WO2017084569A1 - 在智能终端中获取登陆凭证的方法、智能终端以及操作*** - Google Patents

在智能终端中获取登陆凭证的方法、智能终端以及操作*** Download PDF

Info

Publication number
WO2017084569A1
WO2017084569A1 PCT/CN2016/106009 CN2016106009W WO2017084569A1 WO 2017084569 A1 WO2017084569 A1 WO 2017084569A1 CN 2016106009 W CN2016106009 W CN 2016106009W WO 2017084569 A1 WO2017084569 A1 WO 2017084569A1
Authority
WO
WIPO (PCT)
Prior art keywords
operating system
login
smart terminal
application
user
Prior art date
Application number
PCT/CN2016/106009
Other languages
English (en)
French (fr)
Inventor
褚红梅
才华
Original Assignee
***股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by ***股份有限公司 filed Critical ***股份有限公司
Publication of WO2017084569A1 publication Critical patent/WO2017084569A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0861—Network architectures or network communication protocols for network security for authentication of entities using biometrical features, e.g. fingerprint, retina-scan
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0807—Network architectures or network communication protocols for network security for authentication of entities using tickets, e.g. Kerberos
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/321—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving a third party or a trusted authority
    • H04L9/3213—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving a third party or a trusted authority using tickets or tokens, e.g. Kerberos
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3226—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using a predetermined code, e.g. password, passphrase or PIN
    • H04L9/3231—Biological data, e.g. fingerprint, voice or retina

