WO2022155973A1 - 一种终端芯片及其度量方法 - Google Patents

一种终端芯片及其度量方法 Download PDF

Info

Publication number
WO2022155973A1
WO2022155973A1 PCT/CN2021/073663 CN2021073663W WO2022155973A1 WO 2022155973 A1 WO2022155973 A1 WO 2022155973A1 CN 2021073663 W CN2021073663 W CN 2021073663W WO 2022155973 A1 WO2022155973 A1 WO 2022155973A1
Authority
WO
WIPO (PCT)
Prior art keywords
subsystem
security
computing
computing subsystem
security subsystem
Prior art date
Application number
PCT/CN2021/073663
Other languages
English (en)
French (fr)
Inventor
贾建卫
尹飞飞
冯刚
刘宇
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to EP21920365.0A priority Critical patent/EP4273722A4/en
Priority to CN202180084411.1A priority patent/CN116601629A/zh
Priority to PCT/CN2021/073663 priority patent/WO2022155973A1/zh
Publication of WO2022155973A1 publication Critical patent/WO2022155973A1/zh
Priority to US18/356,463 priority patent/US20230367913A1/en

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/52—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
    • G06F21/53—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow by executing in a restricted environment, e.g. sandbox or secure virtual machine
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/64—Protecting data integrity, e.g. using checksums, certificates or signatures
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/57—Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
    • G06F21/575—Secure boot
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/03—Indexing scheme relating to G06F21/50, monitoring users, programs or devices to maintain the integrity of platforms
    • G06F2221/034—Test or assess a computer or a system

Definitions

  • the embodiments of the present application relate to the field of chips, and in particular, to a terminal chip and a measurement method thereof.
  • the trustzone technology is usually used to separate computing subsystems into trusted execution environment (trust execution environment, TEE) and rich execution environment (rich execution environment, REE).
  • TEE trusted execution environment
  • REE rich execution environment
  • REE can run Android, Linux, windows and other operating systems to support users to run rich applications
  • TEE can run a small operating system of the supplier to support the operation of some key security requirements. business to ensure the security of critical business.
  • the embodiments of the present application provide a terminal chip and a measurement method thereof, which can ensure the safe operation of the computing subsystem by measuring the computing subsystem.
  • a first aspect of the embodiments of the present application provides a terminal chip, the terminal chip includes a computing subsystem and a security subsystem, the security subsystem is used to measure the computing subsystem, and the startup time of the security subsystem is earlier than the computing subsystem
  • the startup time of the subsystem, the security subsystem includes: an integrity verification unit; the integrity verification unit is used to measure the integrity of the data in the startup process of the computing subsystem.
  • the integrity measurement of the startup process of the computing subsystem can be performed to determine the calculation Whether the subsystem is maliciously attacked during the startup process can improve the security of the computing subsystem startup process.
  • the function of the integrity verification unit in this application may be implemented by a hardware circuit or a software program, which is not limited in this application.
  • the security subsystem further includes: a first interaction interface, through which the security subsystem accesses all resources of the computing subsystem.
  • the security subsystem can read all resources of the computing subsystem through the first interactive interface, so that after the startup of the security subsystem is completed, during the startup process of the computing subsystem, the security subsystem can read the startup process of the computing subsystem and perform integrity measurement on the data to determine whether the computing subsystem has been maliciously attacked during the startup process, which can improve the security of the computing subsystem startup process.
  • the above-mentioned integrity verification unit is further configured to perform integrity measurement on the data of the operation process of the above-mentioned computing subsystem.
  • the security subsystem can not only measure the data of the startup process of the computing subsystem, but also measure the data of the operation process of the computing subsystem, so that the whole life cycle of the computing subsystem can be measured to ensure that the computing Safe operation of subsystems.
  • the integrity verification unit is specifically configured to, when the computing subsystem switches from the rich execution environment REE to the trusted execution environment TEE, The data run by the above computing subsystem is subjected to integrity measurement.
  • the security subsystem can measure when the computing subsystem switches from REE to TEE, which can ensure the security of the computing subsystem's running process. It can be understood that the security subsystem provided by the present application can measure not only the REE, but also the TEE, so as to ensure the safe operation of the entire computing subsystem.
  • the security subsystem further includes: a timer, where the timer is used for timing; the integrity verification unit is further configured to, specifically, based on the timing The device is used to periodically measure the integrity of the data run by the computing subsystem. Based on this solution, the security subsystem can measure the running process of the computing subsystem regularly, thereby further ensuring the security of the running process of the computing subsystem.
  • the data of the operation of the computing subsystem may only include the data of the operation of the TEE, or only the data of the operation of the REE, or may include the data of the operation of the TEE and the REE at the same time.
  • the security subsystem regularly measures the integrity of the computing subsystem, if the processor of the current computing subsystem only runs the TOS, the security subsystem performs integrity measurement on the data run by the TEE.
  • the security subsystem periodically measures the integrity of the computing subsystem, if the processor of the current computing subsystem only runs ROS, the security subsystem performs integrity measurement on the data run by the REE.
  • the security subsystem regularly measures the integrity of the computing subsystem, if the processor of the current computing subsystem runs ROS and TOS at the same time, the security subsystem performs integrity measurement on the data run by REE and TEE.
  • the security subsystem further includes: a shared buffer, where the shared buffer is used for the computing subsystem to communicate with the security subsystem.
  • the computing subsystem can communicate with the security subsystem through a shared buffer.
  • the computing subsystem can read data from the shared buffer of the security subsystem through the second interactive interface, and can also write data into the shared buffer of the security subsystem through the second interactive interface.
  • the security subsystem further includes: a filter, which is used to intercept the first access operation of the computing subsystem, the first access operation of the computing subsystem.
  • An access operation is used to request access to resources other than the shared buffer in the above-mentioned security subsystem.
  • the computing subsystem can only access the shared buffer in the security subsystem, and cannot access other resources except the shared buffer in the security subsystem, thus ensuring that the computing subsystem cannot read the information in the security subsystem or changes to ensure the trustworthiness of the security subsystem.
  • the shared buffer is the only resource in the security subsystem that can be accessed by the computing subsystem.
  • the filter can be used. Block these access operations. For example, the computing subsystem cannot overwrite the data stored in the random access memory RAM of the security subsystem.
  • the above-mentioned filter is further used to intercept the second access operation of the above-mentioned security subsystem, and the second access operation is used to request the above-mentioned computing Subsystem writes data.
  • the security subsystem can read all resources in the computing subsystem, but cannot write data to the computing subsystem, so as to avoid exposing the data in the security subsystem to the computing subsystem, which can further improve the performance of the security subsystem. credibility.
  • the above-mentioned security subsystem further includes: a read-only memory ROM and a processor, where the ROM is used to store the data when the above-mentioned security subsystem is powered on.
  • Computer program processor for running a computer program stored in ROM.
  • the processor of the security subsystem executes the computer program code stored in the ROM, so that the security subsystem can be started, and the security subsystem can be ensured to be powered on first.
  • the above-mentioned security subsystem further includes a cryptographic engine, which is used to provide a cryptographic algorithm; the above-mentioned integrity verification unit is specifically used for calling The cryptographic algorithm provided by the cryptographic engine performs integrity measurement on the data of the startup process and the running process of the computing subsystem.
  • the integrity verification unit can measure the integrity of the data in the startup process and the running process of the computing subsystem by invoking the cryptographic algorithm, so as to determine whether the computing subsystem has been maliciously attacked during the startup or running process, which can improve the performance of the computing subsystem. security.
  • the security subsystem further includes: a random access memory RAM, where the RAM is used to store data of the startup process and the running process of the computing subsystem the corresponding benchmark value. Based on this scheme, it can be determined whether the computing subsystem is attacked through the reference value stored in the RAM.
  • the RAM can also be used to temporarily store other information required by the security subsystem during operation.
  • the integrity verification unit is specifically used to invoke the cryptographic algorithm provided by the cryptographic engine to calculate the data of the startup process and the running process of the computing subsystem. eigenvalue, and compare the eigenvalue with the reference value stored in RAM to indicate whether the computing subsystem is attacked. Based on this solution, the integrity verification unit can determine whether the computing subsystem is maliciously attacked by comparing the characteristic value with the reference value stored in the RAM.
  • the characteristic value is the hash value.
  • the integrity verification unit invokes the message authentication code MAC algorithm provided by the cryptographic engine to calculate the characteristic value of the data, the characteristic value is the MAC value.
  • the above-mentioned processor is further configured to send a first indication signal to the above-mentioned computing subsystem when the above-mentioned characteristic value is the same as the reference value , the first indication signal is used to indicate that the computing subsystem is not attacked.
  • a first indication signal indicating that the computing subsystem is not attacked can be sent to the computing subsystem.
  • the security subsystem may also not send the first indication signal to the computing subsystem indicating that the computing subsystem is not attacked. That is to say, when the computing subsystem is not attacked, the computing subsystem can perform the startup or running process step by step regardless of the integrity measurement result of the security subsystem during the startup or running process, until the computing subsystem is attacked.
  • the safety subsystem resets it.
  • the above-mentioned processor is further configured to: in the case that the above-mentioned characteristic value is different from the reference value, send indication information to the server, the indication information Used to indicate that the computing subsystem is attacked; sending a second indication signal to the computing subsystem, where the second indication signal is used to reset the computing subsystem.
  • the security subsystem determines that the characteristic value is different from the reference value, the security subsystem can directly reset the computing subsystem, thereby ensuring that sensitive information (eg, keys) of the computing subsystem is not leaked.
  • the security subsystem can also send indication information to the server to notify the server that the computing subsystem is attacked, so that the supplier can repair the vulnerability in the computing subsystem in time.
  • the security subsystem may also perform other exception processing. In this embodiment of the present application, only when the computing subsystem is attacked, the security subsystem resets the computing subsystem as an example. illustrate.
  • the security subsystem further includes: a power clock management unit; the power clock management unit is used to power on or power on the security subsystem. Power down control.
  • the power clock management unit for managing the power-on or power-off of the security subsystem is independently set in the security subsystem, the power-on or power-off of the security subsystem can not be controlled by the external power management unit, so the external power supply The management unit cannot control the power-off of the security subsystem, so as to avoid the problem that the computing subsystem cannot be measured after the security subsystem is powered off, which reduces the security of the computing subsystem.
  • the above-mentioned processor is further configured to send a third indication signal to the external power management unit, where the third indication signal is used to instruct the external power management unit Power-up or power-down control of the safety subsystem.
  • the third instruction signal is sent to the external power management unit through the safety subsystem, so that the external power management unit can perform power-off control on the safety subsystem only after receiving the third instruction signal from the safety subsystem.
  • the security subsystem further includes: a watchdog; the watchdog is used to reset the security subsystem when the security subsystem hangs up. The security subsystem and the computing subsystem. Based on this solution, if the security subsystem hangs up, no one will feed the dog. After the watchdog times out, a system-wide reset will be performed, thereby preventing the computing subsystem from being attacked when it is running in an unprotected state.
  • resetting the security subsystem and the computing subsystem above includes restarting the security subsystem and the computing subsystem.
  • a method for measuring a terminal chip includes a computing subsystem and a security subsystem, and the method includes: powering on and starting the security subsystem; The system performs measurement; after the startup of the security subsystem is completed, the computing subsystem is powered on; the security subsystem performs integrity measurement on the data during the startup process of the computing subsystem.
  • the above-mentioned method further includes: the above-mentioned security subsystem performs an integrity measurement on the data of the operation process of the above-mentioned computing subsystem.
  • the above-mentioned security subsystem performs an integrity measurement on the data of the operation process of the above-mentioned computing subsystem, including: in the above-mentioned computing subsystem, the rich execution environment When the REE is switched to the trusted execution environment TEE, the security subsystem performs integrity measurement on the data run by the computing subsystem.
  • the above-mentioned security subsystem performs an integrity measurement on the data in the operation process of the above-mentioned computing subsystem, including: the security subsystem regularly runs the computing subsystem. Process data integrity measurements.
  • the above-mentioned security subsystem performs an integrity measurement on the data of the startup process or the running process of the above-mentioned computing subsystem, including: the above-mentioned security subsystem calculates the above-mentioned The characteristic value of the data of the startup process or the running process of the subsystem is calculated, and the characteristic value is compared with the reference value, so as to indicate whether the above-mentioned computing subsystem is attacked.
  • the above-mentioned method further includes: the above-mentioned security subsystem sends the first information to the above-mentioned computing subsystem. an indication signal, the first indication signal is used to indicate that the computing subsystem is not attacked.
  • the above-mentioned method further includes: the above-mentioned security subsystem sends indication information to the server, the The indication information is used to indicate that the computing subsystem is attacked; the security subsystem sends a second indication signal to the computing subsystem, and the second indication signal is used to reset the computing subsystem.
  • the above method further includes: the above-mentioned security subsystem sends a third indication signal to the external power management unit, where the third indication signal is used to indicate an external The power management unit controls the power-on or power-off of the security subsystem.
  • the above method further includes: the security subsystem intercepts a first access operation of the computing subsystem, where the first access operation is used to access the above Resources other than shared buffers in the security subsystem.
  • the above method further includes: the security subsystem intercepts a second access operation of the security subsystem, where the second access operation is used to request The computing subsystem described above writes data.
  • a terminal device in a third aspect of the embodiments of the present application, includes the terminal chip according to any one of the implementation manners of the above first aspect and an off-chip memory, where the terminal chip is used to store data from the off-chip memory. Read or write data.
  • FIG. 1 is a schematic diagram of a security architecture of a computing system provided by an embodiment of the present application.
  • FIG. 2 is a schematic diagram of a security architecture of another computing system provided by an embodiment of the present application.
  • FIG. 3 is a schematic structural diagram of a terminal device according to an embodiment of the present application.
  • FIG. 4 is a schematic structural diagram of another terminal device provided by an embodiment of the present application.
  • FIG. 5 is a schematic diagram of a software architecture of a terminal device according to an embodiment of the present application.
  • FIG. 6 is a schematic flowchart of a method for measuring a terminal chip according to an embodiment of the present application.
  • FIG. 7 is a schematic flowchart of another method for measuring a terminal chip according to an embodiment of the present application.
  • FIG. 8 is an application schematic diagram of a method for measuring a terminal chip provided by an embodiment of the present application.
  • FIG. 9 is a schematic flowchart of another method for measuring a terminal chip according to an embodiment of the present application.
  • At least one (a) of a, b or c may represent: a, b, c, a and b, a and c, b and c, or a and b and c, where a, b and c can be single or multiple.
  • words such as “first” and “second” are used to distinguish the same or similar items that have basically the same function and effect, Those skilled in the art can understand that words such as “first” and “second” do not limit the quantity and execution order.
  • the "first” in the first indication signal and the "second” in the second indication signal in the embodiment of the present application are only used to distinguish different indication signals.
  • the descriptions of the first, second, etc. appearing in the embodiments of the present application are only used for illustration and distinguishing the description objects, and have no order. any limitations of the examples.
  • SoC system on chip
  • TEE trusted execution environment
  • REE rich execution environment
  • FIG. 1 a schematic diagram of the security architecture of a computing system
  • the computing system includes REE and TEE
  • the business running in the REE does not have high security requirements
  • the business running in the TEE has high security requirements .
  • REE can run a rich operating system (ROS) to support users to run rich applications (application, App).
  • ROI rich operating system
  • REE can run Android, Linux, windows and other operating systems to support users to run WeChat, Tencent Video and other applications with low security requirements.
  • TEE usually runs a small operating system implemented by the supplier to support users to run trusted applications (trust application, TA), this operating system can be called trusted operating system (trust operating system, TOS).
  • TEE can run the supplier's operating system to support users running signed APPs, payment APPs, face recognition, fingerprint recognition, password processing, data encryption and decryption, security authentication, key management, etc. high program.
  • the above TOS and ROS can run on the same processor in a time-division multiplexing manner.
  • the processor is running TOS, it is called a safe world processor, and when the processor is running ROS, it is called a normal world processor.
  • TOS and ROS can also run simultaneously on different operating system kernels of a processor.
  • TOS and ROS can share other physical resources at the same time.
  • TOS and ROS can share central processing unit (CPU), graphics processing unit (GPU), Physical resources such as neural network processing unit (NPU), read only memory (ROM), peripherals, one-time programmable memory (eg, efuse).
  • CPU central processing unit
  • GPU graphics processing unit
  • NPU neural network processing unit
  • ROM read only memory
  • peripherals one-time programmable memory (eg, efuse).
  • trustzone technology improves the security of computing systems, with the increasing number of key businesses, the amount of code in the secure world isolated by trustzone is getting larger and larger, resulting in a larger and larger trusted computing base in the secure world.
  • the world also faces a growing attack surface, requiring new technologies to secure computing systems.
  • the secure boot technology uses cryptographic methods to verify the image level by level to ensure the credibility of the computing device.
  • the code that runs when a computing device boots is usually written in ROM, and the characteristics of the ROM device ensure that this code cannot be tampered with. Only after the image to be run at the next level passes the verification, will it be executed by the computing system, so it can be ensured that the running image has not been illegally tampered with.
  • the secure boot technology can only ensure that the image running on the computing device has not been tampered with.
  • attackers can use these loopholes to gain higher privileges, run malicious code, and even gain access to the system.
  • an attacker can conduct attacks during the secure boot process of a computing system, and exploit code vulnerabilities in the boot process, thereby bypassing security verification in the boot process.
  • malware exploits a privilege configuration vulnerability and can access the entire memory space. Therefore, the secure boot technology cannot guarantee the security of the computing device when there are loopholes in the implementation of the system.
  • FIG. 2 a schematic diagram of the security architecture of a computing system
  • an integrity verification application is set in the TEE
  • the integrity of the operation of the REE is measured by the integrity verification application.
  • operations related to the kernel in the REE can be intercepted by an integrity verification application, for example, operations such as modifying the TEE operating system and writing information into a privileged code page can be intercepted.
  • the integrity verification application of this scheme in the TEE can only measure the operation of the REE to ensure the safety of the operation of the REE, and cannot find the loopholes in the TEE. That is to say, this solution treats the TEE as a fully trusted system, but according to the foregoing discussion, it can be seen that the TEE is not always secure. For example, the use of Android system security vulnerabilities mentioned in the Blackhat Security Technology Conference Blackhat can break the user's fingerprint recognition function and successfully steal the user's fingerprint information. Therefore, only measuring REE and not measuring TEE will result in lower security of TEE. Moreover, this solution cannot measure the startup process of the computing system, which may cause loopholes in the startup process of the computing system to be exploited by attackers.
  • an embodiment of the present application provides a terminal chip, where a security subsystem in the terminal chip can control the startup process of the computing subsystem Integrity measurement can ensure the security of the startup process of the computing subsystem.
  • FIG. 3 is a schematic structural diagram of a terminal device according to an embodiment of the present application, where the terminal device includes a terminal chip and an off-chip memory.
  • the terminal chip is provided with a security subsystem and a computing subsystem, the security subsystem is used to measure the computing subsystem, and the startup time of the security subsystem is earlier than the startup time of the computing subsystem.
  • the security subsystem includes: an integrity verification unit. The integrity verification unit is used to measure the integrity of the data in the startup process of the computing subsystem.
  • the function of the integrity verification unit in the embodiment of the present application may be implemented by a hardware circuit or a software program, which is not limited in the embodiment of the present application.
  • the computing subsystem is started after the security subsystem is started. Since the startup time of the security subsystem is earlier than the startup time of the computing subsystem, the security subsystem can measure the data of the startup process of the computing subsystem to determine Whether the computing subsystem is maliciously attacked during the startup process can improve the security of the computing subsystem startup process.
  • the above-mentioned computing subsystem may include REE and TEE
  • the above-mentioned integrity verification unit may perform integrity measurement on the data of the startup process of the computing subsystem, which may include performing integrity measurement on the data of the startup process of the REE, or may include: Integrity measurement of the data of the TEE startup process.
  • the computing subsystem includes REE and TEE.
  • the integrity measurement can be performed on the data of the power-on and start-up process of the TEE and the power-on and start-up process of the REE, so as to ensure the integrity of the start-up process of the computing subsystem. safety.
  • the security subsystem may further include a ROM and a processor.
  • ROM used to store the computer program when the security subsystem is powered up.
  • the processor is also used to run the operating system of the security subsystem.
  • the processor may be a central processing unit (CPU), a specific integrated circuit (application specific integrated circuit, ASIC), or one or more integrated circuits configured to implement the embodiments of the present application, for example: One or more microprocessors (digital signal processor, DSP), or, one or more field programmable gate array (field programmable gate array, FPGA).
  • DSP digital signal processor
  • FPGA field programmable gate array
  • the embodiment of the present application does not limit the specific form of the processor.
  • the computer program code stored in the ROM may be executed by the processor of the security subsystem.
  • the power-on start time of the security subsystem in the embodiment of the present application is earlier than the power-on start time of the computing subsystem, after the security subsystem is powered on and started, the integrity of the power-on and start-up process of the computing subsystem can be performed. Metrics to ensure the security of the computing subsystem startup process.
  • the above security subsystem can run in a closed execution environment, and the security subsystem can run customized firmware and operating system.
  • the computing subsystem includes hardware resources such as an application processor (application central processing unit, ACPU), random access memory (Random Access Memory, RAM), ROM, memory controller, GPU, peripherals and the like.
  • the security subsystem includes hardware resources such as CPU, RAM, and ROM, that is, the hardware resources of the security subsystem and the hardware resources of the computing subsystem are independent of each other.
  • FIG. 5 is a schematic diagram of the software architecture of a terminal device.
  • the computing subsystem may include REE and TEE, and the security subsystem may run a custom operating system, which can be combined with the REE.
  • the running ROS and the TEE run different TOS.
  • the integrity verification unit in the security subsystem can measure the operating system kernel of the TEE and the operating system kernel of the REE to ensure the safe operation of the computing subsystem.
  • the processor structure of the security subsystem and the processor structure of the computing subsystem may be the same or different.
  • the processor architecture of the security subsystem may be the ARM architecture
  • the processor architecture of the computing subsystem may be the X86 architecture.
