Advanced New Technologies Co., Ltd.

Alibaba Group Holding Limited

Hongwei Luo

Xi Sun

Xin Wang

Chen Gu

The present specification discloses a service authorization method, apparatus and device. In one aspect, the method includes: obtaining, by a first execution unit that runs in a first security environment, information to be verified; generating, by the first execution unit that runs in the first security environment, a verification result of the information to be verified; signing, by the first execution unit that runs in the first security environment, the verification result using a signature verification private key to provide signature information; obtaining, by a second execution unit that runs in a second security environment, the signature information from the first execution unit; verifying, by the second execution unit that runs in the second security environment, the signature information using a signature verification public key corresponding to the signature verification private key; and in response to verifying the signature information, performing service authorization based on the verification result.

Verification-based service authorization

The present application provides an unlocking solution. In this solution, after obtaining a digital key seed, a user mobile device can generate a digital key for multiple times by using the digital key seed and first check data corresponding to a current unlocking operation, and then send the digital key to a smart door lock for verification and unlocking. Because the digital key includes the first check data only corresponding to the current unlocking operation, an attacker cannot use the digital key to perform unlocking again even if the attacker obtains the digital key. In addition, because the digital key seed can be used for multiple times, a smart door lock server does not need to be connected each time to obtain the digital key. Therefore, both security and ease of use are satisfied.

Secure smart unlocking

One embodiment provides a system and method for sharing a security application. During operation, the security application receives a service key associated with a first application executed on a terminal device. The security application resides in a secure element within the terminal device. The security application receives service data associated with the first application; processes the service data based on the service key; and returns the processed service data to the first application, thereby facilitating the first application in performing service based on the processed service data.

Method and mobile terminal of sharing security application in mobile terminal

One embodiment provides a system and method for providing secure identity information. During operation, the system scans a graphic code associated with the service provider to obtain coded information; queries a registration platform based on the coded information to obtain an identifier of the service provider, an encryption key of the service provider, and a user-identity-information requirement associated with the service provider; obtains identity information of the user; obtains verified identity information from a verification source based on the identity information of the user; generates secure identity information for the user by encrypting, using the encryption key, at least the verified identity information, the secure identify information comprising the identifier of the service provider; and sends the secure identity information to the registration platform, thereby allowing the registration platform to forward the encrypted verified identity information to the service provider.

Method and apparatus for providing and obtaining secure identity information

One embodiment provides a key transfer system and method based on a shared security application. During operation, an application executing on a terminal device receives an application key comprising at least a service key from a management server of the application and forwards the application key to a management server of a shared security application residing in a secure element in the terminal device, thereby facilitating the management server of the shared security application to deliver the application key to the shared security application. The application invokes the application key stored in the shared security application to perform services associated with the application. The application key is isolated from other application keys associated with other applications stored in the shared security application.

Key transfer method and system based on shared security application, storage medium, and device thereof

Techniques for generating and processing two-dimensional barcodes are described. One example method includes identifying original content to be encoded in a two-dimensional (2D) barcode structure; and generating a 2D barcode associated with the original content based on at least the 2D barcode structure and the original content, wherein the 2D barcode structure includes at least an identification field and a data field, and the identification field indicates one or more data elements in the data field.

Two-dimensional code generation and processing

The present application provides a facial data collection and verification solution. In this solution, after collecting a face sample, a collection device uses the face sample and check data including a random number as to-be-signed data, performs signature by using a device private key, to obtain a facial data signature, and then obtains trusted facial data based on the to-be-signed data, the facial data signature, and a digital certificate that includes a device public key. When performing verification on the trusted facial data, a facial recognition server sequentially performs verification on the digital certificate that includes the device public key, the facial data signature, and the check data. Because content used for the verification process is added for the face sample on the collection device, subsequent verification cannot succeed if a transmitted communication packet is replaced by an attacker. Therefore, a replay attack is prevented at the collection source.

Facial data collection and verification

A computer-implemented method includes: obtaining, by an application client executing on a terminal, a display request; and controlling, based on the display request, a display screen of the terminal to simultaneously display a scanning region and a first identification code in an interface, in which the first identification code stores information corresponding to a user of the terminal, in which the scanning region displays a second identification code scanned by a camera of the terminal, and in which the second identification code is usable by the terminal to perform operations based on the second identification code.

Growing community of inventors

Hangzhou, China

Hongwei Luo