JP4796158B2 - Mobile device - Google Patents

Description

  A secure execution domain for processing protection target information, a first CPU associated with a non-secure execution domain for processing non-protection target information, and a second CPU associated with a communication domain for performing communication processing for communicating with a network It relates to mobile terminals.

  Conventionally, portable terminals configured to be able to add various contents and applications are known. In recent years, the data size of contents and applications has increased, and the functions of contents and applications have been advanced. In order to cope with such a situation, it is required to increase the functionality of a CPU provided in a portable terminal.

  For example, a portable terminal having a first CPU (hereinafter referred to as A-CPU) and a second CPU (hereinafter referred to as C-CPU) has been proposed. The A-CPU is a dedicated CPU that executes an application. The C-CPU is a dedicated CPU that executes processing (communication processing) for communicating with a network such as a mobile communication network. In such a portable terminal, when an application executed on the A-CPU requires communication processing, the A-CPU needs to request communication processing from the C-CPU.

  Here, the A-CPU executes various applications such as mail, web browsing, and a camera. Therefore, the A-CPU often has a high-function OS such as Linux, Symbian OS, or Windows (registered trademark) Mobile. On the other hand, the C-CPU has a real-time OS such as μITRON (Micro Industrial The Real-time Operating System Nucleus).

  Here, on the A-CPU, an application can be directly executed on an OS provided in the A-CPU, like a PC or the like. As a result, the application is executed without causing unnecessary overhead. However, as with a PC or the like, if an attack application including a virus or the like is executed illegally, there is a risk that various information (contents, personal information, etc.) stored in the mobile terminal may be erased or leaked. There is also a risk that the mobile terminal will break down.

  In order to deal with such a risk, (1) a first technology that operates a plurality of OSs using virtual resources (for example, Patent Document 1), and (2) a memory area used by each of the plurality of OSs. Proposed (for example, Patent Document 2), and (3) a technique for specifying the address of a memory area used by the receiving OS when communicating between a plurality of CPUs (for example, Patent Document 3) Has been.

  In the first technique, a virtual terminal having a virtual CPU, a memory area, and a peripheral device is configured. A plurality of OSs operate on a virtual terminal. On such a virtual terminal, it is conceivable to separate an OS that executes an application from an OS that processes content and personal information.

  In the second technique, the mobile terminal has a non-secure execution domain and a secure execution domain by separating memory areas used by each of the plurality of OSs. The non-secure execution domain is a domain in which data stored in the memory area is not protected. The secure execution domain is a domain in which data stored in the memory area is protected. The portable terminal includes a first processing unit that processes an external interrupt to the non-secure execution domain and a second processing unit that processes an external interrupt to the secure execution domain. Thereby, an external interrupt from an external CPU (for example, C-CPU) is notified to an appropriate OS (domain).

  In the third technique, when communication is performed between a plurality of CPUs, the transmitting CPU designates the address of the memory area used by the receiving CPU.

US Pat. No. 6,453,392 US Patent Application Publication No. 2004/0153593 US Pat. No. 7,136,933

  However, in the above-described technique, information to be processed in the secure execution domain (hereinafter, protection target information) is not sufficiently protected when the secure execution domain and the non-secure execution domain operate in parallel.

  Specifically, in the first technique described above, a plurality of OSs operating on the virtual terminal are physically realized by a single hardware. Therefore, a plurality of OSs (secure execution domain and non-secure execution domain) cannot be operated in parallel.

  In the second technique described above, an external interrupt is merely notified to an appropriate OS. That is, in the second technique, no consideration is given to which of the secure execution domain and the non-secure execution domain the external CPU (for example, C-CPU) interrupts. Therefore, when the external CPU (for example, C-CPU) interrupts the non-secure execution domain, the protection target information acquired by the external CPU (for example, C-CPU) may leak to the non-secure execution domain.

  In the third technique described above, the transmitting CPU only specifies the address of the memory area used by the receiving CPU. In other words, the third technique does not consider the operation of a plurality of OSs (secure execution domain and non-secure execution domain) on the receiving CPU. As described above, since the secure execution domain is not considered, the protection target information is not sufficiently protected.

  Therefore, the present invention has been made to solve the above-described problem, and in the case where the secure execution domain and the non-secure execution domain operate in parallel, information (protection target information) to be processed in the secure execution domain is obtained. An object is to provide a portable terminal that can be sufficiently protected.

  The mobile terminal according to the first feature includes a first CPU associated with a secure execution domain for processing protection target information and a non-secure execution domain for processing non-protection target information, and communication for executing communication processing for communicating with a network. And a second CPU associated with the domain. The portable terminal includes a data sharing area that is associated with the first CPU and is a memory area shared by the first CPU and the second CPU. The first CPU has a first CPU side identification unit that identifies a secure interrupt that is an interrupt from the second CPU to the secure execution domain and a non-secure interrupt that is an interrupt from the second CPU to the non-secure execution domain. . The second CPU side identification for identifying a secure external interrupt that is an external interrupt from the secure execution domain to the second CPU and a non-secure external interrupt that is an interrupt from the non-secure execution domain to the second CPU Part. The secure execution domain protects the protection target information written in the data sharing area for passing from the second CPU to the first CPU from the non-secure execution domain.

  In the first feature, the secure execution domain protects the protection target information written in the data sharing area for passing from the first CPU to the second CPU from the non-secure execution domain.

  In the first feature, the data sharing area is provided in the secure execution domain.

  In the first feature, the data sharing area includes a secure sharing area provided in the secure execution domain and a non-secure sharing area provided in the non-secure execution domain. The second CPU side identification unit identifies the secure external interrupt and the non-secure external interrupt according to the state of the secure shared area and the non-secure shared area.

  In the first feature, the data sharing area is provided in the non-secure execution domain. The secure execution domain can access the data sharing area provided in the non-secure execution domain. The secure execution domain includes a first invalidation unit that invalidates the non-secure interrupt detected after the secure interrupt is detected, and the protection target information is erased from the data sharing area. A first validation unit that validates the non-secure interrupt invalidated by the invalidation unit.

  In the first feature, the secure execution domain includes an execution stop unit that stops processing executed in the non-secure execution domain until the protection target information is erased from the data sharing area.

  In the first feature, the secure execution domain and the second CPU jointly erase the protection target information written in the data sharing area.

  In the first feature, the data sharing area is provided in the non-secure execution domain. The secure execution domain includes a first verification unit that verifies the integrity of a program executed in the non-secure execution domain, and the protection target information written in the data sharing area by the second CPU to the secure execution domain. And a first request unit that requests the non-secure execution domain for a data acquisition process to be passed. The first request unit requests the data acquisition process to the non-secure execution domain when the integrity of the program being executed in the non-secure execution domain is verified.

  In the first feature, the data sharing area is provided in the non-secure execution domain. The secure execution domain includes: a second verification unit that verifies the integrity of a program executed in the non-secure execution domain; and the protection target information written in the data sharing area by the secure execution domain to the second CPU. A second request unit that requests the non-secure execution domain for a data transmission process to be passed. The second request unit requests the non-secure execution domain for the data transmission process when the integrity of a program executed in the non-secure execution domain is verified.

  In the first feature, the communication domain collects the protection target information acquired from the secure execution domain and the non-protection target information acquired from the non-secure execution domain, and transmits transmission data to the network. Has a data coupling unit for generating

  In the first feature, the communication domain separates received data received from the network into the protection target information passed to the secure execution domain and the non-protection target information passed to the non-secure execution domain. Part.

  According to the present invention, there is provided a portable terminal capable of sufficiently protecting information (protection target information) to be processed in a secure execution domain when a secure execution domain and a non-secure execution domain operate in parallel. be able to.

1 is a block diagram showing a program execution device 100 according to a first embodiment. It is a figure which shows the data sharing area | region 163 which concerns on 1st Embodiment. It is a figure which shows the data sharing area | region 163 which concerns on 1st Embodiment. It is a flowchart which shows operation | movement of the program execution apparatus 100 which concerns on 1st Embodiment. It is a flowchart which shows operation | movement of the program execution apparatus 100 which concerns on 1st Embodiment. It is a block diagram which shows the program execution apparatus 100 which concerns on 2nd Embodiment. It is a block diagram which shows the program execution apparatus 100 which concerns on 3rd Embodiment. It is a flowchart which shows operation | movement of the program execution apparatus 100 which concerns on 3rd Embodiment. It is a flowchart which shows operation | movement of the program execution apparatus 100 which concerns on 3rd Embodiment. It is a block diagram which shows the program execution apparatus 100 which concerns on 4th Embodiment. It is a flowchart which shows operation | movement of the program execution apparatus 100 which concerns on 4th Embodiment. It is a flowchart which shows operation | movement of the program execution apparatus 100 which concerns on 4th Embodiment. It is a block diagram which shows the program execution apparatus 100 which concerns on 5th Embodiment. It is a flowchart which shows operation | movement of the program execution apparatus 100 which concerns on 5th Embodiment. It is a flowchart which shows operation | movement of the program execution apparatus 100 which concerns on 5th Embodiment. It is a block diagram which shows the program execution apparatus 100 which concerns on 6th Embodiment. It is a flowchart which shows operation | movement of the program execution apparatus 100 which concerns on 6th Embodiment. It is a flowchart which shows operation | movement of the program execution apparatus 100 which concerns on 6th Embodiment.

  Hereinafter, a mobile terminal according to an embodiment of the present invention will be described with reference to the drawings. In the following description of the drawings, the same or similar parts are denoted by the same or similar reference numerals.

  However, it should be noted that the drawings are schematic and ratios of dimensions and the like are different from actual ones. Therefore, specific dimensions and the like should be determined in consideration of the following description. Moreover, it is a matter of course that portions having different dimensional relationships and ratios are included between the drawings.

[Outline of Embodiment]
The mobile terminal according to the embodiment includes a secure execution domain for processing protection target information and a first CPU associated with the non-secure execution domain for processing non-protection target information, and a communication domain for executing communication processing for communication with a network. And an associated second CPU. The portable terminal is associated with the first CPU and includes a data sharing area that is a memory area shared by the first CPU and the second CPU.

  The first CPU has a first CPU side identification unit that identifies a secure interrupt that is an interrupt from the second CPU to the secure execution domain and a non-secure interrupt that is an interrupt from the second CPU to the non-secure execution domain.

  The second CPU has a second CPU side identifying unit that identifies a secure external interrupt that is an external interrupt from the secure execution domain to the second CPU and a non-secure external interrupt that is an interrupt from the non-secure execution domain to the second CPU.

  The secure execution domain protects the protection target information written in the data sharing area from the second CPU to the first CPU from the non-secure execution domain. Similarly, the secure execution domain protects the protection target information written in the data sharing area for passing from the first CPU to the second CPU from the non-secure execution domain.

  In the embodiment, the first CPU has a first CPU side identification unit that identifies a secure interrupt and a non-secure interrupt. Similarly, the second CPU has a second CPU side identification unit for identifying a secure external interrupt and a non-secure external interrupt. The secure execution domain protects the protection target information written in the data sharing area from the non-secure execution domain.

  As described above, when secure execution domains and non-secure execution domains operate in parallel by identifying secure interrupts, non-secure interrupts, secure external interrupts, and non-secure external interrupts, information to be processed in the secure execution domain (protection target) Information) can be adequately protected.

  In the following, the program execution device provided in the mobile terminal will be mainly described.

[First Embodiment]
(Configuration of program execution device)
The configuration of the program execution device according to the first embodiment will be described below with reference to the drawings. FIG. 1 is a block diagram showing a program execution device 100 according to the first embodiment. The program execution device 100 is provided in a mobile terminal, for example.

  As shown in FIG. 1, the program execution device 100 includes a first CPU 110, a second CPU 120, a first CPU memory 130, and a second CPU memory 140.

  The first CPU 110 develops a program on the first CPU memory 130 and executes various applications (programs). The first CPU 110 is associated with the first CPU memory 130. The first CPU 110 is, for example, a dedicated CPU (A-CPU) that executes an application. The first CPU 110 executes applications such as e-mail, web browsing, and camera.

  In the first embodiment, the first CPU 110 includes an interrupt identification unit 111 that identifies the type of interrupt from the second CPU 120. Examples of the interrupt from the second CPU 120 include a non-secure interrupt that is an interrupt to the non-secure execution domain 150 and a secure interrupt that is an interrupt to the secure execution domain 160. That is, the interrupt identification unit 111 identifies a non-secure interrupt and a secure interrupt.

  In the first embodiment, the non-secure interrupt and the secure interrupt are interrupts having different configurations. That is, the non-secure interrupt and the secure interrupt are dedicated interrupts, respectively.

  The second CPU 120 develops a program on the second CPU memory 140 and executes various applications (programs). The second CPU 120 is associated with the second CPU memory 140. The second CPU 120 is a dedicated CPU (C-CPU) that executes processing (communication processing) for communicating with a network such as a mobile communication network.

  In the first embodiment, the second CPU 120 includes an external interrupt identification unit 121 that identifies the type of external interrupt from the first CPU 110. Examples of the external interrupt from the first CPU 110 include a non-secure external interrupt that is an external interrupt from the non-secure execution domain 150 and a secure external interrupt that is an external interrupt from the secure execution domain 160. That is, the external interrupt identification unit 121 identifies a non-secure external interrupt and a secure external interrupt.

  In the first embodiment, the non-secure external interrupt and the secure external interrupt are external interrupts having different configurations. That is, each of the non-secure external interrupt and the secure external interrupt is a dedicated external interrupt.

  The first CPU memory 130 has a non-secure execution domain 150 and a secure execution domain 160. The first CPU memory 130 is composed of, for example, a RAM (Random Access Memory).

  The non-secure execution domain 150 is a domain that processes unprotected information. That is, in the non-secure execution domain 150, data stored in the memory area is not protected more than the secure execution domain 160.

  Specifically, the non-secure execution domain 150 includes an untrusted application processing unit 151 and a non-secure external interrupt processing unit 152.

  The untrusted application processing unit 151 processes an application that does not have reliability. For example, the untrusted application processing unit 151 processes an application newly added to the mobile terminal.

  The non-secure external interrupt processing unit 152 issues an external interrupt (non-secure external interrupt) to the second CPU 120. Specifically, the non-secure external interrupt processing unit 152 issues a non-secure external interrupt according to a request from the untrusted application processing unit 151. For example, the non-secure external interrupt processing unit 152 issues a non-secure external interrupt when the second CPU 120 transmits data to the network according to a request from the untrusted application processing unit 151.

  The secure execution domain 160 is a domain that processes protection target information. That is, in the secure execution domain 160, data stored in the memory area is protected more than in the non-secure execution domain 150. Specifically, in the secure execution domain 160, data stored in the memory area is protected from the non-secure execution domain 150.

  Specifically, the secure execution domain 160 includes a trusted application processing unit 161, a secure external interrupt processing unit 162, and a data sharing area 163.

  The trusted application processing unit 161 processes a reliable application. For example, the trusted application processing unit 161 processes an application installed in advance on the mobile terminal.

  The secure external interrupt processing unit 162 issues an external interrupt (secure external interrupt) to the second CPU 120. Specifically, the secure external interrupt processing unit 162 issues a secure external interrupt according to a request from the trusted application processing unit 161. For example, the secure external interrupt processing unit 162 issues a secure external interrupt when the second CPU 120 transmits data to the network in accordance with a request from the trusted application processing unit 161.

  The data sharing area 163 is an area associated with the first CPU 110 and shared by the first CPU 110 and the second CPU 120.

  Here, data to be passed from the first CPU 110 to the second CPU 120 is written in the data sharing area 163. That is, data transmitted to the network by the second CPU 120 is stored in the data sharing area 163.

  In the data sharing area 163, data to be passed from the second CPU 120 to the first CPU 110 is written. That is, the data sharing area 163 stores data received from the network by the second CPU 120.

  The second CPU memory 140 includes a communication application processing unit 141, a secure interrupt processing unit 142, and a non-secure interrupt processing unit 143. The second CPU memory 140 is a communication domain that executes processing (communication processing) for communicating with a network.

  The communication application processing unit 141 processes an application related to a communication function. Specifically, the communication application processing unit 141 processes an application related to processing (communication processing) for communicating with the network.

  The secure interrupt processing unit 142 issues an interrupt (secure interrupt) to the secure execution domain 160 of the first CPU 110. Specifically, the secure interrupt processing unit 142 issues a secure interrupt according to a request from the communication application processing unit 141. For example, the secure interrupt processing unit 142 issues a secure interrupt when transmitting data received from the network by the second CPU 120 to the secure execution domain 160 in accordance with a request from the communication application processing unit 141.

  The non-secure interrupt processing unit 143 issues an interrupt (non-secure interrupt) to the non-secure execution domain 150 of the first CPU 110. Specifically, the non-secure interrupt processing unit 143 issues a non-secure interrupt according to a request from the communication application processing unit 141. For example, the non-secure interrupt processing unit 143 issues a non-secure interrupt when transmitting data received from the network by the second CPU 120 to the non-secure execution domain 150 in accordance with a request from the communication application processing unit 141.

(Protection of protected information)
Hereinafter, protection of protection target information according to the first embodiment will be described. Specifically, the data sharing area 163 is provided in the secure execution domain 160. In addition, the secure execution domain 160 protects data written in the data sharing area 163 from the non-secure execution domain 150.

  That is, the secure execution domain 160 protects the protection target information written in the data sharing area 163 for passing from the first CPU 110 to the second CPU 120 from the non-secure execution domain 150. Similarly, the secure execution domain 160 protects the protection target information written in the data sharing area 163 for passing from the second CPU 120 to the first CPU 110 from the non-secure execution domain 150.

  In the first embodiment, the protection target information is managed by a data reception completion flag as shown in FIGS.

  FIG. 2 shows a data reception completion flag associated with the protection target information passed from the second CPU 120 to the secure execution domain 160. In such a case, when receiving the protection target information from the second CPU 120, the secure execution domain 160 sets “approval” to the data reception completion flag (see the first protection target information shown in FIG. 2).

  FIG. 3 shows a data reception completion flag associated with the protection target information passed from the secure execution domain 160 to the second CPU 120. In such a case, when receiving the protection target information from the secure execution domain 160, the second CPU 120 sets “approval” to the data reception completion flag (see the first protection target information shown in FIG. 3).

(Operation of the program execution device)
Hereinafter, the operation of the program execution device according to the first embodiment will be described with reference to the drawings. 4 and 5 are flowcharts showing the operation of the program execution device 100 according to the first embodiment.

  In the following, since the configuration provided on the first CPU memory 130 is controlled by the first CPU 110, the processing of the configuration provided on the first CPU memory 130 is performed as the processing of the first CPU 110 as necessary. explain. Similarly, since the configuration provided on the second CPU memory 140 is controlled by the second CPU 120, the processing of the configuration provided on the second CPU memory 140 will be described as the processing of the second CPU 120 as necessary. To do.

  First, a case where data is transferred from the second CPU 120 (an application operating on the second CPU memory 140) to the first CPU 110 (an application operating on the first CPU memory 130) will be described with reference to FIG. Here, a case where protection target information is passed from the second CPU 120 to the secure execution domain 160 will be described.

  As shown in FIG. 4, in step 110, the second CPU 120 writes data received from the network by the second CPU 120 in the data sharing area 163. Specifically, the communication application processing unit 141 writes the protection target information to be passed to the secure execution domain 160 in the data sharing area 163.

  In step 120, the second CPU 120 issues an interrupt to the first CPU 110. Specifically, the secure interrupt processing unit 142 issues a secure interrupt that is an interrupt to the secure execution domain 160.

  In step 210, the first CPU 110 detects an interrupt to the first CPU 110. Specifically, the interrupt identification unit 111 detects a secure interrupt that is an interrupt to the secure execution domain 160.

  In step 220, the first CPU 110 reads data from the data sharing area 163. Specifically, the trusted application processing unit 161 of the secure execution domain 160 reads the protection target information from the data sharing area 163.

  In step 230, the first CPU 110 sets “approval” to the data reception completion flag associated with the data read from the data sharing area 163. Specifically, the trusted application processing unit 161 of the secure execution domain 160 sets “approval” to the data reception completion flag associated with the protection target information.

  In step 240, the first CPU 110 issues an external interrupt to the second CPU 120. Specifically, the secure external interrupt processing unit 162 of the secure execution domain 160 issues a secure external interrupt that is an external interrupt to the second CPU 120.

  In step 310, the second CPU 120 detects an external interrupt to the second CPU 120. Specifically, the external interrupt identification unit 121 detects an external interrupt to the second CPU 120.

  In step 320, the second CPU 120 confirms the issue source (interrupt source) of the external interrupt to the second CPU 120. Specifically, the external interrupt identification unit 121 confirms the issue source of the external interrupt to the second CPU 120.

  In step 330, the second CPU 120 identifies whether or not the issue source of the external interrupt to the second CPU 120 is the secure execution domain 160. Specifically, the external interrupt identification unit 121 identifies whether or not the external interrupt is a secure external interrupt.

  If the external interrupt is a secure external interrupt, step 340 is executed. On the other hand, when the external interrupt is a non-secure external interrupt, a series of processing ends.

  In step 340, the second CPU 120 confirms the data reception completion flag associated with the data read from the data sharing area 163. Specifically, the communication application processing unit 141 confirms that “approval” is set in the data reception completion flag associated with the protection target information.

  Secondly, a case where data is transferred from the first CPU 110 (an application operating on the first CPU memory 130) to the second CPU 120 (an application operating on the second CPU memory 140) will be described with reference to FIG. Here, a case where protection target information is transferred from the secure execution domain 160 to the second CPU 120 will be described.

  As shown in FIG. 5, in step 410, the first CPU 110 writes data transmitted to the network by the second CPU 120 in the data sharing area 163. Specifically, the trusted application processing unit 161 of the secure execution domain 160 writes the protection target information to be passed to the second CPU 120 in the data sharing area 163.

  In step 420, the first CPU 110 issues an external interrupt to the second CPU 120. Specifically, the secure external interrupt processing unit 162 of the secure execution domain 160 issues a secure external interrupt that is an external interrupt to the second CPU 120.

  In step 510, the second CPU 120 detects an external interrupt to the second CPU 120. Specifically, the external interrupt identification unit 121 detects an external interrupt to the second CPU 120.

  In step 520, the second CPU 120 confirms the issue source (interrupt source) of the external interrupt to the second CPU 120. Specifically, the external interrupt identification unit 121 confirms the issue source of the external interrupt to the second CPU 120.

  In step 530, the second CPU 120 identifies whether or not the issue source of the external interrupt to the second CPU 120 is the secure execution domain 160. Specifically, the external interrupt identification unit 121 identifies whether or not the external interrupt is a secure external interrupt.

  If the external interrupt is a secure external interrupt, step 540 is executed. On the other hand, when the external interrupt is a non-secure external interrupt, a series of processing ends.

  In step 540, the second CPU 120 reads data from the data sharing area 163. Specifically, the communication application processing unit 141 reads the protection target information from the data sharing area 163.

  In step 550, the second CPU 120 sets “approval” to the data reception completion flag associated with the data read from the data sharing area 163. Specifically, the communication application processing unit 141 sets “approval” to the data reception completion flag associated with the protection target information.

  In step 560, the second CPU 120 issues an interrupt to the first CPU 110. Specifically, the secure interrupt processing unit 142 issues a secure interrupt that is an interrupt to the secure execution domain 160.

  In step 610, the first CPU 110 detects an interrupt to the first CPU 110. Specifically, the interrupt identification unit 111 detects a secure interrupt that is an interrupt to the secure execution domain 160.

  In step 620, the first CPU 110 confirms the data reception completion flag associated with the data read from the data sharing area 163. Specifically, the trusted application processing unit 161 of the secure execution domain 160 confirms that “approval” is set in the data reception completion flag associated with the protection target information.

(Function and effect)
In the first embodiment, the first CPU 110 includes an interrupt identification unit 111 that identifies a secure interrupt and a non-secure interrupt. Similarly, the second CPU 120 includes an external interrupt identification unit 121 that identifies a secure external interrupt and a non-secure external interrupt. The secure execution domain 160 associated with the first CPU 110 protects the protection target information written in the data sharing area from the non-secure execution domain 150 associated with the first CPU 110.

  Thus, in the case where the secure execution domain 160 and the non-secure execution domain 150 operate in parallel by identifying secure interrupts, non-secure interrupts, secure external interrupts, and non-secure external interrupts, information to be processed in the secure execution domain 160 (Protected information) can be sufficiently protected.

  In the first embodiment, since the data sharing area 163 is provided in the secure execution domain 160, information (protection target information) to be processed in the secure execution domain 160 can be sufficiently protected.

[Second Embodiment]
Hereinafter, the second embodiment will be described with reference to the drawings. In the following, differences from the first embodiment will be mainly described.

  Specifically, in the first embodiment, the non-secure interrupt and the secure interrupt are interrupts having different configurations. Non-secure external interrupts and secure external interrupts are external interrupts having different configurations.

  On the other hand, in the second embodiment, the non-secure interrupt and the secure interrupt are interrupts having the same configuration. A non-secure external interrupt and a secure external interrupt are external interrupts having a similar configuration.

(Configuration of program execution device)
Hereinafter, the configuration of the program execution device according to the second embodiment will be described with reference to the drawings. FIG. 6 is a block diagram showing the program execution device 100 according to the second embodiment. In FIG. 6, the same components as those in FIG.

  As shown in FIG. 6, the non-secure execution domain 150 further includes a non-secure shared area 153. The secure execution domain 160 includes a secure sharing area 164 instead of the data sharing area 163.

  The non-secure shared area 153 is an area associated with the first CPU 110 and shared by the first CPU 110 and the second CPU 120. Specifically, the non-secure shared area 153 is an area shared by the non-secure execution domain 150 and the second CPU 120.

  Here, the data stored in the non-secure shared area 153 is associated with an interrupt identification flag indicating that the data is passed from the second CPU 120 to the non-secure execution domain 150 by a non-secure interrupt. Similarly, the data stored in the non-secure execution domain 150 is associated with an interrupt identification flag indicating that the data is passed from the non-secure execution domain 150 to the second CPU 120 by a non-secure external interrupt.

  The secure sharing area 164 is an area associated with the first CPU 110 and shared by the first CPU 110 and the second CPU 120. Specifically, the secure shared area 164 is an area shared by the secure execution domain 160 and the second CPU 120.

  Here, the data stored in the secure shared area 164 is associated with an interrupt identification flag indicating that the data is passed from the second CPU 120 to the secure execution domain 160 by a secure interrupt. Similarly, the data stored in the secure shared area 164 is associated with an interrupt identification flag indicating that the data is passed from the secure execution domain 160 to the second CPU 120 by a secure external interrupt.

  The above-described interrupt identification unit 111 identifies a non-secure interrupt and a secure interrupt by an interrupt identification flag. That is, the interrupt identifying unit 111 identifies a non-secure interrupt and a secure interrupt according to the states of the non-secure shared area 153 and the secure shared area 164.

  The external interrupt identification unit 121 described above identifies non-secure external interrupts and secure external interrupts by an interrupt identification flag. That is, the external interrupt identification unit 121 identifies a non-secure external interrupt and a secure external interrupt according to the states of the non-secure shared area 153 and the secure shared area 164.

(Function and effect)
In the second embodiment, the interrupt identification unit 111 identifies a non-secure interrupt and a secure interrupt by using an interrupt identification flag stored in the non-secure shared area 153 and the secure shared area 164. Therefore, even if the non-secure interrupt and the secure interrupt have the same configuration, the non-secure interrupt and the secure interrupt can be distinguished.

  Similarly, the external interrupt identification unit 121 identifies non-secure external interrupts and secure external interrupts based on the interrupt identification flags stored in the non-secure shared area 153 and the secure shared area 164. Therefore, even if the non-secure external interrupt and the secure external interrupt have the same configuration, the non-secure external interrupt and the secure external interrupt can be distinguished.

[Third Embodiment]
Hereinafter, a third embodiment will be described with reference to the drawings. In the following, differences from the first embodiment will be mainly described.

  Specifically, in the first embodiment, the data sharing area is provided in the secure execution domain 160. On the other hand, in the third embodiment, the data sharing area is provided in the non-secure execution domain 150.

(Configuration of program execution device)
Hereinafter, the configuration of the program execution device according to the third embodiment will be described with reference to the drawings. FIG. 7 is a block diagram showing a program execution device 100 according to the third embodiment. In FIG. 7, the same reference numerals are given to the same configurations as those in FIG. 1.

  As shown in FIG. 7, the second CPU memory 140 further includes a data erasing unit 144. The non-secure execution domain 150 further includes a data sharing area 154. The secure execution domain 160 includes an interrupt monitoring unit 165 and a data erasing unit 166 instead of the data sharing area 163.

  The data erasing unit 144 deletes the data written in the data sharing area 154 for passing from the first CPU 110 to the second CPU 120. Specifically, the data erasure unit 144 deletes the protection target information written in the data sharing area 154 to be passed from the secure execution domain 160 to the second CPU 120 before the interrupt of the non-secure execution domain 150 is enabled. To do.

  Similar to the data sharing area 163, the data sharing area 154 is associated with the first CPU 110 and is an area shared by the first CPU 110 and the second CPU 120. It should be noted that the secure execution domain 160 can access the data sharing area 154.

  Here, data to be transferred from the first CPU 110 to the second CPU 120 is written in the data sharing area 154. That is, data transmitted to the network by the second CPU 120 is stored in the data sharing area 154.

  In addition, data to be transferred from the second CPU 120 to the first CPU 110 is written in the data sharing area 154. That is, data received from the network by the second CPU 120 is stored in the data sharing area 154.

  The interrupt monitoring unit 165 monitors an interrupt from the first CPU 110 to the second CPU 120 and an external interrupt from the second CPU 120 to the first CPU 110.

  Here, the interrupt monitoring unit 165 constitutes a first invalidating unit that invalidates other interrupts (for example, non-secure interrupts and non-secure external interrupts) detected after the secure interrupt is detected. Further, the interrupt monitoring unit 165 invalidates other interrupts (for example, non-secure interrupts and non-secure external interrupts) detected after the secure external interrupt is detected.

  The interrupt monitoring unit 165 first activates another interrupt (for example, a non-secure interrupt or a non-secure external interrupt) invalidated by the interrupt monitoring unit 165 after the protection target information is erased from the data sharing area 154. Configure the validation part.

  The interrupt monitoring unit 165 constitutes an execution stopping unit that stops processing executed in the non-secure execution domain 150 until the protection target information is deleted from the data sharing area 154. Specifically, the interrupt monitoring unit 165 receives the secure external interrupt from the secure execution domain 160 to the second CPU 120 until the secure interrupt from the second CPU 120 to the secure execution domain 160 is detected. The process executed at 150 is stopped and the secure execution domain 160 is maintained.

  The data erasing unit 166 deletes the data written in the data sharing area 154 for passing from the second CPU 120 to the first CPU 110. Specifically, the data erasure unit 166 passes at least the interrupt of the non-secure execution domain 150 (for example, non-secure interrupt or non-secure external interrupt) from the second CPU 120 to the secure execution domain 160 before being enabled. The protection target information written in the data sharing area 154 is deleted.

(Operation of the program execution device)
The operation of the program execution device according to the third embodiment will be described below with reference to the drawings. 8 and 9 are flowcharts showing the operation of the program execution device 100 according to the third embodiment. In FIG. 8, the same step numbers are assigned to the same processes as in FIG. In FIG. 9, the same step numbers are assigned to the same processes as in FIG.

  First, a case where data is transferred from the second CPU 120 (an application operating on the second CPU memory 140) to the first CPU 110 (an application operating on the first CPU memory 130) will be described with reference to FIG. Here, a case where protection target information is passed from the second CPU 120 to the secure execution domain 160 will be described.

  As shown in FIG. 8, in step 211, the first CPU 110 invalidates other interrupts. Specifically, the interrupt monitoring unit 165 invalidates other interrupts (for example, non-secure interrupt and non-secure external interrupt).

  Here, it should be noted that the processing in step 211 is performed after the processing in step 210, that is, after a secure interrupt is detected by the interrupt identification unit 111.

  In step 221, the first CPU 110 deletes the data written in the data sharing area 154. Specifically, the data erasure unit 166 deletes the protection target information written in the data sharing area 154 for transfer from the second CPU 120 to the secure execution domain 160.

  Here, it should be noted that the process of step 221 is performed before the process of step 240, that is, before the secure external interrupt is issued.

  In step 242, the first CPU 110 enables another interrupt. Specifically, the interrupt monitoring unit 165 enables another interrupt (for example, a non-secure interrupt or a non-secure external interrupt) invalidated in step 211.

  Here, it should be noted that the process of step 241 is performed after the process of step 240, that is, after a secure external interrupt is issued.

  Secondly, a case where data is transferred from the first CPU 110 (an application operating on the first CPU memory 130) to the second CPU 120 (an application operating on the second CPU memory 140) will be described with reference to FIG. Here, a case where protection target information is transferred from the secure execution domain 160 to the second CPU 120 will be described.

  As shown in FIG. 9, in step 401, the first CPU 110 invalidates other interrupts. Specifically, the interrupt monitoring unit 165 invalidates other interrupts (for example, non-secure interrupt and non-secure external interrupt).

  Here, it should be noted that the process in step 401 is performed before the process in step 410, that is, before the process in which the secure execution domain 160 writes the protection target information in the data sharing area 154.

  In step 421, the first CPU 110 sets a state for maintaining the secure execution domain 160 (domain maintenance state). Specifically, the interrupt monitoring unit 165 sets the domain maintenance state and stops processing executed in the non-secure execution domain 150.

  In step 541, the second CPU 120 deletes the data written in the data sharing area 154. Specifically, the data erasure unit 144 deletes the protection target information written in the data sharing area 154 to be transferred from the secure execution domain 160 to the second CPU 120.

  It should be noted that the processing in step 541 is performed before the processing in step 550, that is, before “approval” is set in the data reception completion flag.

  In step 611, the first CPU 110 cancels the state for maintaining the secure execution domain 160 (domain maintenance state). Specifically, the interrupt monitoring unit 165 releases the domain maintenance state and restarts the processing executed in the non-secure execution domain 150.

  It should be noted that the processing in step 611 is performed after the processing in step 610 and after a secure interrupt is detected.

  In step 621, the first CPU 110 deletes the data written in the data sharing area 154. Specifically, the data erasure unit 166 deletes the remaining protection target information that has not been deleted in Step 541.

  The process of step 621 is performed after the process of step 620, that is, after it is confirmed that “approval” is set in the data reception completion flag.

  In step 622, the first CPU 110 enables another interrupt. Specifically, the interrupt monitoring unit 165 enables other interrupts invalidated in step 401 (for example, non-secure interrupts and non-secure external interrupts).

(Function and effect)
In the third embodiment, the interrupt monitoring unit 165 invalidates other interrupts detected after the secure interrupt is detected (for example, a non-secure interrupt or a non-secure external interrupt). Therefore, even if the data sharing area 154 is provided in the non-secure execution domain 150, information (protection target information) to be processed in the secure execution domain 160 can be protected from the non-secure execution domain 150.

  In the third embodiment, the interrupt monitoring unit 165 has another interrupt (for example, a non-secure interrupt or a non-secure external interrupt) invalidated by the interrupt monitoring unit 165 after the protection target information is erased from the data sharing area 154. Activate. Therefore, the secure execution domain 160 and the non-secure execution domain 150 can be operated in parallel.

  In the third embodiment, the interrupt monitoring unit 165 stops processing executed in the non-secure execution domain 150 until the protection target information is deleted from the data sharing area 154. Therefore, information (protection target information) to be processed in the secure execution domain 160 can be protected from the non-secure execution domain 150.

[Fourth Embodiment]
Hereinafter, a fourth embodiment will be described with reference to the drawings. In the following, differences from the third embodiment will be mainly described.

  Specifically, in the third embodiment, the receiving side deletes the protection target information written in the data sharing area 154. In the fourth embodiment, both the reception side and the transmission side delete the protection target information written in the data sharing area 154.

(Configuration of program execution device)
The configuration of the program execution device according to the fourth embodiment will be described below with reference to the drawings. FIG. 10 is a block diagram showing a program execution device 100 according to the fourth embodiment. In FIG. 10, the same reference numerals are given to the same configurations as those in FIG. 7.

  As shown in FIG. 10, the second CPU memory 140 further includes a transmission data erasing unit 145. The secure execution domain 160 further includes a transmission data erasing unit 167.

  The transmission data erasure unit 145 deletes the data written in the data sharing area 154 for delivery from the second CPU 120 to the first CPU 110. Specifically, the transmission data erasure unit 145 is written in the data sharing area 154 to be passed from the second CPU 120 to the secure execution domain 160 when the data execution completion flag is set by the secure execution domain 160. Delete the protected information.

  The transmission data erasure unit 167 deletes the data written in the data sharing area 154 for passing from the first CPU 110 to the second CPU 120. Specifically, the transmission data erasure unit 167 protects the data written in the data sharing area 154 to be passed from the secure execution domain 160 to the second CPU 120 when “approval” is set in the data reception completion flag by the second CPU 120. Delete the target information.

(Operation of the program execution device)
The operation of the program execution device according to the fourth embodiment will be described below with reference to the drawings. 11 and 12 are flowcharts showing the operation of the program execution device 100 according to the fourth embodiment. In FIG. 11, the same step numbers are assigned to the same processes as in FIG. In FIG. 12, the same step numbers are assigned to the same processes as in FIG.

  First, a case where data is transferred from the second CPU 120 (an application operating on the second CPU memory 140) to the first CPU 110 (an application operating on the first CPU memory 130) will be described with reference to FIG. Here, a case where protection target information is passed from the second CPU 120 to the secure execution domain 160 will be described.

  As shown in FIG. 11, in step 241, the first CPU 110 deletes the data written in the data sharing area 154. Specifically, the data erasure unit 166 deletes the protection target information written in the data sharing area 154 for transfer from the second CPU 120 to the secure execution domain 160.

  Here, the process of step 241 is the same as the process of step 221 shown in FIG. In FIG. 11, the process of step 241 is performed instead of the process of step 221 shown in FIG.

  It should be noted that the process of step 241 is performed after the process of step 240, that is, after a secure external interrupt is issued. However, the process in step 241 is performed before the process in step 242, that is, before another interrupt (for example, a non-secure interrupt or a non-secure external interrupt) is enabled.

  In step 341, the second CPU 120 deletes the data written in the data sharing area 154. Specifically, the transmission data erasure unit 145 deletes the protection target information written in the data sharing area 154 for transfer from the second CPU 120 to the secure execution domain 160.

  Here, it should be noted that the process of step 341 is performed after the process of step 340, that is, after “approval” is set in the data reception completion flag.

  As described above, in the fourth embodiment, the protection target information written in the data sharing area 154 to be transferred from the second CPU 120 to the secure execution domain 160 is jointly deleted by both the transmission data erasure unit 145 and the data erasure unit 166. Is done.

  Second, a case where data is transferred from the first CPU 110 (an application operating on the first CPU memory 130) to the second CPU 120 (an application operating on the second CPU memory 140) will be described with reference to FIG. Here, a case where protection target information is transferred from the secure execution domain 160 to the second CPU 120 will be described.

  As shown in FIG. 12, in step 561, the second CPU 120 deletes the data written in the data sharing area 154. Specifically, the data erasure unit 144 deletes the protection target information written in the data sharing area 154 to be transferred from the secure execution domain 160 to the second CPU 120.

  Here, the process of step 561 is the same as the process of step 541 shown in FIG. In FIG. 12, the process of step 561 is performed instead of the process of step 541 shown in FIG.

  It should be noted that the processing in step 561 is performed after the processing in step 560, that is, after a secure interrupt that is an interrupt to the secure execution domain 160 is issued.

  In step 621A, the first CPU 110 deletes the data written in the data sharing area 154. Specifically, the transmission data erasure unit 167 deletes the protection target information written in the data sharing area 154 for transfer from the secure execution domain 160 to the second CPU 120.

  Here, it should be noted that the process of step 341 is performed after the process of step 340, that is, after “approval” is set in the data reception completion flag.

  Note that the processing in step 621A is similar to the processing in step 621 shown in FIG. However, in the fourth embodiment, the protection target information written in the data sharing area 154 to be passed from the secure execution domain 160 to the second CPU 120 is jointly deleted by both the data erasure unit 144 and the transmission data erasure unit 167. .

(Function and effect)
In the fourth embodiment, the protection target information written in the data sharing area 154 is deleted by both the transmission side and the reception side. Therefore, other interrupts can be validated in a short time.

[Fifth Embodiment]
Hereinafter, a fifth embodiment will be described with reference to the drawings. In the following, differences from the third embodiment will be mainly described.

  Specifically, in the third embodiment, the protection target information written in the data sharing area 154 is deleted by the secure execution domain 160. In the fifth embodiment, the protection target information written in the data sharing area 154 is passed to the secure execution domain 160 by the non-secure execution domain 150 in response to a request from the secure execution domain 160.

(Configuration of program execution device)
The configuration of the program execution device according to the fifth embodiment will be described below with reference to the drawings. FIG. 13 is a block diagram showing a program execution device 100 according to the fifth embodiment. In FIG. 13, the same reference numerals are given to the same components as those in FIG.

  As shown in FIG. 13, the non-secure execution domain 150 further includes a data erasure unit 155. The secure execution domain 160 includes a request unit 168 and an integrity verification unit 169 instead of the data erasure unit 166.

  Similar to the data erasure unit 166, the data erasure unit 155 deletes data written in the data sharing area 154 to be transferred from the second CPU 120 to the first CPU 110. Specifically, the data erasure unit 155 passes from the second CPU 120 to the secure execution domain 160 at least before an interrupt (for example, non-secure interrupt or non-secure external interrupt) of the non-secure execution domain 150 is enabled. The protection target information written in the data sharing area 154 is deleted.

  The request unit 168 requests the non-secure execution domain 150 to perform data transmission processing for passing data to be processed in the secure execution domain 160 to the second CPU 120. Similarly, the request unit 168 requests the non-secure execution domain 150 for data acquisition processing for acquiring data to be processed in the secure execution domain 160 from the second CPU 120.

  Specifically, the request unit 168 requests the untrusted application processing unit 151 to perform data transmission processing for passing the protection target information written in the data sharing area 154 to the second CPU 120. Similarly, the request unit 168 requests the untrusted application processing unit 151 to perform a data acquisition process that is written in the data sharing area 154 and passes the protection target information to the secure execution domain 160.

  The request unit 168 passes the protection target information to the non-secure execution domain 150. Similarly, the request unit 168 acquires protection target information from the non-secure execution domain 150.

  The integrity verification unit 169 verifies the integrity of an untrusted application (untrusted program) operating in the unsecure execution domain 150. Specifically, the integrity verification unit 169 verifies the integrity of the memory image on the non-secure execution domain 150. Verification of the integrity of the memory image is performed by comparison with a correct memory image and a hash value derived from the correct memory image.

(Operation of the program execution device)
The operation of the program execution device according to the fifth embodiment will be described below with reference to the drawings. 14 and 15 are flowcharts showing the operation of the program execution device 100 according to the fifth embodiment. In FIG. 14, the same step numbers are assigned to the same processes as in FIG. In FIG. 15, the same step numbers are assigned to the same processes as in FIG.

  First, a case where data is transferred from the second CPU 120 (an application operating on the second CPU memory 140) to the first CPU 110 (an application operating on the first CPU memory 130) will be described with reference to FIG. Here, a case where protection target information is passed from the second CPU 120 to the secure execution domain 160 will be described.

  In step 212, the first CPU 110 verifies the integrity of the untrusted application (untrusted program) operating in the unsecure execution domain 150. Specifically, the integrity verification unit 169 verifies the integrity of the memory image on the non-secure execution domain 150.

  In step 213, the first CPU 110 stabilizes whether or not an untrusted application (untrusted program) operating in the unsecure execution domain 150 has been tampered with. If there is no falsification, the process of step 214 is performed. If there is tampering, the series of processing ends.

  In step 214, the first CPU 110 requests the non-secure execution domain 150 for data acquisition processing for acquiring data to be processed in the secure execution domain 160 from the second CPU 120. Specifically, the request unit 168 requests the untrusted application processing unit 151 to perform data acquisition processing for passing the protection target information written in the data sharing area 154 to the secure execution domain 160.

  In step 220X, the first CPU 110 reads data from the data sharing area 154. Specifically, the untrusted application processing unit 151 of the non-secure execution domain 150 reads the protection target information from the data sharing area 154.

  In step 221X, the first CPU 110 deletes the data written in the data sharing area 154. Specifically, the data erasure unit 155 of the non-secure execution domain 150 deletes the protection target information written in the data sharing area 154 for transfer from the second CPU 120 to the secure execution domain 160.

  In step 230 </ b> X, the first CPU 110 sets “approval” to the data reception completion flag associated with the data read from the data sharing area 154. Specifically, the untrusted application processing unit 151 of the non-secure execution domain 150 sets “approval” to the data reception completion flag associated with the protection target information.

  It should be noted that the processing from Step 220X to Step 230X is performed by the non-secure execution domain 150, not the secure execution domain 160.

  In step 231, the secure execution domain 160 receives data from the non-secure execution domain 150. Specifically, the trusted application processing unit 161 receives the protection target information from the untrusted application processing unit 151.

  Second, a case where data is transferred from the first CPU 110 (an application operating on the first CPU memory 130) to the second CPU 120 (an application operating on the second CPU memory 140) will be described with reference to FIG. Here, a case where protection target information is transferred from the secure execution domain 160 to the second CPU 120 will be described.

  As shown in FIG. 15, in step 402, the first CPU 110 verifies the integrity of an untrusted application (untrusted program) operating in the unsecure execution domain 150. Specifically, the integrity verification unit 169 verifies the integrity of the memory image on the non-secure execution domain 150.

  In step 403, the first CPU 110 stabilizes whether or not an untrusted application (untrusted program) operating in the unsecure execution domain 150 has been tampered with. If there is no falsification, the process of step 404 is performed. If there is tampering, the series of processing ends.

  In step 404, the first CPU 110 requests the non-secure execution domain 150 to perform data transmission processing for passing data to be processed in the secure execution domain 160 to the second CPU 120. For the specific liquid, the request unit 168 requests the untrusted application processing unit 151 to perform data transmission processing for passing the protection target information written in the data sharing area 154 to the second CPU 120.

  In step 410X, the first CPU 110 writes the data transmitted to the network by the second CPU 120 in the data sharing area 154. Specifically, the untrusted application processing unit 151 of the non-secure execution domain 150 writes the protection target information to be passed to the second CPU 120 in the data sharing area 154.

  It should be noted that the processing of step 410X is performed by the non-secure execution domain 150, not the secure execution domain 160.

(Function and effect)
In the fourth embodiment, the integrity verification unit 169 verifies the integrity of an untrusted application (untrusted program) that operates in the unsecure execution domain 150. If there is no falsification of the untrusted application (untrusted program), the request unit 168 requests the non-secure execution domain 150 to transmit the protection target information or receive the protection target information.

  Therefore, even when the protection target information is transmitted or the protection target information is received by the non-secure execution domain 150, the information (protection target information) to be processed in the secure execution domain 160 is protected from the non-secure execution domain 150. be able to. Further, even if the secure execution domain 160 cannot directly access the data sharing area 154, the secure execution domain 160 can acquire the protection target information.

[Sixth Embodiment]
The sixth embodiment will be described below with reference to the drawings. In the following, differences from the first embodiment will be mainly described.

  Specifically, in the sixth embodiment, the second CPU 120 (second CPU memory 140) separates the non-protection target information and the protection target information, and combines the non-protection target information and the protection target information. It should be noted that the sixth embodiment can be applied to any of the first to fifth embodiments.

(Configuration of program execution device)
The configuration of the program execution device according to the sixth embodiment will be described below with reference to the drawings. FIG. 16 is a block diagram showing a program execution device 100 according to the sixth embodiment. In FIG. 16, it should be noted that only the second CPU 120 and the second CPU memory 140 are shown, and other configurations are omitted. In FIG. 16, the same reference numerals are given to the same configurations as those in FIG. 1.

  As shown in FIG. 16, the second CPU memory 140 further includes a data separator 146 and a data combiner 147.

  The data separator 146 separates unprotected information from protected information. Specifically, the data separation unit 146 separates the received data received from the communication application processing unit 141 into non-protection target information and protection target information. The communication application processing unit 141 receives, from the network, received data in which the non-protection target information and the protection target information are combined.

  The data separation unit 146 passes the non-protection target information to the non-secure execution domain 150. The data separator 146 passes the protection target information to the secure execution domain 160.

  The data combining unit 147 combines the non-protection target information and the protection target information. Specifically, the data combining unit 147 combines the non-protection target information and the protection target information, and passes the transmission data in which the non-protection target information and the protection target information are combined to the communication application processing unit 141. The communication application processing unit 141 receives transmission data in which the non-protection target information and the protection target information are combined to the network.

  The data combining unit 147 receives the non-protection target information from the non-secure execution domain 150. The data separator 146 receives the protection target information from the secure execution domain 160.

(Operation of the program execution device)
The operation of the program execution device according to the sixth embodiment will be described below with reference to the drawings. 17 and 18 are flowcharts showing the operation of the program execution device 100 according to the sixth embodiment. In FIG. 17, the same step numbers are assigned to the processes similar to those in FIG. In FIG. 18, the same step numbers are assigned to the processes similar to those in FIG. 5.

  First, a case where data is transferred from the second CPU 120 (an application operating on the second CPU memory 140) to the first CPU 110 (an application operating on the first CPU memory 130) will be described with reference to FIG. Here, a case where protection target information is passed from the second CPU 120 to the secure execution domain 160 will be described.

  As shown in FIG. 17, in step 101, the second CPU 120 separates data received from the network into non-protection target information and protection target information. Specifically, the data separation unit 146 separates the received data received from the communication application processing unit 141 into non-protection target information and protection target information.

  Secondly, a case where data is transferred from the first CPU 110 (an application operating on the first CPU memory 130) to the second CPU 120 (an application operating on the second CPU memory 140) will be described with reference to FIG. Here, a case where protection target information is transferred from the secure execution domain 160 to the second CPU 120 will be described.

  As shown in FIG. 18, in step 561, the second CPU 120 combines the non-protection target information and the protection target information. Specifically, the data combining unit 147 combines the non-protection target information and the protection target information, and passes the transmission data in which the non-protection target information and the protection target information are combined to the communication application processing unit 141.

[Other Embodiments]
Although the present invention has been described with reference to the above-described embodiments, it should not be understood that the descriptions and drawings constituting a part of this disclosure limit the present invention. From this disclosure, various alternative embodiments, examples and operational techniques will be apparent to those skilled in the art.

  In the embodiment, when data stored in the data sharing area is read, “approval” is set to the data reception completion flag. However, the embodiment is not limited to this. If data stored in the data sharing area is read without using the data reception completion flag, the data stored in the data sharing area may be immediately deleted.

  In the second embodiment, an interrupt identification flag is associated with data stored in the non-secure shared area 153. However, the embodiment is not limited to this. For example, an interrupt identification flag may be provided in the header of data stored in the non-secure shared area 153.

  As other embodiments, two or more embodiments may be combined among the first to sixth embodiments.

  DESCRIPTION OF SYMBOLS 100 ... Program execution apparatus, 110 ... 1st CPU, 111 ... Interrupt identification part, 120 ... 2nd CPU, 121 ... External interrupt identification part, 130 ... Memory for 1st CPU, 140. ..Second CPU memory 141... Communication application processing unit 142... Secure interrupt processing unit 143... Non-secure interrupt processing unit 144 .. data erasing unit 145. 146... Data separation unit 147... Data combination unit 150... Non-secure execution domain 151... Untrusted application processing unit 152 152 Non-secure external interrupt processing unit 153. .. Non-secure shared area, 154... Data shared area, 155... Data erasure unit, 160. Trust application processing unit 162... Secure external interrupt processing unit 163... Data sharing area 164... Secure sharing area 165... Interrupt monitoring unit 166. Transmission data erasure unit, 168 ... request unit, 169 ... integrity verification unit

Claims (11)

A secure execution domain for processing protection target information, a first CPU associated with a non-secure execution domain for processing non-protection target information, and a second CPU associated with a communication domain for performing communication processing for communicating with a network A mobile device,
A data sharing area associated with the first CPU and shared by the first CPU and the second CPU;
The first CPU has a first CPU side identification unit for identifying a secure interrupt that is an interrupt from the second CPU to the secure execution domain and a non-secure interrupt that is an interrupt from the second CPU to the non-secure execution domain. And
The second CPU side identification for identifying a secure external interrupt that is an external interrupt from the secure execution domain to the second CPU and a non-secure external interrupt that is an interrupt from the non-secure execution domain to the second CPU Have
The portable terminal characterized in that the secure execution domain protects the protection target information written in the data sharing area for passing from the second CPU to the first CPU from the non-secure execution domain.   2. The mobile phone according to claim 1, wherein the secure execution domain protects the protection target information written in the data sharing area to be passed from the first CPU to the second CPU from the non-secure execution domain. Terminal.   The mobile terminal according to claim 1, wherein the data sharing area is provided in the secure execution domain. The data sharing area includes a secure sharing area provided in the secure execution domain, and a non-secure sharing area provided in the non-secure execution domain,
The said 2nd CPU side identification part identifies the said secure external interrupt and a non-secure external interrupt according to the state of the said secure shared area and the said non-secure shared area, The Claim 1 or Claim 2 characterized by the above-mentioned. The portable terminal described. The data sharing area is provided in the non-secure execution domain,
The secure execution domain is accessible to the data sharing area provided in the non-secure execution domain;
The secure execution domain is
A first invalidation unit for invalidating the non-secure interrupt detected after the secure interrupt is detected;
The portable terminal according to claim 1, further comprising: a first validation unit that validates the non-secure interrupt invalidated by the first invalidation unit after the protection target information is erased from the data sharing area. .   The said secure execution domain has an execution stop part which stops the process performed by the said non-secure execution domain until the said protection object information is erase | eliminated from the said data sharing area | region. Mobile devices.   The portable terminal according to claim 5 or 6, wherein the secure execution domain and the second CPU jointly erase the protection target information written in the data sharing area. The data sharing area is provided in the non-secure execution domain,
The secure execution domain is
A first verification unit for verifying the integrity of a program executed in the non-secure execution domain;
A first request unit that requests the non-secure execution domain for data acquisition processing for passing the protection target information written to the data sharing area by the second CPU to the secure execution domain;
The said 1st request part requests | requires the said data acquisition process to the said non-secure execution domain, when the integrity of the program currently run by the said non-secure execution domain is verified. The portable terminal described. The data sharing area is provided in the non-secure execution domain,
The secure execution domain is
A second verification unit for verifying the integrity of a program executed in the non-secure execution domain;
A second request unit for requesting the non-secure execution domain to perform data transmission processing for passing the protection target information written to the data sharing area by the secure execution domain to the second CPU;
The said 2nd request part requests | requires the said data transmission process to the said non-secure execution domain, when the integrity of the program currently run by the said non-secure execution domain is verified. The portable terminal described.   The communication domain combines the protection target information acquired from the secure execution domain and the non-protection target information acquired from the non-secure execution domain, and generates a transmission data to be transmitted to the network The mobile terminal according to claim 1, comprising:   The communication domain includes a data separator that separates received data received from the network into the protection target information passed to the secure execution domain and the non-protection target information passed to the non-secure execution domain. The mobile terminal according to claim 1.

Images