WO2021217589A1 - Security data processing method and apparatus - Google Patents

Abstract

Provided are a security data processing method and apparatus, which can improve system security and reduce the risk of attack on the basis of supporting an SMT function. The method comprises: a first processing core executing a first thread in a normal mode; a second processing core executing a second thread in the normal mode; the first processing core pausing the execution of the first thread when needing to switch to a safe mode; the first processing core instructing the second processing core to pause the execution of the second thread; then the second processing core pausing the execution of the second thread under the instruction of the first processing core; and the first processing core processing first information after switching from the normal mode to the safe mode.

Description

Safe data processing method and device Technical field

This application relates to the technical field of secure data, and in particular to a secure data processing method and device.

Background technique

Simultaneous multithreading (SMT, also known as synchronous multithreading) technology means that the central processing unit (CPU) of the architecture is on the physical core or logical core of the central processing unit (CPU) Multiple threads are executed in parallel, and the multiple threads can share physical resources to improve system performance and reduce power consumption. However, time-sharing and multiplexing of shared resources among multiple processing cores will cause differences in the time for accessing shared resources, which will lead to vulnerability to attacks and disclosure of sensitive information.

At present, several methods to reduce the risk of SMT attacks have been proposed, but all have various shortcomings. For example, turning off the SMT function to reduce the risk of attack, but unable to take advantage of the technical advantages of SMT, resulting in a decline in system performance, re-enable the SMT function requires a large delay, such as the need to restart the system. For another example, it is up to the user to determine whether to enable SMT, but the solution is only applicable to products that the user can modify the software configuration, such as computers, and does not apply to products that the user cannot modify the software configuration, such as mobile phones, which have poor applicability, and the solution requires users The SMT can be configured accurately only with the corresponding technical knowledge, and the user experience is poor. Another example is to eliminate code that may leak sensitive information, and change the process of processing sensitive information in the code to a "constant-time" code form. However, when the data stream involving sensitive information is long, the solution will Missing or misreporting the code of sensitive information, and the code corresponding to the sensitive information is also huge, making this solution difficult to implement. For another example, dividing the physical resources of the CPU according to logical cores, assigning physical resources to each logical core separately, and prohibiting one logical core from accessing the physical resources of other logical cores to reduce the risk of attack, similar to the above-mentioned solution of turning off the SMT function. This solution also fails to take advantage of SMT's technical advantages, resulting in a decrease in system performance.

In summary, none of the above-mentioned schemes can take into account the requirements of reducing the risk of attacks and using the technical advantages of SMT.

Summary of the invention

The embodiments of the present application provide a secure data processing method and device, which can improve system security and reduce the risk of attack on the basis of supporting the SMT function. In order to achieve the above-mentioned purpose, this application adopts the following technical solutions.

In the first aspect, a secure data processing method is provided. The safe data processing method includes: a first processing core executes a first thread in a normal mode, a second processing core executes a second thread in a normal mode, and the first processing core suspends execution of the first thread when it needs to switch to the safe mode, The first processing core instructs the second processing core to suspend the execution of the second thread, and then the second processing core suspends the execution of the second thread according to the instruction of the first processing core, and the first processing core switches from the normal mode to the safe mode to process the first information. It should be noted that this application does not limit the sequence in which the first processing core suspends the execution of the first thread and the first processing core instructs the second processing core to suspend the execution of the second thread.

Based on the secure data processing method described in the first aspect, when the processing core does not need to switch to the safe mode to process information, each processing core executes its corresponding thread in the normal mode, taking advantage of multi-threading and improving system performance. When a processing core needs to switch to safe mode, instruct other processing cores to suspend execution of the corresponding thread. If the first processing core needs to switch to safe mode, instruct the second processing core to suspend execution of the second thread, which can eliminate one processing core in safety When the mode processes the first information, other processing nuclei maliciously use the shared resource competition conditions to carry out attacks, thereby improving the security of the system. In addition, this solution does not need to completely turn off the SMT function, which improves system performance.

In a possible design solution, the above-mentioned first processing core instructs the second processing core to suspend the execution of the second thread, which may include: the first processing core sends first instruction information to the control circuit, and the control circuit sends first instruction information to the control circuit in response to the first instruction information. The second processing core sends second instruction information, where the second instruction information is used to instruct the second processing core to suspend execution of the second thread. In other words, the first processing core may send information that it needs to switch to the safe mode to the control circuit, so that the control circuit instructs the second processing core to suspend the execution of the second thread.

Optionally, the control circuit may include: a safe mode synchronization module or an interrupt controller.

In a possible design solution, after the second processing core suspends the execution of the second thread according to the instruction of the first processing core, the secure data processing method may further include: the second processing core switches to the safe mode, or in the normal mode. Enter the first low power consumption state in the mode to reduce power consumption.

Optionally, after the second processing core switches to the safe mode, the safe data processing method may further include: the second processing core enters the second low power consumption state in the safe mode, or processes the second information in the safe mode . That is to say, after the second processing core is switched to the safe mode, it can enter the second low-power state to reduce system power consumption, and can also process the second information that needs to be processed by itself. At this time, the second information can be compared with the first The information is different. It can also be combined with the first processing core into a single core to process the second information. At this time, the second information can be the same as the first information, that is, the combined single core processes the first processing core that needs to be processed by the first processing core. information.

In a possible design solution, after the first processing core switches from the normal mode to the safe mode to process the first information, the safe data processing method may further include: the first processing core exits the safe mode, and the first processing core exits the safe mode. The second processing core is triggered to resume execution of the second thread, the first processing core resumes execution of the first thread, and the second processing core resumes execution of the second thread according to the trigger of the first processing core.

That is to say, after the first processing core finishes processing the first information in the safe mode, it can exit the safe mode, continue to execute the first thread in the normal mode, and trigger the second processing core to resume the execution of the second thread, and continue to play the multi-threaded system. Advantage. It should be noted that this application does not limit the sequence in which the first processing core triggers the second processing core to resume execution of the second thread and the first processing core resumes execution of the first thread.

In a possible design solution, before the first processing core exits the safe mode, the safe data processing method may further include: the first processing core clears traces of processing the first information in the safe mode, that is, the first processing core The use traces of the first information remaining in the shared hardware resources can be cleared in the safe mode, so as to further improve the security of the system. Similarly, if the second processing core processes the second information in the safe mode, before the second processing core exits the safe mode, the second processing core can clear the remaining usage traces of the second information processed in the safe mode in the shared hardware resources, To further improve system security.

Optionally, the first processing core and the second processing core may be physical cores or logical cores.

In the second aspect, a secure data processing device is provided. The secure data processing device includes a first processing core and a second processing core. Among them, the first processing core is used to execute the first thread in the normal mode, suspend the execution of the first thread when it needs to switch to the safe mode, instruct the second processing core to suspend the execution of the second thread, and switch from the normal mode to the safe mode To process the first information. The second processing core is configured to execute the second thread in the normal mode, and suspend the execution of the second thread according to the instruction of the first processing core.

In a possible design solution, the secure data processing device may also include a control circuit. Wherein, the first processing core is also used to send first indication information to the control circuit, and the control circuit is used to send second indication information to the second processing core in response to the first indication information, and the second indication information is used to indicate the second indication information. The processing core suspends execution of the second thread.

Optionally, the control circuit includes: a safe mode synchronization module or an interrupt controller.