Definitions

  • the present invention relates to a method for acquiring a login credential in an intelligent terminal, an intelligent terminal, and an operating system.
  • the present application provides a method for obtaining a login credential in an intelligent terminal, where the smart terminal includes a first operating system and a second operating system running thereon, wherein the second operating system has a ratio
  • the first operating system has a higher security level
  • the method includes: the user selects an application to be used in the first operating system of the smart terminal, the application prompts the user to input a login credential or automatically enters; After the automatic entry, the first operating system initiates a call request for the login credential of the application to the second operating system; based on the call request, the second operating system verifies the user identity and retrieves the requested login And the second operating system returns the login credential to the first operating system.
  • the above method may further include: in the registration phase, the user pre-establishes a correspondence between the primary key of the one or more applications in the first operating system and one or more login credentials in the second operating system.
  • the correspondence is stored in a specific application within the second operating system.
  • the call request contains a primary key of an application to be used and information for verifying the identity of the user.
  • the information for verifying the identity of the user includes one or more of a fingerprint, an iris, and a digital password.
  • the method may further include: the first operating system automatically entering the login credential fed back by the second operating system, wherein the login credential is further verified by a background system of an application of the first operating system.
  • the method may further include the first operating system automatically clearing the login credential after exiting the application or after the login and verification of the login credential is successful.
  • the first operating system is a normal operating system
  • the second operating system is a TEEI operating system
  • the common operating system is an Android operating system or an iOS operating system.
  • an intelligent terminal includes: a first operating system running on the smart terminal, the first operating system includes one or more applications; and a second operating system running on the smart terminal, the second operation
  • the system includes one or more applications, wherein the second operating system has a higher security level than the first operating system, and wherein the second operating system is further configured to be one of the first operating systems Or multiple applications provide storage space for login credentials.
  • the first operating system initiates a call request for the login credential of the application to the second operating system; based on the call request, the second operating system verifies the user identity and retrieves the request a login credential; and the second operating system returns the login credential to the first operating system.
  • the second operating system is pre-configured with a correspondence between a primary key of one or more applications in the first operating system and one or more login credentials.
  • the correspondence relationship is stored in a specific application of the second operating system.
  • the call request includes a primary key of an application to be used and is used for checking Information about the identity of the user.
  • the information for verifying the identity of the user includes, but is not limited to, one or more of a fingerprint, an iris, and a digital password.
  • the first operating system is configured to automatically input the login credential fed back by the second operating system, wherein the login credential is further verified by a background system of an application of the first operating system.
  • the first operating system is configured to automatically clear the login credential after exiting the application or after the login and verification of the login credential is successful.
  • the first operating system is a normal operating system
  • the second operating system is a TEEI operating system
  • the common operating system is an Android operating system or an iOS operating system.
  • a second operating system installed on a smart terminal, the operating system configured to provide a login credential for one or more applications running on another operating system of the smart terminal Storage space.
  • the storage container of the login credentials is provided for each type of APP application in the first operating system by the second operating system, thereby avoiding the trouble that the user memorizes multiple credentials.
  • the current user avoids entering the login credential every time, and directly saves the login credential. Although no user operation is required, it is not safe if the mobile terminal is lost or borrowed.
  • the second operating system stores various types of login credentials, and after the user has the login requirement and the identification is passed, the automatic retrieval and automatic filling can also achieve corresponding effects, but the security level is higher.
  • the identification mentioned above may be that when the user triggers “automatic login”, the biometric information such as the fingerprint of the user is automatically acquired, and the verification is performed in the background, which does not affect the user experience.
  • the mobile terminal loses or replaces the mobile terminal, it only needs to log in with the account at the time of registration on the new mobile terminal to download all the stored login credentials, and the login voucher storage APP on the original terminal will be updated.
  • FIG. 1 is a schematic diagram of a smart terminal according to an embodiment of the present application.
  • the TEEI (Trusted Executive Environment Integration) system developed by UnionPay is a higher security operating system.
  • Android and iOS systems are easily attacked by hackers, and one of the main ways to break through is screen capture. For example, according to the password, once the hacker enters the operating system, the user will be intercepted at which position and which number corresponds to the location. If there is a TEEI system on the terminal, these steps will be performed in the TEEI system, even if the hacker breaks Android or It doesn't matter to the iOS system.
  • the security of the TEEI system itself although no system is 100% secure, the "root key" (root certificate key file) is relatively safe, and the TEEI system is a root key. Its security is higher than Android and iOS.
  • FIG. 1 is a schematic diagram of a smart terminal according to an embodiment of the present application.
  • the smart terminal includes a first operating system running on the smart terminal, and the first operating system includes one or more applications (such as QQ, WeChat, UnionPay wallet, Alipay, mobile banking, etc.).
  • the first operating system is a common operating system, including but not limited to an Android operating system and an iOS operating system.
  • the smart terminal further includes a second operating system, and the second operating system also includes one or more applications.
  • the first operating system is a common operating system, including but not limited to an Android operating system and an iOS operating system.
  • the smart terminal further includes a second operating system, and the second operating system also includes one or more applications.
  • FIG. 1 is a schematic diagram of a smart terminal according to an embodiment of the present application.
  • the smart terminal includes a first operating system running on the smart terminal, and the first operating system includes one or more applications (such as QQ, WeChat, UnionPay wallet, Alipay, mobile banking, etc.).
  • the second operating system is a TEEI system with a higher security level
  • the TEEI system includes a login credential storage application configured to become one or more applications in a common operating system (eg, UnionPay wallet, Alipay, mobile phone) Bank, etc.) Provides storage space for login credentials.
  • a common operating system eg, UnionPay wallet, Alipay, mobile phone) Bank, etc.
  • a common operating system of the smart terminal is installed with various APP applications, such as an instant messaging APP that requires real-time authentication, various wallet APPs, mobile banking APPs, Mailbox, etc.
  • the common operating system is configured to interact with the TEEI operating system according to the login request of various instant messaging applications to obtain corresponding login credentials.
  • the normal operating system is configured to automatically log in to the login credentials fed back by the TEEI operating system.
  • the normal operating system is configured to be deleted in time after successful login to prevent acquisition by a malicious program.
  • the second operating system (for example, the TEEI operating system) is configured to provide storage containers for various types of applications with higher security levels, including but not limited to SE, login credential storage APP, and the like.
  • the login credential storage APP can be installed on the TEEI operating system and store login credentials for various real-time identification applications.
  • the login credential storage APP application can retrieve the corresponding login credential according to the primary key provided by the common operating system, and feed back to the common operating system.
  • the business process can include storing login credentials and automatically filling in two processes, as follows:
  • the user starts the login credential storage APP, and registers the account information according to the prompt. At this time, the APP can obtain the unique identification number of the mobile device;
  • the user sets the permission to use the login credentials to store the APP according to the system conditions
  • the specific process of registering and storing the login credentials described above is for illustrative purposes only and is not intended to limit the invention. It is necessary to point out that if the normal operating system calls the TEEI operating system and needs identification, then the login credential storage APP can be called without identity recognition. It should also be noted that after registering and storing each login credential, the background system can associate the account information, the unique identification number, and the various APP primary keys with the login credentials. In one embodiment, in order to use the effect, the correspondence between the various APP primary keys and the login credentials may be stored in the TEEI operating system. In one embodiment, each time the login credential storage APP is invoked, the biometric method is used, and the registration account information is no longer required to be entered. In an embodiment, if the mobile terminal loses or replaces the mobile terminal, only all the stored login credentials can be downloaded by logging in with the account at the time of registration on the new mobile terminal, and the login credential storage APP on the original terminal is updated. .
  • the user selects an APP application to be used on the smart terminal;
  • the APP application prompts the user to input a login credential or automatically enter the entry;
  • the normal operating system initiates a request to invoke the login credential storage APP under the TEEI operating system (referred to as a request for obtaining the login credential), and the request includes the APP primary key to be used for login, and the fourth step operation Required verification information (such as fingerprints);
  • the TEEI operating system After receiving the request, the TEEI operating system verifies the identity of the user, such as by fingerprint, iris or digital password.
  • the TEEI operating system sends a request for obtaining the login credential to the login credential storage APP;
  • the login credential storage APP retrieves the corresponding login credential according to information such as the primary key in the request for obtaining the login credential;
  • the login voucher storage APP feeds back the retrieved login credentials to the normal operating system
  • the normal operating system is automatically entered and verified by the APP application backend system
  • the login credentials are automatically cleared; if the system allows, the system can automatically clear the login credentials after the entry and verification is successful to prevent the illegal program from being acquired.
  • the above-mentioned process satisfies the user's security requirements through the APP application, and on the other hand, through the automatic retrieval and automatic filling, the user input operation is reduced, and the user experience is improved.
  • the application under the TEEI operating system is invoked, the security of the use is ensured by the necessary authentication method, and even if the mobile terminal is lost or borrowed, there is no need to worry about other people seeing the private information.
  • the user stores the login credentials of various APPs requiring real-time authentication through the login credentials storage APP application.
  • the normal operating system sends a request for obtaining the login credential to the login credential storage APP under the TEEI operating system.
  • the login voucher storage APP automatically retrieves the corresponding login voucher and returns to the normal operating system, the login voucher is automatically entered without the user's perception.
  • the background of the intelligent terminal will authenticate the user through the convenient way of fingerprinting when calling the login voucher storage APP to obtain the login voucher, and ensure the security of the use while ensuring the user experience.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Health & Medical Sciences (AREA)
  • Biomedical Technology (AREA)
  • General Health & Medical Sciences (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Life Sciences & Earth Sciences (AREA)
  • Biodiversity & Conservation Biology (AREA)
  • Telephone Function (AREA)

Abstract

本申请公开了一种在智能终端中获取登陆凭证的方法，所述智能终端包括运行于其上的第一操作***和第二操作***，其中所述第二操作***具有比所述第一操作***更高的安全级别，所述方法包括：用户在所述智能终端的第一操作***中选择需要使用的应用，所述应用提示用户输入登陆凭证或自动录入；在用户选择自动录入后，所述第一操作***向所述第二操作***发起对所述应用的登陆凭证的调用请求；基于所述调用请求，所述第二操作***验证用户身份并检索所请求的登陆凭证；以及所述第二操作***向所述第一操作***返回所述登陆凭证。本申请还公开了一种智能终端以及运行于智能终端上的操作***。

Description

在智能终端中获取登陆凭证的方法、智能终端以及操作*** 技术领域
本发明涉及在智能终端中获取登陆凭证的方法、智能终端以及操作***。
背景技术
目前在智能终端上存在多种即时通讯类应用，如微信、QQ、邮箱等。一般而言，该类应用允许用户自动保存登录密码。用户为了省事，通常会选择这种自动保存免输入的方式。但是，这也带来一些问题，例如在安装有这些应用的移动终端遗失时，用户的隐私可能会泄露。甚至，在网络支付日益发展的今天，例如黑客容易通过各种技术手段攻破普通手机操作***，从而获取用户的支付密码等敏感信息，从而造成用户财产的损失。
因此，需要一种既能避免用户输入登陆凭证(如密码等)，同时又能保证较高安全性的方法和***。
发明内容
为了解决上述问题，本申请提供了一种在智能终端中获取登陆凭证的方法，所述智能终端包括运行于其上的第一操作***和第二操作***，其中所述第二操作***具有比所述第一操作***更高的安全级别，所述方法包括：用户在所述智能终端的第一操作***中选择需要使用的应用，所述应用提示用户输入登陆凭证或自动录入；在用户选择自动录入后，所述第一操作***向所述第二操作***发起对所述应用的登陆凭证的调用请求；基于所述调用请求，所述第二操作***验证用户身份并检索所请求的登陆凭证；以及所述第二操作***向所述第一操作***返回所述登陆凭证。
上述方法还可包括：在注册阶段，用户预先在所述第二操作***中建立所述第一操作***中的一个或多个应用的主键与一个或多个登陆凭证之间的对应关系。
在上述方法中，所述对应关系存储在所述第二操作***内的一特定应用中。
在上述方法中，所述调用请求包含需要使用的应用的主键以及用于验证用户身份的信息。
在上述方法中，所述用于验证用户身份的信息包含指纹、虹膜以及数字密码中的一个或多个。
上述方法还可包括：所述第一操作***自动录入所述第二操作***所反馈的所述登陆凭证，其中所述登陆凭证由所述第一操作***的应用的后台***进一步验证。
上述方法还可包括：在退出所述应用之后或在所述登陆凭证的录入以及验证成功之后，所述第一操作***自动清除所述登陆凭证。
在上述方法中，所述第一操作***为普通操作***，而所述第二操作***为TEEI操作***。
在上述方法中，所述普通操作***为安卓操作***或iOS操作***。
根据本申请的另一个方面，提供了一种智能终端。该智能终端包括：运行于所述智能终端上的第一操作***，所述第一操作***包括一个或多个应用；以及运行于所述智能终端上的第二操作***，所述第二操作***包括一个或多个应用，其中所述第二操作***具有比所述第一操作***更高的安全级别，以及其中，所述第二操作***还配置成为所述第一操作***中的一个或多个应用提供登陆凭证的存储空间。
在上述智能终端中，所述第一操作***向所述第二操作***发起对所述应用的登陆凭证的调用请求；基于所述调用请求，所述第二操作***验证用户身份并检索所请求的登陆凭证；以及所述第二操作***向所述第一操作***返回所述登陆凭证。
在上述智能终端中，所述第二操作***预先配置有所述第一操作***中的一个或多个应用的主键与一个或多个登陆凭证之间的对应关系。
在上述智能终端中，所述对应关系存储在所述第二操作***的一特定应用中。
在上述智能终端中，所述调用请求包含需要使用的应用的主键以及用于验 证用户身份的信息。
在上述智能终端中，所述用于验证用户身份的信息包含但不限于指纹、虹膜以及数字密码中的一个或多个。
在上述智能终端中，所述第一操作***配置成自动录入所述第二操作***所反馈的所述登陆凭证，其中所述登陆凭证由所述第一操作***的应用的后台***进一步验证。
在上述智能终端中，所述第一操作***配置成在退出所述应用之后或在所述登陆凭证的录入以及验证成功之后，自动清除所述登陆凭证。
在上述智能终端中，所述第一操作***为普通操作***，而所述第二操作***为TEEI操作***。
在上述智能终端中，所述普通操作***为安卓操作***或iOS操作***。
根据本申请的另一个方面，提供了一种安装于智能终端上的第二操作***，所述操作***配置成为运行于所述智能终端的另一个操作***上的一个或多个应用提供登陆凭证的存储空间。
按照本申请的方案，通过第二操作***为第一操作***中的各类APP应用提供了登陆凭证的存放容器，避免了用户记忆多个凭证的烦恼。另外，当前用户避免每次使用时都输入登录凭证，直接将登录凭证保存，虽然不需要用户操作，但是如果移动终端丢失或借用，很不安全。通过第二操作***存储各类登录凭证，并在用户有登陆需求并身份识别通过后，自动检索和自动填写，也可以起到相应的效果，但是安全级别更高。上面所说的身份识别可以是用户触发“自动登录”时，自动获取到用户的指纹等生物识别信息，并在后台验证，不会影响用户的使用体验。此外，如果移动终端丢失或替换移动终端后，只需要在新的移动终端上用注册时的账号登陆即可下载所有已存储的登录凭证，原来终端上的登录凭证存储APP会被更新。
附图说明
在参照附图阅读了本发明的具体实施方式以后，本领域技术人员将会更清楚地了解本发明的各个方面。本领域技术人员应当理解的是：这些附图仅仅用于配合具体实施方式说明本发明的技术方案，而并非意在对本发明的保护范围构成限制。
图1是根据本申请的一个实施例的智能终端的示意图。
具体实施方式
下面介绍的是本发明的多个可能实施例中的一些，旨在提供对本发明的基本了解，并不旨在确认本发明的关键或决定性的要素或限定所要保护的范围。容易理解，根据本发明的技术方案，在不变更本发明的实质精神下，本领域的一般技术人员可以提出可相互替换的其它实现方式。因此，以下具体实施方式以及附图仅是对本发明的技术方案的示例性说明，而不应当视为本发明的全部或者视为对本发明技术方案的限定或限制。
银联开发的TEEI(Trusted Executive Environment Integration可信执行环境集成)***是一个安全级别较高的操作***。现在的安卓、iOS***很容易被黑客攻破，而攻破的一种主要方式就是截屏。比如按密码，黑客一旦进入正在操作的***，使用者按在哪个位置、这个位置对应哪个数字就会被截取，如果终端上有TEEI***，这些步骤将在TEEI***里进行，黑客即使攻破安卓或iOS***也没关系。而就TEEI***本身的安全性而言，尽管没有一个***是100％安全的，但相对而言，“根key”(根证书密钥文件)是最安全的，TEEI***就是一种根key，其安全性比安卓与iOS***都要高。
图1是根据本申请的一个实施例的智能终端的示意图。该智能终端包括运行于所述智能终端上的第一操作***，所述第一操作***包括一个或多个应用(如QQ、微信、银联钱包、支付宝、手机银行等应用)。如图1所示，该第一操作***为普通操作***，包括但不限于安卓操作***和iOS操作***。除了第一操作***之外，该智能终端还包括第二操作***，所述第二操作***也包括一个或多个应用。在图1中，该第二操作***为安全级别更高的TEEI***，该TEEI***包括登陆凭证存储应用，该应用配置成为普通操作***中的一个或多个应用(例如银联钱包、支付宝、手机银行等)提供登陆凭证的存储空间。
由于将一些重要的登陆凭证存储在本申请的智能终端安全级别较高的TEEI操作***中，所以即使黑客攻破手机的普通操作***也无法获取支付密码等敏感信息。
根据本申请的一个实施例，智能终端的普通操作***安装有各类APP应用，如需要实时身份验证的即时通讯类APP、各类钱包APP、手机银行APP、 邮箱等。该普通操作***配置成根据各类即时通讯应用的登陆请求，与TEEI操作***交互，获取对应的登陆凭证。在一个实施例中，该普通操作***配置成将TEEI操作***反馈的登录凭证自动登陆。在一个实施例中，该普通操作***配置成在登陆成功后及时删除，防止被恶意程序获取。
根据本申请的一个实施例，第二操作***(例如，TEEI操作***)配置成为各类安全级别较高的应用提供存储容器，包括但不限于SE、登陆凭证存储APP等。
根据本申请的一个实施例，登陆凭证存储APP可安装在TEEI操作***上，并存储各类实时身份识别应用的登陆凭证。在一个实施例中，用户获取使用权限后，登陆凭证存储APP应用可根据普通操作***提供的主键，检索对应的登录凭证，并将其反馈给普通操作***。
根据本申请的一个方面，提供了具体的业务流程。该业务流程可包括存储登录凭证、自动填写两个过程，具体如下：
(一)注册并存储登陆凭证
1、用户启动登录凭证存储APP，并根据提示注册账户信息，此时该APP可获取移动设备的唯一识别号；
2、用户根据***情况，设置使用登录凭证存储APP的权限；
3、在登录凭证存储APP中，输入并存储各类APP应用的登陆凭证，建立各类APP主键与登陆凭证的对应关系。
需要指出的是，上述注册并存储登陆凭证的具体过程仅用作示例，而不是要对本发明进行限制。有必要指出的是，如果普通操作***调用TEEI操作***时，需要身份识别，那么调用登录凭证存储APP时可不需要身份识别。还需要指出的是，注册并存储各登录凭证后，后台***可将账户信息、唯一识别号、各类APP主键与登陆凭证建立对应关系。在一个实施例中，为了使用效果，可将各类APP主键与登陆凭证之间的对应关系存放在TEEI操作***中。在一个实施例中，每次调用登录凭证存储APP时，通过生物识别方法即可，不再需要输入注册账户信息。在一个实施例中，如果移动终端丢失或替换移动终端后，只需要在新的移动终端上用注册时的账号登陆即可下载所有已存储的登录凭证，原来终端上的登录凭证存储APP被更新。
(二)自动填写过程
1、用户在智能终端上选择需要使用的APP应用；
2、APP应用提示用户输入登陆凭证或自动录入；
3、用户选择自动录入后，普通操作***发起调用TEEI操作***之下的登录凭证存储APP的请求(简称获取登录凭证的请求)，请求中包括需登录使用的APP主键，以及第4步操作所需要的验证信息(如指纹)等；
4、TEEI操作***收到请求后，验证用户身份，如通过指纹、虹膜或数字密码等方式验证；
5、验证通过后，TEEI操作***将获取登录凭证的请求发送给登录凭证存储APP；
6、登录凭证存储APP根据获取登录凭证的请求中的主键等信息检索对应的登录凭证；
7、登录凭证存储APP将检索到的登录凭证反馈给普通操作***；
8、普通操作***自动录入并由APP应用后台***验证；
9、当用户终止使用APP应用时，自动清除登录凭证；如果***允许，也可在录入并验证成功后，***自动清除登录凭证防止被不法程序获取。
上述流程一方面通过APP应用凡用必验身份的措施，满足用户的安全需求，另一方面通过自动检索和自动填写的方式，减少用户的输入操作，提升了用户的使用体验。此外，在调用TEEI操作***下的应用程序时，也通过必要的身份验证方式保证了使用的安全性，即使移动终端被丢失或借用，也不必担心其他人看到隐私信息。
上述方案可从以下几方面确保支付的安全性：
(1)采用安全访问控制措施，用户只有通过身份验证后，才可调用TEEI操作***之下的登录凭证存储APP；
(2)将登录凭证存储APP放置在TEEI操作***下，有效隔离了不法程序的恶意攻击。
在一个实施例中，用户通过登录凭证存储APP应用来存储各类需要实时身份验证的APP的登陆凭证。当用户在智能终端上选择使用APP时，普通操作***会将获取登陆凭证的请求发送给TEEI操作***之下的登录凭证存储APP， 登录凭证存储APP自动检索到对应的登录凭证后返回普通操作***后，在用户无感知的情况下自动录入该登陆凭证。在该方案中，表面上用户只需触发需要使用的APP即可，不需要输入任何信息，即可自动录入已存储的对应的登录凭证。事实上，智能终端的后台在调用登录凭证存储APP获取登陆凭证时会通过指纹等便捷方式进行身份验证，在保证用户使用体验的同时，也保证了使用的安全性。
上文中，参照附图描述了本发明的具体实施方式。但是，本领域中的普通技术人员能够理解，在不偏离本发明的精神和范围的情况下，还可以对本发明的具体实施方式作各种变更和替换。这些变更和替换都落在本发明权利要求书所限定的范围内。

Claims (20)

  1. 一种在智能终端中获取登陆凭证的方法，所述智能终端包括运行于其上的第一操作***和第二操作***，其中所述第二操作***具有比所述第一操作***更高的安全级别，其特征在于，所述方法包括：
    用户在所述智能终端的第一操作***中选择需要使用的应用，所述应用提示用户输入登陆凭证或自动录入；
    在用户选择自动录入后，所述第一操作***向所述第二操作***发起对所述应用的登陆凭证的调用请求；
    基于所述调用请求，所述第二操作***验证用户身份并检索所请求的登陆凭证；以及
    所述第二操作***向所述第一操作***返回所述登陆凭证。
  2. 如权利要求1所述的方法，还包括：在注册阶段，用户预先在所述第二操作***中建立所述第一操作***中的一个或多个应用的主键与一个或多个登陆凭证之间的对应关系。
  3. 如权利要求2所述的方法，其中，所述对应关系存储在所述第二操作***内的一特定应用中。
  4. 如权利要求1所述的方法，其中，所述调用请求包含需要使用的应用的主键以及用于验证用户身份的信息。
  5. 如权利要求4所述的方法，其中，所述用于验证用户身份的信息包含但不限于指纹、虹膜以及数字密码中的一个或多个。
  6. 如权利要求1所述的方法，还包括：所述第一操作***自动录入所述第二操作***所反馈的所述登陆凭证，其中所述登陆凭证由所述第一操作***的应用的后台***进一步验证。
  7. 如权利要求1或6所述的方法，还包括：在退出所述应用之后或在所述登陆凭证的录入以及验证成功之后，所述第一操作***自动清除所述登陆凭证。
  8. 如权利要求1所述的方法，其中，所述第一操作***为普通操作***，而所述 第二操作***为TEEI操作***。
  9. 如权利要求8所述的方法，其中，所述普通操作***为安卓操作***或iOS操作***。
  10. 一种智能终端，其特征在于，所述智能终端包括：
    运行于所述智能终端上的第一操作***，所述第一操作***包括一个或多个应用；以及
    运行于所述智能终端上的第二操作***，所述第二操作***包括一个或多个应用，其中所述第二操作***具有比所述第一操作***更高的安全级别，
    其中，所述第二操作***还配置成为所述第一操作***中的一个或多个应用提供登陆凭证的存储空间。
  11. 如权利要求10所述的智能终端，其中，所述第一操作***向所述第二操作***发起对所述应用的登陆凭证的调用请求；基于所述调用请求，所述第二操作***验证用户身份并检索所请求的登陆凭证；以及所述第二操作***向所述第一操作***返回所述登陆凭证。
  12. 如权利要求10或11所述的智能终端，其中，所述第二操作***预先配置有所述第一操作***中的一个或多个应用的主键与一个或多个登陆凭证之间的对应关系。
  13. 如权利要求12所述的智能终端，其中，所述对应关系存储在所述第二操作***的一特定应用中。
  14. 如权利要求11所述的智能终端，其中，所述调用请求包含需要使用的应用的主键以及用于验证用户身份的信息。
  15. 如权利要求14所述的智能终端，其中，所述用于验证用户身份的信息包含但不限于指纹、虹膜以及数字密码中的一个或多个。
  16. 如权利要求11所述的智能终端，其中，所述第一操作***配置成自动录入所述第二操作***所反馈的所述登陆凭证，其中所述登陆凭证由所述第一操作***的应用的后台***进一步验证。
  17. 如权利要求11或16所述的智能终端，其中，所述第一操作***配置成在退出所述应用之后或在所述登陆凭证的录入以及验证成功之后，自动清除所述登陆凭证。
  18. 如权利要求11所述的智能终端，其中，所述第一操作***为普通操作***，而所述第二操作***为TEEI操作***。
  19. 如权利要求18所述的智能终端，其中，所述普通操作***为安卓操作***或iOS操作***。
  20. 一种安装于智能终端上的第二操作***，其特征在于，所述操作***配置成为运行于所述智能终端的另一个操作***上的一个或多个应用提供登陆凭证的存储空间。
PCT/CN2016/106009 2015-11-19 2016-11-16 在智能终端中获取登陆凭证的方法、智能终端以及操作*** WO2017084569A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201510799005.XA CN105592072A (zh) 2015-11-19 2015-11-19 在智能终端中获取登陆凭证的方法、智能终端以及操作***
CN201510799005.X 2015-11-19

Publications (1)

Publication Number Publication Date
WO2017084569A1 true WO2017084569A1 (zh) 2017-05-26

Family

ID=55931287

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2016/106009 WO2017084569A1 (zh) 2015-11-19 2016-11-16 在智能终端中获取登陆凭证的方法、智能终端以及操作***

Country Status (2)

Country Link
CN (1) CN105592072A (zh)
WO (1) WO2017084569A1 (zh)

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115248912A (zh) * 2022-09-19 2022-10-28 平安银行股份有限公司 基于云终端的***登录方法、设备及计算机可读存储介质
CN116702019A (zh) * 2023-04-26 2023-09-05 佛山众陶联供应链服务有限公司 一种基于二维码收集凭证的自动分类方法及***
US11895106B2 (en) 2021-01-28 2024-02-06 Oracle International Corporation Automatic sign-in upon account signup

Families Citing this family (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN105592072A (zh) * 2015-11-19 2016-05-18 ***股份有限公司 在智能终端中获取登陆凭证的方法、智能终端以及操作***
CN111722894B (zh) * 2019-03-21 2023-04-18 成都鼎桥通信技术有限公司 应用处理方法、装置及电子设备
CN113722693A (zh) * 2021-09-09 2021-11-30 国网福建省电力有限公司漳州供电公司 基于生物识别的rpa平台登录方法、***、设备和存储介质

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20130219192A1 (en) * 2012-02-16 2013-08-22 Samsung Electronics Co. Ltd. Contents security apparatus and method thereof
CN104424028A (zh) * 2013-08-26 2015-03-18 联想(北京)有限公司 终端设备以及切换方法
CN104618601A (zh) * 2015-02-05 2015-05-13 深圳酷派技术有限公司 一种数据共享方法及多***终端
CN105592072A (zh) * 2015-11-19 2016-05-18 ***股份有限公司 在智能终端中获取登陆凭证的方法、智能终端以及操作***

Family Cites Families (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103118031B (zh) * 2013-02-25 2016-10-05 东莞宇龙通信科技有限公司 登录应用账户的方法及电子设备
US9495544B2 (en) * 2013-06-27 2016-11-15 Visa International Service Association Secure data transmission and verification with untrusted computing devices
JP6346443B2 (ja) * 2014-01-08 2018-06-20 キヤノン株式会社 情報処理装置およびその制御方法、並びにプログラム
CN103945385B (zh) * 2014-03-27 2018-02-13 宇龙计算机通信科技(深圳)有限公司 移动终端防盗的方法及其装置

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20130219192A1 (en) * 2012-02-16 2013-08-22 Samsung Electronics Co. Ltd. Contents security apparatus and method thereof
CN104424028A (zh) * 2013-08-26 2015-03-18 联想(北京)有限公司 终端设备以及切换方法
CN104618601A (zh) * 2015-02-05 2015-05-13 深圳酷派技术有限公司 一种数据共享方法及多***终端
CN105592072A (zh) * 2015-11-19 2016-05-18 ***股份有限公司 在智能终端中获取登陆凭证的方法、智能终端以及操作***

Cited By (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US11895106B2 (en) 2021-01-28 2024-02-06 Oracle International Corporation Automatic sign-in upon account signup
CN115248912A (zh) * 2022-09-19 2022-10-28 平安银行股份有限公司 基于云终端的***登录方法、设备及计算机可读存储介质
CN115248912B (zh) * 2022-09-19 2023-01-31 平安银行股份有限公司 基于云终端的***登录方法、设备及计算机可读存储介质
CN116702019A (zh) * 2023-04-26 2023-09-05 佛山众陶联供应链服务有限公司 一种基于二维码收集凭证的自动分类方法及***
CN116702019B (zh) * 2023-04-26 2023-11-28 佛山众陶联供应链服务有限公司 一种基于二维码收集凭证的自动分类方法及***

Also Published As

Publication number Publication date
CN105592072A (zh) 2016-05-18

Similar Documents

Publication Publication Date Title
KR102307665B1 (ko) 신원 인증
US10826882B2 (en) Network-based key distribution system, method, and apparatus
WO2017084569A1 (zh) 在智能终端中获取登陆凭证的方法、智能终端以及操作***
US9887995B2 (en) Locking applications and devices using secure out-of-band channels
CN110061842B (zh) 带外远程认证
US9166966B2 (en) Apparatus and method for handling transaction tokens
US8572689B2 (en) Apparatus and method for making access decision using exceptions
US8572714B2 (en) Apparatus and method for determining subject assurance level
US8752123B2 (en) Apparatus and method for performing data tokenization
US8752124B2 (en) Apparatus and method for performing real-time authentication using subject token combinations
KR101451359B1 (ko) 사용자 계정 회복
US20160182491A1 (en) Methods, systems and apparatus to manage an authentication sequence
US20140026196A1 (en) Anti-cloning system and method
US20170169213A1 (en) Electronic device and method for running applications in different security environments
US10333707B1 (en) Systems and methods for user authentication
US20240080201A1 (en) Systems and methods for enhanced mobile device authentication
US20170201528A1 (en) Method for providing trusted service based on secure area and apparatus using the same
EP3407241B1 (en) User authentication and authorization system for a mobile application
US20140250499A1 (en) Password based security method, systems and devices
US8584202B2 (en) Apparatus and method for determining environment integrity levels
US9906516B2 (en) Security system for preventing further access to a service after initial access to the service has been permitted
US9977907B2 (en) Encryption processing method and device for application, and terminal
CN112398787B (zh) 邮箱登录验证的方法、装置、计算机设备及存储介质
CN109428869B (zh) 钓鱼攻击防御方法和授权服务器
CN106533685B (zh) 身份认证方法、装置及***

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 16865746

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 16865746

Country of ref document: EP

Kind code of ref document: A1