Verification-based service authorization

Patent metadata

Field	Value
Publication number	US-11316702-B2
Application number	US-202117145889-A
Country	US
Kind code	B2
Filing date	Jan 11, 2021
Priority date	Nov 16, 2017
Publication date	Apr 26, 2022
Grant date	Apr 26, 2022

Abstract

The present specification discloses a service authorization method, apparatus and device. In one aspect, the method includes: obtaining, by a first execution unit that runs in a first security environment, information to be verified; generating, by the first execution unit that runs in the first security environment, a verification result of the information to be verified; signing, by the first execution unit that runs in the first security environment, the verification result using a signature verification private key to provide signature information; obtaining, by a second execution unit that runs in a second security environment, the signature information from the first execution unit; verifying, by the second execution unit that runs in the second security environment, the signature information using a signature verification public key corresponding to the signature verification private key; and in response to verifying the signature information, performing service authorization based on the verification result.

First claim

What is claimed is:

1. A computed-implemented method, comprising:
generating a dynamic parameter;
setting a validity time for the dynamic parameter;
providing, from a second execution unit running in a second security environment, through a service application, and to a first execution unit, the dynamic parameter, wherein the first execution unit runs in a first security environment that is different from the second security environment, and wherein the first execution unit is restricted from accessing the second execution unit;
receiving, from the service application, signature information at the second execution unit, wherein the signature information is generated based on (i) a verification result, (ii) the dynamic parameter, and (iii) a signature verification private key;
verifying, by the second execution unit, the signature information using a signature verification public key corresponding to the signature verification private key;
verifying, by the second execution unit, the dynamic parameter by comparing the dynamic parameter to a pre-stored copy of the dynamic parameter, wherein verifying the dynamic parameter comprises
determining that the dynamic parameter is valid when the signature information is sent to the second execution unit within the validity time; and
in response to verifying the signature information and the dynamic parameter, performing service authorization based on the verification result to authorize a service executed by the service application.

2. The computed-implemented method of claim 1 , further comprising:
obtaining, by the first execution unit and through the service application running in the first security environment, verification information; and
generating, by the first execution unit, the verification result based on the verification information.

3. The computed-implemented method of claim 2 , wherein the verification information comprises biometric feature.

4. The computed-implemented method of claim 1 , wherein the signature information is generated by the first execution unit based on signing, using the signature verification private key, the verification result and the dynamic parameter.

5. The computed-implemented method of claim 1 , wherein the second security environment comprises an execution environment provided by a secure element (SE), and the first security environment comprises a trusted execution environment (TEE).

6. The computed-implemented method of claim 1 , wherein the dynamic parameter comprises at least one of a random number or time information.

7. The computed-implemented method of claim 1 , wherein generating the signature information by the first execution unit comprises:
obtaining, by the first execution unit, the signature verification private key from a management server corresponding to the first execution unit.

8. A computer-implemented system, comprising:
one or more computers; and
one or more computer memory devices interoperably coupled with the one or more computers and having tangible, non-transitory, machine-readable media storing one or more instructions that, when executed by the one or more computers, cause the one or more computers to perform operations comprising:
generating a dynamic parameter;
setting a validity time for the dynamic parameter;
providing, from a second execution unit running in a second security environment, through a service application, and to a first execution unit, the dynamic parameter, wherein the first execution unit runs in a first security environment that is different from the second security environment, and wherein the first execution unit is restricted from accessing the second execution unit;
receiving, from the service application, signature information at the second execution unit, wherein the signature information is generated based on (i) a verification result, (ii) the dynamic parameter, and (iii) a signature verification private key;
verifying, by the second execution unit, the signature information using a signature verification public key corresponding to the signature verification private key;
verifying, by the second execution unit, the dynamic parameter by comparing the dynamic parameter to a pre-stored copy of the dynamic parameter, wherein verifying the dynamic parameter comprises
determining that the dynamic parameter is valid when the signature information is sent to the second execution unit within the validity time; and
in response to verifying the signature information and the dynamic parameter, performing service authorization based on the verification result to authorize a service executed by the service application.

9. The computer-implemented system of claim 8 , wherein the operations further comprise:
obtaining, by the first execution unit and through the service application running in the first security environment, verification information; and
generating, by the first execution unit, the verification result based on the verification information.

10. The computer-implemented system of claim 9 , wherein the verification information comprises biometric feature.

11. The computer-implemented system of claim 8 , wherein the signature information is generated by the first execution unit based on signing, using the signature verification private key, the verification result and the dynamic parameter.

12. The computer-implemented system of claim 8 , wherein the second security environment comprises an execution environment provided by a secure element (SE), and the first security environment comprises a trusted execution environment (TEE).

13. The computer-implemented system of claim 8 , wherein the dynamic parameter comprises at least one of a random number or time information.

14. The computer-implemented system of claim 8 , wherein generating the signature information by the first execution unit comprises:
obtaining, by the first execution unit, the signature verification private key from a management server corresponding to the first execution unit.

15. A non-transitory, computer-readable medium storing one or more instructions that, when executed by a computer system, cause the computer system to perform operations comprising:
generating a dynamic parameter;
setting a validity time for the dynamic parameter;
providing, from a second execution unit running in a second security environment, through a service application, and to a first execution unit, the dynamic parameter, wherein the first execution unit runs in a first security environment that is different from the second security environment, and wherein the first execution unit is restricted from accessing the second execution unit;
receiving, from the service application, signature information at the second execution unit, wherein the signature information is generated based on (i) a verification result, (ii) the dynamic parameter, and (iii) a signature verification private key;
verifying, by the second execution unit, the signature information using a signature verification public key corresponding to the signature verification private key;
verifying, by the second execution unit, the dynamic parameter by comparing the dynamic parameter to a pre-stored copy of the dynamic parameter, wherein verifying the dynamic parameter comprises
determining that the dynamic parameter is valid when the signature information is sent to the second execution unit within the validity time; and
in response to verifying the signature information and the dynamic parameter, performing service authorization based on the verification result to authorize a service executed by the service application.

Assignees

• Advanced New Technologies Co Ltd

Inventors

• Sun Xi
• Luo Hongwei

Classifications

• G06F21/53 Primary

  by executing in a restricted environment, e.g. sandbox or secure virtual machine · CPC title

• H04L9/3247

  involving digital signatures · CPC title

• H04L63/12

  Applying verification of the received information (cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32) · CPC title

• H04L9/0825

  using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates · CPC title

• H04L63/0892

  by using authentication-authorization-accounting [AAA] servers or protocols · CPC title