution environment)
  • the service data sent by the application is then decrypted with the service key of the mobile application (such as mobile application A and mobile application B in the trusted execution environment).
  • the service key can be a symmetric key or an asymmetric key.
  • the algorithm of the symmetric key can include any of DES, AES, and MD5.
  • the algorithm of the asymmetric key can include RSA, Elgamal, knapsack algorithm, Rabin, Either DH or ECC.
  • the security application may send the decrypted data to the corresponding mobile application (such as mobile application A and mobile application B in the trusted execution environment) for the mobile application to complete the subsequent process.
  • the corresponding mobile application such as mobile application A and mobile application B in the trusted execution environment
  • the security application can also use the communication security protection private key of the mobile application (such as mobile application A and mobile application B in the trusted execution environment) to sign the decrypted business data after decrypting the business data to improve security Sex.
  • the mobile application for example, mobile application A and mobile application B in the trusted execution environment
  • the mobile application uses the mobile application's communication security protection public key to verify the signature, thereby obtaining the decrypted business data, and can complete the subsequent Process.
  • the mobile terminal in the above embodiments can implement a security application installed in a security chip, provide security services to several mobile applications installed or running in the execution environment, and provide decryption services for business data of mobile applications, thereby improving the security of the mobile terminal Sex.
  • FIG. 6 is a schematic diagram of a mobile terminal provided by an embodiment of the present application, including a rich execution environment, a trusted execution environment, and a security chip, for example, applications such as mobile application A are installed or run in the rich execution environment, and installed or run in the trusted execution environment Applications such as mobile application B have security applications running in the security chip.
  • the rich execution environment is an open execution environment that runs on mobile devices and provides open and rich support for running applications, but the security protection capability is relatively weak.
  • the trusted execution environment is an isolated execution environment that runs on mobile devices. Compared with the rich execution environment, it has strong security capabilities to ensure that applications and sensitive data running in it are stored and processed in a relatively trusted environment. And protection.
  • Mobile applications can receive the secure communication protection key of the mobile application (for example, mobile application A in the rich execution environment) from the mobile application management server
  • the communication security protection key of the mobile application uses an asymmetric key.
  • the key saved by the mobile application is a public key
  • the key saved by the security application is a private key.
  • the asymmetric key algorithm may include any one of RSA, Elgamal, knapsack algorithm, Rabin, D-H, ECC.
  • Mobile applications can use the mobile application's communication security protection key (such as rich The communication security protection public key of the mobile application A in the execution environment and the communication security protection public key of the mobile application B in the trusted execution environment) encrypt the business data, and send the encrypted business data to the security application.
  • the security application may receive the communication security protection key and the service key of the mobile application (for example, mobile application A in the rich execution environment and mobile application B in the trusted execution environment) from the management server of the security application.
  • the communication security protection key of the mobile application can be an asymmetric key, so the security application can use the communication security of the mobile application (eg, mobile application A in the rich execution environment and mobile application B in the trusted execution environment) Protect the private key to decrypt the service data sent by the mobile application, and then use the service key of the mobile application (such as mobile application A in the rich execution environment and mobile application B in the trusted execution environment) to decrypt it.
  • the service key can be a symmetric key or an asymmetric key.
  • the algorithm of the symmetric key can include any of DES, AES, and MD5.
  • the algorithm of the asymmetric key can include RSA, Elgamal, knapsack algorithm, Rabin, Either DH or ECC.
  • the security application can send the decrypted data to the corresponding mobile application (for example, mobile application A in the rich execution environment and mobile application B in the trusted execution environment) for the mobile application to complete the subsequent process.
  • the corresponding mobile application for example, mobile application A in the rich execution environment and mobile application B in the trusted execution environment
  • the security application may also use the communication security protection private key of the mobile application (such as mobile application A in the rich execution environment and mobile application B in the trusted execution environment) to decrypt the business data after decrypting the business data. Sign to improve security.
  • the mobile application for example, mobile application A in the rich execution environment and mobile application B in the trusted execution environment
  • the mobile application's communication security protection public key is used to verify the signature, thereby obtaining the decrypted business data , And can complete the subsequent process.
  • the mobile terminal in the above embodiments can implement a security application installed in a security chip, provide security services to several mobile applications installed or running in the execution environment, and provide decryption services for business data of mobile applications, thereby improving the security of the mobile terminal Sex.
  • FIG. 7 is a schematic diagram of a mobile terminal provided by an embodiment of the present application, including a processor and a first memory, as well as a security chip and a second memory, the first memory stores a program corresponding to a mobile application (for example, a program corresponding to a mobile application A and a mobile application Corresponding program B) and other programs, the second memory stores a program corresponding to the security application.
  • a mobile application for example, a program corresponding to a mobile application A and a mobile application Corresponding program B
  • the second memory stores a program corresponding to the security application.
  • the processor can execute a program corresponding to the mobile application (for example, program A corresponding to the mobile application and program B corresponding to the mobile application), so that the secure communication protection key of the mobile application can be received from the management server of the program corresponding to the mobile application.
  • the communication security protection key of the mobile application uses an asymmetric key.
  • the key saved by the mobile application is a public key
  • the key saved by the security application is a private key.
  • the asymmetric key algorithm may include any one of RSA, Elgamal, knapsack algorithm, Rabin, D-H, ECC.
  • Programs corresponding to mobile applications can encrypt business data using the communication security protection key of the mobile application when business data needs to be processed (such as decryption) And send the encrypted business data to the security chip.
  • the security chip can execute the program corresponding to the security application, so that the communication security protection key and the service key of the mobile mobile application can be received from the management server of the program corresponding to the security application.
  • the communication security protection key of the mobile application can be an asymmetric key, so the security chip can use the mobile application's communication security protection private key to decrypt the business data sent by the processor, and then use the mobile application's business key to perform Decrypt.
  • the service key can be a symmetric key or an asymmetric key.
  • the algorithm of the symmetric key can include any of DES, AES, and MD5.
  • the algorithm of the asymmetric key can include RSA, Elgamal, knapsack algorithm, Rabin, Either DH or ECC.
  • the security chip After the security chip decrypts the business data, it can send the decrypted data to the processor for the processor to complete the subsequent process.
  • the processor may also use the mobile application's communication security protection private key to sign the decrypted business data to improve security.
  • the processor uses the mobile application's communication security protection public key to verify the signature, so as to obtain the decrypted business data, and can complete the subsequent process.
  • the mobile terminal in the above embodiment can implement a program corresponding to a security application in the security chip, provide security services to multiple mobile applications installed or running in the execution environment, and provide decryption services for business data of mobile applications, thereby improving Mobile terminal security.
  • the system for sharing security applications includes a mobile terminal, a management server for mobile applications, and a management server for security applications.
  • the mobile terminal includes an execution environment and a security chip.
  • the mobile application management server can generate communication security protection keys and service keys for mobile applications (such as mobile application A and mobile application B), and the mobile application management server can store mobile application (such as mobile application A and mobile application B)
  • the communication security protection key and the service key are sent to the management server of the security application, and the communication security protection key of the mobile application (for example, mobile application A and mobile application B) is sent to the corresponding mobile application (for example, mobile application A and mobile Application B).
  • the management server of the security application can send the communication security protection key and service key of the mobile application (such as mobile application A and mobile application B) to the security application, and the security application receives the mobile application (such as mobile application A and mobile application B) ) After the communication security protection key and the service key, the communication security protection key and the service key of the mobile application will be safely separated, for example, the communication security protection key and the service key of the mobile application A and the mobile application B The communication security protection key and / or business key are isolated.
  • each mobile application can save the same public key, and the security application saves the corresponding private key; if the communication security protection key is managed by the mobile application Provided by the server, the public key of each mobile application is different, and the security application stores the private key corresponding to multiple corresponding public keys; or if the communication security protection key is provided by the management server of the mobile application, when a symmetric key is used Next, each mobile application saves its own key, and the security application saves the corresponding key. In security applications, each communication security protection key needs to be safely isolated.
  • the service keys corresponding to each mobile application are generally different, and each service key also needs to be isolated.
  • the communication security protection keys of mobile applications may also be generated by the management server of the security application.
  • the management server of the security application may send the communication security protection key of the mobile application (for example, mobile application A and mobile application B) generated to the management server of the mobile application (for example, mobile application A and mobile application B).
  • the management server of the mobile application for example, mobile application A and mobile application B
  • may only generate the service key of the mobile application for example, mobile application A and mobile application B
  • the generated mobile application for example, mobile The service keys of application A and mobile application B
  • the management server of the security application can send the communication security protection key and the service key of the mobile application (such as mobile application A and mobile application B) to the security key, and the management server of the mobile application (such as mobile application A and mobile application B)
  • the communication security protection keys of mobile applications eg, mobile application A and mobile application B
  • may be sent to corresponding mobile applications eg, mobile application A and mobile application B).
  • the communication security protection key of the mobile application uses an asymmetric key.
  • the key saved by the mobile application is a public key
  • the key saved by the security application is a private key.
  • the asymmetric key algorithm may include any one of RSA, Elgamal, knapsack algorithm, Rabin, D-H, ECC.
  • a mobile application such as mobile application A and mobile application B
  • a business operation request such as a decryption operation request
  • the mobile application can also initiate an encrypted operation request to request the security application to encrypt the business data.
  • an operation request to request a signature or verify a signature can also be initiated.
  • the security application can use the mobile application (such as mobile application) after receiving the business data encrypted by the mobile application (such as mobile application A and mobile application B) using the mobile application (such as mobile application A and mobile application B) to secure the public key encryption A and mobile application B) communication security protection private key decryption, get business data. Subsequently, the security application can use the service key of the mobile application (such as mobile application A and mobile application B) to decrypt the business data, and can send the decrypted business data to the mobile application (such as mobile application A and mobile application B) , The mobile application can then use the decrypted business data to complete subsequent business processes.
  • the service key can be a symmetric key or an asymmetric key.
  • the algorithm of the symmetric key can include any of DES, AES, and MD5.
  • the algorithm of the asymmetric key can include RSA, Elgamal, knapsack algorithm, Rabin, Either DH or ECC.
  • the security application can also use the communication security protection of the mobile application (such as mobile application A and mobile application B)
  • the private key signs the decrypted business data and sends it to mobile applications (such as mobile application A and mobile application B).
  • Mobile applications (such as mobile application A and mobile application B) can use the corresponding communication security protection public key for verification Sign to get the decrypted business data.
  • the above system can complete the distribution of communication security protection keys and service keys, so that several mobile applications can share one management application.
  • the system for sharing security applications includes a mobile terminal, a management server for mobile applications, and a management server for security applications.
  • the mobile terminal includes a rich execution environment and a security chip.
  • the rich execution environment is an open execution environment that runs on mobile devices and provides open and rich support for running applications, but the security protection capability is relatively weak.
  • the mobile application management server can generate communication security protection keys and service keys for mobile applications (such as mobile application A and mobile application B in a rich execution environment), and the mobile application management server can store mobile applications (such as rich execution environment)
  • the mobile application A and mobile application B) communication security protection key and service key are sent to the security application management server, and the mobile application (such as mobile application A and mobile application B in a rich execution environment) communication security protection
  • the key is sent to the corresponding mobile application (for example, mobile application A and mobile application B in a rich execution environment).
  • the management server of the security application can send the communication security protection key and the service key of the mobile application (such as mobile application A and mobile application B in the rich execution environment) to the security application, and the security application receives the mobile application (such as rich execution) After the communication security protection key and service key of mobile application A and mobile application B) in the environment, the communication security protection key of the mobile application and the service key will be safely separated, for example, the communication security protection of mobile application A
  • the key and service key are isolated from the mobile application B's communication security protection key and service key.
  • each mobile application can save the same public key, and the security application saves the corresponding private key; if the communication security protection key is managed by the mobile application Provided by the server, the public key of each mobile application is different, and the security application stores the private key corresponding to multiple corresponding public keys; or if the communication security protection key is provided by the management server of the mobile application, when a symmetric key is used Next, each mobile application saves its own key, and the security application saves the corresponding key. In security applications, each communication security protection key needs to be safely isolated.
  • the service keys corresponding to each mobile application are generally different, and each service key also needs to be isolated.
  • the communication security protection key of the mobile application may also be generated by the management server of the security application.
  • the management server of the security application can send the communication security protection key of the mobile application (such as mobile application A and mobile application B in the rich execution environment) generated by it to the mobile application (such as mobile application A and mobile application in the rich execution environment) B) Management server.
  • the management server of the mobile application may only generate the service key of the mobile application (eg, mobile application A and mobile application B in the rich execution environment) And send the generated service key of the mobile application (such as mobile application A and mobile application B in the rich execution environment) to the management server of the security application.
  • the management server of the security application can send the communication security protection key and the service key of the mobile application (such as mobile application A and mobile application B in the rich execution environment) to the security key, and the mobile application (such as mobile in the rich execution environment)
  • the management server of application A and mobile application B) can send the communication security protection keys of mobile applications (such as mobile application A and mobile application B in a rich execution environment) to corresponding mobile applications (such as mobile applications in a rich execution environment) A and mobile application B).
  • the communication security protection key of the mobile application uses an asymmetric key.
  • the key saved by the mobile application is a public key
  • the key saved by the security application is a private key.
  • the asymmetric key algorithm may include any one of RSA, Elgamal, knapsack algorithm, Rabin, D-H, ECC.
  • a mobile application such as mobile application A and mobile application B in a rich execution environment
  • a business operation request such as a decryption operation request
  • the communication saved by the mobile application can be used
  • the security protection public key encrypts the business data, and sends the encrypted business data to the security application.
  • the mobile application can also initiate an encrypted operation request to request the security application to encrypt the business data.
  • an operation request to request a signature or verify a signature can also be initiated.
  • the security application can use the mobile application (such as mobile application A and mobile application B in the rich execution environment) to use the mobile application (such as mobile application A and mobile application B in the rich execution environment) to communicate and protect the business data encrypted by the public key, and can use it Private keys of communication security protection of mobile applications (such as mobile application A and mobile application B in a rich execution environment) are decrypted to obtain business data. Subsequently, the security application can decrypt the business data using the business key of the mobile application (such as mobile application A and mobile application B in the rich execution environment), and can send the decrypted business data to the mobile application (such as the mobile application in the rich execution environment) A and mobile application B), the mobile application can then use the decrypted business data to complete subsequent business processes.
  • the mobile application such as mobile application A and mobile application B in the rich execution environment
  • the mobile application such as mobile application A and mobile application B in the rich execution environment
  • the mobile application can then use the decrypted business data to complete subsequent business processes.
  • the service key can be a symmetric key or an asymmetric key.
  • the algorithm of the symmetric key can include any of DES, AES, and MD5.
  • the algorithm of the asymmetric key can include RSA, Elgamal, knapsack algorithm, Rabin, Either DH or ECC.
  • the security application can use the mobile application (such as mobile application A and mobile application in the rich execution environment) to decrypt the business data after using the service key of the mobile application (such as mobile application A and mobile application B in the rich execution environment).
  • the communication security protection private key signs the decrypted business data and sends to mobile applications (such as mobile application A and mobile application B in the rich execution environment), mobile applications (such as mobile application A and mobile application B in the rich execution environment )
  • the above system can complete the distribution of communication security protection keys and service keys, so that several mobile applications in the rich execution environment can share one management application.
  • the system for sharing security applications includes a mobile terminal, a management server for mobile applications, and a management server for security applications.
  • the mobile terminal includes a trusted execution environment and a security chip.
  • the trusted execution environment is an isolated execution environment that runs on mobile devices. Compared with the rich execution environment, it has strong security capabilities to ensure that applications and sensitive data running in it are stored and processed in a relatively trusted environment. And protection.
  • the mobile application management server can generate communication security protection keys and service keys for mobile applications (such as mobile application A and mobile application B in a trusted execution environment), and the mobile application management server can store mobile applications (such as trusted execution)
  • the communication security protection key and service key of mobile application A and mobile application B in the environment are sent to the management server of the security application, and the mobile application (such as mobile application A and mobile application B in the trusted execution environment) is sent
  • the communication security protection key is sent to the corresponding mobile application (for example, mobile application A and mobile application B in the trusted execution environment).
  • the management server of the security application can send the communication security protection key and the service key of the mobile application (such as mobile application A and mobile application B in the trusted execution environment) to the security application.
  • the security application receives the mobile application (such as After the communication security protection key and service key of the mobile application A and mobile application B) in the letter execution environment, the communication security protection key and the service key of the mobile application will be safely separated, for example, the communication of the mobile application A
  • the security protection key and the service key are isolated from the mobile application B's communication security protection key and the service key.
  • each mobile application can save the same public key, and the security application saves the corresponding private key; if the communication security protection key is managed by the mobile application Provided by the server, the public key of each mobile application is different, and the security application stores the private key corresponding to multiple corresponding public keys; or if the communication security protection key is provided by the management server of the mobile application, when a symmetric key is used Next, each mobile application saves its own key, and the security application saves the corresponding key. In security applications, each communication security protection key needs to be safely isolated.
  • the service keys corresponding to each mobile application are generally different, and each service key also needs to be isolated.
  • the communication security protection key of the mobile application may also be generated by the management server of the security application.
  • the management server of the secure application can send the communication security protection key of the mobile application (for example, mobile application A and mobile application B in the trusted execution environment) it generates to the mobile application (for example, mobile application A and mobile application in the trusted execution environment) Mobile application B) management server.
  • the management server of the mobile application may only generate services for the mobile application (for example, mobile application A and mobile application B in the trusted execution environment) Key, and send the generated service key of the mobile application (such as mobile application A and mobile application B in the trusted execution environment) to the management server of the security application.
  • the management server of the security application can send the communication security protection key and the service key of the mobile application (such as mobile application A and mobile application B in the trusted execution environment) to the security key, and the mobile application (such as the trusted execution environment)
  • the management server of the mobile application A and mobile application B can send the communication security protection key of the mobile application (such as mobile application A and mobile application B in the trusted execution environment) to the corresponding mobile application (such as trusted execution environment) Mobile application A and mobile application B).
  • the communication security protection key of the mobile application uses an asymmetric key.
  • the key saved by the mobile application is a public key
  • the key saved by the security application is a private key.
  • the asymmetric key algorithm may include any one of RSA, Elgamal, knapsack algorithm, Rabin, D-H, ECC.
  • a mobile application such as mobile application A and mobile application B in a trusted execution environment
  • a business operation request such as a decryption operation request
  • it can be saved using a mobile application (such as mobile application A and mobile application B in a trusted execution environment)
  • the communication security protection public key encrypts the business data and sends the encrypted business data to the security application.
  • the security application After the security application receives the business data encrypted by the mobile application (such as mobile application A and mobile application B in the trusted execution environment) using the mobile application (such as mobile application A and mobile application B in the trusted execution environment), the public security key protects the communication data, The private key of communication security protection of mobile applications (such as mobile application A and mobile application B in a trusted execution environment) can be decrypted to obtain business data. Subsequently, the security application can use the service key of the mobile application (such as mobile application A and mobile application B in the trusted execution environment) to decrypt the business data, and can send the decrypted business data to the mobile application (such as the trusted execution environment) China Mobile Application A and Mobile Application B), the mobile application can then use the decrypted business data to complete subsequent business processes.
  • the service key of the mobile application such as mobile application A and mobile application B in the trusted execution environment
  • the mobile application can then use the decrypted business data to complete subsequent business processes.
  • the service key can be a symmetric key or an asymmetric key.
  • the algorithm of the symmetric key can include any of DES, AES, and MD5.
  • the algorithm of the asymmetric key can include RSA, Elgamal, knapsack algorithm, Rabin, Either DH or ECC.
  • the security application can also use the mobile application (such as mobile application A and mobile application in the trusted execution environment).
  • Mobile application B) 's communication security protection private key signs the decrypted business data and sends it to mobile applications (such as mobile application A and mobile application B in trusted execution environment), mobile applications (such as mobile application A in trusted execution environment)
  • mobile application B) can use the corresponding communication security protection public key for verification and signature to obtain decrypted business data.
  • the above system can complete the distribution of communication security protection keys and service keys, so that several mobile applications in the trusted execution environment can share one management application.
  • the system for sharing security applications includes a mobile terminal, a management server for mobile applications, and a management server for security applications.
  • the mobile terminal includes a rich execution environment, a trusted execution environment, and a security chip.
  • the rich execution environment is an open execution environment that runs on mobile devices and provides open and rich support for running applications, but the security protection capability is relatively weak.
  • the trusted execution environment is an isolated execution environment that runs on mobile devices. Compared with the rich execution environment, it has strong security capabilities to ensure that applications and sensitive data running in it are stored and processed in a relatively trusted environment. And protection.
  • the mobile application management server can generate communication security protection keys and service keys for mobile applications (such as mobile application A in a rich execution environment and mobile application B in a trusted execution environment), and the mobile application management server can store the mobile application (For example, mobile application A in the rich execution environment and mobile application B in the trusted execution environment) the communication security protection key and the service key are sent to the management server of the security application, and the mobile application (for example, in the rich execution environment The communication security protection key of the mobile application A and the mobile application B in the trusted execution environment) is sent to the corresponding mobile application (eg, mobile application A in the rich execution environment and mobile application B in the trusted execution environment).
  • the management server of the security application can send the communication security protection key and the service key of the mobile application (such as mobile application A in the rich execution environment and mobile application B in the trusted execution environment) to the security application, and the security application receives After the communication security protection key and the service key of the mobile application (such as mobile application A in the rich execution environment and mobile application B in the trusted execution environment), the communication security protection key and the service key of the mobile application will be carried out Security isolation, for example, to isolate the communication security protection key and service key of mobile application A from the communication security protection key and service key of mobile application B.
  • Security isolation for example, to isolate the communication security protection key and service key of mobile application A from the communication security protection key and service key of mobile application B.
  • each mobile application can save the same public key, and the security application saves the corresponding private key; if the communication security protection key is managed by the mobile application Provided by the server, the public key of each mobile application is different, and the security application stores the private key corresponding to multiple corresponding public keys; or if the communication security protection key is provided by the management server of the mobile application, when a symmetric key is used Next, each mobile application saves its own key, and the security application saves the corresponding key. In security applications, each communication security protection key needs to be safely isolated.
  • the service keys corresponding to each mobile application are generally different, and each service key also needs to be isolated.
  • the communication security protection key of the mobile application may also be generated by the management server of the security application.
  • the management server of the secure application can send the communication security protection key of the mobile application (for example, mobile application A in the rich execution environment and mobile application B in the trusted execution environment) it generates to the mobile application (for example, in the rich execution environment)
  • the management server of mobile application A and mobile application B) in the trusted execution environment may also be generated by the management server of the security application.
  • the management server of the mobile application may only generate mobile applications (eg, mobile application A and trusted in the rich execution environment) The business key of the mobile application B) in the execution environment, and sends the generated business key of the mobile application (for example, mobile application A in the rich execution environment and mobile application B in the trusted execution environment) to the management of the secure application server.
  • the management server of the security application can send the communication security protection key and the service key of the mobile application (for example, mobile application A in the rich execution environment and mobile application B in the trusted execution environment) to the security key, and the mobile application (for example The management server of the mobile application A in the rich execution environment and the mobile application B in the trusted execution environment) can secure the communication of mobile applications (such as mobile application A in the rich execution environment and mobile application B in the trusted execution environment)
  • the protection key is sent to the corresponding mobile application (for example, mobile application A in the rich execution environment and mobile application B in the trusted execution environment).
  • the communication security protection key of the mobile application uses an asymmetric key.
  • the key saved by the mobile application is a public key
  • the key saved by the security application is a private key.
  • the asymmetric key algorithm may include any one of RSA, Elgamal, knapsack algorithm, Rabin, D-H, ECC.
  • a mobile application such as mobile application A in a rich execution environment and mobile application B in a trusted execution environment
  • a business operation request for example, a decryption operation request
  • the mobile application (such as mobile application A in a rich execution environment and The mobile application in the trusted execution environment B)
  • the communication security protection public key saved encrypts the business data, and sends the encrypted business data to the security application.
  • the mobile application can also initiate an encrypted operation request to request the security application to encrypt the business data.
  • an operation request to request a signature or verify a signature can also be initiated.
  • the security application uses mobile applications (such as mobile application A in the rich execution environment and mobile application A in the trusted execution environment) when receiving mobile applications (such as mobile application A in the rich execution environment and mobile application B in the trusted execution environment) B)
  • mobile applications such as mobile application A in the rich execution environment and mobile application B in the trusted execution environment
  • you can use the mobile application such as mobile application A in the rich execution environment and mobile application B in the trusted execution environment to decrypt the communication security protection private key to obtain the business data .
  • the security application can use the service key of the mobile application (such as mobile application A in the rich execution environment and mobile application B in the trusted execution environment) to decrypt the business data, and can send the decrypted business data to the mobile Applications (such as mobile application A in a rich execution environment and mobile application B in a trusted execution environment), the mobile application can then use the decrypted business data to complete subsequent business processes.
  • the service key can be a symmetric key or an asymmetric key.
  • the algorithm of the symmetric key can include any of DES, AES, and MD5.
  • the algorithm of the asymmetric key can include RSA, Elgamal, knapsack algorithm, Rabin, Either DH or ECC.
  • the security application may use the mobile application (such as rich after decrypting the business data using the business key of the mobile application (such as mobile application A in the rich execution environment and mobile application B in the trusted execution environment))
  • the private key of the communication security protection private key of the mobile application A in the execution environment and the mobile application B) in the trusted execution environment signs the decrypted business data, and sends it to the mobile application (such as mobile application A and Mobile application B in the letter execution environment)
  • mobile applications (such as mobile application A in the rich execution environment and mobile application B in the trusted execution environment) can use the corresponding communication security protection public key to verify the signature and obtain the decrypted Business data.
  • the above system can complete the distribution of communication security protection keys and service keys, so that several mobile applications in the trusted execution environment can share one management application.
  • the embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of computer program products implemented on multiple computer usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer usable program codes.
  • These computer program instructions may also be stored in a computer readable memory that can guide a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture including an instruction device, the instructions The device implements the functions specified in one block or multiple blocks of the flowchart one flow or multiple flows and / or block diagrams.
  • These computer program instructions can also be loaded onto a computer or other programmable data processing device, so that a series of operating steps are performed on the computer or other programmable device to produce computer-implemented processing, which is executed on the computer or other programmable device
  • the instructions provide steps for implementing the functions specified in one block or multiple blocks of the flowchart one flow or multiple flows and / or block diagrams.
  • the computing device includes multiple processors (CPUs), input / output interfaces, network interfaces, and memory.
  • processors CPUs
  • input / output interfaces output interfaces
  • network interfaces network interfaces
  • memory volatile and non-volatile memory
  • the memory may include non-permanent memory, random access memory (RAM) and / or non-volatile memory in computer-readable media, such as read only memory (ROM) or flash memory (flash RAM). Memory is an example of computer-readable media.
  • RAM random access memory
  • ROM read only memory
  • flash RAM flash memory
  • Computer-readable media including permanent and non-permanent, removable and non-removable media, can store information by any method or technology.
  • the information may be computer readable instructions, data structures, modules of programs, or other data.
  • Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, read-only compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, Magnetic tape cassettes, magnetic tape magnetic disk storage or other magnetic storage devices or any other non-transmission media can be used to store information that can be accessed by computing devices.
  • computer-readable media does not include temporary computer-readable media (transitory media), such as modulated data signals and carrier waves.
  • the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware. Moreover, the present application may take the form of computer program products implemented on multiple computer usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer usable program codes.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Mobile Radio Communication Systems (AREA)
  • Telephone Function (AREA)

Abstract

本申请公开了一种移动终端中共享安全应用的方法及移动终端，所述移动终端可运行多个移动应用，所述移动终端还包括安全应用，该方法包括：所述安全应用接收所述移动应用的业务密钥；所述若干移动应用将各自的业务数据加密后发送至所述安全应用；所述安全应用解密后得到所述各自的业务数据；所述安全应用使用所述移动应用的业务密钥处理所述业务数据；所述安全应用将处理后的业务数据发送至所述移动应用。

Description

一种移动终端中共享安全应用的方法及移动终端 技术领域
本申请涉及移动终端领域，尤其涉及一种移动终端中共享安全应用的方法及移动终端。
背景技术
随着移动互联网的发展，智能手机或者平板电脑等移动终端的功能也越来越强大，处理性能越来越强，它能够接入移动通信网、能够提供应用程序开发接口的开放操作系统并能够安装和运行各种应用软件，导致移动终端的安全性更加受到关注和重视。为了提高移动终端的安全性，移动终端集成了安全芯片(Secure Element，SE)，由其提供一个安全的数据存储和运算环境。设置有安全芯片的移动终端被广泛应用于各种具有较高安全性要求的业务场景。现有技术中，在使用安全芯片提高移动终端的安全性时，通常需要针对每个移动应用在安全芯片中安装对应的独立安全应用(运行在安全芯片中的应用)，并由该独立的安全应用负责完成该移动应用的安全运算需求，具有较高的开发成本和推广成本。
为了避免不必要的安全应用开发费用并降低推广成本，有必要提供一种解决方案，能够降低研发和推广成本，还可以保证移动应用安全运算和数据的独立性和安全性，从而降低移动应用使用安全芯片进行安全运算的成本。
发明内容
本申请实施例提供一种移动终端中共享安全应用的方法及移动终端，用于解决安全应用研发和推广成本高的问题。
本申请实施例提供了一种移动终端中共享安全应用的方法，所述移动终端可运行多个移动应用，所述移动终端还包括安全应用，所述方法包括：
所述安全应用接收多个移动应用的业务密钥；
所述安全应用接收多个移动应用发送的加密后的业务数据，并进行解密，得到各自解密后的业务数据；
所述安全应用使用所述多个移动应用的业务密钥处理各自相应的业务数据；
所述安全应用将处理后的各自相应的业务数据发送给相应的移动应用。
优选地，该方法还包括：
所述移动应用接收所述移动应用的通信安全保护密钥；
所述安全应用接收多个移动应用发送的加密后的业务数据，并进行解密包括：
所述安全应用接收多个移动应用发送的使用各自的通信安全保护密钥加密后的业务数据；
所述安全应用使用所述多个移动应用各自的通信安全保护密钥解密后得到所述各自的业务数据。
优选地，所述安全应用包括第一安全应用和第二安全应用；
所述若干移动应用中一部分移动应用与所述第一安全应用通信，所述若干移动应用中的另一部分移动应用与所述第二安全应用通信。
优选地，该方法还包括：
所述移动应用的管理服务器生成所述移动应用的通信安全保护密钥，并将所述移动应用的通信安全保护密钥发送至所述移动应用和安全应用管理服务器；所述安全应用管理服务器将所述移动应用的通信安全保护密钥发送至安全应用；和/或，
所述移动应用的管理服务器生成所述移动应用的业务密钥，并将所述移动应用的业务密钥发送至所述安全应用管理服务器；所述安全应用管理服务器将所述移动应用的业务密钥发送至安全应用。
优选地，该方法还包括：
所述移动应用的管理服务器生成所述移动应用的通信安全保护密钥和业务密钥，并将所述移动应用的通信安全保护密钥和业务密钥发送至所述安全应用管理服务器；
所述安全应用管理服务器将所述移动应用的通信安全保护密钥和业务密钥发送至安全应用；
所述移动应用的管理服务器将所述移动应用的通信安全保护密钥发送至所述移动应用。
优选地，该方法还包括：
所述安全应用的管理服务器生成所述移动应用的通信安全保护密钥，并将所述移 动应用的通信安全保护密钥发送至所述移动应用的管理服务器；
所述移动应用的管理服务器生成所述移动应用的业务密钥，并将所述移动应用的业务密钥发送至所述安全应用的管理服务器；
所述移动应用的管理服务器将所述移动应用的通信安全保护密钥发送至所述移动应用，所述安全应用的管理服务器将所述移动应用的通信安全保护密钥和业务密钥发送至所述安全应用。
优选地，若干所述移动应用的业务密钥在所述安全应用中被安全隔离；和/或若干所述移动应用的通信安全保护密钥在所述安全应用中被安全隔离。
优选地，所述移动应用的业务密钥为对称密钥或者非对称密钥；
当所述移动应用的业务密钥为对称密钥时，所述处理所述相应的业务数据包括加密所述业务数据或者解密所述业务数据；
当所述移动应用的业务密钥为非对称密钥时，所述处理所述相应的业务数据包括加密所述业务数据、解密所述业务数据、对所述业务数据签名或者验证所述业务所述数据的签名。
优选地，所述移动应用的通信安全保护密钥为对称密钥或者非对称密钥；其中，所述移动应用的通信安全保护密钥为非对称密钥的情况下，所述移动应用接收的所述移动应用的通信安全保护密钥为公钥，所述安全应用接收的所述移动应用的通信安全保护密钥为私钥。
优选地，所述安全应用将处理后的业务数据发送至所述移动应用包括：
所述安全应用使用私钥将处理后的业务数据签名后发送至所述移动应用。
优选地，所述执行环境为富执行环境和/或者可信执行环境。
优选地，所述若干移动应用通过安全应用代理与所述安全应用通信。
本申请实施例提供了一种移动终端，所述移动终端可运行多个移动应用，所述移动终端还包括安全应用；
所述安全应用，用于接收多个移动应用的业务密钥；接收多个移动应用发送的加密后的业务数据，并进行解密，得到各自解密后的业务数据；
所述安全应用，还用于使用所述多个移动应用的业务密钥处理各自相应的业务数 据；将处理后的各自相应的业务数据发送给相应的移动应用。
优选地，所述移动应用，还用于接收所述多个移动应用的通信安全保护密钥；
所述安全应用，还用于接收多个移动应用发送的使用各自的通信安全保护密钥加密后的业务数据；使用所述多个移动应用各自的通信安全保护密钥解密后得到所述各自的业务数据。
本申请实施例提供了一种移动终端，包括处理器、第一存储器、安全芯片以及第二存储器，所述第一存储器存储有多个移动应用对应的程序，所述第二存储器存储有安全应用对应的程序，
所述安全芯片，用于执行所述安全应用对应的程序以接收多个移动应用的业务密钥；接收处理器发送的加密后的业务数据，并进行解密，得到各自解密后的业务数据；
所述安全芯片，还用于使用多个移动应用的业务密钥处理各自相应的业务数据；将处理后的各自相应的业务数据发送给相应的移动应用。
优选地，所述处理器，还用于接收多个移动应用的通信安全保护密钥；
所述安全芯片，还用于接收处理器发送的使用多个安全应用各自的通信安全保护密钥加密后的业务数据；使用所述多个移动应用各自的通信安全保护密钥解密后得到所述各自的业务数据。
优选地，所述安全应用包括第一安全应用和第二安全应用；
所述多个移动应用中一部分移动应用与所述第一安全应用通信，所述多个移动应用中的另一部分移动应用与所述第二安全应用通信。
优选地，多个移动应用的业务密钥在所述第二存储器中被安全隔离；和/或多个移动应用的通信安全保护密钥在所述第二存储器中被安全隔离。
优选地，多个移动应用的业务密钥为对称密钥或者非对称密钥；所述移动应用的业务密钥为对称密钥的情况下，所述处理相应的业务数据包括加密所述业务数据或者解密所述业务数据；所述移动应用的业务密钥为非对称密钥的情况下，所述处理相应的业务数据包括加密所述业务数据、解密所述业务数据、对所述业务数据签名或者验证所述业务数据的签名。
优选地，多个移动应用的通信安全保护密钥为对称密钥或者非对称密钥；其中，所述移动应用的通信安全保护密钥为非对称密钥的情况下，所述处理器接收的所述移动 应用的通信安全保护密钥为公钥，所述安全芯片接收的所述移动应用的通信安全保护密钥为私钥。
优选地，所述安全芯片，还用于使用私钥将处理后的业务数据签名后发送至所述处理器。
本申请实施例提供了一种共享安全应用的系统，该系统所述的移动终端、多个移动应用的管理服务器、以及安全应用的管理服务器，其特征在于，
所述移动应用的管理服务器，用于生成多个移动应用的通信安全保护密钥和业务密钥，将多个移动应用的通信安全保护密钥发送至所述移动应用，将多个移动应用的通信安全保护密钥和业务密钥发送至所述安全应用的管理服务器；
所述安全应用的管理服务器，用于将多个移动应用的通信安全保护密钥和业务密钥发送至所述安全应用。
本申请实施例提供了一种共享安全应用的系统，该系统所述的移动终端、多个移动应用的管理服务器、以及安全应用的管理服务器，其特征在于，
多个移动应用的管理服务器，用于生成多个移动应用的业务密钥，并将多个移动应用的业务密钥发送至所述安全应用的管理服务器；
所述安全应用的管理服务器，还用于将业务密钥发送至所述安全应用。
优选地，所述安全应用的管理服务器，还用于生成多个移动应用的通信安全保护密钥；将多个移动应用的通信安全保护密钥发送至多个移动应用的管理服务器，并将多个移动应用的通信安全保护密钥发送至所述安全应用；多个移动应用的管理服务器，还用于将多个移动应用的通信安全保护密钥发送至所述移动应用。
本申请实施例提供了一种共享安全应用对应的程序的系统，该系统所述的移动终端、多个移动应用对应的程序的管理服务器、以及安全应用对应的程序的管理服务器，其特征在于，
多个移动应用对应的程序的管理服务器，用于生成多个移动应用的业务密钥，将多个移动应用的业务密钥发送至所述安全应用对应的管理服务器；
所述安全应用对应的程序的管理服务器，用于将多个移动应用的业务密钥发送至所述安全芯片。
优选地，多个移动应用对应的程序的管理服务器，还用于生成多个移动应用的通 信安全保护密钥；将多个移动应用的通信安全保护密钥发送至所述处理器；将多个移动应用的通信安全保护密钥发送至所述安全应用对应的程序的管理服务器；
所述安全应用对应的程序的管理服务器，还用于将多个移动应用的通信安全保护密钥发送至所述安全芯片。
本申请实施例提供了一种共享安全应用对应的程序的系统，该系统包括所述的移动终端、多个移动应用对应的程序的管理服务器、以及安全应用对应的程序的管理服务器，其特征在于，
移动应用对应的程序的管理服务器，用于生成多个移动应用的业务密钥，并将多个移动应用的业务密钥发送至安全应用对应的程序的管理服务器；
安全应用对应的程序的管理服务器，还用于将多个移动应用的业务密钥发送至所述安全芯片。
优选地，所述安全应用对应的程序的管理服务器，还用于生成多个移动应用的通信安全保护密钥；将多个移动应用的通信安全保护密钥发送至移动应用对应的程序的管理服务器；将多个移动应用的通信安全保护密钥发送至所述安全芯片；
移动应用对应的程序的管理服务器，还用于将多个移动应用的通信安全保护密钥发送至所述处理器。
本申请实施例采用的上述至少一个技术方案能够达到以下有益效果：
本申请实施例通过使这些移动应用在安全芯片中共享一个安全应用，可以无需针对这些移动应用独立开发应用软件开发包，可以极大降低移动应用使用安全芯片进行安全运算的成本，加快基于安全芯片的安全运算的普及，保障产品和业务安全。此外，本申请实施例在共享安全应用内部通过安全隔离的方式还能够确保不同移动应用安全运算和数据的独立性和安全性。
附图说明
此处所说明的附图用来提供对本申请的进一步理解，构成本申请的一部分，本申请的示意性实施例及其说明用于解释本申请，并不构成对本申请的不当限定。在附图中：
图1为本申请第一实施例提供的共享安全应用的方法示意图；
图2为本申请第二实施例提供的共享安全应用的方法示意图；
图3为本申请第三请实施例提供的移动终端示意图；
图4为本申请第四实施例提供的移动终端示意图；
图5为本申请第五实施例提供的移动终端示意图；
图6为本申请第六实施例提供的移动终端示意图；
图7为本申请第七实施例提供的移动终端示意图；
图8为本申请第八实施例提供的共享安全应用的系统示意图；
图9为本申请第九实施例提供的共享安全应用的系统示意图；
图10为本申请第十实施例提供的共享安全应用的系统示意图；
图11为本申请第十一实施例提供的共享安全应用的系统示意图。
具体实施方式
为使本申请的目的、技术方案和优点更加清楚，下面将结合本申请具体实施例及相应的附图对本申请技术方案进行清楚、完整地描述。显然，所描述的实施例仅是本申请一部分实施例，而不是全部的实施例。基于本申请中的实施例，本领域普通技术人员在没有做出创造性劳动前提下所获得的所有其他实施例，都属于本申请保护的范围。
以下结合附图，详细说明本申请实施例提供的技术方案。
在移动终端中包含有执行环境(Execution Environment)，是存在于移动设备中的软硬件集合，能够为应用程序在移动设备中的运行提供必要的能力支持，一般包括硬件处理单元、易失性存储单元、非易失性存储单元、操作系统、调用接口等组件。执行环境可以为富执行环境(Rich Execution Environment)或者可信执行环境(Trusted Execution Environment)。富执行环境是运行在移动设备中的开放执行环境，为运行其中的应用程序提供开放、丰富的运行能力支持，但安全保护能力相对较弱。可信执行环境是运行在移动设备中的隔离执行环境，相对于富执行环境，具备较强的安全能力，以确保运行其中的应用程序、敏感数据等在相对可信的环境中得到存储、处理和保护。
执行环境中可以运行或安装有移动应用，例如可以至少包含移动应用A和移动应用B。在安装有安全芯片的移动终端，通过在安全芯片中安装安全应用，提高移动终端设备的安全性。
在现有技术中，对于提供安全芯片的移动终端，各个移动应用的开发者，需要在 安全芯片中安装独立的安全应用，例如在华为手机中，淘宝、苏宁、京东为了提高其移动应用的安全性，需要分别在安全芯片中安装针对自身的安全应用，从而导致不必要的研发支出，也不利于后期的维护。尤其是对于同一个开发方或者关联的开发方开发多个移动应用的情况，例如淘宝、咸鱼、支付宝等移动应用，在安全需求统一的情况下，完全没有单独开发若干个独立的安全应用。
为了解决该技术问题，可以通过在手机中共享安全应用的方式来实现，该安全应用可以预置或者后期下载到用户的手机中，使用该安全应用管理各个移动应用的密钥，并实现对业务数据的处理，从而实现了使用一个安全应用为多个移动应用提供安全服务，从而实现了安全应用的共享。
为了便于描述，本申请以两个移动应用为例进行说明，例如移动应用A为淘宝移动应用，移动应用B为苏宁移动应用。需要说明的是，安全应用对于各个移动应用可以按照相同的方式进行管理，各个移动应用的通信安全保护密钥和业务密钥在安全应用中被安全隔离，每个移动应用在向安全应用请求服务时，只能访问该移动应用对应的通信安全保护密钥和业务密钥。
第一实施例
本申请实施例提供的共享安全应用的方法如图1所示，包括以下步骤：
步骤105，移动应用接收移动应用的通信安全保护密钥；安全通信保护密钥可以由移动应用的管理服务器生成，也可以由安全应用的管理服务器生成，然后同步给移动应用的管理服务器；移动应用(例如移动应用A和移动应用B)可以分别从对应的移动应用服务器(例如移动应用A的服务器和移动应用B的服务器)接收各自的通信安全保护密钥(例如移动应用A的通信安全保护密钥和移动应用B的通信安全保护密钥)；通信安全保护密钥可以是对称密钥，也可以是非对称密钥；通信安全保护密钥是对称密钥的情况下，通信安全保护密钥主要用于待传输的业务数据进行加密或者解密；通信安全保护密钥是非对称密钥的情况下，通信安全保护密钥中的公钥主要用于待传输的业务数据进行加密和对返回的签名进行验证，通信安全保护密钥中的私钥主要对接收到的加密后的业务数据进行解密，并利用业务密钥处理后，对处理后的业务数据进行签名；一般而言，通信安全保护密钥的公钥可以保存在移动应用中，通信安全保护密钥的私钥保存在安全应用中；
