WO2021008105A1

WO2021008105A1 - Data transmission method and device in tee system

Info

Publication number: WO2021008105A1
Application number: PCT/CN2020/071288
Authority: WO
Inventors: 刘琦; 赵博然; 闫莺; 魏长征
Original assignee: 创新先进技术有限公司
Priority date: 2019-07-16
Filing date: 2020-01-10
Publication date: 2021-01-21
Also published as: CN110442463B; TWI718000B; CN110442463A; TW202105219A

Abstract

The embodiments of the present invention provide a data transmission method and device in a TEE system. The method is executed by a first thread from a TEE side, and comprises: obtaining first data; calling a predetermined function by taking the first data as an input parameter so as to switch to a non-TEE side; obtaining a write offset address by reading a first address; obtaining a read offset address by reading a second address; determining whether the number of bytes of the first data is less than or equal to the number of writable bytes, wherein the number of writable bytes is determined based on the write offset address and the read offset address, and each address corresponds to one byte; if the number of bytes of the first data is less than or equal to the number of writable bytes, writing the first data into a third address starting from the write offset address; updating the write offset address in the first address; and returning to the TEE side.

Description

Data transmission method and device in TEE system

Technical field

The embodiments of this specification relate to the field of TEE technology, and more specifically, to a data transmission method and device in a TEE system.

Background technique

Trusted Execution Environment (TEE-Trusted Execution Environment) is a secure and trusted zone in the processor, which can ensure the security, confidentiality and integrity of the code and data placed in it. TEE provides an isolated execution environment. Code and data can run in this trusted area. During the operation, it can ensure that the calculation is not interfered by the conventional operating system, so that the confidentiality and integrity of the code and data can be guaranteed. Compared with conventional operating systems, TEE (EAL2+) provides a higher level of security; compared with SE (EAL5), it provides more functions and better performance. There are many ways to implement TEE, such as Intel's SGX, AMD's SEV, ARM's TrustZone, etc. Because TEE provides an isolated execution environment, the communication between the non-TEE environment and the TEE environment is generally invoked through special instructions, such as smccall (TrustZone) or ecallOcall (SGX). For example, in the case of log printing by calling the Ocall function on the TEE side, after calling the Ocall function to cause the CPU to switch from the TEE side to the non-TEE side, and restore context information such as registers, it is usually necessary to wait for the log printing to complete on the non-TEE side Returning to the TEE side will bring a certain performance loss.

Therefore, there is a need for a more effective data transmission scheme in the TEE system.

Summary of the invention

The embodiments of this specification aim to provide a more effective solution for data transmission in the TEE system to solve the deficiencies in the prior art.

To achieve the above objective, one aspect of this specification provides a data transmission method in a TEE system. The TEE system includes a TEE side and a non-TEE side. The non-TEE side includes shared memory, and the shared memory includes a first Address, a second address, and a plurality of consecutive third addresses, wherein the first address is used to store a write offset address, and the write offset address indicates the start of the plurality of third addresses that can be written Address, the second address is used to store a read offset address, the read offset address indicates a readable start address among the plurality of third addresses, and the third address is used to store data from the TEE side Data, the method is executed by the first thread from the TEE side, including:

Get the first data;

Calling a predetermined function with the first data as an input parameter to switch to the non-TEE side;

Obtain the write offset address by reading the first address;

Obtain the read offset address by reading the second address;

Determine whether the number of bytes of the first data is less than or equal to the number of writable bytes, where the number of writable bytes is determined based on the write offset address and the read offset address, wherein each address corresponds to Less than one byte;

In the case that the number of bytes of the first data is less than or equal to the number of writable bytes, writing the first data into a third address starting from the write offset address;

Update the write offset address in the first address; and

Return to the TEE side.

In an embodiment, the first data is any one of the following data: logs, monitoring data, and statistical data.

In an embodiment, the method further includes waiting when the number of bytes of the first data is greater than the number of writable bytes.

