WO2019047745A1

WO2019047745A1 - Data sharing method, terminal apparatus and storage medium

Info

Publication number: WO2019047745A1
Application number: PCT/CN2018/102692
Authority: WO
Inventors: 赵泳清; 吕达夫
Original assignee: 阿里巴巴集团控股有限公司
Priority date: 2017-09-06
Filing date: 2018-08-28
Publication date: 2019-03-14
Also published as: CN109460373A; CN109460373B

Abstract

A data sharing method, a terminal apparatus and a storage medium. The terminal apparatus comprises a first platform in a rich execution environment and a second platform in a trusted execution environment. The method comprises: the first platform determining, according to first virtual address information of shared data, a corresponding physical storage address and sending the physical storage address to the second platform (202); and the second platform performing mapping in the trusted execution environment according to the physical storage address, so as to obtain corresponding second virtual address information, and processing shared data corresponding to the second virtual address information (204). The method acquires shared data from the same physical storage address in both the rich execution environment and the trusted execution environment without wasting resources.

Description

Data sharing method, terminal device and storage medium

The present application claims the priority of the Chinese Patent Application No. PCT Application No. No. No. No. No. No. No. No. No. No. .

Technical field

The present application relates to the field of computer technologies, and in particular, to a data sharing method, a terminal device, and a storage medium.

Background technique

Trusted Execution Environment (TEE) and Rich Execution Environment (REE) are running environments that coexist in terminal devices. Common operating systems such as Android and Linux run in REE. The TEE is a secure area on the host processor's main processor that guarantees the security, confidentiality, and integrity of the code and data loaded into the environment.

Among them, TEE can provide security services for the REE corresponding operating system, such as REE needs to transfer data to the TEE for processing, etc., therefore, TEE and REE need to share data.

Generally, in order to implement data sharing between the TEE and the REE, a shared space B needs to be set in the terminal device in advance, so that the application in the REE stores the shared data in the space A, and the shared data can be stored in the shared space B, and then Tell the TEE corresponding storage information. The application in the TEE can obtain the shared data from the shared space B for processing, and store the processed data in the shared space B. Then, the application in the REE needs to copy the data in the shared space B back into the space A.

The above method of sharing data requires setting a dedicated shared space for shared data, and the shared space cannot be used by non-shared data, which causes waste of resources. Moreover, when the data needs to be shared, the same data in the device needs to be stored in two spaces, which also causes waste of resources.

Summary of the invention

The embodiment of the present application provides a data sharing method to reduce resource waste caused by sharing data.

Correspondingly, the embodiment of the present application further provides a terminal device and a storage medium to ensure implementation and application of the foregoing system.

In order to solve the above problem, the embodiment of the present application discloses a data sharing method, which is applied to a terminal device, where the terminal device includes a first platform in a non-secure environment and a second platform in a trusted execution environment, the method. The first platform determines a corresponding physical storage address according to the first virtual address information of the shared data, and sends the physical storage address to the second platform; the second platform is based on the physical storage address. Mapping the corresponding second virtual address information in the trusted execution environment, and processing the shared data corresponding to the second virtual address information.

The embodiment of the present application further discloses a terminal device, where the terminal device includes a first platform in a non-secure environment and a second platform in a trusted execution environment; the first platform is configured to use the first data according to the shared data. The virtual address information is used to determine the corresponding physical storage address, and the physical storage address is sent to the second platform. The second platform is configured to map the corresponding storage address in the trusted execution environment according to the physical storage address. The second virtual address information processes the shared data corresponding to the second virtual address information.

The embodiment of the present application further discloses a terminal device, including: one or more processors; and one or more machine-readable media having instructions stored thereon, when executed by the one or more processors, The terminal device is caused to perform a data sharing method as described in one or more of the embodiments of the present application.

The embodiment of the present application further discloses one or more machine readable mediums having stored thereon instructions that, when executed by one or more processors, cause the terminal device to perform one or more of the embodiments as described in the embodiments of the present application. Data sharing method.

Compared with the prior art, the embodiments of the present application include the following advantages:

In the embodiment of the present application, the first platform in the non-secure environment determines the corresponding physical storage address according to the first virtual address information of the shared data, and sends the physical storage address to the second platform in the trusted execution environment, thereby There is no need to set a shared space dedicated to the shared data, and the space storage data is applied to reduce the waste of resources when needed; the second platform maps the corresponding second virtual address information in the trusted execution environment according to the physical storage address. The shared data corresponding to the second virtual address information is processed. It can be seen that different platforms are mapped to different virtual address information for the shared data in the same physical storage address, thereby being in a non-secure environment and a trusted execution environment. Shared data can be obtained from the same physical storage address without wasting resources.

