CN114785566A - Data processing method, device and equipment - Google Patents
Data processing method, device and equipment Download PDFInfo
- Publication number
- CN114785566A CN114785566A CN202210345257.5A CN202210345257A CN114785566A CN 114785566 A CN114785566 A CN 114785566A CN 202210345257 A CN202210345257 A CN 202210345257A CN 114785566 A CN114785566 A CN 114785566A
- Authority
- CN
- China
- Prior art keywords
- transmission data
- data
- processor
- processing
- security
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
- 238000003672 processing method Methods 0.000 title claims abstract description 29
- 230000005540 biological transmission Effects 0.000 claims abstract description 290
- 238000012545 processing Methods 0.000 claims abstract description 155
- 238000000034 method Methods 0.000 claims abstract description 48
- 238000012216 screening Methods 0.000 claims description 25
- 230000004044 response Effects 0.000 claims description 3
- 230000008569 process Effects 0.000 description 15
- 238000010586 diagram Methods 0.000 description 9
- 230000006870 function Effects 0.000 description 7
- 230000007246 mechanism Effects 0.000 description 4
- 238000004891 communication Methods 0.000 description 3
- 230000008878 coupling Effects 0.000 description 3
- 238000010168 coupling process Methods 0.000 description 3
- 238000005859 coupling reaction Methods 0.000 description 3
- 238000013461 design Methods 0.000 description 3
- 238000005516 engineering process Methods 0.000 description 3
- 238000001914 filtration Methods 0.000 description 3
- 238000012423 maintenance Methods 0.000 description 2
- 230000003287 optical effect Effects 0.000 description 2
- 230000002093 peripheral effect Effects 0.000 description 2
- 230000009286 beneficial effect Effects 0.000 description 1
- 230000008859 change Effects 0.000 description 1
- 230000000694 effects Effects 0.000 description 1
- 230000003993 interaction Effects 0.000 description 1
- 238000006467 substitution reaction Methods 0.000 description 1
- 230000001960 triggered effect Effects 0.000 description 1
- 230000002618 waking effect Effects 0.000 description 1
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
- H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/60—Protecting data
- G06F21/602—Providing cryptographic facilities or services
Landscapes
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Computer Hardware Design (AREA)
- Theoretical Computer Science (AREA)
- General Engineering & Computer Science (AREA)
- Signal Processing (AREA)
- Computer Networks & Wireless Communication (AREA)
- Health & Medical Sciences (AREA)
- Bioethics (AREA)
- General Health & Medical Sciences (AREA)
- Software Systems (AREA)
- Physics & Mathematics (AREA)
- General Physics & Mathematics (AREA)
- Computing Systems (AREA)
- Storage Device Security (AREA)
Abstract
The application discloses a data processing method, a data processing device and data processing equipment. The method is mainly applied to electronic equipment with a first processor connected with a second processor, and when a first system on the first processor and the second system on the second processor carry out data transmission, a safety system independent of the first system on the first processor is used for carrying out safety processing (such as encryption and/or decryption) on the transmitted data. Therefore, the security and the reliability of data transmission between the first system and the second system can be ensured, and an illegal system is prevented from masquerading as the second system to attack the first system or stealing the data transmission between the first system and the second system.
Description
Technical Field
The present application relates to the field of data security, and in particular, to a data processing method, apparatus and device.
Background
In current hardware designs, mainstream computers often employ a main processor running on a main processor (e.g., an ARM processor) to implement basic functions, and then one or more sub-processors (e.g., an MCU processor) connected to implement extended or dedicated functions through sub-systems running on the sub-processors.
However, the sub-systems on the sub-processors usually do not have high security design and processing capability, and cannot ensure secure data transmission with the main system on the main processor, thereby creating a security risk.
Disclosure of Invention
Based on the above, the application provides a data processing method, device and equipment.
According to a first aspect of embodiments of the present application, there is provided a data processing method, including: the method comprises the steps that a first system obtains first transmission data to be sent to a second system; based on the security system, carrying out encryption processing on the first transmission data to obtain second transmission data; the first system sends the second transmission data to the second system; and/or the first system receives third transmission data sent by the second system; based on the security system, carrying out decryption processing on the third transmission data to obtain fourth transmission data, wherein the first system runs on the first processor; the second system runs on the second processor; the first processor is connected with the second processor; the security system operates on the first processor and is independent of the first system.
According to an embodiment of the present application, encrypting the first transmission data and/or decrypting the third transmission data includes: the first system obtains a secure processing tool sent by the secure system; determining an encryption rule and/or a decryption rule based on the secure processing tool; and the first system encrypts the first transmission data based on the encryption rule, and/or the first system decrypts the second transmission data based on the decryption rule.
According to an embodiment of the present application, the method further includes: in response to obtaining the input instruction or meeting a preset condition, the first system obtains or updates the secure processing tool.
According to an embodiment of the present application, the encrypting the first transmission data and/or decrypting the third transmission data based on the security system includes: the first system sends the first transmission data and/or the third transmission data to the safety system; and receiving second transmission data and/or fourth data returned by the security system, wherein the second transmission data is first transmission data subjected to encryption processing by the security system, and the fourth transmission data is third transmission data subjected to decryption processing by the security system.
According to an embodiment of the present application, based on a security system, encrypting the first transmission data and/or decrypting the third transmission data includes: the method comprises the steps of encrypting first transmission data and/or decrypting third transmission data under the condition that the first transmission data and/or the third transmission data meet a first preset screening rule, wherein the first preset screening rule comprises at least one of the following items: the data volume of the first transmission data and/or the second transmission data is within a specified range; the purpose of the first transmission data and/or the second transmission data is within a specified purpose range; the attributes of the first transmission data and/or the second transmission data satisfy a specified condition.
