Key transfer method and system based on shared security application, storage medium, and device thereof

Patent metadata

Field	Value
Publication number	US-11101985-B2
Application number	US-202117158719-A
Country	US
Kind code	B2
Filing date	Jan 26, 2021
Priority date	Oct 12, 2018
Publication date	Aug 24, 2021
Grant date	Aug 24, 2021

Abstract

One embodiment provides a key transfer system and method based on a shared security application. During operation, an application executing on a terminal device receives an application key comprising at least a service key from a management server of the application and forwards the application key to a management server of a shared security application residing in a secure element in the terminal device, thereby facilitating the management server of the shared security application to deliver the application key to the shared security application. The application invokes the application key stored in the shared security application to perform services associated with the application. The application key is isolated from other application keys associated with other applications stored in the shared security application.

First claim

What is claimed is:

1. A computer executed method, comprising:
receiving, by an application executing on a terminal device, an application key comprising at least a service key from a management server of the application;
forwarding the application key to a management server of a shared security application residing in a secure element in the terminal device, thereby facilitating the management server of the shared security application to deliver the application key to the shared security application; and
invoking, by the application, the application key stored in the shared security application to perform services associated with the application, wherein the application key is isolated from other application keys associated with other applications stored in the shared security application.

2. The method according to claim 1 , wherein the application key further comprises a communication security protection key, and wherein the method further comprises:
encrypting, by the application, service data associated with the services using the communication security protection key; and
sending the encrypted service data to the shared security application.

3. The method according to claim 2 , further comprising:
decrypting, by the shared security application, the encrypted service data;
processing, by the shared security application, the service data using the service key;
encrypting, by the shared security application, the processed service data using the communication security protection key; and
returning, by the shared security application, the encrypted processed service data to the application.

4. The method according to claim 1 , wherein receiving the application key from the management server of the application comprises receiving the application key that is encrypted by the management server of the application using a public key of the management server of the shared security application, and wherein the public key of the management server of the shared security application is distributed to the management server of the application by the management server of the shared security application.

5. The method according to claim 4 , wherein forwarding the application key comprises:
invoking, by the application, a corresponding interface provided by a shared security application proxy on the terminal device external of the secure element;
sending, by the application via the corresponding interface and the security application proxy, the encrypted application key to the management server of the shared security application;
performing, by the management server of the shared security application, decryption using a private key corresponding to the public key to obtain the application key; and
delivering, by the management server of the shared security application, the application key to the shared security application in the secure element.

6. The method according to claim 5 , wherein the shared security application proxy is executed in a rich execution environment or a trusted execution environment of the terminal device.

7. The method according to claim 5 , wherein the public key and the private key of the management server of the shared security application form an asymmetric key pair, and wherein an encryption or decryption operation based on the asymmetric key pair comprises one of the following operations: Rivest-Shamir-Adleman (RSA), Elgamal, knapsack, Rabin, Diffie-Hellman (D-H), and elliptic-curve cryptography (ECC).

8. The method according to claim 1 , wherein the application is executed in a rich execution environment or a trusted execution environment of the terminal device.

9. A computer system, comprising:
a processer;
a storage device coupled to the processor and storing instructions, which when executed by the processor cause the processor to perform a method, the method comprising:
receiving, by an application executing on a terminal device, an application key comprising at least a service key from a management server of the application;
forwarding the application key to a management server of a shared security application residing in a secure element in the terminal device, thereby facilitating the management server of the shared security application to deliver the application key to the shared security application; and
invoking, by the application, the application key stored in the shared security application to perform services associated with the application, wherein the application key is isolated from other application keys associated with other applications stored in the shared security application.

10. The computer system according to claim 9 , wherein the application key further comprises a communication security protection key, and wherein the method further comprises:
encrypting, by the application, service data associated with the services using the communication security protection key; and
sending the encrypted service data to the shared security application.

11. The computer system according to claim 10 , wherein the method further comprises:
decrypting, by the shared security application, the encrypted service data;
processing, by the shared security application, the service data using the service key;
encrypting, by the shared security application, the processed service data using the communication security protection key; and
returning, by the shared security application, the encrypted processed service data to the application.

12. The computer system according to claim 9 , wherein receiving the application key from the management server of the application comprises receiving the application key that is encrypted by the management server of the application using a public key of the management server of the shared security application, and wherein the public key of the management server of the shared security application is distributed to the management server of the application by the management server of the shared security application.

13. The computer system according to claim 12 , wherein forwarding the application key comprises:
invoking, by the application, a corresponding interface provided by a shared security application proxy on the terminal device external of the secure element;
sending, by the application via the corresponding interface and the security application proxy, the encrypted application key to the management server of the shared security application;
performing, by the management server of the shared security application, decryption using a private key corresponding to the public key to obtain the application key; and
delivering, by the management server of the shared security application, the application key to the shared security application in the secure element.

14. The computer system according to claim 13 , wherein the shared security application proxy is executed in a rich execution environment or a trusted execution environment of the terminal device.

15. The computer system according to claim 13 , wherein the public key and the private key of the management server of the shared security application form an asymmetric key pair, and wherein an encryption or decryption operation based on the asymmetric key pair comprises one of the following operations: Rivest-Shamir-Adleman (RSA), Elgamal, knapsack, Rabin, Diffie-Hellman (D-H), and elliptic-curve cryptography (ECC).

16. The computer system according to claim 9 , wherein the application is executed in a rich execution environment or a trusted execution environment of the terminal device.

17. A non-transitory computer-readable storage mediu

Assignees

• Advanced New Technologies Co Ltd

Inventors

• Sun Xi
• Luo Hongwei

Classifications

• H04W12/0431

  Key distribution or pre-distribution; Key agreement · CPC title

• H04W12/04

  Key management, e.g. using generic bootstrapping architecture [GBA] · CPC title

• H04L9/083 Primary

  involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP] · CPC title

• H04L9/0825

  using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates · CPC title

• H04L9/0819 Primary

  Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) (network architectures or network communication protocols for key distribution in a packet data network H04L63/062) · CPC title