WO2021036706A1 - 可信应用的运行方法、信息处理和内存分配方法及装置 - Google Patents

可信应用的运行方法、信息处理和内存分配方法及装置 Download PDF

Info

Publication number
WO2021036706A1
WO2021036706A1 PCT/CN2020/106685 CN2020106685W WO2021036706A1 WO 2021036706 A1 WO2021036706 A1 WO 2021036706A1 CN 2020106685 W CN2020106685 W CN 2020106685W WO 2021036706 A1 WO2021036706 A1 WO 2021036706A1
Authority
WO
WIPO (PCT)
Prior art keywords
target
operating system
memory
tee
dynamic library
Prior art date
Application number
PCT/CN2020/106685
Other languages
English (en)
French (fr)
Inventor
彭建新
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to EP20858803.8A priority Critical patent/EP4016347A4/en
Publication of WO2021036706A1 publication Critical patent/WO2021036706A1/zh
Priority to US17/682,034 priority patent/US20220277108A1/en

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/70—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer
    • G06F21/71—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure computing or processing of information
    • G06F21/74—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure computing or processing of information operating in dual or compartmented mode, i.e. at least one secure mode
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/64—Protecting data integrity, e.g. using checksums, certificates or signatures
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/52—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
    • G06F21/53—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow by executing in a restricted environment, e.g. sandbox or secure virtual machine
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/57—Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
    • G06F21/6218—Protecting access to data via a platform, e.g. using keys or access control rules to a system of files or objects, e.g. local or distributed file system or database
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/70—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer
    • G06F21/78—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure storage of data
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/46—Multiprogramming arrangements
    • G06F9/50—Allocation of resources, e.g. of the central processing unit [CPU]
    • G06F9/5005—Allocation of resources, e.g. of the central processing unit [CPU] to service a request
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/21—Indexing scheme relating to G06F21/00 and subgroups addressing additional information or applications relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/2149—Restricted operating environment
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/44—Arrangements for executing specific programs
    • G06F9/445—Program loading or initiating
    • G06F9/44521—Dynamic linking or loading; Link editing at or after load time, e.g. Java class loading

Definitions

  • This application relates to the field of communication technology, and in particular to a method for running a trusted application program, an information processing method, a memory allocation method and a device.
  • terminal devices are built in rich execution environments (REE) and trusted execution environments that provide an open operating environment. , TEE) above.
  • REE is also called a general operating environment, and it mainly includes a rich operating system (Rich Operating System, Rich OS) running on a general-purpose processor and a client application (Client Application, CA) running on the Rich OS.
  • TEE is an independent operating environment that runs outside of REE. It mainly includes trusted operating system (Trusted OS) and trusted application (TA) running on Trusted OS.
  • TEE is isolated from REE. . REE cannot directly access the hardware and software resources of the TEE, such as TEE memory, and the two can only interact through an authorized application programming interface (API). Therefore, TEE can resist software attacks that occur on the REE side.
  • API application programming interface
  • the program segment (including code and data) corresponding to the function can be called logically Make the program module corresponding to this function.
  • the TEE operating system loads the program modules corresponding to each function of the TA into the memory space of the TA during the process of starting the TA.
  • the TA receives the operation request of a certain service, it can use the software that supports the service. Each program module runs the service.
  • the memory space allocated by the TEE operating system for the TA is getting larger and larger.
  • the secure memory of the TEE is facing increasingly severe challenges.
  • the TA may not receive a service request, and the various program modules that support the service have been loaded into the TA’s memory space, which causes a waste of TA’s memory space and further increases The pressure of TEE’s safe memory.
  • the embodiments of the present application provide an operating method, an information processing method, a memory allocation method, and a device for a trusted application program, which are used to save the memory space of the TA.
  • Rich operating system Rich OS
  • REE Rich operating system
  • TEE trusted execution environment
  • CAs CAs
  • TEE trusted Operating System
  • TAs are generally deployed on the TEE operating system, and the TAs can generally provide one or more services.
  • a certain TA referred to as a target TA
  • a certain service referred to as a target service
  • the following describes the operation method of the TA provided in the first aspect of the embodiments of the present application. It should be noted that this application does not limit all TAs deployed in the TEE operating system to run according to the method provided in this application.
  • the premise of the target TA running the target service is that the TEE operating system starts the target TA. More specifically, the TEE operating system starts the main process of the target TA and is used to support the program modules of the target service (or the target TA running target The program modules used in the service are loaded into the memory space of the target TA.
  • the TEE operating system may load the target file of the target TA into the memory space of the target TA, and create a process of the target TA to execute the target file.
  • the type of the target file may be a shared target file (such as a .so file) or an executable file (such as a .os file) or other types of files.
  • the specific type of the target file is not limited.
  • the target file is an executable file as an example, and the target file saves binary code that can be directly loaded into the memory for execution.
  • Dynamic libraries usually .so files
  • executable files usually .os files
  • ELF executable and linkable format
  • the target dynamic library includes the code of the function, or the definition of symbols (such as variables or function calls, etc.).
  • the reference of the symbol (such as the identifier of the referenced object) and other registration information (such as the symbol table and relocation information, etc.) are added to the target file.
  • the TEE operating system can start the target TA in response to the creation request of the target TA; after the target TA is started, it can receive the running request of the target service sent by the CA or other TAs, or spontaneously start (or generate) the running request of the target service, and then, In response to the running request, the target TA may send a loading request to the TEE operating system, where the loading request is used to instruct the TEE operating system to load the target dynamic library.
  • the TEE operating system can receive the load request sent by the target TA.
  • the TEE operating system can load the target dynamic library into the memory space of the target TA. After that, the target TA can use the target dynamics in its own memory space.
  • the library runs the target service.
  • the TEE operating system can load the target dynamic library for supporting the target service into the memory space of the target TA after the target TA receives the target service running request , Make the target TA use the target dynamic library to run the target service, so that when the TEE operating system starts the target TA, or before the target TA receives the operation request of the target service, there is no need to load the program module used to support the target service In the memory space of the TA, there is a waste of reducing the memory space of the TA.
  • the target dynamic library is loaded into the target TA by the TEE operating system, and there is no need to configure the permission to load the target dynamic library for the target TA. For example, there is no need to configure the target TA to access the target storage area and configure the attributes of the target TA. Conducive to improving the safety of TEE.
  • the target storage area stores the target dynamic library, which is a storage space other than the memory space of the target TA in the storage area of the TEE.
  • the target TA uses the target dynamic library to run the target service, not restricting the target TA to only use the target dynamic library to run the target service, but restricting the target TA to run the target service at least using the target dynamic library.
  • the aforementioned "the premise of the target TA running the target service is that the TEE operating system starts the target TA" does not limit the target TA to run the target service.
  • the TEE operating system needs to start the target TA, but restricts the target TA to run Before the target service, the TEE operating system executes the steps of starting the target TA at least once, so that the target TA enters the running state, and can receive or spontaneously generate the running request of the target service.
  • the process of loading the target dynamic library into the memory space of the target TA by the TEE operating system may specifically include the TEE operating system mapping or loading the target dynamic library into the memory space of the target TA, and then performing symbol analysis and relocation to make The target dynamic library is linked to the target file.
  • symbol analysis can be understood as associating the definition of symbols in the target dynamic library with the references of symbols in the target file; relocation can be understood as pointing the symbols in the target file to the corresponding in the memory according to the memory location of the target dynamic library position.
  • the TEE operating system can also configure corresponding attributes for the memory corresponding to the target dynamic library. For example, configure the memory corresponding to the code segment in the target dynamic library as an executable attribute, and set the memory corresponding to the data segment in the target dynamic library. Configured as a read-only attribute.
  • the memory of the TEE includes the memory mapped to the TA. In the embodiment of this application, it can be called the memory space of the TA or the memory of the TA; the memory of the TEE also includes the memory mapped to the TEE operating system, which is implemented in this application In the example, it can be referred to as the memory space of the TEE operating system, or as the memory of the TEE operating system; similarly, the memory of the REE can be considered as including the memory mapped to the CA, which can be referred to as the memory space of the CA in the embodiment of this application, or It is called the memory of CA; the memory of REE also includes the memory mapped to the REE operating system, which may be referred to as the memory space of the REE operating system or the memory of the REE operating system in the embodiment of the present application.
  • the TA operation service may be expressed as a TA execution service. In the embodiments of this application, it can be considered that the operation service and the execution service have the same meaning.
  • the target dynamic library has been stored in the TEE operating system
  • the TEE operating system loads the target dynamic library into the memory space of the target TA in response to the load request, which may include: in response to the load request, the TEE operating system can load the target dynamic library from the memory space of the TEE operating system to the target TA
  • the efficiency of loading the target dynamic library into the memory space of the target TA is high, which is conducive to improving the completion efficiency of the target service.
  • the target dynamic library can be stored in a REE storage device (such as a ROM), and the TEE operating system responds
  • the load request to load the target dynamic library into the memory space of the target TA may include: in response to the load request, the TEE operating system can obtain the target dynamic library from the REE operating system, and after obtaining the target dynamic library, the TEE operating system can transfer the target The dynamic library is loaded into the memory space of the target TA.
  • the TEE operating system can obtain the target dynamic library from the REE operating system after receiving the load request. Therefore, if the target TA does not receive it For the operation request of the target service, the TEE operating system does not need to obtain the target dynamic library from the storage device of the REE to the storage device of the TEE, which is beneficial to further save the storage resources of the TEE.
  • the target dynamic library can be stored in a REE storage device.
  • the TEE operating system in response to the loading request, obtains the target dynamic library from the REE operating system, which may include: in response to the loading request, the TEE operating system may send the REE operating system to the REE operating system. After sending the transfer request of the target dynamic library, the TEE operating system can receive the target dynamic library sent by the REE operating system.
  • This implementation does not limit the specific content and content form of the transfer request sent by the TEE operating system, as long as the REE operating system can send the target dynamic library to the TEE operating system in response to the transfer request.
  • the transfer request may include the target The identification of the dynamic library, the REE operating system can find the target dynamic library from the storage device of the REE according to the identification of the target dynamic library.
  • the TEE operating system can obtain the target dynamic library from the REE operating system
  • the target dynamic library that can be directly loaded into the memory space of the target TA is obtained from the REE operating system.
  • the TEE operating system can process the information obtained from the REE operating system to obtain the target dynamic library.
  • the target dynamic library can be encrypted to obtain an encrypted file, and then the encrypted file is stored in the storage device of the REE.
  • the TEE operating system in response to the load request, obtains the target from the REE operating system
  • the dynamic library may include: in response to the loading request sent by the target TA, the TEE operating system may obtain the encrypted file from the REE operating system, and then decrypt the encrypted file to obtain the target dynamic library.
  • the TEE operating system receives the target dynamic library sent by the REE operating system, which may include : The TEE operating system receives the encrypted file delivered by the REE operating system, and then the TEE operating system decrypts the encrypted file to obtain the target dynamic library.
  • the information obtained by decrypting the encrypted file is not limited to only the target dynamic library. Therefore, the file after decrypting the encrypted file can be called a decrypted file.
  • the decrypted file includes at least the target dynamic library.
  • the decrypted file may also include other information.
  • the decrypted file may also include instructions for indicating whether a TA has a calling target.
  • the permission information of the dynamic library is referred to as target permission information for short.
  • the target dynamic library can also be signed, and the signature is used to verify the authenticity of the information.
  • the library is encrypted and signed. For example, it can be specifically:
  • the TEE operating system can obtain the encrypted information and standard signature corresponding to the target dynamic library from the REE operating system, and first verify whether the signature of the encrypted information is consistent with the standard signature. If it is inconsistent, the target dynamic library is determined to be insecure and the target dynamic library fails to be obtained. If they are consistent, the encrypted information is decrypted to obtain the target dynamic library.
  • the TEE operating system can obtain the encrypted information corresponding to the target dynamic library from the REE operating system, and decrypt the encrypted information to obtain the target dynamic library and the standard signature.
  • the TEE operating system can verify whether the signature of the target dynamic library is consistent with the standard signature. The target dynamic library is not safe, and it is determined that the target dynamic library has failed to be obtained. If they are consistent, it is determined that the target dynamic library is successfully obtained.
  • the target dynamic library can also be stored in the storage device of the REE; the main difference lies in the second possible implementation manner of the first aspect of the foregoing embodiments of the application.
  • the target dynamic is obtained from the REE operating system by the TEE operating system in response to the load request sent by the target TA.
  • the target dynamic library is obtained from the REE side It is sent to the TEE operating system in response to the first delivery request sent by the target TA.
  • the sixth possible implementation manner of the first aspect of the embodiments of the present application will be specifically introduced below.
  • the REE side includes the REE operating system and the CA that sends the target service operation request to the target TA (referred to as the target CA in the embodiment of the present application), and the REE operation
  • the target CA deployed on the system has the authority to call the target TA to run the target service.
  • the target TA After the target TA receives the request to run the target service sent by the target CA, it can send a first delivery request to the target CA; in response to the first delivery request, the target The CA may send a second transfer request to the REE operating system; in response to the second transfer request, the REE operating system may send the target dynamic library to the TEE operating system.
  • Two specific implementation methods are described below:
  • the target CA is configured with the permission to access the target storage area of the REE, and the target dynamic library is stored in the target storage area.
  • the target CA can read the target dynamic library in the target storage area, and then send it to the REE
  • the operating system sends a second transfer request, and in response to the second transfer request, the REE operating system sends the target dynamic library read by the target CA to the TEE operating system;
  • the target dynamic library is stored in the target storage area.
  • the target CA can send a second transfer request to the REE operating system, and in response to the second transfer request, the REE operating system can read from the target storage area The target dynamic library, after which, the target dynamic library is sent to the TEE operating system.
  • This implementation does not limit the specific content and content form of the first transfer request and the second transfer request, as long as the target CA can send the second transfer request to the REE operating system in response to the first transfer request, and the REE operating system can respond to The second transfer request simply sends the target dynamic library to the TEE operating system.
  • both the first transfer request and the second transfer request may include the identification of the target dynamic library, and the REE operating system may search for the target dynamic library from the storage device of the REE according to the identification of the target dynamic library.
  • the target file of the target TA can be loaded into the memory space of the target TA, and the target file records what the target TA needs in the process of running the service.
  • Each dynamic library used for example, records the identifier representing each dynamic library, and each dynamic library recorded in the target file can be stored in the REE to save TEE storage resources.
  • the TEE operating system When the TEE operating system starts the target TA, the TEE operating system The identification of one or more dynamic libraries can be read from the target file, and then the corresponding one or more dynamic libraries are obtained from the REE operating system, and the obtained dynamic libraries are stored in the memory space of the TEE operating system.
  • the dynamic library acquired by the TEE operating system in the process of starting the target TA may be all the dynamic libraries recorded in the target file, or, in order to save storage resources of the TEE, it may also be part of the dynamic libraries recorded in the target file.
  • the TEE operating system receives the loading request of the target dynamic library, if the target dynamic library has been stored in the TEE operating system in advance, the efficiency of loading the target dynamic library into the memory space of the target TA will be improved by the TEE operating system.
  • the TEE operating system can obtain each dynamic library recorded in the target file One or more dynamic libraries with a higher probability of being called in the medium prediction, obtain the corresponding dynamic library predicted in the process of starting the target TA.
  • the TEE operating system can set target authority information for the target dynamic library.
  • the target authority information is used to indicate which TAs have the authority to call the target dynamic library, or which TAs do not have the authority to call the target dynamic library.
  • the target authority information may include the identification of the TA that has the authority to call the target dynamic library.
  • the TEE operating system loads the target dynamic library into the memory space of the target TA, which may include:
  • the TEE operating system determines whether the target TA has the call according to the target authority information
  • the authority of the target dynamic library based on that the target TA has the authority to call the target dynamic library, the TEE operating system can load the target dynamic library into the memory space of the target TA.
  • the ninth possible implementation manner of the first aspect of the embodiments of the present application in order to prevent the target authority information from being tampered with, and to facilitate the TEE operating system to find the target
  • the dynamic library corresponds to the target authority information.
  • the target authority information and the target dynamic library can be jointly encrypted into the same encrypted file.
  • the encrypted file can be decrypted.
  • the decrypted file obtained includes the target authority information and
  • the target dynamic library later, optionally, the TEE operating system can store the target permission information and the target dynamic library in the memory space of the TEE operating system in association with each other.
  • target TA a certain TA deployed in the TEE operating system
  • target service a certain service provided by the target TA
  • the premise of the target TA running the target service is that the TEE operating system starts the target TA. More specifically, the TEE operating system starts the main process of the target TA and is used to support the program modules of the target service (or the target TA running target). The program modules used in the service are loaded into the memory space of the target TA. In the embodiments of the present application, part or all of the program modules supporting the target service are encapsulated as a shared target file, or specifically referred to as a target dynamic library.
  • the target TA after the TEE operating system starts the target TA, in response to the operation request of the target service, the target TA sends a loading request of the target dynamic library to the TEE operating system In response to the load request, the TEE operating system loads the target dynamic library into the memory space of the target TA; and in the TA running method provided in the second aspect of the embodiment of the present application, the target TA can be configured with the right to load the dynamic library , The TEE operating system can start the target TA. After that, the TEE operating system can provide the target dynamic library for the target TA.
  • the target TA can load the target dynamic library into the memory space of the target TA and utilize the target dynamic The library runs the target service.
  • the TEE operating system loads the program segments required to start the TA and the program modules corresponding to each function that the TA can implement into the memory space of the TA during the process of starting the TA, and the existing The technical difference is that in the TA operation method provided in the second aspect of the embodiments of the present application, the TEE operating system can provide the target TA with the target dynamic library that needs to be loaded to run the target service after starting the target TA, which is beneficial to implementation Before the target TA receives the running request of the target service, the target dynamic library is not loaded into the memory space of the target TA. After the target TA receives the running request of the target service, the target TA loads the target dynamic library provided by the TEE operating system To the memory space of the target TA, it is beneficial to reduce the waste of the memory space of the TA.
  • the target dynamic library is loaded by the target TA, which facilitates the decoupling of the TA and the TEE operating system in the TEE, facilitates the upgrade of the TA and TEE operating systems, and helps reduce the operation of the TEE operating system.
  • the target TA uses the target dynamic library to run the target service, not restricting the target TA to only use the target dynamic library to run the target service, but restricting the target TA to run the target service at least using the target dynamic library.
  • the process of loading the target dynamic library by the target TA can refer to the description of the process of loading the target dynamic library by the TEE operating system in the first aspect described above, which will not be repeated here.
  • configuring the permission to load the dynamic library for the target TA can be specifically understood as configuring the permission for the target TA to access the target storage area of the TEE and configure attributes (executable or readable, etc.), and the target storage area is the save target The storage area of the dynamic library.
  • the TEE operating system provides the target dynamic library for the target TA.
  • the target dynamic library library that the target TA needs to be loaded needs to be obtained by the TEE operating system.
  • the target TA obtains the target dynamic library from the TEE operating system.
  • the target TA needs to access the memory space of the TEE operating system to load the target dynamic library into the memory space of the target TA; it can also be understood as a combination of the first two implementation methods, for example,
  • the target dynamic library to be loaded by the target TA is obtained by the TEE operating system, and the obtained target dynamic library is stored in the memory space of the TEE operating system by the TEE operating system.
  • the target TA may send an acquisition request to the TEE operating system in response to the operation request of the target service.
  • the request is used to instruct the TEE operating system to obtain the target dynamic library;
  • the TEE operating system provides the target dynamic library for the target TA, which may include: the TEE operating system can receive the acquisition request sent by the target TA, and after receiving the acquisition request, the TEE operating system
  • the target dynamic library can be obtained.
  • the TEE operating system obtains the target dynamic library, it can store the target dynamic library in the memory of the TEE, for example, in the cache of the TEE.
  • the TEE operating system can obtain the target dynamic library after the target TA receives the running request of the target service, which is beneficial to saving the memory of the TEE.
  • the target dynamic library can be stored in a REE storage device to save TEE storage Resources.
  • the TEE operating system obtains the target dynamic library, which may include: the TEE operating system obtains the target dynamic library from the REE operating system.
  • the TEE operating system can obtain the target dynamic library from the REE operating system
  • the TEE operating system can process the information obtained from the REE operating system to obtain the target dynamic library. For example, due to the poor security of the REE, in order to improve the storage in the REE The security of the target dynamic library can be encrypted to the target dynamic library to obtain the encrypted file, and then save the encrypted file in the storage device of the REE.
  • the TEE operating system obtains the target dynamic library from the REE operating system, which may include: The TEE operating system obtains the encrypted file from the REE operating system; the TEE operating system decrypts the encrypted file to obtain the decrypted file, and the decrypted file includes the target dynamic library.
  • the target dynamic library can also be signed, and the signature is used to verify the authenticity of the information.
  • the library is encrypted and signed. For example, it can be specifically:
  • the TEE operating system can obtain the encrypted information and standard signature corresponding to the target dynamic library from the REE operating system, and first verify whether the signature of the encrypted information is consistent with the standard signature. If it is inconsistent, the target dynamic library is determined to be insecure and the target dynamic library fails to be obtained. If they are consistent, the encrypted information is decrypted to obtain the target dynamic library.
  • the TEE operating system can obtain the encrypted information corresponding to the target dynamic library from the REE operating system, and decrypt the encrypted information to obtain the target dynamic library and the standard signature.
  • the TEE operating system can verify whether the signature of the target dynamic library is consistent with the standard signature. The target dynamic library is not safe, and it is determined that the target dynamic library has failed to be obtained. If they are consistent, it is determined that the target dynamic library is successfully obtained.
  • a method for the TEE operating system to obtain the target dynamic library from the REE operating system is provided.
  • a specific method may specifically include: the TEE operating system sends a transfer request of the target dynamic library to the REE operating system, the transfer request includes the identification of the target dynamic library, and the transfer request is used to instruct the REE operating system to send the target dynamic library to the TEE operation After that, the TEE operating system can receive the target dynamic library sent by the REE operating system.
  • the target dynamic library can be stored in a REE storage device to save TEE storage Resources, and the target service request is sent by the target client application CA deployed in the REE operating system.
  • the target CA has the authority to call the target service.
  • the target TA can send the first request to the target CA.
  • the target CA can send a second transfer request to the TEE operating system in response to the first transfer request, and in response to the second transfer request, the REE operating system can send the target dynamic library to the TEE operating system, the first type of the second aspect
  • the "TEE operating system provides the target dynamic library for the target TA" in the possible implementation manner may include: the TEE operating system receives the target dynamic library sent by the REE operating system in response to the second transfer request.
  • the target file of TA is loaded into the memory space of the target TA.
  • the target file records the various dynamic libraries that the target TA needs to use in the process of running the service. For example, it records the identification of each dynamic library and each record in the target file.
  • the dynamic library can be stored in the REE to save TEE storage resources.
  • the TEE operating system can read one or more dynamic library identifiers from the target file, and then from the REE operating system Obtain the corresponding one or more dynamic libraries, and store the acquired dynamic libraries in the memory space of the TEE operating system.
  • the dynamic library acquired by the TEE operating system in the process of starting the target TA may be all the dynamic libraries recorded in the target file, or, in order to save storage resources of the TEE, it may also be part of the dynamic libraries recorded in the target file.
  • the TEE operating system receives the loading request of the target dynamic library, if the target dynamic library has been stored in the TEE operating system in advance, the efficiency of loading the target dynamic library into the memory space of the target TA will be improved by the TEE operating system.
  • the TEE operating system can obtain each dynamic library recorded in the target file One or more dynamic libraries with a higher probability of being called in the medium prediction, obtain the corresponding dynamic library predicted in the process of starting the target TA.
  • the TEE operating system can store the target dynamic library in the TEE The memory space of the operating system, the target TA can load the target dynamic library by accessing the memory space of the TEE operating system.
  • the TEE operating system can set access permissions for the memory space of the TEE operating system.
  • the TEE operating system provides target dynamic libraries for the target TA, which can include: TEE operating system receives the target The access request sent by the TA is used to request access to the memory space of the TEE operating system; in response to the access request of the target TA, the TEE operating system can determine whether the target TA has the right to access the memory space of the TEE operating system, if the target TA is determined Having the authority to access the memory space of the TEE operating system, the TEE operating system can send access permission information to the target TA, and the access permission information is used to notify the target TA to access the memory space of the TEE operating system. After the target TA receives the access permission information, it can access the memory space of the TEE operating system, and load the target dynamic library therein into its own memory space.
  • the TEE operating system can call the target dynamic library, so the access request sent by the target TA needs to indicate the specific file that the target TA accesses in the TEE operating system.
  • the TEE operating system sending the permission access information to the target TA may specifically include: based on the target TA having the permission to access the memory space of the TEE operating system, the TEE operating system determines whether the target TA has the permission to call the target dynamic library, based on the target TA has the authority to call the target dynamic library, and the TEE operating system sends permission to access information to the target TA.
  • target TA a certain TA deployed in the TEE operating system
  • target service a certain service provided by the target TA
  • the premise of the target TA running the target service is that the TEE operating system starts the target TA. More specifically, the TEE operating system starts the main process of the target TA and is used to support the program modules of the target service (or the target TA running target). The program modules used in the service are loaded into the memory space of the target TA. In the embodiments of the present application, part or all of the program modules supporting the target service are encapsulated as a shared target file, or specifically referred to as a target dynamic library.
  • the permission to load the dynamic library can be configured for the target TA, and in response to the operation request of the target service, the target The TA can load the target dynamic library into the memory space of the target TA, and then can use the target dynamic library to run the target service.
  • the TEE operating system loads the program segments required to start the TA and the program modules corresponding to each function that the TA can implement into the memory space of the TA during the process of starting the TA, and the existing The technical difference is that in the TA running method provided in the second aspect of the embodiments of the present application, the target TA can load the target dynamic library into the memory space of the target TA after receiving the running request of the target service, then, Before receiving the running request of the target service, the target TA may not need to load the target dynamic library into the memory space of the target TA, thereby helping to reduce the waste of the memory space of the target TA.
  • the target dynamic library is loaded by the target TA, which facilitates the decoupling of the TA and the TEE operating system in the TEE, facilitates the upgrade of the TA and TEE operating systems, and helps reduce the operation of the TEE operating system.
  • the target TA uses the target dynamic library to run the target service, not restricting the target TA to only use the target dynamic library to run the target service, but restricting the target TA to run the target service at least using the target dynamic library.
  • configuring the permission to load the dynamic library for the target TA can be specifically understood as configuring the permission for the target TA to access the target storage area of the TEE and configure attributes (executable or readable, etc.), and the target storage area is the save target The storage area of the dynamic library.
  • the target dynamic library loaded by the target TA is provided by the TEE operating system
  • the target TA dynamically Loading the library into the memory space of the target TA may specifically refer to that the target TA loads the target dynamic library provided by the TEE operating system into the memory space of the target TA.
  • the target dynamic library that the target TA needs to load is provided by the TEE operating system. It is exemplary, and it can be understood that the target dynamic library that the target TA needs to load needs to be obtained by the TEE operating system. After that, the target TA will use the TEE operating system. The obtained target dynamic library is loaded into the memory space of the target TA; it can also be understood that the target dynamic library to be loaded by the target TA is stored in the memory space of the TEE operating system by the TEE operating system, and the target TA needs to access the memory of the TEE operating system Space to load the target dynamic library into the memory space of the target TA; it can also be understood as a combination of the first two implementations.
  • the target dynamic library that the target TA needs to load is obtained by the TEE operating system, and the TEE operating system will The obtained target dynamic library is stored in the memory space of the TEE operating system.
  • the TEE operating system providing the target dynamic library for the target TA it can be understood with reference to the corresponding implementation manner of the second aspect of the present application, which will not be repeated here.
  • the process of the target TA loading the target dynamic library into the memory space of the target TA may specifically include the target TA mapping or loading the target dynamic library into the memory space of the target TA, and analyzing and reproducing the symbols in the target dynamic library. Locate, configure corresponding attributes for the memory corresponding to the target dynamic library, for example, configure the memory corresponding to the code segment in the target dynamic library as an executable attribute, and configure the memory corresponding to the data segment in the target dynamic library as read-only.
  • the target TA loads the target dynamic library into the memory space of the target TA , May include: the target TA may send an acquisition request to the TEE operating system, the acquisition request is used to request the TEE operating system to acquire the target dynamic library; after the TEE operating system acquires the target dynamic library, the target TA may obtain the target obtained by the TEE operating system The dynamic library is loaded into the memory space of the target TA.
  • the target TA can request the TEE operating system to obtain the target dynamic library after receiving the operation request of the target service
  • the TEE operating system can obtain the target dynamic library after the target TA receives the operation request of the target service, which is conducive to saving TEE RAM.
  • the target dynamic library can be stored in a REE storage device to save TEE
  • the storage resources of the target TA and the target dynamic library to be loaded by the target TA may be obtained by the TEE operating system from the REE operating system.
  • the target dynamic library can be stored in a REE storage device to save TEE
  • the target service’s running request is sent by the target client application CA deployed in the REE operating system.
  • the target CA has the right to call the target service.
  • the target TA loads the target dynamic library into the target TA’s memory space.
  • the target TA may send a first transfer request to the target CA, the target CA may send a second transfer request to the TEE operating system in response to the first transfer request, and in response to the second transfer request, the REE operation
  • the system can send the target dynamic library to the TEE operating system; after that, the target TA can load the target dynamic library received by the TEE operating system into the memory space of the target TA.
  • the TEE operating system Providing the target dynamic library for the target TA can be understood as the TEE operating system stores the target dynamic library in the memory space of the TEE operating system, and the target TA loads the target dynamic library provided by the TEE operating system into the memory space of the target TA, which can include: target TA loads the target dynamic library from the memory space of the TEE operating system to the memory space of the target TA.
  • the TEE operating system can store the target dynamic library in the memory of the TEE operating system Space, the target TA can load the target dynamic library by accessing the memory space of the TEE operating system.
  • the TEE operating system can set access permissions for the memory space of the TEE operating system.
  • the target TA loads the target dynamic library from the memory space of the TEE operating system to the memory space of the target TA. It may include: the target TA sends an access request to the TEE operating system. The access request is used to request access to the memory space of the TEE operating system.
  • the TEE operating system can determine whether the target TA has the right to access the memory space of the TEE operating system according to the access request. TA has the permission to access the memory space of the TEE operating system, the TEE operating system can send permission access information to the target TA; based on the target TA receiving the permission access information sent by the TEE operating system, the target TA can access the memory space of the TEE operating system, and The target dynamic library is loaded into the memory space of the target TA.
  • the CA can obtain the files required by the TEE, and then send the obtained files to the TEE operating system.
  • the fourth aspect of the embodiments of the present application provides an information processing method in the aforementioned computer system, which adds a function of obtaining required files to the TEE operating system for the TEE operating system, which helps reduce the difficulty of CA development.
  • the REE operating system may obtain the target file, and then send the obtained target file to the TEE operating system, where the transfer request is used to instruct the REE operating system to send the target file to the TEE operating system.
  • the target file indicated in the transfer request may be a target dynamic library
  • the target dynamic library is the target TA running the target service.
  • the dynamic library to be called is stored in the storage device of the REE
  • the target TA is a TA deployed in the TEE operating system
  • the target service is a service provided by the target TA.
  • the REE operating system can provide the TEE operating system with a dynamic library that needs to be called when the TA is running services, which is conducive to dynamically loading the program segments required by the TA into the memory space of the TA, thereby helping to save the memory space of the TA.
  • the transfer request received by the REE operating system may be sent by the TEE operating system.
  • the delivery request received by the REE operating system can be sent by the target client application CA, and the target CA has The permission to call the target service.
  • TEE and REE shared memory devices In computer systems deployed with rich execution environment REE and trusted execution environment TEE, TEE and REE shared memory devices generally allocate part of the memory to the TEE according to a certain ratio, and the TEE configures the attributes of this part of memory as secure memory. For use by processes in TEE; other memory attributes are unsafe memory for use by processes in REE. Processes in REE (such as REE operating system or CA) can only access non-secure memory, and processes in TEE (such as TEE operating system or TA) can only access secure memory.
  • the prior art adopts the business logic coordination between CA and TA. When TA needs large memory, CA applies for memory from the REE operating system, and sends the information of the requested memory (such as the address of the memory) to TA.
  • the TEE operating system allocates the memory to the TA. If there is an abnormal situation, such as the CA is killed abnormally, the REE operating system will reclaim the memory allocated to the CA. Because the memory is occupied by the TA, if the REE operating system uses the memory The use of other processes allocated to the REE operating system will cause abnormal memory access and reduce the stability of the computer system.
  • the fifth aspect of the embodiments of the present application provides a memory processing method in a computer system.
  • the REE operating system is deployed in the REE on the computer system, and the TEE is deployed in the TEE operating system.
  • One or more TAs are deployed on the TEE operating system.
  • the memory allocation method provided by the fifth aspect of the present application may include: the TEE operating system may send a first memory request to the REE operating system, and the first memory request is used To apply for memory from the TEE operating system; in response to the first memory request, the REE operating system can allocate memory (referred to as target memory) for the TEE operating system, and send the memory allocation information to the TEE operating system.
  • the memory allocation information is used for It is indicated that the memory allocated for the TEE operating system is the target memory.
  • the memory allocation information may include the address of the target memory; the TEE operating system may configure the target memory as a secure memory. Since the target memory is allocated by the REE operating system for the TEE operating system, the probability of abnormalities in the TEE operating system is low, so it is not easy to cause memory access abnormalities, which is beneficial to improve the stability of the computer system.
  • the TEE operating system can apply to the REE operating system for memory for the TA, and the TEE operating system applies to the REE operating system Before sending the first memory request, the memory allocation method further includes: the TEE operating system obtains the second memory request sent by the target TA, the target TA is any one of the one or more TAs deployed on the TEE operating system, and the second memory request Used to apply for memory from the TEE operating system.
  • this implementation does not limit the TEE operating system to send the first memory request to the REE operating system when it obtains the second memory request sent by the target TA.
  • the TEE operating system can determine the TEE after receiving the second memory request If the safe memory of TEE is sufficient, you can allocate the safe memory of TEE to the target TA, if not, you can apply for memory from the REE operating system.
  • the memory allocation method may also include: the TEE operating system allocates the target memory to the target TA.
  • the allocation of target memory to the target TA by the TEE operating system can also be understood as that the TEE operating system maps the target memory to the target TA.
  • the target service is the service provided by the target TA, and the target TA can receive the operation of the target service After the request, if the memory space of the target TA is insufficient to run the target service, the target TA may send a second memory request to the TEE operating system, and the second memory request is used to apply to the TEE operating system for the memory required by the target TA to run the target service.
  • the memory requested by the TEE operating system from the REE operating system can be It is larger than the memory requested by the target TA from the TEE operating system, that is, the memory requested by the first memory request is greater than the memory requested by the second memory, which helps reduce the number of times the target TA requests memory from the TEE operating system and reduces the target TA and TEE operations The operation of the system saves the computing resources of the computer system.
  • the memory allocation method may further include: TEE operation
  • the system can receive the memory release request sent by the target TA (for easy distinction, the memory release request sent by the target TA here is called the TA memory release request), and the TA memory release request is used to request the TEE operating system to release the target memory; TA memory release request, TEE operating system can release target memory.
  • the release of the target memory by the TEE operating system can be understood as the TEE operating system cancels the mapping between the target memory and the target TA.
  • the memory allocation method may further include: the TEE operating system configures the target memory It is non-secure memory. Later, the TEE operating system can send a TEE memory release request to the REE operating system. The TEE memory release request is used to request the REE operating system to release the target memory. After the REE operating system receives the TEE memory release request, it can release the target memory. The release of the target memory by the REE operating system can be understood as the REE operating system cancels the mapping between the target memory and the TEE operating system.
  • the TEE operating system releases the target memory, the target memory is in an idle state, and the TEE operating system does not need to allocate the target memory to the process in the TEE again. It immediately configures the target memory as non-secure memory and returns it to the REE operating system. ; Or, after the TEE operating system releases the target memory, the TEE operating system can allocate the target memory to the process in the TEE again, and return it to the REE operating system with a delay.
  • any one of the first to sixth possible implementations of the fifth aspect of the embodiments of the present application may be applied to the TA operation method of the first aspect of the foregoing embodiments of the present application or the first aspect.
  • any possible implementation manner, or applied to the TA operation method of the second aspect of the foregoing embodiments of the present application or any one of the possible implementation manners of the second aspect, or applied to the foregoing third embodiment of the present application In the operating method of the TA of the aspect or any one of the possible implementation manners of the third aspect.
  • each functional module can be divided corresponding to each function, or Integrate two or more functions into one function module.
  • the above-mentioned integrated functional modules can be implemented in the form of hardware or software functional units.
  • the sixth aspect of the embodiments of the present application provides a TEE operating system
  • the TEE operating system may include: a startup module for Start the target TA, where the target TA is any one of the one or more TAs; the receiving module is configured to receive a loading request sent by the target TA in response to a request to run the target service, and the loading request is used for Instructs to load the target dynamic library, where the target service is a service provided by the target TA; a loading module is used to load the target dynamic library into the memory space of the target TA in response to the load request, so The target dynamic library is used to support the operation of the target service.
  • the loading module is configured to load the target dynamic library from the memory space of the TEE operating system into the memory space of the target TA.
  • the loading module includes: a TEE communication unit, which is used to obtain the target dynamic library from the REE operating system; and a dynamic library loading unit, which is used to load the target dynamic library into the In the memory space of the target TA.
  • the TEE communication unit is configured to: send a transfer request of the target dynamic library to the REE operating system, the transfer request includes an identifier of the target dynamic library, and the transfer request It is used to instruct the REE operating system to send the target dynamic library to the TEE operating system; to receive the target dynamic library sent by the REE operating system.
  • the TEE communication unit is configured to: obtain an encrypted file from the REE operating system; decrypt the encrypted file to obtain a decrypted file, and the decrypted file includes the target dynamic library.
  • the startup module is used to: obtain one or more dynamic libraries from the REE operating system, and store the one or more dynamic libraries in the memory space of the TEE operating system
  • the one or more dynamic libraries are recorded in a target file of the target TA, and optionally, the target file is an executable file of the target TA.
  • the loading module is used to determine whether the target TA has the permission to call the target dynamic library according to target permission information; based on that the target TA has the permission to call the target dynamic library , Load the target dynamic library into the memory space of the target TA.
  • the TEE operating system further includes a TEE memory module, and the TEE memory module is configured to obtain a memory request sent by the target TA in response to the operation request of the target service, and The memory request is used to apply to the TEE operating system for the memory required to run the target service; in response to the memory request, obtain memory allocation information from the REE operating system, and the memory allocation information is used to indicate the REE
  • the operating system allocates the first memory to the TEE operating system; allocates the first memory to the target TA.
  • the TEE memory module is specifically configured to: configure the first memory as a secure memory; and allocate the first memory configured as a secure memory to the target TA.
  • the TEE memory module is further configured to: after allocating the first memory to the target TA, receive a TA memory release request sent by the target TA, and release the TA memory The request is used to request the TEE operating system to release the first memory; in response to the TA memory release request, the first memory is released.
  • the TEE memory module is specifically configured to: configure the first memory as an unsecured memory; and release the first memory configured as an unsecured memory.
  • the TEE memory module is further configured to: after releasing the first memory, send a TEE memory release request to the REE operating system, and the TEE memory release request is used to request the The REE operating system releases the first memory.
  • the seventh aspect of the present application provides a TEE operating system.
  • the TEE operating system may include: a startup module, When starting a target TA, the target TA is any one of the one or more TAs; a dynamic library providing module is used to provide a target dynamic library for the target TA, and the target dynamic library is defined by the target TA. Loaded into the memory space of the target TA to support the target TA to run a target service, and the target service is a service provided by the target TA.
  • the dynamic library providing module may include: an acquisition request receiving unit configured to receive the acquisition request sent by the target TA in response to the operation request of the target service, the acquisition request being used for Instruct the TEE operating system to obtain the target dynamic library; the dynamic library obtaining unit is configured to obtain the target dynamic library in response to the obtaining request.
  • the dynamic library obtaining unit is configured to obtain the target dynamic library from the REE operating system.
  • the dynamic library acquisition unit is specifically configured to: send a transfer request of the target dynamic library to the REE operating system, the transfer request including an identifier of the target dynamic library, and The transfer request is used to instruct the REE operating system to send the target dynamic library to the TEE operating system; to receive the target dynamic library sent by the REE operating system.
  • the dynamic library acquisition unit is specifically configured to: acquire an encrypted file from the REE operating system; decrypt the encrypted file to obtain a decrypted file, and the decrypted file includes the target dynamic Library.
  • the dynamic library providing module is specifically configured to: receive the target dynamic library sent by the REE operating system in response to the second transfer request, and the running request of the target service is deployed in the Sent by the target client application CA of the REE operating system, the target CA has the authority to call the target service, and the second transfer request is sent by the target CA to the REE operating system in response to the first transfer request , The first delivery request is sent by the target TA to the target CA in response to the operation request of the target service.
  • the startup module includes: obtaining one or more dynamic libraries from the REE operating system, and storing the one or more dynamic libraries in the memory space of the TEE operating system , Wherein the one or more dynamic libraries are recorded in a target file of the target TA, and optionally, the target file is an executable file of the target TA.
  • the dynamic library providing module includes: an access request receiving unit, configured to receive an access request sent by the target TA, and the access request is used to request access to the memory space of the TEE operating system ,
  • the target dynamic library is stored in the memory space of the TEE operating system;
  • the permission information sending unit is configured to send permission to access to the target TA based on the permission of the target TA to access the memory space of the TEE operating system Information, the access permission information is used to notify the target TA to access the memory space of the TEE operating system.
  • the access request is used to request access to the target dynamic library;
  • the permission information sending unit is used to: based on the target TA having the permission to access the memory space of the TEE operating system, And, based on the target TA having the authority to call the target dynamic library, the response information is sent to the target TA.
  • the eighth aspect of this embodiment provides a TA, which corresponds to the target TA in the solution of the third aspect, and the TA It may include: a loading module for loading a target dynamic library into the memory space of the target TA in response to a running request of the target service, the target TA being any one of the one or more TAs, the The target service is a service provided by the target TA; a service running module is used to run the target service using the target dynamic library.
  • the target dynamic library is provided to the target TA by the TEE operating system.
  • the loading module is configured to: send an acquisition request to the TEE operating system, and the acquisition request is used to request the TEE operating system to acquire the target dynamic library; and operate the TEE The target dynamic library obtained by the system is loaded into the memory space of the target TA.
  • the target dynamic library is obtained by the TEE operating system from the REE operating system.
  • the loading module is used to: send a first delivery request to a target client application CA, the target CA is deployed in the REE operating system, and there is a method for invoking the target service Permission, the operation request of the target service is sent by the target CA; the target dynamic library received by the TEE operating system is loaded into the memory space of the target TA, and the target dynamic library is operated by the REE The system sends to the TEE operating system in response to a second transfer request, and the second transfer request is sent to the REE operating system by the target CA in response to the first transfer request.
  • the loading module is configured to load the target dynamic library from the memory space of the TEE operating system into the memory space of the target TA.
  • the loading module is specifically configured to: send an access request to the TEE operating system, the access request is used to request access to the memory space of the TEE operating system, and the target dynamic library stores In the memory space of the TEE operating system; based on receiving the access permission information sent by the TEE operating system, access the target dynamic library in the memory space of the TEE operating system, and set the target dynamic library Loaded into the memory space of the target TA.
  • the ninth aspect of the embodiment of the present application provides a REE operating system
  • the REE operating system may include: a file acquisition module , Used to obtain a target file in response to a transfer request, where the transfer request is used to instruct the REE operating system to transfer the target file to the TEE operating system; the REE communication module is used to send the target file to The TEE operating system.
  • the target file is a target dynamic library
  • the target dynamic library is used to load into the memory space of the target TA to support the target TA to run the target service
  • the target service is the target
  • the target TA is any one of the one or more TAs deployed on the TEE operating system.
  • the transfer request is sent by the TEE operating system, or the transfer request is sent by a target client application CA, and the target CA has the authority to call the target service .
  • the tenth aspect of the embodiment of the present application provides a TEE operating system
  • the TEE operating system may include: a memory application module , Used to send a first memory request to the REE operating system, the first memory request used to request the REE operating system to allocate memory for the TEE operating system; a memory receiving module, used to receive the REE operating system sent
  • the memory allocation information is used to indicate that the memory allocated for the TEE operating system is a target memory;
  • a memory configuration module is used to configure the target memory as a secure memory.
  • the memory request module is also used to:
  • the target TA Before sending the first memory request to the REE operating system, obtain the second memory request sent by the target TA, where the target TA is any one of the one or more TAs deployed on the TEE operating system, and The second memory request is used to apply for memory from the TEE operating system.
  • the memory configuration module is further used for:
  • the target memory is configured as a secure memory
  • the target memory is allocated to the target TA.
  • the second memory request is sent by the target TA in response to a request to run the target service, and the second memory request is used to apply for the target TA to run the target service.
  • the target service is a service provided by the target TA.
  • the memory requested by the first memory request is greater than the memory requested by the second memory.
  • the memory request module is also used to:
  • the memory configuration module After the memory configuration module allocates the first memory to the target TA, it receives a TA memory release request sent by the target TA, where the TA memory release request is used to request the TEE operating system to release the target RAM;
  • the target memory is released.
  • the memory configuration module is further configured to configure the target memory as non-secure memory after the memory configuration module releases the target memory;
  • the memory application module is further configured to send a TEE memory release request to the REE operating system, and the TEE memory release request is used to request the REE operating system to release the target memory.
  • the eleventh aspect of the embodiments of the present application provides a computer device, including a processor and a memory.
  • the processor runs the computer instructions stored in the memory, it executes any one of the first aspect or the first aspect of the embodiments of the present application.
  • Possible implementations, or implement any possible implementation such as the second aspect or the second aspect of the embodiments of the present application, or implement any possible implementation such as the third aspect or the third aspect of the embodiments of the present application
  • execute any possible implementation manner such as the fourth aspect or the fourth aspect of the embodiments of the present application, or execute any possible implementation manner such as the fifth aspect or the fifth aspect of the embodiments of the present application.
  • a twelfth aspect of the embodiments of the present application provides a computer-readable storage medium, including instructions, which when run on a computer, cause the computer to execute any of the first aspect or the first aspect of the embodiments of the present application Possible implementations, or implement any possible implementation such as the second aspect or the second aspect of the embodiments of the present application, or implement any possible implementation such as the third aspect or the third aspect of the embodiments of the present application , Or execute any possible implementation manner such as the fourth aspect or the fourth aspect of the embodiment of the present application, or execute any possible implementation manner such as the fifth aspect or the fifth aspect of the embodiment of the present application.
  • the thirteenth aspect of the embodiments of the present application provides a computer program product (or computer program), including instructions, when the instructions are run on a computer, the computer executes the first aspect or the first aspect of the embodiments of the present application.
  • a computer program product or computer program
  • Any one of the possible implementation manners of, or implement any one of the possible implementation manners such as the second aspect or the second aspect of the embodiments of the present application, or implement any one of the third aspect or the third aspect of the embodiments of the present application.
  • Possible implementation manners, or implement any possible implementation manners such as the fourth aspect or the fourth aspect of the embodiments of the present application, or implement any possible implementation manners such as the fifth aspect or the fifth aspect of the embodiments of the present application .
  • each device provided in the embodiment of the present application can be used to execute the foregoing corresponding embodiment method, the technical effect that can be obtained by each device embodiment of the present application can refer to the foregoing corresponding method embodiment, and will not be repeated here.
  • Figure 1 is a schematic diagram of a structure of a terminal device
  • FIG. 2A is a schematic diagram of the startup process of fingerprint TA in the prior art
  • FIG. 2B is a schematic diagram of a process in which a fingerprint TA performs a fingerprint comparison service in the prior art
  • Figure 2C is a schematic diagram of the memory structure of the TA
  • 3A is a schematic diagram of the memory structure of a fingerprint TA in the prior art
  • 3B is a schematic diagram of the memory structure of the REE storage medium in the prior art
  • 3C is a schematic diagram of fingerprint TA loading dynamic library 1 in an embodiment of the present application.
  • Figure 4 is a schematic diagram of an embodiment of the TA operating method of the present application.
  • Figure 5 is a schematic diagram of another embodiment of the TA operating method of the present application.
  • FIG. 6 is a schematic diagram of an embodiment of a method for transferring a dynamic library from the REE operating system to the TEE operating system according to this application;
  • FIG. 7 is a schematic diagram of another embodiment of the method for transferring the dynamic library from the REE operating system to the TEE operating system according to this application;
  • Fig. 8 is a schematic diagram of an existing memory allocation method
  • FIG. 9 is a schematic diagram of an embodiment of a memory allocation method of the present application.
  • FIG. 10 is a schematic diagram of an embodiment of the TEE operating system of the present application.
  • FIG. 11 is a schematic diagram of another embodiment of the TEE operating system of the present application.
  • FIG. 12 is a schematic diagram of an embodiment of TA of the present application.
  • FIG. 13 is a schematic diagram of an embodiment of the REE operating system of this application.
  • FIG. 14 is a schematic diagram of another embodiment of the TEE operating system of the present application.
  • Fig. 15 is a schematic diagram of an embodiment of the computer equipment of the present application.
  • the embodiments of the present application provide an operating method, an information processing method, a memory allocation method, and a device for a trusted application program.
  • the method in the embodiments of this application can be applied to a computer system.
  • the computer system can be a terminal device.
  • Common terminal devices include, for example, mobile phones, tablet computers, desktop computers, wearable devices (such as smart watches), and smart home devices. (Such as smart speakers or smart TVs), vehicle-mounted smart devices, unmanned driving devices, virtual reality devices, augmented reality devices, mixed reality devices, and artificial intelligence devices.
  • terminal devices are usually built on rich execution environment (REE) that provides an open operating environment.
  • REE is also called a general operating environment, which mainly includes running A rich operating system (Rich OS) on a general-purpose processor, or REE operating system, and a client application (CA) running on the REE operating system.
  • Rich OS A rich operating system
  • CA client application
  • the open environment provides a channel for information leakage and malware propagation, exposing terminal devices to an ever-increasing variety of attacks, leading to increasingly prominent security issues for terminal devices.
  • FIG. 1 is a schematic diagram of the structure of the terminal equipment.
  • the terminal equipment is built on REE and TEE.
  • TEE is an independent operating environment that runs outside of REE and mainly includes trusted operating system (Trusted OS) , Or TEE operating system, and one or more trusted applications (TA) running on the TEE operating system, the TEE is isolated from the REE.
  • the processor can switch between the REE operating system and the TEE operating system by the monitoring system (monitor system).
  • the monitoring system monitoring system
  • Each TA running on the TEE operating system is independent, and the TA cannot access the security resources of another TA without authorization.
  • REE cannot directly access the hardware and software resources of the TEE.
  • the two can only interact through an authorized application programming interface (application programming interface, API).
  • API application programming interface
  • the process in the TEE described in this application (such as the process or the TA process or The interaction between the process of TEE operating system and the process of REE (such as the process of CA or the process of REE operating system) is no longer emphasized that it is realized through API. Therefore, TEE can resist software attacks that occur on the REE side.
  • TEE storage medium part of the storage medium of the terminal device (referred to as TEE storage medium) is configured as a security attribute and can only be accessed by the TEE; other storage medium of the terminal device (referred to as the REE storage medium) can only be accessed by the REE.
  • the TEE storage medium includes the TEE memory, and the TEE memory includes the memory allocated to the TA (TA memory) and the memory of the TEE operating system (TEE operating system memory). It should be noted that TEE storage media and REE storage media may be physically separated or integrated.
  • the CA can access the TA by calling the API area of the TEE to call the TA to perform security services. For example, the CA can request the TA to provide services related to identity verification.
  • the TA as a fingerprint TA, which is used to perform a fingerprint comparison service as an example, the following describes the process of the fingerprint TA performing a fingerprint comparison service.
  • the startup process of the fingerprint TA includes the following steps:
  • the TEE operating system obtains the creation request for the fingerprint TA, and obtains the target file of the fingerprint TA passed by CA2;
  • CA2 can obtain the target file of the fingerprint TA from the ROM of the REE, send the creation request of the fingerprint TA to the TEE operating system, and send it to the TEE operating system.
  • the target file of the fingerprint TA is transferred to the TEE operating system.
  • the TEE operating system stores the target file of the fingerprint TA in the TEE file management subsystem
  • the TEE operating system After the TEE operating system receives the target file of the fingerprint TA delivered by CA2, it can store the target file of the fingerprint TA in the memory of the TEE operating system.
  • the target file of the fingerprint TA can be stored in the TEE file management subsystem.
  • the TEE operating system loads the target file of the fingerprint TA into the memory of the fingerprint TA, and starts the process of the fingerprint TA.
  • the TEE operating system can allocate memory for the fingerprint TA according to the creation request of the fingerprint TA, load the target file of the fingerprint TA into the memory of the fingerprint TA, start the fingerprint TA, and execute the target file using the process of the fingerprint TA.
  • the fingerprint TA can perform the fingerprint matching service.
  • the fingerprint TA performing the fingerprint matching service includes the following steps:
  • the fingerprint TA obtains the operation request of the fingerprint comparison service sent by CA2;
  • CA2 can send a fingerprint comparison service request to the fingerprint TA to request the fingerprint TA to obtain the user's fingerprint, and compare the user's fingerprint with the standard fingerprint.
  • TA's memory generally includes the following multiple segments:
  • Heap The memory segment that is dynamically allocated during the running of the process used to store the TA;
  • Code segment usually used to store executable code in the target file of the TA.
  • the TA target file can generally be considered logically to include the operating program segments used by the target TA to run the service.
  • TA generally needs to use multiple functions to execute a single service.
  • TA realizes a certain function, it needs to run part of the code of the code segment and access part of the data of the data segment.
  • this part of the data and the part of the code It is called the program module corresponding to this function. Since TA usually has multiple functions, it can be considered that the code segment and data segment of the TA include multiple program modules, and each program module corresponds to a function.
  • the code segment and data segment of the fingerprint TA include the program modules corresponding to the three functions required by the fingerprint comparison service as an example.
  • the three program modules are fingerprint module, image processing module, and comparison module.
  • Fingerprint TA The process of using these three program modules to perform the fingerprint comparison service can refer to the following steps 202B to 204B.
  • the fingerprint TA uses the fingerprint module to call the fingerprint identification device to obtain the user's fingerprint
  • the fingerprint TA uses the image processing module to perform image processing on the acquired user fingerprints;
  • the fingerprint TA uses the comparison module to compare the processed user fingerprint with the standard fingerprint to obtain the execution result of the fingerprint comparison service;
  • the execution result of the fingerprint comparison service is used to indicate whether the user's fingerprint is consistent with the standard fingerprint.
  • the fingerprint TA returns the execution result of the fingerprint comparison service to CA2.
  • the CA After the CA obtains the execution result of the fingerprint comparison service, it can realize the identity verification of the current user, and accept or reject the user's request to access the protected content (encrypted document or payment interface, etc.) according to the identity verification result.
  • the corresponding function of the fingerprint module is to drive the fingerprint identification device to detect the user's fingerprint.
  • different fingerprint modules need to be compiled.
  • Different terminal devices of the same model may use different types of fingerprint identification devices produced by different manufacturers, and the mirroring requirements of each terminal device of the same model are the same. Therefore, it is necessary to compile the corresponding fingerprint identification devices for each model of the terminal device of this model.
  • Fingerprint module assuming there are multiple models of fingerprint identification devices, and n represents the number of models, then n fingerprint modules need to be added to the target file of the fingerprint TA, assuming that the n fingerprint modules are fingerprint module 1, fingerprint module 2 ,..., fingerprint module n.
  • FIG. 3A shows the structure of the memory of the fingerprint TA.
  • each fingerprint TA target file adds a fingerprint module corresponding to a model of fingerprint recognition device, assuming there are n models of fingerprint recognition device, then it needs to be compiled
  • the target files of n fingerprint TAs, and the compiled target files of n fingerprint TAs are stored in the REE storage medium.
  • Figure 3B shows the n fingerprint TAs in the REE storage medium (fingerprint TA1, fingerprint TA2, ..., fingerprint Tan) Schematic diagram of the target file.
  • the compiled target files of n fingerprint TAs are stored in the storage device of the REE, for example, they can be stored in the ROM of the REE. Because there are a lot of repeated program content between different fingerprint TAs, such as stack and heap content, and common program modules in code and data segments, such as the image processing module and the comparison module in the embodiment corresponding to FIG. 2B Therefore, a large amount of REE storage resources will be wasted.
  • This application proposes to compile fingerprint module 1 to fingerprint module n into separate dynamic libraries, for example, use the GNU compiler suite (GNU compiler collection, gcc) respectively compile fingerprint module 1 to fingerprint module n into dynamic library 1 to dynamic library n, you can enable the "-fPIC” option when compiling, and use "-share” when linking; change the correlation of each dynamic library Information (such as the identification or symbol of the function in the dynamic library) is embedded in the target file of the fingerprint TA.
  • GNU compiler suite GNU compiler collection, gcc
  • each encrypted file is stored in the storage device of REE.
  • the signature of the information is used to verify the information, encrypt and sign the information.
  • the information may be encrypted first, and then the encrypted information signature is generated, or the information signature is generated first, and then the information and its signature are generated. Encryption.
  • the dynamic library called by TA is encrypted and signed and stored in the storage device of REE as an example.
  • the dynamic library stored in REE may not be imported. Encrypted signature, or only encrypted, but not signed.
  • Figure 3C shows a schematic diagram of the fingerprint TA loading dynamic library 1.
  • Figure 3C is only used to concisely show the process of fingerprint TA loading dynamic library 1.
  • Other parts of REE and TEE omitted in Figure 3C can be understood with reference to Figure 1.
  • the present application is beneficial to reduce repetitive program content and save REE storage resources.
  • REE can transfer the encrypted file of the dynamic library (assuming dynamic library 1) corresponding to the model of the fingerprint identification device used to TEE. After decrypting and verifying it by the TEE operating system, it loads the obtained dynamic library 1 into the fingerprint. In TA’s memory, so that the fingerprint TA performs a fingerprint matching service.
  • the target TA mentioned in the following method embodiments may be, but is not limited to, the above-mentioned fingerprint TA.
  • FIG. 4 is a schematic diagram of an embodiment of the TA operation method provided by this application.
  • an embodiment of the TA operation method of this application may include the following steps:
  • the TEE operating system starts the target TA
  • the TEE operating system can obtain the encrypted file of the target TA delivered by the REE operating system, decrypt and verify the encrypted file of the target TA, and obtain the target file of the target TA.
  • load the target file of the target TA to In the memory allocated by the target TA, the process that created the target TA executes the code segment in the target file.
  • the CA when the CA needs to call the function of the target TA, it can request the TEE operating system to create the target TA through the interface provided by the SDK, and then the CA uses the opensession interface provided by libteec to request the TEE operating system to run the target TA in the TEE.
  • the target TA Based on the target TA obtaining the operation request of the target service, the target TA sends a loading request of the target dynamic library to the TEE operating system;
  • the target TA After the process of the target TA is started, it can be called by other TAs in the TEE or CAs in the REE to execute the target service. Assuming that the target TA needs to use the target function to execute the target service, in the embodiment of this application, the code segment and data segment corresponding to the target function can be encapsulated as the target dynamic library, and the relevant information of the target dynamic library (such as symbol reference, symbol table) And relocation information, etc.) are embedded in the target file of the target TA, and the target TA can call the target dynamic library when executing the target service.
  • the target dynamic library such as symbol reference, symbol table
  • the encrypted file of the target dynamic library can be stored in the storage device of the REE.
  • the target TA When the target TA needs to call the target dynamic library, it can send a loading request of the target dynamic library to the TEE operating system, and the loading request can include The identifier of the target dynamic library, or, may also include the identifier of the target TA.
  • the target TA may call the dlopen interface to request the TEE operating system to load the target dynamic library.
  • the TEE operating system judges whether the target dynamic library is stored in the memory of the TEE operating system, if not, execute step 404, and if yes, execute step 409;
  • the TEE operating system After the TEE operating system receives the load request sent by the target TA, it can use the identifier of the target dynamic library, or use the identifier of the target dynamic library and the identifier of the target TA to find the target dynamic library in the memory of the TEE operating system. If the target dynamic library is not stored in the TEE operating system, step 404 can be executed. If the target dynamic library is stored in the memory of the TEE operating system, step 409 can be executed.
  • the TEE operating system sends a transfer request for the target dynamic library to the REE operating system;
  • the TEE operating system can send a transfer request for the target dynamic library to the REE operating system. Assuming that the agent process in the REE operating system is used to transfer the encrypted file of the dynamic library to the TEE operating system, the TEE operating system can wake up the agent process and send a transfer request to the agent process.
  • the transfer request can include the identification of the target dynamic library, or , Including the identification of the target dynamic library and the identification of the target TA.
  • the REE operating system obtains the encrypted file of the target dynamic library from the storage device of the REE according to the transfer request;
  • the encrypted files of the dynamic library are all stored in the storage device of the REE. Specifically, assuming that they are stored in the vendor/bin directory, the proxy process can be based on the identification of the target dynamic library, or according to the identification of the target dynamic library and the identification of the target TA. Find the encrypted file of the target dynamic library in the vendor/bin directory. Exemplarily, in order to uniquely identify the target dynamic library that the target TA needs to call, the file name of the encrypted file of the target dynamic library can be uuid1-fingerdriver1.so.sec, and the REE operating system can be based on the received transfer request of the target TA. The identification "uid1" and the identification of the target dynamic library "fingerdriver1" find the encrypted file of the target dynamic library in the vendor/bin directory.
  • the REE operating system transmits the encrypted file of the target dynamic library to the TEE operating system
  • the REE agent process finds the encrypted file of the target dynamic library, it can transfer the encrypted file of the target dynamic library to the TEE operating system.
  • the TEE operating system decrypts and verifies the encrypted file of the target dynamic library to obtain the target dynamic library
  • the TEE operating system can decrypt the encrypted files of the target dynamic library to obtain the target dynamic library, and perform signature verification on the target dynamic library. If the verification is passed, it indicates that the target dynamic library has not been modified, and step 408 can be continued; if the verification is not passed, it indicates that the target dynamic library may be modified, and other operations can be performed, for example, step 404 is performed again.
  • the TEE operating system stores the target dynamic library in the memory of the TEE operating system
  • the target dynamic library can be stored in the memory (for example, a file system) of the TEE operating system.
  • the TEE operating system loads the target dynamic library into the memory of the target TA;
  • the application program In the existing dynamic link technology, the application program generally sets the permissions to access system memory and the permissions to configure its own memory attributes, so that the application can load the dynamic library that needs to be called into its own memory space, and configure the dynamic library accordingly Attributes. There are certain security risks for the application to configure the permissions to access the system memory and the permissions to configure its own memory attributes.
  • the TA In order to improve the security of the TEE, in this embodiment of the application, the TA may not set the permissions to access the TEE operating system memory and configure itself The permission of the memory attribute is that the TEE operating system loads the target dynamic library into the memory of the target TA.
  • the loading process can generally specifically include the TEE operating system mapping or loading the target dynamic library into the memory space of the target TA to perform symbol analysis and Relocate, configure corresponding attributes for the memory corresponding to the target dynamic library, for example, configure the memory corresponding to the code segment in the target dynamic library as an executable attribute, and configure the memory corresponding to the data segment in the target dynamic library as read-only.
  • the target TA uses the target dynamic library to execute the target service
  • the target TA can use the function of the target dynamic library to execute the target service. It should be noted that the target TA can use the function of the target dynamic library to execute the target service. It is not limited to the target TA only using the target dynamic library to execute the target service. It is used to limit the target TA at least using the target dynamic library to execute the target service. In practical applications, in addition to using the target dynamic library, the target TA can also use the content in the target file of the target TA, or use other dynamic libraries to execute the target service. Exemplarily, the target TA can call the dlsym interface to obtain the code of the function in the target dynamic library, and after completion, it can call the dlclose interface to end the call.
  • the program segments corresponding to some functions of TA are individually encapsulated as a dynamic library, which improves the flexibility of TA loading strategy.
  • the TEE operating system can obtain the encrypted file of the dynamic library from the REE operating system. After the encrypted file is decrypted and verified, the TEE operating system can load the dynamic library into the TA. In the memory, so that TA performs the corresponding function of the dynamic library.
  • the TEE operating system can store the dynamic library corresponding to the model of the fingerprint identification device in the memory of the TEE operating system without obtaining the dynamic library corresponding to other models, which is beneficial to reduce the TEE memory Waste.
  • the TEE operating system only obtains the target dynamic library from the REE when it receives the TA's loading request for the target dynamic library. It is loaded into the memory of the TA, which is conducive to further saving the TEE memory.
  • step 403 to 408 may not be executed as needed.
  • step 409 is directly executed.
  • the TEE operating system can load the target dynamic library to other TAs when it receives a load request from other TAs for the target dynamic library. In the memory. Sharing the same dynamic library by multiple TAs is conducive to further saving the safe memory of the TEE.
  • the TEE operating system can set target authority information for the target dynamic library.
  • the target authority information is used to indicate which TAs have the authority to call the target dynamic library, or which TAs do not have the authority to call the target dynamic library; 4 In the corresponding method embodiment, after step 408 is performed, before step 409 is performed, the following steps may also be performed:
  • the TEE operating system judges whether the target TA has the permission to call the target dynamic library according to the target permission information, if yes, execute step 409, if not, execute step 412;
  • the TEE operating system can read the target authority information of the target dynamic library, and judge whether the target TA has the authority to call the target dynamic library according to the target authority information, and if it has the authority , Step 409 is executed, and if the permission is not available, step 412 is executed.
  • the target authority information may be an identifier of a TA that has the authority to call the target dynamic library.
  • the identification of the TA that has the authority to call the target dynamic library is called the TA identification.
  • the TA identifier can be added to the file name of the target dynamic library, then the TEE operating system can read the TA identifier from the file name of the target dynamic library, and judge the target TA identifier and TA identifier Whether they are consistent, if they are consistent, it is determined that the target TA has the authority to call the target dynamic library; if they are inconsistent, it is determined that the target TA does not have the authority to call the target dynamic library.
  • the target dynamic library can only be called by a single TA. In some application scenarios, it can be called by multiple TAs. Then the target authority information includes multiple TA identifiers, and each TA identifier corresponds to one callable The TA of the target dynamic library. In this case, as long as the target TA’s identifier is consistent with any one of the TA identifiers, it can be determined that the target TA has the authority to call the target dynamic library; if the target TA’s identifier and all TA identifiers therein If they are inconsistent, it can be determined that the target TA does not have the authority to call the target dynamic library.
  • the TEE operating system performs other operations.
  • the TEE operating system can reject the target TA's loading request for the target dynamic library.
  • the target authority information may be encrypted and signed.
  • step 407 may specifically perform the following steps:
  • the TEE operating system decrypts and verifies the encrypted file of the target dynamic library, and obtains the target dynamic library and target authority information;
  • the "gpd.ta.service_name" field in the configuration information (manifest) of the encryption tool can be configured to call the TA identification of the target dynamic library (referred to as TA identification) ), for example, the TA identifier can be uuid2, and "gpd.ta.islib:” is configured as "true” to indicate that the target dynamic library can only be called by the TA corresponding to the identifier.
  • the TEE operating system decrypts the encrypted file of the target dynamic library, it can obtain the configuration information, extract the TA identifier from it, and determine that the target dynamic library can only be run by the TA corresponding to the TA identifier.
  • Step 408 may specifically perform the following steps:
  • the TEE operating system stores the target dynamic library and target permission information in the memory of the TEE operating system in association with each other;
  • the target dynamic library and the target authority information can be associated and stored in the TEE operating system memory (for example, a file system).
  • the TEE operating system may add the target authority information to the file name of the target dynamic library.
  • the file name of the target dynamic library stored in the memory of the TEE operating system may be "uuid2- fingerdriver1.so"
  • the TEE operating system can determine the target authority information corresponding to the target dynamic library through the file name of the target dynamic library.
  • the TA in order to improve the security of the TEE, the TA does not set the authority to access the memory of the TEE operating system and the authority to configure its own memory attributes, and the TEE operating system loads the target dynamic library into the memory of the target TA.
  • the TA can also be selected to set the permission to access the memory of the TEE operating system and the permission to configure its own memory attributes. Referring to FIG. 5, another embodiment of the TA operating method of the present application may include the following steps:
  • the TEE operating system starts the process of the target TA
  • Step 501 can be understood with reference to the description of step 401 above, and will not be repeated here.
  • the target TA judges whether the target dynamic library is stored in the memory of the TEE operating system, if not, execute step 503, and if yes, execute step 509;
  • the target TA can use the identification of the target dynamic library, or use the identification of the target dynamic library and the identification of the target TA.
  • the target dynamic library is searched in the memory of the TEE operating system. If the target dynamic library is not stored in the memory of the TEE operating system, step 503 can be executed, and if the target dynamic library is stored in the memory of the TEE operating system, step 509 can be executed.
  • the target TA sends a request for obtaining the target dynamic library to the TEE operating system
  • the target TA may send an acquisition request for the target dynamic library to the TEE operating system, and the acquisition request may include the identification of the target dynamic library, or may also include the identification of the target TA.
  • the target TA may call the dlopen interface to request the TEE operating system to obtain the target dynamic library, and store the target dynamic library in the memory of the TEE operating system.
  • the TEE operating system sends a transfer request for the target dynamic library to the REE operating system;
  • the REE operating system obtains the encrypted file of the target dynamic library from the storage device of the REE according to the transfer request;
  • the REE operating system transfers the encrypted file of the target dynamic library to the TEE operating system
  • the TEE operating system decrypts and verifies the encrypted file of the target dynamic library to obtain the target dynamic library
  • the TEE operating system stores the target dynamic library in the memory of the TEE operating system
  • step 504 to step 508 reference may be made to the description of step 404 to step 408, which will not be repeated here.
  • the target TA loads the target dynamic library into the memory of the target TA;
  • the TEE operating system After the TEE operating system stores the target dynamic library in the memory of the TEE operating system, it can notify the target TA that the target dynamic library has been acquired, and the target TA can load the target dynamic library into its own memory.
  • the loading process generally includes specifically: TA maps or loads the target dynamic library into the memory space of the target TA, analyzes and relocates the symbols in the target dynamic library, and configures the corresponding attributes for the memory corresponding to the target dynamic library, for example, the corresponding code segment in the target dynamic library
  • the memory is configured as an executable attribute, and the memory corresponding to the data segment in the target dynamic library is configured as read-only.
  • the target TA uses the target dynamic library to execute the target service
  • the target TA can call the dlsym interface to obtain the code of the function in the target dynamic library, and after completion, it can call the dlclose interface to end the call.
  • Step 509 The embodiment corresponding to FIG. 5 is only an example. In actual applications, all or part of steps 502 to 508 may not be executed as needed. For example, after the target TA obtains the operation request of the target service, it is directly executed Step 509.
  • the TEE operating system can set target authority information for the target dynamic library.
  • the target authority information is used to indicate which TAs have the authority to call the target dynamic library, or which TAs are not. Have the authority to call the target dynamic library.
  • the target TA sends an access request to the target dynamic library in the memory of the TEE operating system to the TEE operating system;
  • the target TA may send to the TEE operating system an access request for the target dynamic library in the memory of the TEE operating system, and the access request may include the identification of the target dynamic library.
  • the TEE operating system judges whether the target TA has the permission to call the target dynamic library according to the target permission information, if yes, execute step 513, if not, execute step 514;
  • the TEE operating system sends the permission access information of the target dynamic library to the target TA;
  • the target TA may execute step 509.
  • the TEE operating system sends a notice of denial of access to the target dynamic library to the target TA;
  • the target TA Based on the target TA getting the notification of denial of access to the target dynamic library sent by the TEE operating system, the target TA cannot load the target dynamic library, which helps prevent TAs that do not have the right to call the target dynamic library from loading the target dynamic library, and prevent the target dynamic library from being Give way.
  • the TEE operating system after the TEE operating system receives the access request of the target TA, it can also determine whether the target TA has the permission to access the memory of the TEE operating system, based on the target TA has the permission to access the memory of the TEE operating system, and the target TA has After calling the permission of the target dynamic library, the TEE operating system sends the permission access information of the target dynamic library to the target TA.
  • the target dynamic library is loaded into the memory of the target TA after the target TA is started.
  • the TEE operating system can load the target dynamic library into the memory of the target TA during the initialization of the target TA. Specifically, during the initialization of the target TA, the TEE operating system can be based on the target TA’s The identification of the dynamic library recorded in the target file is used to obtain all or part of the dynamic library (including or excluding the target dynamic library) recorded in the target file of the target TA.
  • step 404 you can refer to step 404 to step 408, and the TEE operating system sets the target TA All or part of the called dynamic libraries are stored in the memory of the TEE operating system; then the TEE operating system can directly load each dynamic library into the memory of the target TA, or, based on the load request of the target service sent by the target TA, if the target The dynamic library has been stored in the memory of the TEE operating system, and the TEE operating system loads the target dynamic library from the memory of the TEE operating system into the memory of the target TA.
  • the target dynamic library may have been stored in the memory of the TEE operating system, or even loaded into the memory of the target TA, which is beneficial to improve the completion efficiency of the target service.
  • TA generally calls the corresponding dynamic library according to the services that need to be executed, that is, the target TA may not need to call some of the dynamic libraries recorded in the target file during the running process, and the TEE operating system initializes the target TA In the process, all dynamic libraries that the target TA may call are loaded into the memory of the target TA, which is likely to cause a waste of the safe memory of the TEE.
  • the TEE operating system can predict one or more dynamic libraries with a higher probability of being called from the dynamic libraries recorded in the target file, and obtain the predicted corresponding dynamics during the process of starting the target TA Library.
  • the REE operating system executes step 405 and step 406 based on obtaining the transfer request for the target dynamic library sent by the TEE operating system.
  • the REE operating system can actively perform steps 405 and 406 to transfer the encrypted file of the target dynamic library.
  • it is beneficial to reduce the interaction between REE and TEE and save the computing resources of terminal equipment.
  • an embodiment in which the REE operating system transmits the dynamic library to the TEE operating system may include:
  • the target CA requests the TEE operating system to create a target TA based on the target CA, and the target CA obtains the identification of each dynamic library that the target TA needs to call;
  • the operating information of the TA that the target CA may call can be recorded in the target file of the target CA.
  • the identification of each dynamic library that the target TA needs to call can be associated with the target TA's identification and recorded in the target file of the target CA.
  • the target CA needs to call the target TA to execute the service, it can look up the identification of each dynamic library that the target TA needs to call.
  • the target CA sends a transfer request for the dynamic library to the REE operating system, and the transfer request includes the acquired identification of each dynamic library;
  • the REE operating system obtains the encrypted files of each dynamic library from the storage device of the REE according to the transfer request;
  • the REE operating system transfers the encrypted files of each dynamic library to the TEE operating system.
  • the TEE operating system After the TEE operating system obtains the encrypted files of each dynamic library delivered by the TEE operating system, it can decrypt and verify it, and store the obtained dynamic libraries in the memory of the TEE operating system. After that, the TEE operating system can load each dynamic library into the memory of the target TA during the initialization of the target TA, or load the target dynamic library when it obtains the load request of the target dynamic library sent by the target TA To the memory of the target TA, or the target TA can load the target dynamic library into its own memory.
  • another embodiment of the method for the REE operating system to transfer the dynamic library to the TEE operating system may include:
  • the target CA sends an operation request of the target service to the target TA;
  • the target CA may request the target TA to perform the target service.
  • the target TA sends a first transfer request for the target dynamic library to the target TA.
  • the target TA can obtain the identification of the target dynamic library that needs to be called when executing the target service, and send a transfer request to the target dynamic library to the target TA.
  • the transfer request here is called the first transfer request, and the first transfer request includes the identification of the target dynamic library.
  • the target CA obtains the encrypted file of the target dynamic library from the storage device of the REE according to the first transfer request.
  • the target CA may be configured with the permission to access the storage device of the REE.
  • the target CA may obtain the encrypted file of the target dynamic library from the storage device of the REE according to the first transfer request.
  • the target CA sends a second transfer request for the target dynamic library to the REE operating system
  • the target CA After the target CA obtains the encrypted file of the target dynamic library, it can cache the encrypted file and send a second transfer request to the target dynamic library to the REE operating system, requesting the REE operating system to send the target dynamic library to the TEE operating system.
  • the transfer request here is called the second transfer request, and the second transfer request may include the identifier of the target dynamic library.
  • the REE operating system transmits the encrypted file of the target dynamic library to the TEE operating system.
  • the REE operating system may transfer the encrypted file obtained by the target CA to the TEE operating system.
  • the TEE operating system After the TEE operating system obtains the encrypted file of the target dynamic library delivered by the TEE operating system, it can decrypt and verify it, and store the obtained target dynamic library in the memory of the TEE operating system. For the specific process, please refer to the description of step 407 and step 408. , I won’t repeat it here.
  • the TEE operating system can directly load the target dynamic library into the memory of the target TA, or, when it obtains the load request of the target dynamic library sent by the target TA, load the target dynamic library in the memory of the TEE operating system to the target TA. Or, if the TA is set to access the TEE operating system memory and configure its own memory attributes, the target TA can load the target dynamic library into its own memory.
  • the identification of the target dynamic library that the target TA needs to call when executing the target service can also be recorded in the target file of the target CA.
  • the steps can be executed without the target TA sending a delivery request.
  • TEE and REE shared memory devices generally allocate part of the memory to the TEE according to a certain ratio, and the TEE configures the attributes of this part of memory as safe memory for TEE use; other memory attributes are non-safe memory for REE use.
  • REE can only access non-secure memory, and TEE can only access secure memory.
  • Tasks that CA calls TA to perform may require a lot of memory, such as face recognition tasks. TA needs to perform calculations on a large amount of graphics data when performing face recognition tasks, which generates a large amount of intermediate data and requires a large amount of memory.
  • the prior art adopts the business logic coordination between CA and TA.
  • CA applies for memory and transfers it to TA, and TA applies to TEE operating system to configure the memory as secure memory.
  • TEE operating system to configure the memory as secure memory.
  • the REE operating system will reclaim the memory allocated to the CA and may allocate it to other processes of the REE operating system Used, but because the attribute of the memory is safe memory, other processes in the REE cannot access it, resulting in abnormal stability.
  • the target CA obtains the address information of the first memory that is fed back by the REE operating system in response to the memory application of the target CA.
  • the memory request sent by the target CA is used to apply to the REE operating system for the memory required by the target TA to run the target service.
  • the target CA sends the address information of the first memory and the operation request of the target service to the target TA;
  • the target TA sends a security attribute configuration request to the TEE operating system, where the security attribute configuration request includes address information of the first memory.
  • the TEE operating system modifies the attribute of the first memory to the secure memory according to the security attribute configuration request.
  • the target TA uses the first memory to execute the target service.
  • the target service is completed based on the target TA, and the target TA sends a non-secure attribute configuration request to the TEE operating system, and the non-secure attribute configuration request includes the address information of the first memory.
  • the TEE operating system modifies the attribute of the first memory to non-secure memory according to the non-secure attribute configuration request.
  • the target service is completed based on the target TA, and the target CA requests the REE operating system to release the first memory.
  • the existing memory allocation methods generally have the following problems:
  • CA When TA needs a large amount of memory to execute tasks, CA applies to REE operating system for the memory required by TA, and when TA completes the task, CA informs REE operating system to release the corresponding memory. If the TA does not complete the task and the CA is killed abnormally, the REE operating system will release the memory allocated to the CA. The memory release of the CA is not synchronized with the modification of the memory attributes of the TEE, which will cause memory attribute configuration problems and cause the whole machine to reset.
  • an embodiment of the memory allocation method of the present application may include the following steps:
  • the target TA obtains the operation request of the target service sent by the target CA.
  • the target TA sends a TA memory request to the TEE operating system
  • the TA memory request can be used to apply for the memory required by the target service
  • the TEE operating system determines whether the system memory available in the TEE operating system is sufficient according to the TA memory request, if not, execute step 904, and if yes, execute step 907;
  • the TEE operating system sends a TEE memory request to the REE operating system, and the memory size requested by the TEE memory request is not less than the memory requested by the TA memory request;
  • the size of the memory requested by the TEE memory request is determined according to the size of the available safe memory and the size of the memory requested by the TA memory request.
  • the REE operating system transmits the address information of the first memory to the TEE operating system according to the TEE memory request;
  • the REE operating system may send memory allocation information to the TEE operating system.
  • the memory allocation information is used to indicate that the memory allocated by the TEE operating system is the first memory.
  • the memory allocation information is the address information of the first memory as example.
  • the TEE operating system configures the attribute of the first memory as a safe memory
  • the TEE operating system allocates the second memory to the target TA, and the size of the second memory is not less than the memory requested by the TA memory request;
  • the target TA uses the second memory to execute the target service.
  • the target service is completed based on the target TA, and the target TA sends a TA memory release request to the TEE operating system, and the TA memory release request includes the address information of the second memory.
  • the TEE operating system releases the second memory according to the TA memory release request
  • the TEE operating system configures the attribute of the first memory as non-secure memory
  • the TEE operating system requests the REE operating system to release the first memory.
  • the TEE operating system needs to return the first memory (ie, step 911 and step 912 are executed). If the first memory is greater than the second memory, the TEE operating system can return the first memory at one time, or can return the first memory in multiple times.
  • the TEE operating system can return the second memory immediately after step 910 (that is, performing step 911 and step 912); or, the TEE operating system can return the second memory with a delay, for example, the TEE operating system can Determine whether the safety memory passed by the REE/or the available safety memory is sufficient. If it is sufficient, return it immediately, otherwise it will not be returned temporarily; or, the TEE operating system can reserve the second memory for a certain period of time, and return it if it is not used within the period of time .
  • the embodiments of the present application are beneficial to solve the instability problem caused when the CA applies for the memory for the TA, and are beneficial to reduce the complexity of the TEE memory dynamic expansion solution.
  • steps 901, 902, 903, and 907 to 912 may not be executed as needed.
  • the foregoing mainly introduces the solution provided by the embodiment of the present application from the perspective of the interaction between the target CA, the REE operating system, the TEE operating system, and the target TA in the computer system.
  • the aforementioned target CA, REE operating system, TEE operating system, and target TA include hardware structures and/or software modules corresponding to each function in order to realize the aforementioned functions.
  • the present application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a certain function is executed by hardware or computer software-driven hardware depends on the specific application and design constraint conditions of the technical solution. Professionals and technicians can use different methods for each specific application to implement the described functions, but such implementation should not be considered beyond the scope of this application.
  • each functional module can be divided corresponding to each function, or Integrate two or more functions into one function module.
  • the above-mentioned integrated functional modules can be implemented in the form of hardware or software functional units.
  • FIG. 10 shows a schematic structural diagram of a TEE operating system.
  • an embodiment of the TEE operating system 1000 of the present application may include:
  • the starting module 1010 is used to start a target TA, and the target TA is any one of one or more TAs;
  • the receiving module 1020 is configured to receive a loading request sent by the target TA in response to the running request of the target service, the loading request is used to instruct to load the target dynamic library, where the target service is a service provided by the target TA;
  • the loading module 1030 is used to load the target dynamic library into the memory space of the target TA in response to the loading request, and the target dynamic library is used to support the operation of the target service.
  • the loading module 1030 is used to:
  • the loading module 1030 includes:
  • the TEE communication unit is used to obtain the target dynamic library from the REE operating system
  • the dynamic library loading unit is used to load the target dynamic library into the memory space of the target TA.
  • the TEE communication unit is used to:
  • the transfer request includes the identification of the target dynamic library, and the transfer request is used to instruct the REE operating system to send the target dynamic library to the TEE operating system;
  • the TEE communication unit is used to:
  • Decrypt the encrypted file to obtain the decrypted file, and the decrypted file includes the target dynamic library.
  • the startup module 1010 is used to:
  • the loading module 1030 is used to:
  • the target dynamic library is loaded into the memory space of the target TA.
  • the TEE operating system also includes a TEE memory module, and the TEE memory module is used for:
  • the memory request is used to apply to the TEE operating system for the memory required to run the target service;
  • the first memory is allocated to the target TA.
  • the TEE memory module is specifically used for:
  • the first memory configured as a safe memory is allocated to the target TA.
  • the TEE memory module is also used to:
  • the TA memory release request sent by the target TA is received, and the TA memory release request is used to request the TEE operating system to release the first memory;
  • the first memory is released.
  • the TEE memory module is specifically used for:
  • the TEE memory module is also used to:
  • a TEE memory release request is sent to the REE operating system, and the TEE memory release request is used to request the REE operating system to release the first memory.
  • FIG. 11 shows a schematic structural diagram of a TEE operating system.
  • another embodiment of the TEE operating system 1100 of the present application may include:
  • the starting module 1110 is used to start a target TA, and the target TA is any one of one or more TAs;
  • the dynamic library providing module 1120 is configured to provide a target dynamic library for the target TA.
  • the target dynamic library is loaded by the target TA into the memory space of the target TA to support the target TA to run the target service, and the target service is the service provided by the target TA.
  • the dynamic library providing module 1120 includes:
  • the acquisition request receiving unit is configured to receive the acquisition request sent by the target TA in response to the operation request of the target service, and the acquisition request is used to instruct the TEE operating system to acquire the target dynamic library;
  • the dynamic library obtaining unit is used to obtain the target dynamic library in response to the obtaining request.
  • the dynamic library acquisition unit is used to acquire the target dynamic library from the REE operating system.
  • the dynamic library acquisition unit is specifically used for:
  • the transfer request includes the identification of the target dynamic library, and the transfer request is used to instruct the REE operating system to send the target dynamic library to the TEE operating system;
  • the dynamic library acquisition unit is specifically used for:
  • Decrypt the encrypted file to obtain the decrypted file, and the decrypted file includes the target dynamic library.
  • the dynamic library providing module 1120 is specifically used for:
  • the target dynamic library sent by the REE operating system in response to the second transfer request receives the target dynamic library sent by the REE operating system in response to the second transfer request.
  • the running request of the target service is sent by the target client application CA deployed on the REE operating system.
  • the target CA has the authority to call the target service.
  • the second transfer request is made by The target CA sends to the REE operating system in response to the first transfer request, and the first transfer request is sent to the target CA by the target TA in response to the running request of the target service.
  • the startup module 1110 includes:
  • one or more dynamic libraries are recorded in the target file of the target TA, optional Yes, the target file is the executable file of the target TA.
  • the dynamic library providing module 1120 includes:
  • the access request receiving unit is used to receive the access request sent by the target TA, the access request is used to request access to the memory space of the TEE operating system, and the target dynamic library is stored in the memory space of the TEE operating system;
  • the permission information sending unit is used to send permission information to the target TA based on the target TA having the permission to access the memory space of the TEE operating system, and the permission information is used to notify the target TA to access the memory space of the TEE operating system.
  • the access request is used to request access to the target dynamic library
  • the response message is sent to the target TA.
  • FIG. 12 shows a schematic structural diagram of a TA, and the TA in this embodiment corresponds to the foregoing Target TA in the method embodiment.
  • an embodiment of TA 1200 of this application may include:
  • the loading module 1210 is used to load the target dynamic library into the memory space of the target TA in response to the running request of the target service, the target TA is any one of one or more TAs, and the target service is the service provided by the target TA;
  • the service running module 1220 is used to run the target service by using the target dynamic library.
  • the target dynamic library is provided to the target TA by the TEE operating system.
  • the loading module 1210 is used to:
  • the target dynamic library is obtained by the TEE operating system from the REE operating system.
  • the loading module 1210 is used to:
  • the target CA is deployed in the REE operating system and has the authority to call the target service.
  • the operation request of the target service is sent by the target CA;
  • the target dynamic library is sent to the TEE operating system by the REE operating system in response to the second transfer request, and the second transfer request is sent by the target CA in response to the first transfer request Sent to the REE operating system.
  • the loading module 1210 is used to:
  • the loading module 1210 is specifically used for:
  • the access request is used to request access to the memory space of the TEE operating system, and the target dynamic library is stored in the memory space of the TEE operating system;
  • the target dynamic library in the memory space of the TEE operating system is accessed, and the target dynamic library is loaded into the memory space of the target TA.
  • FIG. 13 shows a schematic structural diagram of a REE operating system.
  • an embodiment of the REE operating system 1300 of the present application may include:
  • the file obtaining module 1310 is configured to obtain the target file in response to the transfer request, and the transfer request is used to instruct the REE operating system to transfer the target file to the TEE operating system;
  • the REE communication module 1320 is used to send the target file to the TEE operating system.
  • the target file is a target dynamic library, which is used to load into the memory space of the target TA to support the target TA to run the target service.
  • the target service is the service provided by the target TA, and the target TA is Any one of the one or more TAs deployed on the TEE operating system.
  • the transfer request is sent by the TEE operating system, or the transfer request is sent by the target client application CA, and the target CA has the authority to call the target service.
  • FIG. 14 shows a schematic structural diagram of a TEE operating system.
  • another embodiment of the TEE operating system 1400 of the present application may include:
  • the memory application module 1410 is used to send a first memory request to the REE operating system, and the first memory request is used to request the REE operating system to allocate memory for the TEE operating system;
  • the memory receiving module 1420 is used to receive the memory allocation information sent by the REE operating system, and the memory allocation information is used to indicate that the memory allocated for the TEE operating system is the target memory;
  • the memory configuration module 1430 is used to configure the target memory as a secure memory.
  • the memory application module 1410 is also used to:
  • the target TA is any one of the one or more TAs deployed on the TEE operating system.
  • the second memory request is used to send the TEE The operating system applies for memory.
  • the memory configuration module 1430 is also used to:
  • the target memory is configured as a safe memory
  • the target memory is allocated to the target TA.
  • the second memory request is sent by the target TA in response to the running request of the target service, the second memory request is used to apply for the memory required by the target TA to run the target service, and the target service is provided by the target TA service.
  • the memory requested by the first memory request is greater than the memory requested by the second memory.
  • the memory application module 1410 is also used to:
  • the memory configuration module 1430 After the memory configuration module 1430 allocates the first memory to the target TA, it receives the TA memory release request sent by the target TA, and the TA memory release request is used to request the TEE operating system to release the target memory;
  • the memory application module 1410 is also used to release the target memory in response to the TA memory release request.
  • the memory configuration module 1430 is further configured to configure the target memory as an unsecured memory after the memory configuration module 1430 releases the target memory;
  • the memory application module is also used to send a TEE memory release request to the REE operating system, and the TEE memory release request is used to request the REE operating system to release the target memory.
  • the embodiments of the present application also provide a computer system, which can run any of the methods of the embodiments provided in the present application, and includes hardware structures and/or software modules corresponding to each function.
  • a computer system which can run any of the methods of the embodiments provided in the present application, and includes hardware structures and/or software modules corresponding to each function.
  • the computer system of the present application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a certain function is executed by hardware or computer software-driven hardware depends on the specific application and design constraint conditions of the technical solution. Professionals and technicians can use different methods for each specific application to implement the described functions, but such implementation should not be considered beyond the scope of this application.
  • each functional module can be divided corresponding to each function, or two or more functions can be integrated into one function.
  • Module The above-mentioned integrated functional modules can be implemented in the form of hardware or software functional units.
  • the computer operating system provided in this application may include one or more of the aforementioned REE operating system, TEE operating system, CA, and TA.
  • each device provided in the embodiment of the present application can be used to execute the foregoing corresponding embodiment method, the technical effect that can be obtained by each device embodiment of the present application can refer to the foregoing corresponding method embodiment, and will not be repeated here.
  • FIG. 15 is a schematic diagram of the hardware structure of the computer device 1500.
  • ASICs application-specific integrated circuits
  • REE operating system REE operating system
  • TA TA
  • CA CA or operating system
  • the computer device 1500 may include: a processor radio frequency (RF) circuit 1510, a memory 1520, an input unit 1530, a display unit 1540, a sensor 1550, an audio circuit 1560, a wireless fidelity (WiFi) module 1570, a processing 1580, power supply 1590 and other components.
  • RF radio frequency
  • FIG. 15 does not constitute a limitation on the computer device, and may include more or fewer components than those shown in the figure, or a combination of certain components, or different component arrangements.
  • the RF circuit 1510 can be used for receiving and sending signals in the process of sending and receiving information or talking.
  • the processor 1580 After receiving the downlink information of the network side device, it is processed by the processor 1580; in addition, the designed uplink data is sent to the network side device.
  • the RF circuit 1510 includes, but is not limited to, an antenna, at least one amplifier, a transceiver, a coupler, a low noise amplifier (LNA), a duplexer, and the like.
  • LNA low noise amplifier
  • the RF circuit 1510 can also communicate with the network and other devices through wireless communication.
  • the above-mentioned wireless communication can use any communication standard or protocol, including but not limited to global system of mobile communication (GSM), general packet radio service (GPRS), code division multiple access (code division multiple access, GSM) multiple access, CDMA), wideband code division multiple access (WCDMA), long term evolution (LTE), email, short messaging service (SMS), etc.
  • GSM global system of mobile communication
  • GPRS general packet radio service
  • code division multiple access code division multiple access
  • CDMA code division multiple access
  • WCDMA wideband code division multiple access
  • LTE long term evolution
  • email short messaging service
  • the memory 1520 may be used to store software programs and modules.
  • the processor 1580 executes various functional applications and data processing of the computer device by running the software programs and modules stored in the memory 1520.
  • the memory 1520 may mainly include a program storage area and a data storage area.
  • the program storage area may store an operating system and an application program required by at least one function; the data storage area may store data created according to the use of a computer device.
  • the memory 1520 may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one magnetic disk storage device, a flash memory device, or other volatile solid-state storage devices.
  • the input unit 1530 may be used to receive inputted numeric or character information, and generate key signal input related to user settings and function control of the computer device.
  • the input unit 1530 may include a touch panel 1531 and other input devices 1532.
  • the touch panel 1531 also called a touch screen, can collect the user's touch operations on or near it (for example, the user uses any suitable objects or accessories such as fingers, stylus, etc.) on the touch panel 1531 or near the touch panel 1531. Operation), and drive the corresponding connection device according to the preset program.
  • the input unit 1530 may also include other input devices 1532.
  • other input devices 1532 may include, but are not limited to, one or more of a physical keyboard, function keys (such as volume control buttons, switch buttons, etc.), trackball, mouse, and joystick.
  • the display unit 1540 may be used to display information input by the user or information provided to the user and various menus of the computer device.
  • the display unit 1540 may include a display panel 1541.
  • the display panel 1541 may be configured in the form of a liquid crystal display (LCD), an organic light-emitting diode (OLED), or the like.
  • the touch panel 1531 can cover the display panel 1541. When the touch panel 1531 detects a touch operation on or near it, it transmits it to the processor 1580 to determine the type of the touch event, and then the processor 1580 responds to the touch event. The type provides corresponding visual output on the display panel 1541.
  • the touch panel 1531 and the display panel 1541 are used as two independent components to realize the input and input functions of the computer device, in some embodiments, the touch panel 1531 and the display panel 1541 can be integrated And realize the input and output functions of computer equipment.
  • the computer device may also include at least one sensor 1550, such as a light sensor, a motion sensor, and other sensors.
  • the light sensor may include an ambient light sensor and a proximity sensor.
  • the ambient light sensor can adjust the brightness of the display panel 1541 according to the brightness of the ambient light.
  • the proximity sensor can close the display panel 1541 and the display panel 1541 when the computer device is moved to the ear. / Or backlight.
  • the accelerometer sensor can detect the magnitude of acceleration in various directions (usually three axes), and can detect the magnitude and direction of gravity when it is stationary.
  • the audio circuit 1560, the speaker 1561, and the microphone 1562 can provide an audio interface between the user and the computer equipment.
  • the audio circuit 1560 can transmit the electrical signal converted from the received audio data to the speaker 1561, which is converted into a sound signal for output by the speaker 1561; on the other hand, the microphone 1562 converts the collected sound signal into an electrical signal, and the audio circuit 1560 After being received, it is converted into audio data, and then processed by the audio data output processor 1580, and then sent to another device via the RF circuit 1510, or the audio data is output to the memory 1520 for further processing.
  • WiFi is a short-distance wireless transmission technology.
  • Computer equipment can help users send and receive emails, browse web pages, and access streaming media through the WiFi module 1570. It provides users with wireless broadband Internet access.
  • FIG. 15 shows the WiFi module 1570, it is understandable that it is not a necessary component of the computer equipment and can be omitted as needed without changing the essence of the invention.
  • the processor 1580 is the control center of the computer equipment. It uses various interfaces and lines to connect the various parts of the entire computer equipment. It runs or executes the software programs and/or modules stored in the memory 1520, and calls the data stored in the memory 1520. , Perform various functions of computer equipment and process data, so as to monitor the computer equipment as a whole.
  • the processor 1580 may be a central processing unit (CPU), a network processor (NP) or a combination of a CPU and NP, a digital signal processor (DSP), or an application specific integrated circuit (application specific integrated circuit). integrated circuit, ASIC), off-the-shelf programmable gate array (field programmable gate array, FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components.
  • the methods, steps, and logic block diagrams disclosed in this application can be implemented or executed.
  • the general-purpose processor may be a microprocessor or the processor may also be any conventional processor or the like. Combining the steps of the method disclosed in this application may be directly embodied as being executed and completed by a hardware decoding processor, or executed and completed by a combination of hardware and software modules in the decoding processor.
  • the software module can be located in a mature storage medium in the field, such as random access memory, flash memory, read-only memory, programmable read-only memory, or electrically erasable programmable memory, registers. The storage medium is located in the memory, and the processor reads the information in the memory and completes the steps of the above method in combination with its hardware.
  • the apparatus may include multiple processors or the processors may include multiple processing units.
  • the processor may be a single-core processor, or a multi-core or many-core processor.
  • the processor may be an ARM architecture processor.
  • the processor 1580 may integrate an application processor and a modem processor, where the application processor mainly processes an operating system, a user interface, and application programs, and the modem processor mainly processes wireless communication. It can be understood that the foregoing modem processor may not be integrated into the processor 1580.
  • the computer device also includes a power supply 1590 (such as a battery) for supplying power to various components.
  • a power supply 1590 (such as a battery) for supplying power to various components.
  • the power supply can be logically connected to the processor 1580 through a power management system, so that functions such as charging, discharging, and power consumption management can be managed through the power management system.
  • the computer device may also include a camera, a Bluetooth module, etc., which will not be repeated here.
  • the computer equipment provided in the embodiments of this application may be a mobile phone, a tablet computer, a desktop computer, a wearable device (such as a smart watch), a smart home device (such as a smart audio or a smart TV), a vehicle-mounted smart device, an unmanned driving device, and virtual reality.
  • the computer program product includes one or more computer instructions.
  • the computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices.
  • the computer instructions may be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium.
  • the computer instructions may be transmitted from a website, computer, server, or data center. Transmission to another website site, computer, server or data center via wired (such as coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (such as infrared, wireless, microwave, etc.).
  • wired such as coaxial cable, optical fiber, digital subscriber line (DSL)
  • wireless such as infrared, wireless, microwave, etc.
  • the computer-readable storage medium may be any available medium that can be stored by a computer or a data storage device such as a server or a data center integrated with one or more available media.
  • the usable medium may be a magnetic medium (for example, a floppy disk, a hard disk, and a magnetic tape), an optical medium (for example, a DVD), or a semiconductor medium (for example, a solid state disk (SSD)).
  • words such as “exemplary” or “for example” are used as examples, illustrations, or illustrations. Any embodiment or design solution described as “exemplary” or “for example” in the embodiments of the present application should not be construed as being more preferable or advantageous than other embodiments or design solutions. To be precise, words such as “exemplary” or “for example” are used to present related concepts in a specific manner.

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Software Systems (AREA)
  • Computer Security & Cryptography (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer Hardware Design (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Health & Medical Sciences (AREA)
  • Bioethics (AREA)
  • General Health & Medical Sciences (AREA)
  • Databases & Information Systems (AREA)
  • Mathematical Physics (AREA)
  • Stored Programmes (AREA)

Abstract

本申请实施例公开了一种可信应用程序的运行方法、信息处理方法、内存分配方法及装置，应用于部署有可信执行环境TEE和富执行环境REE的计算机系统中，REE上部署有REE操作系统，TEE上部署有TEE操作系统，TEE操作系统上运行一个或多个可信应用程序TA。以其中的一个目标TA为例，目标TA可以提供目标服务，TEE操作系统可以启动目标TA，之后，目标TA可以响应于目标服务的运行请求，向TEE操作系统发送对支持目标服务的目标动态库的加载请求，TEE操作系统可以响应于该加载请求，将目标动态库加载到目标TA的内存空间中。这样，在目标TA运行目标服务之前，无需将用于支持目标服务的程序模块加载至TA的内存空间中，有利用减少TA的内存空间的浪费。

Description

可信应用的运行方法、信息处理和内存分配方法及装置
本申请要求于2019年8月30日提交中国专利局、申请号为201910817794.3、发明名称为“可信应用的运行方法、信息处理和内存分配方法及装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及通信技术领域，尤其涉及一种可信应用程序的运行方法、信息处理方法、内存分配方法及装置。
背景技术
随着移动互联网的发展，智能终端设备的应用越来越广泛。为了提供智能终端设备的丰富功能和可扩展属性，并且保护用户隐私和信息安全，终端设备构建在提供开放式操作环境的富执行环境(rich execution envrironment，REE)和可信执行环境(trusted execution environment，TEE)之上。REE也被称作一般运行环境，主要包括运行于通用处理器上的富操作系统(rich operating system，Rich OS)和运行在Rich OS上的客户端应用程序(client application，CA)。TEE是运行于REE之外的独立运行环境，主要包括运行于可信操作系统(trusted operating system，Trusted OS)和运行在Trusted OS上的可信应用程序(trusted application，TA)，TEE与REE隔离。REE无法直接访问TEE的硬件和软件资源，例如TEE内存，二者只能通过授权的应用程序编程接口(application programming interface，API)进行交互。因此TEE能够抵御在REE侧发生的软件攻击。
由于TA在实现某个功能时，需要运行TA的目标文件中代码段的部分代码，并且访问数据段的部分数据，因此，可以在逻辑上将该功能对应的程序段(包括代码和数据)称作该功能对应的程序模块。现有技术中，TEE操作系统在启动TA的过程中，将TA的各个功能对应的程序模块均加载至TA的内存空间，TA在收到某个服务的运行请求时，可以利用支持该服务的各个程序模块运行该服务。
随着TEE内部署的TA不断增多，TA的功能不断增加，TEE操作系统为TA分配的内存空间越来越大，TEE的安全内存作为TEE的一种有限的安全资源，面临着日趋严峻的挑战。而现有TA的运行方法中，TA可能未收到某个服务的运行请求，而支持该服务的各个程序模块均已被加载至TA的内存空间中，造成TA的内存空间的浪费，进一步增加了TEE的安全内存的压力。
发明内容
本申请实施例提供一种可信应用程序的运行方法、信息处理方法、内存分配方法及装置，用于节约TA的内存空间。
为了保护用户隐私和信息安全，部署有富执行环境(rich execution envrironment，REE)和可信执行环境(trusted execution environment，TEE)的计算机系统的应用越来越 广泛，该计算机系统的REE内部署有富操作系统(rich operating system，Rich OS)，或称REE操作系统，该REE操作系统内一般部署有一个或多个CA，该计算机系统的TEE内部署有可信操作系统(trusted operating system，Trusted OS)，或称TEE操作系统，该TEE操作系统上一般部署有一个或多个TA，TA一般可以提供一个或多个服务。
以该TEE操作系统中部署的某个TA(称作目标TA)和目标TA提供的某个服务(称作目标服务)为例，下面介绍本申请实施例第一方面提供的TA的运行方法。需要说明的是，本申请并不限定TEE操作系统中部署的所有TA都按照本申请提供的方法运行。
目标TA运行目标服务的前提是，该TEE操作系统启动目标TA，更具体的说法是，该TEE操作系统启动目标TA的主进程，并且用于支持目标服务的程序模块(或者说目标TA运行目标服务时所需利用的程序模块)被加载至目标TA的内存空间中。
示例性的，TEE操作系统在启动目标TA的过程中，可以将目标TA的目标文件加载至目标TA的内存空间，并创建目标TA的进程来执行该目标文件。该目标文件的类型可以为共享的目标文件(例如.so文件)或可执行文件(例如.os文件)或其他类型的文件，在本申请实施例中，不对该目标文件的具体类型进行限定。示例性的，在本申请实施例中，以目标文件为可执行文件为例，该目标文件保存了能够直接加载到内存中执行的二进制代码。动态库(一般为.so文件)和可执行文件(一般为.os文件)一般都是可执行和可链接格式(executable and linkable format，ELF)格式的文件。
本申请实施例中，在编译目标TA的目标文件时，未将支持目标服务的部分或全部程序模块复制到该目标文件中，而是将这部分程序模块单独编译为共享的目标文件，例如动态库，为了便于描述，将这部分程序模块编译得到的动态库称作目标动态库，目标动态库包括函数的代码，或者说包括符号(如变量或函数调用等)的定义，将目标动态库中的符号的引用(比如引用对象的标识)及其他登记信息(比如符号表和重定位信息等)添加在该目标文件中。TEE操作系统可以响应于目标TA的创建请求启动目标TA；目标TA被启动后，可以接收CA或其他TA发送的目标服务的运行请求，或自发启动(或产生)目标服务的运行请求，之后，目标TA响应于该运行请求，可以向TEE操作系统发送加载请求，该加载请求用于指示TEE操作系统加载目标动态库。TEE操作系统可以接收目标TA发送的该加载请求，响应于该加载请求，TEE操作系统可以将目标动态库加载到目标TA的内存空间中，之后，目标TA可以利用自己的内存空间中的目标动态库运行目标服务。
下面对本申请实施例第一方面提供的TA的运行方法的有益效果进行分析：
1)本申请实施例第一方面提供的TA的运行方法中，TEE操作系统可以在目标TA接收到目标服务的运行请求后，将用于支持目标服务的目标动态库加载至目标TA的内存空间，使目标TA利用目标动态库运行目标服务，这样，在TEE操作系统启动目标TA的过程中，或者，在目标TA接收到目标服务的运行请求之前，无需将用于支持目标服务的程序模块加载至TA的内存空间中，有利用减少TA的内存空间的浪费。
2)由TEE操作系统将目标动态库加载至目标TA中，无需为目标TA配置加载目标动态库的权限，例如具体的，无需为目标TA配置对目标存储区域进行访问和配置属性的权限，有利于提高TEE的安全性。其中，目标存储区域存储有目标动态库，为TEE的存储区域中目标TA的内存空间以外的其他存储空间。
需要说明的是，目标TA利用目标动态库运行目标服务，并不是限定目标TA仅利用目标动态库便可以运行目标服务，而是限定目标TA运行目标服务至少需要利用目标动态库。
前面所说的“目标TA运行目标服务的前提是，该TEE操作系统启动目标TA”，不是限定目标TA运行目标服务的过程中，TEE操作系统均需启动目标TA，而是限定，目标TA运行目标服务前，TEE操作系统至少执行一次启动目标TA的步骤，使目标TA进入运行状态，可以接收或自发产生目标服务的运行请求。
TEE操作系统将目标动态库加载到目标TA的内存空间的过程，作为举例，可以具体包括，TEE操作系统将目标动态库映射或装载到目标TA的内存空间，之后进行符号解析和重定位，使目标动态库链接至该目标文件。其中，符号解析可以理解为将目标动态库中的符号的定义与目标文件中的符号的引用进行关联；重定位可以理解为根据目标动态库的内存位置将目标文件中的符号指向内存中的相应位置。在一些实现方式中，TEE操作系统还可以对目标动态库对应的内存配置相应属性，例如，将目标动态库中代码段对应的内存配置为可执行属性，将目标动态库中数据段对应的内存配置为只读属性。
可以认为TEE的内存包括映射给TA的内存，在本申请实施例中可以称作TA的内存空间，或者称作TA的内存；TEE的内存还包括映射给TEE操作系统的内存，在本申请实施例中可以称作TEE操作系统的内存空间，或者称作TEE操作系统内存；同样的，可以认为REE的内存包括映射给CA的内存，在本申请实施例中可以称作CA的内存空间，或者称作CA的内存；REE的内存还包括映射给REE操作系统的内存，在本申请实施例中可以称作REE操作系统的内存空间，或者称作REE操作系统内存。在本申请部分实施例中，TA运行服务或被表述为TA执行服务，在本申请实施例中，可以认为运行服务和执行服务具有相同的含义。
基于本申请实施例第一方面提供的方法，在本申请实施例第一方面的第一种可能的实现方式中，在TEE操作系统接收到该加载请求前，目标动态库已存储在TEE操作系统的内存空间，TEE操作系统响应于加载请求加载目标动态库到目标TA的内存空间中，可以包括：响应于该加载请求，TEE操作系统可以从TEE操作系统的内存空间加载目标动态库到目标TA的内存空间中，目标动态库加载至目标TA的内存空间的效率高，有利于提高目标服务的完成效率。
基于本申请实施例第一方面提供的方法，在本申请实施例第一方面的第二种可能的实现方式中，目标动态库可以存储在REE的存储设备(例如ROM)中，TEE操作系统响应于加载请求加载目标动态库到目标TA的内存空间中，可以包括：响应于该加载请求，TEE操作系统可以从REE操作系统获取目标动态库，获取到目标动态库之后，TEE操作系统可以将目标动态库加载到目标TA的内存空间中。
由于目标动态库可以存储在REE的存储设备中，有利于节约TEE的存储资源；TEE操作系统可以在接收到该加载请求后，从REE操作系统获取目标动态库，因此，若目标TA未接收到目标服务的运行请求，TEE操作系统可以不用将目标动态库从REE的存储设备获取至TEE的存储设备中，有利于进一步节约TEE的存储资源。
在本申请实施例第一方面的第二种可能的实现方式中，目标动态库可以存储在REE的存储设备中，基于本申请实施例第一方面的第二种可能的实现方式，在本申请实施例第一方面的第三种可能的实现方式中，响应于该加载请求，TEE操作系统从REE操作系统获取目标动态库，可以包括：响应于该加载请求，TEE操作系统可以向REE操作系统发送目标动态库的 传递请求，之后，TEE操作系统可以接收REE操作系统发送的目标动态库。
本实现方式中不限定TEE操作系统发送的传递请求的具体内容及内容形式，只要REE操作系统可以响应于该传递请求将目标动态库发送到TEE操作系统即可，例如，该传递请求可以包括目标动态库的标识，REE操作系统可以按照目标动态库的标识从REE的存储设备中查找目标动态库。
在本申请实施例第一方面的第二种可能的实现方式和第一方面的第三种可能的实现方式中，“TEE操作系统可以从REE操作系统获取目标动态库”，不是限定TEE操作系统从REE操作系统获取到可以直接加载到目标TA的内存空间的目标动态库，在一些实施方式中，TEE操作系统可以对从REE操作系统获取的信息进行处理后得到目标动态库，示例性的，由于REE的安全性较差，为了提高REE中保存的目标动态库的安全性，可以对目标动态库进行加密，得到加密文件，之后将加密文件保存在REE的存储设备中。基于本申请实施例第一方面的第二种可能的实现方式，在本申请实施例第一方面的第四种可能的实现方式中，响应于该加载请求，TEE操作系统从REE操作系统获取目标动态库可以包括：响应于目标TA发送的该加载请求，TEE操作系统可以从REE操作系统获取该加密文件，之后对加密文件进行解密，可以得到目标动态库。基于本申请实施例第一方面的第三种可能的实现方式，在本申请实施例第一方面的第五种可能的实现方式中，TEE操作系统接收REE操作系统发送的目标动态库，可以包括：TEE操作系统接收REE操作系统传递的该加密文件，之后，TEE操作系统对该加密文件进行解密，得到目标动态库。
在本实现方式中，并不限定对加密文件解密得到的信息仅为目标动态库，因此，可以将对加密文件进行解密后的文件称作解密文件，该解密文件至少包括目标动态库，此外，在一些实现方式中，该解密文件还可以包括其他信息，例如在下文中的本申请第一方面的第九种可能的实现方式中，该解密文件还可以包括用于指示某个TA是否具有调用目标动态库的权限的信息，简称为目标权限信息。
为了提高目标动态库的安全性，除了将其加密存储在REE中，可选的，在一些实现方式中，还可以对目标动态库进行签名，对签名用于验证信息的真实性，对目标动态库进行加密和签名，示例性的，可以具体为：
1)对目标动态库进行加密得到加密信息，之后生成加密信息的签名。TEE操作系统可以从REE操作系统获取目标动态库对应的加密信息和标准签名，先验证加密信息的签名与标准签名是否一致，若不一致，则判定目标动态库不安全，获取目标动态库失败，若一致，再对加密信息进行解密，得到目标动态库。
或者，2)生成目标动态库的签名，之后对目标动态库和其签名进行加密得到加密信息。TEE操作系统可以从REE操作系统获取目标动态库对应的加密信息，对加密信息解密得到目标动态库和标准签名，TEE操作系统可以验证目标动态库的签名与标准签名是否一致，若不一致，则判定目标动态库不安全，判定获取目标动态库失败，若一致，判定成功获取到目标动态库。
和前述本申请实施例第一方面的第二种可能的实现方式相似的，基于本申请实施例第一方面提供的方法或者本申请实施例第一方面的第一种可能的实现方式，在本申请实施例第一方面的第六种可能的实现方式中，目标动态库也可以存储在REE的存储设备中；不同点主要 在于，前述本申请实施例第一方面的第二种可能的实现方式中，目标动态是由TEE操作系统响应于目标TA发送的加载请求从REE操作系统获取的，而在本申请实施例第一方面的第六种可能的实现方式中，目标动态库是由REE侧响应于目标TA发送的第一传递请求发送给TEE操作系统的。下面对本申请实施例第一方面的第六种可能的实现方式中进行具体介绍。
在本申请实施例第一方面的第六种可能的实现方式中，REE侧包括REE操作系统和向目标TA发送目标服务的运行请求的CA(本申请实施例中称作目标CA)，REE操作系统上部署的目标CA具有调用目标TA运行目标服务的权限，目标TA接收到目标CA发送的目标服务的运行请求后，可以向目标CA发送第一传递请求；响应于该第一传递请求，目标CA可以向REE操作系统发送第二传递请求；响应于该第二传递请求，REE操作系统可以将目标动态库发送给TEE操作系统。下面介绍两种具体的实现方式：
1)为目标CA配置了访问REE的目标存储区域的权限，目标存储区域中存储有目标动态库，响应于第一传递请求，目标CA可以在目标存储区域中读取目标动态库，之后向REE操作系统发送第二传递请求，响应于第二传递请求，REE操作系统将目标CA读取的目标动态库发送给TEE操作系统；
2)目标存储区域中存储有目标动态库，响应于第一传递请求，目标CA可以向REE操作系统发送第二传递请求，响应于第二传递请求，REE操作系统可以从目标存储区域中读取目标动态库，之后，将目标动态库发送给TEE操作系统。
本实现方式中不限定第一传递请求和第二传递请求的具体内容及内容形式，只要目标CA可以响应于第一传递请求向REE操作系统发送第二传递请求，并且，REE操作系统可以响应于第二传递请求将目标动态库发送到TEE操作系统即可。例如，第一传递请求和第二传递请求均可以包括目标动态库的标识，REE操作系统可以按照目标动态库的标识从REE的存储设备中查找目标动态库。
基于本申请实施例第一方面或第一方面的第一种可能的实现方式至第一方面的第六种可能的实现方式中任意一种可能的实现方式，在本申请实施例第一方面的第七种可能的实现方式中，TEE操作系统启动目标TA的过程中，可以将目标TA的目标文件加载至目标TA的内存空间，该目标文件中记录了目标TA在运行服务的过程中所需利用的各个动态库，例如记录了代表各个动态库的标识，目标文件中记录的各个动态库可以存储在REE中，以节约TEE的存储资源，TEE操作系统启动目标TA的过程中，TEE操作系统可以从该目标文件中读取一个或多个动态库的标识，之后从REE操作系统获取相应的一个或多个动态库，并将获取到的各动态库存储在TEE操作系统的内存空间中。
TEE操作系统在启动目标TA的过程中获取的动态库可以为该目标文件中记录的全部动态库，或者，为了节约TEE的存储资源，也可以为该目标文件中记录的部分动态库。TEE操作系统接收到目标动态库的加载请求时，若目标动态库已预先被存储在TEE操作系统中，将会提高TEE操作系统将目标动态库加载至目标TA的内存空间的效率。
若TEE操作系统在启动目标TA的过程中仅预先获取目标文件中记录的部分动态库，为了提高预先获取的动态库被目标TA调用的几率，TEE操作系统可以从目标文件中记录的各动态库中预测被调用的几率更高的一个或多个动态库，在启动目标TA的过程中获取预测到的相应动态库。
TEE中的不同TA之间是相互独立的，TA不能未经授权访问另一个TA的安全资源，目标动态库可被视为目标TA的安全资源，为了提高TEE的安全性，基于本申请实施例第一方面或第一方面的第一种可能的实现方式至第一方面的第六种可能的实现方式中任意一种可能的实现方式，在本申请实施例第一方面的第八种可能的实现方式中，TEE操作系统可以为目标动态库设置目标权限信息，目标权限信息用于表示哪些TA具有调用目标动态库的权限，或者表示哪些TA不具有调用目标动态库的权限，示例性的，目标权限信息可以包括具有调用目标动态库的权限的TA的标识。响应于目标动态库的加载请求，TEE操作系统加载目标动态库到目标TA的内存空间中，可以包括：响应于目标动态库的加载请求，TEE操作系统根据该目标权限信息判断目标TA是否具有调用目标动态库的权限，基于所述目标TA具有调用所述目标动态库的权限，TEE操作系统可以将目标动态库加载到所述目标TA的内存空间中。
基于本申请实施例第一方面的第八种可能的实现方式，在本申请实施例第一方面的第九种可能的实现方式中，为了防止目标权限信息被篡改，并且便于TEE操作系统查找目标动态库对应目标权限信息，可以将目标权限信息与目标动态库共同加密为同一加密文件，TEE操作系统需要获取目标动态库时，可以对该加密文件进行解密，得到的解密文件包括目标权限信息和目标动态库，之后，可选的，TEE操作系统可以将目标权限信息和目标动态库关联存储在TEE操作系统的内存空间中。
继续以该TEE操作系统中部署的某个TA(称作目标TA)和目标TA提供的某个服务(称作目标服务)为例，介绍本申请实施例第二方面提供的TA的运行方法。
目标TA运行目标服务的前提是，该TEE操作系统启动目标TA，更具体的说法是，该TEE操作系统启动目标TA的主进程，并且用于支持目标服务的程序模块(或者说目标TA运行目标服务时所需利用的程序模块)被加载至目标TA的内存空间中。本申请实施例中，将支持目标服务的部分或全部程序模块封装为共享的目标文件，或者具体称作目标动态库。
在前述第一方面提供的TA的运行方法和第一方面的各个实现方式中，TEE操作系统启动目标TA后，响应于目标服务的运行请求，目标TA向TEE操作系统发送目标动态库的加载请求，响应于该加载请求，TEE操作系统将目标动态库加载到目标TA的内存空间中；而在本申请实施例第二方面提供的TA的运行方法中，可以为目标TA配置加载动态库的权限，TEE操作系统可以启动目标TA，之后，TEE操作系统可以为目标TA提供目标动态库，响应于目标服务的运行请求，目标TA可以将目标动态库加载至目标TA的内存空间中，利用目标动态库运行目标服务。下面对本申请实施例第二方面提供的TA的运行方法的有益效果进行分析：
1)现有TA的运行方法中，TEE操作系统在启动TA的过程中，将启动TA所需的程序段和TA能够实现的各个功能对应的程序模块均加载至TA的内存空间，和现有技术不同的是，本申请实施例第二方面提供的TA的运行方法中，TEE操作系统可以在启动目标TA后，再为目标TA提供运行目标服务所需加载的目标动态库，从而有利于实现，在目标TA接收目标服务的运行请求之前，不将目标动态库加载至目标TA的内存空间中，在目标TA接收到目标服务的运行请求后，目标TA将TEE操作系统提供的目标动态库加载至目标TA的内存空间，进而有利于减少TA的内存空间的浪费。
2)由目标TA加载目标动态库，有利于实现TEE中TA与TEE操作系统的解耦，方便TA和TEE操作系统的升级，并且，有利于减少TEE操作系统的操作。
需要说明的是，目标TA利用目标动态库运行目标服务，并不是限定目标TA仅利用目标动态库便可以运行目标服务，而是限定目标TA运行目标服务至少需要利用目标动态库。
目标TA加载目标动态库的过程可以参考前述第一方面TEE操作系统加载目标动态库的过程描述，此处不再赘述。作为举例，为目标TA配置加载动态库的权限，可以具体理解为，为目标TA配置对TEE的目标存储区域进行访问和配置属性(可执行或可读等)的权限，目标存储区域为保存目标动态库的存储区域。
TEE操作系统为目标TA提供目标动态库，示例性的，可以理解为，目标TA所需加载的目标动态库库需要由TEE操作系统获取，之后，目标TA将TEE操作系统获取到的目标动态库加载至目标TA的内存空间；还可以理解为，目标TA需要访问TEE操作系统的内存空间来将目标动态库加载到目标TA的内存空间；还可以理解为前两种实现方式的组合，例如，目标TA所需加载的目标动态库由TEE操作系统获取，并且，由TEE操作系统将获取到的目标动态库保存在TEE操作系统的内存空间中等。下面提供的本申请第二方面的具体实现方式继续对“TEE操作系统为目标TA提供目标动态库”进行介绍。
基于本申请实施例第二方面提供的方法，在本申请实施例第二方面的第一种可能的实现方式中，目标TA可以响应于目标服务的运行请求向TEE操作系统发送获取请求，该获取请求用于指示TEE操作系统获取该目标动态库；TEE操作系统为目标TA提供目标动态库，可以包括：TEE操作系统可以接收目标TA发送的获取请求，在接收到该获取请求之后，TEE操作系统可以获取该目标动态库。TEE操作系统获取到目标动态库之后，可以将目标动态库保存在TEE的内存中，例如保存在TEE的缓存中。在本实现方式中，TEE操作系统可以在目标TA接收到目标服务的运行请求之后获取该目标动态库，有利于节约TEE的内存。
基于本申请实施例第二方面的第一种可能的实现方式，在本申请第二方面的第二种可能的实现方式中，目标动态库可以存储在REE的存储设备中，以节约TEE的存储资源，此时，TEE操作系统获取目标动态库，可以包括：TEE操作系统从REE操作系统获取目标动态库。
在本申请第二方面的第二种可能的实现方式中，“TEE操作系统可以从REE操作系统获取目标动态库”，不是限定TEE操作系统从REE操作系统获取到可以直接加载到目标TA的内存空间的目标动态库，在一些实施方式中，TEE操作系统可以对从REE操作系统获取的信息进行处理后得到目标动态库，示例性的，由于REE的安全性较差，为了提高REE中保存的目标动态库的安全性，可以对目标动态库进行加密，得到加密文件，之后将加密文件保存在REE的存储设备中。例如，基于本申请实施例第二方面的第二种可能的实现方式，在本申请第二方面的第三种可能的实现方式中，TEE操作系统从REE操作系统获取目标动态库，可以包括：TEE操作系统从REE操作系统获取加密文件；TEE操作系统对加密文件进行解密，得到解密文件，解密文件包括目标动态库。
为了提高目标动态库的安全性，除了将其加密存储在REE中，可选的，在一些实现方式中，还可以对目标动态库进行签名，对签名用于验证信息的真实性，对目标动态库进行加密和签名，示例性的，可以具体为：
1)对目标动态库进行加密得到加密信息，之后生成加密信息的签名。TEE操作系统可以从REE操作系统获取目标动态库对应的加密信息和标准签名，先验证加密信息的签名与标准签名是否一致，若不一致，则判定目标动态库不安全，获取目标动态库失败，若一致，再对 加密信息进行解密，得到目标动态库。
或者，2)生成目标动态库的签名，之后对目标动态库和其签名进行加密得到加密信息。TEE操作系统可以从REE操作系统获取目标动态库对应的加密信息，对加密信息解密得到目标动态库和标准签名，TEE操作系统可以验证目标动态库的签名与标准签名是否一致，若不一致，则判定目标动态库不安全，判定获取目标动态库失败，若一致，判定成功获取到目标动态库。
基于本申请实施例第二方面的第二种可能的实现方式，在本申请实施例第二方面的第四种可能的实现方式中，提供了TEE操作系统从REE操作系统获取目标动态库的一种具体方式，具体可以包括：TEE操作系统向REE操作系统发送目标动态库的传递请求，该传递请求包括目标动态库的标识，该传递请求用于指示REE操作系统将目标动态库发送到TEE操作系统，之后，TEE操作系统可以接收REE操作系统发送的目标动态库。
基于本申请实施例第二方面的第一种可能的实现方式，在本申请第二方面的第五种可能的实现方式中，目标动态库可以存储在REE的存储设备中，以节约TEE的存储资源，并且，目标服务的运行请求由部署在REE操作系统的目标客户端应用程序CA发送，目标CA有调用目标服务的权限，响应于目标服务的运行请求，目标TA可以向目标CA发送第一传递请求，目标CA响应于第一传递请求可以向TEE操作系统发送第二传递请求，响应于第二传递请求，REE操作系统可以将目标动态库发送给TEE操作系统，第二方面的第一种可能的实现方式中所说的“TEE操作系统为目标TA提供目标动态库”，可以包括：TEE操作系统接收REE操作系统响应于第二传递请求发送的目标动态库。
基于本申请实施例第二方面或第二方面的任意一种可能的实现方式，在本申请第二方面的第六种可能的实现方式中，TEE操作系统启动目标TA的过程中，可以将目标TA的目标文件加载至目标TA的内存空间，该目标文件中记录了目标TA在运行服务的过程中所需利用的各个动态库，例如记录了代表各个动态库的标识，目标文件中记录的各个动态库可以存储在REE中，以节约TEE的存储资源，TEE操作系统启动目标TA的过程中，TEE操作系统可以从该目标文件中读取一个或多个动态库的标识，之后从REE操作系统获取相应的一个或多个动态库，并将获取到的各动态库存储在TEE操作系统的内存空间中。
TEE操作系统在启动目标TA的过程中获取的动态库可以为该目标文件中记录的全部动态库，或者，为了节约TEE的存储资源，也可以为该目标文件中记录的部分动态库。TEE操作系统接收到目标动态库的加载请求时，若目标动态库已预先被存储在TEE操作系统中，将会提高TEE操作系统将目标动态库加载至目标TA的内存空间的效率。
若TEE操作系统在启动目标TA的过程中仅预先获取目标文件中记录的部分动态库，为了提高预先获取的动态库被目标TA调用的几率，TEE操作系统可以从目标文件中记录的各动态库中预测被调用的几率更高的一个或多个动态库，在启动目标TA的过程中获取预测到的相应动态库。
基于本申请实施例第二方面或第二方面的任意一种可能的实现方式，在本申请实施例第二方面的第七种可能的实现方式中，TEE操作系统可以将目标动态库保存在TEE操作系统的内存空间，目标TA可以通过访问TEE操作系统的内存空间来加载目标动态库。为了提高TEE操作系统的内存空间中信息的安全性，TEE操作系统可以为TEE操作系统的内存空间设置访 问权限，例如，TEE操作系统为目标TA提供目标动态库，可以包括：TEE操作系统接收目标TA发送的访问请求，访问请求用于请求访问TEE操作系统的内存空间；响应于目标TA的访问请求，TEE操作系统可以判断目标TA是否具有访问TEE操作系统的内存空间的权限，若判定目标TA具有访问TEE操作系统的内存空间的权限，TEE操作系统可以向目标TA发送允许访问信息，该允许访问信息用于通知目标TA访问TEE操作系统的内存空间。目标TA接收到该允许访问信息后，便可以访问TEE操作系统的内存空间，将其中的目标动态库加载至自己的内存空间。
基于本申请实施例第二方面的第七种可能的实现方式，在本申请实施例第二方面的第八种可能的实现方式中，为了进一步提高TEE操作系统的内存空间中保存的目标动态库的安全，TEE操作系统可以对目标动态库调用权限，那么目标TA发送的访问请求需要指示目标TA在TEE操作系统中访问的具体文件，若目标TA的访问请求用于请求访问所述目标动态库，TEE操作系统向目标TA发送允许访问信息可以具体包括：基于所述目标TA具有访问所述TEE操作系统的内存空间的权限，TEE操作系统判断目标TA是否具有调用目标动态库的权限，基于目标TA具有调用目标动态库的权限，TEE操作系统向目标TA发送允许访问信息。
继续以该TEE操作系统中部署的某个TA(称作目标TA)和目标TA提供的某个服务(称作目标服务)为例，介绍本申请实施例第三方面提供的TA的运行方法。
目标TA运行目标服务的前提是，该TEE操作系统启动目标TA，更具体的说法是，该TEE操作系统启动目标TA的主进程，并且用于支持目标服务的程序模块(或者说目标TA运行目标服务时所需利用的程序模块)被加载至目标TA的内存空间中。本申请实施例中，将支持目标服务的部分或全部程序模块封装为共享的目标文件，或者具体称作目标动态库。
和前述本申请实施例第二方面提供的方法类似，在本申请实施例第三方面提供的TA的运行方法中，可以为目标TA配置加载动态库的权限，响应于目标服务的运行请求，目标TA可以将目标动态库加载至目标TA的内存空间中，之后，可以利用目标动态库运行目标服务。下面对本申请实施例第三方面提供的TA的运行方法的有益效果进行分析：
1)现有TA的运行方法中，TEE操作系统在启动TA的过程中，将启动TA所需的程序段和TA能够实现的各个功能对应的程序模块均加载至TA的内存空间，和现有技术不同的是，本申请实施例第二方面提供的TA的运行方法中，目标TA可以在接收到目标服务的运行请求之后，再将目标动态库加载至目标TA的内存空间中，那么，在接收到目标服务的运行请求之前，目标TA可以无需将目标动态库加载到目标TA的内存空间中，进而有利于减少目标TA的内存空间的浪费。
2)由目标TA加载目标动态库，有利于实现TEE中TA与TEE操作系统的解耦，方便TA和TEE操作系统的升级，并且，有利于减少TEE操作系统的操作。
需要说明的是，目标TA利用目标动态库运行目标服务，并不是限定目标TA仅利用目标动态库便可以运行目标服务，而是限定目标TA运行目标服务至少需要利用目标动态库。
作为举例，为目标TA配置加载动态库的权限，可以具体理解为，为目标TA配置对TEE的目标存储区域进行访问和配置属性(可执行或可读等)的权限，目标存储区域为保存目标动态库的存储区域。
基于本申请实施例第三方面提供的方法，在本申请实施例第三方面的第一种可能的实现 方式中，目标TA加载的目标动态库是由TEE操作系统提供的，目标TA将目标动态库加载至目标TA的内存空间，可以具体指，目标TA将TEE操作系统提供的目标动态库加载至目标TA的内存空间。
目标TA所需加载的目标动态库是由TEE操作系统提供的，示例性的，可以理解为，目标TA所需加载的目标动态库库需要由TEE操作系统获取，之后，目标TA将TEE操作系统获取到的目标动态库加载至目标TA的内存空间；还可以理解为，目标TA所需加载的目标动态库被TEE操作系统保存在TEE操作系统的内存空间，目标TA需要访问TEE操作系统的内存空间来将目标动态库加载到目标TA的内存空间；还可以理解为前两种实现方式的组合，例如，目标TA所需加载的目标动态库由TEE操作系统获取，并且，由TEE操作系统将获取到的目标动态库保存在TEE操作系统的内存空间中等。关于TEE操作系统为目标TA提供目标动态库可以参考前述本申请第二方面的相应实现方式进行理解，此处不再赘述。
目标TA将目标动态库加载到目标TA的内存空间的过程，作为举例，可以具体包括，目标TA将目标动态库映射或装载到目标TA的内存空间，对目标动态库中的符号进行解析和重定位，对目标动态库对应的内存配置相应属性，例如，将目标动态库中代码段对应的内存配置为可执行属性，将目标动态库中数据段对应的内存配置为只读。
基于本申请实施例第三方面的第一种可能的实现方式，在本申请实施例第三方面的第二种可能的实现方式中，目标TA加载目标动态库到所述目标TA的内存空间中，可以包括：目标TA可以向TEE操作系统发送获取请求，该获取请求用于请求TEE操作系统获取目标动态库；TEE操作系统获取到目标动态库之后，目标TA可以将TEE操作系统获取到的目标动态库加载到目标TA的内存空间中。由于目标TA可以在接收到目标服务的运行请求之后，请求TEE操作系统获取目标动态库，因此，TEE操作系统可以在目标TA接收到目标服务的运行请求后获取目标动态库，有利于节约TEE的内存。
基于本申请实施例第三方面的第二种可能的实现方式，在本申请实施例第三方面的第三种可能的实现方式中，目标动态库可以存储在REE的存储设备中，以节约TEE的存储资源，目标TA所需加载的目标动态库可以为所述TEE操作系统从所述REE操作系统获取的。
基于本申请实施例第三方面的第一种可能的实现方式，在本申请实施例第三方面的第四种可能的实现方式中，目标动态库可以存储在REE的存储设备中，以节约TEE的存储资源，并且，目标服务的运行请求由部署在REE操作系统的目标客户端应用程序CA发送，目标CA有调用目标服务的权限，目标TA加载目标动态库到目标TA的内存空间中，可以包括：响应于目标服务的运行请求，目标TA可以向目标CA发送第一传递请求，目标CA响应于第一传递请求可以向TEE操作系统发送第二传递请求，响应于第二传递请求，REE操作系统可以将目标动态库发送给TEE操作系统；之后，目标TA可以将TEE操作系统接收到的目标动态库加载到目标TA的内存空间中。
基于本申请实施例第三方面的第一种至第四种可能的实现方式中任意一种可能的实现方式，在本申请实施例第三方面的第五种可能的实现方式中，TEE操作系统为目标TA提供目标动态库可以理解为，TEE操作系统将目标动态库保存在TEE操作系统的内存空间，目标TA加载TEE操作系统提供的目标动态库到目标TA的内存空间中，可以包括：目标TA从TEE操作系统的内存空间加载目标动态库到目标TA的内存空间中。
基于本申请实施例第三方面的第五种可能的实现方式，在本申请实施例第三方面的第六种可能的实现方式中，TEE操作系统可以将目标动态库保存在TEE操作系统的内存空间，目标TA可以通过访问TEE操作系统的内存空间来加载目标动态库。为了提高TEE操作系统的内存空间中信息的安全性，TEE操作系统可以为TEE操作系统的内存空间设置访问权限，目标TA从TEE操作系统的内存空间加载目标动态库到目标TA的内存空间中，可以包括：目标TA向TEE操作系统发送访问请求，访问请求用于请求访问TEE操作系统的内存空间，TEE操作系统可以根据访问请求判断目标TA是否具有访问TEE操作系统的内存空间的权限，若目标TA具有访问TEE操作系统的内存空间的权限，TEE操作系统可以向目标TA发送允许访问信息；基于目标TA接收到TEE操作系统发送的允许访问信息，目标TA可以访问TEE操作系统的内存空间，将其中的目标动态库加载到目标TA的内存空间中。
现有技术中，若TEE所需的文件保存在REE的存储设备中，可以由CA获取TEE所需的文件，之后将获取到的文件发送给TEE操作系统。本申请实施例第四方面提供一种前述计算机系统中的信息处理方法，为TEE操作系统新增为TEE获取所需文件的功能，有利于降低CA的开发难度。具体的，响应于传递请求，REE操作系统可以获取目标文件，之后，将获取到的目标文件发送给TEE操作系统，其中，传递请求用于指示REE操作系统将目标文件发送给TEE操作系统。
基于第四方面提供的方法，在本申请实施例第四方面的第一种可能的实现方式中，传递请求中所指示的目标文件可以为目标动态库，目标动态库为目标TA运行目标服务所需调用的动态库，被存储在REE的存储设备中，目标TA为TEE操作系统中部署的一个TA，目标服务为目标TA提供的一个服务。REE操作系统可以为TEE操作系统提供TA运行服务时所需调用的动态库，有利于实现将TA所需的程序段动态加载至TA的内存空间，从而有利于节约TA的内存空间。
基于第四方面的第一种可能的实现方式，在第四方面的第二种可能的实现方式中，REE操作系统接收到的传递请求可以为所述TEE操作系统发送的。
基于第四方面的第一种可能的实现方式中，在第四方面的第三种可能的实现方式中，REE操作系统接收到的传递请求可以为目标客户端应用程序CA发送的，目标CA有调用目标服务的权限。
本申请第四方面的第一种、第二种和第三种可能的实现方式可以参考前述本申请实施例第一方面至第四方面提供的相应方案进行理解，此处不再赘述。
部署有富执行环境REE和可信执行环境TEE的计算机系统中，TEE和REE共享内存设备，一般会按照某个比例将部分内存分配给TEE，由TEE将这部分内存的属性配置为安全内存，供TEE中的进程使用；其他内存的属性为非安全内存，供REE中的进程使用。REE中的进程(比如REE操作系统或CA)只能访问非安全内存，TEE中的进程(比如TEE操作系统或TA)只能访问安全内存。现有技术采用在CA和TA进行业务逻辑上协同，在TA需要大内存的情况下，由CA向REE操作系统申请内存，并将申请到的内存的信息(比如内存的地址)发送给TA，TEE操作系统将该内存分配给该TA使用，若出现异常情况，例如CA异常被杀，那么REE操作系统会将分配给CA的内存回收，由于该内存被TA占用，若REE操作系统将该内存分配给REE操作系统的其他进程使用，将引起内存访问异常，降低计算机系统的稳定性。
为了减少内存访问异常，提高计算机系统的稳定性，本申请实施例第五方面提供一种计算机系统中的内存处理方法，该计算机系统上所述REE内部署有REE操作系统，该TEE内部署有TEE操作系统，该TEE操作系统上部署有一个或多个TA，本申请第五方面提供的内存分配方法可以包括：TEE操作系统可以向REE操作系统发送第一内存请求，该第一内存请求用于向TEE操作系统申请内存；响应于该第一内存请求，REE操作系统可以为TEE操作系统分配内存(称作目标内存)，并将内存分配信息发送给TEE操作系统，该内存分配信息用于指示为TEE操作系统分配内存为目标内存，示例性的，该内存分配信息可以包括目标内存的地址；TEE操作系统可以将目标内存配置为安全内存。由于目标内存为REE操作系统为TEE操作系统分配的，TEE操作系统出现异常的概率较低，因此不易引起内存访问异常，有利于提高计算机系统的稳定性。
基于本申请实施例第五方面提供的方法，在本申请实施例第五方面的第一种可能的实现方式中，TEE操作系统可以为TA向REE操作系统申请内存，TEE操作系统向REE操作系统发送第一内存请求之前，内存分配方法还包括：TEE操作系统获取目标TA发送的第二内存请求，目标TA为TEE操作系统上部署的一个或多个TA中的任意一个TA，第二内存请求用于向TEE操作系统申请内存。需要说明的是，本实现方式不限定TEE操作系统获取到目标TA发送的第二内存请求时一定向REE操作系统发送第一内存请求，例如，TEE操作系统接收到第二内存请求后可以判断TEE的安全内存是否充足，若充足，可以将TEE的安全内存分配给目标TA，若不充足，则可以向REE操作系统申请内存。
基于本申请实施例第五方面的第一种可能的实现方式，在本申请实施例第五方面的第二种可能的实现方式中，TEE操作系统将目标内存配置为安全内存之后，内存分配方法还可以包括：TEE操作系统将所述目标内存分配给所述目标TA。TEE操作系统将目标内存分配给目标TA还可以理解为，TEE操作系统将目标内存映射给目标TA。
基于第五方面的第一种或第二种可能的实现方式，在第五方面的第三种可能的实现方式中，目标服务为目标TA提供的服务，目标TA可以在接收到目标服务的运行请求之后，若目标TA的内存空间不足以运行目标服务，目标TA可以向TEE操作系统发送第二内存请求，第二内存请求用于向TEE操作系统申请目标TA运行目标服务所需的内存。
基于第五方面的第一种至第三种可能的实现方式中任意一种可能的实现方式，在第五方面的第四种可能的实现方式中，TEE操作系统向REE操作系统申请的内存可以大于目标TA向TEE操作系统申请的内存，也就是说，第一内存请求申请的内存大于第二内存申请的内存，有利于减少目标TA向TEE操作系统申请内存的次数，减少目标TA和TEE操作系统的操作，节约计算机系统的运算资源。
基于第五方面的第二种可能的实现方式，在第五方面的第五种可能的实现方式中，在TEE操作系统将第一内存分配给目标TA之后，内存分配方法还可以包括：TEE操作系统可以接收目标TA发送的内存释放请求(为了便于区分，将此处目标TA发送的内存释放请求称作TA内存释放请求)，该TA内存释放请求用于请求TEE操作系统释放目标内存；响应于TA内存释放请求，TEE操作系统可以释放目标内存。TEE操作系统释放目标内存可以理解为，TEE操作系统取消目标内存和目标TA之间的映射。
基于第五方面的第五种可能的实现方式，在第五方面的第六种可能的实现方式中，在 TEE操作系统释放目标内存之后，内存分配方法还可以包括：TEE操作系统将目标内存配置为非安全内存，之后，TEE操作系统可以向REE操作系统发送TEE内存释放请求，该TEE内存释放请求用于请求REE操作系统释放目标内存。REE操作系统接收到TEE内存释放请求后，可以释放目标内存，REE操作系统释放目标内存可以理解为，REE操作系统取消目标内存和TEE操作系统之间的映射。
需要说明的，TEE操作系统释放目标内存之后，目标内存处于空闲状态，TEE操作系统可以不将目标内存再次分配给TEE中的进程使用，立即将目标内存配置为非安全内存，归还给REE操作系统；或者，TEE操作系统释放目标内存之后，TEE操作系统可以将目标内存再次分配给TEE中的进程使用，延迟归还给REE操作系统。
本申请实施例第五方面的第一种至第六种可能的实现方式中任意一种可能的实现方式，可以应用于前述本申请实施例第一方面的TA的运行方法中或第一方面的任意一种可能的实现方式中，或者应用于前述本申请实施例第二方面的TA的运行方法中或第二方面的任意一种可能的实现方式中，或者应用于前述本申请实施例第三方面的TA的运行方法中或第三方面的任意一种可能的实现方式中。
从功能模块的角度，本领域技术人员可以根据上述方法实施例分别对目标CA、REE操作系统、TEE操作系统和目标TA进行功能模块的划分，例如，可以对应各个功能划分各个功能模块，也可以将两个或两个以上的功能集成在一个功能模块中。上述集成的功能模块既可以采用硬件的形式实现，也可以采用软件功能单元的形式实现。
示例性的，根据第一方面提供的方案，以采用集成的方式划分各个功能单元的情况下，本申请实施例第六方面提供一种TEE操作系统，TEE操作系统可以包括：启动模块，用于启动目标TA，所述目标TA为所述一个或多个TA中的任意一个TA；接收模块，用于接收所述目标TA响应于目标服务的运行请求发送的加载请求，所述加载请求用于指示加载目标动态库，其中，所述目标服务为所述目标TA提供的服务；加载模块，用于响应于所述加载请求，加载所述目标动态库到所述目标TA的内存空间中，所述目标动态库用于支持所述目标服务的运行。
在一种可能的实现方式中，所述加载模块用于：从所述TEE操作系统的内存空间加载所述目标动态库到所述目标TA的内存空间中。
在一种可能的实现方式中，所述加载模块包括：TEE通信单元，用于从所述REE操作系统获取所述目标动态库；动态库加载单元，用于将所述目标动态库加载到所述目标TA的内存空间中。
在一种可能的实现方式中，所述TEE通信单元用于：向所述REE操作系统发送所述目标动态库的传递请求，所述传递请求包括所述目标动态库的标识，所述传递请求用于指示所述REE操作系统将所述目标动态库发送到所述TEE操作系统；接收所述REE操作系统发送的所述目标动态库。
在一种可能的实现方式中，所述TEE通信单元用于：从所述REE操作系统获取加密文件；对所述加密文件进行解密，得到解密文件，所述解密文件包括所述目标动态库。
在一种可能的实现方式中，所述启动模块用于：从所述REE操作系统获取一个或多个动态库，并将所述一个或多个动态库存储在所述TEE操作系统的内存空间中，其中，所述一个 或多个动态库被记录在所述目标TA的目标文件中，可选的，所述目标文件为所述目标TA的可执行文件。
在一种可能的实现方式中，所述加载模块用于：根据目标权限信息判断所述目标TA是否具有调用所述目标动态库的权限；基于所述目标TA具有调用所述目标动态库的权限，将所述目标动态库加载到所述目标TA的内存空间中。
在一种可能的实现方式中于，所述TEE操作系统还包括TEE内存模块，所述TEE内存模块用于：获取所述目标TA响应于所述目标服务的运行请求发送的内存请求，所述内存请求用于向所述TEE操作系统申请运行所述目标服务所需的内存；响应于所述内存请求，向所述REE操作系统获取内存分配信息，所述内存分配信息用于指示所述REE操作系统将第一内存分配给所述TEE操作系统；将所述第一内存分配给所述目标TA。
在一种可能的实现方式中，所述TEE内存模块具体用于：将所述第一内存配置为安全内存；将配置为安全内存的所述第一内存分配给所述目标TA。
在一种可能的实现方式中，所述TEE内存模块还用于：在将所述第一内存分配给所述目标TA之后，接收所述目标TA发送的TA内存释放请求，所述TA内存释放请求用于请求所述TEE操作系统释放所述第一内存；响应于所述TA内存释放请求，释放所述第一内存。
在一种可能的实现方式中，所述TEE内存模块具体用于：将所述第一内存配置为非安全内存；释放被配置为非安全内存的所述第一内存。
在一种可能的实现方式中，所述TEE内存模块还用于：在释放所述第一内存之后，向所述REE操作系统发送TEE内存释放请求，所述TEE内存释放请求用于请求所述REE操作系统释放所述第一内存。
示例性的，根据发明内容中第二方面提供的方案，以采用集成的方式划分各个功能单元的情况下，本申请第七方面提供一种TEE操作系统，TEE操作系统可以包括：启动模块，用于启动目标TA，所述目标TA为所述一个或多个TA中的任意一个TA；动态库提供模块，用于为所述目标TA提供目标动态库，所述目标动态库由所述目标TA加载至所述目标TA的内存空间中，以支持所述目标TA运行目标服务，所述目标服务为所述目标TA提供的服务。
在一种可能的实现方式中，所述动态库提供模块可以包括：获取请求接收单元，用于接收所述目标TA响应于所述目标服务的运行请求发送的获取请求，所述获取请求用于指示所述TEE操作系统获取所述目标动态库；动态库获取单元，用于响应于所述获取请求，获取所述目标动态库。
在一种可能的实现方式中，所述动态库获取单元用于从所述REE操作系统获取所述目标动态库。
在一种可能的实现方式中，所述动态库获取单元具体用于：向所述REE操作系统发送所述目标动态库的传递请求，所述传递请求包括所述目标动态库的标识，所述传递请求用于指示所述REE操作系统将所述目标动态库发送到所述TEE操作系统；接收所述REE操作系统发送的所述目标动态库。
在一种可能的实现方式中，所述动态库获取单元具体用于：从所述REE操作系统获取加密文件；对所述加密文件进行解密，得到解密文件，所述解密文件包括所述目标动态库。
在一种可能的实现方式中，所述动态库提供模块具体用于：接收所述REE操作系统响应 于第二传递请求发送的所述目标动态库，所述目标服务的运行请求由部署在所述REE操作系统的目标客户端应用程序CA发送，所述目标CA有调用所述目标服务的权限，所述第二传递请求由所述目标CA响应于第一传递请求发送给所述REE操作系统，所述第一传递请求由所述目标TA响应于所述目标服务的运行请求发送给所述目标CA。
在一种可能的实现方式中，所述启动模块包括：从所述REE操作系统获取一个或多个动态库，并将所述一个或多个动态库存储在所述TEE操作系统的内存空间中，其中，所述一个或多个动态库被记录在所述目标TA的目标文件中，可选的，所述目标文件为所述目标TA的可执行文件。
在一种可能的实现方式中，所述动态库提供模块包括：访问请求接收单元，用于接收所述目标TA发送的访问请求，所述访问请求用于请求访问所述TEE操作系统的内存空间，所述目标动态库存储在所述TEE操作系统的内存空间；允许信息发送单元，用于基于所述目标TA具有访问所述TEE操作系统的内存空间的权限，向所述目标TA发送允许访问信息，所述允许访问信息用于通知所述目标TA访问所述TEE操作系统的内存空间。
在一种可能的实现方式中，所述访问请求用于请求访问所述目标动态库；所述允许信息发送单元用于：基于所述目标TA具有访问所述TEE操作系统的内存空间的权限，并且，基于所述目标TA具有调用所述目标动态库的权限，向所述目标TA发送所述应答信息。
示例性的，根据第三方面提供的方案，以采用集成的方式划分各个功能单元的情况下，本实施例八方面提供一种TA，该TA对应于第三方面方案中的目标TA，该TA可以包括：加载模块，用于响应于目标服务的运行请求，加载目标动态库到所述目标TA的内存空间中，所述目标TA为所述一个或多个TA中的任意一个TA，所述目标服务为所述目标TA提供的服务；服务运行模块，用于利用所述目标动态库运行所述目标服务。
在一种可能的实现方式中，所述目标动态库由所述TEE操作系统提供给所述目标TA。
在一种可能的实现方式中，所述加载模块用于：向所述TEE操作系统发送获取请求，所述获取请求用于请求所述TEE操作系统获取所述目标动态库；将所述TEE操作系统获取到的所述目标动态库加载到所述目标TA的内存空间中。
在一种可能的实现方式中，所述目标动态库为所述TEE操作系统从所述REE操作系统获取的。
在一种可能的实现方式中，所述加载模块用于：向目标客户端应用程序CA发送第一传递请求，所述目标CA部署在所述REE操作系统中，并且有调用所述目标服务的权限，所述目标服务的运行请求由所述目标CA发送；将所述TEE操作系统接收的所述目标动态库加载到所述目标TA的内存空间中，所述目标动态库由所述REE操作系统响应于第二传递请求发送给所述TEE操作系统，所述第二传递请求由所述目标CA响应于所述第一传递请求发送给所述REE操作系统。
在一种可能的实现方式中，所述加载模块用于：从所述TEE操作系统的内存空间加载所述目标动态库到所述目标TA的内存空间中。
在一种可能的实现方式中，所述加载模块具体用于：向所述TEE操作系统发送访问请求，所述访问请求用于请求访问所述TEE操作系统的内存空间，所述目标动态库存储在所述TEE操作系统的内存空间中；基于接收到所述TEE操作系统发送的允许访问信息，访问将所述 TEE操作系统的内存空间中的所述目标动态库，并将所述目标动态库加载到所述目标TA的内存空间中。
示例性的，根据第四方面提供的方案，以采用集成的方式划分各个功能单元的情况下，本申请实施例第九方面提供了一种REE操作系统，该REE操作系统可以包括：文件获取模块，用于响应于传递请求，获取目标文件，所述传递请求用于指示所述REE操作系统将所述目标文件传递至所述TEE操作系统；REE通信模块，用于将所述目标文件发送给所述TEE操作系统。
在一种可能的实现方式中，所述目标文件为目标动态库，所述目标动态库用于加载至目标TA的内存空间中，以支持所述目标TA运行目标服务，所述目标服务为目标TA提供的服务，所述目标TA为所述TEE操作系统上部署的一个或多个TA中的任意一个TA。
在一种可能的实现方式中，所述传递请求为所述TEE操作系统发送的，或者，所述传递请求为目标客户端应用程序CA发送的，所述目标CA有调用所述目标服务的权限。
示例性的，根据第五方面提供的方案，以采用集成的方式划分各个功能单元的情况下，本申请实施例第十方面提供了一种TEE操作系统，该TEE操作系统可以包括：内存申请模块，用于向所述REE操作系统发送第一内存请求，所述第一内存请求用于请求所述REE操作系统为是TEE操作系统分配内存；内存接收模块，用于接收所述REE操作系统发送的内存分配信息，所述内存分配信息用于指示为所述TEE操作系统分配的内存为目标内存；内存配置模块，用于将所述目标内存配置为安全内存。
在一种可能的实现方式中，所述内存申请模块还用于：
在向所述REE操作系统发送第一内存请求之前，获取目标TA发送的第二内存请求，所述目标TA为所述TEE操作系统上部署的一个或多个TA中的任意一个TA，所述第二内存请求用于向所述TEE操作系统申请内存。
在一种可能的实现方式中，所述内存配置模块还用于：
在将所述目标内存配置为安全内存之后，将所述目标内存分配给所述目标TA。
在一种可能的实现方式中，所述第二内存请求为所述目标TA响应于目标服务的运行请求发送的，所述第二内存请求用于申请所述目标TA运行所述目标服务所需的内存，所述目标服务为所述目标TA提供的服务。
在一种可能的实现方式中，所述第一内存请求申请的内存大于所述第二内存申请的内存。
在一种可能的实现方式中，所述内存申请模块还用于：
在所述内存配置模块将所述第一内存分配给所述目标TA之后，接收所述目标TA发送的TA内存释放请求，所述TA内存释放请求用于请求所述TEE操作系统释放所述目标内存；
响应于所述TA内存释放请求，释放所述目标内存。
在一种可能的实现方式中，所述内存配置模块还用于，在所述内存配置模块释放所述目标内存之后，将所述目标内存配置为非安全内存；
所述内存申请模块还用于向所述REE操作系统发送TEE内存释放请求，所述TEE内存释放请求用于请求所述REE操作系统释放所述目标内存。
本申请实施例第十一方面提供一种计算机设备，包括处理器和存储器，该处理器在运行所述存储器存储的计算机指令时，执行如本申请实施例第一方面或第一方面的任意一种可能 的实现方式，或者执行如本申请实施例第二方面或第二方面的任意一种可能的实现方式，或者执行如本申请实施例第三方面或第三方面的任意一种可能的实现方式，或者执行如本申请实施例第四方面或第四方面的任意一种可能的实现方式，或者执行如本申请实施例第五方面或第五方面的任意一种可能的实现方式。
本申请实施例第十二方面提供了一种计算机可读存储介质，包括指令，当所述指令在计算机上运行时，使得计算机执行如本申请实施例第一方面或第一方面的任意一种可能的实现方式，或者执行如本申请实施例第二方面或第二方面的任意一种可能的实现方式，或者执行如本申请实施例第三方面或第三方面的任意一种可能的实现方式，或者执行如本申请实施例第四方面或第四方面的任意一种可能的实现方式，或者执行如本申请实施例第五方面或第五方面的任意一种可能的实现方式。
本申请实施例第十三方面提供了一种计算机程序产品(或称计算机程序)，包括指令，当所述指令在计算机上运行时，使得计算机执行如本申请实施例第一方面或第一方面的任意一种可能的实现方式，或者执行如本申请实施例第二方面或第二方面的任意一种可能的实现方式，或者执行如本申请实施例第三方面或第三方面的任意一种可能的实现方式，或者执行如本申请实施例第四方面或第四方面的任意一种可能的实现方式，或者执行如本申请实施例第五方面或第五方面的任意一种可能的实现方式。
由于本申请实施例提供的各装置可用于执行前述对应的实施例方法，因此本申请各装置实施例所能获得到的技术效果可参考前述对应的方法实施例，此处不再赘述。
附图说明
图1是终端设备的一个结构示意图；
图2A是现有技术中指纹TA的启动过程示意图；
图2B是现有技术中指纹TA执行指纹比对服务的过程示意图；
图2C是TA的内存结构示意图；
图3A是现有技术中指纹TA的内存结构示意图；
图3B是现有技术中REE的存储介质的内存结构示意图；
图3C是本申请实施例中指纹TA加载动态库1的示意图；
图4是本申请TA的运行方法一个实施例示意图；
图5是本申请TA的运行方法另一个实施例示意图；
图6是本申请REE操作系统向TEE操作系统传递动态库的方法一个实施例示意图；
图7是本申请REE操作系统向TEE操作系统传递动态库的方法另一个实施例示意图；
图8是现有内存分配方法的示意图；
图9是本申请内存分配方法一个实施例示意图；
图10是本申请TEE操作系统一个实施例示意图；
图11是本申请TEE操作系统另一个实施例示意图；
图12是本申请TA一个实施例示意图；
图13是本申请REE操作系统一个实施例示意图；
图14是本申请TEE操作系统另一个实施例示意图；
图15是本申请计算机设备一个实施例示意图。
具体实施方式
本申请实施例提供了一种可信应用程序的运行方法、信息处理方法、内存分配方法及装置。本申请实施例方法可以应用于计算机系统，示例性的，该计算机系统可以为终端设备，常见的终端设备例如包括：手机、平板电脑、台式电脑、可穿戴设备(例如智能手表)、智能家庭设备(例如智能音响或智能电视)、车载智能设备、无人驾驶设备、虚拟现实设备、增强现实设备、混合现实设备、以及人工智能设备等。下面以计算机系统为终端设备为例，结合附图，对本申请的实施例进行描述。
随着移动互联网的发展，智能终端设备的应用越来越广泛。为了提供智能终端设备的丰富功能和可扩展属性，终端设备通常是构建在提供开放式操作环境的富执行环境(rich execution envrironment，REE)之上，REE也被称作一般运行环境，主要包括运行于通用处理器上的富操作系统(rich operating system，Rich OS)，或称REE操作系统，和运行在REE操作系统上的客户端应用程序(client application，CA)。但是，开放式的环境为信息泄露和恶意软件传播提供了通道，使终端设备暴露在不断增长的多种形式的攻击之下，导致终端设备的安全问题日益凸显。
为了保护用户隐私和信息安全，全球平台组织提出了可信执行环境(trusted execution environment，TEE)标准。图1是终端设备的一个结构示意图，参考图1，终端设备构建在REE和TEE之上，TEE是运行于REE之外的独立运行环境，主要包括可信操作系统(trusted operating system，Trusted OS)，或称TEE操作系统，和运行在TEE操作系统上的一个或多个可信应用程序(trusted application，TA)，TEE与REE隔离。在一种可能的实现方式中，可以由监控系统(monitor系统)完成处理器在REE操作系统和TEE操作系统之间的切换，当处理器上运行REE的进程时，TEE的进程被挂起，当处理器上运行TEE的进程时，REE的进程被挂起。运行在TEE操作系统上的每一个TA都是独立的，TA不能未经授权访问另一个TA的安全资源。REE无法直接访问TEE的硬件和软件资源，二者只能通过授权的应用程序编程接口(application programming interface，API)进行交互，为了简化描述，本申请描述的TEE中的进程(比如TA的进程或TEE操作系统的进程)和REE中的进程(比如CA的进程或REE操作系统的进程)之间的交互，不再强调是通过API实现的。因此TEE能够抵御在REE侧发生的软件攻击。例如，终端设备的部分存储介质(称作TEE存储介质)被配置为安全属性，只能被TEE访问；终端设备的其他存储介质(称作REE存储介质)只能被REE访问。TEE存储介质包括TEE内存，TEE内存包括分配给TA的内存(TA内存)和TEE操作系统的内存(TEE操作系统内存)。需要说明的是,TEE存储介质和REE存储介质在物理上可能是分开的，也可能是集成在一起的。
CA可以通过调用TEE的API区访问TA，以调用TA执行安全服务，例如，CA可以请求TA提供与身份验证相关的服务。以该TA为指纹TA，用于执行指纹比对服务为例，下面对指纹TA执行指纹比对服务的过程进行介绍。
首先，对指纹TA的启动过程进行介绍。参考图2A，指纹TA的启动过程包括如下步骤：
201A、TEE操作系统获取对指纹TA的创建请求，并获取CA2传递的指纹TA的目标文件；
假设CA2在运行过程中需要调用指纹TA执行指纹比对服务，而指纹TA尚未启动，CA2可以从REE的ROM中获取指纹TA的目标文件，向TEE操作系统发送对指纹TA的创建请求，并将指纹TA的目标文件传递至TEE操作系统。
202A、TEE操作系统将指纹TA的目标文件存储在TEE文件管理子系统中；
TEE操作系统接收到CA2传递的指纹TA的目标文件后，可以将指纹TA的目标文件存储在TEE操作系统内存中，示例性的，可以将指纹TA的目标文件存储在TEE文件管理子系统中。
203A、TEE操作系统将指纹TA的目标文件加载至指纹TA的内存中，并启动指纹TA的进程。
TEE操作系统可以根据对指纹TA的创建请求为指纹TA分配内存，将指纹TA的目标文件加载至指纹TA的内存中，启动指纹TA，利用指纹TA的进程执行该目标文件。
TEE操作系统启动指纹TA的进程后，指纹TA可以执行指纹比对服务，参考图2B，指纹TA执行指纹比对服务的过程包括如下步骤：
201B、指纹TA获取CA2发送的指纹比对服务的运行请求；
指纹TA启动后，CA2可以向指纹TA发送指纹比对服务请求，以请求指纹TA获取用户指纹，将用户指纹与标准指纹进行比对。
指纹TA获取到CA2发送的指纹比对服务请求后，可以利用指纹TA的目标文件执行指纹比对服务。参考图2C，TA的内存一般包括如下多个段：
1)栈(stack)：用于存放TA的进程临时创建的局部变量；
2)堆(heap)：用于存放TA的进程运行中被动态分配的内存段；
3)数据段(data segment)：通常用来存放程序中已初始化的全局变量；
4)代码段(code segment)：通常用来存放TA的目标文件中可执行代码。
TA的目标文件一般可以从逻辑上被认为包括目标TA运行服务时所利用的运行用程序段。TA一般需要利用多个功能来执行单个服务，TA在实现某个功能时，需要运行代码段的部分代码，并且访问数据段的部分数据，本申请实施例中，将该部分数据和该部分代码称作该功能对应的程序模块。由于TA通常具备多个功能，因此，可以认为TA的代码段和数据段中包括多个程序模块，每个程序模块对应于一个功能。
图2C中以指纹TA的代码段和数据段包括指纹比对服务所需的三个功能对应的程序模块为例，这三个程序模块分别为指纹模块、图像处理模块和比对模块，指纹TA利用这三个程序模块执行指纹比对服务的过程可以参考如下步骤202B至204B。
202B、指纹TA利用指纹模块调用指纹识别设备获取用户指纹；
203B、指纹TA利用图像处理模块对获取到的用户指纹进行图像处理；
204B、指纹TA利用比对模块对处理后的用户指纹与标准指纹进行比对，得到指纹比对服务的执行结果；
指纹比对服务的执行结果用于指示用户指纹与标准指纹是否一致。
205B、指纹TA将指纹比对服务的执行结果返回至CA2。
CA获取指纹比对服务的执行结果后，可以实现对当前用户的身份验证，根据身份验证结果接受或拒绝用户访问被保护内容(加密文档或付款界面等)的请求。
指纹模块对应的功能是驱动指纹识别设备检测用户的指纹，为了驱动不同厂家的指纹识 别设备，需要编译不同的指纹模块。同一型号的不同终端设备可能采用不同厂家生产的不同型号的指纹识别设备，而同一型号的各个终端设备的镜像要求一致，因此，需要为该型号终端设备所采用的各个型号的指纹识别设备编译对应的指纹模块，假设有多个型号的指纹识别设备，以n代表型号的数目，那么需要在指纹TA的目标文件中加入n个指纹模块，假设n个指纹模块分别为指纹模块1、指纹模块2、……、指纹模块n。TEE操作系统启动时，可以确定指纹识别设备的型号，从而确定该型号的指纹识别设备所对应的指纹模块，但是，由于各个指纹模块均被编译在指纹TA的目标文件中，因此，创建指纹TA时，仍然需要将所有指纹模块加载到TA的内存中，图3A为指纹TA的内存的结构。该型号的终端设备的出货量越大，n的数值越大，指纹TA的目标文件越大，指纹TA占用的TEE内存越大，造成TEE内存的浪费。
为了节约TEE内存，现有技术提出编译多个指纹TA的目标文件，每个指纹TA的目标文件添加一个型号的指纹识别设备对应的指纹模块，假设有n个型号的指纹识别设备，那么需要编译n个指纹TA的目标文件，并将编译的n个指纹TA的目标文件存储在REE存储介质中，图3B为REE存储介质中n个指纹TA(指纹TA1、指纹TA2、……、指纹Tan)的目标文件的示意图。TEE操作系统启动时，可以确定指纹识别设备的型号，从而确定该型号的指纹识别设备所对应的指纹TA。编译后的n个指纹TA的目标文件存储在REE的存储设备中，比如，可以存储在REE的ROM中。由于不同的指纹TA之间存在大量重复的程序内容，例如stack、heap中的内容，以及代码段和数据段中的公用程序模块，比如图2B对应的实施例中的图像处理模块和比对模块，因此，会大量浪费REE的存储资源。
为了节约TEE的存储资源和REE的存储资源，继续以上述指纹比对服务的应用场景为例，本申请提出将指纹模块1至指纹模块n分别编译为单独的动态库，例如使用GNU编译器套件(GNU compiler collection，gcc)分别将指纹模块1至指纹模块n编译为动态库1至动态库n，编译时可以启动“-fPIC”选项，链接时使用“-share”；将各个动态库的相关信息(比如动态库中函数的标识或称符号等)嵌入到指纹TA的目标文件中。为了提高文件的安全性，可选的，可以分别对动态库1、动态库2、……、动态库n以及指纹TA的目标文件进行加密，或者进行加密和签名，得到动态库1的加密文件、动态库2的加密文件、……、动态库n的加密文件以及指纹TA的加密文件，将各加密文件存储在REE的存储设备中。信息的签名用于对信息进行验证，对信息进行加密和签名，示例性的，具体可以为先对信息进行加密，之后生成加密信息签名，或者，先生成信息的签名，之后对信息和其签名进行加密，在本申请提供的实施例中，以将TA所需调用的动态库加密签名后保存在REE的存储设备中为例，在实际应用中，REE中保存的动态库进也可以未经过加密签名，或者仅经过加密，但是未经过签名。图3C示出了指纹TA加载动态库1的示意图，图3C仅用于简洁的示出指纹TA加载动态库1的过程，图3C中省略的REE和TEE中的其他部分(比如REE操作系统和TEE操作系统等)可以参考图1进行理解。和为每个指纹模块均编译一个指纹TA相比，本申请有利于减少重复的程序内容，节约了REE的存储资源。继续参考图3C，REE可以将所用指纹识别设备的型号对应的动态库(假设为动态库1)的加密文件传递至TEE，TEE操作系统对其解密验证后，将得到的动态库1加载至指纹TA的内存中，以使得指纹TA执行指纹比对服务。
下面对本申请提供的TA的运行方法进行具体介绍，下述方法实施例中提到的目标TA可以为、但不限定为上述指纹TA。
图4为本申请提供的TA的运行方法一个实施例示意图，参考图4，本申请TA的运行方法一个实施例可以包括如下步骤：
401、TEE操作系统启动目标TA；
TEE操作系统可以获取REE操作系统传递的目标TA的加密文件，对目标TA的加密文件进行解密验证，得到目标TA的目标文件，在启动目标TA的过程中，将目标TA的目标文件加载至为目标TA分配的内存中，创建目标TA的进程执行目标文件中的代码段。
示例性的，CA需要调用目标TA的功能时，可以通过SDK提供的接口来请求TEE操作系统创建目标TA，之后，CA使用libteec提供的opensession接口请求TEE操作系统将目标TA在TEE中运行。
402、基于目标TA获取到目标服务的运行请求，目标TA向TEE操作系统发送目标动态库的加载请求；
目标TA的进程启动后，可以被TEE中的其他TA或REE中的CA调用，来执行目标服务。假设目标TA需要利用目标功能来执行目标服务，本申请实施例中，可以将目标功能对应的代码段和数据段等封装为目标动态库，目标动态库的相关信息(比如符号的引用、符号表和重定位信息等)被嵌入到目标TA的目标文件中，目标TA在执行目标服务时可以调用目标动态库。
在本申请实施例中，可以将目标动态库的加密文件存储在REE的存储设备中，目标TA需要调用目标动态库时，可以向TEE操作系统发送目标动态库的加载请求，加载请求中可以包括目标动态库的标识，或者，还可以包括目标TA的标识。示例性的，目标TA可以调用dlopen接口来请求TEE操作系统加载目标动态库。
403、TEE操作系统判断TEE操作系统内存中是否存储有目标动态库，若否，则执行步骤404，若是，则执行步骤409；
TEE操作系统接收到目标TA发送的加载请求后，可以利用目标动态库的标识，或利用目标动态库的标识和目标TA的标识，在TEE操作系统内存中查找目标动态库，若TEE操作系统内存中未存储有目标动态库，则可以执行步骤404，若TEE操作系统内存中存储有目标动态库，则可以执行步骤409。
404、TEE操作系统向REE操作系统发送对目标动态库的传递请求；
基于TEE操作系统内存中未存储目标动态库，TEE操作系统可以向REE操作系统发送对目标动态库的传递请求。假设REE操作系统中的代理(agent)进程用于向TEE操作系统传递动态库的加密文件，TEE操作系统可以唤醒代理进程，向代理进程发送传递请求，传递请求可以包括目标动态库的标识，或者，包括目标动态库的标识和目标TA的标识。
405、REE操作系统根据传递请求从REE的存储设备中获取目标动态库的加密文件；
动态库的加密文件均存储在REE的存储设备中，具体的，假设存储在vendor/bin目录下，代理进程可以根据目标动态库的标识，或者，根据目标动态库的标识和目标TA的标识在vendor/bin目录下查找目标动态库的加密文件。示例性的，为了唯一标识目标TA所需调用的目标动态库，目标动态库的加密文件的文件名可以为uuid1-fingerdriver1.so.sec，REE 操作系统可以根据接收到的传递请求中目标TA的标识“uuid1”和目标动态库的标识“fingerdriver1”在vendor/bin目录下查找到目标动态库的加密文件。
406、REE操作系统将目标动态库的加密文件传递至TEE操作系统；
例如，REE的代理进程在查找到目标动态库的加密文件后，可以将目标动态库的加密文件传递至TEE操作系统。
407、TEE操作系统对目标动态库的加密文件进行解密验证，得到目标动态库；
TEE操作系统可以对目标动态库的加密文件进行解密，得到目标动态库，并对目标动态库进行签名验证。若通过验证，表明目标动态库未被修改，可以继续执行步骤408；若未通过验证表明目标动态库可能被修改，可以执行其他操作，例如再次执行步骤404。
408、TEE操作系统将目标动态库存储在TEE操作系统内存中；
TEE操作系统得到目标动态库后，可以将目标动态库存储在TEE操作系统内存(例如文件(file)系统)中。
409、TEE操作系统将目标动态库加载至目标TA的内存中；
现有动态链接技术中，一般为应用程序设置访问系统内存的权限和配置自身内存属性的权限，使得应用程序可以将所需调用的动态库加载至自己的内存空间中，并为动态库配置相应属性。为应用程序配置访问系统内存的权限和配置自身内存属性的权限，存在一定安全隐患，为了提高TEE的安全性，本申请实施例中，可以不为TA设置访问TEE操作系统内存的权限和配置自身内存属性的权限，由TEE操作系统将目标动态库加载至目标TA的内存中，该加载过程一般可以具体包括，TEE操作系统将目标动态库映射或装载到目标TA的内存空间，进行符号解析和重定位，对目标动态库对应的内存配置相应属性，例如，将目标动态库中代码段对应的内存配置为可执行属性，将目标动态库中数据段对应的内存配置为只读。
410、目标TA利用目标动态库执行目标服务；
基于目标动态库被加载至目标TA的内存空间，目标TA可以利用目标动态库的功能执行目标服务。需要说明的是，目标TA可以利用目标动态库的功能执行目标服务，不是限定目标TA仅利用目标动态库便可以执行目标服务，而是用于限定目标TA至少需要利用目标动态库来执行目标服务，在实际应用中，除了利用目标动态库，目标TA还可以利用目标TA的目标文件中的内容，或者，利用其他动态库来执行目标服务。示例性的，目标TA可以调用dlsym接口来获取目标动态库中的函数的代码，完成后，可以调用dlclose接口结束调用。
TA的部分功能对应的程序段被单独封装为动态库，提高了TA加载策略的灵活性。在图4对应的实施例中，TA需要调用动态库时，TEE操作系统可以向REE操作系统获取动态库的加密文件，该加密文件通过解密验证后，TEE操作系统可以将该动态库加载至TA的内存中，以使得TA执行动态库对应的功能。以前述指纹比对服务的应用场景为例，TEE操作系统可以将指纹识别设备的型号所对应的动态库存储在TEE操作系统内存中，而不获取其他型号对应的动态库，有利于减少TEE内存的浪费。并且，指纹TA运行的过程中，可能无需执行指纹比对服务，图4对应的实施例中，TEE操作系统在接收到TA对目标动态库的加载请求时，才向REE获取目标动态库，将其加载至TA的内存中，有利于进一步节约TEE内存。
图4对应的实施例仅作为一种举例，在实际应用中，可以根据需要不执行步骤403至步骤408中的全部或部分步骤，例如，在步骤402后，直接执行步骤409。
在一种可能的实现方式中，TEE操作系统将目标动态库存储在TEE操作系统内存之后，TEE操作系统在接收到其他TA对目标动态库的加载请求时，可以将目标动态库加载至其他TA的内存中。通过多个TA共享同一动态库，有利于进一步节约TEE的安全内存。
运行在TEE中的每一个TA都是独立的，TA不能未经授权访问另一个TA的安全资源，若将TA动态链接的动态库视为TA的安全资源，为了提高TEE的安全性，在一种可能的实现方式中，TEE操作系统可以为目标动态库设置目标权限信息，目标权限信息用于表示哪些TA具有调用目标动态库的权限，或者表示哪些TA不具有调用目标动态库的权限；图4对应的方法实施例，在执行步骤408之后，在执行步骤409之前，还可以执行如下步骤：
411、TEE操作系统根据目标权限信息判断目标TA是否具有调用目标动态库的权限，若是，则执行步骤409，若否，则执行步骤412；
基于TEE操作系统获取到目标TA对目标动态库的加载请求，TEE操作系统可以读取目标动态库的目标权限信息，根据目标权限信息判断目标TA是否具有调用目标动态库的权限，若具有该权限，则执行步骤409，若不具有该权限，则执行步骤412。
在一种可能的实现方式中，目标权限信息可以为具有调用目标动态库的权限的TA的标识。为了便于描述，将具有调用目标动态库的权限的TA的标识称作TA标识。
在一种可能的实现方式中，可以将TA标识添加至目标动态库的文件名中，那么，TEE操作系统可以从目标动态库的文件名中读取TA标识，判断目标TA的标识与TA标识是否一致，若一致，则判定目标TA具有调用目标动态库的权限；若不一致，则判定目标TA不具有调用目标动态库的权限。
本申请实施例中，不限定目标动态库仅可以被单个TA调用，在一些应用场景中，可以被多个TA调用，那么目标权限信息包括多个TA标识，每个TA标识对应于一个可以调用该目标动态库的TA，这种情况下，目标TA的标识只要和其中的任意一个TA标识一致，便可以判定目标TA具有调用目标动态库的权限；若目标TA的标识和其中的所有TA标识均不一致，可以判定目标TA不具有调用目标动态库的权限。
412、TEE操作系统执行其他操作。
若目标TA不具有调用目标动态库的权限，TEE操作系统可以拒绝目标TA的对目标动态库的加载请求。
为了提高目标权限信息的安全性，在一种可能的实现方式中，可以对目标权限信息进行加密签名，此时，步骤407可以具体执行如下步骤：
4071、TEE操作系统对目标动态库的加密文件进行解密验证，得到目标动态库和目标权限信息；
示例性的，在利用加密工具对目标动态库进行加密前，可以在加密工具的配置信息(manifest)中的“gpd.ta.service_name”字段配置可以调用目标动态库的TA的标识(简称TA标识)，例如TA标识可以为uuid2，并将“gpd.ta.islib：”配置为“true”，以指示该目标动态库仅可以被该标识对应的TA调用。TEE操作系统在对目标动态库的加密文件进行解密时，可以获取配置信息，从中提取TA标识，确定该目标动态库仅可以被该TA标识对应的TA运行。
步骤408可以具体执行如下步骤：
4081、TEE操作系统将目标动态库和目标权限信息关联存储在TEE操作系统内存中；
TEE操作系统得到目标动态库和目标权限信息后，为了便于确定目标动态库的目标权限信息，可以将目标动态库和目标权限信息关联存储在TEE操作系统内存(例如文件(file)系统)中。示例性的，TEE操作系统可以将目标权限信息添加至目标动态库的文件名中，以目标权限信息为uuid2为例，存储在TEE操作系统内存中的目标动态库的文件名可以为“uuid2-fingerdriver1.so”，TEE操作系统通过目标动态库的文件名便可以确定目标动态库对应的目标权限信息。
在图4对应的实施例中，为了提高TEE的安全性，不为TA设置访问TEE操作系统内存的权限和配置自身内存属性的权限，由TEE操作系统将目标动态库加载至目标TA的内存中，在本申请TA的运行方法另一个实施例中，也可以选择为TA设置访问TEE操作系统内存的权限和配置自身内存属性的权限。参考图5，本申请TA的运行方法另一个实施例可以包括如下步骤：
501、TEE操作系统启动目标TA的进程；
步骤501可以参考上述步骤401的描述进行理解，此处不再赘述。
502、基于获取到目标服务的运行请求，目标TA判断TEE操作系统内存中是否存储有目标动态库，若否，则执行步骤503，若是，则执行步骤509；
假设目标TA需要利用目标动态库的功能来执行目标服务，基于目标TA获取到目标服务的运行请求，目标TA可以利用目标动态库的标识，或利用目标动态库的标识和目标TA的标识，在TEE操作系统内存中查找目标动态库，若TEE操作系统内存中未存储有目标动态库，则可以执行步骤503，若TEE操作系统内存存储有目标动态库，则可以执行步骤509。
503、目标TA向TEE操作系统发送目标动态库的获取请求；
基于TEE操作系统内存中未存储有目标动态库，目标TA可以向TEE操作系统发送目标动态库的获取请求，获取请求中可以包括目标动态库的标识，或者，还可以包括目标TA的标识。示例性的，目标TA可以调用dlopen接口来请求TEE操作系统获取目标动态库，并将目标动态库存储在TEE操作系统内存中。
504、TEE操作系统向REE操作系统发送对目标动态库的传递请求；
505、REE操作系统根据传递请求从REE的存储设备中获取目标动态库的加密文件；
506、REE操作系统将目标动态库的加密文件传递至TEE操作系统；
507、TEE操作系统对目标动态库的加密文件进行解密验证，得到目标动态库；
508、TEE操作系统将目标动态库存储在TEE操作系统内存中；
步骤504至步骤508可以参考上述步骤404至步骤408的描述，此处不再赘述。
509、目标TA将目标动态库加载至目标TA的内存中；
TEE操作系统将目标动态库存储在TEE操作系统内存之后，可以通知目标TA已获取到该目标动态库，目标TA可以将目标动态库加载至自己的内存中，该加载过程一般可以具体包括，目标TA将目标动态库映射或装载到目标TA的内存空间，对目标动态库中的符号进行解析和重定位，对目标动态库对应的内存配置相应属性，例如，将目标动态库中代码段对应的内存 配置为可执行属性，将目标动态库中数据段对应的内存配置为只读。
510、目标TA利用目标动态库执行目标服务；
示例性的，目标TA可以调用dlsym接口来获取目标动态库中的函数的代码，完成后，可以调用dlclose接口结束调用。
图5对应的实施例仅作为一种举例，在实际应用中，可以根据需要不执行步骤502至步骤508中的全部或部分步骤，例如，在目标TA获取到目标服务的运行请求后，直接执行步骤509。
为了提高TEE的安全性，在一种可能的实现方式中，TEE操作系统可以为目标动态库设置目标权限信息，目标权限信息用于表示哪些TA具有调用目标动态库的权限，或者表示哪些TA不具有调用目标动态库的权限。在步骤510之前，图5对应的方法实施例还可以包括如下步骤：
511、目标TA向TEE操作系统发送对TEE操作系统内存中目标动态库的访问请求；
基于TEE操作系统将目标动态库存储在TEE操作系统内存，目标TA可以向TEE操作系统发送对TEE操作系统内存中目标动态库的访问请求，该访问请求可以包括目标动态库的标识。
512、TEE操作系统根据目标权限信息判断目标TA是否具有调用目标动态库的权限，若是，则执行步骤513，若否，则执行步骤514；
TEE操作系统根据目标权限信息判断目标TA是否具有调用目标动态库的权限的方法可以参见前述步骤409的相关描述，此处不再赘述。
513、TEE操作系统向目标TA发送目标动态库的允许访问信息；
基于目标TA获取到TEE操作系统发送的目标动态库的允许访问信息，目标TA可以执行步骤509。
514、TEE操作系统向目标TA发送目标动态库的拒绝访问通知；
基于目标TA获取到TEE操作系统发送的目标动态库的拒绝访问通知，目标TA无法加载目标动态库，从而有利于防止不具有调用目标动态库的权限的TA加载目标动态库，防止目标动态库被泄露。
在一些实施例中，TEE操作系统在接收到目标TA的访问请求后，还可以判断目标TA是否具有访问TEE操作系统内存的权限，基于目标TA具有访问TEE操作系统内存的权限，并且目标TA具有调用目标动态库的权限，TEE操作系统才向目标TA发送目标动态库的允许访问信息。
在上述本申请TA的运行方法中，目标动态库是在目标TA启动后被加载至目标TA的内存中的。在一种可能的实现方式中，TEE操作系统可以在目标TA初始化的过程中将目标动态库加载至目标TA的内存中，具体的，在目标TA初始化的过程，TEE操作系统可以根据目标TA的目标文件中记录的动态库的标识，获取目标TA的目标文件中记录的全部或部分动态库(包括或不包括目标动态库)，例如，可以参考步骤404至步骤408，TEE操作系统将目标TA调用的全部或部分动态库存储在TEE操作系统内存中；之后TEE操作系统可以直接将各动态库加载至目标TA的内存中，或者，基于获取到目标TA发送的目标服务的加载请求，若目标动态 库已被存储在TEE操作系统内存中，则TEE操作系统将目标动态库从TEE操作系统内存中加载至目标TA的内存中。
由于目标TA获取到目标服务的运行请求前，目标动态库可能已经存储在TEE操作系统内存中，甚至已经加载至目标TA的内存中，有利于提高目标服务的完成效率。
但是，TA一般根据所需执行的服务来调用相应的动态库，也就是说，目标TA在运行过程中可能不需要调用其目标文件中记录的部分动态库，而TEE操作系统在目标TA初始化的过程中将目标TA可能会调用的各个动态库均加载至目标TA的内存中，容易造成TEE的安全内存的浪费。为了平衡内存资源和加载效率，TEE操作系统可以从目标文件中记录的各动态库中预测被调用的几率更高的一个或多个动态库，在启动目标TA的过程中获取预测到的相应动态库。
在上述本申请TA的运行方法中，REE操作系统是基于获取到TEE操作系统发送的对目标动态库的传递请求来执行步骤405和步骤406的。在一种可能的实现方式中，即使REE操作系统未获取到TEE操作系统发送的对目标动态库的传递请求，REE操作系统也可以主动执行步骤405和步骤406，将目标动态库的加密文件传递至TEE操作系统，有利于减少REE与TEE之间的交互，节约终端设备的计算资源。
在一种可能的实现方式中，参考图6，REE操作系统向TEE操作系统传递动态库的一个实施例可以包括：
601、基于目标CA请求TEE操作系统创建目标TA，目标CA获取目标TA所需调用的各动态库的标识；
可以将目标CA可能调用的TA的运行信息记录在目标CA的目标文件中，例如，可以将目标TA所需调用的各动态库的标识与目标TA的标识关联记录在目标CA的目标文件中，目标CA需要调用目标TA执行服务时，可以查找目标TA所需调用的各动态库的标识。
602、目标CA向REE操作系统发送对动态库的传递请求，传递请求包括获取到的各动态库的标识；
603、REE操作系统根据传递请求从REE的存储设备中获取各动态库的加密文件；
604、REE操作系统将各动态库的加密文件传递至TEE操作系统。
TEE操作系统获取到TEE操作系统传递的各动态库的加密文件后，可以对其解密验证，并将得到的各动态库存储在TEE操作系统内存中。之后，TEE操作系统可以在目标TA初始化的过程中，将各动态库加载至目标TA的内存中，或者，在获取到目标TA发送的目标动态库的加载请求时，将其中的目标动态库加载至目标TA的内存中，或者，目标TA可以自己将目标动态库加载至自己的内存中。
在一种可能的实现方式中，参考图7，REE操作系统向TEE操作系统传递动态库的方法另一个实施例可以包括：
701、目标CA向目标TA发送目标服务的运行请求；
基于目标TA已启动，目标CA可以请求目标TA执行目标服务。
702、目标TA向目标TA发送对目标动态库的第一传递请求；
目标TA基于获取到目标服务的运行请求，可以获取在执行目标服务时所需要调用的目标动态库的标识，向目标TA发送对目标动态库的传递请求，为了便于和其他传递请求区分开，将此处的传递请求称作第一传递请求，第一传递请求包括目标动态库的标识。
703、目标CA根据第一传递请求从REE的存储设备中获取目标动态库的加密文件；
可以为目标CA配置访问REE的存储设备的权限，响应于第一传递请求，目标CA可以根据第一传递请求从REE的存储设备中获取目标动态库的加密文件。
704、目标CA向REE操作系统发送对目标动态库的第二传递请求；
目标CA获取到目标动态库的加密文件后，可以将加密文件进行缓存，并向REE操作系统发送对目标动态库的第二传递请求，请求REE操作系统将目标动态库发送至TEE操作系统。为了便于区分，将此处的传递请求称作第二传递请求，第二传递请求可以包括目标动态库的标识。
705、REE操作系统将目标动态库的加密文件传递至TEE操作系统。
响应于第二传递请求，REE操作系统可以将目标CA获取的加密文件传递至TEE操作系统。
TEE操作系统获取到TEE操作系统传递的目标动态库的加密文件后，可以对其解密验证，并将得到的目标动态库存储在TEE操作系统内存中，具体过程可以参考步骤407和步骤408的描述，此处不再赘述。之后，TEE操作系统可以直接将目标动态库加载至目标TA的内存中，或者，在获取到目标TA发送的目标动态库的加载请求时，将TEE操作系统内存中的目标动态库加载至目标TA的内存中，或者，若为TA设置了访问TEE操作系统内存的权限和配置自身内存属性的权限，目标TA可以将目标动态库加载至自己的内存中。
在一种可能的实现方式中，也可以在目标CA的目标文件中可以记录目标TA执行目标服务时所需调用的目标动态库的标识，此时，目标CA需要请求目标TA执行目标服务时，可以无需目标TA发送传递请求便可以执行步骤。
TEE和REE共享内存设备，一般会按照某个比例将部分内存分配给TEE，由TEE将这部分内存的属性配置为安全内存，供TEE使用；其他内存的属性为非安全内存，供REE使用。REE只能访问非安全内存，TEE只能访问安全内存。CA调用TA执行的任务可能需要大量内存，比如人脸识别任务，TA在执行人脸识别任务时需要对大量的图形数据进行计算，产生大量的中间数据，需要较大的内存。
现有技术采用在CA和TA进行业务逻辑上协同，在TA需要大内存的情况下，由CA申请内存，并将其传递到TA，并由TA向TEE操作系统申请将该内存配置为安全内存，并映射给该TA使用；在CA退出前，如果没有主动解除安全属性，比如CA出现异常被杀，那么REE操作系统会将分配给CA的内存回收，并可能分配给REE操作系统的其他进程使用，但是由于该内存的属性为安全内存，REE中的其他进程无法访问，从而导致稳定性异常。
参考图8，下面具体介绍现有内存分配方法，包括如下步骤：
801、目标CA获取REE操作系统响应于目标CA的内存申请反馈的第一内存的地址信息；
目标CA发送的内存申请用于向REE操作系统申请目标TA运行目标服务所需的内存。
802、目标CA将第一内存的地址信息和目标服务的运行请求发送给目标TA；
803、目标TA向TEE操作系统发送安全属性配置请求，安全属性配置请求包括第一内存 的地址信息；
804、TEE操作系统根据安全属性配置请求将第一内存的属性修改为安全内存；
805、目标TA利用第一内存执行目标服务；
806、基于目标TA完成目标服务，目标TA向TEE操作系统发送非安全属性配置请求，非安全属性配置请求包括第一内存的地址信息；
807、TEE操作系统根据非安全属性配置请求将第一内存的属性修改为非安全内存；
808、基于目标TA完成目标服务，目标CA请求REE操作系统释放第一内存。
现有内存分配方法一般存在以下问题：
1)TA执行任务需要大量内存时，TA所需的内存由CA向REE操作系统申请，在TA完成任务时，由CA通知REE操作系统释放相应的内存。若TA未完成任务，而CA异常被杀，REE操作系统会释放分配给CA的内存，CA的内存释放与TEE的内存属性修改不同步，将导致内存属性配置问题，引起整机复位。
2)TA运行需要大量内存时，需要CA和TA之间进行大量的交互操作，CA和TA的开发流程复杂。
为了解决上述问题，本申请提供一种内存分配方法，参考图9，本申请内存分配方法一个实施例可以包括如下步骤：
901、目标TA获取目标CA发送的目标服务的运行请求；
902、目标TA向TEE操作系统发送TA内存请求；
该TA内存请求可以用于申请目标服务所需的内存；
903、TEE操作系统根据TA内存请求判断TEE操作系统中可用的系统内存是否充足，若否，则执行步骤904，若是，则执行步骤907；
904、TEE操作系统向REE操作系统发送TEE内存请求，TEE内存请求所申请的内存大小不小于TA内存请求所申请的内存；
或者，根据可用的安全内存的大小和TA内存请求申请的内存的大小确定TEE内存请求所申请的内存的大小。
905、REE操作系统根据TEE内存请求将第一内存的地址信息传递至TEE操作系统；
REE操作系统可以向TEE操作系统发送内存分配信息，该内存分配信息用于指示TEE操作系统分配的内存为第一内存，在本申请实施例中，以内存分配信息为第一内存的地址信息为例。
906、TEE操作系统将第一内存的属性配置为安全内存；
907、TEE操作系统将第二内存分配给目标TA，第二内存的大小不小于TA内存请求所申请的内存；
908、目标TA利用第二内存执行目标服务；
909、基于目标TA完成目标服务，目标TA向TEE操作系统发送TA内存释放请求，TA内存释放请求包括第二内存的地址信息；
910、TEE操作系统根据TA内存释放请求释放第二内存；
911、基于第一内存空闲，TEE操作系统将第一内存的属性配置为非安全内存；
912、TEE操作系统请求REE操作系统释放第一内存。
TEE操作系统需要归还第一内存(即执行步骤911和步骤912)，若第一内存大于第二内存，TEE操作系统可以一次性归还第一内存，或者可以分多次归还第一内存。
关于TEE操作系统归还第二内存：TEE操作系统可以在步骤910之后立即归还第二内存(即执行步骤911和步骤912)；或者，TEE操作系统可以延迟归还第二内存，例如，TEE操作系统可以判断REE传递的安全内存/或可用的安全内存是否充足，若充足，则立即归还，否则暂不归还；或者，TEE操作系统可以将第二内存保留一定时长，若时长内未被使用，则归还。
本申请实施例有利于解决由CA为TA申请内存时导致的不稳定问题，并有利于降低TEE内存动态扩容方案的复杂度问题。
图9对应的实施例仅作为一种举例，在实际应用中，可以根据需要不执行步骤901、902、903和907至912中的全部或部分步骤。
上述主要从计算机系统中的目标CA、REE操作系统、TEE操作系统和目标TA之间交互的角度对本申请实施例提供的方案进行了介绍。可以理解的是，上述目标CA、REE操作系统、TEE操作系统和目标TA，为了实现上述功能，包含了执行各个功能相应的硬件结构和/或软件模块。本领域技术人员应该很容易意识到，结合本文中所公开的实施例描述的功能，本申请能够以硬件或硬件和计算机软件的结合形式来实现。某个功能究竟以硬件还是计算机软件驱动硬件的方式来执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本申请的范围。
从功能模块的角度，本领域技术人员可以根据上述方法实施例分别对目标CA、REE操作系统、TEE操作系统和目标TA进行功能模块的划分，例如，可以对应各个功能划分各个功能模块，也可以将两个或两个以上的功能集成在一个功能模块中。上述集成的功能模块既可以采用硬件的形式实现，也可以采用软件功能单元的形式实现。
示例性的，根据发明内容中第一方面提供的方案，以采用集成的方式划分各个功能单元的情况下，图10示出了一种TEE操作系统的结构示意图。如图10所示，本申请TEE操作系统1000的一个实施例可以包括：
启动模块1010，用于启动目标TA，目标TA为一个或多个TA中的任意一个TA；
接收模块1020，用于接收目标TA响应于目标服务的运行请求发送的加载请求，加载请求用于指示加载目标动态库，其中，目标服务为目标TA提供的服务；
加载模块1030，用于响应于加载请求，加载目标动态库到目标TA的内存空间中，目标动态库用于支持目标服务的运行。
在一种可能的实现方式中，加载模块1030用于：
从TEE操作系统的内存空间加载目标动态库到目标TA的内存空间中。
在一种可能的实现方式中，加载模块1030包括：
TEE通信单元，用于从REE操作系统获取目标动态库；
动态库加载单元，用于将目标动态库加载到目标TA的内存空间中。
在一种可能的实现方式中，TEE通信单元用于：
向REE操作系统发送目标动态库的传递请求，传递请求包括目标动态库的标识，传递请求用于指示REE操作系统将目标动态库发送到TEE操作系统；
接收REE操作系统发送的目标动态库。
在一种可能的实现方式中，TEE通信单元用于：
从REE操作系统获取加密文件；
对加密文件进行解密，得到解密文件，解密文件包括目标动态库。
在一种可能的实现方式中，启动模块1010用于：
从REE操作系统获取一个或多个动态库，并将一个或多个动态库存储在TEE操作系统的内存空间中，其中，一个或多个动态库被记录在目标TA的目标文件中，目标文件为目标TA的可执行文件。
在一种可能的实现方式中，加载模块1030用于：
根据目标权限信息判断目标TA是否具有调用目标动态库的权限；
基于目标TA具有调用目标动态库的权限，将目标动态库加载到目标TA的内存空间中。
在一种可能的实现方式中于，TEE操作系统还包括TEE内存模块，TEE内存模块用于：
获取目标TA响应于目标服务的运行请求发送的内存请求，内存请求用于向TEE操作系统申请运行目标服务所需的内存；
响应于内存请求，向REE操作系统获取内存分配信息，内存分配信息用于指示REE操作系统将第一内存分配给TEE操作系统；
将第一内存分配给目标TA。
在一种可能的实现方式中，TEE内存模块具体用于：
将第一内存配置为安全内存；
将配置为安全内存的第一内存分配给目标TA。
在一种可能的实现方式中，TEE内存模块还用于：
在将第一内存分配给目标TA之后，接收目标TA发送的TA内存释放请求，TA内存释放请求用于请求TEE操作系统释放第一内存；
响应于TA内存释放请求，释放第一内存。
在一种可能的实现方式中，TEE内存模块具体用于：
将第一内存配置为非安全内存；
释放被配置为非安全内存的第一内存。
在一种可能的实现方式中，TEE内存模块还用于：
在释放第一内存之后，向REE操作系统发送TEE内存释放请求，TEE内存释放请求用于请求REE操作系统释放第一内存。
示例性的，根据发明内容中第二方面提供的方案，以采用集成的方式划分各个功能单元的情况下，图11示出了一种TEE操作系统的结构示意图。如图11所示，本申请TEE操作系统1100的另一个实施例可以包括：
启动模块1110，用于启动目标TA，目标TA为一个或多个TA中的任意一个TA；
动态库提供模块1120，用于为目标TA提供目标动态库，目标动态库由目标TA加载至目标TA的内存空间中，以支持目标TA运行目标服务，目标服务为目标TA提供的服务。
在一种可能的实现方式中，动态库提供模块1120包括：
获取请求接收单元，用于接收目标TA响应于目标服务的运行请求发送的获取请求，获取请求用于指示TEE操作系统获取目标动态库；
动态库获取单元，用于响应于获取请求，获取目标动态库。
在一种可能的实现方式中，动态库获取单元用于从REE操作系统获取目标动态库。
在一种可能的实现方式中，动态库获取单元具体用于：
向REE操作系统发送目标动态库的传递请求，传递请求包括目标动态库的标识，传递请求用于指示REE操作系统将目标动态库发送到TEE操作系统；
接收REE操作系统发送的目标动态库。
在一种可能的实现方式中，动态库获取单元具体用于：
从REE操作系统获取加密文件；
对加密文件进行解密，得到解密文件，解密文件包括目标动态库。
在一种可能的实现方式中，动态库提供模块1120具体用于：
接收REE操作系统响应于第二传递请求发送的目标动态库，目标服务的运行请求由部署在REE操作系统的目标客户端应用程序CA发送，目标CA有调用目标服务的权限，第二传递请求由目标CA响应于第一传递请求发送给REE操作系统，第一传递请求由目标TA响应于目标服务的运行请求发送给目标CA。
在一种可能的实现方式中，启动模块1110包括：
从REE操作系统获取一个或多个动态库，并将一个或多个动态库存储在TEE操作系统的内存空间中，其中，一个或多个动态库被记录在目标TA的目标文件中，可选的，目标文件为目标TA的可执行文件。
在一种可能的实现方式中，动态库提供模块1120包括：
访问请求接收单元，用于接收目标TA发送的访问请求，访问请求用于请求访问TEE操作系统的内存空间，目标动态库存储在TEE操作系统的内存空间；
允许信息发送单元，用于基于目标TA具有访问TEE操作系统的内存空间的权限，向目标TA发送允许访问信息，允许访问信息用于通知目标TA访问TEE操作系统的内存空间。
在一种可能的实现方式中，访问请求用于请求访问目标动态库；
允许信息发送单元用于：
基于目标TA具有访问TEE操作系统的内存空间的权限，并且，基于目标TA具有调用目标动态库的权限，向目标TA发送应答信息。
示例性的，根据发明内容中第三方面提供的方案，以采用集成的方式划分各个功能单元的情况下，图12示出了一种TA的结构示意图，本实施例中的TA对应于前述各方法实施例中的目标TA。如图12所示，本申请TA 1200的一个实施例可以包括：
加载模块1210，用于响应于目标服务的运行请求，加载目标动态库到目标TA的内存空间中，目标TA为一个或多个TA中的任意一个TA，目标服务为目标TA提供的服务；
服务运行模块1220，用于利用目标动态库运行目标服务。
在一种可能的实现方式中，目标动态库由TEE操作系统提供给目标TA。
在一种可能的实现方式中，加载模块1210用于：
向TEE操作系统发送获取请求，获取请求用于请求TEE操作系统获取目标动态库；
将TEE操作系统获取到的目标动态库加载到目标TA的内存空间中。
在一种可能的实现方式中，目标动态库为TEE操作系统从REE操作系统获取的。
在一种可能的实现方式中，加载模块1210用于：
向目标客户端应用程序CA发送第一传递请求，目标CA部署在REE操作系统中，并且有调用目标服务的权限，目标服务的运行请求由目标CA发送；
将TEE操作系统接收的目标动态库加载到目标TA的内存空间中，目标动态库由REE操作系统响应于第二传递请求发送给TEE操作系统，第二传递请求由目标CA响应于第一传递请求发送给REE操作系统。
在一种可能的实现方式中，加载模块1210用于：
从TEE操作系统的内存空间加载目标动态库到目标TA的内存空间中。
在一种可能的实现方式中，加载模块1210具体用于：
向TEE操作系统发送访问请求，访问请求用于请求访问TEE操作系统的内存空间，目标动态库存储在TEE操作系统的内存空间中；
基于接收到TEE操作系统发送的允许访问信息，访问将TEE操作系统的内存空间中的目标动态库，并将目标动态库加载到目标TA的内存空间中。
示例性的，根据发明内容中第四方面提供的方案，以采用集成的方式划分各个功能单元的情况下，图13示出了一种REE操作系统的结构示意图。如图13所示，本申请REE操作系统1300的一个实施例可以包括：
文件获取模块1310，用于响应于传递请求，获取目标文件，传递请求用于指示REE操作系统将目标文件传递至TEE操作系统；
REE通信模块1320，用于将目标文件发送给TEE操作系统。
在一种可能的实现方式中，目标文件为目标动态库，目标动态库用于加载至目标TA的内存空间中，以支持目标TA运行目标服务，目标服务为目标TA提供的服务，目标TA为TEE操作系统上部署的一个或多个TA中的任意一个TA。
在一种可能的实现方式中，传递请求为TEE操作系统发送的，或者，传递请求为目标客户端应用程序CA发送的，目标CA有调用目标服务的权限。
示例性的，根据发明内容中第五方面提供的方案，以采用集成的方式划分各个功能单元的情况下，图14示出了一种TEE操作系统的结构示意图。如图14所示，本申请TEE操作系统1400的另一个实施例可以包括：
内存申请模块1410，用于向REE操作系统发送第一内存请求，第一内存请求用于请求REE操作系统为是TEE操作系统分配内存；
内存接收模块1420，用于接收REE操作系统发送的内存分配信息，内存分配信息用于指 示为TEE操作系统分配的内存为目标内存；
内存配置模块1430，用于将目标内存配置为安全内存。
在一种可能的实现方式中，内存申请模块1410还用于：
在向REE操作系统发送第一内存请求之前，获取目标TA发送的第二内存请求，目标TA为TEE操作系统上部署的一个或多个TA中的任意一个TA，第二内存请求用于向TEE操作系统申请内存。
在一种可能的实现方式中，内存配置模块1430还用于：
在将目标内存配置为安全内存之后，将目标内存分配给目标TA。
在一种可能的实现方式中，第二内存请求为目标TA响应于目标服务的运行请求发送的，第二内存请求用于申请目标TA运行目标服务所需的内存，目标服务为目标TA提供的服务。
在一种可能的实现方式中，第一内存请求申请的内存大于第二内存申请的内存。
在一种可能的实现方式中，内存申请模块1410还用于：
在内存配置模块1430将第一内存分配给目标TA之后，接收目标TA发送的TA内存释放请求，TA内存释放请求用于请求TEE操作系统释放目标内存；
内存申请模块1410，还用于响应于TA内存释放请求，释放目标内存。
在一种可能的实现方式中，内存配置模块1430还用于，在内存配置模块1430释放目标内存之后，将目标内存配置为非安全内存；
内存申请模块，还用于向REE操作系统发送TEE内存释放请求，TEE内存释放请求用于请求REE操作系统释放目标内存。
本申请实施例还提供一种计算机系统，该计算机系统可以运行本申请提供的任一实施例方法，包含了执行各个功能相应的硬件结构和/或软件模块。本领域技术人员应该很容易意识到，结合本文中所公开的实施例描述的功能，本申请计算机系统能够以硬件或硬件和计算机软件的结合形式来实现。某个功能究竟以硬件还是计算机软件驱动硬件的方式来执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本申请的范围。
从功能模块的角度，本领域技术人员可以根据上述方法实施例计算机系统进行功能模块的划分，例如，可以对应各个功能划分各个功能模块，也可以将两个或两个以上的功能集成在一个功能模块中。上述集成的功能模块既可以采用硬件的形式实现，也可以采用软件功能单元的形式实现。
示例性的，本申请提供的计算机操作系统可以包括上述REE操作系统、TEE操作系统、CA和TA中的一个或多个。
由于本申请实施例提供的各装置可用于执行前述对应的实施例方法，因此本申请各装置实施例所能获得到的技术效果可参考前述对应的方法实施例，此处不再赘述。
上述各模块可以指特定应用集成电路(application-specific integrated circuit，ASIC)，执行一个或多个软件或固件程序的处理器和存储器，集成逻辑电路，和/或其他可以提供上述功能的器件。图15为计算机设备1500的硬件结构示意图，在一个简单的实施例中， 本领域的技术人员可以想到上述TEE操作系统、REE操作系统、TA、CA或操作系统可以采用图15所示的形式。
该计算机设备1500可以包括：处理器射频(radio frequency，RF)电路1510、存储器1520、输入单元1530、显示单元1540、传感器1550、音频电路1560、无线保真(wireless fidelity，WiFi)模块1570、处理器1580、以及电源1590等部件。
本领域技术人员可以理解，图15中示出的计算机设备结构并不构成对计算机设备的限定，可以包括比图示更多或更少的部件，或者组合某些部件，或者不同的部件布置。
下面结合图15对计算机设备的各个构成部件进行具体的介绍：
RF电路1510可用于收发信息或通话过程中，信号的接收和发送，特别地，将网络侧设备的下行信息接收后，给处理器1580处理；另外，将设计上行的数据发送给网络侧设备。
通常，RF电路1510包括但不限于天线、至少一个放大器、收发信机、耦合器、低噪声放大器(low noise amplifier，LNA)、双工器等。
此外，RF电路1510还可以通过无线通信与网络和其他设备通信。
上述无线通信可以使用任一通信标准或协议，包括但不限于全球移动通讯系统(global system of mobile communication，GSM)、通用分组无线服务(general packet radio service，GPRS)、码分多址(code division multiple access，CDMA)、宽带码分多址(wideband code division multiple access,WCDMA)、长期演进(long term evolution，LTE)、电子邮件、短消息服务(short messaging service，SMS)等。
存储器1520可用于存储软件程序以及模块，处理器1580通过运行存储在存储器1520的软件程序以及模块，从而执行计算机设备的各种功能应用以及数据处理。
存储器1520可主要包括存储程序区和存储数据区，其中，存储程序区可存储操作系统、至少一个功能所需的应用程序；存储数据区可存储根据计算机设备的使用所创建的数据等。此外，存储器1520可以包括高速随机存取存储器，还可以包括非易失性存储器，例如至少一个磁盘存储器件、闪存器件、或其他易失性固态存储器件。
输入单元1530可用于接收输入的数字或字符信息，以及产生与计算机设备的用户设置以及功能控制有关的键信号输入。
具体地，输入单元1530可包括触控面板1531以及其他输入设备1532。触控面板1531，也称为触摸屏，可收集用户在其上或附近的触摸操作(比如用户使用手指、触笔等任何适合的物体或附件在触控面板1531上或在触控面板1531附近的操作)，并根据预先设定的程式驱动相应的连接装置。除了触控面板1531，输入单元1530还可以包括其他输入设备1532。具体地，其他输入设备1532可以包括但不限于物理键盘、功能键(比如音量控制按键、开关按键等)、轨迹球、鼠标、操作杆等中的一种或多种。
显示单元1540可用于显示由用户输入的信息或提供给用户的信息以及计算机设备的各种菜单。显示单元1540可包括显示面板1541，可选的，可以采用液晶显示器(liquid crystal display，LCD)、有机发光二极管(organic light-emitting diode,OLED)等形式来配置显示面板1541。进一步的，触控面板1531可覆盖显示面板1541，当触控面板1531检测到在其上或附近的触摸操作后，传送给处理器1580以确定触摸事件的类型，随后处理器1580根据触摸事件的类型在显示面板1541上提供相应的视觉输出。虽然在图15中，触控面 板1531与显示面板1541是作为两个独立的部件来实现计算机设备的输入和输入功能，但是在某些实施例中，可以将触控面板1531与显示面板1541集成而实现计算机设备的输入和输出功能。
计算机设备还可包括至少一种传感器1550，比如光传感器、运动传感器以及其他传感器。具体地，光传感器可包括环境光传感器及接近传感器，其中，环境光传感器可根据环境光线的明暗来调节显示面板1541的亮度，接近传感器可在计算机设备移动到耳边时，关闭显示面板1541和/或背光。作为运动传感器的一种，加速计传感器可检测各个方向上(一般为三轴)加速度的大小，静止时可检测出重力的大小及方向，可用于识别计算机设备姿态的应用(比如横竖屏切换、相关游戏、磁力计姿态校准)、振动识别相关功能(比如计步器、敲击)等；至于计算机设备还可配置的陀螺仪、气压计、湿度计、温度计、红外线传感器等其他传感器，在此不再赘述。
音频电路1560、扬声器1561，传声器1562可提供用户与计算机设备之间的音频接口。音频电路1560可将接收到的音频数据转换后的电信号，传输到扬声器1561，由扬声器1561转换为声音信号输出；另一方面，传声器1562将收集的声音信号转换为电信号，由音频电路1560接收后转换为音频数据，再将音频数据输出处理器1580处理后，经RF电路1510以发送给比如另一设备，或者将音频数据输出至存储器1520以便进一步处理。
WiFi属于短距离无线传输技术，计算机设备通过WiFi模块1570可以帮助用户收发电子邮件、浏览网页和访问流式媒体等，它为用户提供了无线的宽带互联网访问。虽然图15示出了WiFi模块1570，但是可以理解的是，其并不属于计算机设备的必须构成，完全可以根据需要在不改变发明的本质的范围内而省略。
处理器1580是计算机设备的控制中心，利用各种接口和线路连接整个计算机设备的各个部分，通过运行或执行存储在存储器1520内的软件程序和/或模块，以及调用存储在存储器1520内的数据，执行计算机设备的各种功能和处理数据，从而对计算机设备进行整体监控。处理器1580可以是中央处理器(central processing unit，CPU)，网络处理器(network processor，NP)或者CPU和NP的组合、数字信号处理器(digital signal processor，DSP)、专用集成电路(application specific integrated circuit，ASIC)、现成可编程门阵列(field programmable gate array，FPGA)或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件。可以实现或者执行本申请中的公开的各方法、步骤及逻辑框图。通用处理器可以是微处理器或者该处理器也可以是任何常规的处理器等。结合本申请所公开的方法的步骤可以直接体现为硬件译码处理器执行完成，或者用译码处理器中的硬件及软件模块组合执行完成。软件模块可以位于随机存储器，闪存、只读存储器，可编程只读存储器或者电可擦写可编程存储器、寄存器等本领域成熟的存储介质中。该存储介质位于存储器，处理器读取存储器中的信息，结合其硬件完成上述方法的步骤。虽然图中仅仅示出了一个处理器，该装置可以包括多个处理器或者处理器包括多个处理单元。具体的，处理器可以是一个单核处理器，也可以是一个多核或众核处理器。该处理器可以是ARM架构处理器。可选的，处理器1580可集成应用处理器和调制解调处理器，其中，应用处理器主要处理操作系统、用户界面和应用程序等，调制解调处理器主要处理无线通信。可以理解的是，上述调制解调处理器也可以不集成到处理器1580中。
计算机设备还包括给各个部件供电的电源1590(比如电池)，优选的，电源可以通过电源管理系统与处理器1580逻辑相连，从而通过电源管理系统实现管理充电、放电、以及功耗管理等功能。
尽管未示出，计算机设备还可以包括摄像头、蓝牙模块等，在此不再赘述。
本申请实施例提供的计算机设备可以为手机、平板电脑、台式电脑、可穿戴设备(例如智能手表)、智能家庭设备(例如智能音响或智能电视)、车载智能设备、无人驾驶设备、虚拟现实设备、增强现实设备、混合现实设备、以及人工智能设备等。
上述实施例，可以全部或部分地通过软件、硬件、固件或者其任意组合来实现，当使用软件实现时，可以全部或部分地以计算机程序产品的形式实现。
所述计算机程序产品包括一个或多个计算机指令。在计算机上加载和执行所述计算机执行指令时，全部或部分地产生按照本申请实施例所述的流程或功能。所述计算机可以是通用计算机、专用计算机、计算机网络、或者其他可编程装置。所述计算机指令可以存储在计算机可读存储介质中，或者从一个计算机可读存储介质向另一计算机可读存储介质传输，例如，所述计算机指令可以从一个网站站点、计算机、服务器或数据中心通过有线(例如同轴电缆、光纤、数字用户线(DSL))或无线(例如红外、无线、微波等)方式向另一个网站站点、计算机、服务器或数据中心进行传输。所述计算机可读存储介质可以是计算机能够存储的任何可用介质或者是包含一个或多个可用介质集成的服务器、数据中心等数据存储设备。所述可用介质可以是磁性介质，(例如，软盘、硬盘、磁带)、光介质(例如，DVD)、或者半导体介质(例如固态硬盘(solid state disk，SSD))等。
本申请的说明书和权利要求书及上述附图中的术语“第一”、“第二”等是用于区别类似的对象，而不必用于描述特定的顺序或先后次序。应该理解这样使用的术语在适当情况下可以互换，这仅仅是描述本申请的实施例中对相同属性的对象在描述时所采用的区分方式。此外，术语“包括”和“具有”以及他们的任何变形，意图在于覆盖不排他的包含，以便包含一系列单元的过程、方法、系统、产品或设备不必限于那些单元，而是可包括没有清楚地列出的或对于这些过程、方法、产品或设备固有的其它单元。在本申请实施例中，“多个”指两个或两个以上。
本申请实施例中，“示例性的”或者“例如”等词用于表示作例子、例证或说明。本申请实施例中被描述为“示例性的”或者“例如”的任何实施例或设计方案不应被解释为比其他实施例或设计方案更优选或更具优势。确切而言，使用“示例性的”或者“例如”等词旨在以具体方式呈现相关概念。
在本申请的各实施例中，为了方面理解，进行了多种举例说明。然而，这些例子仅仅是一些举例，并不意味着是实现本申请的最佳实现方式。
以上对本申请所提供的技术方案进行了详细介绍，本申请中应用了具体个例对本申请的原理及实施方式进行了阐述，以上实施例的说明只是用于帮助理解本申请的方法及其核心思想；同时，对于本领域的一般技术人员，依据本申请的思想，在具体实施方式及应用范围上均会有改变之处，综上所述，本说明书内容不应理解为对本申请的限制。

Claims (80)

  1. 一种可信应用程序TA的运行方法，其特征在于，应用于计算机系统，所述计算机系统上部署有富执行环境REE和可信执行环境TEE，所述REE内部署有REE操作系统，所述TEE内部署有TEE操作系统，所述TEE操作系统上部署有一个或多个可信应用程序TA，所述方法包括：
    所述TEE操作系统启动目标TA，所述目标TA为所述一个或多个TA中的任意一个TA；
    所述TEE操作系统接收所述目标TA响应于目标服务的运行请求发送的加载请求，所述加载请求用于指示加载目标动态库，其中，所述目标服务为所述目标TA提供的服务；
    响应于所述加载请求，所述TEE操作系统加载所述目标动态库到所述目标TA的内存空间中，所述目标动态库用于支持所述目标服务的运行。
  2. 根据权利要求1所述的方法，其特征在于，所述TEE操作系统加载所述目标动态库到所述目标TA的内存空间中，包括：
    所述TEE操作系统从所述TEE操作系统的内存空间加载所述目标动态库到所述目标TA的内存空间中。
  3. 根据权利要求1所述的方法，其特征在于，所述TEE操作系统加载所述目标动态库到所述目标TA的内存空间中，包括：
    所述TEE操作系统从所述REE操作系统获取所述目标动态库，并将所述目标动态库加载到所述目标TA的内存空间中。
  4. 根据权利要求3所述的方法，其特征在于，所述TEE操作系统从所述REE操作系统获取所述目标动态库，包括：
    所述TEE操作系统向所述REE操作系统发送所述目标动态库的传递请求，所述传递请求包括所述目标动态库的标识，所述传递请求用于指示所述REE操作系统将所述目标动态库发送到所述TEE操作系统；
    所述TEE操作系统接收所述REE操作系统发送的所述目标动态库。
  5. 根据权利要求3所述的方法，其特征在于，所述TEE操作系统从所述REE操作系统获取所述目标动态库，包括：
    所述TEE操作系统从所述REE操作系统获取加密文件；
    所述TEE操作系统对所述加密文件进行解密，得到解密文件，所述解密文件包括所述目标动态库。
  6. 根据权利要求1或2所述的方法，其特征在于，所述目标服务的运行请求由部署在所述REE操作系统的目标客户端应用程序CA发送，所述目标CA有调用所述目标服务的权限，所述目标动态库由所述REE操作系统响应于第二传递请求发送给所述TEE操作系统，其中，所述第二传递请求由所述目标CA响应于第一传递请求发送给所述REE操作系统，所述第一传递请求由所述目标TA响应于所述目标服务的运行请求发送给所述目标CA。
  7. 根据权利要求1至6中任意一项所述的方法，其特征在于，所述TEE操作系统启动目标TA，包括：
    所述TEE操作系统从所述REE操作系统获取一个或多个动态库，并将所述一个或多个动态库存储在所述TEE操作系统的内存空间中，其中，所述一个或多个动态库被记录在所述目 标TA的目标文件中。
  8. 根据权利要求1至7中任意一项所述的方法，其特征在于，所述TEE操作系统加载所述目标动态库到所述目标TA的内存空间中，包括：
    所述TEE操作系统根据目标权限信息判断所述目标TA是否具有调用所述目标动态库的权限；
    基于所述目标TA具有调用所述目标动态库的权限，所述TEE操作系统将所述目标动态库加载到所述目标TA的内存空间中。
  9. 根据权利要求1至8中任一项所述的方法，其特征在于，所述方法还包括：
    所述TEE操作系统获取所述目标TA响应于所述目标服务的运行请求发送的内存请求，所述内存请求用于向所述TEE操作系统申请运行所述目标服务所需的内存；
    响应于所述内存请求，所述TEE操作系统向所述REE操作系统获取内存分配信息，所述内存分配信息用于指示所述REE操作系统将第一内存分配给所述TEE操作系统；
    所述TEE操作系统将所述第一内存分配给所述目标TA。
  10. 根据权利要求9所述的方法，其特征在于，所述第一内存大于所述内存请求所申请的内存。
  11. 根据权利要求9所述的方法，其特征在于，所述TEE操作系统将所述第一内存分配给目标TA，包括：
    所述TEE操作系统将所述第一内存配置为安全内存；
    所述TEE操作系统将配置为安全内存的所述第一内存分配给所述目标TA。
  12. 根据权利要求9至11中任意一项所述的方法，其特征在于，在所述TEE操作系统将所述第一内存分配给所述目标TA之后，所述方法还包括：
    所述TEE操作系统接收所述目标TA发送的TA内存释放请求，所述TA内存释放请求用于请求所述TEE操作系统释放所述第一内存；
    响应于所述TA内存释放请求，所述TEE操作系统释放所述第一内存。
  13. 根据权利要求12所述的方法，其特征在于，所述TEE操作系统释放所述第一内存，包括：
    所述TEE操作系统将所述第一内存配置为非安全内存；
    所述TEE操作系统释放被配置为非安全内存的所述第一内存。
  14. 根据权利要求12所述的方法，其特征在于，在所述TEE操作系统释放所述第一内存之后，所述方法还包括：
    所述TEE操作系统向所述REE操作系统发送TEE内存释放请求，所述TEE内存释放请求用于请求所述REE操作系统释放所述第一内存。
  15. 一种可信应用程序TA的运行方法，其特征在于，应用于计算机系统，所述计算机系统上部署有富执行环境REE和可信执行环境TEE，所述REE内部署有REE操作系统，所述TEE内部署有TEE操作系统，所述TEE操作系统上部署有一个或多个可信应用程序TA，所述方法包括：
    所述TEE操作系统启动目标TA，所述目标TA为所述一个或多个TA中的任意一个TA；
    所述TEE操作系统为所述目标TA提供目标动态库，所述目标动态库由所述目标TA加载至所述目标TA的内存空间中，以支持所述目标TA运行目标服务，所述目标服务为所述目标TA提供的服务。
  16. 根据权利要求15所述的方法，其特征在于，所述TEE操作系统为所述目标TA提供所述目标动态库，包括：
    所述TEE操作系统接收所述目标TA响应于所述目标服务的运行请求发送的获取请求，所述获取请求用于指示所述TEE操作系统获取所述目标动态库；
    响应于所述获取请求，所述TEE操作系统获取所述目标动态库。
  17. 根据权利要求16所述的方法，其特征在于，所述TEE操作系统获取所述目标动态库，包括：
    所述TEE操作系统从所述REE操作系统获取所述目标动态库。
  18. 根据权利要求17所述的方法，其特征在于，所述TEE操作系统从所述REE操作系统获取所述目标动态库，包括：
    所述TEE操作系统向所述REE操作系统发送所述目标动态库的传递请求，所述传递请求包括所述目标动态库的标识，所述传递请求用于指示所述REE操作系统将所述目标动态库发送到所述TEE操作系统；
    所述TEE操作系统接收所述REE操作系统发送的所述目标动态库。
  19. 根据权利要求17所述的方法，其特征在于，所述TEE操作系统从所述REE操作系统获取所述目标动态库，包括：
    所述TEE操作系统从所述REE操作系统获取加密文件；
    所述TEE操作系统对所述加密文件进行解密，得到解密文件，所述解密文件包括所述目标动态库。
  20. 根据权利要求15所述的方法，其特征在于，所述TEE操作系统为所述目标TA提供所述目标动态库包括：
    所述TEE操作系统接收所述REE操作系统响应于第二传递请求发送的所述目标动态库，所述目标服务的运行请求由部署在所述REE操作系统的目标客户端应用程序CA发送，所述目标CA有调用所述目标服务的权限，所述第二传递请求由所述目标CA响应于第一传递请求发送给所述REE操作系统，所述第一传递请求由所述目标TA响应于所述目标服务的运行请求发送给所述目标CA。
  21. 根据权利要求15至20中任一项所述的方法，其特征在于，所述TEE操作系统启动目标TA，包括：
    所述TEE操作系统从所述REE操作系统获取一个或多个动态库，并将所述一个或多个动态库存储在所述TEE操作系统的内存空间中，其中，所述一个或多个动态库被记录在所述目标TA的目标文件中。
  22. 根据权利要求15至21中任一项所述的方法，其特征在于，所述TEE操作系统为所述目标TA提供所述目标动态库包括：
    所述TEE操作系统接收所述目标TA发送的访问请求，所述访问请求用于请求访问所述TEE操作系统的内存空间，所述目标动态库存储在所述TEE操作系统的内存空间；
    基于所述目标TA具有访问所述TEE操作系统的内存空间的权限，所述TEE操作系统向所述目标TA发送允许访问信息，所述允许访问信息用于通知所述目标TA访问所述TEE操作系统的内存空间。
  23. 根据权利要求22所述的方法，其特征在于，所述访问请求用于请求访问所述目标动态库；
    所述TEE操作系统向所述目标TA发送允许访问信息包括：
    基于所述目标TA具有访问所述TEE操作系统的内存空间的权限，并且，基于所述目标TA具有调用所述目标动态库的权限，所述TEE操作系统向所述目标TA发送所述应答信息。
  24. 一种可信应用程序TA的运行方法，其特征在于，应用于计算机系统，所述计算机系统上部署有富执行环境REE和可信执行环境TEE，所述REE内部署有REE操作系统，所述TEE内部署有TEE操作系统，所述TEE操作系统上部署有一个或多个TA，所述方法包括：
    响应于目标服务的运行请求，目标TA加载目标动态库到所述目标TA的内存空间中，所述目标TA为所述一个或多个TA中的任意一个TA，所述目标服务为所述目标TA提供的服务；
    所述目标TA利用所述目标动态库运行所述目标服务。
  25. 根据权利要求24所述的方法，其特征在于，所述目标TA加载目标动态库到所述目标TA的内存空间中，包括：
    所述目标TA向所述TEE操作系统发送获取请求，所述获取请求用于请求所述TEE操作系统获取所述目标动态库；
    所述目标TA将所述TEE操作系统获取到的所述目标动态库加载到所述目标TA的内存空间中。
  26. 根据权利要求25所述的方法，其特征在于，所述目标动态库为所述TEE操作系统从所述REE操作系统获取的。
  27. 根据权利要求24所述的方法，其特征在于，所述目标TA加载目标动态库到所述目标TA的内存空间中，包括：
    所述目标TA向目标客户端应用程序CA发送第一传递请求，所述目标CA部署在所述REE操作系统中，并且有调用所述目标服务的权限，所述目标服务的运行请求由所述目标CA发送；
    所述目标TA将所述TEE操作系统接收的所述目标动态库加载到所述目标TA的内存空间中，所述目标动态库由所述REE操作系统响应于第二传递请求发送给所述TEE操作系统，所述第二传递请求由所述目标CA响应于所述第一传递请求发送给所述REE操作系统。
  28. 根据权利要求24至27中任一项所述的方法，其特征在于，所述目标TA加载目标动态库到所述目标TA的内存空间中，包括：
    所述目标TA从所述TEE操作系统的内存空间加载所述目标动态库到所述目标TA的内存空间中。
  29. 根据权利要求28所述的方法，其特征在于，所述目标TA从所述TEE操作系统的内存空间加载所述目标动态库到所述目标TA的内存空间中，包括：
    所述目标TA向所述TEE操作系统发送访问请求，所述访问请求用于请求访问所述TEE操作系统的内存空间，所述目标动态库存储在所述TEE操作系统的内存空间中；
    基于接收到所述TEE操作系统发送的允许访问信息，所述目标TA访问将所述TEE操作系 统的内存空间中的所述目标动态库，并将所述目标动态库加载到所述目标TA的内存空间中。
  30. 一种信息处理方法，其特征在于，应用于计算机系统，所述计算机系统上部署有富执行环境REE和可信执行环境TEE，所述REE内部署有REE操作系统，所述TEE内部署有TEE操作系统，所述方法包括：
    响应于传递请求，所述REE操作系统获取目标文件，所述传递请求用于指示所述REE操作系统将所述目标文件传递至所述TEE操作系统；
    所述REE操作系统将所述目标文件发送给所述TEE操作系统。
  31. 根据权利要求30所述的方法，其特征在于，所述目标文件为目标动态库，所述目标动态库用于加载至目标TA的内存空间中，以支持所述目标TA运行目标服务，所述目标服务为目标TA提供的服务，所述目标TA为所述TEE操作系统上部署的一个或多个TA中的任意一个TA。
  32. 根据权利要求31所述的方法，其特征在于，所述传递请求为所述TEE操作系统发送的，或者，所述传递请求为目标客户端应用程序CA发送的，所述目标CA有调用所述目标服务的权限。
  33. 一种内存分配方法，其特征在于，应用于计算机系统，所述计算机系统上部署有富执行环境REE和可信执行环境TEE，所述REE内部署有REE操作系统，所述TEE内部署有TEE操作系统，其特征在于，所述方法包括：
    所述TEE操作系统向所述REE操作系统发送第一内存请求，所述第一内存请求用于请求所述REE操作系统为是TEE操作系统分配内存；
    所述TEE操作系统接收所述REE操作系统发送的内存分配信息，所述内存分配信息用于指示为所述TEE操作系统分配的内存为目标内存；
    所述TEE操作系统将所述目标内存配置为安全内存。
  34. 根据权利要求33所述的方法，其特征在于，所述TEE操作系统向所述REE操作系统发送第一内存请求之前，所述方法还包括：
    所述TEE操作系统获取目标TA发送的第二内存请求，所述目标TA为所述TEE操作系统上部署的一个或多个TA中的任意一个TA，所述第二内存请求用于向所述TEE操作系统申请内存。
  35. 根据权利要求34所述的方法，其特征在于，所述TEE操作系统将所述目标内存配置为安全内存之后，所述方法还包括：
    所述TEE操作系统将所述目标内存分配给所述目标TA。
  36. 根据权利要求34或35所述的方法，其特征在于，所述第二内存请求为所述目标TA响应于目标服务的运行请求发送的，所述第二内存请求用于申请所述目标TA运行所述目标服务所需的内存，所述目标服务为所述目标TA提供的服务。
  37. 根据权利要34至36中任一项所述的方法，其特征在于，所述第一内存请求申请的内存大于所述第二内存申请的内存。
  38. 根据权利要求35所述的方法，其特征在于，在所述TEE操作系统将所述第一内存分配给所述目标TA之后，所述方法还包括：
    所述TEE操作系统接收所述目标TA发送的TA内存释放请求，所述TA内存释放请求用于 请求所述TEE操作系统释放所述目标内存；
    响应于所述TA内存释放请求，所述TEE操作系统释放所述目标内存。
  39. 根据权利要求38所述的方法，其特征在于，在所述TEE操作系统释放所述目标内存之后，所述方法还包括：
    所述TEE操作系统将所述目标内存配置为非安全内存；
    所述TEE操作系统向所述REE操作系统发送TEE内存释放请求，所述TEE内存释放请求用于请求所述REE操作系统释放所述目标内存。
  40. 一种可信执行环境TEE操作系统，其特征在于，所述TEE操作系统部署于计算机系统上的TEE中，所述计算机系统上还部署有富执行环境REE，所述REE内部署有REE操作系统，所述TEE操作系统上部署有一个或多个TA，所述TEE操作系统包括：
    启动模块，用于启动目标TA，所述目标TA为所述一个或多个TA中的任意一个TA；
    接收模块，用于接收所述目标TA响应于目标服务的运行请求发送的加载请求，所述加载请求用于指示加载目标动态库，其中，所述目标服务为所述目标TA提供的服务；
    加载模块，用于响应于所述加载请求，加载所述目标动态库到所述目标TA的内存空间中，所述目标动态库用于支持所述目标服务的运行。
  41. 根据权利要求40所述的TEE操作系统，其特征在于，所述加载模块用于：
    从所述TEE操作系统的内存空间加载所述目标动态库到所述目标TA的内存空间中。
  42. 根据权利要求40所述的TEE操作系统，其特征在于，所述加载模块包括：
    TEE通信单元，用于从所述REE操作系统获取所述目标动态库；
    动态库加载单元，用于将所述目标动态库加载到所述目标TA的内存空间中。
  43. 根据权利要求42所述的TEE操作系统，其特征在于，所述TEE通信单元用于：
    向所述REE操作系统发送所述目标动态库的传递请求，所述传递请求包括所述目标动态库的标识，所述传递请求用于指示所述REE操作系统将所述目标动态库发送到所述TEE操作系统；
    接收所述REE操作系统发送的所述目标动态库。
  44. 根据权利要求42所述的TEE操作系统，其特征在于，所述TEE通信单元用于：
    从所述REE操作系统获取加密文件；
    对所述加密文件进行解密，得到解密文件，所述解密文件包括所述目标动态库。
  45. 根据权利要求40至44中任意一项所述的TEE操作系统，其特征在于，所述启动模块用于：
    从所述REE操作系统获取一个或多个动态库，并将所述一个或多个动态库存储在所述TEE操作系统的内存空间中，其中，所述一个或多个动态库被记录在所述目标TA的目标文件中。
  46. 根据权利要求40至45中任意一项所述的TEE操作系统，其特征在于，所述加载模块用于：
    根据目标权限信息判断所述目标TA是否具有调用所述目标动态库的权限；
    基于所述目标TA具有调用所述目标动态库的权限，将所述目标动态库加载到所述目标TA的内存空间中。
  47. 根据权利要求40至46中任一项所述的TEE操作系统，其特征在于，所述TEE操作系统还包括TEE内存模块，所述TEE内存模块用于：
    获取所述目标TA响应于所述目标服务的运行请求发送的内存请求，所述内存请求用于向所述TEE操作系统申请运行所述目标服务所需的内存；
    响应于所述内存请求，向所述REE操作系统获取内存分配信息，所述内存分配信息用于指示所述REE操作系统将第一内存分配给所述TEE操作系统；
    将所述第一内存分配给所述目标TA。
  48. 根据权利要求47所述的TEE操作系统，其特征在于，所述TEE内存模块具体用于：
    将所述第一内存配置为安全内存；
    将配置为安全内存的所述第一内存分配给所述目标TA。
  49. 根据权利要求47或48所述的TEE操作系统，其特征在于，所述TEE内存模块还用于：
    在将所述第一内存分配给所述目标TA之后，接收所述目标TA发送的TA内存释放请求，所述TA内存释放请求用于请求所述TEE操作系统释放所述第一内存；
    响应于所述TA内存释放请求，释放所述第一内存。
  50. 根据权利要求49所述的TEE操作系统，其特征在于，所述TEE内存模块具体用于：
    将所述第一内存配置为非安全内存；
    释放被配置为非安全内存的所述第一内存。
  51. 根据权利要求49所述的TEE操作系统，其特征在于，所述TEE内存模块还用于：
    在释放所述第一内存之后，向所述REE操作系统发送TEE内存释放请求，所述TEE内存释放请求用于请求所述REE操作系统释放所述第一内存。
  52. 一种可信执行环境TEE操作系统，其特征在于，所述TEE操作系统部署于计算机系统上的TEE中，所述计算机系统上还部署有富执行环境REE，所述REE内部署有REE操作系统，所述TEE操作系统上部署有一个或多个TA，所述TEE操作系统包括：
    启动模块，用于启动目标TA，所述目标TA为所述一个或多个TA中的任意一个TA；
    动态库提供模块，用于为所述目标TA提供目标动态库，所述目标动态库由所述目标TA加载至所述目标TA的内存空间中，以支持所述目标TA运行目标服务，所述目标服务为所述目标TA提供的服务。
  53. 根据权利要求52所述的TEE操作系统，其特征在于，所述动态库提供模块包括：
    获取请求接收单元，用于接收所述目标TA响应于所述目标服务的运行请求发送的获取请求，所述获取请求用于指示所述TEE操作系统获取所述目标动态库；
    动态库获取单元，用于响应于所述获取请求，获取所述目标动态库。
  54. 根据权利要求53所述的TEE操作系统，其特征在于，所述动态库获取单元用于从所述REE操作系统获取所述目标动态库。
  55. 根据权利要求54所述的TEE操作系统，其特征在于，所述动态库获取单元具体用于：
    向所述REE操作系统发送所述目标动态库的传递请求，所述传递请求包括所述目标动态库的标识，所述传递请求用于指示所述REE操作系统将所述目标动态库发送到所述TEE操作系统；
    接收所述REE操作系统发送的所述目标动态库。
  56. 根据权利要求54所述的TEE操作系统，其特征在于，所述动态库获取单元具体用于：
    从所述REE操作系统获取加密文件；
    对所述加密文件进行解密，得到解密文件，所述解密文件包括所述目标动态库。
  57. 根据权利要求52所述的TEE操作系统，其特征在于，所述动态库提供模块具体用于：
    接收所述REE操作系统响应于第二传递请求发送的所述目标动态库，所述目标服务的运行请求由部署在所述REE操作系统的目标客户端应用程序CA发送，所述目标CA有调用所述目标服务的权限，所述第二传递请求由所述目标CA响应于第一传递请求发送给所述REE操作系统，所述第一传递请求由所述目标TA响应于所述目标服务的运行请求发送给所述目标CA。
  58. 根据权利要求52至57中任一项所述的TEE操作系统，其特征在于，所述启动模块包括：
    从所述REE操作系统获取一个或多个动态库，并将所述一个或多个动态库存储在所述TEE操作系统的内存空间中，其中，所述一个或多个动态库被记录在所述目标TA的目标文件中。
  59. 根据权利要求52至58中任一项所述的TEE操作系统，其特征在于，所述动态库提供模块包括：
    访问请求接收单元，用于接收所述目标TA发送的访问请求，所述访问请求用于请求访问所述TEE操作系统的内存空间，所述目标动态库存储在所述TEE操作系统的内存空间；
    允许信息发送单元，用于基于所述目标TA具有访问所述TEE操作系统的内存空间的权限，向所述目标TA发送允许访问信息，所述允许访问信息用于通知所述目标TA访问所述TEE操作系统的内存空间。
  60. 根据权利要求59所述的TEE操作系统，其特征在于，所述访问请求用于请求访问所述目标动态库；
    所述允许信息发送单元用于：
    基于所述目标TA具有访问所述TEE操作系统的内存空间的权限，并且，基于所述目标TA具有调用所述目标动态库的权限，向所述目标TA发送所述应答信息。
  61. 一种可信应用程序TA，其特征在于，所述TA部署在可信执行环境TEE操作系统上，所述TEE操作系统部署在计算机系统的TEE内，所述计算机系统上还部署有富执行环境REE，所述REE内部署有REE操作系统，所述TA包括：
    加载模块，用于响应于目标服务的运行请求，加载目标动态库到所述目标TA的内存空间中，所述目标TA为所述一个或多个TA中的任意一个TA，所述目标服务为所述目标TA提供的服务；
    服务运行模块，用于利用所述目标动态库运行所述目标服务。
  62. 根据权利要求61所述的TA，其特征在于，所述目标动态库由所述TEE操作系统提供给所述目标TA。
  63. 根据权利要求62所述的TA，其特征在于，所述加载模块用于：
    向所述TEE操作系统发送获取请求，所述获取请求用于请求所述TEE操作系统获取所述目标动态库；
    将所述TEE操作系统获取到的所述目标动态库加载到所述目标TA的内存空间中。
  64. 根据权利要求63所述的TA，其特征在于，所述目标动态库为所述TEE操作系统从所述REE操作系统获取的。
  65. 根据权利要求62所述的TA，其特征在于，所述加载模块用于：
    向目标客户端应用程序CA发送第一传递请求，所述目标CA部署在所述REE操作系统中，并且有调用所述目标服务的权限，所述目标服务的运行请求由所述目标CA发送；
    将所述TEE操作系统接收的所述目标动态库加载到所述目标TA的内存空间中，所述目标动态库由所述REE操作系统响应于第二传递请求发送给所述TEE操作系统，所述第二传递请求由所述目标CA响应于所述第一传递请求发送给所述REE操作系统。
  66. 根据权利要求62至65中任一项所述的TA，其特征在于，所述加载模块用于：
    从所述TEE操作系统的内存空间加载所述目标动态库到所述目标TA的内存空间中。
  67. 根据权利要求66所述的TA，其特征在于，所述加载模块具体用于：
    向所述TEE操作系统发送访问请求，所述访问请求用于请求访问所述TEE操作系统的内存空间，所述目标动态库存储在所述TEE操作系统的内存空间中；
    基于接收到所述TEE操作系统发送的允许访问信息，访问将所述TEE操作系统的内存空间中的所述目标动态库，并将所述目标动态库加载到所述目标TA的内存空间中。
  68. 一种富执行环境REE操作系统，其特征在于，所述REE操作系统部署于计算机系统上的REE中，所述计算机系统上还部署有可信执行环境TEE，所述TEE内部署有TEE操作系统，所述REE操作系统包括：
    文件获取模块，用于响应于传递请求，获取目标文件，所述传递请求用于指示所述REE操作系统将所述目标文件传递至所述TEE操作系统；
    REE通信模块，用于将所述目标文件发送给所述TEE操作系统。
  69. 根据权利要求68所述的REE操作系统，其特征在于，所述目标文件为目标动态库，所述目标动态库用于加载至目标TA的内存空间中，以支持所述目标TA运行目标服务，所述目标服务为目标TA提供的服务，所述目标TA为所述TEE操作系统上部署的一个或多个TA中的任意一个TA。
  70. 根据权利要求69所述的REE操作系统，其特征在于，所述传递请求为所述TEE操作系统发送的，或者，所述传递请求为目标客户端应用程序CA发送的，所述目标CA有调用所述目标服务的权限。
  71. 一种可信执行环境TEE操作系统，其特征在于，所述TEE操作系统部署于计算机系统上的TEE中，所述计算机系统上还部署有富执行环境REE，所述REE内部署有REE操作系统，所述TEE操作系统包括：
    内存申请模块，用于向所述REE操作系统发送第一内存请求，所述第一内存请求用于请求所述REE操作系统为是TEE操作系统分配内存；
    内存接收模块，用于接收所述REE操作系统发送的内存分配信息，所述内存分配信息用于指示为所述TEE操作系统分配的内存为目标内存；
    内存配置模块，用于将所述目标内存配置为安全内存。
  72. 根据权利要求71所述的TEE操作系统，其特征在于，所述内存申请模块还用于：
    在向所述REE操作系统发送第一内存请求之前，获取目标TA发送的第二内存请求，所述目标TA为所述TEE操作系统上部署的一个或多个TA中的任意一个TA，所述第二内存请求用于向所述TEE操作系统申请内存。
  73. 根据权利要求72所述的TEE操作系统，其特征在于，所述内存配置模块还用于：
    在将所述目标内存配置为安全内存之后，将所述目标内存分配给所述目标TA。
  74. 根据权利要求72或73所述的TEE操作系统，其特征在于，所述第二内存请求为所述目标TA响应于目标服务的运行请求发送的，所述第二内存请求用于申请所述目标TA运行所述目标服务所需的内存，所述目标服务为所述目标TA提供的服务。
  75. 根据权利要72至74中任一项所述的TEE操作系统，其特征在于，所述第一内存请求申请的内存大于所述第二内存申请的内存。
  76. 根据权利要求73所述的TEE操作系统，其特征在于，所述内存申请模块还用于：
    在所述内存配置模块将所述第一内存分配给所述目标TA之后，接收所述目标TA发送的TA内存释放请求，所述TA内存释放请求用于请求所述TEE操作系统释放所述目标内存；
    响应于所述TA内存释放请求，释放所述目标内存。
  77. 根据权利要求76所述的TEE操作系统，其特征在于，所述内存配置模块还用于，在所述内存配置模块释放所述目标内存之后，将所述目标内存配置为非安全内存；
    所述内存申请模块还用于向所述REE操作系统发送TEE内存释放请求，所述TEE内存释放请求用于请求所述REE操作系统释放所述目标内存。
  78. 一种计算机设备，其特征在于，包括处理器和存储器，该处理器在运行所述存储器存储的计算机指令时，执行如权利要求1至39中任一项所述的方法。
  79. 一种计算机可读存储介质，其特征在于，包括指令，当所述指令在计算机上运行时，使得计算机执行如权利要求1至39中任一项所述的方法。
  80. 一种计算机程序产品，其特征在于，包括指令，当所述指令在计算机上运行时，使得计算机执行如权利要求1至39中任一项所述的方法。
PCT/CN2020/106685 2019-08-30 2020-08-04 可信应用的运行方法、信息处理和内存分配方法及装置 WO2021036706A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
EP20858803.8A EP4016347A4 (en) 2019-08-30 2020-08-04 TRUSTED APPLICATION METHOD AND APPARATUS AND INFORMATION PROCESSING AND STORAGE METHOD AND APPARATUS
US17/682,034 US20220277108A1 (en) 2019-08-30 2022-02-28 Trusted Application Running Method, Information Processing Method, Memory Allocation Method, and Apparatus

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201910817794.3A CN112528288A (zh) 2019-08-30 2019-08-30 可信应用的运行方法、信息处理和内存分配方法及装置
CN201910817794.3 2019-08-30

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US17/682,034 Continuation US20220277108A1 (en) 2019-08-30 2022-02-28 Trusted Application Running Method, Information Processing Method, Memory Allocation Method, and Apparatus

Publications (1)

Publication Number Publication Date
WO2021036706A1 true WO2021036706A1 (zh) 2021-03-04

Family

ID=74684453

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2020/106685 WO2021036706A1 (zh) 2019-08-30 2020-08-04 可信应用的运行方法、信息处理和内存分配方法及装置

Country Status (4)

Country Link
US (1) US20220277108A1 (zh)
EP (1) EP4016347A4 (zh)
CN (1) CN112528288A (zh)
WO (1) WO2021036706A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115048642A (zh) * 2021-11-29 2022-09-13 荣耀终端有限公司 多可信执行环境下可信应用间的通信方法及电子设备

Families Citing this family (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111401901B (zh) * 2020-03-23 2021-06-04 腾讯科技（深圳）有限公司 生物支付设备的认证方法、装置、计算机设备和存储介质
CN115248718A (zh) * 2021-04-26 2022-10-28 华为技术有限公司 内存数据获取方法、装置及存储介质
CN113553204B (zh) * 2021-09-16 2021-12-28 支付宝(杭州)信息技术有限公司 一种数据传输方法及装置
CN113645014B (zh) * 2021-10-13 2022-01-04 北京创米智汇物联科技有限公司 基于智能安防设备的数据处理方法、设备及存储介质
US20220092196A1 (en) * 2021-12-08 2022-03-24 Intel Corporation Mechanism for secure library sharing
CN114297631A (zh) * 2021-12-31 2022-04-08 展讯通信（上海）有限公司 图像隐私保护方法及装置
CN114564150B (zh) * 2022-02-28 2024-03-22 无锡江南计算技术研究所 动态链接模式片上存储器空间分配方法
CN117375864A (zh) * 2022-06-30 2024-01-09 华为技术有限公司 远程证明方法、装置、系统、存储介质及计算机程序产品

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106845285A (zh) * 2016-12-28 2017-06-13 北京握奇智能科技有限公司 一种tee系统与ree系统配合以实现服务的方法及终端设备
CN107220189A (zh) * 2017-03-14 2017-09-29 晨星半导体股份有限公司 内存空间管理及内存访问控制方法及装置
CN108959916A (zh) * 2017-05-22 2018-12-07 华为技术有限公司 用于访问安全世界的方法、装置和系统

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106845285A (zh) * 2016-12-28 2017-06-13 北京握奇智能科技有限公司 一种tee系统与ree系统配合以实现服务的方法及终端设备
CN107220189A (zh) * 2017-03-14 2017-09-29 晨星半导体股份有限公司 内存空间管理及内存访问控制方法及装置
CN108959916A (zh) * 2017-05-22 2018-12-07 华为技术有限公司 用于访问安全世界的方法、装置和系统

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP4016347A4

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115048642A (zh) * 2021-11-29 2022-09-13 荣耀终端有限公司 多可信执行环境下可信应用间的通信方法及电子设备

Also Published As

Publication number Publication date
US20220277108A1 (en) 2022-09-01
EP4016347A4 (en) 2022-10-05
CN112528288A (zh) 2021-03-19
EP4016347A1 (en) 2022-06-22

Similar Documents

Publication Publication Date Title
WO2021036706A1 (zh) 可信应用的运行方法、信息处理和内存分配方法及装置
CN108595970B (zh) 处理组件的配置方法、装置、终端及存储介质
US11864248B2 (en) Application function implementation method and electronic device
US9965565B2 (en) Methods and terminals for generating and reading 2D barcode and servers
US10021103B2 (en) Service authorization methods and apparatuses
CN106598584B (zh) 一种处理资源文件的方法、装置和系统
US9584476B2 (en) Safety protection method, firewall, terminal device and computer-readable storage medium
CN110457894B (zh) root权限的分配方法、装置、存储介质及终端设备
KR102107132B1 (ko) 전자 장치의 억세스 포인트 접속 방법 및 그 전자 장치
US10068068B2 (en) Trusted timer service
WO2018201991A1 (zh) 数据处理方法、系统、装置、存储介质及设备
WO2019010863A1 (zh) 控制可信应用访问的方法和终端
WO2019057155A1 (zh) 一种动态管理内核节点的方法和设备
CN113821803B (zh) 安全架构系统、安全管理方法和计算设备
WO2021098823A1 (zh) 一种内存隔离的装置、内存隔离方法和相关设备
US10764038B2 (en) Method and apparatus for generating terminal key
CN114218560B (zh) 资源访问方法、装置、电子设备及存储介质
KR20140114263A (ko) 어플리케이션 인증 방법 및 이를 구현하는 전자 장치
US20230177196A1 (en) Resource management method, computing device, computing equipment, and readable storage medium
CN114826785B (zh) 一种动态防护方法、系统级芯片、电子设备及介质
WO2020187008A1 (zh) 服务调用控制方法、服务调用方法、装置及终端
WO2019127468A1 (zh) 分组应用使用同一密钥共享数据
KR20140127124A (ko) 시스템 자원에 대한 접근을 관리하는 전자 장치
US11627468B2 (en) Connecting securely to a wireless display from BIOS
CN115981576B (zh) 共享数据的方法、电子设备及存储介质

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 20858803

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

ENP Entry into the national phase

Ref document number: 2020858803

Country of ref document: EP

Effective date: 20220314