In an embodiment, the shared memory further includes a fourth address for storing the number of discarded data, and the method further includes, in a case where the number of bytes of the first data is greater than the number of writable bytes, The first data is discarded, and the number of discarded data stored in the fourth address is increased by one.

In one embodiment, the number of discarded data is an atomic variable.

In an embodiment, the write offset address is before the read offset address, and the number of writable bytes is equal to the difference between the read offset address minus the write offset address.

In one embodiment, the write offset address is after the read offset address, and the number of writable bytes is equal to the number of the third address minus the difference between the number of unwritable bytes, wherein the unwritable The number of bytes is equal to the difference between the write offset address and the read offset address.

In one embodiment, the write offset address is the same as the read offset address, and the number of writable bytes is equal to the number of all third addresses.

In one embodiment, the TEE system is an SGX system, and the predetermined function is an Ocall function.

Another aspect of this specification provides a data transmission device in a TEE system. The TEE system includes a TEE side and a non-TEE side. The non-TEE side includes a shared memory, and the shared memory includes a first address and a second address. Address and a plurality of consecutive third addresses, wherein the first address is used to store a write offset address, and the write offset address indicates a writable start address among the plurality of third addresses, and The second address is used to store a read offset address, the read offset address indicates a readable start address among the plurality of third addresses, and the third address is used to store data from the TEE side. The device is deployed in the first thread from the TEE side, including:

The first obtaining unit is configured to obtain first data;

The calling unit is configured to call a predetermined function using the first data as an input parameter to switch to the non-TEE side;

The second obtaining unit is configured to obtain the write offset address by reading the first address;

The third obtaining unit is configured to obtain the read offset address by reading the second address;

The determining unit is configured to determine whether the number of bytes of the first data is less than or equal to the number of writable bytes, wherein the number of writable bytes is determined based on the write offset address and the read offset address, Among them, each address corresponds to a byte;

The writing unit is configured to write the first data into a third address starting from the write offset address when the number of bytes of the first data is less than or equal to the number of writable bytes;

The update unit is configured to update the write offset address in the first address; and

The return unit is configured to return to the TEE side.

In an embodiment, the device further includes a waiting unit configured to wait when the number of bytes of the first data is greater than the number of writable bytes.

In one embodiment, the shared memory further includes a fourth address for storing the number of discarded data, and the device further includes a discarding unit configured to: when the number of bytes of the first data is greater than the number of writable bytes In the case of the number, the first data is discarded, and the number of discarded data stored in the fourth address is increased by one.

Another aspect of this specification provides a computer-readable storage medium on which a computer program is stored. When the computer program is executed in a computer, the computer is caused to execute any of the above methods.

Another aspect of this specification provides a computing device including a memory and a processor, wherein the memory stores executable code, and when the processor executes the executable code, any one of the above methods is implemented.

Through the data transmission scheme in the TEE system according to the embodiment of this specification, a high-performance asynchronous data transmission system is provided for the TEE environment, such as an asynchronous log printing system, which reduces the overhead of the TEE system for printing logs and improves the operation of the TEE system Speed, while meeting some basic requirements of the log system.

Description of the drawings

By describing the embodiments of this specification in conjunction with the accompanying drawings, the embodiments of this specification can be made clearer:

FIG. 1 shows a schematic diagram of a TEE system 100 and data flow therein according to an embodiment of the present specification;

Figure 2 shows a flow chart of a data transmission method in a TEE system according to an embodiment of this specification;

Fig. 3 schematically shows a schematic diagram of a data structure in a shared memory according to an embodiment of the present specification;

Figures 4 to 8 respectively show the write offset address and the read offset address in the process of transmitting data through the shared memory;

Figure 9 shows a shared memory data structure according to another embodiment of this specification;

Fig. 10 shows a flow chart of a data transmission method in a TEE system according to an embodiment of this specification;

FIG. 11 shows a data transmission device 1100 in a TEE system according to an embodiment of this specification.

Detailed ways

The embodiments of this specification will be described below with reference to the drawings.

FIG. 1 shows a schematic diagram of the TEE system 100 and the data flow therein according to an embodiment of the present specification. As shown in the figure, the system 100 includes a TEE side 11 and a non-TEE side 12. Among them, a dedicated buffer register 121 is preset on the non-TEE side 12 as a shared memory for buffering specific data (such as logs) transmitted from the TEE side. A first thread runs on the TEE side 11, and the first thread can acquire first data (for example, log data), and stores the first data in the buffer register 121 by calling, for example, a printing function (_pringf). Specifically, for example, if the TEE system is an SGX system, the _pringf function can be switched to a non-TEE side thread by calling the Ocall function. On the non-TEE side 12, the first thread writes the log into the buffer register 121, after which, the first thread returns to the TEE side for subsequent steps. A second thread runs on the non-TEE side 12, and the second thread reads the stored data from the buffer register 121 by periodically calling the pop function, for example, in a polling manner, for example, reads the second data in one read. After reading the second data, the second thread sends the second data to a specific program on the non-TEE side (for example, the log system log4cplus) for data printing.

In the above schematic diagram, in order to ensure the data security of the first thread and the second thread simultaneously accessing the shared memory, a specific data structure is designed to allow the above process to be performed, which will be described in detail below.

Fig. 2 shows a flow chart of a data transmission method in a TEE system according to an embodiment of the specification. The TEE system includes a TEE side and a non-TEE side. The non-TEE side includes shared memory, and the shared memory includes A first address, a second address, and a plurality of consecutive third addresses, wherein the first address is used to store a write offset address, and the write offset address indicates which of the plurality of third addresses can be written A start address, the second address is used to store a read offset address, the read offset address indicates a readable start address among the plurality of third addresses, and the third address is used to store data from the TEE Side data, the method is executed by the first thread from the TEE side, including:

Step S202, obtain first data;

Step S204, calling a predetermined function with the first data as an input parameter to switch to the non-TEE side;

Step S206: Obtain the write offset address by reading the first address;

Step S208: Obtain a read offset address by reading the second address;

Step S210: Determine whether the number of bytes of the first data is less than or equal to the number of writable bytes, where the number of writable bytes is determined based on the write offset address and the read offset address, where each Each address corresponds to one byte;

Step S212, in the case that the number of bytes of the first data is less than or equal to the number of writable bytes, write the first data into a third address starting from the write offset address;

Step S214, updating the write offset address in the first address; and

Step S216, return to the TEE side.

Fig. 3 schematically shows a schematic diagram of a data structure in a shared memory according to an embodiment of the present specification. As shown in FIG. 3, the shared memory includes a first address, a second address, and a plurality of consecutive third addresses. The figure schematically shows ten third addresses, and the ten consecutive third addresses may be respectively identified as "1,2,...,10", for example. Each address in the memory can write one byte, where the first address is used to store the write offset address, and the write offset address indicates the start address that can be written in the third address; the second address is used to A read offset address is stored, and the read offset address indicates a readable start address in the third address; the third address is used to store data that is expected to be transmitted from the TEE side to the non-TEE side. For example, in the case where data has not been initially stored in the shared memory from the TEE side, the start address that can be written in the third address is the first address, that is, address "1". Therefore, the first address stores The write offset address is "1". In this case, when reading data, since only the address before the write offset address can be read at most, the read offset address in the second address at this time is also address "1", as shown schematically in the figure The third address (ie address "1") corresponding to the read offset address (indicated by R in the figure) and the write offset address (indicated by W in the figure) respectively are shown. It can be understood that in the shared memory, only multiple third addresses are limited to be consecutive addresses, and the positional relationship between the first address, the second address, and the third address is not particularly limited, for example, the first address, the second address The addresses may be located at both ends of the third address, or the first address and the second address may be located after the third address, and so on. In addition, although FIG. 3 schematically shows that the shared memory includes 10 consecutive third addresses, in practical applications, the number of third addresses included in the shared memory can be determined according to the specific number of bytes of data to be transmitted. For example, the data to be transmitted is a log on the TEE side. For example, the log usually has tens of bytes. Therefore, the shared memory can be set to include hundreds of consecutive third addresses.

When the TEE side wants to transmit specific data to the non-TEE side, the method is executed by the first thread running the TEE side to write data to the third address of the shared memory. The first thread is for example used to transfer data from the TEE side to the non-TEE side. The process of transmitting data on the TEE side. After writing data to the shared memory through this method, the data will be transferred to the target program through another thread on the non-TEE side. Therefore, the method of data transmission is asynchronous transmission mode, so this method is suitable For data that does not require high real-time performance, large transmission volume, and high performance requirements. Thus, the specific data is, for example, logs, monitoring data, statistical data, and so on.

First, in step S202, first data is acquired.

The first data is, for example, a log generated in the TEE. After generating the log, the TEE side stores it, for example, in a predetermined memory location on the TEE side. The first thread may be preset to periodically read the log from the predetermined memory location, so that the data to be transmitted may be periodically acquired to periodically execute the method.

Step S204, calling a predetermined function with the first data as an input parameter to switch to the non-TEE side.

The TEE system is, for example, an SGX system, and the SGX system includes an enclave as a trusted execution environment (TEE). In the enclave, the first thread can switch to the non-enclave side by calling the Ocall function ( That is, the non-TEE side). The Ocall function is a data transmission method provided in the SGX system. After the thread on the circle side calls the Ocall function, the cpu is switched to the non-circle side. Specifically, after the Ocall function is called with the first data as the input parameter, the register on the circle side is backed up on the circle side, and the first data is transferred to the non-TEE side by using the first data as the input parameter, and then on the non-TEE side. The circle side restores the register information of the non-circle side, which includes storing the first data as the input parameter in the register. After the first thread is switched to the non-TEE side, the subsequent steps can then be performed by calling other functions.

In step S206, the write offset address is obtained by reading the first address. In step S208, the read offset address is obtained by reading the second address.

Except for the case where the write offset address and the read offset address shown in FIG. 3 respectively indicate the address "1" in the third address, FIGS. 4 to 8 respectively show the process of transmitting data through the shared memory. The write offset address and read offset address. In Figure 4-8, each box corresponds to an address, the data inside the box is one byte of data stored in it, the number below the box is the address identification, "R" and "W" are as above The instructions correspond to the read offset address and the write offset address respectively.

In Figure 4, four bytes "ab\n\0" have been sequentially written from address 1 to the third address through this method, and the shared memory has not been read yet on the non-TEE side. In this case, the write offset address (W) stored in the first address points to the address after "\0" is stored, that is, address 5, and the read offset address (R) stored in the second address still points to address 1. .

In Figure 5, four bytes "cd\n\0" have been written sequentially from address 5 through this method, and the shared memory has not been read yet on the non-TEE side. In this case , The write offset address (W) points to the address after the second "\0" is stored, that is, address 9, and the read offset address (R) still points to address 1.

In FIG. 6, data reading has been performed from the read offset address on the non-TEE side through the method described below, and the read can only read up to an address before the write offset address, that is, the read The process reads the eight bytes "ab\n\0cd\n\0" that have been written in the shared memory. In this case, the write offset address stored in the first address still points to address 9, and the read offset address stored in the second address points to the address after the second "\0", that is, it is also address 9.

In Figure 7, four bytes of "ef\n\0" have been sequentially written into the third address from address 9 through the method shown in Figure 2. In this case, the read offset address has not changed and is still address 9. In the process of writing data, when all 10 addresses are filled, the data before the read offset address is read Data, thus, each address from address 1 to the address before the read offset address (address 9 in this case) (ie address 8) can be written, so jump from address 10 to address 1 to continue Write, after writing, the write offset address points to address 3.

In Figure 8, the shared memory has been read on the non-TEE side again. Specifically, from the read offset address (address 9) to the previous address (address 2) of the write offset address, after the read, the write offset address in the first address still points to address 3. , The read offset address in the second address also points to address 3.

In step S210, it is judged whether the number of bytes of the first data is less than or equal to the number of writable bytes, wherein the number of writable bytes is determined based on the write offset address and the read offset address, wherein, Each address corresponds to a byte.

Those skilled in the art can easily determine the writable addresses among the multiple third addresses according to the write offset address and the read offset address. Since one address corresponds to one byte, the number of writable bytes can be determined.

For example, in the situations shown in FIG. 3, FIG. 6 and FIG. 8, the read offset address and the write offset address point to the same address, and the number of writable bytes is the total number of third addresses, that is, 10.

In the cases shown in Figures 4 and 5, the write offset address is after the read offset address, the number of writable bytes is the number of the third address minus the number of unwritable bytes, and the number of unwritable bytes is the write offset The difference of the shift address minus the read offset address. For example, in Figure 4, the write offset address is 5 and the read offset address is 1, so the number of unwritable bytes is 5-1=4, and the number of writable bytes is 10-4=6, which correspond to There are six addresses from address 5 to address 10.

In the case shown in FIG. 7, the write offset address is before the read offset address. In this case, the number of writable bytes is the difference between the read offset address and the write offset address. For example, in FIG. 7, the write offset address is 3 and the read offset address is 9, so that the number of writable bytes is 9-3=6, which respectively correspond to a total of six addresses from address 3 to address 8.

In step S212, in the case where the number of bytes of the first data is less than or equal to the number of writable bytes, the first data is written into a third address starting from the write offset address.

For example, in the case where the data stored in the shared memory is shown in Figure 4, as described above, the number of writable bytes is 6, when the first data to be written is "ef\n\0 In the case of 4 bytes, since 4<6, 4 bytes of "ef\n\0" can be written into the four addresses of 5, 6, 7, and 8.

In the case where the data stored in the shared memory is shown in Figure 7, as described above, the number of writable bytes is 6, when the first data to be written is "ghijkl\n\0" 8 In the case of bytes, that is, the number of bytes of the first data is greater than the number of writable bytes, and therefore, the data cannot be written to the shared memory. In this case, the writing thread either waits until there are enough writable bytes in the shared memory, or it can discard the first data and return. Figure 9 shows a shared memory data structure according to another embodiment of the specification. In this data structure, in addition to the first address, the second address, and the third address described in FIG. 3, it also includes a fourth address, and the fourth address stores the number of discarded data. After discarding the first data as described above, the number of discarded data is increased by 1 in the fourth address. In one embodiment, the number of discarded data is an atomic variable, so that data security can be ensured when the TEE side and non-TEE side dual threads operate simultaneously.

In step S214, the write offset address in the first address is updated.

For example, after writing "ab\n\0" to the third address in Figure 3, the initial write offset address "1" is updated to the write offset address "5" to facilitate the next write or Read the write offset address when reading. For example, when writing to the third address shown in FIG. 4, the latest write offset address "5" can be read, so as to calculate the number of writable bytes.

In step S216, return to the TEE side.

The first thread may be preset to return to the TEE side after performing step S214, so that the first thread will automatically return to the TEE side after performing step S214 to perform subsequent steps on the TEE side, for example, repeat the method again.

Fig. 10 shows a flow chart of a data transmission method in a TEE system according to an embodiment of the present specification. The TEE system includes a TEE side and a non-TEE side. The non-TEE side includes shared memory, and the shared memory includes A first address, a second address, and a plurality of consecutive third addresses, wherein the first address is used to store a write offset address, and the write offset address indicates which of the plurality of third addresses can be written A start address, the second address is used to store a read offset address, the read offset address indicates a readable start address among the plurality of third addresses, and the third address is used to store data from the TEE Side data, the method is executed by the non-TEE side, including:

Step S1002, obtain the write offset address by reading the first address;

Step S1004: Obtain a read offset address by reading the second address;

Step S1006: Read unread bytes in the write data in the third address as second data, where the unread bytes are determined based on the write offset address and the read offset address, Among them, each address corresponds to a byte; and

Step S1008: Update the read offset address in the second address.

This method may be executed by a second thread running on the non-TEE side, and the second thread may also belong to the aforementioned process for transmitting data from the TEE side to the non-TEE side.

For step S1002 and step S1004, reference may be made to the above description of step S206 and step S208, which will not be repeated here.

In step S1006, read unread bytes in the write data in the third address as second data, and the unread bytes are determined based on the write offset address and the read offset address , Where each address corresponds to a byte.

Those skilled in the art can easily determine the unread bytes in the third address according to the write offset address and the read offset address.

For example, in the cases shown in FIG. 3, FIG. 6 and FIG. 8, the read offset address and the write offset address point to the same address, and the third address does not include unread bytes.

In the cases shown in FIGS. 4 and 5, the write offset address is after the read offset address, and all unread bytes in the third address include starting from the read offset address to the write offset address Each byte in the previous address. For example, in FIG. 4, the write offset address is 5 and the read offset address is 1, so that all unread bytes are the bytes in addresses 1 to 4.

In the case shown in FIG. 7, the write offset address is before the read offset address. In this case, the all unread bytes are the bytes other than the read bytes in the third address. , The read byte includes each byte from the write offset address to the previous address of the read offset address. For example, in Figure 7, the write offset address is 3 and the read offset address is 9, so that the read bytes are the bytes in each address from address 3 to address 8, so that all unread bytes For each byte in address 1-2 and address 9-10. It can be understood that in this step, it is not necessary to read all the unread bytes in the third address, but only part of the unread bytes may be read. For example, it can be preset to read only 3 bytes at a time, so that the first three bytes of all unread bytes can be read in one read, and the remaining unread byte can be reserved for It will be read the next time it is read.

In step S1008, the read offset address in the second address is updated.

For example, after reading eight bytes "ab\n\0cd\n\0" from the third address shown in Figure 5, update the read offset address from "1" to "9" to facilitate the next time Reading the read offset address when writing or reading.

In an embodiment, the second data is log data, and the method further includes, after updating the read offset address in the second address, sending the second data to the log on the non-TEE side The printing program is used to print the second data. The printing includes, for example, displaying on a display or storing in a hard disk.

FIG. 11 shows a data transmission device 1100 in a TEE system according to an embodiment of the present specification. The TEE system includes a TEE side and a non-TEE side. The non-TEE side includes a shared memory, and the shared memory includes a first One address, a second address, and a plurality of consecutive third addresses, wherein the first address is used to store a write offset address, and the write offset address indicates the start of the plurality of third addresses that can be written A start address, the second address is used to store a read offset address, the read offset address indicates a readable start address among the plurality of third addresses, and the third address is used to store data from the TEE side The device is deployed in the first thread from the TEE side, including:

The first obtaining unit 1101 is configured to obtain first data;

The calling unit 1102 is configured to call a predetermined function using the first data as an input parameter to switch to the non-TEE side;

The second obtaining unit 1103 is configured to obtain the write offset address by reading the first address;

The third obtaining unit 1104 is configured to obtain the read offset address by reading the second address;

The determining unit 1105 is configured to determine whether the number of bytes of the first data is less than or equal to the number of writable bytes, wherein the number of writable bytes is determined based on the write offset address and the read offset address , Among them, each address corresponds to a byte;

The writing unit 1106 is configured to write the first data into a third address starting from the write offset address when the number of bytes of the first data is less than or equal to the number of writable bytes ；

The update unit 1107 is configured to update the write offset address in the first address; and

The returning unit 1108 is configured to return to the TEE side.

In an embodiment, the device further includes a waiting unit 1109 configured to wait when the number of bytes of the first data is greater than the number of writable bytes.

In one embodiment, the shared memory further includes a fourth address for storing the number of discarded data, and the device further includes a discarding unit 1110 configured to: when the number of bytes of the first data is greater than the number of words that can be written In the case of the number of nodes, the first data is discarded, and the number of discarded data stored in the fourth address is increased by one.

In the embodiment of this specification, because the shared memory will be used by both TEE and non-TEE environments, the particularity of TEE makes it impossible to use locks to ensure thread safety. Therefore, in this solution, a lock-free data structure is used and passed Special design ensures thread safety. Specifically, the shared memory includes the above-mentioned first address-fourth address. For the first address and the second address, only one side can be written, and the other side can only be read, so there is no problem of simultaneous writing. In addition, for the situation that one side is reading and the other is writing, because when writing, the write offset address is updated after writing, and when reading, the offset address is updated after reading, so there is no offset address update, but the data has not yet In the case of processing, the unwritten data will not be read, and the unread data will not be overwritten by writing data. Although the data stored in the third address is read and written on both sides, the read and write range is controlled by the write offset address and the read offset address, so they are actually separate areas and do not interfere with each other. In addition, although the number of discarded data in the fourth address is read and written at the same time, data security is ensured by setting it as an atomic variable.

Through the design of the above lock-free data structure, a high-performance asynchronous data transmission system is provided for the TEE environment, such as an asynchronous log printing system, which reduces the overhead of the TEE system for printing logs, improves the running speed of the TEE system, and satisfies the Some basic requirements of the log system.

It should be understood that the descriptions of "first", "second", etc. in this text are merely used to distinguish similar concepts for simplicity of description, and do not have other limiting effects.

The various embodiments in this specification are described in a progressive manner, and the same or similar parts between the various embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, as for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and for related parts, please refer to the part of the description of the method embodiment.

The foregoing describes specific embodiments of this specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps described in the claims may be performed in a different order than in the embodiments and still achieve desired results. In addition, the processes depicted in the drawings do not necessarily require the specific order or sequential order shown in order to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

Those of ordinary skill in the art should be further aware that the units and algorithm steps of the examples described in the embodiments disclosed herein can be implemented by electronic hardware, computer software or a combination of the two, in order to clearly illustrate the hardware For the interchangeability with software, the composition and steps of each example have been described generally in accordance with the function in the above description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those of ordinary skill in the art can use different methods for each specific application to implement the described functions, but such implementation should not be considered as going beyond the scope of this application.

The steps of the method or algorithm described in the embodiments disclosed herein can be implemented by hardware, a software module executed by a processor, or a combination of the two. The software module can be placed in random access memory (RAM), internal memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disks, removable disks, CD-ROMs, or all areas in the technical field. Any other known storage media.

The specific embodiments described above further describe the purpose, technical solutions and beneficial effects of the present invention in further detail. It should be understood that the above are only specific embodiments of the present invention and are not intended to limit the scope of the present invention. The scope of protection, any modification, equivalent replacement, improvement, etc., made within the spirit and principle of the present invention shall be included in the scope of protection of the present invention.

Claims

A data transmission method in a TEE system. The TEE system includes a TEE side and a non-TEE side. The non-TEE side includes a shared memory, and the shared memory includes a first address, a second address, and a plurality of consecutive addresses. The third address, wherein the first address is used to store a write offset address, the write offset address indicates a writable start address among the plurality of third addresses, and the second address is used to store Read offset address, the read offset address indicates a readable start address among the plurality of third addresses, the third address is used to store data from the TEE side, and the method is determined by the method from the TEE side The first thread execution includes:

Get the first data;

Calling a predetermined function with the first data as an input parameter to switch to the non-TEE side;

Obtain the write offset address by reading the first address;

Obtain the read offset address by reading the second address;

Determine whether the number of bytes of the first data is less than or equal to the number of writable bytes, where the number of writable bytes is determined based on the write offset address and the read offset address, wherein each address corresponds to Less than one byte;

In the case that the number of bytes of the first data is less than or equal to the number of writable bytes, writing the first data into a third address starting from the write offset address;

Update the write offset address in the first address; and

Return to the TEE side.
The method according to claim 1, wherein the first data is any one of the following data: logs, monitoring data, and statistical data.
The method according to claim 1, further comprising, in a case where the number of bytes of the first data is greater than the number of writable bytes, waiting.
The method according to claim 1, wherein the shared memory further comprises a fourth address for storing the number of discarded data, and the method further comprises: when the number of bytes of the first data is greater than the number of writable bytes In this case, the first data is discarded, and the number of discarded data stored in the fourth address is increased by one.
The method according to claim 4, wherein the number of discarded data is an atomic variable.
The method according to claim 1, wherein the write offset address is before the read offset address, and the number of writable bytes is equal to the difference between the read offset address minus the write offset address .
The method according to claim 1, wherein the write offset address is after the read offset address, and the number of writable bytes is equal to the number of the third address minus the difference of the number of unwritable bytes, wherein , The number of unwritable bytes is equal to the difference between the write offset address and the read offset address.
The method according to claim 1, wherein the write offset address is the same as the read offset address, and the number of writable bytes is equal to the number of all third addresses.
The method according to claim 1, wherein the TEE system is an SGX system, and wherein the predetermined function is an Ocall function.
A data transmission device in a TEE system. The TEE system includes a TEE side and a non-TEE side. The non-TEE side includes a shared memory, and the shared memory includes a first address, a second address, and a plurality of consecutive addresses. The third address, wherein the first address is used to store a write offset address, the write offset address indicates a writable start address among the plurality of third addresses, and the second address is used to store A read offset address, where the read offset address indicates a readable start address among the plurality of third addresses, the third address is used to store data from the TEE side, and the device is deployed from the TEE side The first thread includes:

The first obtaining unit is configured to obtain first data;

The calling unit is configured to call a predetermined function using the first data as an input parameter to switch to the non-TEE side;

The second obtaining unit is configured to obtain the write offset address by reading the first address;

The third obtaining unit is configured to obtain the read offset address by reading the second address;

The determining unit is configured to determine whether the number of bytes of the first data is less than or equal to the number of writable bytes, wherein the number of writable bytes is determined based on the write offset address and the read offset address, Among them, each address corresponds to a byte;

The writing unit is configured to write the first data into a third address starting from the write offset address when the number of bytes of the first data is less than or equal to the number of writable bytes;

The update unit is configured to update the write offset address in the first address; and

The return unit is configured to return to the TEE side.
The device according to claim 10, wherein the first data is any one of the following data: logs, monitoring data, and statistical data.
The apparatus according to claim 10, further comprising a waiting unit configured to wait when the number of bytes of the first data is greater than the number of writable bytes.
The device according to claim 10, wherein the shared memory further comprises a fourth address for storing the number of discarded data, and the device further comprises a discarding unit configured to: when the number of bytes of the first data is greater than the available In the case of writing the number of bytes, the first data is discarded, and the number of discarded data stored in the fourth address is increased by one.
The apparatus according to claim 13, wherein the number of discarded data is an atomic variable.
11. The device according to claim 10, wherein the write offset address is before the read offset address, and the number of writable bytes is equal to the difference between the read offset address minus the write offset address .
11. The device according to claim 10, wherein the write offset address is after the read offset address, and the number of writable bytes is equal to the number of the third address minus the number of unwritable bytes, wherein , The number of unwritable bytes is equal to the difference between the write offset address and the read offset address.
11. The device of claim 10, wherein the write offset address is the same as the read offset address, and the number of writable bytes is equal to the number of all third addresses.
The apparatus according to claim 10, wherein the TEE system is an SGX system, and wherein the predetermined function is an Ocall function.
A computer-readable storage medium with a computer program stored thereon, and when the computer program is executed in a computer, the computer is caused to execute the method according to any one of claims 1-9.
A computing device, comprising a memory and a processor, characterized in that executable code is stored in the memory, and when the processor executes the executable code, the device described in any one of claims 1-9 is implemented method.