CN118921661A - High-security Bluetooth digital key storage management method based on mobile terminal TEE - Google Patents

Abstract

The invention discloses a mobile terminal TEE-based high-security Bluetooth digital key storage management method, and relates to the technical field of Bluetooth digital key security. The invention comprises the following steps: the Secure enclaspe is utilized on the iOS platform, the trust zone technology is utilized on the Android platform, and the asymmetric encryption, the Secure storage and the strict access control are combined, so that a high-security digital key management system and high-security key generation, storage and management are realized. The invention obviously improves the safety of the Bluetooth digital key through hardware-level safety isolation, a double encryption mechanism and strict access control, and simultaneously maintains good user experience and system performance. The method is not only suitable for the management of the Bluetooth digital key, but also can be expanded to other fields needing high security, such as financial transaction, identity authentication and the like, and effectively prevents unauthorized access and data leakage.

Description

High-security Bluetooth digital key storage management method based on mobile TEE

Technical Field

The present invention belongs to the field of digital key security technology, and in particular to a high-security Bluetooth digital key storage management method based on mobile terminal TEE.

Background Art

With the popularity of the Internet of Things and smart devices, Bluetooth digital keys are increasingly used in mobile applications. However, traditional data storage methods have many security risks:

A: Ordinary mobile applications usually store sensitive data directly in the local storage of the device, which is vulnerable to security threats such as device loss and malware attacks;

B: Although some applications use simple encryption methods, the keys are often stored together with the encrypted data, which still poses a risk of being stolen.

C: Traditional storage methods are difficult to resist advanced reverse engineering and memory attacks, which puts sensitive data at risk of illegal access;

D: Lack of hardware-level security protection, and software-level security measures can be easily bypassed or cracked.

For example, Chinese patent CN112396735A provides a method and device for secure authentication of digital keys for connected cars, including two forms of remote unlocking and close unlocking. Based on PKI technology, during the verification process between the two parties, a signature algorithm is used to extract a summary of the digital key, and the summary and digital key are encrypted and decrypted using the key pairs of both parties, and the correspondence between the summary obtained through authentication and decryption and the digital key is compared with whether the decrypted digital key is consistent with the digital key recorded in the database of the party, so as to achieve the purpose of identity security authentication. Double mandatory authentication of digital keys can effectively prevent replay attacks, man-in-the-middle attacks or password attacks. Even if the digital key is known to a third party, it is necessary to detect illegal objects based on the correspondence between the summary and the digital key, which greatly improves the security of authentication.

For example, Chinese patent CN115967920A discloses a method, system, device and medium for secure management of automobile Bluetooth keys, the method comprising: generating a Bluetooth key activation request in response to a request operation of a user terminal and outputting it to the cloud; obtaining a digital key of the corresponding vehicle in the cloud according to the Bluetooth key activation request, wherein the digital key is generated by the cloud according to a pre-stored vehicle master key, and the vehicle master key is associated with vehicle information; generating a session key according to the digital key to conduct an encrypted session with the vehicle.

Therefore, there is an urgent need for a safer and more reliable method for storing and managing Bluetooth digital keys.

Summary of the invention

The purpose of the present invention is to provide a method for secure storage and management of Bluetooth digital keys based on mobile TEE technology. On the iOS platform, a key pair is generated and stored through Secure Enclave, and encrypted data is stored using Keychain. On the Android platform, a key pair is generated and stored through Android Keystore, and encrypted data is stored using secure storage, so as to solve the security risks existing in the prior art.

In order to solve the above technical problems, the present invention is achieved through the following technical solutions:

The present invention is a high-security Bluetooth digital key storage management method based on mobile terminal TEE, comprising the following steps:

Step S01: Using the hardware security module of the mobile device as a trusted execution environment TEE; using asymmetric encryption technology to generate a key pair in the trusted execution environment TEE;

Step S02: Encrypting Bluetooth digital key data using a public key;

Step S03: storing the encrypted data in a secure storage area of the mobile device;

Step S04: when data needs to be used, the encrypted data is read from the secure storage area;

Step S05: Decrypt the encrypted data using the private key in the trusted execution environment TEE.

Furthermore, the hardware security module is a Secure Enclave on the iOS platform and a KeyStore based on TrustZone on the Android platform.

Furthermore, in step S01, the key pair generated by using asymmetric encryption technology is an RSA key pair with a key length of 2048 bits; before encrypting the Bluetooth digital key data, the Bluetooth digital key data is OAEP-filled; and the SHA256 algorithm is used as the hash function for OAEP filling.

Furthermore, the method further comprises the following steps:

Step B01: Deploy a secure random number generator in the trusted execution environment TEE;

Step B02: Generate a unique identifier for each Bluetooth digital key using a secure random number generator;

Step B03: storing the unique identifier together with the encrypted Bluetooth digital key data;

Step B04: When retrieving and using the Bluetooth digital key, first verify the validity of the unique identifier. If the unique identifier is invalid, access to the corresponding Bluetooth digital key data is denied.

Furthermore, the secure storage area is Keychain on the iOS platform and is EncryptedSharedPreferences on the Android platform; on the iOS platform, when the encrypted data is stored in the Keychain, the kSecAttrAccessible attribute is set to kSecAttrAccessibleWhenUnlockedThisDeviceOnly.

Furthermore, the method further comprises the following steps:

Step G01: triggering key rotation periodically or based on set conditions;

Step G02: Generate a new key pair inside the trusted execution environment TEE;

Step G03: re-encrypt the Bluetooth digital key data using the new public key;

Step G04: Safely destroy the old private key.

Furthermore, the method further comprises the following steps:

Step F01: deploy an access control module outside the trusted execution environment TEE to manage access rights to the encrypted Bluetooth digital key data;

Step F02: The access control module determines whether to allow the application to request data decryption according to a predefined policy.

Furthermore, in step S03:

When the encrypted data is stored, metadata associated with the encrypted data is also stored;

Metadata includes information such as the creation time, last access time, and access count of the data;

Implement data lifecycle management based on metadata, including automatic deletion of expired data.

Furthermore, the method further comprises the following steps:

All key operations are recorded through the security log system, including key generation, data encryption and decryption, access control decisions, etc.

The security logs recorded by the security log system are stored in the storage area protected by the trusted execution environment TEE to prevent tampering or deletion.

Furthermore, the following steps are also included: through a secure backup and recovery mechanism, the user is allowed to securely migrate the encrypted Bluetooth digital key data when changing the mobile device; during the backup process, an additional encryption layer is used to protect the data, and the user is required to provide additional authentication information.

The definitions of the terms involved in the present invention are as follows:

Trusted Execution Environment (TEE): A secure area that runs independently within the device's main processor, providing greater security for processing sensitive data and executing critical code. TEE prevents unauthorized access and modification.

Secure Enclave: A hardware security module introduced by Apple on iOS devices to protect highly sensitive user data and encryption keys.

Keychain: A secure storage service provided by iOS and macOS for storing passwords, keys, and other sensitive data.

Android Keystore: A system-level service on the Android platform that is used to generate and store cryptographic keys, ensuring that the keys are secure and non-exportable.

TrustZone: A TEE technology developed by ARM that separates the standard operating system (non-secure world) and the secure operating system (secure world) to ensure the security of sensitive data and operations.

Public key: A public key in asymmetric encryption that is used to encrypt data and can be obtained by anyone.

Private key: A secret key in asymmetric encryption, used to decrypt data. Only the party holding the private key can decrypt the corresponding encrypted data.

Bluetooth Digital Key: A digital key generated and managed using Bluetooth technology to enable secure communication and authentication between devices.

The present invention has the following beneficial effects:

The present invention realizes a highly secure digital key management system by utilizing the hardware security features of iOS and Android platforms, combining asymmetric encryption, secure storage and strict access control; significantly improving the security of sensitive data in mobile applications while maintaining a good user experience and system performance. This method is not only applicable to the management of Bluetooth digital keys, but can also be extended to other mobile application scenarios that require high security, such as financial transactions, identity authentication and other fields.

Of course, any product implementing the present invention does not necessarily need to achieve all of the advantages described above at the same time.

BRIEF DESCRIPTION OF THE DRAWINGS

In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for describing the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative work.

FIG1 is the left half of a flow chart of a high-security Bluetooth digital key storage management method based on a mobile terminal TEE according to the present invention;

FIG. 2 is the right half of the flow chart of the high-security Bluetooth digital key storage management method based on mobile terminal TEE of the present invention.

DETAILED DESCRIPTION

In the following description, specific details such as specific system structures, technologies, etc. are provided for the purpose of illustration rather than limitation, so as to provide a thorough understanding of the embodiments of the present application. However, it should be clear to those skilled in the art that the present application may also be implemented in other embodiments without these specific details. In other cases, detailed descriptions of well-known systems, devices, circuits, and methods are omitted to prevent unnecessary details from obstructing the description of the present application.

It should be understood that when used in the present specification and the appended claims, the term "comprising" indicates the presence of described features, wholes, steps, operations, elements and/or components, but does not exclude the presence or addition of one or more other features, wholes, steps, operations, elements, components and/or combinations thereof.

It should also be understood that the term “and/or” used in the specification and appended claims refers to any and all possible combinations of one or more of the associated listed items, and includes these combinations.

As used in the specification and appended claims of this application, the term "if" can be interpreted as "when" or "uponce" or "in response to determining" or "in response to detecting", depending on the context. Similarly, the phrase "if it is determined" or "if [described condition or event] is detected" can be interpreted as meaning "uponce it is determined" or "in response to determining" or "uponce [described condition or event] is detected" or "in response to detecting [described condition or event]", depending on the context.

In addition, in the description of the present application specification and the appended claims, the terms "first", "second", "third", etc. are only used to distinguish the descriptions and cannot be understood as indicating or implying relative importance.

References to "one embodiment" or "some embodiments" etc. described in the specification of this application mean that one or more embodiments of the present application include specific features, structures or characteristics described in conjunction with the embodiment. Therefore, the statements "in one embodiment", "in some embodiments", "in some other embodiments", "in some other embodiments", etc. that appear in different places in this specification do not necessarily refer to the same embodiment, but mean "one or more but not all embodiments", unless otherwise specifically emphasized in other ways. The terms "including", "comprising", "having" and their variations all mean "including but not limited to", unless otherwise specifically emphasized in other ways.

Embodiment 1:

Please refer to Figures 1-2. The present invention is a high-security Bluetooth digital key storage management method based on mobile TEE. The method uses Secure Enclave on the iOS platform and TrustZone technology on the Android platform to achieve high-security key generation, storage and management. The present invention significantly improves the security of Bluetooth digital keys through hardware-level security isolation, dual encryption mechanism, and strict access control, and effectively prevents unauthorized access and data leakage; the present invention includes the following steps:

Step S01: using the hardware security module of the mobile device as a trusted execution environment TEE; using asymmetric encryption technology to generate a key pair in the trusted execution environment TEE; by using the hardware security module of the mobile device (such as iOS's Secure Enclave and Android's TrustZone) as a trusted execution environment (TEE), the secure generation and storage of keys is achieved; as an embodiment provided by the present invention, preferably, the hardware security module is SecureEnclave on the iOS platform and is a KeyStore based on TrustZone on the Android platform;

Step S02: Use the public key to encrypt the Bluetooth digital key data; use asymmetric encryption technology to generate a key pair in TEE, and the private key never leaves TEE, ensuring the highest level of security;

Step S03: storing the encrypted data in a secure storage area of the mobile device, encrypting the Bluetooth digital key data using a public key, and storing the encrypted data in a secure storage area of the device (such as Keychain of iOS or EncryptedSharedPreferences of Android);

Step S04: When data needs to be used, the encrypted data is read from the secure storage area. All encryption and decryption operations are completed inside the TEE, and the encrypted data cannot be decrypted outside the TEE.

Step S05: Use the private key in the trusted execution environment TEE to decrypt the encrypted data to implement a double encryption mechanism. Even if the encrypted data is stolen, it cannot be decrypted without the private key inside the TEE.

The high-security Bluetooth digital key storage management method based on mobile TEE significantly improves the security of Bluetooth digital keys and effectively prevents unauthorized access and data leakage. By using hardware-level security isolation, the resistance to advanced attacks is enhanced. It simplifies the complexity of developers to achieve high-security storage and improves the security and reliability of applications. It is suitable for various mobile application scenarios that require high security, such as smart home, car sharing and other fields.

As an embodiment provided by the present invention, preferably, the secure storage area is Keychain on the iOS platform and is EncryptedSharedPreferences on the Android platform; on the iOS platform, when the encrypted data is stored in the Keychain, the kSecAttrAccessible attribute is set to kSecAttrAccessibleWhenUnlockedThisDeviceOnly.

A highly secure Bluetooth digital key storage management method based on mobile TEE, with original technology:

Providing a unified cross-platform security architecture: This invention proposes a unified TEE security architecture on iOS and Android platforms for the first time, achieving a highly consistent security storage and management method, greatly simplifying the development and maintenance of cross-platform applications;

Multi-layer security protection: By combining multiple security mechanisms such as hardware TEE, asymmetric encryption, secure storage and access control, a comprehensive security protection system is built, which significantly improves the ability to resist various attacks;

Dynamic key management: The introduction of a dynamic key generation and management mechanism based on TEE avoids the risk of static key storage and enhances the long-term security of the system.

Performance-optimized encryption scheme: RSA encryption with OAEP padding is used to optimize encryption performance while ensuring security, which is suitable for the resource limitations of mobile devices;

Flexible data isolation strategy: Through sophisticated access control strategies, application-level data isolation is achieved, effectively preventing cross-application data leakage.

Embodiment 2:

High-security Bluetooth digital key storage management method based on mobile TEE, implementation method on iOS platform:

Step 1: Generate a key pair

a. Create a dictionary of key generation parameters:

b. Use the SecKeyCreateRandomKey function to generate a key pair:

c. Get the public key from the private key:

guard let publicKey＝SecKeyCopyPublicKey(privateKey)else{

throw SomeError.failedToGetPublicKey

};

Step 2: Encrypt data using the public key

a. Prepare encryption parameters:

b. Perform encryption operations:

Step 3: Store the encrypted data in the Keychain

a. Prepare the Keychain query dictionary:

b. Add data to Keychain:

Step 4: Read encrypted data from the Keychain a. Prepare the Keychain query dictionary:

b. Retrieve data from Keychain:

Step 5: Decrypt data using private key a. Get private key reference:

b. Perform decryption operation:

Embodiment three:

A high-security Bluetooth digital key storage management method based on mobile TEE, implemented on the Android platform:

Step 1: Generate a key pair

a. Create KeyGenParameterSpec:

b. Initialize KeyPairGenerator and generate a key pair:

Step 2: Encrypt data using the public key

a. Get the public key:

KeyStore keyStore=KeyStore.getInstance("AndroidKeyStore");

keyStore.load(null);

PublicKey publicKey=keyStore.getCertificate("bluetooth_key_alias").getPublicKey();

b. Initialize Cipher and encrypt data:

Cipher cipher=Cipher.getInstance("RSA/ECB/OAEPWithSHA-256AndMGF1Padding");

cipher.init(Cipher.ENCRYPT_MODE,publicKey);

byte[]encryptedData=cipher.doFinal(dataToEncrypt);

Step 3: Store the encrypted data in a secure location

a. Use EncryptedSharedPreferences:

Step 4: Read encrypted data from a secure location a. Read data from EncryptedSharedPreferences:

Step 5: Decrypt the data using the private key

a. Get the private key:

KeyStore keyStore=KeyStore.getInstance("AndroidKeyStore");

keyStore.load(null);

PrivateKey privateKey=(PrivateKey)keyStore.getKey("bluetooth_key_alias",null);

b. Initialize Cipher and decrypt data:

Cipher cipher＝

Cipher.getInstance("RSA/ECB/OAEPWithSHA-256AndMGF1Padding");

cipher.init(Cipher.DECRYPT_MODE,privateKey);

byte[]decryptedData=cipher.doFinal(encryptedData).

Embodiment 4:

As an embodiment provided by the present invention, preferably, based on Embodiment 1, in step S01, asymmetric encryption technology is used to generate a key pair as an RSA key pair with a key length of 2048 bits; before encrypting the Bluetooth digital key data, OAEP padding is performed on the Bluetooth digital key data; and the SHA256 algorithm is used as the hash function for OAEP padding.

As an embodiment provided by the present invention, preferably, based on Embodiment 1, the following steps are further included:

Step B01: Deploy a secure random number generator in the trusted execution environment TEE;

Step B02: Generate a unique identifier for each Bluetooth digital key using a secure random number generator;

Step B03: storing the unique identifier together with the encrypted Bluetooth digital key data;

Step B04: When retrieving and using the Bluetooth digital key, first verify the validity of the unique identifier. If the unique identifier is invalid, access to the corresponding Bluetooth digital key data is denied.

As an embodiment provided by the present invention, preferably, based on Embodiment 1, the following steps are further included:

Step G01: triggering key rotation periodically or based on set conditions;

Step G02: Generate a new key pair inside the trusted execution environment TEE;

Step G03: re-encrypt the Bluetooth digital key data using the new public key;

Step G04: Safely destroy the old private key.

As an embodiment provided by the present invention, preferably, based on Embodiment 1, the following steps are further included:

Step F01: deploy an access control module outside the trusted execution environment TEE to manage access rights to the encrypted Bluetooth digital key data;

Step F02: The access control module determines whether to allow the application to request data decryption according to a predefined policy.

As an embodiment provided by the present invention, preferably, based on Embodiment 1, in step S03:

When the encrypted data is stored, metadata associated with the encrypted data is also stored;

Metadata includes information such as the creation time, last access time, and access count of the data;

Implement data lifecycle management based on metadata, including automatic deletion of expired data.

As an embodiment provided by the present invention, preferably, based on Embodiment 1, the following steps are further included:

All key operations are recorded through the security log system, including key generation, data encryption and decryption, access control decisions, etc.

The security logs recorded by the security log system are stored in the storage area protected by the trusted execution environment TEE to prevent tampering or deletion.

As an embodiment provided by the present invention, preferably, based on Embodiment 1, the following steps are also included: through a secure backup and recovery mechanism, the user is allowed to securely migrate the encrypted Bluetooth digital key data when changing the mobile device; during the backup process, an additional encryption layer is used to protect the data, and the user is required to provide additional authentication information.

Embodiment five:

As an embodiment provided by the present invention, preferably, based on Embodiment 1, the following steps are further included:

Implement a key management module outside the TEE to coordinate the generation, use, and rotation of keys;

The key management module communicates with TEE through a secure channel but does not directly access the private key inside TEE.

Embodiment six:

Also included is a mobile device based on the first embodiment, including:

a) Processor;

b) memory;

c) Communication interface;

d) Trusted Execution Environment TEE;

The memory stores a computer program, and when the computer program is executed by the processor, the method described is implemented.

Also included is a computer-readable storage medium storing a computer program, which implements the methods described in embodiments 1 to 5 when executed by a processor.

The implementation of the present invention provides developers with a powerful and flexible security framework, greatly simplifying the complexity of implementing high-security applications. With the further popularization of the Internet of Things and smart devices, the present invention will play an important role in protecting user privacy and data security.

The present invention significantly improves the security of sensitive data in mobile applications while maintaining a good user experience and system performance. The method is not only applicable to the management of Bluetooth digital keys, but can also be extended to other mobile application scenarios that require high security, such as financial transactions, identity authentication and other fields.

The high-security Bluetooth digital key storage management method based on mobile TEE realizes a highly secure digital key management system by utilizing the hardware security features of iOS and Android platforms, combining asymmetric encryption, secure storage and strict access control; it significantly improves the security of sensitive data in mobile applications while maintaining a good user experience and system performance. This method is not only applicable to the management of Bluetooth digital keys, but can also be extended to other mobile application scenarios that require high security, such as financial transactions, identity authentication and other fields:

In the description of this specification, the description with reference to the terms "one embodiment", "example", "specific example", etc. means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representation of the above terms does not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described can be combined in any one or more embodiments or examples in a suitable manner.

The preferred embodiments of the present invention disclosed above are only used to help illustrate the present invention. The preferred embodiments do not describe all the details in detail, nor do they limit the invention to the specific implementation methods described. Obviously, many modifications and changes can be made according to the content of this specification. This specification selects and specifically describes these embodiments in order to better explain the principles and practical applications of the present invention, so that those skilled in the art can understand and use the present invention well. The present invention is limited only by the claims and their full scope and equivalents.

Claims (10)

1. The high-security Bluetooth digital key storage management method based on mobile terminal TEE is characterized by comprising the following steps:

step S01: utilizing a hardware security module of the mobile device as a Trusted Execution Environment (TEE); generating a key pair in the trusted execution environment TEE by adopting an asymmetric encryption technology;

step S02: encrypting the Bluetooth digital key data by using the public key;

Step S03: storing the encrypted data in a secure storage area of the mobile device;

step S04: when the data is needed to be used, the encrypted data is read from the safe storage area;

step S05: the encrypted data is decrypted in the trusted execution environment TEE using the private key.

2. The mobile terminal TEE-based high-security bluetooth digital key storage management method according to claim 1, wherein the hardware security module is Secure enclaspe on an iOS platform and is trust zone-based KeyStore on an Android platform.

3. The mobile terminal TEE-based high security bluetooth digital key storage management method according to claim 1, wherein in the step S01, an asymmetric encryption technology is adopted to generate a key pair as an RSA key pair, and the key length is 2048 bits; performing OAEP population on bluetooth digital key data prior to encrypting the bluetooth digital key data; the SHA256 algorithm is used as a hash function for OAEP padding.

4. The mobile-TEE-based high security bluetooth digital key storage management method of claim 1, further comprising the steps of:

step B01: deploying a secure random number generator in the trusted execution environment TEE;

Step B02: generating a unique identifier for each bluetooth digital key using a secure random number generator;

step B03: storing the unique identifier with the encrypted Bluetooth digital key data;

Step B04: when the Bluetooth digital key is searched and used, the validity of the unique identifier is verified, and if the unique identifier is invalid, the corresponding Bluetooth digital key data is refused to be accessed.

5. The mobile terminal TEE-based high-security bluetooth digital key storage management method according to claim 1, wherein the secure storage area is Keychain on an iOS platform and is ENCRYPTEDSHAREDPREFERENCES on an Android platform; when storing the encrypted data in Keychain on the iOS platform, the kSecAttrAccessible attribute is set to kSecAttrAccessibleWhenUnlockedThisDeviceOnly.

6. The mobile-TEE-based high security bluetooth digital key storage management method of claim 1, further comprising the steps of:

Step G01: triggering key rotation periodically or based on a set condition;

Step G02: generating a new key pair inside the trusted execution environment TEE;

step G03: encrypting the Bluetooth digital key data again by using the new public key;

step G04: the old private key is destroyed securely.

7. The mobile-TEE-based high security bluetooth digital key storage management method of claim 1, further comprising the steps of:

step F01: an access control module is deployed outside the trusted execution environment TEE and used for managing access rights to encrypted Bluetooth digital key data;

Step F02: the access control module decides whether to allow the application program to request decryption data according to a predefined policy.

8. The mobile terminal TEE-based high security bluetooth digital key storage management method according to claim 1, wherein in step S03:

Storing metadata associated with the encrypted data at the same time when the encrypted data is stored;

the metadata comprises the creation time, the last access time and the access times of the data;

Data lifecycle management is implemented based on the metadata.

9. The mobile-TEE-based high security bluetooth digital key storage management method of claim 1, further comprising the steps of:

Recording all key operations through a security log system, wherein the key operations comprise key generation, data encryption and decryption and access control decision;

The security log recorded by the security log system is stored in a storage area protected by a Trusted Execution Environment (TEE) to prevent the security log from being tampered or deleted.

10. The mobile-TEE-based high security bluetooth digital key storage management method of claim 1, further comprising the steps of: allowing a user to safely migrate encrypted Bluetooth digital key data when replacing the mobile device through a safe backup and recovery mechanism; during the backup process, the data is protected using an additional encryption layer and requires the user to provide additional authentication information.