DRAWINGS

1 is a schematic diagram of interaction between platforms according to an embodiment of the present application;

2 is a flow chart of steps of an embodiment of a data sharing method of the present application;

3 is a flow chart showing the steps of another data sharing method embodiment of the present application;

4 is a schematic diagram of interaction between a REE and a TEE according to the present application;

5 is a structural block diagram of an embodiment of a terminal device of the present application;

FIG. 6 is a schematic structural diagram of hardware of an electronic device according to an embodiment of the present application; FIG.

FIG. 7 is a schematic structural diagram of hardware of an electronic device according to another embodiment of the present application.

Detailed ways

The above described objects, features and advantages of the present application will become more apparent and understood.

TEE provides an isolated execution environment that provides security features including isolated execution, integrity of trusted applications, confidentiality of trusted data, secure storage, and more. Therefore, TEE provides a higher level of execution space than REE, such as the common mobile operating system (Android, etc.) execution environment; and more than the security element SE (Secure Element, such as smart card, SIM card, etc.) The function.

In the embodiment of the present application, the non-secure environment and the trusted execution environment may implement and provide corresponding functions based on the corresponding platform, and the platform may provide an execution environment for the operating system, the driver, the application, and the like. The non-secure environment corresponds to the first platform, and the trusted execution environment corresponds to the second platform. The first platform can provide a rich execution environment for operating systems such as Android and Linux, and the trusted execution environment of the second platform can be based on the processor. Technology is determined, such as Intel's trust enforcement technology, AMD's secure virtual machine, ARM's TrustZone, and more.

The application running in the REE is called a client application (CA), and the application running in the TEE is called a trusted application (TA). The CA can invoke the interface to request security services from the TA. Provides security services for CA. The TA can access all functions of the device's main processor and memory. The hardware isolation technology protects it from the user's App, which is installed in the main operating system environment, and the software and password isolation technology inside the TEE can protect each TA. Interact with each other so that they can be used simultaneously by multiple different service providers without compromising security. Therefore, when the TA provides security services for the CA, it needs to obtain the application data corresponding to the CA, and then process the application data, and then feed back to the CA, which can be referred to as shared data, that is, both the CA and the TA are required. data.

In the embodiment of the present application, the terminal device includes a first platform in a non-secure environment and a second platform in a trusted execution environment, where the first platform and the second platform are isolated. The two platforms can support different operating systems, such as the first platform supports Android, Linux, etc., and the second platform supports an operating system that provides security services. Both the first platform and the second platform support the running of the application, so the application in the first platform needs the application providing service in the second platform. For example, the payment application in the first platform performs the corresponding function of payment, and the application in the second platform is required to provide sensitive data such as bank certificate and user data; for example, in the scenario of communication and encryption, the application of the first platform needs to be second. Application of the platform to obtain keys, encrypted communication data, and the like.

As shown in FIG. 1 , the first platform may determine first virtual address information corresponding to the shared data, and then determine a physical storage address corresponding to the storage shared data based on the first virtual address information, where the shared data may be stored in one or more In the data block, one or more physical storage addresses can be determined. The physical storage address can then be sent to the second platform. The second platform may map the physical storage address, determine the corresponding second virtual address information, and then obtain the shared data according to the second virtual address information, and then process the shared data.

In the embodiment of the present application, the terminal device includes various electronic devices such as a smart phone, a personal computer, an Internet of Things device, and a wearable device. The shared data can be determined according to specific services, such as e-commerce, payment-related user passwords, credit card information, electronic bank vouchers, network accounts, etc.; such as keys, signatures, and the like related to data encryption; Sensitive data such as call content and short messages.

The embodiment of the present application does not need to set a shared space dedicated to shared data, and applies space storage data when needed, thereby reducing waste of resources, and mapping different platforms to different virtual address information for shared data in the same physical storage address. Thus, both the first platform and the second platform can obtain shared data from the same physical storage address without causing waste of resources.

Referring to FIG. 2, a flow chart of steps of an embodiment of a data sharing method according to the present application is shown, which specifically includes the following steps:

Step 202: The first platform determines a corresponding physical storage address according to the first virtual address information of the shared data, and sends the physical storage address to the second platform.

