# US 12,010,250 B2 · Capability enabling method and apparatus > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,010,250 B2 - Document ID: US12010250B2 - Status: Granted - Kind: B2 - Application number: 17/290,497 - Filed: 2019-10-23 - Published: 2021-11-18 - Granted: 2024-06-11 - Earliest claimed: 2018-11-01 - Assignees: Huawei Technologies Co., Ltd. - Applicants: Huawei Technologies Co., Ltd. - Inventors: Sishan Wang; Xiaona Zhao; Xinmiao Chang - Web page: https://patentgrep.com/patent/US12010250B2 ## CPC - H04L 9/0897: {involving additional devices, e.g. trusted platform module [TPM], smartcard or USB} - H04L 9/3268: {using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]} - G06F 21/57: Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities - H04L 9/3242: {involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC} - H04L 9/3247: {involving digital signatures} - H04L 9/3263: {involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements (network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823)} - H04L 63/0823: {using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263)} - H04L 63/12: {Applying verification of the received information (cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32)} - G06F 2221/2153: Using hardware token as a secondary aspect - H04L 2209/80: Wireless - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A capability enabling method and apparatus. A secure element (SE) establishes, with a trusted execution environment (TEE), a session for communication. The SE sends, to the TEE, an obtaining instruction to obtain a security certificate of the TEE. After receiving the obtaining instruction, the TEE generates the security certificate based on attribute information of the TEE, and sends the generated security certificate to the SE. After the SE receives the security certificate, the SE determines, based on the security certificate and a preset security policy, that the TEE is in a secure state. After the SE determines that the TEE is in the secure state, the SE enables a first capability for a third-party service in the SE based on a second capability of the TEE. ## Claims ### Claim 1 A capability enabling method comprising: establishing, with a trusted execution environment (TEE), a session for communication, wherein the session comprises: sending, to the TEE, an obtaining instruction to obtain a security certificate of the TEE; and receiving the security certificate from the TEE, wherein the security certificate comprises first attribute information of the TEE, wherein the TEE is in a secure state when the first attribute information meets a preset security policy, wherein the first attribute information comprises platform attribute information of the TEE, and wherein the platform attribute information comprises a developer identifier of the TEE; and enabling a first capability for a third-party service in a secure element (SE) when the TEE is in the secure state, wherein enabling the first capability is based on a second capability of the TEE, wherein the second capability comprises a trusted user interface (TUI) capability. ### Claim 2 (depends on 1) The capability enabling method of claim 1, wherein the first attribute information comprises second attribute information of TUI capability, and wherein the second attribute information comprises a peripheral type of a TUI or a peripheral attribute of the TUI. ### Claim 3 (depends on 1) The capability enabling method of claim 1, further comprising: sending, to the TEE, a session establishment request message requesting to establish the session with the TEE; and receiving, from the TEE, a session establishment response message indicating that the TEE acknowledges to establish the session. ### Claim 4 (depends on 3) The capability enabling method of claim 3, wherein before sending the session establishment request message to the TEE, the capability enabling method further comprises triggering an interrupt signal using a communications system, and wherein the interrupt signal instructs the TEE to receive the session establishment request message. ### Claim 5 (depends on 1) The capability enabling method of claim 1, further comprising performing authentication that the security certificate is from the TEE and has not been not tampered with. ### Claim 6 (depends on 1) The capability enabling method of claim 1, wherein the obtaining instruction comprises attribute identifiers of the TEE, and wherein the obtaining instruction instructs the TEE to generate the security certificate using TEE attributes corresponding to the attribute identifiers. ### Claim 7 (depends on 1) The capability enabling method of claim 1, wherein when the TEE is in the secure state, the capability enabling method further comprises: negotiating a communication key with the TEE, wherein the communication key is bound to a status of the TEE, and wherein the communication key is used by the SE to communicate with the TEE; and deleting the communication key when the TEE is configured to reboot or the TEE attributes change. ### Claim 8 (depends on 1) The capability enabling method of claim 1, wherein the platform attribute information further comprises application programming interface (API) version information of the TEE. ### Claim 9 (depends on 1) The capability enabling method of claim 1, wherein the platform attribute information further comprises an anti-rollback level of the TEE. ### Claim 10 (depends on 1) The capability enabling method of claim 1, wherein the platform attribute information further comprises or version information of an interactive application in the TEE. ### Claim 11 A capability enabling method, implemented by a trusted execution environment (TEE), wherein the capability enabling method comprises: establishing, with a secure element (SE), a session for communication wherein the session comprises: receiving an obtaining instruction from the SE that requests a security certificate of a trusted execution environment (TEE); performing a message authentication code (MAC) operation on first attribute information using a key, to generate a security certificate, wherein the security certificate comprises the first attribute information, wherein the first attribute information comprises platform attribute information of the TEE, and wherein the key comprises a private key of the TEE, a preconfigured key, or a negotiated key between the TEE and the SE; and sending the security certificate to the SE. ### Claim 12 (depends on 11) The capability enabling method of claim 11, wherein the first attribute information further comprises second attribute information of a trusted user interface (TUI) capability, wherein the platform attribute information comprises an identifier of the TEE, a developer identifier of the TEE, an operating system version of the TEE, a boot status of the TEE, a lifecycle status of the TEE, application programming interface (API) version information of the TEE, an anti-rollback level of the TEE, and version information of an interactive application in the TEE, wherein the interactive application is a trusted application used to communicate with the SE in the TEE, and wherein the second attribute information comprises a peripheral type of a TUI or a peripheral attribute of the TUI. ### Claim 13 (depends on 11) The capability enabling method of claim 11, wherein the obtaining instruction comprises attribute identifiers of the TEE, wherein the obtaining instruction instructs the TEE to generate the security certificate based on TEE attributes corresponding to the attribute identifiers of the TEE, and wherein the capability enabling method further comprises performing, based on the key, a digital signature operation, or the MAC operation on the TEE attributes, to generate the security certificate. ### Claim 14 (depends on 11) The capability enabling method of claim 11, wherein after sending the security certificate to the SE, the session further comprises: negotiating a communication key with the SE, wherein the communication key is bound to a status of the TEE; and deleting the communication key when the TEE is configured to reboot or the TEE attributes change. ### Claim 15 A capability enabling apparatus comprising: a communications system, configured to: establish, with a trusted execution environment (TEE), a session for communication, wherein the session comprises: sending, to the TEE, an obtaining instruction to obtain a security certificate of the TEE; and receiving the security certificate from the TEE, wherein the security certificate comprises first attribute information of the TEE, wherein the TEE is in a secure state when the first attribute information meets a preset security policy, wherein the security certificate comprises first attribute information of the TEE, wherein the first attribute information comprises platform attribute information of the TEE, and wherein the platform attribute information comprises an operating system version of the TEE; and one or more processors coupled to the communications system and configured to enable a first capability for a third-party service in a secure element (SE) when the TEE is in the secure state, wherein enabling the first capability is based on a second capability of the TEE. ### Claim 16 (depends on 15) The capability enabling apparatus of claim 15, wherein the second capability comprises a trusted user interface (TUI) capability, second attribute information of TUI capability, and wherein the second attribute information comprises a peripheral type of a TUI or a peripheral attribute of the TUI. ### Claim 17 (depends on 15) The capability enabling apparatus of claim 15, wherein the communications system is further configured to: send, to the TEE, a session establishment request message requesting to establish the session with the TEE; and receive, from the TEE, a session establishment response message indicating that the TEE acknowledges to establish the session. ### Claim 18 (depends on 17) The capability enabling apparatus of claim 17, wherein before the communications system is configured to send the session establishment request message to the TEE, the communications system is further configured to trigger an interrupt signal, and wherein the interrupt signal instructs the TEE to receive the session establishment request message. ### Claim 19 (depends on 15) The capability enabling apparatus of claim 15, wherein the processor is further configured to perform authentication on the security certificate to verify that the security certificate is from the TEE and has not been not tampered with. ### Claim 20 (depends on 15) The capability enabling apparatus of claim 15, wherein the communications system is further configured to negotiate a communication key with the TEE, wherein the communication key is bound to a status of the TEE, and wherein the communication key is used by the SE to communicate with the TEE, and wherein the one or more processors is further configured to delete the communication key when the TEE is configured to reboot or the TEE attributes change.