CN106919856A - Safety mobile terminal - Google Patents
Safety mobile terminal Download PDFInfo
- Publication number
- CN106919856A CN106919856A CN201510993743.8A CN201510993743A CN106919856A CN 106919856 A CN106919856 A CN 106919856A CN 201510993743 A CN201510993743 A CN 201510993743A CN 106919856 A CN106919856 A CN 106919856A
- Authority
- CN
- China
- Prior art keywords
- secure
- mobile terminal
- instruction
- operating system
- security
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
Classifications
-
- G—PHYSICS
- G06—COMPUTING OR CALCULATING; COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/70—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer
- G06F21/71—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure computing or processing of information
Landscapes
- Engineering & Computer Science (AREA)
- Physics & Mathematics (AREA)
- Computer Hardware Design (AREA)
- Theoretical Computer Science (AREA)
- Mathematical Physics (AREA)
- Computer Security & Cryptography (AREA)
- Software Systems (AREA)
- General Engineering & Computer Science (AREA)
- General Physics & Mathematics (AREA)
- Storage Device Security (AREA)
- Telephone Function (AREA)
Abstract
一种安全移动终端，包括：处理器、安全元件和系统总线，所述处理器和安全元件通过所述系统总线互相访问；其中，所述处理器运行安全指令；所述安全元件为存储元件且仅接受所述安全指令访问；所述安全元件适于存储供所述安全指令访问的安全数据；所述系统总线包括安全比特位，当所述处理器运行安全指令时，所述安全比特位被使能；所述安全移动终端为手机或平板电脑。本发明方案实现成本低，安全性高。
A secure mobile terminal, comprising: a processor, a secure element, and a system bus, the processor and the secure element access each other through the system bus; wherein, the processor runs a secure instruction; the secure element is a storage element and only accepts the security instruction access; the secure element is suitable for storing security data accessed by the security instruction; the system bus includes a security bit, and when the processor runs the security instruction, the security bit is Enable; the secure mobile terminal is a mobile phone or a tablet computer. The solution of the invention has low cost and high safety.
Description
Technical Field
The invention relates to a terminal design technology, in particular to a safe mobile terminal.
Background
Nowadays, mobile phones and tablet computers play an increasingly greater role in life of people, and with the wide popularization of mobile terminals such as mobile phones and tablet computers, the data security problem of the mobile terminals draws high attention from users and designers. Many applications (e.g., mobile payment) require that the mobile terminal have an absolutely secure application environment. Generally, an operating system in a mobile terminal is open, and it is difficult to avoid infection with malicious software such as viruses and trojans, and in this case, a Secure Element (SE) needs to be designed in the mobile terminal to improve the application security.
The secure element is intended to prevent malicious parsing and attacks on the mobile terminal from the outside to secure data. The secure element may be a logic circuit having an encryption/decryption function in a chip, may be a separate chip, or may be integrated inside the chip.
In order to solve the above technical problem of Secure application in the mobile terminal, a conventional solution is to add a Secure component chip (a separate chip with a Secure component) in the mobile terminal, where the chip may be integrated on a Printed Circuit Board (PCB) of a main Board of the mobile terminal in a soldered manner or inserted in the mobile terminal in a form of an SD Card (Secure Digital Memory Card). Such as: smart Card (Smart Card) and SIM (Subscriber Identity Module) cards, etc. known to the user include the secure element chip.
However, adding one such secure element chip to a mobile terminal inevitably increases the cost, especially in the case of today's mobile terminal with intense competition, which may add extra cost to the mobile terminal and bring disadvantages to the competition of the product in the market.
Therefore, the mobile terminal in the prior art adopts an external secure element chip, which makes the cost higher.
Disclosure of Invention
The mobile terminal solves the technical problem that the mobile terminal in the prior art adopts an external security element chip and has higher cost.
To solve the above technical problem, an embodiment of the present invention provides a secure mobile terminal, including: a processor, a secure element, and a system bus through which the processor and secure element access each other; wherein the processor executes a security instruction;
the secure element is a storage element and is only accessed by the secure instruction;
the secure element is adapted to store secure data for access by the secure instructions.
Optionally, the system bus comprises a security bit that is enabled when the processor executes a security instruction.
Optionally, a secure operating system and an operating system other than the secure operating system are run on the processor, and the secure instruction is run on the secure operating system.
Optionally, the processor directly executes the secure instruction.
Optionally, the secure element comprises: a programmable read only memory and a first random access memory; the security data includes: a root key and code and data required by the security instructions in operation; wherein the programmable read only memory is adapted to store a root key of the secure instruction; the first random access memory is adapted to store code and data required by the security instructions in operation.
Optionally, the programmable read only memory is a micro-fuse or a one-time programmable memory.
Optionally, a non-volatile memory is further connected to the system bus, and the non-volatile memory is adapted to store the application key generated by the root key.
Optionally, the non-volatile memory is further adapted to encrypt the application key in advance before storing the application key.
Optionally, the system bus is further connected with a read-only memory, a second random access memory and a hardware interface, which are interactively accessed with other operating systems except the secure operating system.
Optionally, other operating systems than the secure operating system have a first application program interface, and the secure instruction has a second application program interface;
accessing the safety instruction by other operating systems except the safety operating system through the second application program interface;
the secure instructions access other operating systems than the secure operating system through the first application program interface.
Optionally, the secure mobile terminal is a mobile phone or a tablet computer or a wearable device.
Compared with the prior art, the technical scheme of the embodiment of the invention has the following beneficial effects:
the embodiment of the invention provides a safe mobile terminal, which comprises: a processor, a secure element, and a system bus through which the processor and secure element access each other; wherein the processor executes a security instruction; the secure element is a storage element and is only accessed by the secure instruction; the secure element is adapted to store secure data for access by the secure instructions. In the embodiment of the invention, the processor can simultaneously run a common instruction and a safety instruction of a common operating system, and the safety element only accepts the access of the safety instruction and cannot access the safety element, so the safety element is suitable for storing data generated by an application which is sensitive to safety when the safety mobile terminal runs; compared with the existing secure mobile terminal which generally integrates the secure element as an independent chip inside the mobile terminal, the secure element and the processor of the embodiment of the invention are integrated in the same chip, and the interactive access with the processor is completed in the same chip, so that the cost of the secure mobile terminal is effectively reduced from the viewpoint of the number of chips.
Further, the secure element in the embodiment of the present invention includes: a programmable read only memory and a first random access memory; the security data includes: a root key and code and data required by the security instructions in operation; wherein the programmable read only memory is adapted to store a root key of the secure instruction; the first random access memory is suitable for storing codes and data required by the safety instructions in operation; the root key will generate a corresponding application key; the system bus is also connected with a nonvolatile memory, and the embodiment of the invention encrypts the application key in advance and stores the encrypted application key in the nonvolatile memory. Because the cost of the programmable read-only memory for storing the secure information (i.e., the secret key) in the secure element is high, the embodiment of the present invention encrypts the application secret key and stores the encrypted application secret key in the nonvolatile memory with low cost, thereby further reducing the cost of the secure mobile terminal on the basis of ensuring high security.
Drawings
FIG. 1 is a schematic block diagram of a secure mobile terminal embodiment of the present invention;
fig. 2 is another schematic block diagram of the secure mobile terminal according to the embodiment of the present invention.
Detailed Description
As described in the background section, the secure mobile terminal of the prior art generally has a secure element for storing secure information as a separate chip disposed inside the mobile terminal, which is very secure, but causes additional cost to the mobile terminal.
On this basis, an embodiment of the present invention provides a secure mobile terminal, including: the processor executes a security instruction, the secure element is a storage element and only receives the access of the security instruction, the secure element is suitable for storing security data for the access of the security instruction, the processor simultaneously executes a common instruction of a common operating system and the security instruction on the processor, the secure element is suitable for storing data generated by a security-sensitive application when the secure mobile terminal operates because the secure element only receives the access of the security instruction, and compared with the existing secure mobile terminal which generally integrates the secure element as a separate chip inside the mobile terminal, the secure element of the embodiment of the invention is arranged in the same chip as the processor, the number of chips in the mobile terminal is reduced, and the cost of the safe mobile terminal can be effectively reduced on the basis of ensuring higher safety.
In order to make the aforementioned objects, features and advantages of the present invention comprehensible, embodiments accompanied with figures are described in detail below.
Fig. 1 is a schematic block diagram of a secure mobile terminal according to an embodiment of the present invention, and fig. 2 is another schematic block diagram of a secure mobile terminal according to an embodiment of the present invention.
As shown in fig. 1 and fig. 2, a secure mobile terminal 100 according to an embodiment of the present invention includes: a processor 10, a secure element 20 and a system bus 30, said processor 10 and secure element 20 accessing each other through said system bus 30; wherein the processor 10 runs a secure instruction 101; the secure element 20 is a storage element and is accessed only by the secure finger 101; the secure element 20 is adapted to store secure data for access by the secure instructions 101.
In an embodiment of the present invention, the system bus 30 may include a safety bit that is enabled when the processor 10 executes the safety instruction 101. Taking a conventional 64-bit system bus as an example, the system bus 30 with the security bit may be 65 bits, and a 65 th bit additionally provided in the system bus 30 may be the security bit.
In the embodiment of the present invention, a secure operating system (not shown in the figure) and other operating systems other than the secure operating system may be run on the processor 10, in fig. 1, the other operating systems other than the secure operating system are a normal operating system 102, the normal operating system 102 may be an android operating system, and the normal operating system 102 runs on a normal instruction.
The embodiment of the present invention may adopt a Trustzone mechanism, or may adopt other processor mechanisms, as long as two different operation instructions, such as the normal instruction and the secure instruction 101 in the embodiment, can be simultaneously executed on the processor 10, and the secure instruction 101 can access the secure element 20 by enabling the secure bit.
It should be noted that in an implementation, the secure instruction 101 may run on the secure operating system, or may be simplified to run directly on the processor 10 without depending on the operating system.
The processor 10 may run secure code, which is compiled and converted into the secure instructions 101.
In the embodiment of the present invention, through the access of the secure instruction 101 to the secure element 20, operations sensitive to security can be performed on the secure mobile terminal 100, such as: generation or storage of system keys, encryption and decryption of encryption algorithms, signature verification of data, and the like. If these security-sensitive operations are directly executed on the ordinary operating system 102, the security is vulnerable to the virus or trojan infected by the ordinary operating system 102.
In an embodiment of the present invention, the secure element 20 may include: a Programmable read-only Memory (PROM) 201 and a first Random Access Memory (RAM) 202. The secure data for the secure instruction 101 to access in the embodiment of the present invention may include: a root key 104 and code and data 105 required by the secure instructions 101 to operate; wherein, the programmable read only memory 201 is suitable for storing the root key 104 of the secure instruction 101, and in practical application, the application key 103 required by various applications can be generated by the root key 104; the first random access memory 202 is adapted to store code and data 105 required by the secure instruction 101 during operation, so that the code and data cannot be accessed by a common operating system (e.g., android operating system) 102 to ensure the security of the code and data.
In a specific implementation, the programmable read-only memory 201 may be a micro fuse (eFuse) or a One Time Programmable (OTP) memory, or may be another programmable memory device that is not lost when power is turned off.
In the embodiment of the present invention, a Nonvolatile Memory (NVM) 40 may be further connected to the system bus 30, and the NVM 40 is adapted to store the application key 103 generated by the root key 104. The nonvolatile memory 40 may be Flash, or may also be an appropriate nonvolatile storage medium such as an EMMC (Embedded multimedia Card) or a micro hard disk, and the nonvolatile memory 40 has a nonvolatile characteristic and can still store information after the chip is powered off.
In the embodiment of the present invention, in order to ensure the security of data, the nonvolatile memory 40 needs to encrypt the application key 103 in advance before storing the application key 103.
The nonvolatile memory 40 may store, in addition to the application key 103 and the like, a general instruction of the general operating system 102 and related data generated at runtime.
Since the cost of the programmable read only memory 201 for storing the secure information (i.e. the key) in the secure element 20 is high, the embodiment of the present invention encrypts the application key 103 and stores the encrypted application key in the nonvolatile memory 40 with low cost, so that the capacity requirement on the programmable read only memory 201 is greatly reduced, and the cost of the secure mobile terminal 100 is further reduced on the basis of ensuring high security.
In the embodiment of the present invention, the system Bus 30 is further connected to a Read-Only Memory (ROM) 50 interactively accessing the common operating system 102, a second random access Memory 60, and a hardware interface 70 such as a Universal Serial Bus (USB), wherein the second random access Memory 60 is adapted to store codes and data generated by the common operating system 102 during operation, and the Read-Only Memory 50 may store boot codes of the common operating system 102, and the like. Since the roles of the ordinary operating system 102, the rom 50, the second ram 60 and the hardware interface 70 in the secure mobile terminal 100 are well known to those skilled in the art, further description is omitted here.
In the embodiment of the present invention, corresponding application program interfaces are respectively set in the normal operating system 102 and the secure instruction 101, so as to be suitable for two different operation instructions to interact. Specifically, the common operating system 102 may have a first Application Programming Interface (API) 1021, and the secure instruction 101 may have a second Application Programming Interface (API) 1011. The general operating system 102 may access the secure instruction 101 through the second application program interface 1011, and the secure instruction 101 may access the general operating system 102 through the first application program interface 1021. The first application program interface 1021 and the second application program interface 1011 may be respectively used for interaction between an application program (APP) under a general operating system 102 and the secure instruction 101, and for performing read-write operations on the application key 103 stored in the non-volatile memory 40.
With continued reference to fig. 1, the operation mechanism of the secure mobile terminal 100 according to the embodiment of the present invention is as follows: an application program in the ordinary operating system 102 initiates an application requirement, such as a payment operation, this application requires a corresponding application key 103, the ordinary operating system 102 sends a command to the secure instruction 101 through the first application program interface 1021 to access the secure instruction 101, where the secure instruction 101 is to process to obtain the application key 103, and the application key 103 may be generated by a root key 104 stored in the programmable read only memory 201, or may be stored in the external nonvolatile memory 40. If the application key 103 is stored in the non-volatile memory 40, the security instruction 101 accesses the general operating system 102 through the second application program interface 1011, sends an instruction to make the general operating system 102 read the required application key 103 from the non-volatile memory 40, the general operating system 102 sends the application key 103 to the security instruction 101 through the first application program interface 1021, the security instruction 101 decrypts the read application key 103, the security instruction 101 and the secure element 20 complete the payment operation, and operation result data related to the payment operation is sent to an application program initiating an application requirement in the general operating system 102 through the second application program interface 1011. In addition, in the secure mobile terminal 100 according to the embodiment of the present invention, the generation, the use, and the destruction of the related key are all performed by the secure instruction 101 and the secure element 20.
In the embodiment of the present invention, the secure mobile terminal 100 may be a mobile phone, a tablet computer, a wearable device, or other suitable mobile terminal devices.
Although the present invention is disclosed above, the present invention is not limited thereto. Various changes and modifications may be effected therein by one skilled in the art without departing from the spirit and scope of the invention as defined in the appended claims.
Claims (11)
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201510993743.8A CN106919856B (en) | 2015-12-25 | 2015-12-25 | Secure Mobile Terminal |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201510993743.8A CN106919856B (en) | 2015-12-25 | 2015-12-25 | Secure Mobile Terminal |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN106919856A true CN106919856A (en) | 2017-07-04 |
| CN106919856B CN106919856B (en) | 2020-01-07 |
Family
ID=59454656
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201510993743.8A Active CN106919856B (en) | 2015-12-25 | 2015-12-25 | Secure Mobile Terminal |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN106919856B (en) |
Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| JP2008085468A (en) * | 2006-09-26 | 2008-04-10 | Fujitsu Ltd | Secure element having key management function and information processing apparatus |
| CN104143065A (en) * | 2014-08-28 | 2014-11-12 | 北京握奇智能科技有限公司 | Safety intelligent terminal equipment and information processing method |
| CN104484593A (en) * | 2014-10-31 | 2015-04-01 | 小米科技有限责任公司 | Terminal verification method and terminal verification device |
| CN104778794A (en) * | 2015-04-24 | 2015-07-15 | 华为技术有限公司 | Mobile payment device and method |
-
2015
- 2015-12-25 CN CN201510993743.8A patent/CN106919856B/en active Active
Patent Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| JP2008085468A (en) * | 2006-09-26 | 2008-04-10 | Fujitsu Ltd | Secure element having key management function and information processing apparatus |
| CN104143065A (en) * | 2014-08-28 | 2014-11-12 | 北京握奇智能科技有限公司 | Safety intelligent terminal equipment and information processing method |
| CN104484593A (en) * | 2014-10-31 | 2015-04-01 | 小米科技有限责任公司 | Terminal verification method and terminal verification device |
| CN104778794A (en) * | 2015-04-24 | 2015-07-15 | 华为技术有限公司 | Mobile payment device and method |
Also Published As
| Publication number | Publication date |
|---|---|
| CN106919856B (en) | 2020-01-07 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| JP6985011B2 (en) | Equipment and methods for ensuring access protection schemes | |
| US8122172B2 (en) | Portable information security device | |
| CN106687985B (en) | Method for the safe input mechanism based on privileged mode | |
| EP1573466B1 (en) | Enhancing data integrity and security in a processor-based system | |
| KR102208072B1 (en) | Data processing system | |
| US20120047503A1 (en) | Method for virtualizing a personal working environment and device for the same | |
| JP6695885B2 (en) | Hack resistant computer design | |
| CN101794362A (en) | Trusted computation trust root device for computer and computer | |
| JP2022527903A (en) | Secure communication when accessing the network | |
| CN107924439B (en) | Apparatus, method, and computer program product for coordinating device boot security | |
| CN103023647B (en) | A kind of method strengthening secondary radar FPGA fail safe | |
| US10747884B2 (en) | Techniques for coordinating device boot security | |
| US10860707B2 (en) | Systems and methods for obfuscation of password key and dynamic key pool management | |
| KR101255204B1 (en) | Storage reader apparatus having security features and the method thereof | |
| EP3044721B1 (en) | Automatic pairing of io devices with hardware secure elements | |
| CN106919856B (en) | Secure Mobile Terminal | |
| KR20210069481A (en) | Storage device inlcuding memroy controller and non volatile memory system including and operating method thereof | |
| JP2006268861A (en) | Method and control device for controlling access of computer to user data | |
| US9158943B2 (en) | Encryption and decryption device for portable storage device and encryption and decryption method thereof | |
| US20090235365A1 (en) | Data access system | |
| EP3274895B1 (en) | System management mode trust establishment for os level drivers | |
| US20250384151A1 (en) | Method to prevent data theft from a storage device | |
| CN106845296A (en) | A kind of method for protecting password, system and a kind of mainboard, connector | |
| CN205354035U (en) | Data protection card | |
| CN113496036A (en) | Security component and preloading method |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |