Method of processing secure data and electronic device supporting the same
According to certain embodiments, an electronic device comprises: a memory storing an interface and an application; a processor; and a secure module physically separated from the processor and including a secure processor and a secure memory, wherein the processor is configured to: obtain user authentication information, through the interface; attempt user authentication, based on the user authentication information; obtain data stored in the secure memory when the user authentication succeeds; store a first token including a first valid duration for an access to the secure memory, the obtained data, and a first key value for decoding the obtained data in a buffer; and delete the first token and the first key value from the buffer when the first valid duration expires.
1. An electronic device comprising:
a memory storing instructions;
a processor; and
a secure module physically separated from the processor and including a secure processor and a secure memory,
wherein the execution of the instructions by the processor causes the electronic device to:
obtain user authentication information, through an interface of a user authentication framework operating in a first execution environment, wherein the first execution environment is provided by the processor;
based on the user authentication information, attempt user authentication, through a trusted application operating in a second execution environment, wherein the second execution environment is provided by the processor;
when the user authentication succeeds, obtain data from the secure memory through a secure application operating in a third execution environment based on a request sent from the trusted application to the secure application, wherein the third execution environment is provided by the secure processor;
encrypt the obtained data from the secure memory according to a first key value;
store a first token including a first valid duration for an access to the secure memory, the encrypted obtained data, and the first key value for decrypting the encrypted data in a buffer included in the second execution environment; and
delete the first token and the first key value from the buffer when the first valid duration expires,
wherein a first secure level of the second execution environment is higher than a normal secure level of the first execution environment and lower than a second level of the third execution environment.
2. The electronic device of claim 1 , wherein the processor is configured to:
verify whether the first token is present in the buffer, upon receiving the request for the data stored in the secure memory from the trusted application; and
send a signal declining the request for the data to the trusted application when the buffer does not store the first token.
3. The electronic device of claim 2 , wherein the processor is configured to:
verify the first valid duration included in the first token when the first token is present in the buffer;
decrypt the encrypted obtained data stored in the buffer by using the first key value, when the first valid duration is verified; and
transfer the decrypted data to the trusted application.
4. The electronic device of claim 1 , wherein the processor is configured to:
after the first token and the first key value are deleted from the buffer, obtain user authentication information through the interface;
attempt user authentication, based on the obtained user authentication information; and
store a second token including a second valid duration for an access to the secure memory and a second key value for decrypting the encrypted obtained data in the buffer, when the attempted user authentication succeeds.
5. The electronic device of claim 1 , wherein the processor is configured to:
verify whether the first token is present in the buffer upon receiving a signal requesting to write data to the secure memory from the trusted application; and
send a signal declining writing the data to the trusted application, when the first token is absent in the buffer.
6. The electronic device of claim 5 , wherein the processor is configured to:
verify the first valid duration included in the first token, when the first token is present in the buffer;
store the data in the buffer, when the first valid duration is verified; and
write the data stored in the buffer to the secure memory.
7. An electronic device comprising:
a memory storing an application;
a processor; and
a secure module physically separated from the processor and including a secure memory and a secure processor,
wherein the processor is configured to:
receive a signal requesting data stored in the secure memory;
attempt user authentication, in response to receiving of the signal in a first execution environment provided by the processor;
based on user authentication information. attempt user authentication through a trusted application operating in a second execution environment provided by the processor;
when the user authentication succeeds, verify a valid duration for an access to the secure memory and obtain data from the secure memory through a secure application operating in a third execution environment based on a request sent from the trusted application to the secure application. wherein the third execution environment is provided by the secure processor;
send a signal declining a request for the data to the processor when the valid duration is not verified; and
send the data stored in a buffer when the valid duration is verified, wherein the data stored in the buffer is encrypted and sending the data comprises decrypting the data,
wherein a first secure level of the second execution environment is higher than a normal secure level of the first execution environment and lower than a second level of the third execution environment.
8. A method of processing secure data of an electronic device, the method comprising:
obtaining user authentication information, through an interface of a user authentication framework operating in a first execution environment, wherein the first execution environment is provided by a processor;
based on the user authentication information, attempt user authentication, through a trusted application operating in a second execution environment, wherein the second execution environment is provided by the processor;
when the user authentication succeeds, obtaining the secure data from a secure memory included in a secure module physically separated from a processor of the electronic device, through a secure application operating in a third execution environment based on a request sent from the trusted application to the secure application, wherein the third execution environment is provided by a secure processor;
encrypting the secure data obtained form the secure memory according to a first key value;
storing a first token including a first valid duration for an access to the secure memory, the encrypted secure data, and the first key value for decrypting the encrypted secure data in a buffer included in the second execution environment; and
deleting the first token and the first key value from the buffer when the first valid duration expires,
wherein a first secure level of the second execution environment is higher than a normal secure level of the first execution environment and lower than a second level of the third execution environment.
9. The method of claim 8 , further comprising:
verifying whether the first token is present in the buffer, upon receiving a signal requesting the secure data from an application; and
sending a signal declining the request for the secure data to the application when the first token is absent in the buffer.
10. The method of claim 9 , further comprising:
verifying the first valid duration included in the first token when the first token is present in the buffer;
decrypting the secure data stored in the buffer by using the first key value, when the first valid duration is verified; and
transferring the decrypted secure data to the application.
11. The method of claim 8 , further comprising:
after the first token and the first key value are deleted from the buffer, obtaining user authentication information;
attempting user authentication, based on the obtained user authentication information; and
storing a second token including a second valid duration for an access to the secure memory and a second key value for decrypting the secure data in the buffer, when the user authentication succeeds.
12. The method of claim 8 , further comprising:
verifying whether the first token is present in the buffer upon receiving from an application a signal requesting to write data in the secure memory; and
sending to the application a signal declining to write the data, when the first token is absent in the buffer.
13. The method of claim 12 , further comprising:
verifying the first valid duration included in the first token, when the first token is present in the buffer;
writing the data in the buffer, when the first valid duration is verified; and
writing the data stored in the buffer to the secure memory.
14. The electronic device of claim 1 , wherein the secure application is at least one of a user authentication application and an access control application.
15. The electronic device of claim 1 , wherein the trusted application processes the obtained data from the secure application.