Method and mobile terminal of sharing security application in mobile terminal

Patent metadata

Field	Value
Publication number	US-11258610-B2
Application number	US-202117158702-A
Country	US
Kind code	B2
Filing date	Jan 26, 2021
Priority date	Oct 12, 2018
Publication date	Feb 22, 2022
Grant date	Feb 22, 2022

Abstract

One embodiment provides a system and method for sharing a security application. During operation, the security application receives a service key associated with a first application executed on a terminal device. The security application resides in a secure element within the terminal device. The security application receives service data associated with the first application; processes the service data based on the service key; and returns the processed service data to the first application, thereby facilitating the first application in performing service based on the processed service data.

First claim

What is claimed is:

1. A computer-executed method, comprising:
receiving, by a set of security applications, respective service keys associated with a plurality of applications executed on a terminal device, wherein the set of security applications resides in a secure element within the terminal device, and wherein the service keys of the plurality of applications are securely isolated in the security application;
receiving, by the set of security applications, service data associated with the plurality of applications;
processing, by a first security application of the set of security applications, service data from a first portion of the plurality of applications, respectively, based on service keys corresponding to the first portion of the plurality of applications;
processing, by a second security application of the set of security applications, service data from a second portion of the plurality of applications, respectively, based on service keys corresponding to the second portion of the plurality of applications; and
returning, by the set of security applications, the processed service data to the plurality of applications, thereby facilitating the plurality of applications in performing service based on the processed service data.

2. The method according to claim 1 , further comprising:
receiving, by the set of security applications, a communication security protection key associated with a first application of the plurality of applications, wherein receiving the service data comprises receiving encrypted service data; and
performing decryption using the communication security protection key on the received encrypted service data to obtain the service data.

3. The method according to claim 2 , wherein the communication security protection key is generated by a management server of the set of security applications or a management server of the first application.

4. The method according to claim 2 , wherein the communication security protection key comprises one of:
a symmetric key; and
a private key of an asymmetric key pair, and wherein a public key of the asymmetric key pair is used by the first application to encrypt the service data.

5. The method according to claim 1 , wherein the service keys are generated by a management server of the set of security applications or a management server of the plurality of applications.

6. The method according to claim 1 , wherein a respective service key comprises one of:
a symmetric key; and
a private or public key of an asymmetric key pair.

7. The method according to claim 1 , wherein a respective application of the plurality of applications is executed in a trusted computing environment or a rich execution environment within the terminal device.

8. A computer system, comprising:
processing circuitry;
a storage device coupled to the processor and storing instructions, which when executed by the processor cause the processor to perform a method, the method comprising:
receiving, by a set of security applications, respective service keys associated with a plurality of applications executed on a terminal device, wherein the set of security applications resides in a secure element within the terminal device, and wherein the service keys of the plurality of applications are securely isolated in the security application;
receiving, by a first security application of the set of security applications, service data associated with the plurality of applications;
processing, by the set of security applications, service data from a first portion of the plurality of applications, respectively, based on service keys corresponding to the first portion of the plurality of applications;
processing, by a second security application of the set of security applications, service data from a second portion of the plurality of applications, respectively, based on service keys corresponding to the second portion of the plurality of applications; and
returning, by the set of security applications, the processed service data to the plurality of applications, thereby facilitating the plurality of applications in performing service based on the processed service data.

9. The computer system according to claim 8 , wherein the method further comprises:
receiving, by the set of security applications, a communication security protection key associated with a first application of the plurality of applications, wherein receiving the service data comprises receiving encrypted service data; and
performing decryption using the communication security protection key on the received encrypted service data to obtain the service data.

10. The computer system according to claim 9 , wherein the communication security protection key is generated by a management server of the set of security applications or a management server of the first application.

11. The computer system according to claim 9 , wherein the communication security protection key comprises one of:
a symmetric key; and
a private key of an asymmetric key pair, and wherein a public key of the asymmetric key pair is used by the first application to encrypt the service data.

12. The computer system according to claim 8 , wherein the service keys are generated by a management server of the set of security applications or a management server of the plurality of applications.

13. The computer system according to claim 8 , wherein a respective service key comprises one of:
a symmetric key; and
a private or public key of an asymmetric key pair.

14. The computer system according to claim 8 , wherein a respective application of the plurality of applications is executed in a trusted computing environment or a rich execution environment within the terminal device.

15. A non-transitory computer-readable storage medium storing instructions that when executed by a computer cause the computer to perform a method, the method comprising:
receiving, by a set of security applications, respective service keys associated with a plurality of applications executed on a terminal device, wherein the set of security applications resides in a secure element within the terminal device, and wherein the service keys of the plurality of applications are securely isolated in the security application;
receiving, by the set of security applications, service data associated with the plurality of applications;
processing, by a first security application of the set of security applications, service data from a first portion of the plurality of applications, respectively, based on service keys corresponding to the first portion of the plurality of applications;
processing, by a second security application of the set of security applications, service data from a second portion of the plurality of applications, respectively, based on service keys corresponding to the second portion of the plurality of applications; and
returning, by the set of security applications, the processed service data to the plurality of applications, thereby facilitating the plurality of applications in performing service based on the processed service data.

16. The non-transitory computer-readable storage medium to claim 15 , wherein the method further comprises:
receiving, by the set of security applications, a communication security protection key associated with a first application of the plurality of applications, wherein receiving the service data comprises receiving encrypted service data; and
performing decryption using the communication security protection key on the received encrypted service data to obtain the service data.

Assignees

• Advanced New Technologies Co Ltd

Inventors

• Sun Xi
• Luo Hongwei

Classifications

• H04L9/3234 Primary

  involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token (network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853) · CPC title

• H04L9/0819 Primary

  Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) (network architectures or network communication protocols for key distribution in a packet data network H04L63/062) · CPC title

• H04L9/0825

  using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates · CPC title

• H04L9/0827

  involving distinctive intermediate devices or communication paths (network architectures or network communication protocols using different networks H04L63/18) · CPC title

• H04L9/0897

  involving additional devices, e.g. trusted platform module [TPM], smartcard or USB · CPC title