ELECTRONIC DEVICE FOR PROTECTING USER'S BIOMETRIC INFORMATION

An electronic device is provided. The electronic device includes a biometric sensor, a processor connected to the biometric sensor, a first memory connected to the processor and configured to store a first virtual machine comprising a first application, a second application which can access the biometric sensor, and a biometric authentication application for performing a biometric authentication using biometric information, and a second memory connected to the processor and divided into a general area and a secure area providing a trusted execution environment in which access by software executed in the general execution environment can be controlled. The second memory stores instructions causing the processor to, when executed by the processor, load the first application to the general area from the first memory and execute the first application, load the first virtual machine to the general area from the first memory and execute the first virtual machine.

TECHNICAL FIELD

The disclosure relates to a technology for protecting a user's biometric information used for a user authentication in an electronic device.

BACKGROUND ART

An electronic device may acquire a user's biometric information from a sensor (for example, a fingerprint sensor or an image sensor) and perform online commercial transaction, financial transaction, or a user authentication for verifying user's identity on the basis of the acquired biometric information. The electronic device may protect the user's biometric information from hacking. For example, the electronic device may assign a right to read the acquired biometric information to an application for the user authentication and block access to the biometric information by other applications which are irrelevant to the user authentication.

DISCLOSURE

Technical Problem

Hardware (for example, a processor and a memory) of an electronic device may be divided into a secure area and a general area (or a non-secure area). In the secure area, a trusted execution environment (TEE) may be provided. In the general area, a general execution environment (rich execution environment) (or a non-trusted execution environment (non-TEE)) may be provided. The TEE (for example, TrustZone between arms) of the electronic device may safely protect biometric information from the general execution environment by controlling access of an application executed in the general execution environment to the biometric information. However, since the TEE is restrictively involved in protection of biometric information only in a part allocated as the secure area rather than whole the hardware, the given performance of the hardware may not be optimized for the user authentication. Particularly, as the user authentication using biometric information has advanced, an amount of data which should be processed becomes larger and a processing scheme may become complex. Accordingly, it is required to show greater performance of hardware in order to perform the user authentication.

A virtual machine (VM) may provide a computing environment independent from a general operating system (OS) of the electronic device.

Aspects of the disclosure are to address at least the above-mentioned problems and/or disadvantages and to provide at least the advantages described below. Accordingly, an aspect of the disclosure is to provide an electronic device capable of showing greater performance of hardware by performing the user authentication using the virtual machine and safely protecting biometric information by controlling access of the VM to the biometric information.

The technical subjects pursued in the disclosure may not be limited to the above mentioned technical subjects, and other technical subjects which are not mentioned may be clearly understood, through the following descriptions, by those skilled in the art of the disclosure.

Technical Solution

In accordance with an aspect of the disclosure, an electronic device is provided. The electronic device includes a biometric sensor, a processor connected to the biometric sensor, a first memory connected to the processor and configured to store a first virtual machine including a first application, a second application which can access the biometric sensor, and a biometric authentication application for performing a biometric authentication using biometric information acquired by the second application, and a second memory connected to the processor and divided into a general area providing a general execution environment and a secure area providing a trusted execution environment in which access by software executed in the general execution environment can be controlled. The second memory stores instructions causing the processor to, when executed by the processor, load the first application to the general area from the first memory and execute the first application, load the first virtual machine to the general area from the first memory and execute the first virtual machine in response to a request for the biometric authentication of the first application, allow the first virtual machine to access the trusted execution environment, based on a predetermined allowed virtual machine list, load the second application to the secure area from the first memory and execute the second application, so as to acquire biometric information from the biometric sensor and perform the biometric authentication by using the acquired biometric information, and transmit a result of the biometric authentication performed by the second application to the first application through the first virtual machine allowed to access the trusted execution screen.

In accordance with another aspect of the disclosure, a method of operating an electronic device is provided. The method includes loading a first application to a general area of a second memory providing a general execution environment from a first memory of the electronic device and executing the first application by a processor of the electronic device, loading a first virtual machine performing a biometric authentication to the general area from the first memory and executing the first virtual machine, based on a request for the biometric authentication of the first application, allowing the first virtual machine to access a trusted execution environment in which access by software executed in the general execution environment can be controlled, based on a predetermined allowed virtual machine list, loading a second application which can access a biometric sensor of the electronic device to a secure area of the second memory providing the trusted execution environment from the first memory and executing the second application, so as to acquire biometric information from the biometric sensor and perform the biometric authentication using the acquired biometric information by the second application, and transmitting a result of the biometric authentication performed by the second application to the first application through the first virtual machine allowed to access the trusted execution environment.

Another aspect of the disclosure provides a recording medium storing instructions that can be read by the processor of the electronic device. The instructions cause the processor to, when executed by the processor, load a first application to a general area of a second memory providing a general execution environment from a first memory of the electronic device and execute the first application, load a first virtual machine performing a biometric authentication to the general area from the first memory and execute the first virtual machine, based on a request for the biometric authentication of the first application, allow the first virtual machine to access a trusted execution environment in which access by software executed in the general execution environment can be controlled, based on a predetermined allowed virtual machine list, load a second application which can access a biometric sensor of the electronic device to a secure area of the second memory providing the trusted execution environment from the first memory and execute the second application, so as to acquire biometric information from the biometric sensor and perform the biometric authentication using the acquired biometric information by the second application, and transmit a result of the biometric authentication performed by the second application to the first application through the first virtual machine allowed to access the trusted execution environment.

Advantageous Effects

According to various aspects of the disclosure, the electronic device can have larger performance of hardware by performing the user authentication through the VM and safely protect biometric information by controlling access of the VM to the biometric information. Further, various effects directly or indirectly detected through the disclosure can be provided.

MODE FOR INVENTION

FIG.2is a block diagram illustrating a program according to an embodiment of the disclosure.

Referring toFIG.2depicting block diagram200, according to an embodiment, a program140may include an operating system (OS)142to control one or more resources of an electronic device101, middleware144, or an application146executable in the OS142. The OS142may include, for example, Android™, iOS™, Windows™, Symbian™, Tizen™, or Bada™. At least part of the program140, for example, may be pre-loaded on the electronic device101during manufacture, or may be downloaded from or updated by an external electronic device (e.g., the electronic device102or104, or the server108) during use by a user.

The OS142may control management (e.g., allocating or deallocation) of one or more system resources (e.g., process, memory, or power source) of the electronic device101. The OS142, additionally or alternatively, may include one or more driver programs to drive other hardware devices of the electronic device101, for example, the input module150, the sound output module155, the display module160, the audio module170, the sensor module176, the interface177, the haptic module179, the camera module180, the power management module188, the battery189, the communication module190, the subscriber identification module196, or the antenna module197.

The middleware144may provide various functions to the application146such that a function or information provided from one or more resources of the electronic device101may be used by the application146. The middleware144may include, for example, an application manager201, a window manager203, a multimedia manager205, a resource manager207, a power manager209, a database manager211, a package manager213, a connectivity manager215, a notification manager217, a location manager219, a graphic manager221, a security manager223, a telephony manager225, or a voice recognition manager227.

The application manager201, for example, may manage the life cycle of the application146. The window manager203, for example, may manage one or more graphical user interface (GUI) resources that are used on a screen. The multimedia manager205, for example, may identify one or more formats to be used to play media files, and may encode or decode a corresponding one of the media files using a codec appropriate for a corresponding format selected from the one or more formats. The resource manager207, for example, may manage the source code of the application146or a memory space of the memory130. The power manager209, for example, may manage the capacity, temperature, or power of the battery189, and determine or provide related information to be used for the operation of the electronic device101based at least in part on corresponding information of the capacity, temperature, or power of the battery189. According to an embodiment, the power manager209may interwork with a basic input/output system (BIOS) (not shown) of the electronic device101.

The database manager211, for example, may generate, search, or change a database to be used by the application146. The package manager213, for example, may manage installation or update of an application that is distributed in the form of a package file. The connectivity manager215, for example, may manage a wireless connection or a direct connection between the electronic device101and the external electronic device. The notification manager217, for example, may provide a function to notify a user of an occurrence of a specified event (e.g., an incoming call, message, or alert). The location manager219, for example, may manage locational information on the electronic device101. The graphic manager221, for example, may manage one or more graphic effects to be offered to a user or a user interface related to the one or more graphic effects.

The security manager223, for example, may provide system security or user authentication. The telephony manager225, for example, may manage a voice call function or a video call function provided by the electronic device101. The voice recognition manager227, for example, may transmit a user's voice data to the server108, and receive, from the server108, a command corresponding to a function to be executed on the electronic device101based at least in part on the voice data, or text data converted based at least in part on the voice data. According to an embodiment, the middleware244may dynamically delete some existing components or add new components. According to an embodiment, at least part of the middleware144may be included as part of the OS142or may be implemented as another software separate from the OS142.

The application146may include, for example, a home251, dialer253, short message service (SMS)/multimedia messaging service (MMS)255, instant message (IM)257, browser259, camera261, alarm263, contact265, voice recognition267, email269, calendar271, media player273, album275, watch277, health279(e.g., for measuring the degree of workout or biometric information, such as blood sugar), or environmental information281(e.g., for measuring air pressure, humidity, or temperature information) application. According to an embodiment, the application146may further include an information exchanging application (not shown) that is capable of supporting information exchange between the electronic device101and the external electronic device. The information exchange application, for example, may include a notification relay application adapted to transfer designated information (e.g., a call, message, or alert) to the external electronic device or a device management application adapted to manage the external electronic device. The notification relay application may transfer notification information corresponding to an occurrence of a specified event (e.g., receipt of an email) at another application (e.g., the email application269) of the electronic device101to the external electronic device. Additionally or alternatively, the notification relay application may receive notification information from the external electronic device and provide the notification information to a user of the electronic device101.

The device management application may control the power (e.g., turn-on or turn-off) or the function (e.g., adjustment of brightness, resolution, or focus) of the external electronic device or some component thereof (e.g., a display module or a camera module of the external electronic device). The device management application, additionally or alternatively, may support installation, delete, or update of an application running on the external electronic device.

FIG.3illustrates a hierarchical architecture of an electronic device300according to an embodiment of the disclosure. In a description ofFIG.3, the description for elements overlapping those inFIG.2are omitted or simplified.

Referring toFIG.3, an electronic device300(for example, an electronic device101ofFIG.1) may include software301and hardware302. The software301may include a non-TEE310, a TEE320, and a monitor330. The hardware302may include a memory303, a sensor340, and a security hardware350. The memory303may include a nonvolatile memory360and a volatile memory370. The software301(for example, the program140ofFIG.1or2) may be stored as instructions in the nonvolatile memory360(for example, the non-volatile memory134ofFIG.1) and loaded to the volatile memory370(for example, the volatile memory132ofFIG.1) and execute by at least one processor120. The nonvolatile memory360may include a secure area361, a common area362, and a general area363. The volatile memory370may include a secure area371, a common area372, and a general area373. In an embodiment, the common area362may be omitted in the nonvolatile memory360, and thus the nonvolatile memory360may include the secure area361and the general area363. Although not illustrated, the electronic device300may further include at least one processor120configured to execute the software301as an element, and environments for executing the non-TEE310and the TEE320may be separated from one processor120or may be included in different processors120. Hereinafter, the operation of the element the illustrated software301may be understood as the operation of at least one processor120. Hereinafter, for convenience of description, at least one processor120is referred to as the ‘processor120’.

The non-TEE310may be installed in the general area363and/or the common area362of the nonvolatile memory360. The non-TEE310may be loaded to the general area373and/or the common area372of the volatile memory370in the area of the installed nonvolatile memory360and executed by the processor120. The non-TEE310may include an application311, virtual machines312aand312b, and a host OS313.

The virtual machines312aand312bmay emulate a computing environment in software. For example, the virtual machines312aand312bmay operate as electronic devices separate from the electronic device300by using an area allocated to the virtual machines in the hardware302(for example, some of the general area and/or the common area of the memory303). Software may be installed in the virtual machines312aand312b. For example, software (for example, an application) for a biometric authentication may be installed in the first virtual machine312a. A general OS and/or a trusted OS may be installed in the first virtual machine312a. For example, the general OS for performing an operation requiring high performance in operations for the biometric authentication and/or the trusted OS for performing an operation requiring security of biometric information in the biometric authentication may be installed in the first virtual machine312a. In another example, the trusted OS for performing all operations related to the biometric authentication may be installed in the first virtual machine312a. A guest OS (or a non-trusted OS or the general OS) may be installed in the second virtual machine312b. The application311and the host OS313may be installed in the nonvolatile memory360and loaded to the volatile memory370and executed. The host OS313may include a first virtual machine manager314for managing access of the virtual machine to the TEE320. The first virtual machine manager314may be included in a software layer (for example, the middleware144ofFIG.1orFIG.2) executed on the basis of the host OS313. The host OS may include, for example, Android™, iOS™, Windows™, Symbian™, Tizen™, or Bada™. The same type operating system as or a different type operating system from the host OS313may be applied to the guest OS installed in the second virtual machine312band/or the general OS installed in the first virtual machine312a.

The TEE320may be installed in the secure area361and/or the common area362of the nonvolatile memory360. The TEE320may be loaded to the secure area371and/or the common area372of the volatile memory132from the area of the installed nonvolatile memory360and executed by the processor120. The trusted OS321, the second virtual machine manager322, and one or more applications (e.g., applets323a,323b, and323c) may be executed in the TEE320. The trusted OS (or secure OS)321may provide an environment in which elements included in the TEE320can operate. For example, the trusted OS may provide an interface required for the user authentication. An application programming interface (API) for allowing at least one of the applets323a,323b, and323c, the sensor340, the security hardware350, and/or the secure area of the memory303to be used. As an example of the trusted OS, an OS for Internet banking or electronic payment may be included in the trusted OS321. The trusted OS321may include the second virtual machine manager322. In another example, the second virtual machine manager322may be implemented as separate software independent from the trusted OS321.

The monitor330may be installed in at least one of the secure area361, the common area362, and the general area363of the nonvolatile memory360. The monitor330may be loaded to the secure area371and/or the common area372of the volatile memory370from the area of the installed nonvolatile memory360and executed by the processor120. The monitor330may relay or control communication between the non-TEE310and the TEE320. The non-TEE310cannot directly access the TEE320(for example, read data from the TEE320) and may be configured to access the TEE320through the monitor330. For example, the TrustZone technology of the Advanced reduced instruction set computer (RISC) Machine (ARM) may be applied to the monitor330.

The application311(for example, the application146ofFIG.1orFIG.2) may provide the user with a function or a service requiring the user authentication. For example, the application311may be an application that provides an online service (for example, contact-free issue of a credit card, financial transaction, or a digital car key for starting a rented car or a shared car) through communication with an external device (for example, the server108ofFIG.1). The application311may be an application that provides an offline service (for example, an identification service for purchasing products (for example, cigarette) in an offline shop). The application311may include an application preloaded to the electronic device300and/or an application installed after download. The application311according to various embodiments of the disclosure has no limitation in the type thereof if the application includes a function related to the user authentication.

The user authentication conducted by the electronic device101may be divided into a primary authentication and a secondary authentication. The application311may support the primary authentication. The application311may support the secondary authentication (or biometric authentication) of biometric information for providing a function or a service after the primary user authentication is successful. For example, the application311may output a user interface (UI) for inducing the user to input user information. For example, the application311may support the primary authentication by providing the user with a screen (for example, lock screen) displayed on the display of the electronic device101. A primary authentication application (for example, applet1323a) within the TEE320may receive user information (for example, pin, pattern, or password) from the user through the hardware302(for example, a touch sensor) and compare the received user information with user information stored in the memory, so as to perform the primary authentication. When the two pieces of user information match and the primary authentication is successful, the application311may make a request for the secondary authentication to a secondary authentication application (for example, the first virtual machine312a) through the first virtual machine manager314.

The first virtual machine manager314(for example, a hypervisor or a virtual machine monitor) may control the access of the virtual machines312aand312bto the TEE320.

In an embodiment, the first virtual machine manager314may transmit a request of the application311(for example, a biometric authentication request) to the virtual machine (for example, the first virtual machine312a). After the request is transmitted to the virtual machine, the first virtual machine manager314may receive a request for accessing the TEE320from the virtual machine. An allowed virtual machine (VM) list may be stored in the memory303. The first virtual machine manager314may determine whether to allow the corresponding virtual machine to access the TEE320with reference to the allowed virtual machine list380. The allowed virtual machine list380according to an embodiment may be stored in the secure area361of the nonvolatile memory360. Although not illustrated, some or all of the allowed virtual machine list380may be stored in the common area362of the nonvolatile memory360. The allowed virtual machine list380may be encrypted and stored in the secure area361and/or the common area362. The allowed virtual machine list380may be loaded to the secure area371and/or the common area372of the volatile memory370from the stored area of the nonvolatile memory360. When the allowed virtual machine list380is encrypted, the allowed virtual machine list may be decrypted by the processor120and loaded to the volatile memory370. A right to access the allowed virtual machine list380loaded to the volatile memory370may be assigned to the first virtual machine manager314by the monitor330. When the virtual machine having made the request for access (for example, VM1312a) is recorded as a virtual machine having a right to access the TEE320in the allowed virtual machine list380, the first virtual machine manager314may allow the virtual machine having made the request for access to access the TEE320. The virtual machine allowed to access may read data which the application executed in the TEE320acquired from the hardware302.

In an embodiment, the first virtual machine manager314may receive, from the virtual machine, a request for accessing a security application (for example, the second applet323b) configured to acquire biometric information (for example, a fingerprint, iris, or a face) among the applications which can be executed in the TEE320. The first virtual machine manager314may determine whether to allow the corresponding virtual machine to access the security application with reference to the allowed virtual machine list380. When the virtual machine (for example, VM1312a) having made the request for accessing is recorded as a virtual machine having a right to access the security application in the allowed virtual machine list380, the first virtual machine manager314may allow the virtual machine having made the request for accessing to access the security application. The virtual machine allowed to access may read data which the security application acquired from the hardware302(for example, the sensor340).

The second virtual machine manager322may control access of the virtual machines312aand312bto the TEE320on behalf of or in addition to the first virtual machine manager314.

The sensor340may include a fingerprint sensor and/or an image sensor which the security application accesses to acquire biometric information. The security hardware350may include a processor specialized in security (for example, embedded secure element (eSE) or a secure processor). In an embodiment, the security hardware350may control access of the application within the TEE320to the sensor340. For example, the security hardware350may receive a request for accessing the sensor340from the application (for example, the second applet323b). An allowed application list381may be stored in the memory303. The security hardware350may determine whether to allow access to the sensor340with reference to the allowed application list381. The allowed application list381may be stored in the secure area361of the nonvolatile memory360. Although not illustrated, some or all of the allowed application list381may be stored in the common area362of the nonvolatile memory360. The allowed application list381may be encrypted and stored in the secure area361and/or the common area362. The allowed application list381may be loaded to the secure area371of the volatile memory370from the stored area of the nonvolatile memory360. When the allowed application list381is encrypted, the allowed application may be decrypted by the processor120and then loaded to the volatile memory370. The right to access the allowed application list381loaded to the volatile memory370may be assigned to the security hardware350. When the application having made the request for access is recorded as an application having a right to access the sensor340in the allowed application list381, the security hardware350may allow the application having made the request for accessing to access the sensor340. The application allowed to access may acquire biometric information from data generated by the sensor340.

FIG.4illustrates a biometric information protection method using a memory access control module and an address conversion module according to an embodiment of the disclosure.

When the electronic device is booted, the memory access control module410may be loaded to the volatile memory132(for example, the secure area) and executed by the processor120. The memory access control module410may configure a right to access the memory by elements of the electronic device for each physical address area (or each logical address area) of the memory in which data can be read and written. For example, the memory access control module410may configure a first general address area431as an address area which the application311and VM2312bcan access in the general area of the volatile memory132. The memory access control module410may configure a first secure address area441as an address area which the sensor340and the security hardware350can access in the secure area of the volatile memory132. The memory access control module410may configure a second secure address area442as an address area which VM1312afor the biometric authentication can access in the secure area of the volatile memory132.

When the electronic device is booted, the address conversion module420may be loaded to the volatile memory370(for example, the secure area or the common area) and executed by the processor120. The address conversion module420may provide the relation between addresses in the secure area of the volatile memory132and the relation between addresses in the general area of the volatile memory132. For example, the address conversion module420may operate on the basis of an address conversion table. There is no limitation in the form of the address conversion module420. For example, the address conversion module420may be the address conversion table itself stored in the memory130. For example, at least one module referring to the address conversion table may access an address of the memory in which the address conversion table is stored and read address conversion data. An intermediate physical address (IPA) and a physical address (PA) related thereto may be mapped and stored in the address conversion table. For example, the security hardware350may identify the relation (A) between the intermediate physical addresses (IPAs) of the first secure address area441and the physical addresses (PAs) of the third secure address area443through the address conversion module420. The security hardware350may access data in the third secure address area443through the relation (A). The sensor340may identify the relation (B) between IPAs of the first secure address area441and PAs of the fourth secure address area444through the address conversion module420. The sensor340may write data (for example, biometric information) in the fourth secure address area444. VM1312amay identify the relation (C) between IPAs of the second secure address area442and PAs of the fourth secure address area444through the address conversion module420. VM1312amay read data recorded by the sensor340through the relation (C). According to an embodiment, the relation (D) between IPAs of the first general address area431and PAs of the second general address area432may be additionally included in the address conversion module420.

According to an embodiment, VM1312amay read the data, which the sensor340records in the PA through the relation (B), through the relation (C). Other elements (e.g., application311and VM2312b) which cannot know the relation (C) cannot read sensor data, and accordingly, the sensor data (for example, biometric information) cannot be safely protected from the elements to which no access right is assigned.

FIG.5illustrates a biometric authentication process in the hierarchical architecture of electronic device according to an embodiment of the disclosure.

The application311may call a biometric authentication application by using an application programming interface (API) or a software development kit (SDK) provided by the non-trusted OS installed in VM2312b. For example, the application311may receive a user input that calls a graphic element (for example, a user interface (UI) element) for inducing the user to input biometric information on the display through an input device. For example, a button for calling a function using the biometric information may be displayed on the display, and the application311may receive a user's touch input for the menu displayed on the display. The application311may display the UI element on the display in response to the user input. For example, when the biometric authentication of the electronic device300uses a fingerprint, the application311may display a UI element (for example, a UI element920ofFIG.9described below) including an image embodying the fingerprint. Alternatively, when the biometric authentication uses iris or a face, the application311may display a UI element including a preview image (or an image embodying pupil or a face) captured by a camera disposed on the same surface as the display. According to an embodiment, the application311may transmit a biometric authentication request message501indicating calling of the biometric authentication application to VM2312bin response to the user call for the UI element (for example, a touch input for the UI element).

