Trusted application access control method and terminal
Embodiments of the present invention relate to a trusted application access control method and a terminal. The method includes: receiving, by a terminal in a TEE, a request for accessing a target trusted application (TA) that is sent by a client application (CA); determining, by the terminal, a service level of the CA in a trusted execution environment (TEE) based on the request for accessing the target TA; and providing, by the terminal in the TEE by using the target TA, a service corresponding to the service level for the CA. In this way, the target TA provides different levels of services for the CA, and determines, in the TEE, the service level corresponding to the CA, thereby enhancing constraint and limitation of accessing the target TA by the CA, and improving security of accessing the target TA by the CA.
1. A method for trusted application access control, comprising:
receiving, by a terminal in a trusted execution environment (TEE), a request for accessing a target trusted application (TA) from a client application (CA);
determining, by the terminal, a CA identifier in the TEE based on the request for accessing the target TA;
determining, by the terminal in the TEE, a service level of the CA based on a correspondence between the CA identifier and the service level of the CA; and
providing, by the terminal in the TEE by using the target TA, a service corresponding to the service level for the CA, including loading the target TA corresponding to the service level of the CA, creating a session handle of the target TA, and returning the session handle, wherein the session handle is used by the CA to access the target TA.
2. The method according to claim 1 , wherein the request for accessing the target TA comprises a connection method parameter, and wherein the connection method parameter is a registered application program.
3. The method according to claim 1 , wherein before the receiving, by a terminal in a TEE, a request for accessing a target TA that is sent by a CA, the method further comprises:
receiving, by the terminal in the TEE, an access rule sent by a server, wherein the access rule comprises a correspondence between the CA identifier and the service level.
4. The method according to claim 1 , wherein the request for accessing the target TA comprises a connection data parameter, and wherein the determining, by the terminal, the CA identifier based on the request for accessing the target TA comprises any one of the following:
obtaining, by the terminal in the TEE, the CA identifier in process data space of the CA, wherein the process data space is process data space in which a CA process is started, and the CA is read after a user identity is authenticated, and the connection data parameter comprises a process data space address;
obtaining, by the terminal in the TEE, the CA identifier comprised in the connection data parameter, wherein the connection data parameter comprises the CA identifier; or
obtaining, by the terminal, the CA identifier in the TEE based on a packet name of the CA, wherein the connection data parameter comprises the packet name of the CA.
5. The method according to claim 1 , wherein the loading, by the terminal in the TEE, the target TA corresponding to the service level of the CA comprises:
loading, by the terminal in the TEE, the target TA based on a loading status of the target TA and the service level of the CA.
6. The method according to claim 1 , wherein the service comprises a video service.
7. An apparatus, comprising:
at least one processor; and
a memory coupled to the at least one processor and configured to store programming instructions that, when executed by the at least one processor, cause the apparatus to perform operations comprising:
receiving, in a trusted execution environment (TEE), a request for accessing a target trusted application (TA) from a client application (CA);
determining a CA identifier in the TEE based on the request for accessing the target TA;
determining, in the TEE, a service level of the CA based on a correspondence between the CA identifier and the service level of the CA; and
providing, in the TEE by using the target TA, a service corresponding to the service level for the CA, including loading the target TA corresponding to the service level of the CA, creating a session handle of the target TA, and returning the session handle, wherein the session handle is used by the CA to access the target TA.
8. The apparatus according to claim 7 , wherein the request for accessing the target TA comprises a connection method parameter, and where the connection method parameter is a registered application program.
9. The apparatus according to claim 7 , wherein the operations further comprise:
receiving, in the TEE, an access rule sent by a server, wherein the access rule comprises a correspondence between the CA identifier and the service level.
10. The apparatus according to claim 7 , wherein the request for accessing the target TA comprises a connection data parameter, and wherein the determining the CA identifier based on the request for accessing the target TA comprises any one of the following:
obtaining, in the TEE, the CA identifier in process data space of the CA, wherein the process data space is process data space in which a CA process is started, and the CA is read after a user identity is authenticated, and the connection data parameter comprises a process data space address;
obtaining, in the TEE, the CA identifier comprised in the connection data parameter, wherein the connection data parameter comprises the CA identifier; or
obtaining the CA identifier in the TEE based on a packet name of the CA, wherein the connection data parameter comprises the packet name of the CA.
11. The apparatus according to claim 7 , wherein the loading, in the TEE, the target TA corresponding to the service level of the CA comprises:
loading, in the TEE, the target TA based on a loading status of the target TA and the service level of the CA.
12. The apparatus according to claim 7 , wherein the service comprises a video service.
13. A non-transitory computer-readable storage medium having computer-readable program code stored therein that, in response to execution by a processor of an apparatus, cause the apparatus to perform operations comprising:
receiving, in a trusted execution environment (TEE), a request for accessing a target trusted application (TA) from a client application (CA);
determining a CA identifier in the TEE based on the request for accessing the target TA;
determining, in the TEE, a service level of the CA based on a correspondence between the CA identifier and the service level of the CA; and
providing, in the TEE by using the target TA, a service corresponding to the service level for the CA, including loading the target TA corresponding to the service level of the CA, creating a session handle of the target TA, and returning the session handle, wherein the session handle is used by the CA to access the target TA.
14. The non-transitory computer-readable storage medium according to claim 13 , wherein the request for accessing the target TA comprises a connection method parameter, and wherein the connection method parameter is a registered application program.
15. The non-transitory computer-readable storage medium according to claim 13 , wherein the operations further comprise:
receiving, in the TEE, an access rule sent by a server, wherein the access rule comprises a correspondence between the CA identifier and the service level.
16. The non-transitory computer-readable storage medium according to claim 13 , wherein the request for accessing the target TA comprises a connection data parameter, and wherein the determining the CA identifier based on the request for accessing the target TA comprises any one of the following:
obtaining, in the TEE, the CA identifier in process data space of the CA, wherein the process data space is process data space in which a CA process is started, and the CA is read after a user identity is authenticated, and the connection data parameter comprises a process data space address;
obtaining, in the TEE, the CA identifier comprised in the connection data parameter, wherein the connection data parameter comprises the CA identifier; or
obtaining the CA identifier in the TEE based on a packet name of the CA, wherein the connection data parameter comprises the packet name of the CA.
17. The non-transitory computer-readable storage medium according to claim 13 , wherein the loading, in the TEE, the target TA corresponding to the service level of the CA comprises:
loading, in the TEE, the target TA based on a loading status of the target TA and the service level of the CA.