In an optional embodiment of the present application, the first platform determines the corresponding physical storage address according to the first virtual address information of the shared data, including: the first platform stores the shared data in the first virtual address information, according to The first storage information determines a corresponding physical storage address.

When the application is processed in the first platform, sometimes some services such as payment, encryption, and the like need application assistance in the second platform, so the shared data that needs to be processed by the application in the second platform may be stored, and it is determined that the shared data is stored in the non- The first virtual address information in the security environment, the first virtual address information corresponding to the memory space accessible in the non-secure environment, and then the corresponding one or more physical storage addresses may be obtained based on the first virtual address information mapping, and then Sending the first physical storage address to the second platform, so that the second platform can acquire the shared data.

Step 204: The second platform maps the corresponding second virtual address information in the trusted execution environment according to the physical storage address, and processes the shared data corresponding to the second virtual address information.

After receiving the physical storage address, the second platform may map the physical storage address in the trusted execution environment to obtain corresponding second virtual address information, where the second virtual address information is accessible to the trusted execution environment. The memory space can then be used to obtain shared data based on the second virtual address information, and then the shared data can be processed.

The processing operation of the application corresponding service in the first platform may be performed, and the processed data is stored in the corresponding memory space of the second virtual address information, and the first platform application may acquire the processed data based on the first virtual address information, and execute the Required operation.

In summary, the first platform in the non-secure environment determines the corresponding physical storage address according to the first virtual address information of the shared data, and sends the physical storage address to the second platform in the trusted execution environment, thereby eliminating the need to set The shared data-specific shared space is applied for the space storage data when there is a demand, and the waste of the resource is reduced. The second platform maps the corresponding second virtual address information in the trusted execution environment according to the physical storage address. The shared data corresponding to the second virtual address information is processed. It can be seen that different platforms are mapped to different virtual address information for the shared data in the same physical storage address, so that the non-secure environment and the trusted execution environment can be used. Obtaining shared data from the same physical storage address does not waste resources.

Secondly, in the non-secure environment and the trusted execution environment, the shared data can be obtained from the same physical storage address, but different environments correspond to different virtual address information, so the data does not need to be copied in two storage spaces, and the resource consumption is reduced. On the basis of this, it also reduces data operations and reduces the burden on the equipment.

In the embodiment of the present application, the first virtual address information includes: a first start address and a data size; and the second virtual address information includes: a second start address and a data size. The first platform runs with a first application and the second platform runs with a second application. Therefore, applications in different execution environments can perform data interaction and share data for required processing. The trusted execution environment can provide trusted service support for non-secure environments and ensure data security.

Referring to FIG. 3, a flow chart of steps of another data sharing method embodiment of the present application is shown, which specifically includes the following steps:

Step 302: The first application invokes a first function request address space, and acquires first storage information corresponding to the address space.

Step 304: Store the shared data in the address space according to the first storage information.

Step 306: Send the first storage information to the first platform.

The first platform runs the first application. In the non-secure environment, during the running of the first application, if the service of the second application running in the trusted execution environment is required, the data to be processed is determined to be shared data, so the The data size corresponding to the shared data, the address space requested by the first function is requested to be based on the data size, and the first start address corresponding to the first function is obtained based on the first function, and the first storage information is generated based on the first start address and the data size. . The shared data can then be stored in an address space corresponding to the first start address.

For example, the first function is a malloc function, and the malloc function can be called to allocate a space based on the data size, determine a corresponding first start address and data size, store the shared data in the space, and then send the first virtual address information. Give the first platform.

Step 308, the first platform calls a second function, and maps the first storage information in the non-secure environment to obtain a corresponding physical storage address.

The first platform may determine an interface function provided by the operating system, that is, a second function for converting between the virtual address and the physical storage address, for example, providing a conversion between the virtual address and the physical storage address for the non-secure environment. Therefore, the second function can be called, and the second function can perform calculation based on the first starting address and the data size in a non-secure environment to determine one or more physical storage addresses corresponding to the data.

Step 310: The first platform generates a corresponding array according to the physical storage address and the data size.

Step 312: The first platform sends the array to the second platform.

The data is usually discontinuously stored in the device hardware. Therefore, the physical storage addresses corresponding to the shared data are usually discontinuous. To facilitate the transmission and use of the physical storage address, an array may be generated according to the physical storage address and the data size. Each physical storage address and data size can be stored in the array. The array can then be transferred to the second platform so that the non-secure environment can inform the trusted execution environment of the shared data that needs to be processed and its storage location.

Step 314: The second platform parses the array to obtain a corresponding physical storage address and data size.

Step 316, invoking a third function, mapping the physical storage address in the trusted execution environment to determine second virtual address information.

After receiving the array, the second platform may parse the array in the trusted execution environment, obtain each physical storage address and data size, and then call a third function, and the physical storage address in the trusted execution environment. Mapping is performed to determine that each physical storage address corresponds to the mapping to obtain an address space, that is, to determine a second starting address for storing the shared data in the trusted execution environment. The second function is used to perform conversion between the virtual address and the physical storage address, for example, to provide a conversion between the virtual address and the physical storage address for the trusted execution environment, and the second function and the third function may be the same or different.

Step 318: The second platform sends the second virtual address information to the second application.

Step 320: The second application acquires corresponding shared data according to the second virtual address information, and processes the shared data in the trusted execution environment.

The second platform sends the second virtual address information to the corresponding second application, and then the second application may determine the second start address from the second virtual address information, obtain the shared data based on the second start address, and then The shared data is processed in the trusted execution environment, such as decryption based on a key, signature verification, bank certificate authentication, obtaining user data, and the like.

In an optional embodiment of the present application, if the second application determines that the data size is insufficient, sending a request to the first application to notify the first application to re-request the address space. When the second application performs data processing, the data size required for the processed data can be obtained, so that the data size corresponding to the second virtual address information and the data size required after the processing can be determined, and the second virtual address is determined. Whether the information is sufficient to store the processed data, if the space is insufficient, the request may be sent to the first application, the request is used to inform the data size of the required space, so that the first application may re-request the address space, and perform the above steps 302-322. .

The shared data of the first application and the second application are obtained based on the first platform in the non-secure environment and the second platform in the trusted execution environment, that is, the data interaction is implemented based on the platform dimension, and the first application and the second application are implemented. Communication interactions between applications, such as request, response, instruction transfer, etc., based on application-oriented dimensions.

Thus, the shared data of the first platform and the second platform are stored in the same physical storage address instead of the set shared space, so the data size is not limited, and theoretically all the free memory space in the first platform can be shared. When there is no shared service, it will not occupy idle resources.

In one example, the first platform corresponds to a non-secure environment and the second platform corresponds to a trusted execution environment. Assume that the first application CA is a payment application, the payment application runs in a non-secure environment REE, and the second application TA is a security support application, or a plug-in corresponding to the payment application, and the second application TA runs in a trusted execution environment TEE. In, as shown in Figure 4.

The CA needs to verify the account data, determine the data size of the application space is 268 KB, and then call the malloc function to allocate a 268 KB segment space X to determine the corresponding first virtual address information, where the first starting address is A001 and the data size is 268KB. The account data that needs to be shared with the TA can then be stored in space X. The CA then returns the first virtual address information to the driver of the non-secure environment. The non-secure environment can be mapped according to the first virtual address information, and the corresponding physical storage addresses are: N0, N4, N5, N8, and N11. Since the physical storage addresses are not continuous, the data size and all physical storages can be obtained. The address exists in the array share_pa_t. A driver in a non-secure environment can send the set share_pa_t to the operating system TEE_OS of the trusted execution environment.

TEE_OS can parse the contents of the array share_pa_t, obtain the corresponding physical storage addresses (N0, N4, N5, N8, and N11, etc.) and the data size (268 KB), and then map based on the physical storage address and the data size to obtain the second virtual The address information includes a second start address B001' and a data size of 268 KB. The TEE_OS sends the second virtual address information to the second application TA, and the TA acquires account data based on the second virtual address information, and then verifies the account data. The verification result may then be stored according to the second virtual address information, so that the CA can obtain operations required for the execution of the verification result, such as providing a payment function and the like.

After obtaining the second virtual address information, the TA may determine the data size required after the account data is verified, and then compare the data size corresponding to the second virtual address information with the required data size, if the required data size No more than 268KB, that is, the requested space X is enough to accommodate the processed data, and can perform subsequent verification and other processing operations; conversely, if the required data size is greater than 268 KB, such as 300 KB, the applied space X is insufficient to accommodate the processing. The data can be sent to the CA to inform that it needs 300KB of space, the CA re-applies, and performs the above process.

The embodiment of the present application does not need to pre-define the shared space, but can trust the physical storage address of the shared memory and the non-secure environment shared memory, thereby reducing the consumption of memory resources. Therefore, the driver of the non-secure environment does not need to send a request to the operating system of the trusted execution environment during the initialization phase to query the shared space, reduce the startup time of the device, and provide efficiency. And based on the shared physical storage address, the shared data between the trusted execution environment and the non-secure environment does not need to be replicated between different addresses, reducing data resources and processing time.

It should be noted that, for the method embodiments, for the sake of simple description, they are all expressed as a series of action combinations, but those skilled in the art should understand that the embodiments of the present application are not limited by the described action sequence, because In accordance with embodiments of the present application, certain steps may be performed in other sequences or concurrently. In the following, those skilled in the art should also understand that the embodiments described in the specification are all preferred embodiments, and the actions involved are not necessarily required in the embodiments of the present application.

Based on the foregoing embodiment, the embodiment further provides a terminal device, where the terminal device includes a first platform 502 in a non-secure environment and a second platform 504 in a trusted execution environment.

Referring to FIG. 5, a structural block diagram of an embodiment of a terminal device of the present application is shown, which may specifically include the following modules:

The first platform 502 is configured to determine a corresponding physical storage address according to the first virtual address information of the shared data, and send the physical storage address to the second platform.

The second platform 504 is configured to map the corresponding second virtual address information in the trusted execution environment according to the physical storage address, and process the shared data corresponding to the second virtual address information.

In summary, the first platform in the non-secure environment determines the corresponding physical storage address according to the first virtual address information of the shared data, and sends the physical storage address to the second platform in the trusted execution environment, thereby eliminating the need to set The shared data-specific shared space is applied for the space storage data when there is a demand, and the waste of resources is reduced; the second platform maps the corresponding second virtual address information in the trusted execution environment according to the physical storage address, The shared data corresponding to the second virtual address information is processed. It can be seen that, for shared data in the same physical storage address, different platforms are mapped to different virtual address information, so that the non-secure environment and the trusted execution environment are available. Obtaining shared data in the same physical storage address does not waste resources.

Secondly, the first platform and the second platform can obtain shared data from the same physical storage address, but different platforms correspond to different virtual address information, so the data does not need to be copied in two storage spaces, and on the basis of reducing resource occupation, It also reduces data operations and reduces the burden on the device.

The first platform is configured to store shared data in the first virtual address information, and determine a corresponding physical storage address according to the first storage information.

The first platform is configured to use the first function to call the first function request address space, obtain the first storage information corresponding to the address space, and store the shared data in the address space according to the first storage information, The first stored information is sent to the first platform.

The first platform is configured to invoke a second function, and map the first storage information in the non-secure environment to obtain a corresponding physical storage address.

The first platform is further configured to generate a corresponding array according to the physical storage address and the data size; the first platform sends the array to the second platform.

The second platform is configured to parse the array to obtain a corresponding physical storage address and a data size, and invoke a third function to map the physical storage address in the trusted execution environment to determine a second Virtual address information.

The second platform is configured to send the second virtual address information to the second application; the second application acquires corresponding shared data according to the second virtual address information, where the trusted execution environment is The shared data is processed.

The second platform is further configured to: if the second application determines that the data size is insufficient, send a request to the first application to notify the first application to re-request the address space.

The shared data of the first application and the second application is obtained based on the first platform in the non-secure environment and the second platform in the trusted execution environment, that is, the data interaction is implemented based on the platform dimension, and between the first application and the second application Communication interactions, such as request, response, instruction transfer, etc., based on application-oriented dimensions. Therefore, the shared data of the first platform and the second platform are stored in the same physical storage address instead of the set shared space, so the data size is not limited, and theoretically all the free memory space in the first platform can be shared. When there is no shared service, it will not occupy idle resources.

In one example, the first platform corresponds to a non-secure environment and the second platform corresponds to a trusted execution environment. Then the first application CA runs in the non-secure environment REE, and the second application TA runs in the trusted execution environment TEE. The embodiment of the present application does not need to pre-define the shared space, but can trust the physical storage address of the shared memory and the non-secure environment shared memory, thereby reducing the consumption of memory resources. Therefore, the driver of the non-secure environment does not need to send a request to the operating system of the trusted execution environment during the initialization phase to query the shared space, reduce the startup time of the device, and provide efficiency. And based on the shared physical storage address, the shared data between the trusted execution environment and the non-secure environment does not need to be replicated between different addresses, reducing data resources and processing time.

The embodiment of the present application further provides a non-volatile readable storage medium, where the storage medium stores one or more programs, and when the one or more modules are applied to the device, the device may be executed. The instructions of each method step in the embodiment of the present application.

Embodiments of the present application provide one or more machine readable medium having stored thereon instructions that, when executed by one or more processors, cause an electronic device to perform the method as described in one or more of the above embodiments. The electronic device includes a terminal device, a server, and the like.

FIG. 6 is a schematic structural diagram of hardware of an electronic device according to an embodiment of the present disclosure, where the electronic device may include a terminal device, a server, and the like. As shown in FIG. 6, the electronic device can include an input device 60, a processor 61, an output device 62, a memory 63, and at least one communication bus 64. Communication bus 64 is used to implement a communication connection between components. The memory 63 may include a high speed RAM (Random Access Memory), and may also include a non-volatile storage NVM (Non-Volatile Memory), such as at least one disk storage. The memory 63 may store various programs for use. The various processing functions are completed and the method steps of the embodiment are implemented.

Optionally, the processor 61 may be, for example, a central processing unit (CPU), an application specific integrated circuit (ASIC), a digital signal processor (DSP), a digital signal processing device (DSPD), and a programmable logic. A device (PLD), field programmable gate array (FPGA), controller, microcontroller, microprocessor or other electronic component is implemented that is coupled to the input device 60 and output device 62 described above by a wired or wireless connection.

Optionally, the input device 60 may include multiple input devices, for example, at least one of a user-oriented user interface, a device-oriented device interface, a software programmable interface, a camera, and a sensor. Optionally, the device-oriented device interface may be a wired interface used for data transmission between the device and the device, or may be a hardware insertion interface (for example, a USB interface, a serial port, etc.) for data transmission between the device and the device. Optionally, the user-oriented user interface may be, for example, a user-oriented control button, a voice input device for receiving voice input, and a touch-sensing device for receiving a user's touch input (eg, a touch screen with touch sensing function, touch Optionally, the programmable interface of the software may be, for example, an input for the user to edit or modify the program, such as an input pin interface or an input interface of the chip; optionally, the transceiver may have Radio frequency transceiver chip, baseband processing chip, and transceiver antenna for communication functions. An audio input device such as a microphone can receive voice data. Output device 62 may include an output device such as a display, an audio, or the like.

In this embodiment, the processor of the device includes functions for executing modules of the network management device in each electronic device. The specific functions and technical effects may be referred to the foregoing embodiments, and details are not described herein again.

FIG. 7 is a schematic structural diagram of hardware of an electronic device according to another embodiment of the present disclosure. Figure 7 is a specific embodiment of the implementation of Figure 6. As shown in FIG. 7, the electronic device of this embodiment includes a processor 71 and a memory 72.

The processor 71 executes the computer program code stored in the memory 72 to implement the data sharing method of FIGS. 1 to 4 in the above embodiment.

The memory 72 is configured to store various types of data to support operation at the electronic device. Examples of such data include instructions for any application or method operating on an electronic device, such as messages, pictures, videos, and the like. Memory 72 may include random access memory RAM and may also include non-volatile memory NVM, such as at least one disk storage.

Optionally, processor 71 is disposed in processing component 70. The electronic device can also include a communication component 73, a power component 74, a multimedia component 75, an audio component 76, an input/output interface 77, and/or a sensor component 78. The components and the like included in the device are set according to actual requirements, which is not limited in this embodiment.

Processing component 70 typically controls the overall operation of the device. Processing component 70 may include one or more processors 71 to execute instructions to perform all or part of the steps of the above-described methods of Figures 1-4. Moreover, processing component 70 can include one or more modules to facilitate interaction between component 70 and other components. For example, processing component 70 can include a multimedia module to facilitate interaction between multimedia component 75 and processing component 70.

Power component 74 provides power to various components of the device. Power component 74 can include a power management system, one or more power sources, and other components associated with generating, managing, and distributing power for the electronic device.

The multimedia component 75 includes a display screen between the device and the user that provides an output interface. In some embodiments, the display screen can include a liquid crystal display (LCD) and a touch panel (TP). If the display includes a touch panel, the display can be implemented as a touch screen to receive input signals from the user. The touch panel includes one or more touch sensors to sense touches, slides, and gestures on the touch panel. The touch sensor may sense not only the boundary of the touch or sliding action, but also the duration and pressure associated with the touch or slide operation.

The audio component 76 is configured to output and/or input an audio signal. For example, audio component 76 includes a microphone (MIC) that is configured to receive an external audio signal when the device is in an operational mode, such as a voice recognition mode. The received audio signal may be further stored in memory 72 or transmitted via communication component 73. In some embodiments, audio component 76 also includes a speaker for outputting an audio signal.

The input/output interface 77 provides an interface between the processing component 70 and the peripheral interface module, which may be a click wheel, a button, or the like. These buttons may include, but are not limited to, a volume button, a start button, and a lock button.

Sensor assembly 78 includes one or more sensors for providing various aspects of state assessment for the device. For example, sensor component 78 can detect the on/off state of the device, the relative positioning of the components, and the presence or absence of user contact with the device. Sensor assembly 78 can include a proximity sensor configured to detect the presence of nearby objects without any physical contact, including detecting the distance between the user and the device. In some embodiments, the sensor assembly 78 can also include a camera or the like.

Communication component 73 is configured to facilitate wired or wireless communication between the electronic device and other electronic devices. The electronic device can access a wireless network based on a communication standard such as WiFi, 2G or 3G, or a combination thereof. In an embodiment, the electronic device may include a SIM card slot for inserting the SIM card, so that the device can log in to the GPRS network to establish communication with the server via the Internet.

It can be seen from the above that the communication component 73, the audio component 76, the input/output interface 77, and the sensor component 78 involved in the embodiment of FIG. 7 can be implemented as an input device in the embodiment of FIG. 6.

An embodiment of the present application provides a terminal device, including: one or more processors; and one or more machine-readable media having stored thereon instructions, when executed by the one or more processors, The terminal device is caused to perform the method as described in one or more of the embodiments of the present application.

For the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the description of the method embodiment.

The various embodiments in the present specification are described in a progressive manner, and each embodiment focuses on differences from other embodiments, and the same similar parts between the various embodiments can be referred to each other.

Embodiments of the present application are described with reference to flowcharts and/or block diagrams of methods, terminal devices (systems), and computer program products according to embodiments of the present application. It will be understood that each flow and/or block of the flowchart illustrations and/or FIG. These computer program instructions can be provided to a processor of a general purpose computer, special purpose computer, embedded processor or other programmable data processing terminal device to produce a machine such that instructions are executed by a processor of a computer or other programmable data processing terminal device Means are provided for implementing the functions specified in one or more of the flow or in one or more blocks of the flow chart.

The computer program instructions can also be stored in a computer readable memory that can direct a computer or other programmable data processing terminal device to operate in a particular manner, such that instructions stored in the computer readable memory produce an article of manufacture comprising the instruction device. The instruction device implements the functions specified in one or more blocks of the flow or in a flow or block diagram of the flowchart.

These computer program instructions can also be loaded onto a computer or other programmable data processing terminal device such that a series of operational steps are performed on the computer or other programmable terminal device to produce computer-implemented processing, such that the computer or other programmable terminal device The instructions executed above provide steps for implementing the functions specified in one or more blocks of the flowchart or in a block or blocks of the flowchart.

While a preferred embodiment of the embodiments of the present application has been described, those skilled in the art can make further changes and modifications to the embodiments once they are aware of the basic inventive concept. Therefore, the appended claims are intended to be interpreted as including all the modifications and the modifications

Finally, it should also be noted that in this context, relational terms such as first and second are used merely to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply these entities. There is any such actual relationship or order between operations. Furthermore, the terms "comprises" or "comprising" or "comprising" or any other variations are intended to encompass a non-exclusive inclusion, such that a process, method, article, or terminal device that includes a plurality of elements includes not only those elements but also Other elements that are included, or include elements inherent to such a process, method, article, or terminal device. An element defined by the phrase "comprising a ..." does not exclude the presence of additional identical elements in the process, method, article, or terminal device that comprises the element, without further limitation.

The foregoing describes a data sharing method, a terminal device, and a storage medium provided by the present application. The principles and implementation manners of the present application are described in the specific examples. It is only used to help understand the method of the present application and its core ideas; at the same time, for those of ordinary skill in the art, according to the idea of the present application, there will be changes in specific implementation manners and application scopes. The contents of this specification are not to be construed as limiting the application.

Claims

A data sharing method, which is applied to a terminal device, where the terminal device includes a first platform in a non-secure environment and a second platform in a trusted execution environment, and the method includes:

Determining, by the first platform, the corresponding physical storage address according to the first virtual address information of the shared data, and sending the physical storage address to the second platform;

And mapping, by the second platform, the corresponding second virtual address information in the trusted execution environment according to the physical storage address, and processing the shared data corresponding to the second virtual address information.
The method according to claim 1, wherein the first virtual address information comprises: a first start address and a data size; and the second virtual address information comprises: a second start address and a data size.
The method according to claim 2, wherein the first platform determines a corresponding physical storage address according to the first virtual address information of the shared data, including:

The first platform stores the shared data in the first virtual address information, and determines the corresponding physical storage address according to the first storage information.
The method of claim 3, wherein the first platform runs a first application; the first platform stores shared data in the first virtual address information, including:

The first application invokes a first function request address space, and acquires first storage information corresponding to the address space;

And storing the shared data in the address space according to the first storage information, and transmitting the first storage information to the first platform.
The method according to claim 4, wherein determining a corresponding physical storage address according to the first storage information comprises:

The first platform invokes a second function, and maps the first storage information in the non-secure environment to obtain a corresponding physical storage address.
The method of claim 2, wherein the method further comprises:

The first platform generates a corresponding array according to the physical storage address and the data size;

And sending the physical storage address to the second platform, including: the first platform sending the array to the second platform.
The method according to claim 6, wherein the mapping, by the second platform, the corresponding second virtual address information in the trusted execution environment according to the physical storage address, includes:

The second platform parses the array to obtain a corresponding physical storage address and data size;

Calling a third function to map the physical storage address in the trusted execution environment to determine second virtual address information.
The method according to claim 4, wherein the second platform runs a second application, and the shared data corresponding to the second virtual address information is processed, including:

The second platform sends the second virtual address information to the second application;

The second application acquires corresponding shared data according to the second virtual address information, and processes the shared data in the trusted execution environment.
The method of claim 8 further comprising:

And if the second application determines that the data size is insufficient, sending a request to the first application to notify the first application to re-request the address space.
A terminal device, where the terminal device includes a first platform in a non-secure environment and a second platform in a trusted execution environment;

The first platform is configured to determine a corresponding physical storage address according to the first virtual address information of the shared data, and send the physical storage address to the second platform;

The second platform is configured to map the corresponding second virtual address information in the trusted execution environment according to the physical storage address, and process the shared data corresponding to the second virtual address information.
The terminal device according to claim 10, wherein the first virtual address information comprises: a first start address and a data size; and the second virtual address information comprises: a second start address and a data size.
The terminal device according to claim 11, wherein

The first platform is configured to store shared data in the first virtual address information, and determine a corresponding physical storage address according to the first storage information.
The terminal device according to claim 12, wherein the first platform runs a first application;

The first platform is configured to use the first function to call the first function request address space, obtain the first storage information corresponding to the address space, and store the shared data in the address space according to the first storage information, The first stored information is sent to the first platform.
The terminal device according to claim 13, wherein

The first platform is configured to invoke a second function, and map the first storage information in the non-secure environment to obtain a corresponding physical storage address.
The terminal device according to claim 11, wherein

The first platform is further configured to generate a corresponding array according to the physical storage address and the data size; the first platform sends the array to the second platform.
The terminal device according to claim 15, wherein

The second platform is configured to parse the array to obtain a corresponding physical storage address and a data size, and invoke a third function to map the physical storage address in the trusted execution environment to determine a second Virtual address information.
The terminal device according to claim 13, wherein

The second platform is configured to send the second virtual address information to the second application; the second application acquires corresponding shared data according to the second virtual address information, where the trusted execution environment is The shared data is processed.
The terminal device according to claim 17, wherein

The second platform is further configured to: if the second application determines that the data size is insufficient, send a request to the first application to notify the first application to re-request the address space.
A terminal device, comprising:

One or more processors; and

One or more machine-readable media having stored thereon instructions that, when executed by the one or more processors, cause the terminal device to perform the method of one or more of claims 1-9.
One or more machine-readable medium having stored thereon instructions that, when executed by one or more processors, cause the terminal device to perform the method of one or more of claims 1-9.