  • the processor architecture of the security subsystem and the processor architecture of the computing subsystem may both be ARM architectures.
  • the security subsystem can run a customized operating system
  • the processor in the security subsystem You can run a customized operating system to start the security subsystem.
  • the integrity verification unit in the security subsystem can measure the integrity of the data running during the startup of the computing subsystem to ensure that the computing subsystem Security of the boot process.
  • the security subsystem may further include a first interaction interface, and the security subsystem may access all resources of the computing subsystem through the first interaction interface.
  • the security subsystem may read all resources in the computing subsystem (eg, resources in RAM and registers of the computing subsystem) through the first interaction interface and the bus 1 of the computing subsystem.
  • the security subsystem may also read resources in the off-chip memory through the first interactive interface.
  • the security subsystem can read the image to be executed, memory-mapped page table information, etc. in the RAM or off-chip memory (eg, double data rate (DDR) synchronous dynamic random access memory) of the computing subsystem and security relevant data.
  • the security subsystem can read the reset vector base address, trustzone protection controller (TZPC), trustzone memory adapter (TZMA), trustzone address space controller in the registers of the computing subsystem (trustzone address space controller, TZASC), exception vector table and other security-related data.
  • TZPC trustzone protection controller
  • TZMA trustzone memory adapter
  • TZASC trustzone address space controller
  • the security subsystem may further include a cryptographic engine (crypto engine), and the cryptographic engine is used to provide a cryptographic algorithm.
  • the integrity verification unit is specifically used to invoke the cryptographic algorithm provided by the cryptographic engine to measure the integrity of the data in the startup process of the computing subsystem.
  • the cryptographic engine is used to provide encryption algorithms such as a hash algorithm, a message authentication code (message authentication code, MAC) algorithm.
  • the integrity verification unit may calculate the hash value of the data of the startup process of the computing subsystem by invoking the hash algorithm provided by the cryptographic engine.
  • the integrity verification unit may calculate the MAC value of the data of the startup process of the computing subsystem by invoking the MAC algorithm provided by the cryptographic engine.
  • the above security subsystem may further include: a random access memory RAM, where the RAM is used to store reference values corresponding to the data of the startup process and the running process of the computing subsystem.
  • the RAM can also be used to temporarily store other information required by the security subsystem during operation.
  • the above-mentioned integrity verification unit is specifically used to call the cryptographic engine to calculate the characteristic value of the data of the startup process of the computing subsystem, and compare the characteristic value with the reference value stored in the RAM to indicate whether the computing subsystem is be attacked. Understandably, if the characteristic value is consistent with the reference value stored in the RAM, it means that the computing subsystem has not been attacked. If the eigenvalues are inconsistent with the baseline values stored in RAM, the computing subsystem is under attack.
  • the security subsystem may reset the computing subsystem, or may also perform other exception handling.
  • the embodiment of the present application does not limit the specific manner of exception handling when the computing subsystem is attacked. , the following embodiments only take an example of resetting the computing subsystem by the security subsystem when the computing subsystem is attacked.
  • the characteristic value is the hash value.
  • the integrity verification unit invokes the MAC algorithm provided by the cryptographic engine to calculate the characteristic value of the data that starts the process, the characteristic value is the MAC value.
  • the embodiment of the present application does not limit the specific type of the cryptographic algorithm provided by the cryptographic engine, and the following embodiments only take the cryptographic algorithm provided by the cryptographic engine as the hash algorithm as an example for description.
  • the above-mentioned processor is further configured to send a first indication signal to the computing subsystem when the integrity verification unit determines that the characteristic value is the same as the reference value, where the first indication signal is used to indicate that the computing subsystem is not attacked .
  • the first indication signal may be a hardware signal.
  • the above-mentioned processor is further configured to send indication information to the server, where the indication information is used to indicate that the computing subsystem is attacked. and send a second indication signal to the computing subsystem, where the second indication signal is used to reset the computing subsystem.
  • the second indication signal may be a hardware signal.
  • the data of the startup process of the computing subsystem may include data that affects the safe operation of the computing subsystem during the startup process of the computing subsystem.
  • the data of the startup process of the computing subsystem may include, but is not limited to, the executed kernel code, the memory-mapped page table, and the security configuration information of the REE and the TEE, and the like.
  • the security subsystem is the first to be powered on, and the security subsystem can ensure the security of its own startup by verifying the startup.
  • the computing subsystem starts to perform a secure startup.
  • the integrity verification unit of the security subsystem can read the data of the secure startup process of the computing subsystem, and call the cryptographic engine to calculate the data. Hash value of the data, and compare the hash value with the benchmark value.
  • the security subsystem sends a first indication signal to the computing subsystem indicating that the computing subsystem has not been attacked, and the computing subsystem continues to execute the next step after receiving the first indication signal startup process. If the comparison fails (the hash value is not the same as the reference value), the security subsystem determines that the computing subsystem has been attacked, and the security subsystem can directly reset the computing subsystem to ensure the sensitive information of the computing subsystem (for example, encryption key) is not disclosed.
  • the security subsystem can also send indication information to the server to notify the server that the computing subsystem is attacked, so that the supplier can repair the vulnerability in the computing subsystem in time.
  • the security subsystem may not send the first indication signal to the computing subsystem indicating that the computing subsystem is not attacked. That is to say, when the computing subsystem is not attacked, the computing subsystem can perform the startup process step by step regardless of the integrity measurement result of the security subsystem during the startup process, until the computing subsystem is attacked, the security subsystem will its reset.
  • the security subsystem since the startup time of the security subsystem is earlier than the startup time of the computing subsystem, and the security subsystem can access all resources of the computing subsystem, the security subsystem can The startup process of the subsystem performs integrity measurement to determine whether the computing subsystem has been maliciously attacked during the startup process, which can ensure the security of the startup process of the computing subsystem.
  • the integrity verification unit in the security subsystem is also used to measure the integrity of the data in the operation process of the computing subsystem.
  • the processor of the computing subsystem may only run ROS, or may only run TOS, and may also run ROS and TOS at the same time.
  • the integrity verification unit performs integrity measurement on the data of the operation process of the computing subsystem, which may include integrity measurement of the data of the operation process of the REE, and may also include integrity measurement of the data of the operation process of the TEE.
  • the data of the operation process of the computing subsystem may include data affecting the safe operation of the computing subsystem during the operation of the computing subsystem.
  • the data of the running process of the computing subsystem may include, but is not limited to, the executed kernel code, the code of the application program, the memory-mapped page table, and the security configuration information of the REE and the TEE.
  • the integrity verification unit is configured to measure the integrity of the data run by the computing subsystem when the computing subsystem switches from the rich execution environment REE to the trusted execution environment TEE.
  • the security subsystem can read the data run by the computing subsystem, and call the cryptographic engine to calculate the hash value of the data, and compare the hash value with the security Compare with the reference value stored in advance by the subsystem. If the comparison is passed, the security subsystem may send a first indication signal to the computing subsystem indicating that the computing subsystem is not attacked. After receiving the first indication signal, the computing subsystem can switch to the TEE and execute the security service. If the comparison fails, the security subsystem determines that the computing subsystem is attacked, and the security subsystem resets the computing subsystem, thereby ensuring the security of the TEE.
  • the security subsystem may not send the first indication signal to the computing subsystem indicating that the computing subsystem is not attacked. That is, when the computing subsystem is not attacked, the computing subsystem can switch from REE to TEE regardless of the integrity measurement result of the security subsystem, and execute TEE services until the computing subsystem is attacked. reset it.