步骤110，安全应用接收移动应用的通信安全保护密钥和业务密钥；如上所述，安 全通信保护密钥可以由移动应用的管理服务器生成，也可以由安全应用的管理服务器生成，然后同步给移动应用的管理服务器；在移动应用的通信安全保护密钥由移动应用的管理服务器生成的情况，可以在安全应用的管理服务器接收到移动应用的通信安全保护密钥后发送给安全应用；移动应用(例如移动应用A和移动应用B)的业务密钥由移动应用的管理服务器生成，然后移动应用的管理服务器将移动应用的业务密钥(例如移动应用A的业务密钥和移动应用B的业务密钥)发送至安全应用的管理服务器；安全应用可以从安全应用的管理服务器接收移动应用的通信安全保护密钥和业务密钥(例如移动应用A的通信安全保护密钥和业务密钥，以及移动应用B的通信安全保护密钥和业务密钥)；安全应用可以将接收的各个移动应用的通信安全保护密钥和/或业务密钥进行安全隔离，例如将移动应用A的通信安全保护密钥和业务密钥和移动应用B的通信安全保护密钥和业务密钥进行安全隔离，可以通过将通信安全保护密钥和业务密钥分别存储在不同的文件中，可以每个文件只存储一个密钥，或者每个文件存储一个移动应用对应的通信安全保护密钥和业务密钥，通过设置各个移动应用的访问权限，从而实现了密钥的安全隔离。需要说明的是，通信安全保护密钥采用非对称密钥时，各个移动应用可以采用相同的公钥作为，而安全应用可以采用对应的私钥作为通信安全保护密钥；移动应用的业务密钥可以有多个，例如既有对称密钥作为业务密钥，又有非对称密钥作为业务密钥，可以针对不同的业务使用不同的业务密钥，例如视频业务使用对称密钥来处理，语音业务使用非对称密钥来处理。
步骤115，移动应用使用移动应用的通信安全保护密钥将业务数据加密后发送至安全应用；移动应用本身有业务数据需要解密的情况下，由于移动应用本身不具有业务密钥，所以移动应用需要请求安全应用来对业务数据进行解密。为了提高安全性，在移动应用请求安全应用对业务数据进行解密时，可以使用移动应用的通信安全保护密钥对业务数据进行加密；一般而言，移动应用的通信安全保护密钥采用非对称密钥，例如移动应用所保存的密钥为公钥，安全应用所保存的密钥为私钥。移动应用(例如移动应用A和移动应用B)使用自身的公钥(例如移动应用A的通信安全保护公钥和移动应用B的通信安全保护公钥)对业务数据进行加密，并发送至安全应用；非对称密钥的算法可以包括RSA、Elgamal、背包算法、Rabin、D-H、ECC中的任一种；
步骤120，安全应用使用移动应用的通信安全保护密钥解密以得到业务数据；安全应用从安全应用的管理服务器接收移动应用的移动通信安全保护密钥(例如移动应用A的通信安全保护私钥和移动应用B的通信安全保护私钥)，从而可以使用移动应用的移动通信安全保护密钥来对接收的数据进行解密，得到业务数据；
步骤125，安全应用使用移动应用的业务密钥处理业务数据；安全应用可以使用自身存储的业务密钥(例如移动应用A的业务密钥和移动应用B的业务密钥)对业务数据进行处理；业务密钥可以为对称密钥或者非对称密钥，对称密钥的算法可以包括DES、AES、以及MD5中的任一种，非对称密钥的算法可以包括RSA、Elgamal、背包算法、Rabin、D-H、ECC中的任一种。在使用非对称密钥作为业务密钥时，业务数据的处理方式可以根据具体的需求来确定，例如业务数据需要加密，则可以使用业务密钥的公钥进行加密，业务数据本身是加密数据，则可以使用业务密钥的私钥进行解密；此外，处理方式还可以包括对业务数据进行签名或者验证业务数据的签名；例如业务数据本身是包含签名的数据，则可以使用业务密钥的公钥来验证该签名，如果业务数据需要进行签名，则可以使用业务密钥的私钥来进行签名。在使用对称密钥时，业如果业务数据需要加密，则可以使用业务密钥进行加密，业务数据本身是加密数据，则可以使用业务密钥进行解密。可以理解的是，业务密钥可以有多组，例如多组非对称密钥而言，安全应用可以保存有不同密钥对中的公钥或者私钥，并根据具体的业务需求使用相应的密钥。
步骤130，安全应用将处理后的业务数据发送至移动应用。安全应用在将业务数据处理后，可以将处理后的业务数据发送至对应移动应用，例如将处理后的移动应用A的业务数据发送至移动应用A，将处理后的移动应用B的业务数据发送至移动应用B；随后移动应用A和移动应用B可以根据处理后的业务数据进行后续的业务流程。
可选地，安全应用在向移动应用发送处理后的业务数据时，还可以使用移动应用的通信安全保护密钥(例如移动应用A的通信安全保护私钥和移动应用B的通信安全保护私钥)来对处理后的业务数据签名，进一步提高安全性。
上述的实施例，能够实现由安全应用对若干移动应用的通信安全保护密钥和业务密钥的统一管理，从而实现安全应用的共享，避免针对每个移动应用在安全芯片中安装各自的安全应用。
需要说明的是，如果通信安全保护密钥和业务密钥均由移动应用的管理服务器，则移动应用的管理服务器生成通信安全保护密钥和业务密钥并无先后次序的限制，可以先生成通信安全保护密钥，也可以先生成业务密钥，也可以同时生成通信安全保护密钥和业务密钥；同样地，向安全应用管理服务器发送通信安全保护密钥和业务密钥时，业务先后次序的限制，可以先发送通信安全保护密钥，也可以先发送业务密钥，也可以同时发送信安全保护密钥和业务密钥。
进一步地需要说明的是，可以不由移动应用的管理服务器或安全应用的管理服务 器生成通信安全保护密钥，因而本实施例中与安全通信保护密钥相关的步骤可以省略。
第二实施例
本申请实施例提供的共享安全应用的方法如图2所示，包括以下步骤：
步骤205，安全应用接收移动应用的通信安全保护密钥和业务密钥；安全通信保护密钥可以由移动应用的管理服务器生成，也可以由安全应用的管理服务器生成，然后同步给移动应用的管理服务器；在移动应用的通信安全保护密钥由移动应用的管理服务器生成的情况，可以在安全应用的管理服务器接收到移动应用的通信安全保护密钥后发送给安全应用；移动应用(例如移动应用A和移动应用B)的业务密钥由移动应用的管理服务器生成，然后移动应用的管理服务器将移动应用的业务密钥(例如移动应用A的业务密钥和移动应用B的业务密钥)发送至安全应用的管理服务器；安全应用可以从安全应用的管理服务器接收移动应用的通信安全保护密钥和业务密钥(例如移动应用A的通信安全保护密钥和业务密钥，以及移动应用B的通信安全保护密钥和业务密钥)；通信安全保护密钥可以是对称密钥，也可以是非对称密钥；通信安全保护密钥是对称密钥的情况下，通信安全保护密钥主要用于待传输的业务数据进行加密或者解密；通信安全保护密钥是非对称密钥的情况下，通信安全保护密钥中的公钥主要用于待传输的业务数据进行加密和对返回的签名进行验证，通信安全保护密钥中的私钥主要对接收到的加密后的业务数据进行解密，并利用业务密钥处理后，对处理后的业务数据进行签名；一般而言，通信安全保护密钥的公钥可以保存在移动应用中，通信安全保护密钥的私钥保存在安全应用中；
步骤210，移动应用接收移动应用的通信安全保护密钥；如上所述，安全通信保护密钥可以由移动应用的管理服务器生成，也可以由安全应用的管理服务器生成，然后同步给移动应用的管理服务器；移动应用(例如移动应用A和移动应用B)可以分别从对应的移动应用服务器(例如移动应用A的服务器和移动应用B的服务器)接收各自的通信安全保护密钥(例如移动应用A的通信安全保护密钥和移动应用B的通信安全保护密钥)；需要说明的是，通信安全保护密钥采用非对称密钥时，各个移动应用可以采用相同的公钥作为，而安全应用可以采用对应的私钥作为通信安全保护密钥；移动应用的业务密钥可以有多个，例如既有对称密钥作为业务密钥，又有非对称密钥作为业务密钥，可以针对不同的业务使用不同的业务密钥，例如视频业务使用对称密钥来处理，语音业务使用非对称密钥来处理。
步骤215，移动应用使用移动应用的通信安全保护密钥将业务数据加密后发送至安 全应用；移动应用本身有业务数据需要解密的情况下，由于移动应用本身不具有业务密钥，所以移动应用需要请求安全应用来对业务数据进行解密。为了提高安全性，在移动应用请求安全应用对业务数据进行解密时，可以使用移动应用的通信安全保护密钥对业务数据进行加密；一般而言，移动应用的通信安全保护密钥采用非对称密钥，例如移动应用所保存的密钥为公钥，安全应用所保存的密钥为私钥。移动应用(例如移动应用A和移动应用B)使用自身的公钥(例如移动应用A的通信安全保护公钥和移动应用B的通信安全保护公钥)对业务数据进行加密，并发送至安全应用；非对称密钥的算法可以包括RSA、Elgamal、背包算法、Rabin、D-H、ECC中的任一种；
步骤220，安全应用使用移动应用的通信安全保护密钥解密以得到业务数据；安全应用从安全应用的管理服务器接收移动应用的移动通信安全保护密钥(例如移动应用A的通信安全保护私钥和移动应用B的通信安全保护私钥)，从而可以使用移动应用的移动通信安全保护密钥来对接收的数据进行解密，得到业务数据；
步骤225，安全应用使用移动应用的业务密钥处理业务数据；安全应用可以使用自身存储的业务密钥(例如移动应用A的业务密钥和移动应用B的业务密钥)对业务数据进行解密；业务密钥可以为对称密钥或者非对称密钥，对称密钥的算法可以包括DES、AES、以及MD5中的任一种，非对称密钥的算法可以包括RSA、Elgamal、背包算法、Rabin、D-H、ECC中的任一种；在使用非对称密钥作为业务密钥时，业务数据的处理方式可以根据具体的需求来确定，例如业务数据需要加密，则可以使用业务密钥的公钥进行加密，业务数据本身是加密数据，则可以使用业务密钥的私钥进行解密；此外，处理方式还可以包括对业务数据进行签名或者验证业务数据的签名；例如业务数据本身是包含签名的数据，则可以使用业务密钥的公钥来验证该签名，如果业务数据需要进行签名，则可以使用业务密钥的私钥来进行签名。在使用对称密钥时，业如果业务数据需要加密，则可以使用业务密钥进行加密，业务数据本身是加密数据，则可以使用业务密钥进行解密。
步骤230，安全应用将处理后的业务数据发送至移动应用。安全应用在将业务数据处理后，可以将处理后的业务数据发送至对应移动应用，例如将处理后的移动应用A的业务数据发送至移动应用A，将处理后的移动应用B的业务数据发送至移动应用B；随后移动应用A和移动应用B可以根据处理后的业务数据进行后续的业务流程。
需要说明的是，如果通信安全保护密钥和业务密钥均由移动应用的管理服务器，则移动应用的管理服务器生成通信安全保护密钥和业务密钥并无先后次序的限制，可以 先生成通信安全保护密钥，也可以先生成业务密钥，也可以同时生成通信安全保护密钥和业务密钥；同样地，向安全应用管理服务器发送通信安全保护密钥和业务密钥时，业务先后次序的限制，可以先发送通信安全保护密钥，也可以先发送业务密钥，也可以同时发送信安全保护密钥和业务密钥。
进一步地需要说明的是，可以不由移动应用的管理服务器或安全应用的管理服务器生成通信安全保护密钥，因而本实施例中与安全通信保护密钥相关的步骤可以省略。
此外，安全应用可以包括第一安全应用和第二安全应用，一部分移动应用于第一安全应用通信，另一部分移动应用与第二安全应用通信。优选地，移动应用还可以通过安全代理与安全应用通信。
可选地，安全应用在向移动应用发送处理后的业务数据时，还可以使用移动应用的通信安全保护密钥(例如移动应用A的通信安全保护私钥和移动应用B的通信安全保护私钥)来对处理后的业务数据签名，进一步提高安全性。
上述的实施例，能够实现由安全应用对若干移动应用的通信安全保护密钥和业务密钥的统一管理，从而实现安全应用的共享，避免针对每个移动应用在安全芯片中安装各自的安全应用。
第三实施例
图3是本申请实施例提供的移动终端示意图，包括执行环境以及安全芯片，执行环境中安装或运行有移动应用A、移动应用B等应用，安全芯片中运行有安全应用。
移动应用(例如移动应用A和移动应用B)可以从移动应用的管理服务器接收移动应用的安全通信保护密钥(例如移动应用A的安全通信保护密钥和移动应用B的安全通信保护密钥)。一般而言，移动应用的通信安全保护密钥采用非对称密钥，例如移动应用所保存的密钥为公钥，安全应用所保存的密钥为私钥。非对称密钥的算法可以包括RSA、Elgamal、背包算法、Rabin、D-H、ECC中的任一种。
移动应用(例如移动应用A和移动应用B)在有业务数据需要处理(例如解密)的情况下，可以使用移动应用的通信安全保护密钥(例如移动应用A的通信安全保护公钥和移动应用B的通信安全保护公钥)对业务数据进行加密，并将加密后的业务数据发送到安全应用。安全应用可以从安全应用的管理服务器接收移动应用(例如移动应用A和移动应用B)的通信安全保护密钥和业务密钥。如上所述，移动应用的通信安全保护密钥可以为非对称密钥，因而安全应用可以使用移动应用(例如移动应用A和移动应用 B)的通信安全保护私钥解密移动应用发送的业务数据，然后再用移动应用(例如移动应用A和移动应用B)的业务密钥进行解密。业务密钥可以为对称密钥或者非对称密钥，对称密钥的算法可以包括DES、AES、以及MD5中的任一种，非对称密钥的算法可以包括RSA、Elgamal、背包算法、Rabin、D-H、ECC中的任一种。
安全应用在解密业务数据以后，可以将解密后的数据发送到相应的移动应用(例如移动应用A和移动应用B)，供移动应用完成后续的流程。
优选地，安全应用还可以在解密业务数据以后，使用移动应用(例如移动应用A和移动应用B)的通信安全保护私钥对解密后的业务数据进行签名，以提高安全性。移动应用(例如移动应用A和移动应用B)接收到签名的解密后业务数据以后，使用移动应用的通信安全保护公钥验证签名，从而得到解密后的业务数据，并能够完成后续的流程。
上述实施例中的移动终端可以实现在安全芯片中安装一个安全应用，对安装或运行在执行环境中的若干移动应用提供安全服务，为移动应用的业务数据提供解密服务，从而提高移动终端的安全性。
第四实施例
图4是本申请实施例提供的移动终端示意图，包括富执行环境以及安全芯片，富执行环境中安装或运行有移动应用A、移动应用B等应用，安全芯片中运行有安全应用。富执行环境为运行在移动设备中的开放执行环境，为运行其中的应用程序提供开放、丰富的运行能力支持，但安全保护能力相对较弱。
移动应用(例如富执行环境中的移动应用A和移动应用B)可以从移动应用的管理服务器接收移动应用的安全通信保护密钥(例如富执行环境中的移动应用A的安全通信保护密钥和移动应用B的安全通信保护密钥)。一般而言，移动应用的通信安全保护密钥采用非对称密钥，例如移动应用所保存的密钥为公钥，安全应用所保存的密钥为私钥。非对称密钥的算法可以包括RSA、Elgamal、背包算法、Rabin、D-H、ECC中的任一种。
移动应用(例如富执行环境中的移动应用A和移动应用B)在有业务数据需要处理(例如解密)的情况下，可以使用移动应用的通信安全保护密钥(例如富执行环境中的移动应用A的通信安全保护公钥和移动应用B的通信安全保护公钥)对业务数据进行加密，并将加密后的业务数据发送到安全应用。安全应用可以从安全应用的管理服务 器接收移动应用(例如富执行环境中的移动应用A和移动应用B)的通信安全保护密钥和业务密钥。如上所述，移动应用的通信安全保护密钥可以为非对称密钥，因而安全应用可以使用移动应用(例如富执行环境中的移动应用A和移动应用B)的通信安全保护私钥解密移动应用发送的业务数据，然后再用移动应用(例如富执行环境中的移动应用A和移动应用B)的业务密钥进行解密。业务密钥可以为对称密钥或者非对称密钥，对称密钥的算法可以包括DES、AES、以及MD5中的任一种，非对称密钥的算法可以包括RSA、Elgamal、背包算法、Rabin、D-H、ECC中的任一种。
安全应用在解密业务数据以后，可以将解密后的数据发送到相应的移动应用(例如富执行环境中的移动应用A和移动应用B)，供移动应用完成后续的流程。
优选地，安全应用还可以在解密业务数据以后，使用移动应用(例如富执行环境中的移动应用A和移动应用B)的通信安全保护私钥对解密后的业务数据进行签名，以提高安全性。移动应用(例如富执行环境中的移动应用A和移动应用B)接收到加密的业务数据以后，使用移动应用的通信安全保护公钥验证签名，从而得到解密后的业务数据，并能够完成后续的流程。
上述实施例中的移动终端可以实现在安全芯片中安装一个安全应用，对安装或运行在执行环境中的若干移动应用提供安全服务，为移动应用的业务数据提供解密服务，从而提高移动终端的安全性。
第五实施例
图5是本申请实施例提供的移动终端示意图，包括可信执行环境以及安全芯片，可信执行环境中安装或运行有移动应用A、移动应用B等应用，安全芯片中运行有安全应用。可信执行环境为运行在移动设备中的隔离执行环境，相对于富执行环境，具备较强的安全能力，以确保运行其中的应用程序、敏感数据等在相对可信的环境中得到存储、处理和保护。
移动应用(例如可信执行环境中的移动应用A和移动应用B)可以从移动应用的管理服务器接收移动应用的安全通信保护密钥(例如可信执行环境中的移动应用A的安全通信保护密钥和移动应用B的安全通信保护密钥)。一般而言，移动应用的通信安全保护密钥采用非对称密钥，例如移动应用所保存的密钥为公钥，安全应用所保存的密钥为私钥。非对称密钥的算法可以包括RSA、Elgamal、背包算法、Rabin、D-H、ECC中的任一种。
移动应用(例如可信执行环境中的移动应用A和移动应用B)在有业务数据需要处理(例如解密)的情况下，可以使用移动应用的通信安全保护密钥(例如可信执行环境中的移动应用A的通信安全保护公钥和移动应用B的通信安全保护公钥)对业务数据进行加密，并将加密后的业务数据发送到安全应用。安全应用可以从安全应用的管理服务器接收移动应用(例如可信执行环境中的移动应用A和移动应用B)的通信安全保护密钥和业务密钥。如上所述，移动应用的通信安全保护密钥可以为非对称密钥，因而安全应用可以使用移动应用(例如可信执行环境中的移动应用A和移动应用B)的通信安全保护私钥解密移动应用发送的业务数据，然后再用移动应用(例如可信执行环境中的移动应用A和移动应用B)的业务密钥进行解密。业务密钥可以为对称密钥或者非对称密钥，对称密钥的算法可以包括DES、AES、以及MD5中的任一种，非对称密钥的算法可以包括RSA、Elgamal、背包算法、Rabin、D-H、ECC中的任一种。
安全应用在解密业务数据以后，可以将解密后的数据发送到相应的移动应用(例如可信执行环境中的移动应用A和移动应用B)，供移动应用完成后续的流程。
优选地，安全应用还可以在解密业务数据以后，使用移动应用(例如可信执行环境中的移动应用A和移动应用B)的通信安全保护私钥对解密后的业务数据进行签名，以提高安全性。移动应用(例如可信执行环境中的移动应用A和移动应用B)接收到签名的业务数据以后，使用移动应用的通信安全保护公钥验证签名，从而得到解密后的业务数据，并能够完成后续的流程。
上述实施例中的移动终端可以实现在安全芯片中安装一个安全应用，对安装或运行在执行环境中的若干移动应用提供安全服务，为移动应用的业务数据提供解密服务，从而提高移动终端的安全性。
第六实施例
图6是本申请实施例提供的移动终端示意图，包括富执行环境、可信执行环境以及安全芯片，例如富执行环境中安装或运行有移动应用A等应用，可信执行环境中安装或运行有移动应用B等应用，安全芯片中运行有安全应用。富执行环境为运行在移动设备中的开放执行环境，为运行其中的应用程序提供开放、丰富的运行能力支持，但安全保护能力相对较弱。可信执行环境为运行在移动设备中的隔离执行环境，相对于富执行环境，具备较强的安全能力，以确保运行其中的应用程序、敏感数据等在相对可信的环境中得到存储、处理和保护。
移动应用(例如富执行环境中的移动应用A和可信执行环境中的移动应用B)可以从移动应用的管理服务器接收移动应用的安全通信保护密钥(例如富执行环境中的移动应用A的安全通信保护密钥和可信执行环境中的移动应用B的安全通信保护密钥)。一般而言，移动应用的通信安全保护密钥采用非对称密钥，例如移动应用所保存的密钥为公钥，安全应用所保存的密钥为私钥。非对称密钥的算法可以包括RSA、Elgamal、背包算法、Rabin、D-H、ECC中的任一种。
移动应用(例如富执行环境中的移动应用A和可信执行环境中的移动应用B)在有业务数据需要处理(例如解密)的情况下，可以使用移动应用的通信安全保护密钥(例如富执行环境中的移动应用A的通信安全保护公钥和可信执行环境中的移动应用B的通信安全保护公钥)对业务数据进行加密，并将加密后的业务数据发送到安全应用。安全应用可以从安全应用的管理服务器接收移动应用(例如富执行环境中的移动应用A和可信执行环境中的移动应用B)的通信安全保护密钥和业务密钥。如上所述，移动应用的通信安全保护密钥可以为非对称密钥，因而安全应用可以使用移动应用(例如富执行环境中的移动应用A和可信执行环境中的移动应用B)的通信安全保护私钥解密移动应用发送的业务数据，然后再用移动应用(例如富执行环境中的移动应用A和可信执行环境中的移动应用B)的业务密钥进行解密。业务密钥可以为对称密钥或者非对称密钥，对称密钥的算法可以包括DES、AES、以及MD5中的任一种，非对称密钥的算法可以包括RSA、Elgamal、背包算法、Rabin、D-H、ECC中的任一种。
安全应用在解密业务数据以后，可以将解密后的数据发送到相应的移动应用(例如富执行环境中的移动应用A和可信执行环境中的移动应用B)，供移动应用完成后续的流程。
优选地，安全应用还可以在解密业务数据以后，使用移动应用(例如富执行环境中的移动应用A和可信执行环境中的移动应用B)的通信安全保护私钥对解密后的业务数据进行签名，以提高安全性。移动应用(例如富执行环境中的移动应用A和可信执行环境中的移动应用B)接收到签名的业务数据以后，使用移动应用的通信安全保护公钥验证签名，从而得到解密后的业务数据，并能够完成后续的流程。
上述实施例中的移动终端可以实现在安全芯片中安装一个安全应用，对安装或运行在执行环境中的若干移动应用提供安全服务，为移动应用的业务数据提供解密服务，从而提高移动终端的安全性。
第七实施例
图7是本申请实施例提供的移动终端示意图，包括处理器和第一存储器，以及安全芯片和第二存储器，第一存储器存储有移动应用对应的程序(例如移动应用对应的程序A和移动应用对应的程序B)等程序，第二存储器存储有安全应用对应的程序。
处理器可以执行移动应用对应的程序(例如移动应用对应的程序A和移动应用对应的程序B)，从而可以从移动应用对应的程序的管理服务器接收移动应用的安全通信保护密钥。一般而言，移动应用的通信安全保护密钥采用非对称密钥，例如移动应用所保存的密钥为公钥，安全应用所保存的密钥为私钥。非对称密钥的算法可以包括RSA、Elgamal、背包算法、Rabin、D-H、ECC中的任一种。
移动应用对应的程序(例如移动应用对应的程序A和移动应用对应的程序B)在有业务数据需要处理(例如解密)的情况下，可以使用移动应用的通信安全保护密钥对业务数据进行加密，并将加密后的业务数据发送到安全芯片。安全芯片可以执行安全应用对应的程序，从而可以从安全应用对应的程序的管理服务器接收移动移动应用的通信安全保护密钥和业务密钥。如上所述，移动应用的通信安全保护密钥可以为非对称密钥，因而安全芯片可以使用移动应用的通信安全保护私钥解密处理器发送的业务数据，然后再用移动应用的业务密钥进行解密。业务密钥可以为对称密钥或者非对称密钥，对称密钥的算法可以包括DES、AES、以及MD5中的任一种，非对称密钥的算法可以包括RSA、Elgamal、背包算法、Rabin、D-H、ECC中的任一种。
安全芯片在解密业务数据以后，可以将解密后的数据发送到处理器，供处理器完成后续的流程。
优选地，处理器还可以在解密业务数据以后，使用移动应用的通信安全保护私钥对解密后的业务数据进行签名，以提高安全性。处理器接收到签名的业务数据以后，使用移动应用的通信安全保护公钥验证签名，从而得到解密后的业务数据，并能够完成后续的流程。
上述实施例中的移动终端可以实现在安全芯片中安装一个安全应用对应的程序，对安装或运行在执行环境中的多个移动应用提供安全服务，为移动应用的业务数据提供解密服务，从而提高移动终端的安全性。
第八实施例
如图8所示，本申请实施例提供的共享安全应用的系统包括移动终端、移动应用的管理服务器和安全应用的管理服务器。移动终端包括执行环境和安全芯片。移动应用 的管理服务器可以生成移动应用(例如移动应用A和移动应用B)的通信安全保护密钥和业务密钥，移动应用的管理服务器可以将移动应用(例如移动应用A和移动应用B)的通信安全保护密钥和业务密钥发送至安全应用的管理服务器，并将移动应用(例如移动应用A和移动应用B)的通信安全保护密钥发送至相应的移动应用(例如移动应用A和移动应用B)。安全应用的管理服务器可以将移动应用(例如移动应用A和移动应用B)的通信安全保护密钥和业务密钥发送至安全应用，安全应用在收到移动应用(例如移动应用A和移动应用B)的通信安全保护密钥和业务密钥以后，会将移动应用的通信安全保护密钥和业务密钥进行安全隔离，例如将移动应用A的通信安全保护密钥和业务密钥与移动应用B的通信安全保护密钥和/或业务密钥进行隔离。需要说明的是，如果通信安全保护密钥由安全应用的管理服务器提供，则各个移动应用可以保存相同的公钥，而安全应用保存对应的私钥；如果通信安全保护密钥由移动应用的管理服务器提供，则各个移动应用的公钥不同，并且安全应用存储与多个对应的公钥对应的私钥；或者如果通信安全保护密钥由移动应用的管理服务器提供，在使用对称密钥的情况下，各个移动应用保存的自身的密钥，并且安全应用保存对应的密钥。安全应用中需要对各个通信安全保护密钥进行安全隔离。各个移动应用对应的业务密钥一般不同，各个业务密钥之间也需要隔离。
可选地，移动应用(例如移动应用A和移动应用B)的通信安全保护密钥也可由安全应用的管理服务器生成。安全应用的管理服务器可以将其生成的移动应用(例如移动应用A和移动应用B)的通信安全保护密钥发送至移动应用(例如移动应用A和移动应用B)的管理服务器。在这种情况下，移动应用(例如移动应用A和移动应用B)的管理服务器可以仅生成移动应用(例如移动应用A和移动应用B)的业务密钥，并将生成的移动应用(例如移动应用A和移动应用B)的业务密钥发送至安全应用的管理服务器。安全应用的管理服务器可以将移动应用(例如移动应用A和移动应用B)的通信安全保护密钥和业务密钥发送至安全密钥，移动应用(例如移动应用A和移动应用B)的管理服务器可以将移动应用(例如移动应用A和移动应用B)的通信安全保护密钥发送至相应的移动应用(例如移动应用A和移动应用B)。
一般而言，移动应用的通信安全保护密钥采用非对称密钥，例如移动应用所保存的密钥为公钥，安全应用所保存的密钥为私钥。非对称密钥的算法可以包括RSA、Elgamal、背包算法、Rabin、D-H、ECC中的任一种。
在移动应用(例如移动应用A和移动应用B)发起业务操作请求时，例如解密操 作请求，可以使用移动应用(例如移动应用A和移动应用B)所保存的通信安全保护公钥对业务数据进行加密，并将加密后的业务数据发送到安全应用。可选地，移动应用还可以发起加密的操作请求，请求安全应用对业务数据加密。在使用非对称密钥作为业务密钥的情况下，还可以发起请求签名或者验证签名的操作请求。
安全应用在收到移动应用(例如移动应用A和移动应用B)使用移动应用(例如移动应用A和移动应用B)的通信安全保护公钥加密的业务数据以后，可以使用移动应用(例如移动应用A和移动应用B)的通信安全保护私钥解密，得到业务数据。随后，安全应用可以使用移动应用(例如移动应用A和移动应用B)的业务密钥对业务数据进行解密，并可以将解密后的业务数据发送至移动应用(例如移动应用A和移动应用B)，移动应用可以随后使用解密后的业务数据完成后续的业务流程。业务密钥可以为对称密钥或者非对称密钥，对称密钥的算法可以包括DES、AES、以及MD5中的任一种，非对称密钥的算法可以包括RSA、Elgamal、背包算法、Rabin、D-H、ECC中的任一种。
可选地，安全应用在使用移动应用(例如移动应用A和移动应用B)的业务密钥对业务数据进行解密后，还可以使用移动应用(例如移动应用A和移动应用B)的通信安全保护私钥对解密后的业务数据进行签名，并发送给移动应用(例如移动应用A和移动应用B)，移动应用(例如移动应用A和移动应用B)可以使用对应的通信安全保护公钥进行验证签名，得到解密后的业务数据。
上述系统，可以完成通信安全保护密钥和业务密钥的分发，从而使得若干移动应用共享一个管理应用得以实现。
第九实施例
如图9所示，本申请实施例提供的共享安全应用的系统包括移动终端、移动应用的管理服务器和安全应用的管理服务器。移动终端包括富执行环境和安全芯片。富执行环境为运行在移动设备中的开放执行环境，为运行其中的应用程序提供开放、丰富的运行能力支持，但安全保护能力相对较弱。
移动应用的管理服务器可以生成移动应用(例如富执行环境中的移动应用A和移动应用B)的通信安全保护密钥和业务密钥，移动应用的管理服务器可以将移动应用(例如富执行环境中的移动应用A和移动应用B)的通信安全保护密钥和业务密钥发送至安全应用的管理服务器，并将移动应用(例如富执行环境中的移动应用A和移动应用B)的通信安全保护密钥发送至相应的移动应用(例如富执行环境中的移动应用A和移动应 用B)。安全应用的管理服务器可以将移动应用(例如富执行环境中的移动应用A和移动应用B)的通信安全保护密钥和业务密钥发送至安全应用，安全应用在收到移动应用(例如富执行环境中的移动应用A和移动应用B)的通信安全保护密钥和业务密钥以后，会将移动应用的通信安全保护密钥和业务密钥进行安全隔离，例如将移动应用A的通信安全保护密钥和业务密钥与移动应用B的通信安全保护密钥和业务密钥进行隔离。需要说明的是，如果通信安全保护密钥由安全应用的管理服务器提供，则各个移动应用可以保存相同的公钥，而安全应用保存对应的私钥；如果通信安全保护密钥由移动应用的管理服务器提供，则各个移动应用的公钥不同，并且安全应用存储与多个对应的公钥对应的私钥；或者如果通信安全保护密钥由移动应用的管理服务器提供，在使用对称密钥的情况下，各个移动应用保存的自身的密钥，并且安全应用保存对应的密钥。安全应用中需要对各个通信安全保护密钥进行安全隔离。各个移动应用对应的业务密钥一般不同，各个业务密钥之间也需要隔离。
可选地，移动应用(例如富执行环境中的移动应用A和移动应用B)的通信安全保护密钥也可由安全应用的管理服务器生成。安全应用的管理服务器可以将其生成的移动应用(例如富执行环境中的移动应用A和移动应用B)的通信安全保护密钥发送至移动应用(例如富执行环境中的移动应用A和移动应用B)的管理服务器。在这种情况下，移动应用(例如富执行环境中的移动应用A和移动应用B)的管理服务器可以仅生成移动应用(例如富执行环境中的移动应用A和移动应用B)的业务密钥，并将生成的移动应用(例如富执行环境中的移动应用A和移动应用B)的业务密钥发送至安全应用的管理服务器。安全应用的管理服务器可以将移动应用(例如富执行环境中的移动应用A和移动应用B)的通信安全保护密钥和业务密钥发送至安全密钥，移动应用(例如富执行环境中的移动应用A和移动应用B)的管理服务器可以将移动应用(例如富执行环境中的移动应用A和移动应用B)的通信安全保护密钥发送至相应的移动应用(例如富执行环境中的移动应用A和移动应用B)。
一般而言，移动应用的通信安全保护密钥采用非对称密钥，例如移动应用所保存的密钥为公钥，安全应用所保存的密钥为私钥。非对称密钥的算法可以包括RSA、Elgamal、背包算法、Rabin、D-H、ECC中的任一种。
在移动应用(例如富执行环境中的移动应用A和移动应用B)发起业务操作请求时，例如解密操作请求，可以使用移动应用(例如富执行环境中移动应用A和移动应用B)所保存的通信安全保护公钥对业务数据进行加密，并将加密后的业务数据发送到安 全应用。可选地，移动应用还可以发起加密的操作请求，请求安全应用对业务数据加密。在使用非对称密钥作为业务密钥的情况下，还可以发起请求签名或者验证签名的操作请求。
安全应用在收到移动应用(例如富执行环境中移动应用A和移动应用B)使用移动应用(例如富执行环境中移动应用A和移动应用B)的通信安全保护公钥加密的业务数据以后，可以使用移动应用(例如富执行环境中移动应用A和移动应用B)的通信安全保护私钥解密，得到业务数据。随后，安全应用可以使用移动应用(例如富执行环境中移动应用A和移动应用B)的业务密钥对业务数据进行解密，并可以将解密后的业务数据发送至移动应用(例如富执行环境中移动应用A和移动应用B)，移动应用可以随后使用解密后的业务数据完成后续的业务流程。业务密钥可以为对称密钥或者非对称密钥，对称密钥的算法可以包括DES、AES、以及MD5中的任一种，非对称密钥的算法可以包括RSA、Elgamal、背包算法、Rabin、D-H、ECC中的任一种。
可选地，安全应用在使用移动应用(例如富执行环境中移动应用A和移动应用B)的业务密钥对业务数据进行解密后，还可以使用移动应用(例如富执行环境中移动应用A和移动应用B)的通信安全保护私钥对解密后的业务数据进行签名，并发送给移动应用(例如富执行环境中移动应用A和移动应用B)，移动应用(例如富执行环境中移动应用A和移动应用B)可以使用对应的通信安全保护公钥进行验证签名，得到解密后的业务数据。
上述系统，可以完成通信安全保护密钥和业务密钥的分发，从而使得富执行环境中的若干移动应用共享一个管理应用得以实现。
第十实施例
如图10所示，本申请实施例提供的共享安全应用的系统包括移动终端、移动应用的管理服务器和安全应用的管理服务器。移动终端包括可信执行环境和安全芯片。可信执行环境为运行在移动设备中的隔离执行环境，相对于富执行环境，具备较强的安全能力，以确保运行其中的应用程序、敏感数据等在相对可信的环境中得到存储、处理和保护。
移动应用的管理服务器可以生成移动应用(例如可信执行环境中的移动应用A和移动应用B)的通信安全保护密钥和业务密钥，移动应用的管理服务器可以将移动应用(例如可信执行环境中的移动应用A和移动应用B)的通信安全保护密钥和业务密钥发 送至安全应用的管理服务器，并将移动应用(例如可信执行环境中的移动应用A和移动应用B)的通信安全保护密钥发送至相应的移动应用(例如可信执行环境中的移动应用A和移动应用B)。安全应用的管理服务器可以将移动应用(例如可信执行环境中的移动应用A和移动应用B)的通信安全保护密钥和业务密钥发送至安全应用，安全应用在收到移动应用(例如可信执行环境中的移动应用A和移动应用B)的通信安全保护密钥和业务密钥以后，会将移动应用的通信安全保护密钥和业务密钥进行安全隔离，例如将移动应用A的通信安全保护密钥和业务密钥与移动应用B的通信安全保护密钥和业务密钥进行隔离。需要说明的是，如果通信安全保护密钥由安全应用的管理服务器提供，则各个移动应用可以保存相同的公钥，而安全应用保存对应的私钥；如果通信安全保护密钥由移动应用的管理服务器提供，则各个移动应用的公钥不同，并且安全应用存储与多个对应的公钥对应的私钥；或者如果通信安全保护密钥由移动应用的管理服务器提供，在使用对称密钥的情况下，各个移动应用保存的自身的密钥，并且安全应用保存对应的密钥。安全应用中需要对各个通信安全保护密钥进行安全隔离。各个移动应用对应的业务密钥一般不同，各个业务密钥之间也需要隔离。
可选地，移动应用(例如可信执行环境中的移动应用A和移动应用B)的通信安全保护密钥也可由安全应用的管理服务器生成。安全应用的管理服务器可以将其生成的移动应用(例如可信执行环境中的移动应用A和移动应用B)的通信安全保护密钥发送至移动应用(例如可信执行环境中的移动应用A和移动应用B)的管理服务器。在这种情况下，移动应用(例如可信执行环境中的移动应用A和移动应用B)的管理服务器可以仅生成移动应用(例如可信执行环境中的移动应用A和移动应用B)的业务密钥，并将生成的移动应用(例如可信执行环境中的移动应用A和移动应用B)的业务密钥发送至安全应用的管理服务器。安全应用的管理服务器可以将移动应用(例如可信执行环境中的移动应用A和移动应用B)的通信安全保护密钥和业务密钥发送至安全密钥，移动应用(例如可信执行环境中的移动应用A和移动应用B)的管理服务器可以将移动应用(例如可信执行环境中的移动应用A和移动应用B)的通信安全保护密钥发送至相应的移动应用(例如可信执行环境中的移动应用A和移动应用B)。
一般而言，移动应用的通信安全保护密钥采用非对称密钥，例如移动应用所保存的密钥为公钥，安全应用所保存的密钥为私钥。非对称密钥的算法可以包括RSA、Elgamal、背包算法、Rabin、D-H、ECC中的任一种。
在移动应用(例如可信执行环境中的移动应用A和移动应用B)发起业务操作请 求时，例如解密操作请求，可以使用移动应用(例如可信执行环境中移动应用A和移动应用B)所保存的通信安全保护公钥对业务数据进行加密，并将加密后的业务数据发送到安全应用。
安全应用在收到移动应用(例如可信执行环境中移动应用A和移动应用B)使用移动应用(例如可信执行环境中移动应用A和移动应用B)的通信安全保护公钥加密的业务数据以后，可以使用移动应用(例如可信执行环境中移动应用A和移动应用B)的通信安全保护私钥解密，得到业务数据。随后，安全应用可以使用移动应用(例如可信执行环境中移动应用A和移动应用B)的业务密钥对业务数据进行解密，并可以将解密后的业务数据发送至移动应用(例如可信执行环境中移动应用A和移动应用B)，移动应用可以随后使用解密后的业务数据完成后续的业务流程。业务密钥可以为对称密钥或者非对称密钥，对称密钥的算法可以包括DES、AES、以及MD5中的任一种，非对称密钥的算法可以包括RSA、Elgamal、背包算法、Rabin、D-H、ECC中的任一种。
可选地，安全应用在使用移动应用(例如可信执行环境中移动应用A和移动应用B)的业务密钥对业务数据进行解密后，还可以使用移动应用(例如可信执行环境中移动应用A和移动应用B)的通信安全保护私钥对解密后的业务数据进行签名，并发送给移动应用(例如可信执行环境中移动应用A和移动应用B)，移动应用(例如可信执行环境中移动应用A和移动应用B)可以使用对应的通信安全保护公钥进行验证签名，得到解密后的业务数据。
上述系统，可以完成通信安全保护密钥和业务密钥的分发，从而使得可信执行环境中的若干移动应用共享一个管理应用得以实现。
第十一实施例
如图11所示，本申请实施例提供的共享安全应用的系统包括移动终端、移动应用的管理服务器和安全应用的管理服务器。移动终端包括富执行环境、可信执行环境和安全芯片。富执行环境为运行在移动设备中的开放执行环境，为运行其中的应用程序提供开放、丰富的运行能力支持，但安全保护能力相对较弱。可信执行环境为运行在移动设备中的隔离执行环境，相对于富执行环境，具备较强的安全能力，以确保运行其中的应用程序、敏感数据等在相对可信的环境中得到存储、处理和保护。
移动应用的管理服务器可以生成移动应用(例如富执行环境中的移动应用A和可信执行环境中的移动应用B)的通信安全保护密钥和业务密钥，移动应用的管理服务器 可以将移动应用(例如富执行环境中的移动应用A和可信执行环境中的移动应用B)的通信安全保护密钥和业务密钥发送至安全应用的管理服务器，并将移动应用(例如富执行环境中的移动应用A和可信执行环境中的移动应用B)的通信安全保护密钥发送至相应的移动应用(例如富执行环境中的移动应用A和可信执行环境中的移动应用B)。安全应用的管理服务器可以将移动应用(例如富执行环境中的移动应用A和可信执行环境中的移动应用B)的通信安全保护密钥和业务密钥发送至安全应用，安全应用在收到移动应用(例如富执行环境中的移动应用A和可信执行环境中的移动应用B)的通信安全保护密钥和业务密钥以后，会将移动应用的通信安全保护密钥和业务密钥进行安全隔离，例如将移动应用A的通信安全保护密钥和业务密钥与移动应用B的通信安全保护密钥和业务密钥进行隔离。需要说明的是，如果通信安全保护密钥由安全应用的管理服务器提供，则各个移动应用可以保存相同的公钥，而安全应用保存对应的私钥；如果通信安全保护密钥由移动应用的管理服务器提供，则各个移动应用的公钥不同，并且安全应用存储与多个对应的公钥对应的私钥；或者如果通信安全保护密钥由移动应用的管理服务器提供，在使用对称密钥的情况下，各个移动应用保存的自身的密钥，并且安全应用保存对应的密钥。安全应用中需要对各个通信安全保护密钥进行安全隔离。各个移动应用对应的业务密钥一般不同，各个业务密钥之间也需要隔离。
可选地，移动应用(例如富执行环境中的移动应用A和可信执行环境中的移动应用B)的通信安全保护密钥也可由安全应用的管理服务器生成。安全应用的管理服务器可以将其生成的移动应用(例如富执行环境中的移动应用A和可信执行环境中的移动应用B)的通信安全保护密钥发送至移动应用(例如富执行环境中的移动应用A和可信执行环境中的移动应用B)的管理服务器。在这种情况下，移动应用(例如富执行环境中的移动应用A和可信执行环境中的移动应用B)的管理服务器可以仅生成移动应用(例如富执行环境中的移动应用A和可信执行环境中的移动应用B)的业务密钥，并将生成的移动应用(例如富执行环境中的移动应用A和可信执行环境中的移动应用B)的业务密钥发送至安全应用的管理服务器。安全应用的管理服务器可以将移动应用(例如富执行环境中的移动应用A和可信执行环境中的移动应用B)的通信安全保护密钥和业务密钥发送至安全密钥，移动应用(例如富执行环境中的移动应用A和可信执行环境中的移动应用B)的管理服务器可以将移动应用(例如富执行环境中的移动应用A和可信执行环境中的移动应用B)的通信安全保护密钥发送至相应的移动应用(例如富执行环境中的移动应用A和可信执行环境中的移动应用B)。
一般而言，移动应用的通信安全保护密钥采用非对称密钥，例如移动应用所保存 的密钥为公钥，安全应用所保存的密钥为私钥。非对称密钥的算法可以包括RSA、Elgamal、背包算法、Rabin、D-H、ECC中的任一种。
在移动应用(例如富执行环境中的移动应用A和可信执行环境中的移动应用B)发起业务操作请求时，例如解密操作请求，可以使用移动应用(例如富执行环境中的移动应用A和可信执行环境中的移动应用B)所保存的通信安全保护公钥对业务数据进行加密，并将加密后的业务数据发送到安全应用。可选地，移动应用还可以发起加密的操作请求，请求安全应用对业务数据加密。在使用非对称密钥作为业务密钥的情况下，还可以发起请求签名或者验证签名的操作请求。
安全应用在收到移动应用(例如富执行环境中的移动应用A和可信执行环境中的移动应用B)使用移动应用(例如富执行环境中的移动应用A和可信执行环境中的移动应用B)的通信安全保护公钥加密的业务数据以后，可以使用移动应用(例如富执行环境中的移动应用A和可信执行环境中的移动应用B)的通信安全保护私钥解密，得到业务数据。随后，安全应用可以使用移动应用(例如富执行环境中的移动应用A和可信执行环境中的移动应用B)的业务密钥对业务数据进行解密，并可以将解密后的业务数据发送至移动应用(例如富执行环境中的移动应用A和可信执行环境中的移动应用B)，移动应用可以随后使用解密后的业务数据完成后续的业务流程。业务密钥可以为对称密钥或者非对称密钥，对称密钥的算法可以包括DES、AES、以及MD5中的任一种，非对称密钥的算法可以包括RSA、Elgamal、背包算法、Rabin、D-H、ECC中的任一种。
可选地，安全应用在使用移动应用(例如富执行环境中的移动应用A和可信执行环境中的移动应用B)的业务密钥对业务数据进行解密后，还可以使用移动应用(例如富执行环境中的移动应用A和可信执行环境中的移动应用B)的通信安全保护私钥对解密后的业务数据进行签名，并发送给移动应用(例如富执行环境中的移动应用A和可信执行环境中的移动应用B)，移动应用(例如富执行环境中的移动应用A和可信执行环境中的移动应用B)可以使用对应的通信安全保护公钥进行验证签名，得到解密后的业务数据。
上述系统，可以完成通信安全保护密钥和业务密钥的分发，从而使得可信执行环境中的若干移动应用共享一个管理应用得以实现。
通过本申请提供实施例，可以实现使用一个安全应用为多个具有统一需求的移动应用进行数据处理，可以降低移动应用使用安全芯片进行安全运算的成本，加快基于安全芯片的安全运算的普及。
本领域内的技术人员应明白，本发明的实施例可提供为方法、系统、或计算机程序产品。因此，本发明可采用完全硬件实施例、完全软件实施例、或结合软件和硬件方面的实施例的形式。而且，本发明可采用在多个其中包含有计算机可用程序代码的计算机可用存储介质(包括但不限于磁盘存储器、CD-ROM、光学存储器等)上实施的计算机程序产品的形式。
本发明是参照根据本发明实施例的方法、设备(系统)、和计算机程序产品的流程图和/或方框图来描述的。应理解可由计算机程序指令实现流程图和/或方框图中的每一流程和/或方框、以及流程图和/或方框图中的流程和/或方框的结合。可提供这些计算机程序指令到通用计算机、专用计算机、嵌入式处理机或其他可编程数据处理设备的处理器以产生一个机器，使得通过计算机或其他可编程数据处理设备的处理器执行的指令产生用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的装置。
这些计算机程序指令也可存储在能引导计算机或其他可编程数据处理设备以特定方式工作的计算机可读存储器中，使得存储在该计算机可读存储器中的指令产生包括指令装置的制造品，该指令装置实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能。
这些计算机程序指令也可装载到计算机或其他可编程数据处理设备上，使得在计算机或其他可编程设备上执行一系列操作步骤以产生计算机实现的处理，从而在计算机或其他可编程设备上执行的指令提供用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的步骤。
在一个典型的配置中，计算设备包括多个处理器(CPU)、输入/输出接口、网络接口和内存。
内存可能包括计算机可读介质中的非永久性存储器，随机存取存储器(RAM)和/或非易失性内存等形式，如只读存储器(ROM)或闪存(flash RAM)。内存是计算机可读介质的示例。
计算机可读介质包括永久性和非永久性、可移动和非可移动媒体可以由任何方法或技术来实现信息存储。信息可以是计算机可读指令、数据结构、程序的模块或其他数据。计算机的存储介质的例子包括，但不限于相变内存(PRAM)、静态随机存取存储器(SRAM)、动态随机存取存储器(DRAM)、其他类型的随机存取存储器(RAM)、只读存 储器(ROM)、电可擦除可编程只读存储器(EEPROM)、快闪记忆体或其他内存技术、只读光盘只读存储器(CD-ROM)、数字多功能光盘(DVD)或其他光学存储、磁盒式磁带，磁带磁磁盘存储或其他磁性存储设备或任何其他非传输介质，可用于存储可以被计算设备访问的信息。按照本文中的界定，计算机可读介质不包括暂存电脑可读媒体(transitory media)，如调制的数据信号和载波。
还需要说明的是，术语“包括”、“包含”或者其任何其他变体意在涵盖非排他性的包含，从而使得包括一系列要素的过程、方法、商品或者设备不仅包括那些要素，而且还包括没有明确列出的其他要素，或者是还包括为这种过程、方法、商品或者设备所固有的要素。在没有更多限制的情况下，由语句“包括一个……”限定的要素，并不排除在包括所述要素的过程、方法、商品或者设备中还存在另外的相同要素。
本领域技术人员应明白，本申请的实施例可提供为方法、系统或计算机程序产品。因此，本申请可采用完全硬件实施例、完全软件实施例或结合软件和硬件方面的实施例的形式。而且，本申请可采用在多个其中包含有计算机可用程序代码的计算机可用存储介质(包括但不限于磁盘存储器、CD-ROM、光学存储器等)上实施的计算机程序产品的形式。
以上所述仅为本申请的实施例而已，并不用于限制本申请。对于本领域技术人员来说，本申请可以有各种更改和变化。凡在本申请的精神和原理之内所作的任何修改、等同替换、改进等，均应包含在本申请的权利要求范围之内。

Claims (18)

  1. 一种移动终端中共享安全应用的方法，其特征在于，所述移动终端可运行多个移动应用，所述移动终端还包括安全应用，所述方法包括：
    所述安全应用接收多个移动应用的业务密钥；
    所述安全应用接收多个移动应用发送的加密后的业务数据，并进行解密，得到各自解密后的业务数据；
    所述安全应用使用所述多个移动应用的业务密钥处理各自相应的业务数据；
    所述安全应用将处理后的各自相应的业务数据发送给相应的移动应用。
  2. 如权利要求1所述的方法，其特征在于，该方法还包括：
    所述移动应用接收所述移动应用的通信安全保护密钥；
    所述安全应用接收多个移动应用发送的加密后的业务数据，并进行解密包括：
    所述安全应用接收多个移动应用发送的使用各自的通信安全保护密钥加密后的业务数据；
    所述安全应用使用所述多个移动应用各自的通信安全保护密钥解密后得到所述各自的业务数据。
  3. 如权利要求1所述的方法，其特征在于，所述安全应用包括第一安全应用和第二安全应用；
    所述若干移动应用中一部分移动应用与所述第一安全应用通信，所述若干移动应用中的另一部分移动应用与所述第二安全应用通信。
  4. 如权利要求1-3任一项所述的方法，其特征在于，该方法还包括：
    所述移动应用的管理服务器生成所述移动应用的通信安全保护密钥，并将所述移动应用的通信安全保护密钥发送至所述移动应用和安全应用管理服务器；所述安全应用管理服务器将所述移动应用的通信安全保护密钥发送至安全应用；和/或，
    所述移动应用的管理服务器生成所述移动应用的业务密钥，并将所述移动应用的业务密钥发送至所述安全应用管理服务器；所述安全应用管理服务器将所述移动应用的业务密钥发送至安全应用。
  5. 如权利要求1-3任一项所述的方法，其特征在于，该方法还包括：
    所述移动应用的管理服务器生成所述移动应用的通信安全保护密钥和业务密钥，并将所述移动应用的通信安全保护密钥和业务密钥发送至所述安全应用管理服务器；
    所述安全应用管理服务器将所述移动应用的通信安全保护密钥和业务密钥发送至安全应用；
    所述移动应用的管理服务器将所述移动应用的通信安全保护密钥发送至所述移动应用。
  6. 如权利要求1-3任一项所述的方法，其特征在于，该方法还包括：
    所述安全应用的管理服务器生成所述移动应用的通信安全保护密钥，并将所述移动应用的通信安全保护密钥发送至所述移动应用的管理服务器；
    所述移动应用的管理服务器生成所述移动应用的业务密钥，并将所述移动应用的业务密钥发送至所述安全应用的管理服务器；
    所述移动应用的管理服务器将所述移动应用的通信安全保护密钥发送至所述移动应用，所述安全应用的管理服务器将所述移动应用的通信安全保护密钥和业务密钥发送至所述安全应用。
  7. 如权利要求1-3任一项所述的方法，其特征在于，若干所述移动应用的业务密钥在所述安全应用中被安全隔离；和/或若干所述移动应用的通信安全保护密钥在所述安全应用中被安全隔离。
  8. 如权利要求1-3任一项所述的方法，其特征在于，所述移动应用的业务密钥为对称密钥或者非对称密钥；
    当所述移动应用的业务密钥为对称密钥时，所述处理所述各自相应的业务数据包括加密所述业务数据或者解密所述业务数据；
    当所述移动应用的业务密钥为非对称密钥时，所述处理所述各自相应的业务数据包括加密所述业务数据、解密所述业务数据、对所述业务数据签名或者验证所述业务所述数据的签名。
  9. 如权利要求1-3任一项所述的方法，其特征在于，所述移动应用的通信安全保护密钥为对称密钥或者非对称密钥；其中，所述移动应用的通信安全保护密钥为非对称密钥的情况下，所述移动应用接收的所述移动应用的通信安全保护密钥为公钥，所述安全应用接收的所述移动应用的通信安全保护密钥为私钥。
  10. 一种移动终端，其特征在于，所述移动终端可运行多个移动应用，所述移动终端还包括安全应用；
    所述安全应用，用于接收多个移动应用的业务密钥；接收多个移动应用发送的加密后的业务数据，并进行解密，得到各自解密后的业务数据；
    所述安全应用，还用于使用所述多个移动应用的业务密钥处理各自相应的业务数据；将处理后的各自相应的业务数据发送给相应的移动应用。
  11. 根据权利要求10所述的移动终端，其特征在于，所述移动应用，还用于接收 所述多个移动应用的通信安全保护密钥；
    所述安全应用，还用于接收多个移动应用发送的使用各自的通信安全保护密钥加密后的业务数据；使用所述多个移动应用各自的通信安全保护密钥解密后得到所述各自的业务数据。
  12. 一种移动终端，其特征在于，包括处理器、第一存储器、安全芯片以及第二存储器，所述第一存储器存储有多个移动应用对应的程序，所述第二存储器存储有安全应用对应的程序，
    所述安全芯片，用于执行所述安全应用对应的程序以接收多个移动应用的业务密钥；接收处理器发送的加密后的业务数据，并进行解密，得到各自解密后的业务数据；
    所述安全芯片，还用于使用多个移动应用的业务密钥处理各自相应的业务数据；将处理后的各自相应的业务数据发送给相应的移动应用。
  13. 根据权利要求12所述的移动终端，其特征在于，所述处理器，还用于接收多个移动应用的通信安全保护密钥；
    所述安全芯片，还用于接收处理器发送的使用多个安全应用各自的通信安全保护密钥加密后的业务数据；使用所述多个移动应用各自的通信安全保护密钥解密后得到所述各自的业务数据。
  14. 一种共享安全应用的系统，该系统包括根据权利要求10所述的移动终端、多个移动应用的管理服务器、以及安全应用的管理服务器，其特征在于，
    所述移动应用的管理服务器，用于生成多个移动应用的通信安全保护密钥和业务密钥，将多个移动应用的通信安全保护密钥发送至所述移动应用，将多个移动应用的通信安全保护密钥和业务密钥发送至所述安全应用的管理服务器；
    所述安全应用的管理服务器，用于将多个移动应用的通信安全保护密钥和业务密钥发送至所述安全应用。
  15. 一种共享安全应用的系统，该系统包括根据权利要求10所述的移动终端、多个移动应用的管理服务器、以及安全应用的管理服务器，其特征在于，
    多个移动应用的管理服务器，用于生成多个移动应用的业务密钥，并将多个移动应用的业务密钥发送至所述安全应用的管理服务器；
    所述安全应用的管理服务器，还用于将业务密钥发送至所述安全应用。
  16. 根据权利要求15所述的共享安全应用的系统，其特征在于，所述安全应用的管理服务器，还用于生成多个移动应用的通信安全保护密钥；将多个移动应用的通信安全保护密钥发送至多个移动应用的管理服务器，并将多个移动应用的通信安全保护密钥 发送至所述安全应用；多个移动应用的管理服务器，还用于将多个移动应用的通信安全保护密钥发送至所述移动应用。
  17. 一种共享安全应用对应的程序的系统，该系统包括根据权利要求12所述的移动终端、多个移动应用对应的程序的管理服务器、以及安全应用对应的程序的管理服务器，其特征在于，
    多个移动应用对应的程序的管理服务器，用于生成多个移动应用的业务密钥，将多个移动应用的业务密钥发送至所述安全应用对应的管理服务器；
    所述安全应用对应的程序的管理服务器，用于将多个移动应用的业务密钥发送至所述安全芯片。
  18. 一种共享安全应用对应的程序的系统，该系统包括根据权利要求12所述的移动终端、多个移动应用对应的程序的管理服务器、以及安全应用对应的程序的管理服务器，其特征在于，
    移动应用对应的程序的管理服务器，用于生成多个移动应用的业务密钥，并将多个移动应用的业务密钥发送至安全应用对应的程序的管理服务器；
    安全应用对应的程序的管理服务器，还用于将多个移动应用的业务密钥发送至所述安全芯片。
PCT/CN2019/097061 2018-10-12 2019-07-22 一种移动终端中共享安全应用的方法及移动终端 Ceased WO2020073712A1 (zh)

Priority Applications (3)

Application Number Priority Date Filing Date Title
SG11202100127SA SG11202100127SA (en) 2018-10-12 2019-07-22 Method and mobile terminal of sharing security application in mobile terminal
EP19871495.8A EP3866384B1 (en) 2018-10-12 2019-07-22 Method for sharing secure application in mobile terminal, and mobile terminal
US17/158,702 US11258610B2 (en) 2018-10-12 2021-01-26 Method and mobile terminal of sharing security application in mobile terminal

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201811186977.1 2018-10-12
CN201811186977.1A CN109450620B (zh) 2018-10-12 2018-10-12 一种移动终端中共享安全应用的方法及移动终端

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US17/158,702 Continuation US11258610B2 (en) 2018-10-12 2021-01-26 Method and mobile terminal of sharing security application in mobile terminal

Publications (1)

Publication Number Publication Date
WO2020073712A1 true WO2020073712A1 (zh) 2020-04-16

Family

ID=65546249

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2019/097061 Ceased WO2020073712A1 (zh) 2018-10-12 2019-07-22 一种移动终端中共享安全应用的方法及移动终端

Country Status (6)

Country Link
US (1) US11258610B2 (zh)
EP (1) EP3866384B1 (zh)
CN (1) CN109450620B (zh)
SG (1) SG11202100127SA (zh)
TW (1) TWI724473B (zh)
WO (1) WO2020073712A1 (zh)

Families Citing this family (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109450620B (zh) * 2018-10-12 2020-11-10 创新先进技术有限公司 一种移动终端中共享安全应用的方法及移动终端
CN109347629B (zh) * 2018-10-12 2020-10-16 阿里巴巴集团控股有限公司 基于共享安全应用的密钥传递方法及系统、存储介质、设备
CN110049036B (zh) * 2019-04-12 2021-05-25 赵宇 数据加密方法、装置及数据加密系统
US12169587B2 (en) * 2021-04-06 2024-12-17 Comcast Cable Communications, Llc Systems and methods for data security on a mobile device
CN113821835B (zh) * 2021-11-24 2022-02-08 飞腾信息技术有限公司 密钥管理方法、密钥管理装置和计算设备
CN114286345B (zh) * 2021-12-27 2024-04-02 无锡融卡科技有限公司 智能终端内的nfc通信装置及方法

Citations (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102026182A (zh) * 2009-09-23 2011-04-20 联通兴业科贸有限公司 一种移动终端的安全控制方法及系统
US20160234176A1 (en) * 2015-02-06 2016-08-11 Samsung Electronics Co., Ltd. Electronic device and data transmission method thereof
CN106375306A (zh) * 2016-08-31 2017-02-01 武汉钢铁工程技术集团通信有限责任公司 手机应用数据传输加密方法及系统
CN108282467A (zh) * 2017-12-29 2018-07-13 北京握奇智能科技有限公司 数字证书的应用方法、系统
CN108288004A (zh) * 2017-12-07 2018-07-17 深圳市中易通安全芯科技有限公司 一种加密芯片在ree和tee环境共存系统及方法
CN109347629A (zh) * 2018-10-12 2019-02-15 阿里巴巴集团控股有限公司 基于共享安全应用的密钥传递方法及系统、存储介质、设备
CN109450620A (zh) * 2018-10-12 2019-03-08 阿里巴巴集团控股有限公司 一种移动终端中共享安全应用的方法及移动终端

Family Cites Families (179)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
DE69309496T2 (de) 1992-12-24 1997-08-07 British Telecommunications Public Ltd. Co., London System und verfahren zur schluesselverteilung unter verwendung von quanten-kryptographie
US5307410A (en) 1993-05-25 1994-04-26 International Business Machines Corporation Interferometric quantum cryptographic key distribution system
US6151676A (en) 1997-12-24 2000-11-21 Philips Electronics North America Corporation Administration and utilization of secret fresh random numbers in a networked environment
US6505247B1 (en) 1998-08-21 2003-01-07 National Instruments Corporation Industrial automation system and method for efficiently transferring time-sensitive and quality-sensitive data
JP2001268535A (ja) 2000-03-15 2001-09-28 Nec Corp インターネット放送課金システム
US8677505B2 (en) 2000-11-13 2014-03-18 Digital Doors, Inc. Security system with extraction, reconstruction and secure recovery and storage of data
AU2002232187A1 (en) 2002-02-14 2003-09-04 Shimada, Kennichi Authenticating method
US8850179B2 (en) 2003-09-15 2014-09-30 Telecommunication Systems, Inc. Encapsulation of secure encrypted data in a deployable, secure communication system allowing benign, secure commercial transport
US7266847B2 (en) 2003-09-25 2007-09-04 Voltage Security, Inc. Secure message system with remote decryption service
US7299354B2 (en) 2003-09-30 2007-11-20 Intel Corporation Method to authenticate clients and hosts to provide secure network boot
US20090193184A1 (en) 2003-12-02 2009-07-30 Super Talent Electronics Inc. Hybrid 2-Level Mapping Tables for Hybrid Block- and Page-Mode Flash-Memory System
US7831048B2 (en) 2003-12-17 2010-11-09 General Dynamics Advanced Information Systems, Inc. Secure quantum key distribution using entangled photons
US7644278B2 (en) 2003-12-31 2010-01-05 International Business Machines Corporation Method for securely creating an endorsement certificate in an insecure environment
US7181011B2 (en) 2004-05-24 2007-02-20 Magiq Technologies, Inc. Key bank systems and methods for QKD
US7484099B2 (en) 2004-07-29 2009-01-27 International Business Machines Corporation Method, apparatus, and product for asserting physical presence with a trusted platform module in a hypervisor environment
US20060056630A1 (en) 2004-09-13 2006-03-16 Zimmer Vincent J Method to support secure network booting using quantum cryptography and quantum key distribution
US7386655B2 (en) 2004-12-16 2008-06-10 Sandisk Corporation Non-volatile memory and method with improved indexing for scratch pad and update blocks
US9191198B2 (en) 2005-06-16 2015-11-17 Hewlett-Packard Development Company, L.P. Method and device using one-time pad data
US7885412B2 (en) 2005-09-29 2011-02-08 International Business Machines Corporation Pre-generation of generic session keys for use in communicating within communications environments
PL1802046T3 (pl) 2005-12-23 2009-11-30 Alcatel Lucent Kontrola dostępu do zasobów dla żądań rezerwacji wyzwalanych przez klienta oraz wyzwalanych przez sieć
US8082443B2 (en) 2006-01-09 2011-12-20 Bbnt Solutions Llc. Pedigrees for quantum cryptography
US20130227286A1 (en) 2006-04-25 2013-08-29 Andre Jacques Brisson Dynamic Identity Verification and Authentication, Dynamic Distributed Key Infrastructures, Dynamic Distributed Key Systems and Method for Identity Management, Authentication Servers, Data Security and Preventing Man-in-the-Middle Attacks, Side Channel Attacks, Botnet Attacks, and Credit Card and Financial Transaction Fraud, Mitigating Biometric False Positives and False Negatives, and Controlling Life of Accessible Data in the Cloud
US9166782B2 (en) 2006-04-25 2015-10-20 Stephen Laurence Boren Dynamic distributed key system and method for identity management, authentication servers, data security and preventing man-in-the-middle attacks
US7783882B2 (en) 2006-09-07 2010-08-24 International Business Machines Corporation Recovering remnant encrypted data on a removable storage media
US8418235B2 (en) 2006-11-15 2013-04-09 Research In Motion Limited Client credential based secure session authentication method and apparatus
US8213602B2 (en) 2006-11-27 2012-07-03 Broadcom Corporation Method and system for encrypting and decrypting a transport stream using multiple algorithms
US20080165973A1 (en) 2007-01-09 2008-07-10 Miranda Gavillan Jose G Retrieval and Display of Encryption Labels From an Encryption Key Manager
CN101222488B (zh) 2007-01-10 2010-12-08 华为技术有限公司 控制客户端访问网络设备的方法和网络认证服务器
EP2122900A4 (en) 2007-01-22 2014-07-23 Spyrus Inc PORTABLE DATA ENCRYPTION DEVICE WITH CONFIGURABLE SAFETY FUNCTIONS AND METHOD FOR FILING ENCRYPTION
US20080219449A1 (en) 2007-03-09 2008-09-11 Ball Matthew V Cryptographic key management for stored data
US20090092252A1 (en) 2007-04-12 2009-04-09 Landon Curt Noll Method and System for Identifying and Managing Keys
GB2450869B (en) 2007-07-09 2012-04-25 Hewlett Packard Development Co Establishing a trust relationship between computing entities
US8111828B2 (en) 2007-07-31 2012-02-07 Hewlett-Packard Development Company, L.P. Management of cryptographic keys for securing stored data
US20090125444A1 (en) 2007-08-02 2009-05-14 William Cochran Graphical user interface and methods of ensuring legitimate pay-per-click advertising
CN101106455B (zh) 2007-08-20 2010-10-13 北京飞天诚信科技有限公司 身份认证的方法和智能密钥装置
US9323901B1 (en) 2007-09-28 2016-04-26 Emc Corporation Data classification for digital rights management
US8917247B2 (en) 2007-11-20 2014-12-23 Samsung Electronics Co., Ltd. External device identification method and apparatus in a device including a touch spot, and computer-readable recording mediums having recorded thereon programs for executing the external device identification method in a device including a touch spot
US8824684B2 (en) 2007-12-08 2014-09-02 International Business Machines Corporation Dynamic, selective obfuscation of information for multi-party transmission
CN101231768B (zh) * 2008-01-25 2010-09-08 北京深思洛克软件技术股份有限公司 一种多应用智能卡及实现智能卡多应用的方法
GB0801395D0 (en) 2008-01-25 2008-03-05 Qinetiq Ltd Network having quantum key distribution
US20090204812A1 (en) 2008-02-13 2009-08-13 Baker Todd M Media processing
US20090262684A1 (en) 2008-04-18 2009-10-22 Amit Khetawat Method and Apparatus for Home Node B Registration using HNBAP
JP2009265159A (ja) 2008-04-22 2009-11-12 Nec Corp 秘匿通信ネットワークにおける共有乱数管理方法および管理システム
US8838990B2 (en) 2008-04-25 2014-09-16 University Of Colorado Board Of Regents Bio-cryptography: secure cryptographic protocols with bipartite biotokens
GB0809044D0 (en) 2008-05-19 2008-06-25 Qinetiq Ltd Multiplexed QKD
EA201100389A1 (ru) 2008-08-20 2011-08-30 УЭРЕПРО, ЛЛСи Генератор пакетов данных, способ определения положения и передачи пароля
GB0819665D0 (en) 2008-10-27 2008-12-03 Qinetiq Ltd Quantum key dsitribution
KR101540798B1 (ko) 2008-11-21 2015-07-31 삼성전자 주식회사 가상화 환경에서 보안 정보를 제공하기 위한 장치 및 방법
US9438574B2 (en) 2008-12-30 2016-09-06 Avago Technologies General Ip (Singapore) Pte. Ltd. Client/server authentication over Fibre channel
WO2010090602A1 (en) 2009-02-04 2010-08-12 Data Security Systems Solutions Pte Ltd Transforming static password systems to become 2-factor authentication
US8194858B2 (en) 2009-02-19 2012-06-05 Physical Optics Corporation Chaotic cipher system and method for secure communication
US8077047B2 (en) 2009-04-16 2011-12-13 Ut-Battelle, Llc Tampering detection system using quantum-mechanical systems
US8266433B1 (en) 2009-04-30 2012-09-11 Netapp, Inc. Method and system for automatically migrating encryption keys between key managers in a network storage system
GB0917060D0 (en) 2009-09-29 2009-11-11 Qinetiq Ltd Methods and apparatus for use in quantum key distribution
US8700893B2 (en) 2009-10-28 2014-04-15 Microsoft Corporation Key certification in one round trip
US8789166B2 (en) 2009-10-30 2014-07-22 Feitian Technologies Co., Ltd. Verification method and system thereof
KR101314210B1 (ko) 2009-11-24 2013-10-02 한국전자통신연구원 사용자 인증 양자 키 분배 방법
WO2011068784A1 (en) 2009-12-01 2011-06-09 Azuki Systems, Inc. Method and system for secure and reliable video streaming with rate adaptation
KR101351012B1 (ko) 2009-12-18 2014-01-10 한국전자통신연구원 다자간 양자 통신에서의 사용자 인증 방법 및 장치
CN101741852B (zh) 2009-12-31 2012-08-08 飞天诚信科技股份有限公司 认证方法、系统和认证装置
US8418259B2 (en) 2010-01-05 2013-04-09 Microsoft Corporation TPM-based license activation and validation
GB201000288D0 (en) 2010-01-11 2010-02-24 Scentrics Information Security System and method of enforcing a computer policy
US8850554B2 (en) 2010-02-17 2014-09-30 Nokia Corporation Method and apparatus for providing an authentication context-based session
US8984588B2 (en) 2010-02-19 2015-03-17 Nokia Corporation Method and apparatus for identity federation gateway
US8868846B2 (en) 2010-03-19 2014-10-21 Netapp, Inc. Method and system for maintaining data coherency across a network
BR112012028616A2 (pt) 2010-05-14 2016-08-02 Siemens Ag método para distribuição de chave de grupo dedicado em sistemas que empregam eventos genéricos de subestação orientados a objeto e controlador de grupo para uma rede que compreende dispositivos de campo
US9002009B2 (en) 2010-06-15 2015-04-07 Los Alamos National Security, Llc Quantum key distribution using card, base station and trusted authority
US20120032781A1 (en) 2010-08-09 2012-02-09 Electronics And Telecommunications Research Institute Remote personal authentication system and method using biometrics
EP2418584A1 (en) 2010-08-13 2012-02-15 Thomson Licensing Method and apparatus for storing at least two data streams into an array of memories, or for reading at least two data streams from an array of memories
US8917631B2 (en) 2010-08-23 2014-12-23 Ortsbo Inc. System and method for sharing information between two or more devices
US8505083B2 (en) 2010-09-30 2013-08-06 Microsoft Corporation Remote resources single sign on
JP5682212B2 (ja) 2010-10-06 2015-03-11 ソニー株式会社 量子暗号通信装置と量子暗号通信方法および量子暗号通信システム
GB201020424D0 (en) 2010-12-02 2011-01-19 Qinetiq Ltd Quantum key distribution
US8839134B2 (en) 2010-12-24 2014-09-16 Intel Corporation Projection interface techniques
CN103608829A (zh) 2011-01-18 2014-02-26 舍德Ip有限责任公司 用于基于编码完整性进行计算机化协商的系统和方法
US9531758B2 (en) 2011-03-18 2016-12-27 Zscaler, Inc. Dynamic user identification and policy enforcement in cloud-based secure web gateways
US9698979B2 (en) 2011-04-15 2017-07-04 Quintessencelabs Pty Ltd. QKD key management system
US20140141725A1 (en) 2011-07-29 2014-05-22 Ronald D. Jesme Wireless presentation system allowing automatic association and connection
EP2555466B1 (en) 2011-08-05 2014-07-02 SELEX ES S.p.A. System for distributing cryptographic keys
US10102383B2 (en) 2011-08-19 2018-10-16 Quintessencelabs Pty Ltd. Permanently erasing mechanism for encryption information
US9509506B2 (en) 2011-09-30 2016-11-29 Los Alamos National Security, Llc Quantum key management
US9008308B2 (en) 2012-02-08 2015-04-14 Vixs Systems, Inc Container agnostic decryption device and methods for use therewith
US8302152B1 (en) 2012-02-17 2012-10-30 Google Inc. Location-based security system for portable electronic device
CN104145466A (zh) 2012-02-24 2014-11-12 诺基亚公司 用于动态服务器/客户端控制的连通性逻辑的方法和装置
US9100825B2 (en) 2012-02-28 2015-08-04 Verizon Patent And Licensing Inc. Method and system for multi-factor biometric authentication based on different device capture modalities
JP2013205604A (ja) 2012-03-28 2013-10-07 Toshiba Corp 通信装置および鍵管理方法
US9130742B2 (en) 2012-03-30 2015-09-08 California Institute Of Technology Key agreement in wireless networks with active adversaries
US20130262873A1 (en) 2012-03-30 2013-10-03 Cgi Federal Inc. Method and system for authenticating remote users
US9183136B2 (en) 2012-05-16 2015-11-10 Hitachi, Ltd. Storage control apparatus and storage control method
US9307564B2 (en) 2012-05-18 2016-04-05 Qualcomm Incorporated Automatic device-to-device connection control by environmental information
AU2013265020B2 (en) 2012-05-23 2017-10-12 University Of Leeds Secure communication
US8693691B2 (en) 2012-05-25 2014-04-08 The Johns Hopkins University Embedded authentication protocol for quantum key distribution systems
US10171454B2 (en) 2012-08-23 2019-01-01 Alejandro V. Natividad Method for producing dynamic data structures for authentication and/or password identification
CA2883313C (en) 2012-08-30 2020-06-16 Los Alamos National Security, Llc Multi-factor authentication using quantum communication
CN102801530B (zh) 2012-09-04 2015-08-26 飞天诚信科技股份有限公司 一种基于声音传输的认证方法
CN102946313B (zh) 2012-10-08 2016-04-06 北京邮电大学 一种用于量子密钥分配网络的用户认证模型和方法
US20140104137A1 (en) 2012-10-16 2014-04-17 Google Inc. Systems and methods for indirectly associating logical and physical display content
US9294267B2 (en) 2012-11-16 2016-03-22 Deepak Kamath Method, system and program product for secure storage of content
CN103034603B (zh) 2012-12-07 2014-06-18 天津瑞发科半导体技术有限公司 多通道闪存卡控制装置及其控制方法
US9129100B2 (en) 2012-12-13 2015-09-08 Huawei Technologies Co., Ltd. Verification code generation and verification method and apparatus
US8990550B1 (en) 2012-12-27 2015-03-24 Emc Corporation Methods and apparatus for securing communications between a node and a server based on hardware metadata gathered by an in-memory process
US8869303B2 (en) 2013-02-16 2014-10-21 Mikhail Fleysher Method and system for generation of dynamic password
US9374376B2 (en) 2013-02-27 2016-06-21 The Boeing Company Anti-hacking system for quantum communication
CN104036780B (zh) 2013-03-05 2017-05-24 阿里巴巴集团控股有限公司 一种人机识别方法及系统
US9747456B2 (en) 2013-03-15 2017-08-29 Microsoft Technology Licensing, Llc Secure query processing over encrypted data
WO2014141074A1 (en) 2013-03-15 2014-09-18 Ologn Technologies Ag Systems, methods and apparatuses for remote attestation
JP6482526B2 (ja) * 2013-03-15 2019-03-13 オラクル・インターナショナル・コーポレイション コンピュータアプリケーションのオブジェクトコードを変更することによるコンピュータアプリケーションのためのセキュリティサービス管理
GB2512944A (en) * 2013-04-12 2014-10-15 Mastercard International Inc Systems and methods for outputting information on a display of a mobile device
BR112015026372B8 (pt) 2013-04-18 2024-02-15 Facecon Co Ltd Dispositivo de comunicação que reforça a segurança para um arquivo armazenado em uma unidade virtual
JP6144338B2 (ja) 2013-04-26 2017-06-07 日立マクセル株式会社 投写型映像表示装置
US9282093B2 (en) 2013-04-30 2016-03-08 Microsoft Technology Licensing, Llc Synchronizing credential hashes between directory services
CN106972922B (zh) 2013-06-08 2019-06-14 科大国盾量子技术股份有限公司 一种基于量子密钥分配网络的移动保密通信方法
US10560265B2 (en) 2013-06-08 2020-02-11 Quantumctek Co., Ltd. Mobile secret communications method based on quantum key distribution network
JP6098439B2 (ja) 2013-08-28 2017-03-22 日亜化学工業株式会社 波長変換部材、発光装置、及び発光装置の製造方法
KR102074329B1 (ko) 2013-09-06 2020-02-06 삼성전자주식회사 데이터 저장 장치 및 그것의 데이터 처리 방법
EP3706364B1 (en) 2013-09-23 2021-04-21 Samsung Electronics Co., Ltd. Security management method and security management device in home network system
US20150095987A1 (en) 2013-10-01 2015-04-02 Certify Global LLC Systems and methods of verifying an authentication using dynamic scoring
CN104571930B (zh) * 2013-10-10 2018-01-30 中国移动通信集团公司 一种安全域存储空间的管理方法、系统和多应用开放平台装置
KR101479117B1 (ko) 2013-10-30 2015-01-07 에스케이 텔레콤주식회사 양자 키 분배 프로토콜을 구현함에 있어 더블 버퍼링 방식을 이용한 원시 키 생성 방법 및 장치
KR20150054505A (ko) 2013-11-12 2015-05-20 건국대학교 산학협력단 홈 가전기기들에 대한 관리 서비스를 제공하는 클라우드 기반의 데이터 서버 및 홈 가전기기들에 대한 관리 서비스 제공 방법
US9684780B2 (en) 2013-11-25 2017-06-20 Yingjie Liu Dynamic interactive identity authentication method and system
US9413759B2 (en) * 2013-11-27 2016-08-09 At&T Intellectual Property I, Lp Apparatus and method for secure delivery of data from a communication device
US9448924B2 (en) 2014-01-08 2016-09-20 Netapp, Inc. Flash optimized, log-structured layer of a file system
US20150207926A1 (en) 2014-01-23 2015-07-23 Microsoft Corporation Entity-linked reminder notifications
US9531537B2 (en) 2014-01-31 2016-12-27 Cryptometry Limited System and method for performing secure communications
JP6359285B2 (ja) 2014-02-17 2018-07-18 株式会社東芝 量子鍵配送装置、量子鍵配送システムおよび量子鍵配送方法
US9509502B2 (en) 2014-03-13 2016-11-29 Intel Corporation Symmetric keying and chain of trust
JP6223884B2 (ja) 2014-03-19 2017-11-01 株式会社東芝 通信装置、通信方法およびプログラム
JP6203093B2 (ja) 2014-03-19 2017-09-27 株式会社東芝 通信システム、通信装置、通信方法およびプログラム
US9331875B2 (en) 2014-04-04 2016-05-03 Nxgen Partners Ip, Llc System and method for communication using orbital angular momentum with multiple layer overlay modulation
US20150288517A1 (en) 2014-04-04 2015-10-08 Ut-Battelle, Llc System and method for secured communication
US9830467B1 (en) 2014-04-14 2017-11-28 Michael Harold System, method and apparatus for securely storing data on public networks
US9083739B1 (en) 2014-05-29 2015-07-14 Shape Security, Inc. Client/server authentication using dynamic credentials
CN104184892A (zh) * 2014-08-12 2014-12-03 桂林微网半导体有限责任公司 基于移动终端智能卡的数据传输方法及移动终端
US9531692B2 (en) * 2014-09-19 2016-12-27 Bank Of America Corporation Method of securing mobile applications using distributed keys
KR101776137B1 (ko) 2014-10-30 2017-09-19 에스케이 텔레콤주식회사 양자 키 분배 시스템에서 복수의 장치에 키를 공급하는 장치 및 방법
CN105553648B (zh) 2014-10-30 2019-10-29 阿里巴巴集团控股有限公司 量子密钥分发、隐私放大及数据传输方法、装置及系统
CN104486307B (zh) 2014-12-03 2017-08-15 中国电子科技集团公司第三十研究所 一种基于同态加密的分权密钥管理方法
CN105827397B (zh) 2015-01-08 2019-10-18 阿里巴巴集团控股有限公司 基于可信中继的量子密钥分发系统、方法及装置
CN104657099B (zh) 2015-01-15 2019-04-12 小米科技有限责任公司 屏幕投射方法、装置及系统
TWI543014B (zh) * 2015-01-20 2016-07-21 動信科技股份有限公司 快速佈署可信任執行環境應用的系統與方法
CN105871538B (zh) 2015-01-22 2019-04-12 阿里巴巴集团控股有限公司 量子密钥分发系统、量子密钥分发方法及装置
CN104579694B (zh) 2015-02-09 2018-09-14 浙江大学 一种身份认证方法及系统
CN105991285B (zh) 2015-02-16 2019-06-11 阿里巴巴集团控股有限公司 用于量子密钥分发过程的身份认证方法、装置及系统
US10848303B2 (en) 2015-03-09 2020-11-24 University Of Houston System Methods and apparatuses for authentication in quantum key distribution and/or quantum data communication
US20160283125A1 (en) 2015-03-25 2016-09-29 Kabushiki Kaisha Toshiba Multi-streamed solid state drive
US9760281B2 (en) 2015-03-27 2017-09-12 Intel Corporation Sequential write stream management
US9667600B2 (en) 2015-04-06 2017-05-30 At&T Intellectual Property I, L.P. Decentralized and distributed secure home subscriber server device
CN104780040A (zh) 2015-04-06 2015-07-15 安徽问天量子科技股份有限公司 基于量子密码的手持设备加密方法及系统
CN106156618A (zh) * 2015-04-17 2016-11-23 国民技术股份有限公司 一种安全芯片、移动终端和实现移动终端系统安全的方法
US10013177B2 (en) 2015-04-20 2018-07-03 Hewlett Packard Enterprise Development Lp Low write amplification in solid state drive
US9696935B2 (en) 2015-04-24 2017-07-04 Kabushiki Kaisha Toshiba Storage device that secures a block for a stream or namespace and system having the storage device
CN106209739B (zh) 2015-05-05 2019-06-04 科大国盾量子技术股份有限公司 云存储方法及系统
US9578008B2 (en) 2015-05-11 2017-02-21 Intel Corporation Technologies for secure bootstrapping of virtual network functions
US9804786B2 (en) 2015-06-04 2017-10-31 Seagate Technology Llc Sector translation layer for hard disk drives
US9801219B2 (en) 2015-06-15 2017-10-24 Microsoft Technology Licensing, Llc Pairing of nearby devices using a synchronized cue signal
US10348704B2 (en) 2015-07-30 2019-07-09 Helder Silvestre Paiva Figueira Method for a dynamic perpetual encryption cryptosystem
CN106470100B (zh) * 2015-08-14 2019-08-20 启碁科技股份有限公司 加解密装置、加密方法和解密方法
CN105260663B (zh) * 2015-09-15 2017-12-01 中国科学院信息工程研究所 一种基于TrustZone技术的安全存储服务系统及方法
US11398915B2 (en) 2016-08-26 2022-07-26 Samsung Electronics Co., Ltd. Apparatus and method for two-way authentication
US9923717B2 (en) 2015-10-07 2018-03-20 International Business Machines Corporation Refresh of shared cryptographic keys
CN105488679B (zh) * 2015-11-23 2019-12-03 北京小米支付技术有限公司 基于生物识别技术的移动支付设备、方法和装置
CN105512576A (zh) * 2015-12-14 2016-04-20 联想(北京)有限公司 一种数据安全存储的方法及电子设备
CN105678192B (zh) * 2015-12-29 2018-12-25 北京数码视讯科技股份有限公司 一种基于智能卡的密钥应用方法及应用装置
CN106130730A (zh) * 2016-06-21 2016-11-16 中国银联股份有限公司 一种智能卡的数据共享方法和智能卡
US10198215B2 (en) 2016-06-22 2019-02-05 Ngd Systems, Inc. System and method for multi-stream data write
CN105978920B (zh) * 2016-07-28 2019-05-24 恒宝股份有限公司 一种访问可信应用的方法及ta
CN106227503A (zh) * 2016-07-29 2016-12-14 苏州国芯科技有限公司 安全芯片cos固件更新方法、服务端、终端及系统
US10321182B2 (en) 2016-09-13 2019-06-11 Dvdo, Inc. System and method for real-time transfer and presentation multiple internet of things (IoT) device information on an electronic device based on casting and slinging gesture command
CN107862516A (zh) * 2016-09-21 2018-03-30 中国移动通信有限公司研究院 一种应用共享方法及相关设备与系统
CN106874733A (zh) * 2016-12-29 2017-06-20 北京握奇智能科技有限公司 一种具有UI功能的多应用网银Key及其控制方法
CN108304716A (zh) * 2017-01-13 2018-07-20 国民技术股份有限公司 多应用智能卡及其应用管理方法、通信系统及通信方法
US20180262907A1 (en) 2017-03-10 2018-09-13 International Business Machines Corporation Location based authentication verification for internet of things
CN107392055A (zh) * 2017-07-20 2017-11-24 深圳市金立通信设备有限公司 一种双系统安全芯片控制方法、终端、计算机可读存储介质及基于安全芯片的双系统架构
US10432395B2 (en) 2017-10-04 2019-10-01 The Boeing Company Recipient-driven data encryption
JP7048289B2 (ja) 2017-12-08 2022-04-05 キオクシア株式会社 情報処理装置および方法
CN108335105B (zh) * 2018-01-18 2022-09-09 中国建设银行股份有限公司 数据处理方法及相关设备
CN110647288A (zh) 2018-06-26 2020-01-03 上海宝存信息科技有限公司 数据储存装置及其快取分流方法
KR102693311B1 (ko) 2018-12-20 2024-08-09 삼성전자주식회사 스토리지 장치의 데이터 기입 방법 및 이를 수행하는 스토리지 장치

Patent Citations (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102026182A (zh) * 2009-09-23 2011-04-20 联通兴业科贸有限公司 一种移动终端的安全控制方法及系统
US20160234176A1 (en) * 2015-02-06 2016-08-11 Samsung Electronics Co., Ltd. Electronic device and data transmission method thereof
CN106375306A (zh) * 2016-08-31 2017-02-01 武汉钢铁工程技术集团通信有限责任公司 手机应用数据传输加密方法及系统
CN108288004A (zh) * 2017-12-07 2018-07-17 深圳市中易通安全芯科技有限公司 一种加密芯片在ree和tee环境共存系统及方法
CN108282467A (zh) * 2017-12-29 2018-07-13 北京握奇智能科技有限公司 数字证书的应用方法、系统
CN109347629A (zh) * 2018-10-12 2019-02-15 阿里巴巴集团控股有限公司 基于共享安全应用的密钥传递方法及系统、存储介质、设备
CN109450620A (zh) * 2018-10-12 2019-03-08 阿里巴巴集团控股有限公司 一种移动终端中共享安全应用的方法及移动终端

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP3866384A4 *

Also Published As

Publication number Publication date
CN109450620B (zh) 2020-11-10
EP3866384A1 (en) 2021-08-18
SG11202100127SA (en) 2021-02-25
TWI724473B (zh) 2021-04-11
US20210152362A1 (en) 2021-05-20
CN109450620A (zh) 2019-03-08
EP3866384A4 (en) 2022-06-22
TW202015379A (zh) 2020-04-16
US11258610B2 (en) 2022-02-22
EP3866384B1 (en) 2024-08-21

Similar Documents

Publication Publication Date Title
TWI724473B (zh) 移動終端中共享安全應用的方法及移動終端
CN107743133B (zh) 移动终端及其基于可信安全环境的访问控制方法和系统
US9590963B2 (en) System and method for key management for issuer security domain using global platform specifications
TWI706660B (zh) 基於共享安全應用的密鑰傳遞方法及系統、儲存媒體、設備
US11483136B2 (en) Wrapped keys with access control predicates
CN111274611A (zh) 数据脱敏方法、装置及计算机可读存储介质
CN111654367A (zh) 密码运算、创建工作密钥的方法、密码服务平台及设备
US20230222230A1 (en) Key distribution system in a secure enclave
US11265156B2 (en) Secrets management using key agreement
WO2024198933A1 (zh) 私钥保护和服务端访问方法、系统、设备及存储介质
US20140059341A1 (en) Creating and accessing encrypted web based content in hybrid applications
CN111741028A (zh) 业务处理方法、装置、设备及系统
US8612753B2 (en) Method and apparatus for protected code execution on clients
US11683159B2 (en) Hybrid content protection architecture
CN113918982B (zh) 一种基于标识信息的数据处理方法及系统
US12574216B2 (en) Multi-tenant hardware-backed transport layer security key management
CN112995109B (zh) 数据加密系统、方法、数据处理方法、装置及电子设备
CN105515757A (zh) 基于可信执行环境的安全性信息交互设备
CN115758403A (zh) 数据加密和解密方法、装置、存储介质及电子设备
CN114070584B (zh) 一种机密计算方法、装置、设备及存储介质
CN114282235A (zh) 一种对接硬件安全模块的系统和服务器
JP2022551586A (ja) 暗号化コプロセッサにおけるエンティティ固有の暗号化コードの実行
CN114389790A (zh) 一种安全多方计算方法及装置
US12438722B1 (en) Cross-platform access control
CN116821936B (zh) 一种数据交集的确定方法及装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 19871495

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

ENP Entry into the national phase

Ref document number: 2019871495

Country of ref document: EP

Effective date: 20210512

WWG Wipo information: grant in national office

Ref document number: 11202100127S

Country of ref document: SG

WWP Wipo information: published in national office

Ref document number: 11202100127S

Country of ref document: SG