CN116049812A

CN116049812A - Method for accessing hardware resources and electronic equipment

Info

Publication number: CN116049812A
Application number: CN202210740393.4A
Authority: CN
Inventors: 马长宝
Original assignee: Honor Device Co Ltd
Current assignee: Honor Device Co Ltd
Priority date: 2022-06-28
Filing date: 2022-06-28
Publication date: 2023-05-02
Anticipated expiration: 2042-06-28
Also published as: CN116049812B

Abstract

The embodiment of the application is applicable to the technical field of data processing, and provides a method and electronic equipment for accessing hardware resources, wherein the method and the electronic equipment are used for the electronic equipment, the electronic equipment comprises at least two Trusted Execution Environments (TEEs), the at least two TEEs comprise a first TEE and a second TEE, the first TEE is the TEE which does not have the authority to access target hardware resources, the second TEE is the TEE which has the authority to access the target hardware resources, and the method comprises the following steps: the first TA sends a hardware resource sharing request to the second TA, the second TA determines the first TEE as a target TEE based on the hardware resource sharing request, the second TA establishes a data channel, and the first TA accesses the target hardware resource through the data channel to acquire key data. This enables applications running in each TEE in a multi-TEE architecture to acquire key data.

Description

Method for accessing hardware resources and electronic equipment

Technical Field

The present application relates to the field of data processing, and more particularly, to a method and electronic device for accessing hardware resources.

Background

In the using process of the terminal equipment, an application program needs to access a target hardware resource to acquire key data (a key and a hardware random number) required by encryption and decryption. The target hardware resource may include TRNG, or HUK, among others.

It should be appreciated that the rights to access the target hardware resource are typically only released to a limited number of applications. Illustratively, the rights to access the target hardware resource are released to an application running in a trusted execution environment (Trustedexecution environment, TEE). With the continuous progress of terminal technology, the multi-TEE architecture becomes a common architecture. For system security reasons, the rights to access the target hardware resources are typically released to only one application running in the TEE. Applications running in other TEEs cannot access the target hardware resources nor acquire the key data.

Based on this, how to realize that the application program running in each TEE in the multi-TEE framework can acquire the key data becomes a problem to be solved urgently.

Disclosure of Invention

The application provides a method for accessing hardware resources, which can realize the function that an application program running in each TEE in a multi-TEE framework can acquire key data.

In a first aspect, a method for accessing a hardware resource is provided, where the method is applied to an electronic device, the electronic device includes at least two trusted execution environments TEE, the at least two TEE includes a first TEE and a second TEE, the first TEE is a TEE that does not have a right to access a target hardware resource, the second TEE is a TEE that has a right to access the target hardware resource, the target hardware resource is a hardware resource that needs to be accessed to obtain key data, and the key data includes a hardware random number and a security key, the method includes:

The method comprises the steps that a first trusted application program TA sends a hardware resource sharing request to a second trusted application program TA, wherein the first TA refers to an application program running in a first TEE, the second TA refers to an application program running in a second TEE, and the hardware resource sharing request is used for accessing target hardware resources;

the second TA determines the first TEE as a target TEE based on the hardware resource sharing request;

the second TA establishes a data channel, and the data channel is used for an application program running in the first TEE to access a target hardware resource;

the first TA accesses the target hardware resource through the data channel to acquire the key data.

The method for accessing the hardware resource, provided in the embodiment of the application, is applied to an electronic device, the electronic device includes at least two trusted execution environments TEE, the at least two TEE includes a first TEE and a second TEE, the first TEE is a TEE without authority to access a target hardware resource, the second TEE is a TEE with authority to access the target hardware resource, the target hardware resource is a hardware resource to be accessed for obtaining key data, and the key data includes a hardware random number and a secure key, the method includes: the first TA sends a hardware resource sharing request to the second TA, the second TA determines the first TEE as a target TEE based on the hardware resource sharing request, the second TA establishes a data channel, and the first TA accesses the target hardware resource through the data channel to acquire key data. The first TA refers to an application program running in the first TEE, the second TA refers to an application program running in the second TEE, and the hardware resource sharing request is used for accessing the target hardware resource; the data channel is used for an application program running in the first TEE to access the target hardware resource. Therefore, the first TA running in the first TEE without the right of accessing the target hardware resource can access the target hardware resource through the data channel, which is equivalent to realizing the function that the application programs running in each TEE in the multi-TEE architecture can access the target hardware resource, thereby the application programs running in each TEE in the multi-TEE architecture can acquire the key data.

In one embodiment, the hardware resource sharing request includes an identifier of a first TEE, the second TEE includes a first module, the first module stores an identifier of a target TEE and first data, and the first data is data obtained by performing Hash processing on the identifier of the target TEE; the second TA determining, based on the hardware resource sharing request, the first TEE as the target TEE, including: the second TA acquires second data according to the identification of the first TEE, wherein the second data is obtained by carrying out Hash processing on the identification of the first TEE; and determining the first TEE as the target TEE under the condition that the identification of the first TEE is matched with the identification of the target TEE and the first data and the second data are the same.

The determining, by the second TA, that the first TEE is the target TEE based on the hardware resource sharing request may be a determination made by the second TA based on whether the identifier of the first TEE and the identifier of the target TEE are matched and whether the first data and the second data are the same; the determination may also be made by the Hypervisor module to determine whether the identification of the first TEE and the identification of the target TEE match and whether the first data and the second data are identical. The embodiments of the present application are not limited in this regard.

In the embodiment of the application, the hardware resource sharing request includes an identifier of a first TEE, the second TEE includes a first module, the identifier of a target TEE and first data are stored in the first module, the second TA acquires second data according to the identifier of the first TEE, and under the condition that the identifier of the first TEE is matched with the identifier of the target TEE and the first data and the second data are the same, the first TEE is determined to be the target TEE, wherein the first data refers to data obtained by carrying out Hash processing on the identifier of the target TEE, and the second data refers to data obtained by carrying out Hash processing on the identifier of the first TEE; therefore, the data channel established by the second TA is established under the condition that the first TEE is the target TEE, that is, not any TEE can access the target hardware resource through the data channel, only the target TEE can access the target hardware resource through the data channel, and the safety of accessing the target hardware resource is improved.

In one embodiment, the acquiring, by the second TA, the second data according to the identifier of the first TEE includes: the second TA sends the identification of the first TEE to the Hypervisor module; the Hypervisor module carries out Hash processing on the identifier of the first TEE to obtain second data; the Hypervisor module sends the second data to the second TA.

In one embodiment, the first trusted application TA sends a hardware resource sharing request to the second trusted application TA, including: the first TA sends an identification of the first TEE to a second module in the first TEE; the second module encrypts the identifier of the first TEE by adopting a preset key to obtain a hardware resource sharing request; the second module will send a hardware resource sharing request to the second TA.

In the embodiment of the application, the hardware resource sharing request is obtained by encrypting the identifier of the first TEE by the key management module by adopting the preset key, so that the hardware resource sharing request transmitted between the first TEE and the second TEE is encrypted data, and the security of the data transmitted between the first TEE and the second TEE is improved.

In one embodiment, the method further comprises: and decrypting the hardware resource sharing request by the second TA by adopting the preset key to obtain the identifier of the first TEE.

In the embodiment of the application, after receiving the hardware resource sharing request, the second TA decrypts the hardware resource sharing request by using the preset key to obtain the identifier of the first TEE, so that the hardware resource sharing request transmitted between the first TEE and the second TEE is encrypted data, and the security of data transmission between the first TEE and the second TEE is improved.

In one embodiment, the method further comprises: a third module in the second TEE generates a preset secret key; the preset key is used for encrypting the identifier of the first TEE to obtain a hardware resource sharing request; the third module sends a preset key to the second module in the first TEE.

In the embodiment of the application, the preset key for encrypting and decrypting the identifier of the first TEE is generated by the third module in the second TEE, so that the hardware resource sharing request transmitted between the first TEE and the second TEE is encrypted by the preset key generated by the module in the second TEE, the condition that the modules in other TEEs send the preset key to the second module in the first TEE and the second TA in the second TEE is avoided, unnecessary data transmission in the electronic equipment is further reduced, and waste of system resources is avoided.

In a second aspect, there is provided an apparatus for accessing a hardware resource, comprising means for performing any of the methods of the first aspect. The device can be a terminal device or a chip in the terminal device. The apparatus may include an input unit and a processing unit.

When the apparatus is a terminal device, the processing unit may be a processor, and the input unit may be a communication interface; the terminal device may further comprise a memory for storing computer program code which, when executed by the processor, causes the terminal device to perform any of the methods of the first aspect.

When the device is a chip in the terminal device, the processing unit may be a processing unit inside the chip, and the input unit may be an output interface, a pin, a circuit, or the like; the chip may also include memory, which may be memory within the chip (e.g., registers, caches, etc.), or memory external to the chip (e.g., read-only memory, random access memory, etc.); the memory is for storing computer program code which, when executed by the processor, causes the chip to perform any of the methods of the first aspect.

In one possible implementation, the memory is used to store computer program code; a processor executing the computer program code stored in the memory, the processor, when executed, configured to perform: the method comprises the steps that a first trusted application program TA sends a hardware resource sharing request to a second trusted application program TA, wherein the first TA refers to an application program running in a first TEE, the second TA refers to an application program running in a second TEE, and the hardware resource sharing request is used for accessing target hardware resources; the second TA determines the first TEE as a target TEE based on the hardware resource sharing request; the second TA establishes a data channel, and the data channel is used for an application program running in the first TEE to access a target hardware resource; the first TA accesses the target hardware resource through the data channel to acquire the key data.

In a third aspect, there is provided a computer readable storage medium storing computer program code which, when run by an access hardware resource device, causes the access hardware resource device to perform any of the methods of accessing a hardware resource of the first aspect.

In a fourth aspect, there is provided a computer program product comprising: computer program code which, when run by an access hardware resource device, causes the access hardware resource device to perform any of the device methods of the first aspect.

The method for accessing the hardware resource provided in the embodiment of the application is applied to the electronic device, the electronic device comprises at least two Trusted Execution Environments (TEEs), the at least two TEEs comprise a first TEE and a second TEE, the first TEE is a TEE which does not have the authority to access the target hardware resource, the second TEE is a TEE which has the authority to access the target hardware resource, the target hardware resource is a hardware resource which is required to be accessed to acquire key data, and the key data comprises a hardware random number and a security key, and the method comprises the following steps: the first TA sends a hardware resource sharing request to the second TA, the second TA determines the first TEE as a target TEE based on the hardware resource sharing request, the second TA establishes a data channel, and the first TA accesses the target hardware resource through the data channel to acquire key data. The first TA refers to an application program running in the first TEE, the second TA refers to an application program running in the second TEE, and the hardware resource sharing request is used for accessing the target hardware resource; the data channel is used for an application program running in the first TEE to access the target hardware resource. Therefore, the first TA running in the first TEE without the right of accessing the target hardware resource can access the target hardware resource through the data channel, which is equivalent to realizing the function that the application programs running in each TEE in the multi-TEE architecture can access the target hardware resource, thereby the application programs running in each TEE in the multi-TEE architecture can acquire the key data.

Drawings

FIG. 1 is a schematic diagram of a hardware system suitable for use with the electronic device of the present application;

FIG. 2 is a schematic diagram of a software system suitable for use with the electronic device of the present application;

fig. 3 is a schematic diagram of an application scenario provided in an embodiment of the present application;

FIG. 4 is a flow chart of a method for accessing hardware resources according to an embodiment of the present application;

FIG. 5 is a schematic diagram of an electronic device in one embodiment of the present application;

FIG. 6 is a schematic diagram of an electronic device in one embodiment of the present application;

FIG. 7 is a schematic diagram of an electronic device suitable for use in embodiments of the present application;

FIG. 8 is a flow chart of a method for accessing hardware resources in another embodiment of the present application;

FIG. 9 is a flow chart of a method of accessing a hardware resource in another embodiment of the present application;

FIG. 10 is a schematic diagram of an apparatus for accessing hardware resources provided herein;

fig. 11 is a schematic diagram of an electronic device for accessing hardware resources provided herein.

Detailed Description

The technical solutions in the embodiments of the present application will be described below with reference to the drawings in the embodiments of the present application. Wherein, in the description of the embodiments of the present application, "/" means or is meant unless otherwise indicated, for example, a/B may represent a or B; "and/or" herein is merely an association relationship describing an association object, and means that three relationships may exist, for example, a and/or B may mean: a exists alone, A and B exist together, and B exists alone. In addition, in the description of the embodiments of the present application, "plurality" means two or more than two.

The terms "first," "second," "third," and the like, are used below for descriptive purposes only and are not to be construed as indicating or implying relative importance or implicitly indicating the number of technical features indicated. Thus, a feature defining "a first", "a second", or a third "may explicitly or implicitly include one or more such feature.

In order to facilitate understanding of embodiments of the present application, related concepts related to the embodiments of the present application will be briefly described first.

1. Trusted execution environment (Trusted execution environment, TEE)

TEE refers to a separate secure operating environment in the terminal device, typically a logically isolated operating environment from the rich execution environment (Rich execution environment, REE). Strict protection measures are defined on the TEE, and the TEE can resist the software attack of easy operation of the conventional REE side. TEE is therefore commonly used to handle high security level tasks.

2. Trusted application (TrustedApplication, TA)

TA generally refers to an application running on a TEE. Security services can be provided for applications running outside the TEE.

3、Hypervisor

An intermediate software layer running between the underlying physical server and the operating system, through the Hypervisor, can access all physical devices on the electronic device, including disks and memory. Hypervisor coordinates hardware resource access and protection between virtual machines. After the server is started, the Hypervisor loads the operating systems of all the virtual machine clients, and allocates memory, disks, networks and the like for the virtual machines. Based on the Hypervisor mechanism, the electronic device may support multiple TEEs to run simultaneously.

4. Hardware random number

In one possible scenario, the electronic device needs to be encrypted by hardware, typically by obtaining a hardware random number generated by a random number generator. It should be appreciated that the application needs to access the target hardware resource to obtain the hardware random number.

The hardware resource sharing method provided by the embodiment of the application can be applied to electronic equipment. Optionally, the electronic device includes a terminal device, which may also be referred to as a terminal (terminal), a User Equipment (UE), a Mobile Station (MS), a Mobile Terminal (MT), and so on. The terminal device may be a mobile phone, a smart television, a wearable device, a tablet (Pad), a computer with wireless transceiving function, a Virtual Reality (VR) terminal device, an augmented reality (augmented reality, AR) terminal device, a wireless terminal in industrial control (industrial control), a wireless terminal in unmanned driving (self-driving), a wireless terminal in teleoperation (remote medical surgery), a wireless terminal in smart grid (smart grid), a wireless terminal in transportation safety (transportation safety), a wireless terminal in smart city (smart city), a wireless terminal in smart home (smart home), or the like. The embodiment of the application does not limit the specific technology and the specific equipment form adopted by the terminal equipment.

By way of example, fig. 1 shows a schematic diagram of an electronic device 100. The electronic device 100 may include a processor 110, an external memory interface 120, an internal memory 121, a universal serial bus (universal serial bus, USB) interface 130, a charge management module 140, a power management module 141, a battery 142, an antenna 1, an antenna 2, a mobile communication module 150, a wireless communication module 160, an audio module 170, a speaker 170A, a receiver 170B, a microphone 170C, an earphone interface 170D, a sensor module 180, keys 190, a motor 191, an indicator 192, a camera 193, a display 194, and a subscriber identity module (subscriber identification module, SIM) card interface 195, etc. The sensor module 180 may include a pressure sensor 180A, a gyro sensor 180B, an air pressure sensor 180C, a magnetic sensor 180D, an acceleration sensor 180E, a distance sensor 180F, a proximity sensor 180G, a fingerprint sensor 180H, a temperature sensor 180J, a touch sensor 180K, an ambient light sensor 180L, a bone conduction sensor 180M, and the like.

It is to be understood that the structure illustrated in the embodiments of the present application does not constitute a specific limitation on the electronic device 100. In other embodiments of the present application, electronic device 100 may include more or fewer components than shown, or certain components may be combined, or certain components may be split, or different arrangements of components. The illustrated components may be implemented in hardware, software, or a combination of software and hardware.

The processor 110 may include one or more processing units, such as: the processor 110 may include an application processor (application processor, AP), a modem processor, a graphics processor (graphics processing unit, GPU), an image signal processor (image signal processor, ISP), a controller, a memory, a video codec, a digital signal processor (digital signal processor, DSP), a baseband processor, and/or a neural network processor (neural-network processing unit, NPU), etc. Wherein the different processing units may be separate devices or may be integrated in one or more processors.

The controller may be a neural hub and a command center of the electronic device 100, among others. The controller can generate operation control signals according to the instruction operation codes and the time sequence signals to finish the control of instruction fetching and instruction execution.

A memory may also be provided in the processor 110 for storing instructions and data. In some embodiments, the memory in the processor 110 is a cache memory. The memory may hold instructions or data that the processor 110 has just used or recycled. If the processor 110 needs to reuse the instruction or data, it can be called directly from the memory. Repeated accesses are avoided and the latency of the processor 110 is reduced, thereby improving the efficiency of the system.

In some embodiments, the processor 110 may include one or more interfaces. The interfaces may include an integrated circuit (inter-integrated circuit, I2C) interface, an integrated circuit built-in audio (inter-integrated circuit sound, I2S) interface, a pulse code modulation (pulse code modulation, PCM) interface, a universal asynchronous receiver transmitter (universal asynchronous receiver/transmitter, UART) interface, a mobile industry processor interface (mobile industry processor interface, MIPI), a general-purpose input/output (GPIO) interface, a subscriber identity module (subscriber identity module, SIM) interface, and/or a universal serial bus (universal serial bus, USB) interface, among others.

It should be noted that any of the electronic devices mentioned in the embodiments of the present application may include more or fewer modules in the electronic device 100.

The software system of the electronic device 100 may employ a layered architecture, an event driven architecture, a microkernel architecture, a microservice architecture, or a cloud architecture. In this embodiment, taking an Android system with a layered architecture as an example, a software structure of the electronic device 100 is illustrated.

Fig. 2 is a software configuration block diagram of the electronic device 100 according to the embodiment of the present application.

The layered architecture of the electronic device 100 divides the software into several layers, each with a distinct role and division of labor. The layers communicate with each other through a software interface. In some embodiments, the Android system is divided into four layers, from top to bottom, an application layer, an application framework layer, an Zhuoyun row (Android run) and system libraries, and a kernel layer, respectively.

The application layer may include a series of application packages.

As shown in fig. 2, the application package may include applications for cameras, gallery, calendar, phone calls, maps, navigation, WLAN, bluetooth, music, video, short messages, etc.

The application framework layer provides an application programming interface (application programming interface, API) and programming framework for application programs of the application layer. The application framework layer includes a number of predefined functions.

As shown in FIG. 2, the application framework layer may include a window manager, a content provider, a view system, a telephony manager, a resource manager, a notification manager, and the like.

The window manager is used for managing window programs. The window manager can acquire the size of the display screen, judge whether a status bar exists, lock the screen, intercept the screen and the like.

The content provider is used to store and retrieve data and make such data accessible to applications. The data may include video, images, audio, calls made and received, browsing history and bookmarks, phonebooks, etc.

The view system includes visual controls, such as controls to display text, controls to display pictures, and the like. The view system may be used to build applications. The display interface may be composed of one or more views. For example, a display interface including a text message notification icon may include a view displaying text and a view displaying a picture.

The telephony manager is used to provide the communication functions of the electronic device 100. Such as the management of call status (including on, hung-up, etc.).

The resource manager provides various resources for the application program, such as localization strings, icons, pictures, layout files, video files, and the like.

The notification manager allows the application to display notification information in a status bar, can be used to communicate notification type messages, can automatically disappear after a short dwell, and does not require user interaction. Such as notification manager is used to inform that the download is complete, message alerts, etc. The notification manager may also be a notification in the form of a chart or scroll bar text that appears on the system top status bar, such as a notification of a background running application, or a notification that appears on the screen in the form of a dialog window. For example, a text message is prompted in a status bar, a prompt tone is emitted, the electronic device vibrates, and an indicator light blinks, etc.

Android run time includes a core library and virtual machines. Android run time is responsible for scheduling and management of the Android system.

The core library consists of two parts: one part is a function which needs to be called by java language, and the other part is a core library of android.

The application layer and the application framework layer run in a virtual machine. The virtual machine executes java files of the application program layer and the application program framework layer as binary files. The virtual machine is used for executing the functions of object life cycle management, stack management, thread management, security and exception management, garbage collection and the like.

The system library may include a plurality of functional modules. For example: surface manager (surface manager), media Libraries (Media Libraries), three-dimensional graphics processing Libraries (e.g., openGL ES), 2D graphics engines (e.g., SGL), etc.

The surface manager is used to manage the display subsystem and provides a fusion of 2D and 3D layers for multiple applications.

Media libraries support a variety of commonly used audio, video format playback and recording, still image files, and the like. The media library may support a variety of audio video encoding formats, such as: MPEG4, h.264, MP3, AAC, AMR, JPG, PNG, etc.

The three-dimensional graphic processing library is used for realizing three-dimensional graphic drawing, image rendering, synthesis, layer processing and the like.

The 2D graphics engine is a drawing engine for 2D drawing.

The kernel layer is a layer between hardware and software. The kernel layer at least comprises a display driver, a camera driver, an audio driver, a sensor driver, a Wi-Fi driver and the like.

It should be noted that, the electronic device according to the embodiment of the present application may include more or fewer modules in the electronic device. For example, the electronic device may also include memory, a timer, and the like.

The application scenario provided by the embodiment of the application is described below with reference to the accompanying drawings.

With the continuous development of terminal technology, the multi-TEE architecture becomes a common architecture. As illustrated in fig. 3, the electronic device includes two TEEs, a first TEE and a second TEE, respectively. The first TEE refers to a TEE without access rights to a target hardware resource, the second TEE refers to a TEE with access rights to the target hardware resource, the target hardware resource refers to a hardware resource to be accessed for obtaining key data, and the key data comprises a hardware random number and a security key. When the first TA running in the first TEE needs to acquire the key data, the first TA also has no right to access the target hardware resource because the first TEE has no right to access the target hardware resource. At this time, the first TA may send a hardware resource sharing request to a second TA running in the second TEE, so as to establish a data channel, so that the first TA may access the target hardware resource through the data channel, and acquire key data.

It should be understood that the foregoing is illustrative of an application scenario, and is not intended to limit the application scenario of the present application in any way.

The hardware resource sharing method provided in the embodiment of the present application is described in detail below with reference to fig. 4 to 9.

The hardware resource sharing method provided by the embodiment of the application can be applied to electronic equipment comprising at least two TEEs.

For example, as shown in fig. 3, the electronic device includes a first TEE, which may refer to a TEE without access rights to the target hardware resource, a second TEE, which may refer to a TEE with access rights to the target hardware resource, and the target hardware resource. The target hardware resource may refer to a hardware resource that is accessed as needed to obtain key data, which may include a hardware random number and a security key. The first TA running in the first TEE accesses the target hardware resource through a data channel between the first TEE and the second TEE, and acquires key data.

The hardware resource sharing method applied to the electronic device shown in fig. 3 is described in detail below with reference to fig. 4.

Fig. 4 is a flowchart of a method for sharing hardware resources according to an embodiment of the present application, where the method is applied to the electronic device shown in fig. 4, and includes:

S101, the first TA sends a hardware resource sharing request to the second TA.

It should be understood that the first TA refers to a trusted application running in the first TEE. In the case where the first TEE does not have access to the target hardware resource, the first TA running therein also does not have access to the target hardware resource. The second TA refers to a trusted application running in the second TEE.

In one possible scenario, the first TA needs to access the target hardware resource to obtain the key data, and encrypt and decrypt the target data through the key data. Because the first TA does not have the right to access the target hardware resource, the first TA may send a hardware resource sharing request to the second TA running in the second TEE, so that the first TA may acquire the key data by means of the right of the second TEE to access the target hardware resource.

Wherein the hardware resource sharing request is for requesting access to the target hardware resource. The target hardware resource may refer to a hardware resource that is accessed as needed to obtain the key data.

By way of example, the target hardware resources may include a true random number generator (True Random Number Generator, TRNG) and a hardware Fuse medium. The key data may include a hardware random number and a hardware unique key (Hardware Unique Key, HUK). The TRNG is used to generate a hardware random number, and the HUK is usually stored in a hardware Fuse medium and is mainly used for deriving other keys.

S102, the second TA determines that the first TEE is a target TEE based on the hardware resource sharing request.

It should be understood that the target TEE may refer to a TEE that may establish a data channel with a second TEE. In the case where a plurality of execution environments are included in the electronic device, not all of the execution environments have authority to access the target hardware resource through the second TEE, for the sake of system security.

For example, as shown in fig. 5, there are 3 TEEs in the electronic device, namely, TEE1, TEE2 and TEE3, respectively, wherein TEE1 is a first TEE, that is, a TEE that does not have the right to access the target hardware resource, TEE2 is a second TEE, and TEE3 is a first TEE, that is, a TEE that does not have the right to access the target hardware resource. Wherein, TEE1 is the target TEE, TEE1 has access to the target hardware resource through the second TEE, and TEE3 is not the target TEE, so TEE3 has no access to the target hardware resource through the second TEE.

Illustratively, as shown in FIG. 6, there are 2 TEEs and one rich execution environment (Rich execution environment, REE) in the electronic device. Herein, the REEs generally refer to an operating environment commonly used on electronic devices, and are operating environments without specific security functions. For example, the Andorid system, the IOS system, all belong to REEs. The 2 TEEs and REEs in the electronic device are TEE1, TEE2 and REE1, respectively, wherein TEE1 is a first TEE and TEE2 is a second TEE. In the case where TEE1 is the target TEE, TEE1 has access to the target hardware resource through the second TEE. TEE1 has access to the target hardware resource through TEE 2. REE1 is not the target TEE, so REE1 has no rights to access the target hardware resource through the second TEE, and REE1 has no rights to access the target hardware resource through TEE 2.

It should be appreciated that the second TA may determine whether the first TEE is the target TEE based on information carried in the hardware resource sharing request.

Optionally, the hardware resource sharing request carries an identifier of the first TEE, and the second TEE includes a first module (i.e. a measurement module), where the identifier of the target TEE is stored.

For example, the second TA may obtain the identifier of the first TEE from the hardware resource sharing request, and then call the identifier of the target TEE stored in the first module to compare, where the identifier of the first TEE is the same as the identifier of the target TEE, and determine that the first TEE is the target TEE.

Illustratively, the second TA may obtain the identifier of the first TEE from the hardware resource sharing request, and send the identifier of the first TEE to the Hypervisor module (not shown in fig. 4). The Hypervisor module invokes the identifier of the target TEE stored in the first module, compares the identifier of the target TEE with the identifier of the first TEE, determines that the first TEE is the target TEE under the condition that the identifier of the first TEE is the same as the identifier of the target TEE, and returns confirmation information to the second TA, wherein the confirmation information is used for indicating that the first TEE is the target TEE.

Optionally, the hardware resource sharing request carries an identifier of the first TEE, and the second TEE includes a first module, where the identifier of the target TEE and the first data are stored in the first module.

The first data refers to a calculation result obtained by performing authentication calculation on the identifier of the target TEE, and may be used to authenticate whether other TEEs are target TEEs.

Alternatively, the authentication calculation may refer to a Hash process.

It should be understood that Hash processing may refer to processing data using a Hash algorithm. The Hash algorithm is an algorithm for converting an identifier into a data, and can be generally used as a digital signature to ensure the security of data transmission.

For example, the second TA may obtain the identifier of the first TEE from the hardware resource sharing request, where the identifier of the first TEE may be a string. The second TA uses a Hash algorithm to operate the identification of the first TEE to obtain operated data, namely second data. The second TA compares the second data with the first data. And under the condition that the first data and the second data are the same, determining that the first TEE is the target TEE. Or if the first data and the second data are the same, comparing whether the identification of the first TEE is the same as the identification of the target TEE, and if the identification of the first TEE is the same as the identification of the target TEE, determining that the first TEE is the target TEE.

For example, the second TA may obtain the identifier of the first TEE from the hardware resource sharing request, and send the identifier of the first TEE to the Hypervisor module. Wherein, the identifier of the first TEE may be a character string. The Hypervisor module calculates the identifier of the first TEE by adopting a Hash algorithm to obtain calculated data, namely second data. The Hypervisor module calls first data in the first module and compares second data with the first data. And under the condition that the first data and the second data are the same, determining that the first TEE is the target TEE. Or if the first data and the second data are the same, comparing whether the identification of the first TEE is the same as the identification of the target TEE, and if the identification of the first TEE is the same as the identification of the target TEE, determining that the first TEE is the target TEE. And the Hypervisor module sends confirmation information to the second TA under the condition that the first TEE is determined to be the target TEE, wherein the confirmation information is used for indicating that the first TEE is the target TEE.

S103, the second TA establishes a data channel.

The data channel may be used for an application running in the first TEE to access the target hardware resource.

In an exemplary embodiment, the second TA sends a message to the Hypervisor module to allow the first TEE to access the target hardware resource through the second TEE if the first TEE is determined to be the target TEE. Based on the message, the Hypervisor module allocates system resources to the first TEE, which access the target hardware resources through the second TEE, wherein the system resources are the data channels.

Optionally, the second TEE includes an encryption and decryption engine module, where the encryption and decryption engine module may refer to a module in the second TEE for accessing the target hardware resource. Typically, modules outside the second TEE have no access to the encryption and decryption engine modules. The second TA sends a message to the Hypervisor module to allow the first TEE to access the target hardware resource through the second TEE if the first TEE is determined to be the target TEE. And the Hypervisor module allocates permission for allowing access to the encryption and decryption engine module to the first TEE based on the message, so that the first TA in the first TEE accesses the target hardware resource through the access encryption and decryption engine module.

S104, the first TA accesses the target hardware resource through the data channel to acquire the key data.

It should be understood that, when the first TA accesses the target hardware resource through the data channel, it may mean that, in a case where the first TA needs to access the target hardware resource to obtain the key data, the first TA sends a request for obtaining the key data to the second TA through the data channel, and the second TA accesses the target hardware resource based on the request, obtains the key data, and then sends the key data to the first TA through the data channel.

In a possible case, the first TA running in the first TEE sends a hardware resource sharing request to the second TA running in the second TEE, and the hardware resource sharing request is encrypted through a preset key, so that data transmitted between the first TEE and the second TEE are encrypted data, and the security of the data transmitted between the first TEE and the second TEE is improved. The following is a detailed description of the embodiments shown in fig. 7 to 9.

Fig. 7 is a schematic structural diagram of an electronic device provided in the embodiment of the present application, where, as shown in fig. 7, the electronic device includes a first TEE, a second TEE, hypervisor module, and a target hardware resource, where the first TEE runs a first TA and a key management service module (i.e., a second module), and the second TEE runs a second TA, a measurement module (i.e., a first module), and an encryption and decryption engine (i.e., a third module). In one possible case, a key module is also running in the second TEE. The first TA sends a hardware resource sharing request to the second TA through the key management service module, and the second TA establishes a data channel through the encryption and decryption engine module based on the hardware resource sharing request, so that the first TA accesses the target hardware resource through the data channel to acquire key data.

In one possible scenario, the second TA may determine whether the first TEE is the target TEE by comparing the identity of the first TEE with the identity of the target TEE. The hardware resource sharing method applied to the electronic device shown in fig. 7 is described in detail below with reference to fig. 8.

Fig. 8 is a flowchart of a method for sharing hardware resources according to an embodiment of the present application, where the method is applied to the electronic device shown in fig. 7, and includes:

s201, the first TA sends an identification of the first TEE to the key management service module.

S202, the key management service module encrypts the identifier of the first TEE by adopting a preset key to obtain a hardware resource sharing request.

Alternatively, the preset key may be generated by a key module running in the second TEE. The key module sends the preset key to the key management service module. When the key management service module receives the identification of the first TEE, the identification of the first TEE is encrypted by adopting a preset key, and a hardware resource sharing request is obtained.

Illustratively, the key module sends the preset key to the key management service module immediately after generating the preset key.

Illustratively, the preset key is stored in the key module after the key module generates the preset key. After receiving the identifier of the first TEE, the key management service module sends a request for acquiring a preset key to the key module, and the key module sends the preset key to the key management service module based on the request for acquiring the preset key.

S203, the key management service module sends a hardware resource sharing request to the second TA.

S204, the second TA decrypts the hardware resource sharing request by adopting the preset key to obtain the identification of the first TEE.

It should be understood that the preset key is stored in a key module in the second TEE, and the second TA may call the preset key stored in the key module, and further decrypt the hardware resource sharing request with the preset key to obtain the identifier of the first TEE.

S205, the second TA sends the identification of the first TEE to the Hypervisor module.

S206, the Hypervisor module carries out Hash processing on the identification of the first TEE to obtain second data.

S207, the Hypervisor module sends the second data to the second TA.

S208, the second TA acquires the identification of the target TEE and the first data stored in the measurement module.

S209, the second TA determines that the first TEE is the target TEE under the condition that the identification of the first TEE is matched with the identification of the target TEE and the first data and the second data are the same.

S210, the second TA establishes a data channel.

S211, the first TA accesses the target hardware resource through the data channel to acquire key data.

In the embodiment of the application, the second TA sends the identifier of the first TEE to the Hypervisor module, the Hypervisor module performs Hash processing on the identifier of the first TEE to obtain second data, the Hypervisor module sends the second data to the second TA, the second TA determines that the first TEE is the target TEE when the identifier of the first TEE is matched with the identifier of the target TEE and the first data is the same as the second data, and then the second TA establishes a data channel to enable the first TA to access the target hardware resource through the data channel to obtain key data. Therefore, the first TA running in the first TEE without the right of accessing the target hardware resource can confirm that the first TA has the right of accessing the target hardware resource through the data channel, which is equivalent to realizing the function that the application programs running in each TEE in the multi-TEE architecture can access the target hardware resource, thereby enabling the application programs running in each TEE in the multi-TEE architecture to acquire the key data.

In one possible scenario, the second TA may determine, through the Hypervisor module, whether the first TEE is the target TEE. The hardware resource sharing method applied to the electronic device shown in fig. 7 is described in detail below with reference to fig. 9.

Fig. 9 is a flowchart of a method for sharing hardware resources according to an embodiment of the present application, where the method is applied to the electronic device shown in fig. 7, and includes:

s301, the first TA sends an identification of the first TEE to the key management service module.

S302, the key module sends a preset key to the key management service module.

S303, the key management service module adopts a preset key to encrypt the identifier of the first TEE, and a hardware resource sharing request is obtained.

S304, the key management service module sends a hardware resource sharing request to the second TA.

And S305, the key module sends a preset key to the second TA.

S306, the second TA decrypts the hardware resource sharing request by adopting the preset key to obtain the identification of the first TEE.

S307, the second TA sends the identification of the first TEE to the Hypervisor module.

S308, the Hypervisor module carries out Hash processing on the identification of the first TEE to obtain second data.

S309, the Hypervisor module acquires the identification and the first data of the target TEE stored in the measurement module.

S310, determining that the first TEE is the target TEE by the Hypervisor module under the condition that the identification of the first TEE is matched with the identification of the target TEE and the first data and the second data are the same.

And S311, the Hypervisor module sends confirmation information to the second TA.

The confirmation information is used for indicating that the first TEE is the target TEE.

S312, the second TA establishes a data channel based on the acknowledgement information.

S313, the first TA accesses the target hardware resource through the data channel to acquire the key data.

In the embodiment of the application, the second TA sends the identifier of the first TEE to the Hypervisor module, the Hypervisor module performs Hash processing on the identifier of the first TEE to obtain second data, and determines that the first TEE is the target TEE when the identifier of the first TEE is matched with the identifier of the target TEE and the first data is the same as the second data, then the Hypervisor module sends acknowledgement information to the second TA, and the second TA establishes a data channel based on the acknowledgement information, so that the first TA accesses the target hardware resource through the data channel to obtain key data. Therefore, the first TA running in the first TEE without the access right to the target hardware resource can confirm that the first TA has the access right to the target hardware resource through the data channel through the Hypervisor module, which is equivalent to the realization that the application programs running in the TEEs in the multi-TEE architecture can access the target hardware resource, so that the application programs running in the TEEs in the multi-TEE architecture can acquire the key data.

It should be understood that, although the steps in the flowcharts in the above embodiments are sequentially shown as indicated by arrows, these steps are not necessarily sequentially performed in the order indicated by the arrows. The steps are not strictly limited to the order of execution unless explicitly recited herein, and the steps may be executed in other orders. Moreover, at least a portion of the steps in the flowcharts may include a plurality of sub-steps or stages that are not necessarily performed at the same time, but may be performed at different times, the order in which the sub-steps or stages are performed is not necessarily sequential, and may be performed in turn or alternately with at least a portion of the sub-steps or stages of other steps or other steps.

Fig. 10 is a schematic structural diagram of a device for accessing hardware resources according to an embodiment of the present application. The device for accessing the hardware resources is applied to the electronic equipment, the electronic equipment comprises at least two Trusted Execution Environments (TEEs), the at least two TEEs comprise a first TEE and a second TEE, the first TEE is the TEE which does not have the authority to access the target hardware resources, the second TEE is the TEE which has the authority to access the target hardware resources, the target hardware resources are hardware resources which are required to be accessed for acquiring key data, and the key data comprises a hardware random number and a secure key.

It should be appreciated that the access hardware resource device 600 may perform the method of accessing hardware resources shown in fig. 4-9; accessing hardware resource device 600 includes: an acquisition unit 610 and a processing unit 620.

The processing unit 620 is configured to send, through a first trusted application TA, a hardware resource sharing request to a second trusted application TA, where the first TA is an application running in a first TEE, and the second TA is an application running in a second TEE, and the hardware resource sharing request is used to access a target hardware resource;

the processing unit 620 is configured to determine, by the second TA, that the first TEE is a target TEE based on the hardware resource sharing request;

the processing unit 620 is configured to establish a data channel through the second TA, where the data channel is used for an application running in the first TEE to access the target hardware resource;

the processing unit 620 is configured to access the target hardware resource through the data channel by using the first TA, and obtain the key data.

In one embodiment, the hardware resource sharing request includes an identifier of a first TEE, the second TEE includes a first module, the first module stores an identifier of a target TEE and first data, and the first data is data obtained by performing Hash processing on the identifier of the target TEE;

The processing unit 620 is specifically configured to obtain, by using a second TA, second data according to the identifier of the first TEE, where the second data is data obtained by performing Hash processing on the identifier of the first TEE; and determining the first TEE as the target TEE under the condition that the identification of the first TEE is matched with the identification of the target TEE and the first data and the second data are the same.

In one embodiment, the processing unit 620 is specifically configured to send, to the Hypervisor module, the identifier of the first TEE through the second TA; the Hypervisor module carries out Hash processing on the identifier of the first TEE to obtain second data; the Hypervisor module sends the second data to the second TA.

In one embodiment, the processing unit 620 is specifically configured to send, through the first TA, an identifier of the first TEE to the second module in the first TEE; the second module encrypts the identifier of the first TEE by adopting a preset key to obtain a hardware resource sharing request; the second module will send a hardware resource sharing request to the second TA.

In one embodiment, the processing unit 620 is further configured to decrypt, by the second TA, the hardware resource sharing request with the preset key, to obtain the identifier of the first TEE.

In one embodiment, the processing unit 620 is further configured to generate, by a third module in the second TEE, a preset key; the preset key is used for encrypting the identifier of the first TEE to obtain a hardware resource sharing request; the third module sends a preset key to the second module in the first TEE.

The method for accessing hardware resources in the embodiment is similar in technical principle and technical effect, and is not repeated here.

The above-described access hardware resource device 600 is embodied in the form of a functional unit. The term "unit" herein may be implemented in software and/or hardware, without specific limitation.

For example, a "unit" may be a software program, a hardware circuit or a combination of both that implements the functions described above. The hardware circuitry may include application specific integrated circuits (application specific integrated circuit, ASICs), electronic circuits, processors (e.g., shared, proprietary, or group processors, etc.) and memory for executing one or more software or firmware programs, merged logic circuits, and/or other suitable components that support the described functions.

Thus, the elements of the examples described in the embodiments of the present application can be implemented in electronic hardware, or in a combination of computer software and electronic hardware. Whether such functionality is implemented as hardware or software depends upon the particular application and design constraints imposed on the solution. Skilled artisans may implement the described functionality in varying ways for each particular application, but such implementation decisions should not be interpreted as causing a departure from the scope of the present application.

The embodiment of the application may divide the functional modules of the electronic device according to the above method example, for example, each functional module may be divided corresponding to each function, or two or more functions may be integrated into one module. It should be noted that, in the embodiment of the present application, the division of the modules is schematic, which is merely a logic function division, and other division manners may be implemented in actual implementation. It should be noted that, in the embodiment of the present application, the names of the modules are schematic, and the names of the modules are not limited in actual implementation.

Fig. 11 shows a schematic structural diagram of an electronic device provided in the present application. The dashed line in fig. 11 indicates that the unit or the module is optional. The electronic device 700 may be used to implement the method of accessing hardware resources described in the method embodiments above.

The electronic device 700 includes one or more processors 701, which one or more processors 701 may support the electronic device 700 to implement the method of accessing hardware resources in a method embodiment. The processor 701 may be a general-purpose processor or a special-purpose processor. For example, the processor 701 may be a central processing unit (central processing unit, CPU), digital signal processor (digital signal processor, DSP), application specific integrated circuit (application specific integrated circuit, ASIC), field programmable gate array (field programmable gate array, FPGA), or other programmable logic device such as discrete gates, transistor logic, or discrete hardware components.

The processor 701 may be used to control the electronic device 700, execute a software program, and process data of the software program. The electronic device 700 may further comprise a communication unit 705 for enabling input (reception) and output (transmission) of signals.

For example, the electronic device 700 may be a chip, the communication unit 705 may be an input and/or output circuit of the chip, or the communication unit 705 may be a communication interface of the chip, which may be an integral part of a terminal device or other electronic device.

For another example, the electronic device 700 may be a terminal device, the communication unit 705 may be a transceiver of the terminal device, or the communication unit 705 may be a transceiver circuit of the terminal device.

The electronic device 700 may include one or more memories 702 having a program 704 stored thereon, the program 704 being executable by the processor 701 to generate instructions 703 such that the processor 701 performs the impedance matching method described in the above method embodiments according to the instructions 703.

Optionally, the memory 702 may also have data stored therein. Alternatively, processor 701 may also read data stored in memory 702, which may be stored at the same memory address as program 704, or which may be stored at a different memory address than program 704.

The processor 701 and the memory 702 may be provided separately or may be integrated together; for example, integrated on a System On Chip (SOC) of the terminal device.

Illustratively, the memory 702 may be used to store a related program 704 for accessing a hardware resource method provided in an embodiment of the present application, and the processor 701 may be used to invoke the related program 704 for accessing a hardware resource method stored in the memory 702 when accessing a hardware resource, to execute the method for accessing a hardware resource of the embodiment of the present application; comprising the following steps: sending a hardware resource sharing request to a second trusted application TA through the first trusted application TA, wherein the first TA refers to an application running in a first TEE, the second TA refers to an application running in a second TEE, and the hardware resource sharing request is used for accessing a target hardware resource; the second TA determines the first TEE as a target TEE based on the hardware resource sharing request; the second TA establishes a data channel, and the data channel is used for an application program running in the first TEE to access a target hardware resource; the first TA accesses the target hardware resource through the data channel to acquire the key data.

The present application also provides a computer program product which, when executed by the processor 701, implements a method of accessing hardware resources according to any of the method embodiments of the present application.

The computer program product may be stored in the memory 702, for example, the program 704, and the program 704 is finally converted into an executable object file capable of being executed by the processor 701 through preprocessing, compiling, assembling, and linking.

The present application also provides a computer readable storage medium having stored thereon a computer program which, when executed by a computer, implements a method for accessing hardware resources according to any of the method embodiments of the present application. The computer program may be a high-level language program or an executable object program.

Such as memory 702. The memory 702 may be volatile memory or nonvolatile memory, or the memory 702 may include both volatile and nonvolatile memory. The nonvolatile memory may be a read-only memory (ROM), a Programmable ROM (PROM), an Erasable PROM (EPROM), an electrically Erasable EPROM (EEPROM), or a flash memory. The volatile memory may be random access memory (random access memory, RAM) which acts as an external cache. By way of example, and not limitation, many forms of RAM are available, such as Static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDR SDRAM), enhanced SDRAM (ESDRAM), synchronous DRAM (SLDRAM), and direct memory bus RAM (DR RAM).

In the present application, "at least one" means one or more, and "a plurality" means two or more. "at least one of" or the like means any combination of these items, including any combination of single item(s) or plural items(s). For example, at least one (one) of a, b, or c may represent: a, b, c, a-b, a-c, b-c, or a-b-c, wherein a, b, c may be single or plural.

It should be understood that, in various embodiments of the present application, the sequence numbers of the foregoing processes do not mean the order of execution, and the order of execution of the processes should be determined by the functions and internal logic thereof, and should not constitute any limitation on the implementation process of the embodiments of the present application.

Those of ordinary skill in the art will appreciate that the various illustrative elements and algorithm steps described in connection with the embodiments disclosed herein may be implemented as electronic hardware, or combinations of computer software and electronic hardware. Whether such functionality is implemented as hardware or software depends upon the particular application and design constraints imposed on the solution. Skilled artisans may implement the described functionality in varying ways for each particular application, but such implementation decisions should not be interpreted as causing a departure from the scope of the present application.

It will be clear to those skilled in the art that, for convenience and brevity of description, specific working procedures of the above-described systems, apparatuses and units may refer to corresponding procedures in the foregoing method embodiments, and are not repeated herein.

In the several embodiments provided in this application, it should be understood that the disclosed apparatus and method may be implemented in other ways. For example, the device embodiments described above are merely illustrative; for example, the division of the units is only one logic function division, and other division modes can be adopted in actual implementation; for example, multiple units or components may be combined or may be integrated into another system, or some features may be omitted, or not performed. Alternatively, the coupling or direct coupling or communication connection shown or discussed with each other may be an indirect coupling or communication connection via some interfaces, devices or units, which may be in electrical, mechanical or other form.

The units described as separate units may or may not be physically separate, and units shown as units may or may not be physical units, may be located in one place, or may be distributed on a plurality of network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

In addition, each functional unit in each embodiment of the present application may be integrated in one processing unit, or each unit may exist alone physically, or two or more units may be integrated in one unit.

The foregoing is merely specific embodiments of the present application, but the scope of the present application is not limited thereto, and any person skilled in the art can easily think about changes or substitutions within the technical scope of the present application, and the changes and substitutions are intended to be covered by the scope of the present application. Therefore, the protection scope of the present application shall be subject to the protection scope of the claims.

Claims

1. A method of accessing a hardware resource, the method being applied to an electronic device, the electronic device comprising at least two trusted execution environments, TEEs, the at least two TEEs comprising a first TEE and a second TEE, the first TEE being a TEE that does not have access to a target hardware resource, the second TEE being a TEE that has access to the target hardware resource, the target hardware resource being a hardware resource that is required to be accessed to obtain key data, the key data comprising a hardware random number and a secure key, the method comprising:

A first trusted application program TA sends a hardware resource sharing request to a second trusted application program TA, wherein the first TA refers to an application program running in the first TEE, the second TA refers to an application program running in the second TEE, and the hardware resource sharing request is used for accessing the target hardware resource;

the second TA establishes a data channel, wherein the data channel is used for an application program running in the first TEE to access the target hardware resource;

and the first TA accesses the target hardware resource through the data channel to acquire the key data.

2. The method of claim 1, wherein the hardware resource sharing request includes an identifier of the first TEE, the second TEE includes a first module, and the first module stores the identifier of the target TEE and first data, where the first data is data obtained by performing Hash processing on the identifier of the target TEE;

the second TA determining, based on the hardware resource sharing request, that the first TEE is a target TEE, including:

The second TA acquires second data according to the identifier of the first TEE, wherein the second data is obtained by carrying out the Hash processing on the identifier of the first TEE;

and determining the first TEE as the target TEE under the condition that the identification of the first TEE is matched with the identification of the target TEE and the first data and the second data are the same.

3. The method of claim 2, wherein the second TA obtaining second data according to the identity of the first TEE, comprising:

the second TA sends the identification of the first TEE to a Hypervisor module;

the Hypervisor module performs the Hash processing on the identifier of the first TEE to obtain the second data;

the Hypervisor module sends the second data to the second TA.

4. A method according to any of claims 1 to 3, wherein the first trusted application TA sending a hardware resource sharing request to a second trusted application TA, comprising:

the first TA sends an identification of the first TEE to a second module in the first TEE;

the second module encrypts the identifier of the first TEE by adopting a preset key to obtain the hardware resource sharing request;

The second module will send the hardware resource sharing request to the second TA.

5. The method according to claim 4, wherein the method further comprises:

and the second TA decrypts the hardware resource sharing request by adopting the preset key to obtain the identification of the first TEE.

6. The method according to any one of claims 1 to 5, further comprising:

a third module in the second TEE generates a preset key; the preset key is used for encrypting the identifier of the first TEE to obtain the hardware resource sharing request;

and the third module sends the preset key to a second module in the first TEE.

7. An apparatus for accessing hardware resources, characterized in that the apparatus comprises a processor and a memory, the memory for storing a computer program, the processor for calling and running the computer program from the memory, causing the apparatus to perform the method of any one of claims 1 to 6.

8. A chip comprising a processor which, when executing instructions, performs the method of any one of claims 1 to 6.

9. An electronic device comprising a processor for coupling with a memory and reading instructions in the memory and, in accordance with the instructions, causing the electronic device to perform the method of any one of claims 1 to 6.

10. A computer readable storage medium, characterized in that the computer readable storage medium stores a computer program, which when executed by a processor causes the processor to perform the method of any of claims 1 to 6.