In a possible design solution, the second processing core is further configured to switch to the safe mode or enter the first low power consumption state in the normal mode after suspending the execution of the second thread according to the instruction of the first processing core.

In a possible design solution, the second processing core is also used to enter the second low power consumption state in the safe mode after the second processing core is switched to the safe mode, or to process the second information in the safe mode.

In a possible design solution, the first processing core is also used to: after switching from the normal mode to the safe mode to process the first information, exit the safe mode, trigger the second processing core to resume execution of the second thread, and resume Execute the first thread. The second processing core is also used to resume execution of the second thread according to the trigger of the first processing core.

In a possible design solution, the first processing core is also used to clear traces of processing the first information in the safe mode before exiting the safe mode.

Optionally, the first processing core and the second processing core may be physical cores or logical cores.

It should be noted that the secure data processing device described in the second aspect may be a processor. In addition, the technical effect of the secure data processing device described in the second aspect may refer to the security described in any implementation manner of the first aspect. The technical effect of the data processing method will not be repeated here.

In the third aspect, a secure data processing device is provided. The secure data processing device includes a first processing module and a second processing module. Among them, the first processing module is used to implement the function of the first processing core involved in any possible implementation manner in the first aspect, and the second processing module is used to implement the function involved in any possible implementation manner in the first aspect. The second processing core function.

In a possible design solution, the secure data processing device may further include a control module. Wherein, the control module may be used to implement the function of the control circuit involved in any possible implementation manner in the first aspect.

In a possible design solution, the secure data processing device described in the third aspect may further include a storage module, the storage module may be a memory, and the storage module is used to store any one of the possible implementation manners in the first aspect. The program instructions and data of the functions involved. When the first processing module, the second processing module, and the control module execute the program or instruction, the secure data processing device described in the third aspect can execute the secure data processing method described in the first aspect.

Optionally, the secure data processing device described in the third aspect may further include a transceiver module. The transceiver module may be a transceiver circuit or an input/output port, and the transceiver module may be used to implement the transceiver function involved in any one of the possible implementation manners in the first aspect. The transceiver module may include a receiving module and a sending module, and this application does not specifically limit the specific implementation of the transceiver module.

It should be noted that the secure data processing device described in the third aspect may be a processor, and one or more of the above modules may be implemented by hardware, software, or hardware execution of corresponding software. The hardware or software includes one or more modules or units corresponding to the above-mentioned functions. When any of the above modules is implemented in software, the software exists in the form of computer program instructions and is stored in the memory. In addition, the technical effect of the secure data processing device described in the third aspect may refer to the technical effect of the secure data processing method described in any implementation manner in the first aspect, which will not be repeated here.

In a fourth aspect, a secure data processing system is provided. The secure data processing system includes the secure data processing device described in the second or third aspect.

In a fifth aspect, a computer-readable storage medium is provided. The computer-readable storage medium includes a computer program or instruction. When the computer program or instruction runs on a computer, the computer executes any one of the possible implementation methods in the first aspect. In the secure data processing method described above, the computer includes a first processing core and a second processing core.

In a sixth aspect, a computer program product is provided. The computer program product includes: a computer program or instruction, which when the computer program or instruction runs on a computer, causes the computer to execute the security described in any one of the possible implementation manners in the first aspect In a data processing method, the computer includes a first processing core and a second processing core.

Description of the drawings

FIG. 1 is a schematic diagram of the architecture of a secure data processing system provided by an embodiment of the application;

FIG. 2 is a first schematic flowchart of a secure data processing method provided by an embodiment of this application;

FIG. 3 is a first structural diagram of a secure data processing device provided by an embodiment of the application;

FIG. 4 is a second schematic flowchart of a secure data processing method provided by an embodiment of this application;

FIG. 5 is a third schematic flowchart of a secure data processing method provided by an embodiment of this application;

FIG. 6 is a second structural diagram of a secure data processing device provided by an embodiment of this application;

FIG. 7 is a third structural diagram of a secure data processing device provided by an embodiment of the application.

Detailed ways

The technical solution in this application will be described below in conjunction with the accompanying drawings. In this application, "at least one" refers to one or more, and "multiple" refers to two or more. "And/or" describes the association relationship of the associated objects, indicating that there can be three relationships, for example, A and/or B, which can mean: A alone exists, A and B exist at the same time, and B exists alone, where A, B can be singular or plural. The character "/" generally indicates that the associated objects before and after are in an "or" relationship. "The following at least one item (a)" or similar expressions refers to any combination of these items, including any combination of a single item (a) or a plurality of items (a). For example, at least one of a, b, or c can mean: a, b, c, a-b, a-c, b-c or a-b-c, where a, b, and c can be single or multiple.

This application will present various aspects, embodiments, or features around a system that may include multiple devices, components, modules, and the like. It should be understood and understood that each system may include additional devices, components, modules, etc., and/or may not include all the devices, components, modules, etc. discussed in conjunction with the accompanying drawings. In addition, a combination of these schemes can also be used.

In addition, in the embodiments of the present application, words such as "exemplary" and "for example" are used to represent examples, illustrations, or illustrations. Any embodiment or design solution described as an "example" in this application should not be construed as being more preferable or advantageous than other embodiments or design solutions. Rather, the term example is used to present the concept in a concrete way.

FIG. 1 is a schematic structural diagram of a secure data processing system to which the secure data processing method provided in an embodiment of the application is applicable. To facilitate the understanding of the embodiments of the present application, first, the architecture of the secure data processing system shown in FIG. 1 is taken as an example to describe in detail the architecture of the secure data processing system applicable to the embodiments of the present application. The secure data processing system can be an Intel architecture CPU using SMT technology, an ARM architecture CPU using SMT technology, or other CPUs using SMT technology. It should be noted that the solutions in the embodiments of the present application can also be applied to secure data processing systems of other architectures. Of course, in this embodiment, a CPU is taken as an example for introduction, but this solution is not limited to this, but can be extended to other types of processors.

As shown in Figure 1, the secure data processing system includes a hardware layer and a software layer. Among them, the hardware layer may include a first processing core and a second processing core. It can be understood that the solution of the present application may include more processing cores, and the subsequent embodiments only take two processing cores as an example for introduction. Optionally, the hardware layer may also include a control circuit. The software layer may include an untrusted execution environment (REE, also known as a rich execution environment), a trusted execution environment (TEE), and a security processing core scheduling module. Among them, REE environment can be called normal mode or non-secure mode, including Android or Windows environment, TEE environment can be called security mode, and the security processing core scheduling module can include: active processing core scheduling module, idle processing core scheduling module, and safe processing Nuclear synchronization control module.

The components of the hardware layer of the secure data processing system are specifically introduced below. Among them, the first processing core executes the first thread, and the second processing core executes the second thread. Optionally, the secure data processing system may include more than two processing cores, and each of the two or more processing cores may execute respective corresponding threads in the REE environment, which is not limited in this application. Optionally, the first processing core may include a first synchronization circuit, and the second processing core may include a second synchronization circuit. For the specific implementation of the first synchronization circuit and the second synchronization circuit, refer to the following S203, which will not be repeated here. .

The control circuit can be used to realize the communication interaction between the processing cores, such as inter-process communication. Specifically, the control circuit receives the event sent by the processing core that the processing core needs to switch to the TEE environment, and triggers other processing cores to suspend or resume execution. The thread does not need to completely shut down the SMT mode, but allows other processing cores to suspend or resume work when SMT is enabled. Exemplarily, the control circuit may be used to realize that the first processing core instructs the second processing core to suspend or resume the execution of the second thread. Optionally, the control circuit may include a safe mode synchronization module or an interrupt controller (not shown in FIG. 1), and the specific implementation of the safe mode synchronization module or interrupt controller can refer to the following S203, which will not be repeated here.

The software modules included in the software layer of the secure data processing system are specifically introduced below. Among them, the non-trusted execution environment can also be referred to as a rich execution environment, and the processing core can execute corresponding threads in the non-trusted execution environment. For example, the first processing core executes the first thread in the untrusted execution environment, and the second processing core executes the second thread in the untrusted execution environment.

The trusted execution environment is isolated from the untrusted execution environment and can be used to protect sensitive information. The processing core can execute secure business code in a trusted execution environment, for example, fingerprint verification, identity verification, etc. can be performed.

The active processing core scheduling module can be used to schedule processing cores that actively request to switch from the REE environment to the TEE environment to enter the TEE environment. For example, when the first processing core needs to switch from the REE environment to the TEE environment, the code of the active processing core scheduling module is executed to switch to the TEE environment.

The idle processing core scheduling module can be used to schedule processing cores other than the processing core that actively requests to switch to the TEE environment to switch to the TEE environment. For example, if the first processing core is a processing core that actively requests to switch to the TEE environment, the second processing core may execute the code of the idle processing core scheduling module to enter the TEE environment.

The security processing core synchronization control module is the drive of the control circuit of the hardware layer and can trigger the control circuit to produce corresponding actions. For example, the trigger control circuit instructs the second processing core to suspend execution of the second thread. This solution does not need to completely close the SMT mode, but allows the second processing core to suspend work or resume afterwards when SMT is enabled.

It should be understood that FIG. 1 is only a simplified schematic diagram of an example for ease of understanding, and the schematic structural diagram of the secure data processing system may also include other components/units, which are not shown in FIG. 1. The secure data processing method provided by the embodiment of the present application will be described in detail below in conjunction with Figures 2 to 5.

FIG. 2 is a first schematic flowchart of a secure data processing method provided by an embodiment of this application. The secure data processing method can be applied to the communication between the various components of the hardware layer shown in FIG. 1. As shown in FIG. 2, the secure data processing method includes the following steps: S201, the first processing core executes the first thread in the normal mode, and the second processing core executes the second thread in the normal mode. Optionally, the normal mode may be the REE environment shown in FIG. 1, the normal mode may also be referred to as an unsafe mode, the REE environment is a general operating environment, and the processing core may execute the corresponding thread in the REE environment. Optionally, the first processing core and the second processing core may be physical cores or logical cores.

The physical core and logical core will be introduced below in conjunction with Figure 3. The secure data processing method provided by the embodiment of the present application can be applied to a secure data processing device. FIG. 3 is a structural schematic diagram 1 of the secure data processing device provided in an embodiment of the present application.

As shown in FIG. 3, the secure data processing device may include one or more physical cores, such as physical core 0 and physical core 1. Each physical core may include one or more logical cores, such as logical core 0 and logical core 1. Among them, each physical core may include physical resources, that is, a corresponding circuit hardware core. Specifically, the physical resource may include at least one of the following: Level 1 instruction cache (L1 Instruction Cache), Level 1 data cache (L1 data cache), cache bank, translation lookaside buffer, TLB ), computing unit (vector unit), load/store buffer, port connection, etc. The logical cores included in the physical core can share the physical resource. For example, the logical core 0 and the logical core 1 can share the physical resources of the physical core, which can improve system performance and reduce power consumption. It should be understood that FIG. 3 is only a simplified schematic diagram for ease of understanding. The schematic structural diagram of the secure data processing device may also include other components/units, which are not shown in FIG. 3. The specific definition of the logic core can be described with reference to the prior art.

S202: The first processing core suspends execution of the first thread when it needs to switch to the safe mode. Optionally, the security mode may be the TEE environment shown in FIG. 1, and fingerprint verification, identity verification, etc. may be performed in the TEE environment. In other words, when the first thread needs to use the TEE service, the first processing core invokes the secure monitor call (SMC) instruction through the first thread, thereby determining that the first processing core needs to switch to the safe mode and pause in the normal mode. The first thread of execution in the mode.

S203: The first processing core instructs the second processing core to suspend execution of the second thread. It should be noted that the second processing core may first suspend the execution of the first thread when it needs to switch to the safe mode, and then instruct the second processing core to suspend the execution of the second thread. Alternatively, the second processing core may first instruct the second processing core to suspend the execution of the second thread when it needs to switch to the safe mode, and then suspend the execution of the first thread by itself. That is to say, this application does not limit the sequence of the foregoing S202 and S203.

In a possible design solution, in the foregoing S203, the first processing core instructs the second processing core to suspend the execution of the second thread, which may include the following steps 1 to 2.

Step 1: The first processing core sends first instruction information to the control circuit. Optionally, the first indication information may be used to indicate that the first processing core needs to switch to the safe mode. Alternatively, the first indication information may be used to instruct the second processing core to suspend execution of the second thread.

In other words, the first processing core may send its own actions to be performed to the control circuit for the control circuit to determine the following second instruction information. Alternatively, the first processing core may directly send the instruction information to the second processing core to the control circuit according to its own state, and the control circuit directly forwards the instruction information of the first processing check to the second processing core, that is, the following second instruction information is at this time and The first indication information is the same.

Step 2: The control circuit sends second instruction information to the second processing core in response to the first instruction information. Optionally, the second indication information may be used to instruct the second processing core to suspend execution of the second thread. Optionally, the second indication information may include a synchronization signal, or a safety interrupt, or a non-safe interrupt. Among them, the synchronization signal can be used to instruct the second processing core to switch to the safe mode, the safety interrupt can be used to instruct the second processing core to switch to the safe mode, and the non-safe interrupt can be used to instruct the second processing core to enter the first mode in the normal mode. Low power consumption state. The power consumption of the second processing core in the first low power consumption state is lower than the power consumption of the second processing core in a normal working state.

Further, the control circuit may include: a safe mode synchronization module or an interrupt controller. Taking the safe mode synchronization module as an example, in a possible design solution, in the foregoing S203, the first processing core instructs the second processing core to suspend execution of the second thread, which may include the following steps three to four.

Step 3: The first processing core sends first instruction information to the security mode synchronization module. Optionally, for the specific implementation of the first indication information, refer to the above step 1, which will not be repeated here. Specifically, the safe mode synchronization module can be used to trigger other processing cores to switch to the safe mode when one processing core needs or has switched to the safe mode. For example, if the first processing core needs or has been switched to the safe mode, the second processing core is triggered to switch to the safe mode.

Step 4: The security mode synchronization module responds to the first instruction information and sends second instruction information to the second processing core. Optionally, the second indication information may be a synchronization signal. For the specific implementation of the second indication information, refer to the above step two, which will not be repeated here.

It should be noted that the methods for switching the safety mode include synchronous switching and asynchronous switching. Among them, the processing core enters the safe mode through the SMC instruction, and exits the safe mode through the abnormal instruction is called synchronous switching. The way the processing core enters the safe mode through an external interrupt or exception is called asynchronous switching. TrustZone technology can support synchronous handover and asynchronous handover, while Intel SGX technology only supports synchronous handover.

Specifically, in the secure data processing method shown in FIG. 2, under the support of the secure mode synchronization module at the hardware layer, the first processing core switches to the secure mode solution, which has short delay, low performance overhead, and reduces the risk of attack. This solution is also suitable for the scenario of synchronously switching to the safe mode and the scenario of asynchronously switching to the safe mode, which can protect the TEE environment of TrustZone technology and Intel SGX technology and reduce the risk of attack.

Further, any of the aforementioned processing cores may also include a synchronization circuit. For example, the first processing core may also include a first synchronization circuit, and the second processing core may also include a second synchronization circuit. Specifically, the first synchronization circuit may be used to actively send the first indication information to the safe mode synchronization module when the first processing core needs to switch from the normal mode to the safe mode. The second synchronization circuit may be used to trigger the second processing core to suspend execution of the corresponding thread when the second instruction information is received.

It should be noted that the safe data switching method shown in FIG. 2 is illustrated by taking the first processing core to actively switch to the safe mode as an example. It should be understood that if the second processing core actively switches to the safe mode, the second processing core can perform the functions of the first processing core in the safe data switching method shown in FIG. 2, and the first processing core can execute the safe data shown in FIG. The function of the second processing core in the switching method. Similarly, the second synchronization circuit may perform the function of the first synchronization circuit in the secure data switching method shown in FIG. 2, and the first synchronization circuit may perform the function of the second synchronization circuit in the secure data switching method shown in FIG. 2.

Further, in a possible design solution, in the foregoing S203, the first processing core instructs the second processing core to suspend the execution of the second thread, which may include the following steps five to six. Step 5: The first synchronization circuit of the first processing core sends the first indication information to the safe mode synchronization module. For the specific implementation of the first indication information, refer to the above step 1, which will not be repeated here.

Step 6. The security mode synchronization module responds to the first instruction information and sends the second instruction information to the second synchronization circuit of the second processing core. Optionally, the second indication information may be used to instruct the second processing core to suspend execution of the second thread. Optionally, the second indication information may be a synchronization signal. For the specific implementation of the second indication information, refer to the above step two, which will not be repeated here.

In other words, the synchronization circuit can monitor the security mode switching event of the processing core corresponding to the synchronization circuit, and send the event to the security mode synchronization module, so that the security mode synchronization module instructs other processing cores to suspend execution threads, and also It can be used to receive the instruction information of suspending the execution thread sent by the safe mode synchronization module, and trigger the processing core to suspend the execution of the corresponding thread.

Taking the interrupt controller as an example, in another possible design solution, in the foregoing S203, the first processing core instructs the second processing core to suspend the execution of the second thread, which may include the following steps 7 to 8. Step 7, the first processing core sends the first indication information to the interrupt controller. For the specific implementation of the first indication information, refer to the above step 1, which will not be repeated here.

Specifically, the interrupt controller can be used to generate inter-processor interrupt (IPI). One processing core can send interrupts to other processing cores through the interrupt controller. The interrupt controller can include data bus buffers and read/write. Circuits, registers and other components.

Step 8. The interrupt controller sends second instruction information to the second processing core in response to the first instruction information. Optionally, the second indication information may be a secure interrupt or a non-secure interrupt. For the specific implementation of the second indication information, refer to the above step two, which will not be repeated here.

It should be noted that the secure data processing method shown in Figure 2 is supported by the interrupt controller at the hardware layer and is suitable for asynchronous switching to the secure mode scenario, which can protect the TEE environment of the TrustZone technology and reduce the risk of attack.

S204: The second processing core suspends execution of the second thread according to the instruction of the first processing core. In a possible design solution, after the second processing core suspends the execution of the second thread according to the instruction of the first processing core, the secure data processing method shown in FIG. 2 may further include: the second processing core switches to the safe mode , Or the second processing core enters the first low power consumption state in the normal mode.

Further, in a possible design solution, the above-mentioned second processing core is switched to the safe mode, which may include the following steps nine to eleven. Step 9: The second processing core receives the second instruction information from the security mode synchronization module. Optionally, the second indication information may be a synchronization signal, and the synchronization signal may be used to instruct the second processing core to switch to the safe mode. Step 10: The second processing core suspends the execution of the second thread. Step eleven, the second processing core switches to the safe mode.

In another possible design solution, the above-mentioned second processing core is switched to the safe mode, which may include the following steps twelve to fourteen. Step 12: The second processing core receives the second instruction information from the interrupt controller. Optionally, the second indication information may be a safe interrupt, and the safe interrupt may be used to instruct the second processing core to switch to the safe mode. In step 13, the second processing core suspends the execution of the second thread. Step 14, the second processing core switches to the safe mode.

That is to say, both the safe mode synchronization module and the interrupt controller can instruct the second processing core to enter the safe mode. In this way, the attack risk caused by the second processing core when the first processing core processes the first information in the safe mode can be eliminated. Thereby improving system security.

In a possible design solution, the above-mentioned second processing core enters the first low power consumption state in the normal mode, which may include the following steps 15 to 17. Step 15: The second processing core receives the second instruction information from the interrupt controller. Optionally, the second indication information may be a non-secure interrupt, and the non-secure interrupt may be used to instruct the second processing core to enter the first low power consumption state in the normal mode. Step 16, the second processing core suspends the execution of the second thread. Step 17, the second processing core enters the first low power consumption state in the normal mode.

That is to say, the interrupt controller can instruct to enter the first low power consumption state in the normal mode. In this way, the attack risk caused by the second processing core when the first processing core processes the first information in the safe mode can be eliminated, thereby Improve system security.

S205: The first processing core switches from the normal mode to the safe mode to process the first information. Optionally, the first information may include sensitive information such as a username, a key, user data, and key system data, which is not limited in this embodiment.

In a possible design solution, after the second processing core is switched to the safe mode, the safe data processing method shown in FIG. 2 may further include: S206, the second processing core enters the second low power consumption in the safe mode Status, or the second processing core processes the second information in the safe mode. Wherein, the second information may include sensitive information such as username, key, user data, key system data, etc. In the second low power consumption state, the power consumption of the second processing core is lower than that of the second processing core in the normal working state. Power consumption. It should be noted that the second information may be the same as or different from the first information.

Taking the same second information as the first information as an example, after the second processing core is switched to the safe mode, the second processing core can be merged with the first processing core into a single core to process the second information. This single core is compared with the first processing core. The processing core has higher performance, which can improve the efficiency of secure data processing, thereby improving system performance. Under this solution, the second information can be the same as the first information, that is, the combined single core is used to process the first information.

Taking the second information and the first information as an example, if the second processing core needs to enter the safe mode to process the second information that needs to be processed, the second processing core can process the second information that needs to be processed after switching to the safe mode. Second information.

Further, in the above S205, after the first processing core switches from the normal mode to the safe mode to process the first information, the safe data processing method shown in FIG. 2 may further include the following S207 to S210. S207: The first processing core exits the safe mode. That is to say, after the first processing core finishes processing the first information in the safe mode, it exits the safe mode and returns to the normal mode.

S208: The first processing core triggers the second processing core to resume execution of the second thread. Optionally, in S208, before the first processing core triggers the second processing core to resume execution of the second thread, the first processing core may trigger the second processing core to exit the safe mode or exit the first low power consumption state in the normal mode.

It should be noted that the first processing core may exit the safe mode first, and then trigger the second processing core to exit the safe mode or exit the first low power consumption state in the normal mode. Alternatively, the first processing core may first trigger the second processing core to exit the safe mode or exit the first low power consumption state in the normal mode, and then exit the safe mode, which is not limited in this application.

S209: The first processing core resumes execution of the first thread. It should be noted that the first processing core may first trigger the second processing core to resume execution of the second thread, and then resume execution of the first thread. Alternatively, the first processing core may resume execution of the first thread first, and then trigger the second processing core to resume execution of the second thread. The present application does not limit the sequence in which the first processing core triggers the second processing core to resume execution of the second thread and resume execution of the first thread.

S210: The second processing core resumes executing the second thread according to the trigger of the first processing core. That is to say, after the first processing core finishes processing the first information in the safe mode, it can exit the safe mode, continue to execute the first thread in the normal mode, and trigger the second processing core to resume the execution of the second thread, and continue to play the multi-threaded system. Advantage.

In a possible design solution, before the first processing core exits the safe mode in S207, the safe data processing method shown in FIG. 2 may further include: the first processing core clears the processing of the first information in the safe mode trace. In this way, after the first processing core finishes processing the first information, it can clear the remaining usage traces of the first information in the shared hardware resource in the safe mode. For example, the traces can include the cache, page table cache, or transfer occupied by the processing information. Address bypassing cache, etc., clearing actions include random number overwriting, formatting and other operations, which can further improve system security.

In a possible design solution, before the second processing core exits the safe mode, the safe data processing method shown in FIG. 2 may further include: the second processing core clears traces of processing the second information in the safe mode. In other words, if the second processing core processes the second information in the safe mode, before the second processing core exits the safe mode, the second processing core can clear the remaining usage traces of the second information processed in the safe mode in the shared hardware resources, For example, the removal behavior includes operations such as random number overwriting, formatting, etc., to further improve system security.

The foregoing FIG. 2 takes the interaction between the various components of the hardware layer as an example to illustrate in detail the secure data processing method provided by the embodiment of the present application. The following takes the interaction between the hardware layer and the software layer as an example to describe in detail the secure data processing method provided in the embodiments of the present application.

Fig. 4 is a second schematic flowchart of a secure data processing method provided by an embodiment of the application. The secure data processing method can be applied to the interaction between the hardware layer and the software layer as well as the modules in the software layer as shown in FIG. 1. As shown in FIG. 4, the secure data processing method includes the following steps: S401, a first processing core executes a first thread, and a second processing core executes a second thread. That is, the first processing core executes the first thread in the normal mode, and the second processing core executes the second thread in the normal mode.

Optionally, the normal mode may be the REE environment shown in FIG. 1, the normal mode may also be referred to as an unsafe mode, the REE environment is a general operating environment, and the processing core may execute the corresponding thread in the REE environment. Optionally, the first processing core and the second processing core may be physical cores or logical cores. For the specific implementation of the physical core and the logical core, refer to the above S201, which will not be repeated here.

S402: The first processing core executes the switching instruction to call the active processing core scheduling module. Optionally, the switching instruction may be an SMC instruction. That is, the first processing core executes the SMC instruction to execute the code of the active processing core scheduling module, so that the active processing core scheduling module schedules the first processing core to switch to the safe mode to process the first information. Optionally, the security mode may be the TEE environment shown in FIG. 1, and fingerprint verification, identity verification, etc. may be performed in the TEE environment.

S403: The first processing core executes the code of the active processing core scheduling module, and sends the first instruction information to call the security processing core synchronization control module. Optionally, the control circuit may include: a safe mode synchronization module or an interrupt controller. For the specific implementation of the control circuit, the first instruction information, and the second instruction information, refer to the foregoing S203, which will not be repeated here. In a possible design solution, the first processing core may include a first synchronization circuit, and the second processing core may include a second synchronization circuit.

In S403, the first processing core executes the code of the active processing core scheduling module, and sends the first instruction information to call the security processing core synchronization control module, which may include the following steps 22 to 23. Step 22: The first processing core executes the code of the active processing core scheduling module, and triggers the first synchronization circuit to send the first indication information to call the security processing core synchronization control module. Step 23: The security processing core synchronization control module triggers the security mode synchronization module of the hardware layer to send second indication information to the second synchronization circuit of the second processing core. Wherein, the second indication information may be a synchronization signal.

It should be noted that the safe data processing method shown in Figure 4 is supported by the safe mode synchronization module at the hardware layer, and is suitable for both synchronously switching to safe mode scenarios and asynchronously switching to safe mode scenarios, thereby protecting TrustZone Technology, Intel SGX technology TEE environment, reduce the risk of attack.

In another possible design solution, the above S403, the first processing core executes the code of the active processing core scheduling module, and sends the first instruction information to call the security processing core synchronization control module, which may include the following steps 24 to 2 fifteen. Step 24: The first processing core executes the code of the active processing core scheduling module, and sends the first instruction information to call the security processing core synchronization control module. Step 25: The security processing core synchronization control module triggers the interrupt controller to send second indication information to the second processing core. Wherein, the second indication information may be a safety interrupt.

It should be noted that the secure data processing method shown in Figure 4, with the support of the interrupt controller at the hardware layer, is suitable for asynchronous switching to the secure mode scenario, which can protect the TEE environment of the TrustZone technology and reduce the risk of attack.

S404: The control circuit sends second indication information to the second processing core. In a possible design solution, the second processing core may include a second synchronization circuit. In the above S404, the control circuit sends the second instruction information to the running second processing core, which may include: the security processing core synchronization control module triggers the hardware layer The safe mode synchronization module sends the second indication information to the second synchronization circuit of the second processing core. Wherein, the second indication information may be a synchronization signal.

In another possible design solution, the second processing core does not include the second synchronization circuit. In S404, the control circuit sends the second instruction information to the running second processing core, which may include: the security processing core synchronization control module triggers interrupt control The processor sends second indication information to the second processing core. Wherein, the second indication information may be a safety interrupt.

S405: The second processing core suspends execution of the second thread, and executes the code of the idle processing core scheduling module. In a possible design solution, the second processing core includes a second synchronization circuit. In the above S405, the second processing core suspends execution of the second thread and executes the code of the idle processing core scheduling module, which may include: the second processing core according to The second instruction information received by the second synchronization circuit suspends the execution of the second thread, and executes the code of the idle processing core scheduling module to schedule the second processing core to switch to the safe mode.

In another possible design solution, the second processing core does not include the second synchronization circuit. In S405, the second processing core suspends the execution of the second thread and executes the code of the idle processing core scheduling module, which may include: second processing The core suspends the execution of the second thread and executes the code of the idle processing core scheduling module to schedule the second processing core to switch to the safe mode.

S406: The second processing core switches to the safe mode according to the scheduling of the idle processing core scheduling module. S407: The idle processing core scheduling module sends third indication information to invoke the security processing core synchronization control module.

Optionally, the third indication information may be used to indicate that the second processing core has switched to the safe mode. That is, the control circuit is notified that the second processing core has switched to the safe mode, and the control circuit is triggered to invoke the active processing core scheduling module to schedule the first processing core to switch to the safe mode.

S408: In response to the third instruction information, the control circuit sends fourth instruction information to invoke the active processing core scheduling module. Optionally, the fourth indication information may be used to indicate that the second processing core has switched to the safe mode, or used to instruct the active processing core scheduling module to schedule the first processing core to switch from the normal mode to the safe mode to process the first information.

S409: The first processing core switches from the normal mode to the safe mode according to the scheduling of the active processing core scheduling module to process the first information. Optionally, for the specific implementation manner of the first information, refer to the foregoing S205, which will not be repeated here.

S410: The second processing core enters the second low power consumption state in the safe mode according to the scheduling of the idle processing core scheduling module, or processes the second information in the safe mode. Optionally, for the specific implementation manner of the second information, refer to the foregoing S205, which will not be repeated here.

S411: The first processing core sends fifth instruction information to call the security processing core synchronization control module. The fifth indication information may be used to indicate that the first processing core has finished processing the first information. That is, the first processing core sends the fifth instruction information to call the security processing core synchronization control module, triggers the first processing core to call the active processing core scheduling module, and triggers the second processing core to call the idle processing core scheduling module.

Optionally, in the foregoing S411, before the first processing core sends the fifth instruction information to invoke the security processing core synchronization control module, the first processing core may clear traces of processing the first information in the safe mode, thereby further improving data security.

S412: In response to the fifth instruction information, the control circuit sends sixth instruction information to invoke the active processing core scheduling module, and sends seventh instruction information to invoke the idle processing core scheduling module. Optionally, the sixth indication information may be used to indicate that the first processing core is triggered to resume execution of the first thread, and the seventh indication information may be used to indicate that the second processing core is triggered to resume execution of the second thread. In other words, instruct the first processing core and the second processing core to resume execution of their corresponding threads, and continue to take advantage of the system's multithreading.

S413: The first processing core exits the safe mode according to the scheduling of the active processing core scheduling module and resumes the execution of the first thread, and the second processing core exits the safe mode according to the scheduling of the idle processing core scheduling module and resumes the execution of the second thread. Optionally, in the above S413, the second processing core exits the safe mode according to the scheduling of the idle processing core scheduling module, and before resuming the execution of the second thread, the second processing core can clear the traces of processing the second information in the safe mode to further improve Data security.

FIG. 5 is a third flowchart of a secure data processing method provided by an embodiment of the application. The secure data processing method may be applicable to the interaction between the first processing core, the second processing core, the interrupt controller, and the software layer shown in FIG. 1, and the second indication information is a non-secure interrupt. As shown in FIG. 5, the secure data processing method includes the following steps: S501, a first processing core executes a first thread, and a second processing core executes a second thread. That is, the first processing core executes the first thread in the normal mode, and the second processing core executes the second thread in the normal mode. Optionally, the normal mode may be the REE environment shown in FIG. 1, the normal mode may also be referred to as an unsafe mode, the REE environment is a general operating environment, and the processing core may execute the corresponding thread in the REE environment. Optionally, the first processing core and the second processing core may be physical cores or logical cores. For the specific implementation of the physical core and the logical core, refer to the above S201, which will not be repeated here.

S502: The first processing core executes the switching instruction to call the active processing core scheduling module. Optionally, the switching instruction may be an SMC instruction. That is, the first processing core executes the SMC instruction to execute the code of the active processing core scheduling module, so that the active processing core scheduling module schedules the first processing core to switch to the safe mode to process the first information. Optionally, the security mode may be the TEE environment shown in FIG. 1, and fingerprint verification, identity verification, etc. may be performed in the TEE environment.

S503: The first processing core executes the code of the active processing core scheduling module, and sends the first instruction information to call the security processing core synchronization control module. In a possible design solution, the above S503, the first processing core executes the code of the active processing core scheduling module, and sends the first instruction information to call the security processing core synchronization control module, which may include the following steps 26 to 20 seven. Step 26: The first processing core executes the code of the active processing core scheduling module, and sends the first instruction information to call the security processing core synchronization control module. Step 27: The security processing core synchronization control module triggers the interrupt controller to send second indication information to the second processing core. Wherein, the second indication information may be a non-secure interrupt. Optionally, the non-secure interrupt may be used to instruct the second processing core to enter the first low power consumption state in the normal mode.

It should be noted that the secure data processing method shown in Fig. 5, with the support of the interrupt controller at the hardware layer, is suitable for the scenario of asynchronously switching to the secure mode, which can protect the TEE environment of the TrustZone technology and reduce the risk of attack.

S504: The interrupt controller sends second indication information to the second processing core. It should be noted that, in S404, the control circuit sends the second instruction information to the second processing core. When the control circuit is an interrupt controller, the second instruction information is a safe interrupt. The difference is that the second instruction information in S504 It is a non-safe interrupt. Among them, the safety interrupt is not maskable in the normal mode, and the non-safe interrupt can be masked in the normal mode.

S505: The second processing core suspends the execution of the second thread, and enters the first low power consumption state in the normal mode. In this way, the second processing core suspends the execution of the second thread and enters the first low power consumption state in the normal mode, which can eliminate the attack risk caused by the second processing core when the first processing core processes the first information in the safe mode. Thereby improving system security.

S506: The interrupt controller sends the eighth instruction information to call the active processing core scheduling module. Optionally, the eighth indication information may be used to indicate that the second processing core has entered the first low power consumption state in the normal mode. That is, the interrupt controller sends the eighth indication information to trigger the interrupt controller to call the active processing core scheduling module to schedule the first processing core to switch to the safe mode.

S507: The first processing core switches from the normal mode to the safe mode according to the scheduling of the active processing core scheduling module to process the first information. Optionally, for the specific implementation manner of the first information, refer to the foregoing S205, which will not be repeated here.

S508: The first processing core sends ninth instruction information to invoke the synchronization control module of the security processing core. Wherein, the ninth indication information may be used to indicate that the first processing core has processed the first information. That is, the first processing core may send the ninth instruction information to call the security processing core synchronization control module, and trigger the interrupt controller to call the active processing core scheduling module.

Optionally, in the foregoing S508, before the first processing core sends the ninth instruction information to invoke the secure processing core synchronization control module, the first processing core may clear traces of processing the first information in the safe mode, thereby further improving data security.

S509: In response to the ninth instruction information, the interrupt controller sends the tenth instruction information to call the active processing core scheduling module. Optionally, the tenth indication information may be used to indicate that the first processing core is triggered to resume execution of the first thread.

S510: The first processing core exits the safe mode according to the scheduling of the active processing core scheduling module and resumes the execution of the first thread. The second processing core exits the first low power consumption state according to the scheduling of the safety processing core synchronization control module and resumes the execution of the second thread. . In this way, after the first processing core has processed the first information in the safe mode, the first processing core and the second processing core resume execution of their corresponding threads, and continue to take advantage of the system's multithreading.

Based on the secure data processing method described in any one of Figure 2, Figure 4, and Figure 5, when the processing core does not need to switch to the safe mode to process information, each processing core executes its corresponding thread in the normal mode, giving full play to multi-threading. When one of the processing cores needs to switch to the safe mode, the other processing cores are instructed to suspend the execution of the corresponding thread. If the first processing core needs to switch to the safe mode, the second processing core is instructed to suspend the execution of the second Threads can eliminate the risk that when one processing core processes the first information in a safe mode, other processing cores maliciously use shared resource competition conditions to carry out attacks, thereby improving system security. In addition, this solution does not need to completely turn off the SMT function, which improves system performance.

The secure data processing method provided by the embodiments of the present application is described in detail above with reference to FIGS. 2 to 5. The secure data processing device provided by the embodiment of the present application will be described in detail below with reference to FIGS. 6-7.

Fig. 6 is a second structural diagram of a secure data processing device provided by an embodiment of the present application. The secure data processing device can be applied to the secure data processing system shown in FIG. 1 to execute the secure data processing method shown in any one of FIG. 2 and FIG. 4 to FIG. 5. For ease of description, FIG. 6 only shows the main components of the secure data processing device.

As shown in FIG. 6, the secure data processing device 600 includes a first processing core 601 and a second processing core 602. Among them, the first processing core 601 is used to execute the first thread in the normal mode. The second processing core 602 is used to execute the second thread in the normal mode. The first processing core 601 is also used to suspend the execution of the first thread when it is necessary to switch to the safe mode. The first processing core 601 is also used to instruct the second processing core 602 to suspend the execution of the second thread. The second processing core 602 is further configured to suspend the execution of the second thread according to the instruction of the first processing core 601. The first processing core 601 is also used to switch from the normal mode to the safe mode to process the first information.

In a possible design solution, the secure data processing device 600 may further include a control circuit 603. Wherein, the first processing core 601 is also used to send first instruction information to the control circuit 603. The control circuit 603 is configured to send second instruction information to the second processing core 602 in response to the first instruction information, and the second instruction information is used to instruct the second processing core 602 to suspend execution of the second thread. Optionally, the control circuit 603 includes: a safe mode synchronization module or an interrupt controller (not shown in FIG. 6).

In a possible design solution, the second processing core 602 is also used to switch to the safe mode or enter the first low power consumption in the normal mode after suspending the execution of the second thread according to the instruction of the first processing core 601 state. In a possible design solution, the second processing core 602 is also used to enter the second low-power state in the safe mode after the second processing core 602 is switched to the safe mode, or to process the second processing core in the safe mode. information.

In a possible design solution, the first processing core 601 is also used to exit the safe mode after switching from the normal mode to the safe mode to process the first information. The first processing core 601 is also used to trigger the second processing core 602 to resume execution of the second thread. The first processing core 601 is also used to resume execution of the first thread. The second processing core 602 is further configured to resume execution of the second thread according to the trigger of the first processing core 601.

In a possible design solution, the first processing core 601 is also used to clear traces of processing the first information in the safe mode before exiting the safe mode. Similarly, if the second processing core 602 processes the second information in the safe mode, the second processing core 602 is also used to clear the remaining use traces of the second information in the shared hardware resource in the safe mode before exiting the safe mode. Improve system security.

Optionally, the first processing core 601 and the second processing core 602 may be physical cores or logical cores. It should be noted that the secure data processing device 600 may be a processor. In addition, the technical effects of the secure data processing device 600 can refer to the technology of the secure data processing method described in any one of the implementation modes in FIGS. 2 and 4 to 5 The effect will not be repeated here.

FIG. 7 is a third structural diagram of a secure data processing device provided by an embodiment of the present application. The secure data processing device can be applied to the secure data processing system shown in FIG. 1 to execute the secure data processing method shown in any one of FIG. 2 and FIG. 4 to FIG. 5. For ease of description, FIG. 7 only shows the main components of the secure data processing device.

As shown in FIG. 7, the secure data processing device 700 includes a first processing module 701 and a second processing module 702. The first processing module 701 is used to implement the function of the first processing core involved in the foregoing method embodiment, and the second processing module 702 is used to implement the function of the second processing core involved in the foregoing method embodiment.

In a possible design solution, the secure data processing device 700 may further include a control module 703. Wherein, the control module 703 may be used to implement the functions of the control circuit involved in the foregoing method embodiments.

Optionally, the secure data processing apparatus 700 may further include a storage module (not shown in FIG. 7), the storage module may be a memory, and the storage module may be used to store program instructions and data that implement the functions involved in the foregoing method embodiments. When the first processing module 701, the second processing module 702, and the control module 703 execute the program or instruction, the secure data processing apparatus 700 can execute the secure data processing method shown in any one of FIGS. 2, 4 to 5 .

Optionally, the secure data processing device 700 may further include a transceiver module (not shown in FIG. 7). The transceiver module may be a transceiver circuit or an input/output port. The transceiver module may be used to implement the transceiver functions involved in the above method embodiments. The transceiver module may include a receiving module and a transmitting module. The specific implementation of the transceiver module in this application is not Make specific restrictions.

It should be noted that the secure data processing device 700 may be a processor. One or more of the above modules can be realized by hardware, software, or by hardware executing corresponding software. The hardware or software includes one or more modules or units corresponding to the above-mentioned functions. When any of the above modules is implemented in software, the software exists in the form of computer program instructions and is stored in the memory. In addition, the technical effect of the secure data processing device 700 may refer to the technical effect of the secure data processing method described in any one of the implementation manners in FIG. 2 and FIG. 4 to FIG. 5, which will not be repeated here.

The embodiment of the present application provides a secure data processing system, and the secure data processing system includes the previously described secure data processing device.

The embodiment of the present application provides a computer-readable storage medium including a computer program or instruction; when the computer program or instruction runs on a computer, the computer is caused to execute the security data described in the foregoing method embodiment In the processing method, the computer includes a first processing core and a second processing core.

The embodiment of the present application provides a computer program product, including a computer program or instruction. When the computer program or instruction runs on a computer, the computer is caused to execute the secure data processing method described in the foregoing method embodiment, and the computer includes the first One processing core and second processing core.

It should be understood that the processor designed in the embodiments of the present application may be the central processing unit (CPU) mentioned in the previous embodiments, or the processor may also be other general-purpose processors, digital signal processors (digital signal processors). signal processor, DSP), application specific integrated circuit (ASIC) processor, ready-made programmable gate array (field programmable gate array, FPGA) processor, the processor may further include other programmable logic devices, Discrete gates or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor or the processor may also be any conventional processor or the like. The previous embodiment mainly uses the CPU as an example to introduce, but it is not used to limit the solution.

It should also be understood that the memory in the embodiments of the present application may be a volatile memory. The volatile memory may be random access memory (RAM), which is used as an external cache. By way of exemplary but not restrictive description, many forms of random access memory (RAM) are available, such as static random access memory (static RAM, SRAM), dynamic random access memory (DRAM), and synchronous dynamic random access memory (DRAM). Access memory (synchronous DRAM, SDRAM), double data rate synchronous dynamic random access memory (double data rate SDRAM, DDR SDRAM), enhanced synchronous dynamic random access memory (enhanced SDRAM, ESDRAM), synchronous connection dynamic random access memory Take memory (synchlink DRAM, SLDRAM) and direct memory bus random access memory (direct rambus RAM, DR RAM).

The foregoing embodiments may be implemented in whole or in part by software, hardware (such as circuits), firmware, or any other combination. When implemented using software, the above-mentioned embodiments may be implemented in the form of a computer program product in whole or in part. The computer program product includes one or more computer instructions or computer programs. When the computer instructions or computer programs are loaded or executed on a computer, the processes or functions described in the embodiments of the present application are generated in whole or in part. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices. The computer instructions may be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions may be transmitted from a website, computer, server, or data center. Transmission to another website, computer, server or data center via wired (such as infrared, wireless, microwave, etc.). The computer-readable storage medium may be any available medium that can be accessed by a computer or a data storage device such as a server or a data center that includes one or more sets of available media. The usable medium may be a magnetic medium (for example, a floppy disk, a hard disk, a magnetic tape), an optical medium (for example, a DVD), or a semiconductor medium. The semiconductor medium may be a solid state drive.

It should be understood that the term "and/or" in this text is only an association relationship describing the associated objects, indicating that there can be three types of relationships, for example, A and/or B, which can mean: A alone exists, and both A and B exist. , There are three cases of B alone, where A and B can be singular or plural. In addition, the character "/" in this text generally indicates that the associated objects before and after are in an "or" relationship, but it may also indicate an "and/or" relationship, which can be understood with reference to the context.

It should be understood that in the various embodiments of the present application, the size of the sequence number of the above-mentioned processes does not mean the order of execution, and the execution order of each process should be determined by its function and internal logic, and should not correspond to the embodiments of the present application. The implementation process constitutes any limitation.

A person of ordinary skill in the art may be aware that the units or modules and algorithm steps described in the examples in combination with the embodiments disclosed herein can be implemented by electronic hardware or a combination of computer software and electronic hardware. Whether these functions are executed by hardware or software depends on the specific application and design constraint conditions of the technical solution. Professionals and technicians can use different methods for each specific application to implement the described functions, but such implementation should not be considered beyond the scope of this application.

Those skilled in the art can clearly understand that, for the convenience and conciseness of description, the specific working process of the system, device, unit or module described above can refer to the corresponding process in the foregoing method embodiment, which will not be repeated here.

In the several embodiments provided in this application, it should be understood that the disclosed system, device, and method can be implemented in other ways. For example, the above-described device embodiments are only illustrative. For example, the division of the above-mentioned units or modules is only a logical function division. In actual implementation, there may be other division methods, for example, multiple units or modules may be combined. Or it can be integrated into another system, or some units or modules can be ignored, or their corresponding functions are not executed. In addition, the displayed or discussed mutual coupling or direct coupling or communication connection may be indirect coupling or communication connection through some interfaces, devices or units/modules, and may be in electrical, mechanical or other forms.

The units/modules described as separate parts may or may not be physically separated, and the parts displayed as units/modules may or may not be physical units/modules, that is, they may be located in one place, or they may be distributed to Multiple network units/modules. Some or all of the units/modules can be selected according to actual needs to achieve the objectives of the solutions of the embodiments.

In addition, each functional unit/module in each embodiment of the present application can be integrated into one processing unit/module, or each unit/module can exist alone physically, or two or more units/modules can be integrated into one. Unit/module.

The above are only specific implementations of this application, but the protection scope of this application is not limited to this. Any person skilled in the art can easily think of changes or substitutions within the technical scope disclosed in this application. Should be covered within the scope of protection of this application. Therefore, the protection scope of this application should be subject to the protection scope of the claims.

Claims (18)

1. A secure data processing method, characterized in that the method includes:

   The first processing core executes the first thread in the normal mode;

   The second processing core executes the second thread in the normal mode;

   The first processing core suspends execution of the first thread when it needs to switch to the safe mode;

   The first processing core instructs the second processing core to suspend execution of the second thread;

   The second processing core suspends execution of the second thread according to an instruction of the first processing core;

   The first processing core switches from the normal mode to the safe mode to process the first information.
2. The secure data processing method of claim 1, wherein the first processing core instructs the second processing core to suspend execution of the second thread, comprising:

   The first processing core sends first indication information to the control circuit;

   The control circuit sends second instruction information to the second processing core in response to the first instruction information, where the second instruction information is used to instruct the second processing core to suspend execution of the second thread.
3. The secure data processing method according to claim 2, wherein the control circuit comprises: a secure mode synchronization module or an interrupt controller.
4. The secure data processing method according to any one of claims 1-3, wherein after the second processing core suspends the execution of the second thread according to the instruction of the first processing core, the method Also includes:

   The second processing core switches to the safe mode or enters the first low power consumption state in the normal mode.
5. The secure data processing method according to claim 4, wherein after the second processing core is switched to the secure mode, the method further comprises:

   The second processing core enters a second low power consumption state in the safe mode, or processes second information in the safe mode.
6. The secure data processing method according to any one of claims 1-5, wherein after the first processing core is switched from the normal mode to the secure mode to process the first information, the method Also includes:

   The first processing core exits the safe mode;

   The first processing core triggers the second processing core to resume execution of the second thread;

   The first processing core resumes execution of the first thread;

   The second processing core resumes executing the second thread according to the trigger of the first processing core.
7. The secure data processing method according to claim 6, wherein before the first processing core exits the secure mode, the method further comprises:

   The first processing core clears traces of processing the first information in the safe mode.
8. The secure data processing method according to any one of claims 1-7, wherein the first processing core and the second processing core are physical cores or logical cores.
9. A secure data processing device, characterized in that the secure data processing device includes a first processing core and a second processing core, wherein,

   The first processing core is used to execute the first thread in the normal mode, suspend the execution of the first thread when it needs to switch to the safe mode, instruct the second processing core to suspend the execution of the second thread, and from the normal mode Switch to the safe mode to process the first information;

   The second processing core is configured to execute the second thread in the normal mode, and suspend the execution of the second thread according to the instruction of the first processing core.
10. The secure data processing device according to claim 9, wherein the secure data processing device further comprises a control circuit, wherein the first processing core is further configured to send first instruction information to the control circuit;

    The control circuit is configured to send second instruction information to the second processing core in response to the first instruction information, where the second instruction information is used to instruct the second processing core to suspend execution of the second thread .
11. The secure data processing device according to claim 10, wherein the control circuit comprises: a secure mode synchronization module or an interrupt controller.
12. The secure data processing device according to any one of claims 9-11, wherein:

    The second processing core is further configured to switch to the safe mode or enter the first low power consumption state in the normal mode after suspending the execution of the second thread according to the instruction of the first processing core .
13. The secure data processing device according to claim 12, wherein:

    The second processing core is further configured to enter a second low power consumption state in the safe mode after the second processing core is switched to the safe mode, or process second information in the safe mode .
14. The secure data processing device according to any one of claims 9-13, wherein:

    The first processing core is further configured to: after switching from the normal mode to the safe mode to process the first information, exit the safe mode, and trigger the second processing core to resume execution of the second thread , And resume execution of the first thread;

    The second processing core is further configured to resume execution of the second thread according to the trigger of the first processing core.
15. The secure data processing device according to claim 14, wherein:

    The first processing core is also used to clear traces of processing the first information in the safe mode before exiting the safe mode.
16. The secure data processing device according to any one of claims 9-15, wherein the first processing core and the second processing core are physical cores or logical cores.
17. A computer-readable storage medium, wherein the computer-readable storage medium includes a computer program or instruction, and when the computer program or instruction runs on a computer, the computer executes the According to any one of the secure data processing methods, the computer includes the first processing core and the second processing core.
18. A computer program product, characterized in that, the computer program product comprises: a computer program or instruction, when the computer program or instruction runs on a computer, the computer executes any one of claims 1-8 In the secure data processing method, the computer includes the first processing core and the second processing core.

Images