According to an embodiment of the present application, based on a security system, encrypting the first transmission data and/or decrypting the third transmission data includes: under the condition that a second preset screening condition is met, the first system sends the first transmission data and/or the third transmission data to the safety system and receives second transmission data and/or fourth transmission data returned by the safety system; and under the condition that the second preset screening condition is not met, the first system encrypts the first transmission data to obtain second transmission data, and/or decrypts the third transmission data to obtain fourth transmission data.
According to a second aspect of embodiments of the present application, there is provided a data processing method, including: the second system receives second transmission data sent by the first system; based on the security system, carrying out decryption processing on the second transmission data to obtain first transmission data; the second system performs data processing on the first transmission data to obtain third transmission data; based on the security system, encrypting the third transmission data to obtain fourth transmission data; the second system returns the fourth transmission data to the first system, wherein the first system runs on the first processor; the second system runs on the second processor; the first processor is connected with the second processor; the security system operates on the first processor and is independent of the first system.
According to a third aspect of embodiments of the present application, there is provided a data processing apparatus including: the system comprises a to-be-transmitted data acquisition module, a transmission module and a transmission module, wherein the to-be-transmitted data acquisition module is used for a first system to acquire first transmission data to be sent to a second system; the first encryption processing module is used for encrypting the first transmission data based on the security system to obtain second transmission data; the first data sending module is used for the first system to send the second transmission data to the second system; and/or a first data receiving module, configured to receive, by the first system, third transmission data sent by the second system; the first decryption module is used for decrypting the third transmission data based on the security system to obtain fourth transmission data, wherein the first system runs on the first processor; the second system runs on the second processor; the first processor is connected with the second processor; the security system operates on the first processor and is independent of the first system.
According to a fourth aspect of embodiments of the present application, there is provided a data processing apparatus, including: the second data receiving module is used for receiving second transmission data sent by the first system by the second system; the second decryption processing module is used for decrypting the second transmission data based on the security system to obtain the first transmission data; the data processing module is used for the second system to perform data processing on the first transmission data so as to obtain third transmission data; the second encryption processing module is used for carrying out encryption processing on the third transmission data based on the security system so as to obtain fourth transmission data; the second data sending module is used for returning the fourth transmission data to the first system by the second system, wherein the first system runs on the first processor; the second system runs on the second processor; the first processor is connected with the second processor; the security system operates on the first processor and is independent of the first system.
According to a fifth aspect of the embodiments of the present application, there is provided an electronic device, including a first processor and a second processor, where the first processor is connected to the second processor, and the first processor runs a first system and a security system, the first system performs security processing on transmission data with a second system on the second processor by using any one of the data processing methods executed by the first system, and the second system performs security processing on transmission data with the first system by using any one of the data processing methods executed by the second system.
According to a sixth aspect of embodiments herein, there is provided a computer storage medium comprising a set of computer executable instructions for performing any one of the above data security processing methods when the instructions are executed.
The embodiment of the application provides a data security processing method, device and system. The method is mainly applied to electronic equipment with a first processor connected with a second processor, and when a first system on the first processor and the second system on the second processor carry out data transmission, a safety system independent of the first system on the first processor is used for carrying out safety processing (such as encryption and/or decryption) on the transmitted data. Therefore, the security and the reliability of data transmission between the first system and the second system can be ensured, and an illegal system is prevented from masquerading as the second system to attack the first system or stealing the data transmission between the first system and the second system.
It is to be understood that the implementation of the present application does not need to achieve all the above advantages, but a specific technical solution may achieve a specific technical effect, and other embodiments of the present application may also achieve the above-mentioned advantages.
Drawings
The above and other objects, features and advantages of exemplary embodiments of the present application will become readily apparent from the following detailed description read in conjunction with the accompanying drawings. Several embodiments of the present application are illustrated by way of example, and not by way of limitation, in the figures of the accompanying drawings and in which:
in the drawings, the same or corresponding reference numerals indicate the same or corresponding parts.
FIG. 1 is a diagram illustrating a hardware architecture according to an embodiment of the present application;
FIG. 2 is a system architecture diagram according to an embodiment of the present application;
fig. 3 is a schematic diagram of an implementation flow of a data security processing method at a first system end according to an embodiment of the present application;
fig. 4 is a schematic flow chart illustrating an implementation of the data security processing method on the second system side according to an embodiment of the present application;
fig. 5 is a second schematic diagram illustrating an implementation process of the data security processing method on the first system side according to an embodiment of the present application;
FIG. 6 is a diagram of a hardware architecture according to another embodiment of the present application;
FIG. 7 is a system architecture diagram according to another embodiment of the present application;
FIG. 8 is a schematic diagram of an interaction process of a data security processing method according to another embodiment of the present application;
fig. 9 is a schematic structural diagram of a first system-side data security processing apparatus according to an embodiment of the present application;
fig. 10 is a schematic structural diagram of a second system-side data security processing apparatus according to an embodiment of the present application.
Detailed Description
In order to make the objects, features and advantages of the present application more obvious and understandable, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present application, and it is obvious that the described embodiments are only a part of the embodiments of the present application, and not all the embodiments. All other embodiments obtained by a person skilled in the art based on the embodiments in the present application without making any creative effort belong to the protection scope of the present application.
In the description of the present specification, reference to the description of "one embodiment," "some embodiments," "an example," "a specific example," or "some examples" or the like means that a particular feature, structure, material, or characteristic described in connection with the embodiment or example is included in at least one embodiment or example of the present application. Furthermore, the particular features, structures, materials, or characteristics described may be combined in any suitable manner in any one or more embodiments or examples. Furthermore, various embodiments or examples and features of different embodiments or examples described in this specification can be combined and combined by one skilled in the art without contradiction.
Furthermore, the terms "first", "second" and "first" are used for descriptive purposes only and are not to be construed as indicating or implying relative importance or implicitly indicating the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include at least one of the feature. In the description of the present application, "a plurality" means two or more unless specifically limited otherwise.
The data security processing method in the embodiment of the present application is mainly applied to the hardware architecture shown in fig. 1. As shown in fig. 1, the hardware architecture includes: a first processor 101 and at least one second processor 102. Where a first system is run on the first processor 101 to implement basic functionality and a second system is run on the second processor 102 to implement extended or dedicated functionality.
The first system and the second system are two independent systems, and the first system controls the second system to complete corresponding functions by sending transmission data to the second system; the second system may also send transmission data to the first system to enable calls to the first system functions and exchange of data with the first system, etc. In the embodiment of the application, the transmission data transmitted and received between the first system and the second system is data in a broad sense, and includes data such as signals, instructions, requests, and specific contents to be processed.
In some embodiments of the present application, the second processor 102 may be disposed on a motherboard where the first processor 101 is located by a slot or an interface, and is disposed in an electronic device together with the first processor 101.
In other embodiments of the present application, the second processor 102 and the first processor 101 may also be disposed in two different electronic devices, respectively, the first processor 101 is disposed in a main device (e.g., a computer host), the second processor 102 is disposed in a sub-device (e.g., a computer peripheral) connected to the main device, and data transmission is performed with the first processor 101 through a connection interface and a communication line between the sub-device and the main device.
Fig. 2 shows a system architecture adopted by the embodiment of the present application to implement the data security processing method. As shown in fig. 2, the embodiment of the present application introduces a security system 203 between a first system 201 of a first processor and a second system 202 of a second processor.
When the first system 201 intends to send transmission data to the second system 202, it first interacts with the security system 203 to encrypt the transmission data to be sent, and then sends the encrypted transmission data to the second system 202.
After receiving the encrypted transmission data, the second system 202 may also interact with the security system 203 first to decrypt the received transmission data; then, using the transmission data after the safety processing to complete the data processing requested by the first system to obtain a data result; then, the system interacts with the security system 203 to perform corresponding encryption processing on the data result, so as to obtain an encrypted data result, and returns the encrypted data result to the first system 201.
Then, after receiving the encrypted data result, the first system 201 also interacts with the security system 203 to perform corresponding decryption processing on the received data result to obtain a data result.
Vice versa, when the second system 202 intends to send transmission data to the first system 201, first interacting with the security system 203 to encrypt the transmission data to be sent, and then sending the encrypted transmission data to the first system 201; after receiving the encrypted transmission data, the first system 201 also interacts with the security system 203 to decrypt the received transmission data, and then completes the operation requested by the second system according to the decrypted transmission data.
In this embodiment, the security system 203 is another system running on the first processor (e.g., a TrustZone system built in an ARM processor, or an Intel Software Guard Extensions (Intel SGX) system, etc.), and is independent from the first system running on the first processor. Therefore, the safe data transmission between the first system and the second system can be realized without introducing new safe hardware.
Specifically, fig. 3 shows a main flow of implementing the data security processing method when a first system running on a first processor intends to send transmission data to a second system running on a second processor, and as shown in fig. 3, the method includes:
the first transmission data is typically unencrypted plaintext data.
in the embodiment of the present application, a specific implementation manner of the encryption processing is not limited. The first transmission data can be encrypted by the security system, and then the second transmission data obtained after encryption is returned to the first system; it is also possible that the second transmission data is directly obtained by the first system by performing an encryption process in the first system using a security processing tool provided by the security system, such as a key, a signature, a certificate, etc.
The second transmission data obtained through the encryption process is typically ciphertext data.
In operation 330, the first system transmits the second transmission data to the second system.
Fig. 4 shows a main flow of the second system running on the second processor implementing the secure processing method when receiving the transmission data sent by the first system running on the first processor, and as shown in fig. 4, the method includes:
in operation 410, the second system receives second transmission data sent by the first system;
the second transmission data is typically ciphertext data subjected to encryption processing.
in the embodiment of the present application, a specific implementation manner of the decryption process is not limited. The second transmission data can be decrypted by the security system, and then the first transmission data obtained after decryption is returned to the first system; it is also possible that the first system performs the decryption process in the first system directly to obtain the first transmission data using security processing means provided by the security system, such as keys, signatures, certificates, etc.
The first transmission data obtained through the decryption process is usually plaintext data.
the third transmission data is result data obtained after data processing, and is plaintext data.
the fourth transmission data is ciphertext data obtained by encrypting the third transmission data.
In operation 450, the second system returns the fourth transmission data to the first system.
Fig. 5 shows a main flow of implementing a data security processing method when a first system running on a first processor receives transmission data sent by a second system running on a second processor, and as shown in fig. 5, the method includes:
the third transmission data sent by the second system to the first system is often encrypted ciphertext data, which cannot be used directly.
In operation 520, the third transmission data is decrypted based on the security system to obtain fourth transmission data.
The decryption process mainly means decrypting the received ciphertext data.
It should be noted that the embodiment of the present application shown in fig. 1 to fig. 5 is only one basic embodiment of the data security processing method of the present application, and an implementer may perform expansion and refinement on the basis of the basic embodiment to obtain more embodiments. Exemplarily, the following steps are carried out:
according to an embodiment of the present application, encrypting the first transmission data and/or decrypting the third transmission data includes: the first system obtains a safe processing tool sent by the safe system; determining an encryption rule and/or a decryption rule based on the secure processing tool; and the first system encrypts the first transmission data based on the encryption rule, and/or the first system decrypts the second transmission data based on the decryption rule.
The secure processing means includes a key, a certificate, a random number and/or a signature, etc. The first system utilizes the safety processing tool provided by the safety system to carry out encryption processing, so that the workload of the safety system can be reduced, the safety system can be more concentrated on the management and maintenance of the safety processing tool, and the efficiency and the speed of safety processing can be higher and higher.
Encryption rules and/or decryption rules refer primarily to rules on how encryption and/or decryption is performed using secure processing tools. For example, before performing encryption processing and/or decryption processing, the first system and the second system first need to authenticate through a certificate, and determine whether an opposite party is a trusted system; generating a key pair that can be used for encryption processing and/or decryption processing; encrypting and/or decrypting the data by using the key pair and the random number; signing the data after the encryption processing and/or the decryption processing using the signature, and the like.
According to an embodiment of the present application, the method further includes: in response to obtaining the input instruction or meeting a preset condition, the first system obtains or updates the secure processing tool.
The input instruction refers to an instruction for obtaining or updating the secure processing tool, and may be a command line instruction or an instruction issued through a graphical interface.
The preset conditions comprise that when the security state of the first system or the second system is changed, for example, the access control authority is changed, the security level is changed, the user password is changed, and the like; that no pre-stored secure processing tools (e.g., keys, signatures, random numbers and/or certificates, etc.) have been found, or that the secure processing tools have expired; a change in the function and/or configuration of the electronics of the first processor, etc.
The security processing means is corresponding to the number of the first system and the second system, and the first system and each second system are corresponding to a set of keys, random numbers and/or certificates, etc. When a plurality of second systems are connected to the first system, a plurality of sets of keys, random numbers, certificates, and the like need to be set.
This ensures that the secure processing of the transmitted data is effective and reliable in real time.
According to an embodiment of the present application, the encrypting the first transmission data and/or decrypting the third transmission data based on the security system includes: the first system sends the first transmission data and/or the third transmission data to the security system; and receiving second transmission data and/or fourth data returned by the security system, wherein the second transmission data is first transmission data subjected to encryption processing by the security system, and the fourth transmission data is third transmission data subjected to decryption processing by the security system.
In the embodiment, the encryption processing is performed by the security system, and the host system does not need to know the implementation details of the security processing, so that the confidentiality of the implementation details of the security processing can be ensured, and the security processing is safer.
According to an embodiment of the present application, based on a security system, encrypting first transmission data and/or decrypting third transmission data includes: and under the condition that the first transmission data and/or the third transmission data meet a first preset screening rule, performing encryption processing on the first transmission data and/or performing decryption processing on the third transmission data, wherein the first preset screening rule comprises at least one of the following items: the data volume of the first transmission data and/or the second transmission data is within a specified range; the purpose of the first transmission data and/or the second transmission data is within a specified purpose range; the attribute of the first transmission data and/or the second transmission data satisfies a specified condition.
The first preset screening rule is mainly used for screening transmission data needing encryption processing and/or decryption processing from the transmission data.
In this embodiment, all the transmission data is not securely processed. Only when the transmission data meet the first preset screening rule, the transmission data are processed safely. For example, in the case where the data amount of the transmission data is suitable for the encryption processing; when the purpose of the transmitted data is the purpose with high safety requirement, such as shutdown instruction, key data and the like; and transmitting data attributes, such as a security level reaching a medium-high security level and the like. Therefore, the efficiency of safety processing can be further improved, and computing resources are saved.
According to an embodiment of the present application, based on a security system, encrypting first transmission data and/or decrypting third transmission data includes: under the condition that a second preset screening condition is met, the first system sends the first transmission data and/or the third transmission data to the safety system and receives second transmission data and/or fourth transmission data returned by the safety system; and under the condition that the second preset screening condition is not met, the first system encrypts the first transmission data to obtain second transmission data, and/or decrypts the third transmission data to obtain fourth transmission data.
The second preset screening rule is used for further screening out transmission data which is higher in security level and needs to be subjected to encryption processing and/or decryption processing by security processing from the transmission data subjected to the encryption processing and/or the decryption processing.
In the embodiment, according to a second preset screening rule, the transmission data which has a higher security level and needs to be subjected to encryption processing and/or decryption processing by security processing is subjected to security system processing; and for the transmission data which has not high security level but still needs security processing for encryption processing and/or decryption processing, the first system performs encryption processing and/or decryption processing.
Therefore, layered security processing is realized, and the security and the secrecy of the security system can be effectively utilized to perform more secure encryption processing and/or decryption processing on the transmission data with higher security level; and the transmission data with low security level can be processed through the first system, so that the computing power of the security system is saved, and the security system is more efficiently utilized.
Fig. 6 to fig. 8 show a specific implementation manner of implementing the data security processing method by using the ARM trust zone technology in another embodiment of the present application.
Wherein, the ARM TrustZone technology is a system-wide safety method and ARM CortexTMThe a-processor is tightly integrated and extended in the system through the AXI bus and a special TrustZone system IP block. This technology provides a platform that can support fully Trusted Execution Environments (TEE) as well as security aware applications and security services, often to protect peripherals such as secure memory, cryptographic blocks, keyboards and screens to ensure that the firmware is protected from software attacks.
In the present embodiment, it is inventively contemplated to utilize this technique to protect data transmission with a main system on a main processor and a sub-system on a sub-processor.
Fig. 6 illustrates a specific hardware architecture employed by an embodiment of the present application.
As shown in fig. 6, in the embodiment of the present application, the first processor is a computer main processor 601, and the main processor 601 is a System on Chip (SoC) integrated with an ARM processor; the second processor connected to the first processor is a sub-processor 602 connected to the main processor 601, and the sub-processor 602 is a Micro Controller Unit (MCU) which can be connected to an external device (not shown) and control the external device to perform an enhanced function.
Fig. 7 shows a system architecture employed by an embodiment of the present application.
As shown in fig. 7, in the embodiment of the present application, the first system is a main system 701 on an ARM main processor (ARM SoC), which is a core operating system integrated in a system-on-chip; the second system is a subsystem 702 on a sub-processor (MCU) and is an embedded system integrated on a microprocessor; the security system is a security system 703 on the main processor (ARM SoC) and is a TEE system carried by the ARM SoC.
As shown in fig. 7, in order to implement the data security processing method of the present application, in this embodiment, a client application program 7011 dedicated to interact with the subsystem 702 is deployed in the main system 701, and the client application program 7011 centrally manages data transmission and reception to and from the subsystem 702; the sub-processors are provided as hardware protected by the TEE system, and a data encryption/decryption program 7022 is added to the sub-system 702 for encryption/decryption of data.
When the data transmitted between the main system 701 and the subsystem 702 conforms to the preset screening rule, for example, the value of the attribute "data security level" is greater than 3 (indicating a medium-high security level), the data is sent to the security system 703 through the dedicated security IPC driver 7013 for security processing, and the data after security processing is obtained.
When the data transmitted between the host system 701 and the subsystem 702 does not conform to the preset filtering rule, for example, the value of the attribute "data security level" is less than or equal to 3 (indicating a low security level), the data may be directly sent to the subsystem 703 through the universal driver 7012.
The subsystem 703 detects the received data meeting the preset screening rule through the data transceiver 7021, and returns an error message if the data is unencrypted data, so as to avoid performing subsequent processing, thereby ensuring that the data meeting the preset screening rule sent to the subsystem is encrypted. Thereby further improving the security of the system.
If the data is encrypted data, the data encryption/decryption program 7022 performs decryption operation, and the decrypted data is subsequently processed by the data processing program 7072 to obtain data processing result data; then, the result data is encrypted by the data encryption/decryption program 7022, and the encrypted result data is transmitted to the client application program 7011 by the data transmission/reception program 7021.
The security system 703 is provided with: a trusted operating system solution 7032 for interacting with the host system 701 or the subsystem 702; the trusted application 7031 is used for security processing, such as encryption and decryption of data, management and maintenance of data keys, certificates, and signatures. And the procedure of gray dot format filling in fig. 7 includes: the dedicated secure IPC driver, trusted application 7031, trusted operating system solution 7032, data transceiver 7021 on subsystem 702, data encryption/decryption program 7022, and data handler 7023 all belong to the secured area of secured system 703 TEE.
Specifically, when the host system 701 initiates access to the subsystem 702 through a Client Application program (Client Application)7011, the following steps shown in fig. 8 are performed:
in step 8010, client application 7011 communicates with security system 703 via dedicated security IPC driver 7013, requesting data encryption;
step 8020, the security system 703 checks a security Storage (Secure Storage) of the TEE through the trusted application 7031, determines whether the security mechanisms of the main system and the sub-systems are activated, and if not, activates the security mechanisms;
the security mechanism includes a loading cryptographic algorithm, a secure storage key, a random number, and the like.
Step 8030, the security system 703 encrypts the data;
step 8040, the security system 703 returns the encrypted data to the client application 7011;
step 8050, the client application program 7011 obtains the encrypted data;
step 8060, the client application 7011 sends the encrypted data to the subsystem 702;
step 8070, the subsystem 702 receives the encrypted data through the data transceiver 7021;
step 8080, the subsystem 702 requests the security system, through the data encryption/decryption program 7022, to decrypt and authenticate the transmitted data;
step 8090, the security system 703 returns the decrypted transmission data;
8100, the subsystem 702 receives the decrypted transmission data, and performs subsequent processing through the data processing program 7072 to obtain data processing result data;
8110, the subsystem 702 requests the security system through the data encryption/decryption program 7022 to encrypt the resulting data;
8120, the security system 703 returns the encrypted result data;
8130, the subsystem 702 receives the encrypted result data;
in step 8140, the subsystem 702 returns the encrypted result data to the client application 7011 through the data transceiver 7021.
The data transceiver 7021 may detect the received data that meets the preset filtering rule, and if the data is not unencrypted, return an error message and do not perform subsequent processing, so as to ensure that the data that meets the preset filtering rule and is sent to the subsystem is encrypted. Thereby further improving the security of the system.
Vice versa, if the main system 701 requests data from the sub-system 702 through the client application program 7011, the sub-system 702 encrypts the requested data by the data encryption/decryption program 7022 to obtain the result data, and the data transceiver program 7021 transmits the encrypted requested data to the client application program 7011; the client Application 7011 communicates with a Trusted Application 7031(Trusted Application) through a dedicated secure IPC driver 7013 to complete data decryption.
In the embodiment of the present application, in order to implement the above-mentioned data security processing method, a dedicated security bus driver is specially developed and deployed in the security system 703, and a client application 7011 and a trusted application 7031 are developed to process a data security processing request.
In the embodiment of the present application, in the process of encrypting the transmission data, a random number is also used in the main system and the subsystem respectively, and the random number is used in the encryption and decryption process as part of the security mechanism. The random number is respectively triggered by the main system or the subsystem to regenerate, synchronize, revoke (revocation) and the like in the starting, waking and running processes of the system, so that the safety and reliability of data safety processing can be further improved.
In the embodiment of the application, all data security processing is realized in the security protection area of the TEE, and the TEE is transparent and invisible to the outside, so that the TEE is safer. And the data of the subsystem is effectively encrypted and managed based on the TrustZone architecture, so that the design complexity of the subsystem can be effectively reduced, and the safety of the whole system is improved.
Further, an embodiment of the present application further provides a data processing apparatus, as shown in fig. 9, the apparatus includes: a to-be-transmitted data obtaining module 901, configured to obtain, by a first system, first transmission data to be sent to a second system; a first encryption processing module 902, configured to perform encryption processing on the first transmission data based on the security system to obtain second transmission data; a first data sending module 903, configured to send the second transmission data to the second system by the first system; and/or a first data receiving module 904, configured to receive, by the first system, third transmission data sent by the second system; a first decryption module 905, configured to decrypt the third transmission data based on the security system to obtain fourth transmission data, where the first system operates in the first processor; the second system runs on the second processor; the first processor is connected with the second processor; the security system operates on the first processor and is independent of the first system.
According to an embodiment of the present application, the first encryption processing module 902 includes: the safety processing tool acquisition sub-module is used for acquiring the safety processing tools sent by the safety system by the first system; an encryption rule determining sub-module for determining an encryption rule based on the secure processing tool; and the encryption processing sub-module is used for carrying out encryption processing on the first transmission data based on the encryption rule by the first system.
According to an embodiment of the present application, the first decryption module 905 includes: the safety processing tool acquisition sub-module is used for acquiring a safety processing tool sent by the safety system by the first system; a decryption rule determining submodule for determining a decryption rule based on the secure processing tool; and the decryption processing submodule is used for decrypting the second transmission data based on the decryption rule by the first system.
According to an embodiment of the present application, the apparatus 90 further includes: and the safe processing tool management module is used for responding to the input instruction acquisition or the preset condition satisfaction, and the first system acquires or updates the safe processing tool.
According to an embodiment of the present application, the first encryption processing module 902 includes: the data sending submodule is used for sending the first transmission data to the safety system by the first system; and the data receiving submodule is used for receiving second transmission data returned by the security system, and the second transmission data is the first transmission data which is encrypted by the security system.
According to an embodiment of the present application, the first decryption processing module 905 includes: the data sending submodule is used for sending the third transmission data to the safety system by the first system; and the data receiving submodule is used for receiving fourth data returned by the security system, and the fourth transmission data is third transmission data subjected to decryption processing through the security system.
According to an implementation manner of the embodiment of the present application, the first encryption processing module 902 and/or the first decryption processing module 905 are specifically configured to: the method comprises the steps of encrypting first transmission data and/or decrypting third transmission data under the condition that the first transmission data and/or the third transmission data meet a first preset screening rule, wherein the first preset screening rule comprises at least one of the following items: the data volume of the first transmission data and/or the second transmission data is within a specified range; the purpose of the first transmission data and/or the second transmission data is within a specified purpose range; the attribute of the first transmission data and/or the second transmission data satisfies a specified condition.
According to an embodiment of the present application, the first encryption processing module 902 and/or the first decryption processing module 905 are specifically configured to: under the condition that a second preset screening condition is met, the first system sends the first transmission data and/or the third transmission data to the safety system and receives second transmission data and/or fourth transmission data returned by the safety system; and under the condition that the second preset screening condition is not met, the first system encrypts the first transmission data to obtain second transmission data, and/or decrypts the third transmission data to obtain fourth transmission data.
Further, an embodiment of the present application also provides a data security processing apparatus, as shown in fig. 10, where the apparatus 100 includes: a second data receiving module 1001, configured to receive, by the second system, second transmission data sent by the first system; the second decryption processing module 1002 is configured to decrypt the second transmission data based on the security system to obtain the first transmission data; the data processing module 1003 is configured to perform data processing on the first transmission data by the second system to obtain third transmission data; a second encryption processing module 1004, configured to perform encryption processing on the third transmission data based on the security system to obtain fourth transmission data; a second data sending module 1005, configured to return the fourth transmission data to the first system by the second system, where the first system operates in the first processor; the second system runs on the second processor; the first processor is connected with the second processor; the security system operates on the first processor and is independent of the first system.
In addition, an embodiment of the present application further provides an electronic device, as shown in fig. 1, including: the system comprises a first processor 101 and a second processor 102, wherein the first processor 101 is connected with the second processor 102, a first system and a security system run on the first processor 101, the first system applies any data processing method executed by the first system to perform security processing on transmission data between the first processor and the second system on the second processor 102, and the second system applies any data processing method executed by the second system to perform security processing on the transmission data between the second processor and the first system.
In addition, the embodiment of the present application further provides a computer storage medium, where the storage medium includes a set of computer executable instructions, and when the instructions are executed, the computer storage medium is used to execute any one of the above data security processing methods.
Here, it should be noted that: the above description on the embodiment of the data security processing apparatus, the above description on the embodiment of the data security processing system, and the above description on the embodiment of the computer storage medium are similar to the descriptions on the foregoing method embodiments, and have similar beneficial effects to the foregoing method embodiments, and therefore are not repeated. For technical details that have not been disclosed in the description of the embodiments of the data security processing apparatus, the description of the embodiments of the data security processing system, and the description of the embodiments of the computer storage medium, please refer to the description of the foregoing method embodiments of the present application for understanding, and therefore, for brevity, will not be described again.
It should be noted that, in this document, the terms "comprises," "comprising," or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but may include other elements not expressly listed or inherent to such process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising an … …" does not exclude the presence of other like elements in a process, method, article, or apparatus that comprises the element.
In the several embodiments provided in the present application, it should be understood that the disclosed apparatus and method may be implemented in other ways. The above-described device embodiments are merely illustrative, for example, the division of the unit is only one logical function division, and there may be other division ways in actual implementation, such as: multiple units or components may be combined, or may be integrated into another device, or some features may be omitted, or not implemented. In addition, the coupling, direct coupling or communication connection between the components shown or discussed may be through some interfaces, and the indirect coupling or communication connection between the devices or units may be electrical, mechanical or other forms.
The units described as separate parts may or may not be physically separate, and parts displayed as units may or may not be physical units; can be located in one place or distributed on a plurality of network units; some or all of the units can be selected according to actual needs to achieve the purpose of the solution of the embodiment.
In addition, all functional units in the embodiments of the present application may be integrated into one processing unit, or each unit may be separately regarded as one unit, or two or more units may be integrated into one unit; the integrated unit may be implemented in the form of hardware, or in the form of hardware plus a software functional unit.
Those of ordinary skill in the art will understand that: all or part of the steps for realizing the method embodiments can be completed by hardware related to program instructions, the program can be stored in a computer readable storage medium, and the program executes the steps comprising the method embodiments when executed; and the aforementioned storage medium includes: various media capable of storing program codes, such as a removable storage medium, a Read Only Memory (ROM), a magnetic disk, and an optical disk.
Alternatively, the integrated unit described above may be stored in a computer-readable storage medium if it is implemented in the form of a software functional module and sold or used as a separate product. Based on such understanding, the technical solutions of the embodiments of the present application may be essentially implemented or portions thereof that contribute to the prior art may be embodied in the form of a software product stored in a storage medium, and including several instructions for enabling a computer device (which may be a personal computer, a server, or a network device) to execute all or part of the methods of the embodiments of the present application. And the aforementioned storage medium includes: a removable storage medium, a ROM, a magnetic disk, an optical disk, or the like.
The above description is only for the specific embodiments of the present application, but the scope of the present application is not limited thereto, and any person skilled in the art can easily conceive of the changes or substitutions within the technical scope of the present application, and shall be covered by the scope of the present application. Therefore, the protection scope of the present application shall be subject to the protection scope of the claims.
Claims (10)
1. A method of data processing, the method comprising:
the method comprises the steps that a first system obtains first transmission data to be sent to a second system;
based on a security system, carrying out encryption processing on the first transmission data to obtain second transmission data;
the first system sends the second transmission data to the second system; and/or
The first system receives third transmission data sent by the second system;
decrypting the third transmission data based on the security system to obtain fourth transmission data,
wherein the first system runs on a first processor; the second system runs on a second processor; the first processor is connected with the second processor; the security system runs on the first processor and is independent of the first system.
2. The method according to claim 1, wherein the encrypting the first transmission data and/or the decrypting the third transmission data comprises:
the first system obtains a safe processing tool sent by the safe system;
determining an encryption rule and/or a decryption rule based on the secure processing tool; and
and the first system encrypts the first transmission data based on the encryption rule and/or decrypts the second transmission data based on the decryption rule.
3. The method of claim 2, further comprising:
in response to obtaining an input instruction or meeting a preset condition, the first system obtains or updates the secure processing tool.
4. The method of claim 1, wherein the encrypting the first transmission data and/or the decrypting the third transmission data based on the security system comprises:
the first system sends the first transmission data and/or the third transmission data to the security system; and
and receiving the second transmission data and/or the fourth transmission data returned by the security system, wherein the second transmission data is the first transmission data encrypted by the security system, and the fourth transmission data is the third transmission data decrypted by the security system.
5. The method of claim 1, wherein the encrypting the first transmission data and/or decrypting the third transmission data based on the security system comprises:
performing encryption processing on the first transmission data and/or performing decryption processing on the third transmission data under the condition that the first transmission data and/or the third transmission data meet a first preset screening rule, wherein the first preset screening rule comprises at least one of the following items:
the data volume of the first transmission data and/or the second transmission data is within a specified range;
the purpose of the first transmission data and/or the second transmission data is within a specified purpose range;
attributes of the first transmission data and/or the second transmission data satisfy a specified condition.
6. The method of claim 1, wherein the encrypting the first transmission data and/or decrypting the third transmission data based on the security system comprises:
under the condition that a second preset screening condition is met, the first system sends the first transmission data and/or the third transmission data to the safety system and receives second transmission data and/or fourth transmission data returned by the safety system;
and under the condition that the second preset screening condition is not met, the first system encrypts the first transmission data to obtain second transmission data, and/or decrypts the third transmission data to obtain fourth transmission data.
7. A method of data processing, the method comprising:
the second system receives second transmission data sent by the first system;
based on a security system, carrying out decryption processing on the second transmission data to obtain first transmission data;
the second system performs data processing on the first transmission data to obtain third transmission data;
based on a security system, carrying out encryption processing on the third transmission data to obtain fourth transmission data;
the second system returns the fourth transmission data to the first system,
wherein the first system runs on a first processor; the second system runs on a second processor; the first processor is connected with the second processor; the security system operates on the first processor and is independent of the first system.
8. A data processing apparatus, the apparatus comprising:
the system comprises a to-be-transmitted data acquisition module, a transmission module and a transmission module, wherein the to-be-transmitted data acquisition module is used for a first system to acquire first transmission data to be sent to a second system;
the first encryption processing module is used for carrying out encryption processing on the first transmission data based on a security system so as to obtain second transmission data;
a first data sending module, configured to send the second transmission data to the second system by the first system; and/or
A first data receiving module, configured to receive, by the first system, third transmission data sent by the second system;
a first decryption module, configured to perform decryption processing on the third transmission data based on the security system to obtain fourth transmission data,
wherein the first system operates on a first processor; the second system runs on a second processor; the first processor is connected with the second processor; the security system runs on the first processor and is independent of the first system.
9. A data processing apparatus, the apparatus comprising:
the second data receiving module is used for receiving second transmission data sent by the first system by the second system;
the second decryption module is used for decrypting the second transmission data based on the security system to obtain the first transmission data;
the data processing module is used for the second system to perform data processing on the first transmission data so as to obtain third transmission data;
the second encryption module is used for carrying out encryption processing on the third transmission data based on a security system so as to obtain fourth transmission data;
a second data sending module, configured to return the fourth transmission data to the first system by the second system,
wherein the first system operates on a first processor; the second system runs on a second processor; the first processor is connected with the second processor; the security system operates on the first processor and is independent of the first system.
10. An electronic device comprising a first processor and a second processor, the first processor being connected to the second processor, wherein,
the first processor is provided with a first system and a safety system, the first system applies the data processing method of any one of claims 1-6 to perform safety processing on data transmitted between the first processor and a second system on the second processor, and the second system applies the data processing method of claim 7 to perform safety processing on data transmitted between the second processor and the first system.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202210345257.5A CN114785566B (en) | 2022-03-31 | 2022-03-31 | Data processing method, device and equipment |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202210345257.5A CN114785566B (en) | 2022-03-31 | 2022-03-31 | Data processing method, device and equipment |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN114785566A true CN114785566A (en) | 2022-07-22 |
| CN114785566B CN114785566B (en) | 2024-04-23 |
Family
ID=82427624
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202210345257.5A Active CN114785566B (en) | 2022-03-31 | 2022-03-31 | Data processing method, device and equipment |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN114785566B (en) |
Citations (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20200396080A1 (en) * | 2017-11-20 | 2020-12-17 | Samsung Electronics Co., Ltd. | Electronic device and method for transmitting and receiving data on the basis of security operating system in electronic device |
| CN113381984A (en) * | 2021-05-21 | 2021-09-10 | 珠海格力电器股份有限公司 | Data processing method, device and system, electronic equipment and storage medium |
| CN113656120A (en) * | 2021-07-23 | 2021-11-16 | 北京鸿合爱学教育科技有限公司 | Interface switching method, device, equipment and storage medium |
-
2022
- 2022-03-31 CN CN202210345257.5A patent/CN114785566B/en active Active
Patent Citations (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20200396080A1 (en) * | 2017-11-20 | 2020-12-17 | Samsung Electronics Co., Ltd. | Electronic device and method for transmitting and receiving data on the basis of security operating system in electronic device |
| CN113381984A (en) * | 2021-05-21 | 2021-09-10 | 珠海格力电器股份有限公司 | Data processing method, device and system, electronic equipment and storage medium |
| CN113656120A (en) * | 2021-07-23 | 2021-11-16 | 北京鸿合爱学教育科技有限公司 | Interface switching method, device, equipment and storage medium |
Also Published As
| Publication number | Publication date |
|---|---|
| CN114785566B (en) | 2024-04-23 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| JP6612322B2 (en) | Data processing method and data processing apparatus | |
| TWI489315B (en) | System and method for temporary secure boot of an electronic device | |
| US9268971B2 (en) | Secure processor supporting multiple security functions | |
| EP3198786B1 (en) | Secure object access | |
| CN107567630B (en) | Isolation of trusted input/output devices | |
| CN111737366B (en) | Private data processing method, device, equipment and storage medium of block chain | |
| JP2011222010A (en) | Method and system for securely and remotely startup, boot, and login from mobile device to computer | |
| CN108768963B (en) | Communication method and system of trusted application and secure element | |
| JP2012005129A (en) | Method for securing transmission data and security system | |
| EP2849403B1 (en) | Method and system for controlling the exchange of privacy-sensitive information | |
| US7940934B2 (en) | System and method for securing computing management functions | |
| JP2010514000A (en) | Method for securely storing program state data in an electronic device | |
| JP6756056B2 (en) | Cryptographic chip by identity verification | |
| CN106992978B (en) | Network security management method and server | |
| Alzomai et al. | The mobile phone as a multi OTP device using trusted computing | |
| CN110138736B (en) | Identity authentication method, device and equipment for multiple dynamic random encryption of Internet of things | |
| CN114091058A (en) | Method and system for secure sharing of data between a first area and a second area | |
| CN112153038B (en) | Method and device for secure login, authentication terminal and readable storage medium | |
| Kurnikov et al. | Keys in the clouds: auditable multi-device access to cryptographic credentials | |
| CN111901312A (en) | Method, system, equipment and readable storage medium for network access control | |
| Sarhan et al. | Secure android-based mobile banking scheme | |
| CN116366364A (en) | Terminal data processing method and system for cloud computer | |
| US9135449B2 (en) | Apparatus and method for managing USIM data using mobile trusted module | |
| CN114785566B (en) | Data processing method, device and equipment | |
| CN108154037B (en) | Inter-process data transmission method and device |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |