CN107229882B - Processor switching between trusted mode and untrusted mode - Google Patents
Processor switching between trusted mode and untrusted mode Download PDFInfo
- Publication number
- CN107229882B CN107229882B CN201710391335.4A CN201710391335A CN107229882B CN 107229882 B CN107229882 B CN 107229882B CN 201710391335 A CN201710391335 A CN 201710391335A CN 107229882 B CN107229882 B CN 107229882B
- Authority
- CN
- China
- Prior art keywords
- mode
- trusted
- switching
- request
- kernel
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/70—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer
- G06F21/71—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure computing or processing of information
- G06F21/74—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure computing or processing of information operating in dual or compartmented mode, i.e. at least one secure mode
Landscapes
- Engineering & Computer Science (AREA)
- Physics & Mathematics (AREA)
- Computer Hardware Design (AREA)
- Theoretical Computer Science (AREA)
- Mathematical Physics (AREA)
- Computer Security & Cryptography (AREA)
- Software Systems (AREA)
- General Engineering & Computer Science (AREA)
- General Physics & Mathematics (AREA)
- Storage Device Security (AREA)
Abstract
The invention provides a processor which is switched between a trusted mode and an untrusted mode. The processor includes: the system comprises a switching control module, a trusted kernel, an untrusted kernel and a resource protection module, wherein the trusted kernel is connected with the switching control module; the non-trusted kernel is connected with the switching control module; and the resource protection module is connected with the switching control module, the trusted kernel and the untrusted kernel. The invention can realize the isolation of the trusted mode and the non-trusted mode through hardware, and has simple realization mechanism and less resource occupation.
Description
Technical Field
The invention relates to the technical field of computers, in particular to a processor capable of switching between a trusted mode and an untrusted mode.
Background
With the continuous development of informatization, the reliability of a system becomes more and more important, the traditional software-level-based reliability protection has lower and lower security, and hackers can directly attack an operating system beyond software protection and then steal sensitive software and hardware resources; therefore, in order to make up for the shortfall of the trustworthiness protection at the software level, a trusted framework is proposed which aims to provide the system with an underlying hardware protection mechanism outside the software.
The specific idea of the trusted framework design is as follows: adding a credible mode in the running mode of the processor, abstracting a credible kernel in the system, and dividing the processor in the credible mode, the system IP with credible attribute and other sensitive and important software and hardware resources in the system into the credible kernel; furthermore, the hardware mechanism ensures that the resources in the trusted kernel can only be accessed by the trusted mode, thereby realizing the isolation of the trusted kernel and the untrusted kernel and ensuring the confidentiality and the integrity of the trusted resources.
The trusted mode and the untrusted mode are respectively provided with independent registers, when the processor is switched between the trusted mode and the untrusted mode, the switching process is monitored through a monitoring mode, the mechanism provides a bottom layer hardware protection mechanism except software protection for the system, indirect switching between the trusted mode and the untrusted mode is realized, but the realization mechanism is complex and occupies more hardware resources.
Disclosure of Invention
The processor capable of mutually switching between the trusted mode and the untrusted mode can realize the isolation of the trusted mode and the untrusted mode through hardware, and has the advantages of simple realization mechanism and less resource occupation.
In a first aspect, the present invention provides a processor for switching between a trusted mode and an untrusted mode, comprising: a switching control module, a trusted kernel, an untrusted kernel and a resource protection module, wherein,
the switching control module is used for sending the mode switching request to the trusted kernel or the untrusted kernel and sending a resource storage request to the resource protection module after receiving the mode switching request; when the switching is completed, sending a switching return request to the non-trusted kernel or the trusted kernel, and simultaneously sending a resource recovery request to the resource protection module;
the trusted kernel is connected with the switching control module and used for storing trusted resources and public resources in the processor, recording the current field and switching to the untrusted kernel after receiving a mode switching request, and switching back to the trusted kernel according to field information recorded when switching occurs after receiving a switching back request;
the non-trusted kernel is connected with the switching control module and used for storing non-trusted resources and public resources in the processor, recording the current field and switching to the trusted kernel after receiving a mode switching request, and switching back to the non-trusted kernel according to the field information recorded when switching occurs after receiving a switching back request;
and the resource protection module is connected with the switching control module, the trusted kernel and the untrusted kernel and used for performing stack pressing storage on the resources of the trusted kernel or the untrusted kernel which receive the switching request after receiving the resource storage request and performing stack popping recovery on the resources of the trusted kernel or the untrusted kernel after receiving the resource recovery request.
Optionally, the trusted kernel may access resources of the own kernel and resources in the untrusted kernel, and the untrusted kernel may only access resources of the own kernel.
Optionally, the mode switching request is a mode switching call request or a cross-mode interrupt request.
Optionally, the switch return request is a mode switch call return or a cross-mode interrupt return. Optionally, the trusted kernel and the untrusted kernel both have independent program status registers, and two or more of a trusted flag bit, an initial mode flag bit, a hardware push flag bit, or a switching request flag bit are set in the program status registers, and are used to record a current field when mode switching occurs, where,
the trusted zone bit is used for indicating that the mode of the processor is a trusted mode or an untrusted mode;
the starting mode flag bit is used for indicating that the starting mode of mode switching is a trusted mode or an untrusted mode, so that after the switching of the processor is completed, a returned mode is judged according to the starting mode flag bit;
the hardware push flag bit is used for indicating whether pushing of the general register is performed during mode switching, so that whether popping of the general register is required or not is judged according to the hardware push flag bit after switching of the processor is completed;
the switching request flag bit is used for indicating whether a request for triggering mode switching is a mode switching call request or a cross-mode interrupt request, so that after the switching of the processor is completed, the type of the switching request is judged according to the switching request flag bit.
Optionally, a trusted flag bit, an initial mode flag bit, a hardware push flag bit, and a switch request flag bit are set in a program status register of the trusted kernel.
Optionally, a trusted flag bit and an initiation mode flag bit are set in a program status register of the untrusted kernel.
Optionally, the resource protection module is further configured to:
when the trusted kernel receives a switching request, stack-pushing and saving the public resources and the trusted resources of the trusted kernel, if the switching request is a cross-mode interrupt request, clearing the stack-pushed public resources further, and after the switching of the processor is completed, performing stack popping and restoring on the saved resources when the processor returns to an initial mode;
and when the non-trusted kernel receives a switching request, only stack-pushing storage is carried out on the non-trusted resource of the non-trusted kernel, and after the switching of the processor is completed, stack-popping recovery is carried out on the stored resource when the processor returns to the initial mode.
Optionally, when the mode switch call request and the cross-mode interrupt request are generated simultaneously, the cross-mode interrupt request may be masked.
The processor which is switched between the trusted mode and the untrusted mode and provided by the embodiment of the invention directly switches between the trusted mode and the untrusted mode without other modes, and performs hardware protection on a switching field in the switching process, thereby realizing isolation between the trusted mode and the untrusted mode, and having simple implementation mechanism and less resource occupation.
Drawings
FIG. 1 is a block diagram of a processor that switches between a trusted mode and an untrusted mode according to an embodiment of the present invention;
FIG. 2 is a schematic diagram of the operating mode of the processor according to the present invention;
FIG. 3 is a diagram illustrating the structure of a program status register according to the present invention;
FIG. 4 is a diagram illustrating a processor processing a handover request according to an embodiment of the invention;
FIG. 5 is a diagram illustrating a processor processing a handover request according to yet another embodiment of the invention.
Detailed Description
In order to make the objects, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the drawings in the embodiments of the present invention, and it is obvious that the described embodiments are only a part of the embodiments of the present invention, and not all of the embodiments. All other embodiments, which can be derived by a person skilled in the art from the embodiments given herein without making any creative effort, shall fall within the protection scope of the present invention.
The invention provides a processor which is switched between a trusted mode and an untrusted mode, as shown in fig. 1, the processor comprises a switching control module 11, a trusted kernel 12, an untrusted kernel 13, and a resource protection module 14, wherein,
the switching control module 11 is configured to send a mode switching request to the trusted kernel 12 or the untrusted kernel 13 after receiving the mode switching request, and send a save instruction to the resource protection module 14 at the same time; when the switching is completed, sending a switching return request to the untrusted kernel or the trusted kernel, and sending a switching return instruction to the resource protection module 14;
the trusted kernel 12 is connected with the switching control module 11 and used for storing resources which can be accessed by the processor in a trusted mode, recording the current field and switching to the untrusted kernel 13 after receiving a mode switching request, and switching back to the trusted kernel 12 according to field information recorded when switching occurs after receiving a switching back request;
the non-trusted kernel 13 is connected with the switching control module 11 and used for storing resources which can be accessed by the processor in a non-trusted mode, recording the current site and then switching to the trusted kernel 12 after receiving a mode switching request, and switching back to the non-trusted kernel 13 according to the site information recorded when switching occurs after receiving a switching back request;
and the resource protection module 14 is connected to the switching control module 11, the trusted kernel 12 and the untrusted kernel 13, and is configured to, after receiving the saving instruction, push and save the resource of the trusted kernel 12 or the untrusted kernel 13 that receives the switching request, and after receiving the resource recovery request, pop the resource of the trusted kernel 12 or the untrusted kernel 13.
The processor which is switched between the trusted mode and the untrusted mode and provided by the embodiment of the invention directly switches between the trusted mode and the untrusted mode without other modes, and performs hardware protection on a switching field in the switching process, thereby realizing isolation between the trusted mode and the untrusted mode, and having simple implementation mechanism and less resource occupation.
Alternatively, as shown in FIG. 2, the processor may operate in a trusted mode and an untrusted mode. There are two modes of trusted mode: a trusted state super user mode and a trusted state common user mode; there are two modes of untrusted mode: an untrusted super user mode and an untrusted ordinary user mode.
If the processor works in a trusted mode, access management can be carried out on trusted resources and non-trusted resources; if the processor works in the non-trusted mode, only the access management can be carried out on the non-trusted resources. The processor can be directly switched between the trusted mode and the untrusted mode without other modes except the trusted mode and the untrusted mode, and resources of the starting mode and the target mode are managed by hardware in the switching process.
Optionally, the trusted kernel 12 may access resources belonging to its own kernel and resources in the untrusted kernel, and the untrusted kernel 13 may only access resources belonging to its own kernel.
Optionally, the mode switching request is a mode switching call request or a cross-mode interrupt request.
Optionally, the switch return request is a mode switch call return or a cross-mode interrupt return.
Optionally, as shown in fig. 3, the trusted kernel 12 and the untrusted kernel 13 both have independent program status registers, and two or more of the trusted flag bit 15, the start mode flag bit 16, the hardware push flag bit 17, or the switch request flag bit 18 are set in the program status registers, and are used to record a current field when a mode switch occurs, where,
the trusted flag 15 is used for indicating that the mode in which the processor is currently located is a trusted mode or an untrusted mode;
the starting mode flag bit 16 is used for indicating that the starting mode of mode switching is a trusted mode or an untrusted mode, so that after the switching of the processor is completed, a returned mode is determined according to the starting mode flag bit;
the hardware push flag bit 17 is used for indicating whether pushing of the general register is performed during mode switching, so that whether popping of the general register is required or not is judged according to the hardware push flag bit after switching of the processor is completed;
the switching request flag 18 is used to indicate whether the request for triggering mode switching is a mode switching call request or a cross-mode interrupt request, so that after the processor completes switching, the triggering type is determined according to the switching request flag.
A trusted flag bit 15, an initial mode flag bit 16, a hardware push flag bit 17, and a switch request flag bit 18 are set in a program status register of the trusted kernel 12.
Optionally, a trusted flag bit 15 and a start mode flag bit 16 are set in a program status register of the untrusted kernel.
Optionally, the resource protection module 14 is further configured to:
when the trusted kernel 12 receives the switching request, stack-pushing and saving the public resources and the trusted resources of the trusted kernel 12, if the switching request is a cross-mode interrupt request, the stack-pushing public resources are further cleared, and after the switching of the processor is completed, stack popping and restoring are performed on the saved resources when the processor returns to the starting mode;
when the untrusted kernel 13 receives the switching request, only the untrusted resource of the untrusted kernel 13 is pushed and saved, and after the switching of the processor is completed, the saved resource is popped and restored when the processor returns to the starting mode.
Optionally, when the mode switch call request and the cross-mode interrupt request are generated simultaneously, the cross-mode interrupt request may be masked.
Alternatively, as shown in fig. 4, when the processor is in trusted mode and receives the mode switch call at (r) and switches to untrusted mode, the resource protection module 14 first pushes and saves the program state register and the program counter in the trusted kernel 12. After the stack saving of the resource of the trusted kernel 12 is performed, the hardware sets the value of the hardware stack flag bit 17 in the trusted mode program status register to record that the trusted mode does not generate the hardware stack of the general register, and the hardware sets the value of the initial mode flag bit 16 in the untrusted mode program status register to record that the subsequent untrusted mode call needs to be returned to the trusted mode when returned. The processor then switches directly to the untrusted kernel 13 as shown in step two.
And thirdly, when the processor performs mode calling processing in the untrusted mode, mode switching calling occurs, that is, nesting of mode switching occurs, and at this time, the resource protection module 14 first performs stack pushing storage on a program state register and a program counter of the untrusted kernel 13. After stack saving is performed on the non-trusted mode resource, the hardware sets the value of the switch request flag bit 18 in the trusted mode program status register to record that the switch from the non-trusted kernel 13 to the trusted kernel 12 is realized through mode switch call, and the hardware sets the value of the start mode flag bit 16 in the trusted mode program status register to record that the subsequent trusted mode call needs to be returned to the non-trusted kernel when returned.
Then, as shown in step (iv), the processor directly switches to the trusted kernel 12, and completes the specific task of the mode switching call in the trusted kernel 12. When the trusted mode call returns, a trusted zone bit 15 in a trusted mode program state register indicates that the current trusted mode is in; the start mode flag bit 16 indicates that a switch from untrusted to trusted mode was previously made; it can therefore be determined that the trusted mode needs to be switched back to the untrusted mode at this time. At the same time, the switch request flag bit 18 in the trusted program status register indicates that the switch to trusted mode was previously made by a mode switch call, and therefore, the return of the mode switch call can be determined. After the switching returns to the untrusted mode, the hardware stack of the resource protection module 14 restores the values of the program state register and the program counter of the untrusted kernel, returns to the original field of the untrusted kernel, and continues to perform the mode call processing of the untrusted mode as shown in step (c).
When the non-trusted mode is called and returned, a trusted zone bit 15 in a program state register of the non-trusted mode indicates that the program is currently in the non-trusted mode; the start mode flag bit 16 indicates that a switch from trusted mode to untrusted mode was previously made; it can therefore be determined that the untrusted mode needs to be switched back to trusted mode at this time. Meanwhile, a hardware stack pushing flag bit 17 in the trusted mode program state register indicates that the stack pushing of the general register does not occur in the previous switching process, so that the stack popping of the general register is not needed after the trusted mode is returned, and then the values of the trusted mode program state register and the program counter are recovered through the hardware stack popping of the resource protection module 14, and the trusted mode program state register and the program counter are returned to the original site of the trusted mode.
Optionally, as shown in fig. 5, the processor is in a trusted mode and receives an untrusted interrupt request for triggering mode switching at (r), and when switching from the trusted mode to the untrusted mode is performed through cross-mode interrupt, the resource protection module 14 first pushes and saves a program state register and a program counter of a trusted kernel, and pushes and clears hardware of a general purpose register. And then, recording that the trusted mode is pushed by the hardware of the general register by setting a hardware push flag bit 17 in a program status register of the trusted mode in the trusted kernel 12 through hardware. Then, as shown in step two, the processor directly switches to the untrusted kernel 13 and backs up the program status register of the untrusted mode into the exception-preserving program status register. The hardware sets the value of the start mode flag bit 16 in the untrusted mode program status register to record that the subsequent untrusted kernel 13 needs to return to the trusted kernel 12 when a call returns.
And thirdly, when the processor processes the interrupt request in the non-trusted mode, the processor receives the trusted interrupt request for triggering mode switching, and the resource protection module firstly pushes and saves the program state register and the program counter of the non-trusted kernel through hardware in the non-trusted mode. Then, as shown in step (iv), the processor directly enters the trusted mode. Fifthly, the processor firstly backs up a program state register of the trusted kernel 12 to an exception retention program state register, the hardware sets the value of an initial mode flag bit 15 in the trusted mode program state register to record that the call of a subsequent trusted mode needs to return to the untrusted kernel 13 when returning, the hardware sets the value of a switching request flag bit 18 in the trusted mode program state register to record that the switching from the untrusted mode to the trusted mode is realized through cross-mode interrupt, and then the interrupt request processing is carried out in the trusted mode. When the interrupt processing of the trusted mode returns, a trusted zone bit 15 in a trusted mode program status register indicates that the trusted mode is currently in the trusted mode; the start mode flag bit 16 indicates that a switch from untrusted to trusted mode was previously made; it can therefore be determined that the trusted mode needs to be switched back to the untrusted mode at this time. Meanwhile, the switching request flag bit 18 in the trusted mode program state register indicates that the switching is to be performed to the trusted mode in the previous interrupt mode, so that the switching return of the trusted interrupt at this time can be determined, the values of the untrusted mode program state register and the program counter are restored through the hardware pop stack of the resource protection module 14, the original field of the untrusted kernel is returned, and the processing of the interrupt request of the untrusted kernel is continued as shown in step (c). When the untrusted interrupt returns, a trusted zone bit 15 in the program state register of the untrusted mode indicates that the untrusted mode is currently in the untrusted mode; the start mode flag bit 16 indicates that a switch from trusted mode to untrusted mode was previously made; it can therefore be determined that the untrusted mode needs to be switched back to the trusted mode at this time. Meanwhile, a hardware stack pushing flag bit 17 in the trusted mode program state register indicates that the hardware stack pushing of the general register occurs in the previous switching process, so that the stack popping of the general register is required after the trusted mode is returned, and the values of the program state register, the program counter and the general register of the trusted kernel are recovered through the hardware stack popping of the resource protection module 14, and the values are returned to the original site of the trusted kernel 12.
It will be understood by those skilled in the art that all or part of the processes of the methods of the embodiments described above can be implemented by specifying the relevant hardware via a computer program, which can be stored in a computer-readable storage medium, and when executed, can include the processes of the embodiments of the methods described above. The storage medium may be a magnetic disk, an optical disk, a Read-Only Memory (ROM), a Random Access Memory (RAM), or the like.
The above description is only for the specific embodiment of the present invention, but the scope of the present invention is not limited thereto, and any changes or substitutions that can be easily conceived by those skilled in the art within the technical scope of the present invention are included in the scope of the present invention. Therefore, the protection scope of the present invention shall be subject to the protection scope of the claims.
Claims (9)
1. A processor capable of switching between a trusted mode and an untrusted mode, the processor comprising a switching control module, a trusted core, an untrusted core, and a resource protection module, wherein,
the switching control module is used for sending the mode switching request to the trusted kernel or the untrusted kernel and sending a resource storage request to the resource protection module after receiving the mode switching request; when the switching is completed, sending a switching return request to the non-trusted kernel or the trusted kernel, and simultaneously sending a resource recovery request to the resource protection module;
the trusted kernel is connected with the switching control module and used for storing trusted resources and public resources in the processor, recording the current field and switching to the untrusted kernel after receiving a mode switching request, and switching back to the trusted kernel according to field information recorded when switching occurs after receiving a switching back request;
the non-trusted kernel is connected with the switching control module and used for storing non-trusted resources and public resources in the processor, recording the current field and switching to the trusted kernel after receiving a mode switching request, and switching back to the non-trusted kernel according to the field information recorded when switching occurs after receiving a switching back request;
the resource protection module is connected with the switching control module, the trusted kernel and the untrusted kernel, and is used for performing stack pressing storage on resources of the trusted kernel or the untrusted kernel which receive the switching request after receiving a resource storage request, and performing stack popping recovery on the resources of the trusted kernel or the untrusted kernel after receiving a resource recovery request, wherein the resources comprise a program state register and a program counter;
the trusted kernel and the untrusted kernel are provided with independent program state registers, and the program state registers are provided with two or more of a trusted zone bit, an initial mode zone bit, a hardware stack pushing zone bit or a switching request zone bit and used for recording the current site when mode switching occurs.
2. The processor of claim 1, wherein the trusted core has access to resources belonging to the trusted core and to resources in an untrusted core, and wherein the untrusted core has access to only resources belonging to the trusted core.
3. The processor of claim 1, wherein the mode switch request is a mode switch call request or a cross-mode interrupt request.
4. The processor of claim 1, wherein the switch return request is a mode switch call return or a cross-mode interrupt return.
5. The processor of claim 1,
the trusted zone bit is used for indicating that the mode of the processor is a trusted mode or an untrusted mode;
the starting mode flag bit is used for indicating that the starting mode of mode switching is a trusted mode or an untrusted mode, so that after the switching of the processor is completed, a returned mode is judged according to the starting mode flag bit;
the hardware push flag bit is used for indicating whether pushing of the general register is performed during mode switching, so that whether popping of the general register is required or not is judged according to the hardware push flag bit after switching of the processor is completed;
the switching request flag bit is used for indicating whether a request for triggering mode switching is a mode switching call request or a cross-mode interrupt request, so that after the switching of the processor is completed, the type of the switching request is judged according to the switching request flag bit.
6. The processor according to claim 5, wherein a trusted flag bit, a start mode flag bit, a hardware push flag bit and a switch request flag bit are set in a program status register of the trusted core.
7. The processor of claim 5, wherein a trusted flag bit and a start mode flag bit are set in a program status register of the untrusted core.
8. The processor of claim 3, wherein the resource protection module is further configured to:
when the trusted kernel receives a switching request, stack-pushing and saving the public resources and the trusted resources of the trusted kernel, if the switching request is the cross-mode interrupt request, the stack-pushing public resources are further cleared, and after the switching of the processor is completed, stack popping and restoring are carried out on the saved resources when the processor returns to the starting mode;
and when the non-trusted kernel receives a switching request, only stack-pushing storage is carried out on the non-trusted resource of the non-trusted kernel, and after the switching of the processor is completed, stack-popping recovery is carried out on the stored resource when the processor returns to the initial mode.
9. The processor as recited in claim 3, wherein the cross-mode interrupt request is masked when the mode switch invoke request and the cross-mode interrupt request are generated simultaneously.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201710391335.4A CN107229882B (en) | 2017-05-27 | 2017-05-27 | Processor switching between trusted mode and untrusted mode |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201710391335.4A CN107229882B (en) | 2017-05-27 | 2017-05-27 | Processor switching between trusted mode and untrusted mode |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN107229882A CN107229882A (en) | 2017-10-03 |
| CN107229882B true CN107229882B (en) | 2020-09-15 |
Family
ID=59934546
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201710391335.4A Active CN107229882B (en) | 2017-05-27 | 2017-05-27 | Processor switching between trusted mode and untrusted mode |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN107229882B (en) |
Families Citing this family (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN109033842B (en) * | 2018-07-27 | 2020-10-16 | 杭州中天微系统有限公司 | Data processor |
| CN109063516B (en) * | 2018-07-27 | 2020-12-04 | 杭州中天微系统有限公司 | Data processor |
Citations (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| WO2007030524A1 (en) * | 2005-09-07 | 2007-03-15 | Ntt Docomo, Inc. | Method and apparatus to provide separation of system software components |
| US8468600B1 (en) * | 2011-03-04 | 2013-06-18 | Adobe Systems Incorporated | Handling instruction received from a sandboxed thread of execution |
| CN104463013A (en) * | 2014-12-08 | 2015-03-25 | 上海斐讯数据通信技术有限公司 | Mobile terminal and data encryption method thereof |
| CN104850787A (en) * | 2015-02-11 | 2015-08-19 | 数据通信科学技术研究所 | Mobile terminal operation system based on high-assurance kernel module and realization method of mobile terminal operation system |
| CN105488388A (en) * | 2015-12-22 | 2016-04-13 | 中软信息系统工程有限公司 | Method for implementing application software behavior monitoring system based on CPU temporal-spatial isolation mechanism |
| CN106599717A (en) * | 2016-12-01 | 2017-04-26 | 杭州中天微系统有限公司 | Data processor |
-
2017
- 2017-05-27 CN CN201710391335.4A patent/CN107229882B/en active Active
Patent Citations (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| WO2007030524A1 (en) * | 2005-09-07 | 2007-03-15 | Ntt Docomo, Inc. | Method and apparatus to provide separation of system software components |
| US8468600B1 (en) * | 2011-03-04 | 2013-06-18 | Adobe Systems Incorporated | Handling instruction received from a sandboxed thread of execution |
| CN104463013A (en) * | 2014-12-08 | 2015-03-25 | 上海斐讯数据通信技术有限公司 | Mobile terminal and data encryption method thereof |
| CN104850787A (en) * | 2015-02-11 | 2015-08-19 | 数据通信科学技术研究所 | Mobile terminal operation system based on high-assurance kernel module and realization method of mobile terminal operation system |
| CN105488388A (en) * | 2015-12-22 | 2016-04-13 | 中软信息系统工程有限公司 | Method for implementing application software behavior monitoring system based on CPU temporal-spatial isolation mechanism |
| CN106599717A (en) * | 2016-12-01 | 2017-04-26 | 杭州中天微系统有限公司 | Data processor |
Also Published As
| Publication number | Publication date |
|---|---|
| CN107229882A (en) | 2017-10-03 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN107977573B (en) | Method and system for secure disk access control | |
| CN103827809B (en) | For the system and method for virtual partition monitoring | |
| CN103324500A (en) | Method and device for recycling internal memory | |
| US8402539B1 (en) | Systems and methods for detecting malware | |
| TWI443580B (en) | Out-of-band access to storage devices through port-sharing hardware | |
| US20190108333A1 (en) | Systems and methods for monitoring bait to protect users from security threats | |
| CN107229882B (en) | Processor switching between trusted mode and untrusted mode | |
| TWI721996B (en) | Secure mode state data access tracking | |
| CN107273765B (en) | Processor based on double virtual kernel mechanism | |
| CN112860322B (en) | Operating system switching method, device, equipment and storage medium | |
| US11888690B2 (en) | System and method for subscription limitation enforcement in distributed system | |
| CN107835185B (en) | Mobile terminal security service method and device based on ARM TrustZone | |
| WO2018136087A1 (en) | Multiple remote attestation service for cloud-based systems | |
| CN109063516B (en) | Data processor | |
| CN108985098B (en) | Data processor | |
| TW201830407A (en) | Systems, methods, and computer programs for providing row tamper protection in a multi-bank memory cell array | |
| CN106682512B (en) | Method, device and system for preventing program from being modified | |
| CN109388511B (en) | Information processing method, electronic equipment and computer storage medium | |
| KR102149711B1 (en) | An apparatus for detecting and preventing ransom-ware behavior using camouflage process, a method thereof and computer recordable medium storing program to perform the method | |
| US20200250107A1 (en) | Systems and methods for safely detecting indeterminate states of ranges in a self-encrypting storage resource | |
| CN111062035A (en) | Lesog software detection method and device, electronic equipment and storage medium | |
| JP2022507883A (en) | Exception handling method, terminal device and storage medium | |
| CN115174596A (en) | Equipment remote copying method, device and medium | |
| US20170300104A1 (en) | Power-saving method and an electronic device for performing power consumption management | |
| WO2017016068A1 (en) | Method for application synchronization during multi-domain switching and user terminal |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |