CN114785566B - Data processing method, device and equipment - Google Patents
Data processing method, device and equipment Download PDFInfo
- Publication number
- CN114785566B CN114785566B CN202210345257.5A CN202210345257A CN114785566B CN 114785566 B CN114785566 B CN 114785566B CN 202210345257 A CN202210345257 A CN 202210345257A CN 114785566 B CN114785566 B CN 114785566B
- Authority
- CN
- China
- Prior art keywords
- transmission data
- data
- processor
- security
- processing
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
- 238000003672 processing method Methods 0.000 title claims abstract description 27
- 230000005540 biological transmission Effects 0.000 claims abstract description 305
- 238000012545 processing Methods 0.000 claims abstract description 145
- 238000000034 method Methods 0.000 claims abstract description 46
- 238000012216 screening Methods 0.000 claims description 27
- 230000004044 response Effects 0.000 claims description 4
- 230000008569 process Effects 0.000 description 14
- 238000010586 diagram Methods 0.000 description 10
- 230000006870 function Effects 0.000 description 5
- 230000007246 mechanism Effects 0.000 description 4
- 230000002093 peripheral effect Effects 0.000 description 4
- 238000013461 design Methods 0.000 description 3
- 238000005516 engineering process Methods 0.000 description 3
- 230000000694 effects Effects 0.000 description 2
- 230000003993 interaction Effects 0.000 description 2
- 238000012423 maintenance Methods 0.000 description 2
- 230000003287 optical effect Effects 0.000 description 2
- 238000004364 calculation method Methods 0.000 description 1
- 230000008859 change Effects 0.000 description 1
- 238000004891 communication Methods 0.000 description 1
- 238000001914 filtration Methods 0.000 description 1
- 238000006467 substitution reaction Methods 0.000 description 1
- 238000012546 transfer Methods 0.000 description 1
- 230000001960 triggered effect Effects 0.000 description 1
- 230000002618 waking effect Effects 0.000 description 1
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
- H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/60—Protecting data
- G06F21/602—Providing cryptographic facilities or services
Landscapes
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Computer Hardware Design (AREA)
- Theoretical Computer Science (AREA)
- General Engineering & Computer Science (AREA)
- Signal Processing (AREA)
- Computer Networks & Wireless Communication (AREA)
- Health & Medical Sciences (AREA)
- Bioethics (AREA)
- General Health & Medical Sciences (AREA)
- Software Systems (AREA)
- Physics & Mathematics (AREA)
- General Physics & Mathematics (AREA)
- Computing Systems (AREA)
- Storage Device Security (AREA)
Abstract
The application discloses a data processing method, a device and equipment. The method is mainly applied to the electronic equipment with the first processor connected with the second processor, and when the first system on the first processor and the second system on the second processor are used for data transmission, a safety system independent of the first system on the first processor is used for carrying out safety processing (e.g. encryption and/or decryption) on the transmitted data. Therefore, the safety and reliability of the transmission data between the first system and the second system can be ensured, and the situation that an illegal system is impersonated by the second system to attack the first system or steal the transmission data between the first system and the second system is avoided.
Description
Technical Field
The present application relates to the field of data security, and in particular, to a data processing method, apparatus, and device.
Background
In current hardware designs, mainstream computers often employ a host system running on a host processor (e.g., an ARM processor) to implement basic functionality, and then one or more sub-processors (e.g., MCU processors) are connected to implement extended or dedicated functionality through the sub-systems running on the sub-processors.
However, the subsystem on the sub-processor generally does not have high security design and processing capability, and cannot ensure secure data transmission with the main system on the main processor, thereby creating a security risk.
Disclosure of Invention
Based on the above, the application provides a data processing method, a device and equipment.
According to a first aspect of an embodiment of the present application, there is provided a data processing method, including: the first system acquires first transmission data to be sent to the second system; encrypting the first transmission data based on the security system to obtain second transmission data; the first system sends the second transmission data to the second system; and/or the first system receives third transmission data sent by the second system; decrypting the third transmission data based on the security system to obtain fourth transmission data, wherein the first system operates on the first processor; the second system is operated on the second processor; the first processor is connected with the second processor; the security system is operated on the first processor and is independent of the first system.
According to an embodiment of the present application, encrypting the first transmission data and/or decrypting the third transmission data includes: the first system obtains a security processing tool sent by the security system; determining encryption rules and/or decryption rules based on the secure processing tool; and the first system performs encryption processing on the first transmission data based on the encryption rule, and/or the first system performs decryption processing on the second transmission data based on the decryption rule.
According to an embodiment of the present application, the method further includes: in response to obtaining the input instruction or meeting a preset condition, the first system obtains or updates the secure processing tool.
According to an embodiment of the present application, based on the security system, the encrypting the first transmission data and/or the decrypting the third transmission data includes: the first system sends the first transmission data and/or the third transmission data to the security system; and receiving second transmission data and/or fourth data returned by the security system, wherein the second transmission data is first transmission data which is encrypted by the security system, and the fourth transmission data is third transmission data which is decrypted by the security system.
According to an embodiment of the present application, based on the security system, encrypting the first transmission data and/or decrypting the third transmission data includes: under the condition that the first transmission data and/or the third transmission data meet a first preset screening rule, encrypting the first transmission data and/or decrypting the third transmission data, wherein the first preset screening rule comprises at least one of the following: the data amount of the first transmission data and/or the second transmission data is within a specified range; the purpose of the first transmission data and/or the second transmission data is within the specified purpose range; the attribute of the first transmission data and/or the second transmission data satisfies a specified condition.
According to an embodiment of the present application, based on the security system, encrypting the first transmission data and/or decrypting the third transmission data includes: under the condition that the second preset screening condition is met, the first system sends the first transmission data and/or the third transmission data to the safety system, and receives the second transmission data and/or the fourth transmission data returned by the safety system; and under the condition that the second preset screening condition is not met, the first system encrypts the first transmission data to obtain second transmission data, and/or the first system decrypts the third transmission data to obtain fourth transmission data.
According to a second aspect of an embodiment of the present application, there is provided a data processing method, including: the second system receives second transmission data sent by the first system; based on the security system, decrypting the second transmission data to obtain first transmission data; the second system performs data processing on the first transmission data to obtain third transmission data; encrypting the third transmission data based on the security system to obtain fourth transmission data; the second system returns fourth transmission data to the first system, wherein the first system operates on the first processor; the second system is operated on the second processor; the first processor is connected with the second processor; the security system is operated on the first processor and is independent of the first system.
According to a third aspect of embodiments of the present application, there is provided a data processing apparatus comprising: the data acquisition module to be transmitted is used for acquiring first transmission data to be sent to the second system by the first system; the first encryption processing module is used for carrying out encryption processing on the first transmission data based on the security system so as to obtain second transmission data; the first data sending module is used for sending the second transmission data to the second system by the first system; and/or a first data receiving module, configured to receive, by using the first system, third transmission data sent by the second system; the first decryption module is used for decrypting the third transmission data based on the security system to obtain fourth transmission data, wherein the first system is operated on the first processor; the second system is operated on the second processor; the first processor is connected with the second processor; the security system is operated on the first processor and is independent of the first system.
According to a fourth aspect of an embodiment of the present application, there is provided a data processing apparatus comprising: the second data receiving module is used for receiving second transmission data sent by the first system by the second system; the second decryption processing module is used for decrypting the second transmission data based on the security system so as to acquire the first transmission data; the data processing module is used for carrying out data processing on the first transmission data by the second system so as to obtain third transmission data; the second encryption processing module is used for carrying out encryption processing on the third transmission data based on the security system so as to obtain fourth transmission data; the second data sending module is used for returning fourth transmission data to the first system by the second system, wherein the first system operates on the first processor; the second system is operated on the second processor; the first processor is connected with the second processor; the security system is operated on the first processor and is independent of the first system.
According to a fifth aspect of the embodiment of the present application, there is provided an electronic device, including a first processor and a second processor, where the first processor is connected to the second processor, and a first system and a security system are running on the first processor, where the first system performs security processing on transmission data with the second system on the second processor by using any one of the data processing methods executed by the first system, and the second system performs security processing on transmission data with the first system by using any one of the data processing methods executed by the second system.
According to a sixth aspect of embodiments of the present application, there is provided a computer storage medium comprising a set of computer executable instructions for performing the data security processing method of any one of the above when the instructions are executed.
The embodiment of the application provides a data security processing method, device and system. The method is mainly applied to the electronic equipment with the first processor connected with the second processor, and when the first system on the first processor and the second system on the second processor are used for data transmission, a safety system independent of the first system on the first processor is used for carrying out safety processing (e.g. encryption and/or decryption) on the transmitted data. Therefore, the safety and reliability of the transmission data between the first system and the second system can be ensured, and the situation that an illegal system is impersonated by the second system to attack the first system or steal the transmission data between the first system and the second system is avoided.
It should be understood that the implementation of the present application does not need to achieve all the above advantages, but a specific technical solution may achieve a specific technical effect, and other embodiments of the present application may also achieve the above-mentioned advantages.
Drawings
The above, as well as additional purposes, features, and advantages of exemplary embodiments of the present application will become readily apparent from the following detailed description when read in conjunction with the accompanying drawings. Several embodiments of the present application are illustrated by way of example, and not by way of limitation, in the figures of the accompanying drawings and in which:
in the drawings, the same or corresponding reference numerals indicate the same or corresponding parts.
FIG. 1 is a schematic diagram of a hardware architecture according to an embodiment of the present application;
FIG. 2 is a schematic diagram of a system architecture according to an embodiment of the present application;
FIG. 3 is a schematic diagram illustrating an implementation flow of a data security processing method at a first system end according to an embodiment of the present application;
FIG. 4 is a schematic diagram of an implementation flow of a data security processing method at a second system end according to an embodiment of the present application;
FIG. 5 is a schematic diagram of a data security processing method according to an embodiment of the present application;
FIG. 6 is a schematic diagram of a hardware architecture according to another embodiment of the present application;
FIG. 7 is a schematic diagram of a system architecture according to another embodiment of the present application;
FIG. 8 is a schematic diagram illustrating an interaction process of a data security processing method according to another embodiment of the present application;
FIG. 9 is a schematic structural diagram of a first system-side data security processing apparatus according to an embodiment of the present application;
Fig. 10 is a schematic structural diagram of a second system-side data security processing device according to an embodiment of the present application.
Detailed Description
In order to make the objects, features and advantages of the present application more comprehensible, the technical solutions according to the embodiments of the present application will be clearly described in the following with reference to the accompanying drawings, and it is obvious that the described embodiments are only some embodiments of the present application, not all embodiments. All other embodiments, which can be derived by a person skilled in the art from the embodiments according to the application without any creative effort, are within the protection scope of the application.
In the description of the present specification, a description referring to terms "one embodiment," "some embodiments," "examples," "specific examples," or "some examples," etc., means that a particular feature, structure, material, or characteristic described in connection with the embodiment or example is included in at least one embodiment or example of the present application. Furthermore, the particular features, structures, materials, or characteristics described may be combined in any suitable manner in any one or more embodiments or examples. Furthermore, the different embodiments or examples described in this specification and the features of the different embodiments or examples may be combined and combined by those skilled in the art without contradiction.
Furthermore, the terms "first," "second," and the like, are used for descriptive purposes only and are not to be construed as indicating or implying a relative importance or implicitly indicating the number of technical features indicated. Thus, a feature defining "a first" or "a second" may explicitly or implicitly include at least one such feature. In the description of the present application, the meaning of "a plurality" is two or more, unless explicitly defined otherwise.
The data security processing method of the embodiment of the application is mainly applied to the hardware architecture shown in fig. 1. As shown in fig. 1, the hardware architecture includes: a first processor 101 and at least one second processor 102. Wherein a first system is run on a first processor 101 to implement basic functionality and a second system is run on a second processor 102 to implement extended or dedicated functionality.
The first system and the second system are independent systems, and the first system controls the second system to complete corresponding functions by sending transmission data to the second system; the second system may also send transmission data to the first system to enable invocation of functions of the first system, exchange of data with the first system, and the like. In the embodiment of the application, the transmission data sent and received between the first system and the second system is data in a broad sense, including data such as signals, instructions, requests, and specific contents to be processed.
In some embodiments of the present application, the second processor 102 may be disposed on a motherboard where the first processor 101 is disposed, and disposed in an electronic device together with the first processor 101 by way of a slot or an interface.
In other embodiments of the present application, the second processor 102 and the first processor 101 may also be disposed in two different electronic devices, respectively, where the first processor 101 is disposed in a main device (e.g., a host computer), and the second processor 102 is disposed in a sub-device (e.g., a peripheral computer) connected to the main device, and performs data transmission with the first processor 101 through a connection interface and a communication line between the sub-device and the main device.
Fig. 2 shows a system architecture adopted by an embodiment of the present application to implement a data security processing method. As shown in fig. 2, embodiments of the present application introduce a security system 203 between a first system 201 of a first processor and a second system 202 of a second processor.
When the first system 201 intends to transmit transmission data to the second system 202, it first interacts with the security system 203 to encrypt the transmission data to be transmitted, and then transmits the encrypted transmission data to the second system 202.
After receiving the encrypted transmission data, the second system 202 will also interact with the security system 203 to decrypt the received transmission data; then, the data processing requested by the first system is completed by using the safely processed transmission data to obtain a data result; then, the data result is interacted with the security system 203 to perform corresponding encryption processing, so as to obtain the encrypted data result, and the encrypted data result is returned to the first system 201.
After receiving the encrypted data result, the first system 201 also interacts with the security system 203 to perform corresponding decryption processing on the received data result to obtain the data result.
Vice versa, when the second system 202 intends to send transmission data to the first system 201, it first interacts with the security system 203 to encrypt the transmission data to be sent, and then sends the encrypted transmission data to the first system 201; after receiving the encrypted transmission data, the first system 201 also interacts with the security system 203 to decrypt the received transmission data, and then completes the operation requested by the second system according to the decrypted transmission data.
In an embodiment of the present application, the security system 203 is another system running on the first processor (e.g., a trust zone system in the ARM processor, or an Intel SGX (Intel Software Guard Extensions) system, etc.), which is independent of the first system running on the first processor. Thus, the secure data transmission between the first system and the second system can be realized without introducing new secure hardware.
Specifically, fig. 3 shows a main flow of a method for implementing data security processing when a first system running on a first processor intends to send transmission data to a second system running on a second processor, and as shown in fig. 3, the method includes:
operation 310, the first system obtaining first transmission data to be sent to the second system;
wherein the first transmission data is typically unencrypted plaintext data.
Operation 320, based on the security system, performing encryption processing on the first transmission data to obtain second transmission data;
in the embodiment of the present application, the specific implementation manner of the encryption process is not limited. The first transmission data is encrypted by the security system, and then the second transmission data obtained after the encryption is returned to the first system; the second transmission data may also be obtained directly by the first system by performing encryption processing in the first system using a security processing tool provided by the security system, such as a key, a signature, a certificate, or the like.
The second transmission data obtained through the encryption processing is typically ciphertext data.
At operation 330, the first system sends the second transmission data to the second system.
Fig. 4 shows a main flow of a method for implementing security processing by a second system running on a second processor when receiving transmission data sent by a first system running on a first processor, as shown in fig. 4, where the method includes:
Operation 410, the second system receives second transmission data sent by the first system;
wherein the second transmission data is typically encrypted ciphertext data.
An operation 420 of decrypting the second transmission data based on the security system to obtain the first transmission data;
In the embodiment of the present application, the specific implementation manner of the decryption process is not limited. The second transmission data is decrypted by the security system, and then the first transmission data obtained after decryption is returned to the first system; the first transmission data may also be directly obtained by performing decryption processing in the first system using a secure processing tool provided by the secure system, such as a key, a signature, a certificate, or the like.
The first transmission data obtained through the decryption process is usually plaintext data.
Operation 430, the second system performs data processing on the first transmission data to obtain third transmission data;
The third transmission data is result data obtained after data processing, and is plaintext data.
Operation 440, based on the security system, performing encryption processing on the third transmission data to obtain fourth transmission data;
The fourth transmission data is ciphertext data obtained by encrypting the third transmission data.
At operation 450, the second system returns the fourth transmission data to the first system.
Fig. 5 shows a main flow of a method for implementing data security processing when a first system running on a first processor receives transmission data sent by a second system running on a second processor, as shown in fig. 5, the method includes:
Operation 510, the first system receiving third transmission data sent by the second system;
the third transmission data sent to the first system by the second system is usually encrypted ciphertext data, and cannot be directly used.
At operation 520, the third transmission data is decrypted based on the security system to obtain fourth transmission data.
The decryption processing mainly means that the received ciphertext data is decrypted.
It should be noted that the embodiments of the present application shown in fig. 1 to 5 are only a basic embodiment of the data security processing method of the present application, and an implementer may extend and refine the data security processing method based on the basic embodiment to obtain more embodiments. Illustratively:
according to an embodiment of the present application, encrypting the first transmission data and/or decrypting the third transmission data includes: the first system obtains a security processing tool sent by the security system; determining encryption rules and/or decryption rules based on the secure processing tool; and the first system performs encryption processing on the first transmission data based on the encryption rule, and/or the first system performs decryption processing on the second transmission data based on the decryption rule.
Wherein the secure processing means comprises keys, certificates, random numbers and/or signatures, etc. The first system utilizes the security processing tool provided by the security system to carry out encryption processing, so that the workload of the security system can be reduced, the security system is more focused on the management and maintenance of the security processing tool, and the security processing efficiency is higher and faster.
Encryption rules and/or decryption rules refer primarily to rules how encryption and/or decryption processes are performed using secure processing tools. For example, before the encryption and/or decryption processes, the first system and the second system first perform authentication through a certificate to determine whether the other party is a trusted system; generating a key pair that can be used for encryption processing and/or decryption processing; encrypting and/or decrypting the data using the key pair and the random number; signing the encrypted and/or decrypted data using a signature, and so forth.
According to an embodiment of the present application, the method further includes: in response to obtaining the input instruction or meeting a preset condition, the first system obtains or updates the secure processing tool.
The input instruction refers to an instruction for acquiring or updating the secure processing tool, and may be a command line instruction or an instruction sent through a graphical interface.
The preset conditions include when the security state of the first system or the second system is changed, for example, access control authority is changed, security level is changed, user password is changed, and the like; no pre-stored security processing tools (e.g., keys, signatures, random numbers, and/or certificates, etc.) are found, or the security processing tools have expired; a change in the function and/or configuration of the electronic device of the first processor, etc.
The secure processing tool is a number of first systems and second systems, each corresponding to a set of keys, random numbers, certificates, etc. When a first system is connected with a plurality of second systems, a plurality of sets of keys, random numbers, certificates, etc. need to be set.
This ensures that the secure processing of the transmission data is efficient and reliable in real time.
According to an embodiment of the present application, based on the security system, the encrypting the first transmission data and/or the decrypting the third transmission data includes: the first system sends the first transmission data and/or the third transmission data to the security system; and receiving second transmission data and/or fourth data returned by the security system, wherein the second transmission data is first transmission data which is encrypted by the security system, and the fourth transmission data is third transmission data which is decrypted by the security system.
In the embodiment, the encryption processing is performed through the security system, the main system does not need to know the implementation details of the security processing, the confidentiality of the implementation details of the security processing can be ensured, and the security is ensured.
According to an embodiment of the present application, based on the security system, encrypting the first transmission data and/or decrypting the third transmission data includes: under the condition that the first transmission data and/or the third transmission data meet a first preset screening rule, encrypting the first transmission data and/or decrypting the third transmission data, wherein the first preset screening rule comprises at least one of the following: the data amount of the first transmission data and/or the second transmission data is within a specified range; the purpose of the first transmission data and/or the second transmission data is within the specified purpose range; the attribute of the first transmission data and/or the second transmission data satisfies a specified condition.
The first preset screening rule is mainly used for screening transmission data needing encryption processing and/or decryption processing from the transmission data.
In this embodiment, not all transmission data is safely processed. And only if the transmission data meets the first preset screening rule, the transmission data is safely processed. For example, in the case where the data amount of the transmission data is suitable for performing encryption processing; when the purpose of transmitting data is the purpose with high security requirement, such as a shutdown instruction, key data and the like; the attribute of the transmission data, such as the security level reaching a medium-high security level, etc. Therefore, the efficiency of security processing can be further improved, and the computing resources are saved.
According to an embodiment of the present application, based on the security system, encrypting the first transmission data and/or decrypting the third transmission data includes: under the condition that the second preset screening condition is met, the first system sends the first transmission data and/or the third transmission data to the safety system, and receives the second transmission data and/or the fourth transmission data returned by the safety system; and under the condition that the second preset screening condition is not met, the first system encrypts the first transmission data to obtain second transmission data, and/or the first system decrypts the third transmission data to obtain fourth transmission data.
The second preset screening rule is used for further screening out the transmission data with higher security level from the transmission data of encryption processing and/or decryption processing, and the transmission data of encryption processing and/or decryption processing needs to be processed safely.
In this embodiment, according to the second preset screening rule, the transmission data with higher security level and needing security processing to perform encryption processing and/or decryption processing is sent to the security system for processing; while for transmission data for which the security level is not high, there is still a need for security processing for encryption processing and/or decryption processing by the first system.
Therefore, layered security processing is realized, and the security and the secrecy of a security system can be effectively utilized to carry out safer encryption processing and/or decryption processing on transmission data with higher security level; the transmission data with low security level can be processed through the first system, so that the calculation power of the security system is saved, and the security system is utilized more efficiently.
Fig. 6 to 8 illustrate a specific implementation manner of implementing a data security processing method according to another embodiment of the present application by using ARM trust zone technology.
The ARM TrustZone technology is a security method in a system range, is tightly integrated with an ARM Cortex TM -A processor, and is expanded in the system through an AXI bus and a specific TrustZone system IP block. This technology provides a platform capable of supporting a fully Trusted Execution Environment (TEE) and security aware applications and security services, typically used to protect peripheral devices such as secure memory, cryptographic blocks, keyboards and screens, to ensure that the firmware is protected from software attacks.
In embodiments of the present application, it is creatively contemplated to utilize this technique to secure data transfer with a host system on a host processor and a subsystem on a sub-processor.
Fig. 6 shows a specific hardware architecture employed by an embodiment of the present application.
As shown in fig. 6, in the embodiment of the present application, the first processor is a computer main processor 601, and the main processor 601 is a System on Chip (SoC) integrated with an ARM processor; the second processor connected to the first processor is a sub-processor 602 connected to the main processor 601, and the sub-processor 602 is a microprocessor unit (Microcontroller Unit, MCU) which can be connected to a peripheral device (not shown in the figure) and control the peripheral device to perform an enhanced function.
Fig. 7 shows a system architecture employed by an embodiment of the present application.
As shown in fig. 7, in the embodiment of the present application, the first system is a host system 701 on a computer host processor (ARM SoC), which is a kernel operating system integrated in a system-on-a-chip; the second system is a subsystem 702 on a sub-processor (MCU), which is an embedded system integrated on a microprocessor; the security system is a security system 703 on a host processor (ARM SoC), which is a TEE system that the ARM SoC is self-contained.
As shown in fig. 7, in order to implement the data security processing method of the present application, in this embodiment, a client application 7011 dedicated to interaction with a subsystem 702 is disposed in a host system 701, and data transmission and reception of the subsystem 702 is centrally managed by the client application 7011; the sub-processor is set as hardware protected by the TEE system, and a data encryption/decryption program 7022 is added to the subsystem 702 to encrypt and decrypt data.
When the data transmitted between the main system 701 and the subsystem 702 accords with the preset screening rule, for example, the value of the attribute of "data security level" is greater than 3 (representing a medium-high security level), the data is sent to the security system 703 through the special security IPC driver 7013 for security processing, and the data after security processing is obtained.
When the data transmitted between the host system 701 and the subsystem 702 does not meet the preset filtering rule, for example, the value of the attribute "data security level" is less than or equal to 3 (indicating a low security level), the data may be directly sent to the subsystem 702 through the universal driver 7012.
The subsystem 702 detects the received data meeting the preset screening rules through the data transceiver 7021, and returns an error message if the data is non-encrypted, so as to ensure that the data meeting the preset screening rules sent to the subsystem is encrypted. Thereby further improving the security of the system.
If the data is encrypted data, performing decryption operation by the data encryption/decryption program 7022, and performing subsequent processing on the decrypted data by the data processing program 7072 to obtain data processing result data; then, the result data is encrypted by the data encryption/decryption program 7022, and the encrypted result data is transmitted to the client application program 7011 by the data transceiver program 7021.
Wherein, the security system 703 is provided with: a trusted operating system solution 7032 for interacting with either host system 701 or subsystem 702; trusted applications 7031 are used for security processes such as encryption and decryption of data, management and maintenance of data keys, certificates and signatures, and the like. Whereas the procedure of gray point format filling in fig. 7 includes: the private secure IPC driver, trusted application 7031, trusted operating system solution 7032, data transceiver 7021, data encryption and decryption 7022, and data processor 7023 on subsystem 702 all belong to the secure protected area of the secure system 703 TEE.
Specifically, when the host system 701 initiates access to the subsystem 702 through the client application (Client Application) 7011, the following steps are performed as shown in fig. 8:
Step 8010, the client application 7011 communicates with the security system 703 through the special security IPC driver 7013, requesting data encryption;
step 8020, the security system 703 checks the Secure Storage (Secure Storage) of the TEE through the trusted application 7031, determines whether the security mechanisms of the main system and the sub-system are activated, and if not, activates the security mechanisms;
The security mechanism comprises a loading cryptographic algorithm, a security storage key, a random number and the like.
Step 8030, the security system 703 encrypts the data;
at step 8040, the security system 703 returns the encrypted data to the client application 7011;
Step 8050, the client application 7011 obtains encrypted data;
step 8060, the client application 7011 sends encrypted data to the subsystem 702;
step 8070, subsystem 702 receives encrypted data via data transceiver 7021;
step 8080, the subsystem 702 requests the security system through the data encryption/decryption program 7022 to decrypt and authenticate the transmitted data;
step 8090, the security system 703 returns the decrypted transmission data;
Step 8100, the subsystem 702 receives the decrypted transmission data, and performs subsequent processing through the data processing program 7072 to obtain data processing result data;
Step 8110, the subsystem 702 requests the security system through the data encryption/decryption program 7022, and encrypts the resulting data;
Step 8120, the security system 703 returns the encrypted result data;
Step 8130, the subsystem 702 receives encrypted result data;
in step 8140, the subsystem 702 returns the encrypted result data to the client application 7011 via the data transceiver 7021.
The data transceiver 7021 detects the received data meeting the preset screening rules, and if the data is not encrypted, returns an error message, and no subsequent processing is performed, so as to ensure that the data meeting the preset screening rules sent to the subsystem is encrypted. Thereby further improving the security of the system.
Vice versa, if the host system 701 requests data from the subsystem 702 via the client application 7011, the subsystem 702 encrypts the result data via the data encryption/decryption program 7022 and the data transceiver program 7021 sends the encrypted requested data to the client application 7011; the client application 7011 communicates with the trusted application 7031 (Trusted Application) via the private secure IPC driver 7013 to complete data decryption.
In an embodiment of the present application, to implement the above-described data security processing method, a dedicated security bus driver is specifically developed and deployed into the security system 703, while a client application 7011 and a trusted application 7031 are developed to process data security processing requests.
In the embodiment of the application, in the process of encrypting the transmission data, random numbers are also respectively used in the main system and the subsystem, and the random numbers are used as a part of a security mechanism in the process of encrypting and decrypting. The random number can be respectively triggered by a main system or a subsystem to regenerate, synchronize, cancel (revocation) and the like in the starting, waking up and running processes of the system, so that the safety and reliability of data security processing can be further improved.
In the embodiment of the application, all data security processing is realized in a security protection area of the TEE, and the data security processing is transparent to the outside and invisible, so that the data security processing is safer. And the data of the subsystem is effectively encrypted and managed based on the TrustZone architecture, so that the design complexity of the subsystem can be effectively reduced, and the safety of the whole system is improved.
Further, an embodiment of the present application further provides a data processing apparatus, as shown in fig. 9, where the apparatus includes: the to-be-transmitted data acquisition module 901 is configured to acquire first transmission data to be sent to a second system by using a first system; a first encryption processing module 902, configured to encrypt the first transmission data based on the security system to obtain second transmission data; a first data sending module 903, configured to send second transmission data to the second system by the first system; and/or a first data receiving module 904, configured to receive, by using the first system, third transmission data sent by the second system; a first decryption module 905, configured to decrypt the third transmission data based on the security system to obtain fourth transmission data, where the first system is operated in the first processor; the second system is operated on the second processor; the first processor is connected with the second processor; the security system is operated on the first processor and is independent of the first system.
According to an embodiment of the present application, the first encryption processing module 902 includes: the safety processing tool acquisition sub-module is used for acquiring the safety processing tool sent by the safety system by the first system; an encryption rule determination submodule for determining an encryption rule based on the security processing tool; and the encryption processing sub-module is used for encrypting the first transmission data based on the encryption rule by the first system.
According to an embodiment of the present application, the first decryption module 905 includes: the safety processing tool acquisition sub-module is used for acquiring the safety processing tool sent by the safety system by the first system; a decryption rule determination submodule for determining a decryption rule based on the secure processing tool; and the decryption processing sub-module is used for performing decryption processing on the second transmission data based on the decryption rule by the first system.
According to an embodiment of the present application, the apparatus 90 further includes: and the safe processing tool management module is used for acquiring or updating the safe processing tool by the first system in response to acquiring the input instruction or meeting the preset condition.
According to an embodiment of the present application, the first encryption processing module 902 includes: the data transmission sub-module is used for transmitting the first transmission data to the security system by the first system; the data receiving sub-module is used for receiving second transmission data returned by the security system, wherein the second transmission data is first transmission data which is encrypted by the security system.
According to an embodiment of the present application, the first decryption module 905 includes: the data transmission sub-module is used for transmitting third transmission data to the security system by the first system; the data receiving sub-module is used for receiving fourth data returned by the security system, and the fourth transmission data is third transmission data which is decrypted by the security system.
According to an embodiment of the present application, the first encryption processing module 902 and/or the first decryption module 905 are specifically configured to: under the condition that the first transmission data and/or the third transmission data meet a first preset screening rule, encrypting the first transmission data and/or decrypting the third transmission data, wherein the first preset screening rule comprises at least one of the following: the data amount of the first transmission data and/or the second transmission data is within a specified range; the purpose of the first transmission data and/or the second transmission data is within the specified purpose range; the attribute of the first transmission data and/or the second transmission data satisfies a specified condition.
According to an embodiment of the present application, the first encryption processing module 902 and/or the first decryption module 905 are specifically configured to: under the condition that the second preset screening condition is met, the first system sends the first transmission data and/or the third transmission data to the safety system, and receives the second transmission data and/or the fourth transmission data returned by the safety system; and under the condition that the second preset screening condition is not met, the first system encrypts the first transmission data to obtain second transmission data, and/or the first system decrypts the third transmission data to obtain fourth transmission data.
Further, an embodiment of the present application further provides a data security processing apparatus, as shown in fig. 10, where the apparatus 100 includes: a second data receiving module 1001, configured to receive, by a second system, second transmission data sent by the first system; a second decryption processing module 1002, configured to decrypt the second transmission data based on the security system, so as to obtain first transmission data; a data processing module 1003, configured to perform data processing on the first transmission data by the second system to obtain third transmission data; a second encryption processing module 1004, configured to encrypt the third transmission data based on the security system to obtain fourth transmission data; a second data sending module 1005, configured to return the fourth transmission data to the first system, where the first system is running on the first processor; the second system is operated on the second processor; the first processor is connected with the second processor; the security system is operated on the first processor and is independent of the first system.
In addition, an embodiment of the present application further provides an electronic device, as shown in fig. 1, including: the first processor 101 is connected with the second processor 102, wherein the first processor 101 is provided with a first system and a security system, the first system performs security processing on transmission data between the first system and the second system on the second processor 102 by using any data processing method executed by the first system, and the second system performs security processing on transmission data between the first system and the second system by using any data processing method executed by the second system.
In addition, an embodiment of the present application also provides a computer storage medium including a set of computer-executable instructions for performing the data security processing method of any one of the above when the instructions are executed.
It should be noted here that: the above description of the embodiments of the data security processing apparatus, the above description of the embodiments of the data security processing system, and the above description of the embodiments of the computer storage medium are similar to those of the foregoing method embodiments, and have similar advantageous effects as those of the foregoing method embodiments, so that a detailed description thereof will be omitted. For technical details that have not been disclosed in the description of the embodiments of the data security processing apparatus, the description of the embodiments of the data security processing system, and the description of the embodiments of the computer storage medium, please refer to the description of the foregoing method embodiments of the present application, for economy of description, and therefore, will not be repeated.
It should be noted that, in this document, the terms "comprises," "comprising," or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but may include other elements not expressly listed or inherent to such process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one … …" does not exclude the presence of other like elements in a process, method, article, or apparatus that comprises the element.
In the several embodiments provided by the present application, it should be understood that the disclosed apparatus and method may be implemented in other ways. The above described device embodiments are only illustrative, e.g. the division of units is only one logical function division, and there may be other divisions in actual implementation, such as: multiple units or components may be combined or may be integrated into another device, or some features may be omitted, or not performed. In addition, the various components shown or discussed may be coupled or directly coupled or communicatively coupled to each other via some interface, whether indirectly coupled or communicatively coupled to devices or units, whether electrically, mechanically, or otherwise.
The units described above as separate components may or may not be physically separate, and components shown as units may or may not be physical units; can be located in one place or distributed to a plurality of network units; some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.
In addition, each functional unit in each embodiment of the present application may be integrated in one processing unit, or each unit may be separately used as one unit, or two or more units may be integrated in one unit; the integrated units may be implemented in hardware or in hardware plus software functional units.
Those of ordinary skill in the art will appreciate that: all or part of the steps for implementing the above method embodiments may be implemented by hardware related to program instructions, and the foregoing program may be stored in a computer readable storage medium, where the program, when executed, performs steps including the above method embodiments; and the aforementioned storage medium includes: a removable storage medium, a Read Only Memory (ROM), a magnetic disk or an optical disk, or the like, which can store program codes.
Or the above-described integrated units of the application may be stored in a computer-readable storage medium if implemented in the form of software functional modules and sold or used as separate products. Based on such understanding, the technical solutions of the embodiments of the present application may be embodied in essence or a part contributing to the prior art in the form of a software product stored in a storage medium, including several instructions for causing a computer device (which may be a personal computer, a server, or a network device, etc.) to execute all or part of the methods of the embodiments of the present application. And the aforementioned storage medium includes: a removable storage medium, a ROM, a magnetic disk or an optical disk, or the like, and can store program codes.
The foregoing is merely illustrative embodiments of the present application, but the scope of the present application is not limited thereto, and any person skilled in the art can easily think about variations or substitutions within the technical scope of the present application, and the application should be covered. Therefore, the protection scope of the application is subject to the protection scope of the claims.
Claims (10)
1. A method of data processing, the method comprising:
The first system acquires first transmission data to be sent to the second system;
Encrypting the first transmission data based on a security system to obtain second transmission data;
The first system sends the second transmission data to the second system, so that the second system decrypts the second transmission data based on a security system, performs data processing on the decrypted data, and performs encryption processing on the data obtained after the data processing based on the security system to obtain third transmission data; and/or
The first system receives third transmission data sent by the second system, and the third transmission data is obtained by the second system based on a security system and obtained by encrypting transmission data to be sent to the first system;
Decrypting the third transmission data based on the security system to obtain fourth transmission data,
Wherein the first system is operated on a first processor; the second system is operated on a second processor; the first processor is connected with the second processor; the security system is running on the first processor and is independent of the first system.
2. The method according to claim 1, said encrypting said first transmission data and/or said decrypting said third transmission data comprising:
the first system obtains a security processing tool sent by the security system;
determining encryption rules and/or decryption rules based on the secure processing tool; and
The first system performs encryption processing on the first transmission data based on the encryption rule, and/or the first system performs decryption processing on the second transmission data based on the decryption rule.
3. The method of claim 2, further comprising:
The first system obtains or updates the secure processing tool in response to obtaining an input instruction or meeting a preset condition.
4. The method of claim 1, the encrypting the first transmission data based on the security system, and/or the decrypting the third transmission data comprising:
The first system sends the first transmission data and/or the third transmission data to the security system; and
And receiving the second transmission data and/or the fourth transmission data returned by the security system, wherein the second transmission data is the first transmission data which is encrypted by the security system, and the fourth transmission data is the third transmission data which is decrypted by the security system.
5. The method of claim 1, wherein the encrypting the first transmission data and/or decrypting the third transmission data based on the security system comprises:
And under the condition that the first transmission data and/or the third transmission data meet a first preset screening rule, encrypting the first transmission data and/or decrypting the third transmission data, wherein the first preset screening rule comprises at least one of the following:
The data amount of the first transmission data and/or the second transmission data is within a specified range;
the purpose of the first transmission data and/or the second transmission data is within the specified purpose range;
The attribute of the first transmission data and/or the second transmission data satisfies a specified condition.
6. The method of claim 1, wherein the encrypting the first transmission data and/or decrypting the third transmission data based on the security system comprises:
under the condition that a second preset screening condition is met, the first system sends the first transmission data and/or the third transmission data to the safety system, and receives second transmission data and/or fourth transmission data returned by the safety system;
And under the condition that the second preset screening condition is not met, the first system performs encryption processing on the first transmission data to obtain second transmission data, and/or the first system performs decryption processing on the third transmission data to obtain fourth transmission data.
7. A method of data processing, the method comprising:
the second system receives second transmission data sent by the first system, wherein the second transmission data is obtained by the first system through encryption processing of the first transmission data to be sent to the second system based on a security system;
based on a security system, decrypting the second transmission data to obtain first transmission data;
the second system performs data processing on the first transmission data to obtain third transmission data;
encrypting the third transmission data based on a security system to obtain fourth transmission data;
the second system returns the fourth transmission data to the first system so that the first system can decrypt the fourth transmission data based on a security system;
Wherein the first system is operated on a first processor; the second system is operated on a second processor; the first processor is connected with the second processor; the security system is running on the first processor and is independent of the first system.
8. A data processing apparatus, the apparatus comprising:
The data acquisition module to be transmitted is used for acquiring first transmission data to be sent to the second system by the first system;
The first encryption processing module is used for carrying out encryption processing on the first transmission data based on the security system so as to obtain second transmission data;
The first data sending module is used for sending the second transmission data to the second system by the first system, so that the second system decrypts the second transmission data based on the security system, performs data processing on the decrypted data, and performs encryption processing on the data obtained after the data processing based on the security system to obtain third transmission data; and/or
The first data receiving module is used for receiving third transmission data sent by the second system by the first system, wherein the third transmission data is obtained by the second system based on a security system and carrying out encryption processing on the transmission data to be sent to the first system;
A first decryption module for decrypting the third transmission data based on the security system to obtain fourth transmission data,
Wherein the first system is operated on a first processor; the second system is operated on a second processor; the first processor is connected with the second processor; the security system is running on the first processor and is independent of the first system.
9. A data processing apparatus, the apparatus comprising:
The second data receiving module is used for receiving second transmission data sent by the first system by the second system, wherein the second transmission data is obtained by encrypting the first transmission data to be sent to the second system by the first system based on the security system;
the second decryption module is used for decrypting the second transmission data based on the security system so as to acquire the first transmission data;
the data processing module is used for carrying out data processing on the first transmission data by the second system so as to obtain third transmission data;
The second encryption module is used for carrying out encryption processing on the third transmission data based on the security system so as to obtain fourth transmission data;
The second data sending module is used for returning the fourth transmission data to the first system by the second system so that the first system can decrypt the fourth transmission data based on a security system;
Wherein the first system is operated on a first processor; the second system is operated on a second processor; the first processor is connected with the second processor; the security system is running on the first processor and is independent of the first system.
10. An electronic device comprising a first processor and a second processor, the first processor being coupled to the second processor, wherein,
The first processor is provided with a first system and a security system, the first system executes the data processing method according to any one of claims 1-6 to perform security processing on transmission data with a second system on the second processor, and the second system executes the data processing method according to claim 7 to perform security processing on transmission data with the first system.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202210345257.5A CN114785566B (en) | 2022-03-31 | 2022-03-31 | Data processing method, device and equipment |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202210345257.5A CN114785566B (en) | 2022-03-31 | 2022-03-31 | Data processing method, device and equipment |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN114785566A CN114785566A (en) | 2022-07-22 |
| CN114785566B true CN114785566B (en) | 2024-04-23 |
Family
ID=82427624
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202210345257.5A Active CN114785566B (en) | 2022-03-31 | 2022-03-31 | Data processing method, device and equipment |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN114785566B (en) |
Citations (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN113381984A (en) * | 2021-05-21 | 2021-09-10 | 珠海格力电器股份有限公司 | Data processing method, device and system, electronic equipment and storage medium |
| CN113656120A (en) * | 2021-07-23 | 2021-11-16 | 北京鸿合爱学教育科技有限公司 | Interface switching method, device, equipment and storage medium |
Family Cites Families (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| KR102436485B1 (en) * | 2017-11-20 | 2022-08-26 | 삼성전자주식회사 | Electronic device and method for transmitting and receiving data based on secured operating system in the electronic device |
-
2022
- 2022-03-31 CN CN202210345257.5A patent/CN114785566B/en active Active
Patent Citations (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN113381984A (en) * | 2021-05-21 | 2021-09-10 | 珠海格力电器股份有限公司 | Data processing method, device and system, electronic equipment and storage medium |
| CN113656120A (en) * | 2021-07-23 | 2021-11-16 | 北京鸿合爱学教育科技有限公司 | Interface switching method, device, equipment and storage medium |
Also Published As
| Publication number | Publication date |
|---|---|
| CN114785566A (en) | 2022-07-22 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| JP6612322B2 (en) | Data processing method and data processing apparatus | |
| CN106980794B (en) | TrustZone-based file encryption and decryption method and device and terminal equipment | |
| EP2786292B1 (en) | Methods and devices for securing keys for a non-secured, distributed environment with applications to virtualization and cloud-computing security and management | |
| US8037295B2 (en) | Hardware-bonded credential manager method and system | |
| CN102271037B (en) | Based on the key protectors of online key | |
| EP3198786B1 (en) | Secure object access | |
| US20090292919A1 (en) | Secure execution environment on external device | |
| JP2011222010A (en) | Method and system for securely and remotely startup, boot, and login from mobile device to computer | |
| US20050149722A1 (en) | Session key exchange | |
| CN109361508B (en) | Data transmission method, electronic device and computer readable storage medium | |
| JPH09128337A (en) | Method and apparatus for protection of masquerade attack in computer network | |
| CN110505055B (en) | External network access identity authentication method and system based on asymmetric key pool pair and key fob | |
| JP2012005129A (en) | Method for securing transmission data and security system | |
| CN110868291B (en) | Data encryption transmission method, device, system and storage medium | |
| CN106790045B (en) | distributed virtual machine agent device based on cloud environment and data integrity guarantee method | |
| CN111191217B (en) | Password management method and related device | |
| EP3292654B1 (en) | A security approach for storing credentials for offline use and copy-protected vault content in devices | |
| US20240184909A1 (en) | Data security processing method and apparatus | |
| CN106992978B (en) | Network security management method and server | |
| CN110519222B (en) | External network access identity authentication method and system based on disposable asymmetric key pair and key fob | |
| Alzomai et al. | The mobile phone as a multi OTP device using trusted computing | |
| CN114091058A (en) | Method and system for secure sharing of data between a first area and a second area | |
| CN111901312A (en) | Method, system, equipment and readable storage medium for network access control | |
| CN110858246B (en) | Authentication method and system of security code space, and registration method thereof | |
| Ogunleye et al. | Elliptic Curve Cryptography Performance Evaluation for Securing Multi-Factor Systems in a Cloud Computing Environment |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |