Authorization credential migration method, terminal device, and service server

1. A method, implemented by an electronic device, for immigrating an authorization credential of a trusted application into a first electronic device, wherein the first electronic device comprises a secure element (SE), wherein the trusted application is installed in the SE, and wherein the method comprises:

establishing a first secure channel directly communicated between the first electronic device and a service server;

sending, over the secure channel in a trusted execution environment (TEE), an authorization credential immigration request to the service server;

receiving, over the secure channel in the TEE, first user input indicating a first authorization verification code, wherein the first authorization verification code relates to a second authorization verification code displayed on a second electronic device, and wherein the second electronic device is a device from which an authorization credential is to be revoked via a second secure channel directly communicated between the service server and the second electronic device;

sending, over the secure channel in the TEE, to the service server, the first authorization verification code to prompt the service server to perform first authorization authentication and to delete a first mapping relationship between a device identifier of the second electronic device and an authorization credential of the trusted application after determining that first authorization authentication succeeds and to set up a second mapping relationship between the first electronic device and the authorization credential of the trusted application; and

receiving, over the secure channel in the TEE, the authorization credential of the trusted application from the service server.

2. The method of claim 1 , wherein the first authorization verification code is the same as the second authorization verification code.

3. The method of claim 1 , wherein before receiving the authorization credential of the trusted application from the service server, the method further comprises:

receiving a first verification code from the service server;

displaying the first verification code;

receiving second user input indicating a second verification code, wherein the second verification code relates to the first verification code; and

sending to the service server, the second verification code to prompt the service server to perform second authorization authentication.

4. The method of claim 3 , wherein the second verification code is the same as the first verification code.

5. The method of claim 1 , wherein the first user input is received using a trusted user interface (TUI) in the TEE.

6. The method of claim 1 , wherein the authorization credential immigration request comprises a device identifier of the first electronic device, an SE identifier of the first electronic device, an application identifier of the trusted application, and personal information of a user.

7. The method of claim 1 , wherein the authorization credential immigration request is set to be valid within a predetermined period.

8. The method of claim 1 , wherein the SE comprises an independent physical chip.

9. A first electronic device for an authorization credential migration, comprising:

a secure element (SE) comprising a trusted application;

a memory storing executable instructions; and

a processor device coupled to the SE and the memory, wherein the processor device is configured to execute the instructions and cause the first electronic device to:

establish a first secure channel directly communicated between the first electronic device and a service server;

send, over the secure channel in a trusted execution environment (TEE), an authorization credential immigration request to the service server;

receive, over the secure channel in the TEE, first user input indicating a first authorization verification code, wherein the first authorization verification code relates to a second authorization verification code displayed on a second electronic device, and wherein the second electronic device is a device from which an authorization credential is to be revoked via a second secure channel between the service server and the second electronic device;

send, over the secure channel in the TEE, to the service server to prompt the service server to perform first authorization authentication and to delete a first mapping relationship between a device identifier of the second electronic device and an authorization credential of the trusted application after determining that first authorization authentication succeeds and to set up a second mapping relationship between the first electronic device and the authorization credential of the trusted application; and

receive, over the secure channel in the TEE, the authorization credential of the trusted application from the service server.

10. The first electronic device of claim 9 , wherein the first authorization verification code is the same as the second authorization verification code.

11. The first electronic device of claim 9 , wherein the instructions further cause the first electronic device to:

receive a first verification code from the service server;

display the first verification code;

receive second user input indicating a second verification code, wherein the second verification code relates to the first verification code; and

send the second verification code to the service server, to instruct the service server to perform second authorization authentication.

12. The first electronic device of claim 11 , wherein the second verification code is the same as the first verification code.

13. The first electronic device of claim 9 , wherein the first user input is received using a trusted user interface (TUI) in the TEE.

14. The first electronic device of claim 9 , wherein the authorization credential immigration request comprises a device identifier of the first electronic device, an SE identifier of the first electronic device, an application identifier of the trusted application, and personal information of a user.

15. The first electronic device of claim 9 , wherein the authorization credential immigration request is set to be valid within a predetermined period.

16. The first electronic device of claim 9 , wherein the SE comprises an independent physical chip.

17. A method, implemented by a service server, for immigrating an authorization credential of a trusted application into a first electronic device, wherein the first electronic device comprises a secure element (SE), wherein the trusted application is installed in the SE, and wherein the method comprises:

establishing a first secure channel directly communicated between the service server and the first electronic device;

receiving, over the first secure channel in a trusted execution environment (TEE), an authorization credential immigration request from the first electronic device;

establishing a second secure channel directly communicated between the service server and a second electronic device;

receiving, over the second secure channel, an authorization credential revocation request from the second electronic device, wherein the second electronic device is a device from which an authorization credential is to be revoked via the second secure channel;

generating a second authorization verification code;

sending, over the second secure channel, the second authorization verification code to the second electronic device;

receiving, over the first secure channel, a first authorization verification code from the first electronic device, wherein the first authorization verification code relates to the second authorization verification code;

deleting a first mapping relationship between a device identifier of the second electronic device and an authorization credential of the trusted application after determining that first authorization authentication succeeds;

subsequently setting up a second mapping relationship between a device identifier of the first electronic device and an authorization credential of the trusted application; and

sending, over the first secure channel, the authorization credential of the trusted application to the first electronic device.

18. The method of claim 17 , wherein the first authorization verification code is the same as the second authorization verification code.

19. The method of claim 17 , wherein the authorization credential immigration request comprises a device identifier of the first electronic device, an SE identifier of the first electronic device, an application identifier of the trusted application, and personal information of a user.

20. The method of claim 19 , wherein generating the second authorization verification code comprises generating the second authorization verification code based on the device identifier of the first electronic device and a random number.