VM2312bmay transmit the biometric authentication request message501to a first VM manager314. The first VM manager314may receive the biometric authentication request message501and transmit a biometric authentication function call message502to VM1312ain which the biometric authentication application is installed in response thereto. For example, when VM1312ais not being executed, the first VM manager314may execute VM1312a. For example, the processor120may load VM1312ato the non-TEE310of the volatile memory132from the non-volatile memory134and execute the same. In an embodiment, when receiving the biometric authentication request message501, the first VM manager314may determine whether the request is a reasonable request and, when it is determined that the request is the reasonable request, transmit the biometric authentication function call message502to VM1312a. For example, when the application generating the biometric authentication request message501and/or VM2312brelaying the biometric authentication request message501is a predetermined caller to call VM1312a, the first VM manager314may transmit the biometric authentication function call message502to VM1312a.

VM1312amay transmit a biometric authentication request message503to the TEE320through the first VM manager314on the basis of reception of the biometric authentication function call message502. VM1312amay insert encrypted biometric information (for example, biometric information stored in the secure area371) to be used for the biometric authentication into the biometric authentication request message503and transmit the message to the TEE320. The first VM manager314may perform operation520of determining whether to accept the user authentication request of VM1312aon the basis of reception of the biometric authentication request message503from VM1312a. For example, the first VM manager314may identify VM1312ain the allowed virtual machine list380loaded to the volatile memory370and accordingly may allow VM1312ato access the TEE320(or the trusted OS321). In another example, among the applications within the TEE320, applet2323bmay be configured to perform the user authentication. The first VM manager314may identify that VM1312ais a virtual machine having a right to access applet2323bin the allowed virtual machine list380and accordingly may allow VM1312ato access the TEE320. The first VM manager314may safely protect biometric information by controlling access to the TEE320by elements (for example, other virtual machines) to which the right to access the TEE320is not assigned.

When the biometric authentication request of VM1312ais allowed on the basis of the result of operation520, the first VM manager314may transmit the biometric authentication request message503to the TEE320. For example, the first VM manager314may first call the monitor330. When the monitor330is not being executed, the processor120may load the monitor330to the secure area371of the volatile memory370from the nonvolatile memory360and execute the same as the first VM manager314calls the monitor330. The monitor330may transmit the biometric authentication request message503of VM1312ato the second VM manager322of the TEE320.

The second VM manager322may perform operation530of determining whether to accept the biometric authentication request of VM1312aon the basis of the allowed virtual machine list380on behalf of or in addition to the first VM manager314. When the biometric authentication request of VM1312ais allowed on the basis of the result of operation530, the second VM manager322may transmit the biometric authentication request message503to the trusted OS321. The trusted OS321may transmit the biometric authentication request message503to applet2323bserving to perform the biometric authentication.

Applet2323bmay receive the biometric authentication request message503through the trusted OS321. Applet2323bmay transmit a message504making a request for acquiring biometric information from the sensor340to the trusted OS321in response to reception of the biometric authentication request message503. The second VM manager322may configure the trusted OS321to access the sensor340. The trusted OS321to which the right to access the sensor340is assigned may determine whether applet2323bcan access the biometric information acquired by the sensor340. For example, the trusted OS321may identify applet2323bin the allowed application list381loaded to the secure area371. Accordingly, the trusted OS321may transmit the request message505making a request for acquiring biometric information to the sensor340. The sensor340may generate biometric information (for example, fingerprint data). The sensor340may transmit a response message506including the generated biometric information to the trusted OS321in response to reception of the request message505. The trusted OS321may acquire biometric information from the response message506and transmit a response message507including the acquired biometric information to applet2323b.

Applet2323bmay acquire encrypted biometric information from the biometric authentication request message503. In an embodiment, applet2323bmay decrypt the acquired encrypted biometric information. In another embodiment, applet2323bmay transmit a message508making a request for decrypting the acquired encrypted biometric information to the trusted OS321. The second VM manager322may configure the trusted OS321to access the security hardware350. The trusted OS321to which the right to access the security hardware350is assigned may transmit a request message509making a request for decrypting the encrypted biometric information to the security hardware350. The security hardware350may decrypt the encrypted biometric information in response to reception of the request message509and transmit a response message510including the decrypted biometric information to the trusted OS321. The trusted OS321may acquire biometric information from the response message510and transmit a response message511including the acquired biometric information to applet2323b.

Applet2323bmay compare the biometric information that is received from VM1312aand decrypted (hereinafter, referred to as first biometric information) with the biometric information acquired from the sensor340(hereinafter, referred to as second biometric information) and generate an authentication result indicating whether the second biometric information is valid on the basis of the comparison result. Applet2323bmay transmit a response message512including the authentication result to the trusted OS321. In addition, applet2323bmay further insert the second biometric information into a response message512and transmit the message to the trusted OS321in order to verify the authentication result. The trusted OS321may transmit the response message512to the second VM manager322. The second VM manager322may transmit the response message512to the first VM manager314through the monitor330. The first VM manager314may transmit the response message512received from the TEE320to VM1312ain response to the biometric authentication request of VM1312a. VM1312amay transmit a response message513including the authentication result to the application311through the first VM manager314and VM2312b. In an embodiment, the authentication result to be transmitted to the application311may be the same as the authentication result received from applet2323b. In another embodiment, VM1312amay re-identify validity of the second biometric information by comparing the second biometric information received from applet2323bwith the first biometric information. When the second biometric information is valid, VM1312amay transmit the response message513including the result of the authentication performed in applet2323bto the application311. According to another embodiment, other information as well as the second biometric information may be additionally used as information for authenticating the user. For example, the electronic device300may periodically collect location information related to a region including the user's home and office, and the place where the UE frequently visits through a communication circuit (for example, the wireless communication module192ofFIG.1) and store the same in the memory303. VM1312amay detect the user's location at a time point at which the biometric authentication request of the application311is made by using location-related data (for example, global positioning system (GPS) information, an IP address, and BS information) collected through the communication circuit (for example, the wireless communication module192ofFIG.1) of the electronic device300. VM1312amay compare the detected user's location with the location information stored in the memory303and determine whether the user is a person qualified to use the electronic device300. As it is proved that the user is the person qualified to use on the basis of the determination result, VM1312amay transmit the response message513including the result of the authentication performed in applet2323bto the application311.

According to an embodiment, power to control access to the data generated by the sensor340may be assigned to the security hardware350. For example, applet2323bmay make a request for allowing access to the data generated by the sensor340to the security hardware350through the trusted OS321. The security hardware350may identify that applet2323bis recorded in the allowed application list381and accordingly may assign the right to access the data generated by the sensor340to applet2323b. As the right to access is assigned, applet2323bmay receive the data generated by the sensor340from the security hardware350through the trusted OS321.

FIG.6illustrates a basic authentication process that should precede the biometric authentication in the hierarchical architecture of the electronic device according to an embodiment of the disclosure. A description overlappingFIG.5is omitted or simplified.

VM2312bmay transmit the biometric authentication request message501to the first VM manager314. The first VM manager314may perform operation601of identifying a preceding condition for the biometric authentication in response to reception of the biometric authentication request message501. For example, information indicating what the preceding condition is may be loaded to the volatile memory370, and the first VM manager314may identify that rooting (for example, the user acquires a root account which is the highest authority account of the Android OS) or the basic authentication for unlocking is the preceding condition in the loaded information.

The first VM manager314may transmit a basic authentication request message602to the TEE320through the monitor330. For example, the first VM manager314may call the monitor330for the basic authentication and transmit the basic authentication request message602. The monitor330may make a request for the basic authentication to applet1323ain response to reception of the basic authentication request message602. For example, the monitor330may access the trusted OS321through the second VM manager322(or directly), and the trusted OS321may call applet1323aconfigured to perform the basic authentication. Accordingly, applet1323amay receive the basic authentication request message602.

Applet1323amay receive user information (for example, pin, pattern, or password) which the user inputs into the electronic device through an input device610, from the trusted OS321in response to reception of the basic authentication request message602. Applet1323amay compare the received user information with the user information stored in the memory and recognize that the two pieces of information match on the basis of the comparison result, so as to succeed in the basic authentication603.

Power to control the access to user information input into the electronic device through the input device610may be assigned to the security hardware350. For example, applet1323amay make a request for allowing the access to the user information to the security hardware350through the trusted OS321. The security hardware350may identify that applet1323ais recorded in the allowed application list381and accordingly may assign the right to access the user information received through the input device610to applet1323a. As the right to access is assigned, applet1323amay receive the data received from the input device610from the security hardware350through the trusted OS321.

Applet1323amay transmit a response message604indicating the basic authentication success to the non-TEE310through the monitor330. In addition, applet1323amay process (for example, encrypt and/or perform electronic signature) the authentication result indicating the basic authentication success, insert the processing result into the response message604, and transmit the response message to the non-TEE310. The first VM manager314may receive the response message604indicating the authentication success by the TEE320through the monitor330and identify the basic authentication success. When the basic authentication is successful, the first VM manager314may transmit the biometric authentication request message705to VM1312a. VM1312amay perform the biometric authentication procedure ofFIG.5according to reception of the biometric authentication request message605.

When the basic authentication is not performed as the preceding condition for the biometric authentication after booting of the electronic device, the biometric authentication itself may not be performed, and accordingly, the biometric information can be safely protected.

FIG.7illustrates the flow of information between ends through a secure channel in the hierarchical architecture of the electronic device according to an embodiment of the disclosure. A description overlappingFIGS.5and6is omitted or simplified.

After transmitting the biometric authentication request message (for example,501ofFIG.5orFIG.6) to VM2312b, the application311may transmit an authentication result request message701making a request for informing of the result of the biometric authentication to VM2312bin order to conduct the service. According to an embodiment, when a predetermined time passes after the biometric authentication request message is transmitted, the application311may transmit the authentication result request message701. VM2312bmay transmit the authentication result request message701received from the application311to the first VM manager314.

The first VM manager314may establish a secure channel710between ends in response to reception of the authentication result request message701. For example, the first VM manager314may identify unique information indicating VM2312b(caller) having made the request for data (authentication result) and identify unique information indicating VM1312a(receiver) which can process the request801. The first VM manager314may identify that VM2unique information matches VM1unique information in an access list (for example, stored in the memory303) and accordingly may establish the secure channel710(in other words, a path or a session) through which the authentication result processed by VM1312ais transmitted to VM2312b. In an embodiment, the secure channel810may include software within the TEE320located between the two ends (e.g., VM1312aand VM2312b) to process data. For example, the secure channel810may include applet3323cfor signing and encrypting the data (for example, authentication result) received from VM1312aand transmitting the same to VM2312b.

The first VM manager314may receive the authentication result from VM1312athrough the secure channel810and transmit the authentication result to applet3323c. Applet3323cmay perform operation702of encrypting the authentication result received through the secure channel710. The first VM manager314may receive a response message including the signed and encrypted authentication result through the secure channel710and transmit the same to VM2312b. The first VM manager314may allow data transmission through the secure channel710, thereby safely protecting the data from elements (for example, VM3312c) which are not included in the secure channel710(in other words, elements which are not the caller).

FIG.8illustrates the flow of information between ends through a secure channel in the hierarchical architecture of the electronic device according to an embodiment of the disclosure. A description overlappingFIG.7is omitted or simplified.

The first VM manager314may establish a secure channel810between ends in response to reception of the authentication result request message701. In an embodiment, the secure channel810may include hardware which is located between the two ends (e.g., VM1312aand VM2312b) to store data and which can be access through the TEE320. For example, the secure channel810may include the security hardware350which stores data received from VM1312athrough the TEE320and transmits the stored data to VM2312bin response to the authentication result request message701.

The first VM manager314may receive the authentication result from VM1312athrough the secure channel810and transmit the authentication result to the security hardware350. The first VM manager314may receive a response message including the authentication result through the secure channel810and transmit the same to VM2312b. The first VM manager314may allow data transmission through the secure channel810, thereby safely protecting data from an element (for example, VM3312c) which is not included in the secure channel810.

In an embodiment, an application (for example, applet3323c) in the TEE320for signing and encrypting data stored in the security hardware350to VM2312bmay be further included in the secure channel810.

FIG.9illustrates an example of UI elements displayed on the display while the biometric authentication process is performed according to an embodiment of the disclosure.

The processor120may display an execution screen901of the application including a first UI element910for inducing the user to input user information (for example, pattern) on a touch sensitive display (for example, the display module160ofFIG.1). For example, the application311supporting the basic authentication may generate the first UI element910and display the same on the execution screen901(for example, lock screen). In another example, applet1323areceiving the basic authentication request message602may display the execution screen901including the first UI element910on the display. In another example, an OS (for example, the host OS313or the trusted OS321) receiving a request of the application may generate the first UI element910. The elements which generate the first UI element910are only examples and there is no limitation.

When the basic authentication is succeeded by the element (for example, applet1323a) serving to perform the corresponding authentication as pattern information received through the first UI element910matches pre-stored pattern information, the processor120may perform the biometric authentication process (for example, the biometric authentication process ofFIG.5). The processor120may display an execution screen902of the application including a second UI element920for inducing the user to input biometric information (for example, fingerprint) on the display. For example, the element which generates the second UI element920may be the application311, the host OS313, the trusted OS321, or applet2323b, but there is no limitation. The processor120may receive fingerprint information from a fingerprint sensor (for example, the sensor340ofFIG.3) located below the second UI element920and compare the same with pre-stored fingerprint information. The processor120may display a third UI element930(for example, a progress bar) for allowing the user to recognize that the biometric authentication is being performed while the biometric authentication process is performed using the fingerprint information received from the fingerprint sensor.

FIG.10is a flowchart illustrating operations in which the electronic device safely protects biometric information required for the biometric authentication according to an embodiment of the disclosure.

In operation1010, the processor120may load a first application (for example, the application311ofFIG.3) to a general area of a second memory (for example, the general area373of the volatile memory370ofFIG.3) provided by the non-TEE310from a first memory (for example, the nonvolatile memory360ofFIG.3) and execute the first application.

In operation1020, the processor120may load a first virtual machine (for example, VM1312aofFIG.3) to the general area of the second memory from the first memory and execute the first virtual machine on the basis of a request for the biometric authentication from the first application.

In operation1030, the processor120may allow the first virtual machine to access the TEE320on the basis of the allowed virtual machine list380. For example, as the first application makes a request for the biometric authentication, the processor120may load the allowed virtual machine list380to a secure area of the second memory (for example, the secure area371of the volatile memory370ofFIG.3) from the first memory. The processor120may identify that the first virtual machine has a right to access the trusted execution environment320in the allowed virtual machine list380.

In operation1040, the processor120may load a second application (for example, applet2323bofFIG.3) which can access a biometric sensor (for example, the sensor340ofFIG.3) to the secure area of the second memory provided by the TEE320from the first memory and execute the second application. According to execution of the second application, the biometric information (for example, the second biometric information ofFIG.5) may be acquired from the biometric sensor and temporarily stored in the secure area. In addition, the second application may compare the second biometric information acquired from the biometric sensor with the first biometric information stored in the secure area of the second memory and generate the authentication result indicating whether the second biometric information is valid on the basis of the comparison result.

In operation1050, the processor120may transmit the result of the authentication performed by the second application to the first virtual machine allowed to access the TEE320. Accordingly, the first virtual machine may transmit the authentication result to the first application. In addition, the processor120may transmit biometric information acquired from the biometric sensor to the first virtual machine along with the authentication result. Therefore, the first virtual machine may perform a re-identification operation of determining whether the authentication result of the second application is accurate by using the biometric information acquired from the biometric sensor.

In various embodiments, an electronic device (for example, the electronic device300ofFIG.3) may include a biometric sensor (for example, the sensor340ofFIG.3), a processor (for example, the processor included in the hardware302ofFIG.3) connected to the biometric sensor, a first memory (for example, the nonvolatile memory360ofFIG.3) connected to the processor and configured to store a first virtual machine (for example, the first virtual machine312aofFIG.3) including a first application, a second application which can access the biometric sensor, and a biometric authentication application for performing a biometric authentication using biometric information acquired by the second application, and a second memory (for example, the volatile memory370ofFIG.3) connected to the processor and divided into a general area providing a general execution environment (for example, the non-TEE310ofFIG.3) and a secure area providing a trusted execution environment (for example, the TEE320ofFIG.3) in which access by software executed in the general execution environment can be controlled. The second memory may store instructions causing the processor to, when executed by the processor, load the first application (for example, the application311ofFIG.3) to the general area from the first memory and execute the first application, load the first virtual machine to the general area from the first memory and execute the first virtual machine in response to a request for the biometric authentication of the first application, allow the first virtual machine to access the trusted execution environment, based on a predetermined allowed virtual machine list, load the second application (for example, applet1323aofFIG.3) to the secure area from the first memory and execute the second application, so as to acquire biometric information from the biometric sensor and perform the biometric authentication by using the acquired biometric information, and transmit a result of the biometric authentication performed by the second application to the first application through the first virtual machine allowed to access the trusted execution screen.

The first virtual machine may be configured to receive biometric information from the second application and verify the result of the biometric authentication performed by the second application by using the received biometric information.

The instructions may cause the processor to provide first biometric information stored in the second memory to the second application through the first virtual machine. The second application may be configured to compare the first biometric information with second biometric information acquired from the biometric sensor and generate an authentication result indicating whether the acquired biometric information is valid based on a comparison result.

The instructions may cause the processor to load a first virtual machine manager (for example, the first VM manager314ofFIG.3) configured to manage access of the first virtual machine to the trusted execution environment to the general area from the first memory. The first virtual machine manager may be configured to determine whether to allow the first virtual machine to access the trusted execution environment, based on the allowed virtual machine list.

The first virtual machine manager may be configured to perform an operation of determining whether to allow the first virtual machine to access the second application executed in the trusted execution environment, based on the allowed virtual machine list.

The instructions may cause the processor to load a second virtual machine manager (for example, the second VM manager322ofFIG.3) configured to manage access of the first virtual machine to the trusted execution screen to the secure area from the first memory. The second virtual machine manager may be configured to perform an operation of determining whether to allow the first virtual machine to access the trusted execution environment, based on the allowed virtual machine list.

The second virtual machine manager may be configured to perform an operation of determining whether to allow the first virtual machine to access the second application executed in the trusted execution environment, based on the allowed virtual machine list.

The electronic device may further include security hardware operatively connected to the trusted execution environment, and the security hardware may be configured to manage access of the second application to the biometric sensor.

The security hardware may be configured to receive a request for accessing the biometric sensor from the second application and allow the request for accessing with reference to a predetermined allowed application list.

The instructions may cause the processor to configure a first secure address area as an address area which the biometric sensor can access in the secure area, configure a second secure address area as an address area which the first virtual machine can access in the secure area, configure a first relation between a third secure address area and the first secure address area, and configure a second relation between the third secure address area and the second secure address area. The biometric sensor may be configured to write data in the third secure address area through the first relation. The first virtual machine may be configured to read data from the third secure address area through the second relation.

The instructions may cause the processor to load a first virtual machine manager configured to manage access of the first virtual machine to the trusted execution environment to the general area from the first memory. The first virtual machine manager may be configured to identify a basic authentication as a preceding condition, which should be performed before the biometric authentication, from information indicating the preceding condition, make a request for the basic authentication to the trusted execution environment, and identify that the basic authentication is successful from the trusted execution environment, and make a request for the biometric authentication to the first virtual machine as the basic authentication is successful.

The instructions may cause the processor load a second virtual machine operatively connected to the first application to the general area from the first memory and execute the second virtual machine, establish a channel through which an authentication result processed by the first virtual machine is transmitted to the second virtual machine, and transmit the authentication result to the second virtual machine through the channel.

The instructions may cause the processor to include an application executed in the trusted execution environment and configured to sign and/or encrypt data in the channel.

The electronic device may further include security hardware (for example, the security hardware350ofFIG.3) operatively connected to the trusted execution environment and configured to store the authentication result processed by the first virtual machine, and the instructions may cause the processor to include the security hardware in the channel.

The instructions may cause the processor to display a graphic element for making a user recognize that the biometric authentication is being performed on a display of the electronic device while the biometric authentication is performed by the first virtual machine.

In various embodiments, a method of operating an electronic device (for example, the electronic device300ofFIG.3) may include an operation of loading a first application (for example, the application311ofFIG.3) to a general area (for example, the general area373ofFIG.3) of a second memory providing a general execution environment from a first memory (for example, the nonvolatile memory360ofFIG.3) of the electronic device and executing the first application by a processor of the electronic device, an operation of loading a first virtual machine (for example, the first virtual machine312aofFIG.3) performing a biometric authentication to the general area from the first memory and executing the first virtual machine, based on a request for the biometric authentication of the first application, an operation of allowing the first virtual machine to access a trusted execution environment in which access by software executed in the general execution environment can be controlled, based on a predetermined allowed virtual machine list, an operation of loading a second application (for example, applet1323aofFIG.3) which can access a biometric sensor of the electronic device to a secure area (for example, the secure area371ofFIG.3) of the second memory providing the trusted execution environment from the first memory and executing the second application, so as to acquire biometric information from the biometric sensor and perform the biometric authentication using the acquired biometric information by the second application, and an operation of transmitting a result of the biometric authentication performed by the second application to the first application through the first virtual machine allowed to access the trusted execution environment.

Various embodiments may provide a recording medium storing instructions that can be read by a processor of an electronic device (for example, the electronic device300ofFIG.3). The instructions may cause the processor to, when executed by the processor, load a first application (for example, the application311ofFIG.3) to a general area of a second memory providing a general execution environment from a first memory (for example, the nonvolatile memory360ofFIG.3) of the electronic device and execute the first application, load a first virtual machine (for example, the first virtual machine312aofFIG.3) performing a biometric authentication to the general area from the first memory and execute the first virtual machine, based on a request for the biometric authentication of the first application, allow the first virtual machine to access a trusted execution environment in which access by software executed in the general execution environment can be controlled, based on a predetermined allowed virtual machine list, load a second application which can access a biometric sensor of the electronic device to a secure area (for example, the secure area371ofFIG.3) of the second memory providing the trusted execution environment from the first memory and execute the second application, so as to acquire biometric information from the biometric sensor and perform the biometric authentication using the acquired biometric information by the second application, and transmit a result of the biometric authentication performed by the second application to the first application through the first virtual machine allowed to access the trusted execution environment.