  • the security subsystem may further include: a timer.
  • the integrity verification unit may also periodically measure the integrity of the data run by the computing subsystem based on the timer.
  • the data of the operation of the computing subsystem may only include the data of the operation of the TEE, or only the data of the operation of the REE, or may include the data of the operation of the TEE and the REE at the same time.
  • the security subsystem regularly measures the integrity of the computing subsystem, if the processor of the current computing subsystem only runs the TOS, the security subsystem performs integrity measurement on the data run by the TEE.
  • the security subsystem periodically measures the integrity of the computing subsystem, if the processor of the current computing subsystem only runs ROS, the security subsystem performs integrity measurement on the data run by the REE.
  • the security subsystem regularly measures the integrity of the computing subsystem, if the processor of the current computing subsystem runs ROS and TOS at the same time, the security subsystem performs integrity measurement on the data run by REE and TEE.
  • the security subsystem can periodically measure the integrity of the data in the running process of the computing subsystem.
  • the security subsystem can periodically read REE. and TEE run data, integrity metrics for REEs and TEEs. It can be understood that the method for measuring the integrity of the REE and the TEE by the security subsystem may refer to the foregoing content, which will not be repeated here.
  • the security subsystem can not only perform integrity measurement on the startup process of the computing subsystem, but also perform integrity measurement on the data in the operation process of the computing subsystem. Measure the entire life cycle of the computing subsystem to ensure the safe operation of the computing subsystem.
  • the security subsystem may further include a shared buffer, where the shared buffer is used for the computing subsystem to communicate with the security subsystem.
  • the shared buffer includes Inbox and Outbox, and Inbox and Outbox are generally on-chip buffers (buffers) of the SoC.
  • the security subsystem may further include an inter-process communication (inter-process communication, IPC) module.
  • IPC inter-process communication
  • the IPC module is used to send an interrupt request to the ACPU in the computing subsystem or the processor in the security subsystem
  • the shared buffer is used to cache communication data for the application processor ACPU in the computing subsystem or the processor in the security subsystem.
  • the security subsystem may further include a second interaction interface, and the computing subsystem may read data from the shared buffer of the security subsystem through the second interaction interface, or may send data to the security subsystem through the second interaction interface. Write data to the shared buffer.
  • the computing subsystem when the computing subsystem communicates with the security subsystem, the computing subsystem writes data into the shared buffer of the security subsystem through the second interactive interface.
  • the IPC module sends an interrupt request to the processor of the security subsystem. After receiving the interrupt request, the processor of the security subsystem reads data from the shared buffer to complete the communication.
  • the security subsystem communicates with the computing subsystem
  • the security subsystem writes data into the shared buffer.
  • the processor of the security subsystem sends an interrupt request to the ACPU of the computing subsystem through the IPC module. After receiving the interrupt request, the ACPU of the computing subsystem reads data from the shared buffer through the second interactive interface to complete the communication.
  • the security subsystem may further include a filter, and the filter is used to intercept the first access operation of the computing subsystem, and the first access operation is used to request access to the security sub-system.
  • the filter can intercept these access operations. In order to ensure that the computing subsystem cannot read or change the information in the security subsystem, so as to ensure the credibility of the security subsystem. For example, the computing subsystem cannot overwrite the data stored in the random access memory RAM of the security subsystem.
  • the security subsystem is a system with simple functions, has a small trusted computing base, and the security subsystem has a high reliability.
  • the filter in the security subsystem is further configured to intercept a second access operation of the security subsystem, where the second access operation is used to request to write data to the computing subsystem. That is to say, the security subsystem in the embodiment of the present application can read all resources in the computing subsystem, but cannot write data to the computing subsystem, so as to avoid exposing the data in the security subsystem to the computing subsystem, and can Further improve the reliability of the security subsystem.
  • the external power management unit cannot power off, reset, or change the clock state of the security subsystem. Otherwise, the security subsystem may be powered off and cannot be performed on the computing subsystem. metric, resulting in reduced security of the computing subsystem.
  • the first implementation is for the security subsystem to be powered directly by an independent clock and power supply, not controlled by an external power management unit.
  • the second implementation is that only after the security subsystem sends a hardware signal to the external power management unit to instruct the external power management unit to power on or off the security subsystem, the external power management unit can power on or power off the security subsystem. Power down control.
  • the security subsystem may further include a power clock management unit, and the power clock management unit is used for power-on or power-off control of the security subsystem.
  • the power clock management unit since a power clock management unit for managing the power-on or power-off of the security subsystem is independently set in the security subsystem, the power-on or power-off of the security subsystem may not be controlled by the external power management unit. The external power management unit cannot power down the safety subsystem.
  • the power clock management unit can periodically control the power-on or power-off of the security subsystem, thereby reducing the performance of the security subsystem. consumption, save power.
  • the above-mentioned processor is further configured to send a third indication signal to the external power management unit, where the third indication signal is used to instruct the external power management unit to power on or power on the security subsystem. Power down control.
  • the external power management unit can perform power-off control on the security subsystem only after receiving the third indication signal from the security subsystem, so as to ensure the security of the entire life cycle of the computing subsystem.
  • the security subsystem in this embodiment of the present application may further include a watchdog Watchdog, This watchdog is used to reset the safety subsystem and the computing subsystem in the event that the safety subsystem hangs. Understandably, if the security subsystem hangs, no one will feed the dog. After the watchdog times out, a system-wide reset will be performed to prevent the computing subsystem from being attacked when it runs in an unprotected state.
  • resetting the security subsystem and the computing subsystem above includes restarting the security subsystem and the computing subsystem.
  • the security subsystem may further include a one-time programmable memory (one time programmable, OTP), and the one-time programmable memory is used to store the configuration information of the security subsystem and some key keys.
  • OTP one time programmable
  • the one-time programmable memory can be efuse.
  • the power-on and start-up time of the security subsystem provided by the embodiments of the present application is earlier than the power-on and start-up time of the computing subsystem, so that the security subsystem can perform integrity measurement on the startup process and the running process of the computing subsystem, That is, the security subsystem can measure the whole life cycle of the computing subsystem to ensure the security of the whole life cycle of the computing subsystem.
  • the security subsystem can not only measure the REE, but also measure the TEE, so as to ensure the safe operation of the entire computing subsystem.
  • an embodiment of the present application further provides a method for measuring a terminal chip.
  • the terminal chip may be the terminal chip shown in FIG. 3 or FIG. 4 , and the measuring method includes the following steps:
  • the startup time of the security subsystem is earlier than the startup time of the computing subsystem. For example, start the computing subsystem after starting the security subsystem.
  • the security startup technology may be used to verify the mirror image level by level, so as to ensure the security of the startup process of the security subsystem.
  • the processor in the security subsystem shown in FIG. 4 may start the security subsystem by executing the code stored in the ROM.
  • the computing subsystem is restarted, so that the security subsystem can measure the integrity of the startup process of the computing subsystem.
  • a secure boot technology may be used to verify the mirror image level by level, so as to ensure the security of the startup process of the computing subsystem.
  • the security subsystem measures the integrity of the startup process of the computing subsystem, and can further determine whether the startup process of the computing subsystem has been maliciously attacked or tampered with.
  • the above computing subsystem may include REE and TEE.
  • Starting the computing subsystem in the above step S602 may include: starting the TEE and the REE.
  • the TEE can be started first, and then the REE can be started.
  • the security subsystem performs integrity measurement on the data of the startup process of the computing subsystem.
  • the integrity verification unit in the security subsystem shown in FIG. 4 may call the cryptographic engine to measure the integrity of the data during the startup process of the computing subsystem.
  • the data content of the startup process of the computing subsystem and the specific implementation manner for the security subsystem to measure the integrity of the data of the startup process of the computing subsystem, reference may be made to the foregoing embodiments, which will not be repeated here.
  • the security subsystem performs an integrity measurement on the data of the startup process of the computing subsystem, including: the security subsystem calculates the characteristic value of the data of the startup process of the computing subsystem, and compares the characteristic value with the reference value. Compare.
  • the computing subsystem starts to perform the security startup.
  • the security subsystem may first measure the integrity of the startup process of the TEE, and then perform the startup process of the REE. Integrity Metrics.
  • the measurement method of the terminal chip starts the computing subsystem after the security subsystem is started, so that the security subsystem can measure the integrity of the startup process of the computing subsystem to ensure that the computing subsystem is started.
  • Security of the subsystem startup process Moreover, when the security subsystem measures the startup process of the computing subsystem, it can not only measure the integrity of the startup process of the REE, but also the startup process of the TEE, so as to ensure the integrity of the startup process of the entire computing subsystem. safety.
  • the security subsystem determines that the integrity measurement is successful. If the characteristic value of the data of the computing subsystem startup process differs from the reference value, the security subsystem fails to determine the integrity metric.
  • the above method may further include step S604; in the case that the security subsystem determines that the integrity measurement fails in step S603, The above method may further include steps S605-S606.
  • the security subsystem sends a first indication signal to the computing subsystem.
  • the first indication signal is used to indicate that the computing subsystem is not attacked.
  • the success of the above-mentioned integrity measurement means that the feature value of the data in the startup process of the computing subsystem is compared with the reference value, that is, the feature value of the data is the same as the reference value.
  • the security subsystem when the integrity measurement is successful, sends a first indication signal to the computing subsystem, indicating that the computing subsystem is not attacked.
  • the security subsystem may also not send the first indication signal to the computing subsystem indicating that the computing subsystem is not attacked.
  • the computing subsystem can perform the startup process step by step regardless of the integrity measurement result of the security subsystem during the startup process, until the computing subsystem is attacked, the security subsystem resets it .
  • the security subsystem sends indication information to the server.
  • the indication information is used to indicate that the computing subsystem is attacked.
  • the above-mentioned failure of the integrity measurement means that the comparison between the characteristic value of the data in the startup process of the computing subsystem and the reference value fails, that is, the characteristic value of the data is different from the reference value.
  • the security subsystem when the security subsystem fails to determine the integrity measurement, the security subsystem sends indication information to the server to notify the server that the computing subsystem is attacked, so that the supplier can repair the vulnerabilities in the computing subsystem in time. , to ensure the safe operation of the computing subsystem.
  • the security subsystem sends a second indication signal to the computing subsystem.
  • the second indication signal is used to reset the computing subsystem.
  • the security subsystem determines that the computing subsystem is attacked, and the security subsystem can directly reset the computing subsystem, thereby ensuring that the sensitive information (for example, the key) of the computing subsystem is not compromised. Give way.
  • the security subsystem is first powered on to start, and the security subsystem
  • the computing subsystem loads the ROM code, and the integrity verification unit of the security subsystem reads the ROM code, the code of the security application, the memory map page table, and the security configuration information of the TEE, etc. data, and measure the integrity of that data. If the data integrity measurement corresponding to the ROM code fails, restart the computing subsystem.
  • the computing subsystem can continue to run the ROM code, load the bootloader (boot loader of the operating system), and further perform integrity measurement on the data corresponding to the loaded bootloader. If loading the data integrity metrics corresponding to the bootloader fails, restart the computing subsystem. If the data integrity measurement corresponding to the bootloader is loaded successfully, the computing subsystem continues to run the bootloader code, and thus executes the boot process in sequence until the TEE secure boot is completed.
  • bootloader boot loader of the operating system
  • the computing subsystem is started after the security subsystem is started, so that the security subsystem can measure the integrity of the startup process of the computing subsystem, so as to ensure the security of the startup process of the computing subsystem. .
  • the security subsystem measures the startup process of the computing subsystem, it can not only measure the integrity of the startup process of the REE, but also the startup process of the TEE, so as to ensure the integrity of the startup process of the entire computing subsystem. safety.
  • the method can also notify the server that the computing subsystem is attacked by sending indication information to the server when the security subsystem determines that the computing subsystem is attacked, so that the supplier can repair the vulnerabilities in the computing subsystem in time to ensure that Safe operation of computing subsystems. And when the computing subsystem is attacked, the computing subsystem is reset, so as to ensure that the sensitive information of the computing subsystem is not leaked.
  • an embodiment of the present application further provides a method for measuring terminal chips.
  • the measuring method may further include the following steps:
  • the security subsystem measures the integrity of the data in the operation process of the computing subsystem.
  • the integrity verification unit in the security subsystem shown in FIG. 4 may call the cryptographic engine to measure the integrity of the data during the operation of the computing subsystem.
  • the content of the data in the operation process of the computing subsystem and the specific implementation manner of the security subsystem performing the integrity measurement on the data in the operation process of the computing subsystem, reference may be made to the foregoing embodiments, which will not be repeated here.
  • the security subsystem performs an integrity measurement on the data of the operation process of the computing subsystem, including: the security subsystem calculates the characteristic value of the data of the operation process of the computing subsystem, and compares the characteristic value with the reference value. Compare.
  • the security subsystem may periodically perform integrity measurement on the data in the operation process of the computing subsystem.
  • the computing subsystem may include only REEs, or only TEEs, or both TEEs and REEs.
  • the measurement method of the terminal chip starts the computing subsystem after the startup of the security subsystem is completed, so that the security subsystem can measure the integrity of the startup process and the running process of the computing subsystem. That is, the security subsystem can measure the whole life cycle of the computing subsystem to ensure the security of the whole life cycle of the computing subsystem. Moreover, when the security subsystem measures the computing subsystem, it can not only measure the integrity of the REE, but also measure the integrity of the TEE, so as to ensure the security of the entire computing subsystem.
  • the above method may further include step S902; in the case that the security subsystem determines that the integrity measurement fails in step S901, The above method may further include steps S903-S904.
  • the security subsystem sends a first indication signal to the computing subsystem.
  • the first indication signal is used to indicate that the computing subsystem is not attacked.
  • the success of the above-mentioned integrity measurement means that the characteristic value of the data in the operation process of the computing subsystem is compared with the reference value, that is, the characteristic value of the data is the same as the reference value.
  • the security subsystem when the integrity measurement is successful, sends a first indication signal to the computing subsystem, indicating that the computing subsystem is not attacked.
  • the security subsystem may also not send the first indication signal to the computing subsystem indicating that the computing subsystem is not attacked.
  • the computing subsystem can execute the operation process step by step regardless of the integrity measurement result of the security subsystem during the startup process, until the computing subsystem is attacked, the security subsystem resets it .
  • the security subsystem sends indication information to the server.
  • the indication information is used to indicate that the computing subsystem is attacked.
  • the above-mentioned failure of the integrity measurement means that the feature value of the data in the operation process of the computing subsystem fails to compare with the reference value, that is, the feature value of the data is different from the reference value.
  • the security subsystem when the security subsystem fails to determine the integrity measurement, the security subsystem sends indication information to the server to notify the server that the computing subsystem is under attack, so that the supplier can timely detect the vulnerabilities in the computing subsystem. Make fixes to ensure safe operation of the computing subsystem.
  • the security subsystem sends a second indication signal to the computing subsystem.
  • the second indication signal is used to reset the computing subsystem.
  • the security subsystem determines that the computing subsystem is attacked, and the security subsystem can directly reset the computing subsystem, thereby ensuring that the sensitive information (for example, the key) of the computing subsystem is not compromised. Give way.
  • the computing subsystem is started after the security subsystem is started, so that the security subsystem can measure the integrity of the startup process and the running process of the computing subsystem, that is, the security subsystem It can measure the whole life cycle of the computing subsystem to ensure the safety of the whole life cycle of the computing subsystem.
  • the security subsystem measures the computing subsystem, it can not only measure the integrity of the REE, but also measure the integrity of the TEE, so as to ensure the security of the entire computing subsystem.
  • the method can also notify the server that the computing subsystem is attacked by sending indication information to the server when the security subsystem determines that the computing subsystem is attacked, so that the supplier can repair the vulnerabilities in the computing subsystem in time to ensure that Safe operation of computing subsystems. And when the computing subsystem is attacked, the computing subsystem is reset, so as to ensure that the sensitive information of the computing subsystem is not leaked.
  • An embodiment of the present application further provides a terminal device, where the terminal device includes a terminal chip as shown in FIG. 3 or FIG. 4 and an off-chip memory, where the terminal chip is used to read or write data from the off-chip memory.
  • the steps of the method or algorithm described in conjunction with the disclosure of the present application may be implemented in a hardware manner, or may be implemented in a manner of a processor executing software instructions.
  • the software instructions can be composed of corresponding software modules, and the software modules can be stored in random access memory (Random Access Memory, RAM), flash memory, Erasable Programmable Read-Only Memory (Erasable Programmable ROM, EPROM), electrically erasable programmable Programmable read only memory (Electrically EPROM, EEPROM), registers, hard disk, removable hard disk, compact disk read only (CD-ROM) or any other form of storage medium well known in the art.
  • An exemplary storage medium is coupled to the processor, such that the processor can read information from, and write information to, the storage medium.
  • the storage medium can also be an integral part of the processor.
  • the processor and storage medium may reside in an ASIC.
  • the ASIC may be located in a terminal interface device.
  • the processor and the storage medium may also exist in the terminal interface device as discrete components.
  • the functions described in the present invention may be implemented in hardware, software, firmware, or any combination thereof.
  • the functions may be stored on or transmitted over as one or more instructions or code on a computer-readable medium.
  • Computer-readable media includes both computer storage media and communication media including any medium that facilitates transfer of a computer program from one place to another.
  • a storage medium can be any available medium that can be accessed by a general purpose or special purpose computer.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Theoretical Computer Science (AREA)
  • Software Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer Hardware Design (AREA)
  • General Physics & Mathematics (AREA)
  • Physics & Mathematics (AREA)
  • General Health & Medical Sciences (AREA)
  • Bioethics (AREA)
  • Health & Medical Sciences (AREA)
  • Storage Device Security (AREA)
  • Testing Or Calibration Of Command Recording Devices (AREA)

Abstract

本申请实施例公开了一种终端芯片及其度量方法，涉及芯片领域，通过对计算子系统的启动过程进行度量，能够确保计算子系统启动过程的安全性。具体方案为：终端芯片包括计算子系统和安全子系统，安全子系统用于对计算子系统进行度量，安全子系统的启动时间早于计算子系统的启动时间，安全子系统包括：完整性验证单元；完整性验证单元，用于对计算子系统启动过程的数据进行完整性度量。

Description

一种终端芯片及其度量方法 技术领域
本申请实施例涉及芯片领域，尤其涉及一种终端芯片及其度量方法。
背景技术
目前在计算设备中，为了确保计算子系统的安全运行，通常使用trustzone技术将计算子系统分离为可信执行环境(trust execution environment，TEE)和丰富执行环境(rich execution environment，REE)。通常，REE可以运行安卓，Linux，windows等操作系统，用以支持用户运行丰富的应用程序，而TEE可以运行供应商的一个小的操作系统，用以支持运行一些对安全性要求较高的关键业务，以保证关键业务的安全性。
但是随着关键业务越来越多，trustzone隔离的TEE的代码量越来越大，导致TEE的可信计算基越来越大，面临的攻击面也越来越大，因此如何确保计算子系统的安全成为了亟待解决的问题。
发明内容
本申请实施例提供一种终端芯片及其度量方法，通过对计算子系统进行度量，能够确保计算子系统的安全运行。
为达到上述目的，本申请实施例采用如下技术方案：
本申请实施例的第一方面，提供一种终端芯片，该终端芯片包括计算子系统和安全子系统，该安全子系统用于对计算子系统进行度量，该安全子系统的启动时间早于计算子系统的启动时间，该安全子系统包括：完整性验证单元；该完整性验证单元，用于对计算子系统启动过程的数据进行完整性度量。基于本方案，由于安全子系统的上电启动时间早于计算子系统的上电启动时间，因此安全子系统上电启动完成后，可以对计算子系统的启动过程进行完整性度量，以确定计算子系统启动过程中是否被恶意攻击，能够提高计算子系统启动过程的安全性。
可选的，本申请中的完整性验证单元的功能可以采用硬件电路实现，也可以采用软件程序实现，本申请对此并不限定。
结合第一方面，在一种可能的实现方式中，上述安全子系统还包括：第一交互接口，上述安全子系统通过该第一交互接口访问上述计算子系统的所有资源。基于本方案，安全子系统可以通过第一交互接口读取计算子系统的所有资源，从而安全子系统启动完成后，在计算子系统的启动过程中，安全子系统可以读取计算子系统启动过程的数据，并对该数据进行完整性度量，以确定计算子系统启动过程中是否被恶意攻击，能够提高计算子系统启动过程的安全性。
结合第一方面和上述可能的实现方式，在另一种可能的实现方式中，上述完整性验证单元，还用于对上述计算子系统运行过程的数据进行完整性度量。基于本方案，安全子系统不仅可以对计算子系统启动过程的数据进行度量，也可以对计算子系统运行过程的数据进行度量，从而能够实现对计算子系统的全生命周期进行度量，以确保 计算子系统的安全运行。
结合第一方面和上述可能的实现方式，在另一种可能的实现方式中，上述完整性验证单元，具体用于在上述计算子系统从丰富执行环境REE切换至可信执行环境TEE时，对上述计算子系统运行的数据进行完整性度量。基于本方案，安全子系统可以在计算子系统从REE切换至TEE时进行度量，能够确保计算子系统运行过程的安全。可以理解的，本申请提供的安全子系统不仅可以对REE进行度量，也可以对TEE进行度量，从而确保整个计算子系统的安全运行。
结合第一方面和上述可能的实现方式，在另一种可能的实现方式中，上述安全子系统还包括：定时器，该定时器用于计时；上述完整性验证单元，具体还用于基于该定时器，定时对上述计算子系统运行的数据进行完整性度量。基于本方案，安全子系统可以定时对计算子系统的运行过程进行度量，从而进一步确保计算子系统运行过程的安全。
可选的，计算子系统运行的数据可以仅包括TEE运行的数据，也可以仅包括REE运行的数据，还可以同时包括TEE及REE运行的数据。例如，安全子系统定时对计算子系统进行完整性度量时，如果当前计算子系统的处理器仅运行TOS，那么安全子系统对TEE运行的数据进行完整性度量。再例如，安全子系统定时对计算子系统进行完整性度量时，如果当前计算子系统的处理器仅运行ROS，那么安全子系统对REE运行的数据进行完整性度量。再例如，安全子系统定时对计算子系统进行完整性度量时，如果当前计算子系统的处理器同时运行ROS和TOS，那么安全子系统对REE和TEE运行的数据进行完整性度量。
结合第一方面和上述可能的实现方式，在另一种可能的实现方式中，上述安全子系统还包括：共享缓冲区，该共享缓冲区用于上述计算子系统与上述安全子系统进行通信。基于本方案，计算子系统可以通过共享缓冲区与安全子系统进行通信。例如，计算子系统可以通过第二交互接口从安全子系统的共享缓冲区中读取数据，也可以通过第二交互接口向安全子系统中的共享缓冲区中写入数据。
结合第一方面和上述可能的实现方式，在另一种可能的实现方式中，上述安全子系统还包括：过滤器，该过滤器，用于拦截上述计算子系统的第一访问操作，该第一访问操作用于请求访问上述安全子系统中除共享缓区以外的其他资源。基于本方案，计算子系统仅可以访问安全子系统中的共享缓冲区，不能访问安全子系统中除共享缓冲区以外的其他资源，从而确保计算子系统不能对安全子系统中的信息进行读取或更改，以保证安全子系统的可信度。可以理解的，本申请的方案中，共享缓冲区是安全子系统中唯一可以被计算子系统访问的资源，计算子系统在访问安全子系统中除共享缓冲区以外的其他资源时，过滤器可以将这些访问操作拦截。比如，计算子系统不能改写安全子系统的随机存取存储器RAM中存储的数据。
结合第一方面和上述可能的实现方式，在另一种可能的实现方式中，上述过滤器，还用于拦截上述安全子系统的第二访问操作，该第二访问操作用于请求向上述计算子系统写入数据。基于本方案，安全子系统可以读取计算子系统中的所有资源，但不能向计算子系统写入数据，从而避免将安全子系统中的数据暴露给计算子系统，能够进一步提高安全子系统的可信度。
结合第一方面和上述可能的实现方式，在另一种可能的实现方式中，上述安全子系统还包括：只读存储器ROM和处理器，该ROM，用于存储上述安全子系统上电时的计算机程序；处理器，用于运行ROM中存储的计算机程序。基于本方案，通过安全子系统的处理器执行ROM中存储的计算机程序代码，从而可以启动安全子系统，能够确保安全子系统第一个上电启动。
结合第一方面和上述可能的实现方式，在另一种可能的实现方式中，上述安全子系统还包括密码引擎，该密码引擎，用于提供密码算法；上述完整性验证单元，具体用于调用该密码引擎提供的密码算法，对上述计算子系统启动过程和运行过程的数据进行完整性度量。基于本方案，完整性验证单元通过调用密码算法可以对计算子系统的启动过程和运行过程的数据进行完整性度量，以确定计算子系统启动或运行过程中是否被恶意攻击，能够提高计算子系统的安全性。
结合第一方面和上述可能的实现方式，在另一种可能的实现方式中，上述安全子系统还包括：随机存取存储器RAM，该RAM用于存储上述计算子系统启动过程和运行过程的数据对应的基准值。基于本方案，可以通过RAM中存储的基准值确定计算子系统是否被攻击。可选的，RAM还可以用于临时存储安全子系统运行时需要的其他信息。
结合第一方面和上述可能的实现方式，在另一种可能的实现方式中，上述完整性验证单元，具体用于调用上述密码引擎提供的密码算法，计算计算子系统启动过程和运行过程的数据的特征值，并将该特征值与RAM中存储的基准值进行比对，以指示计算子系统是否被攻击。基于本方案，完整性验证单元可以通过将特征值与RAM中存储的基准值进行比对，能够确定计算子系统是否被恶意攻击。
可选的，当完整性验证单元调用密码引擎提供的哈希算法计算数据的特征值时，该特征值为哈希值。当完整性验证单元调用密码引擎提供的消息认证码MAC算法计算数据的特征值时，该特征值为MAC值。
结合第一方面和上述可能的实现方式，在另一种可能的实现方式中，上述处理器，还用于在上述特征值与基准值相同的情况下，向上述计算子系统发送第一指示信号，该第一指示信号用于指示计算子系统未被攻击。基于本方案，在安全子系统确定特征值与基准值相同时，可以向计算子系统发送指示计算子系统未被攻击的第一指示信号。可选的，在安全子系统确定计算子系统未被攻击时，安全子系统也可以不向计算子系统发送指示计算子系统未被攻击的第一指示信号。也就是说，在计算子系统未被攻击时，计算子系统在启动或运行过程中可以不管安全子系统的完整性度量结果，一步一步的执行启动或运行流程，直到计算子系统被攻击时，安全子系统将其复位。
结合第一方面和上述可能的实现方式，在另一种可能的实现方式中，上述处理器，还用于：在上述特征值与基准值不同的情况下，向服务器发送指示信息，该指示信息用于指示计算子系统被攻击；向计算子系统发送第二指示信号，该第二指示信号用于复位计算子系统。基于本方案，在安全子系统确定特征值与基准值不同时，安全子系统可以直接将计算子系统复位，从而保证计算子系统的敏感信息(比如，密钥)不被泄露。安全子系统也可以向服务器发送指示信息，通知服务器计算子系统被攻击，以使得供应商可以及时对计算子系统中的漏洞进行修复。可选的，当安全子系统确定计 算子系统被攻击时，安全子系统也可以进行其他异常处理，本申请实施例仅以计算子系统被攻击时，安全子系统将计算子系统复位为例进行说明。
结合第一方面和上述可能的实现方式，在另一种可能的实现方式中，上述安全子系统还包括：电源时钟管理单元；该电源时钟管理单元，用于对上述安全子系统进行上电或下电控制。基于本方案，由于安全子系统中独立的设置了管理安全子系统上电或下电的电源时钟管理单元，该安全子系统的上电或下电可以不受外部电源管理单元控制，因此外部电源管理单元不能对安全子系统进行下电控制，避免了安全子系统下电后无法对计算子系统进行度量，导致计算子系统的安全性降低的问题。
结合第一方面和上述可能的实现方式，在另一种可能的实现方式中，上述处理器还用于向外部电源管理单元发送第三指示信号，该第三指示信号用于指示外部电源管理单元对安全子系统进行上电或下电控制。基于本方案，通过安全子系统向外部电源管理单元发送第三指示信号，使得外部电源管理单元只有接收到来自安全子系统的第三指示信号后，才可以对安全子系统进行下电控制，以确保计算子系统全生命周期的安全，避免了外部电源管理单元对安全子系统下电后，无法对计算子系统进行度量，导致计算子系统的安全性降低的问题。
结合第一方面和上述可能的实现方式，在另一种可能的实现方式中，上述安全子系统还包括：看门狗；该看门狗用于在上述安全子系统挂死的情况下，复位该安全子系统和计算子系统。基于本方案，如果安全子系统挂死，就不会有人喂狗，看门狗超时后，会进行全系统复位，从而避免计算子系统在未保护状态下运行时被攻击。可选的，上述复位安全子系统和计算子系统包括重新启动安全子系统和计算子系统。
本申请实施例的第二方面，提供一种终端芯片的度量方法，该终端芯片包括计算子系统和安全子系统，该方法包括：上电启动安全子系统；该安全子系统用于对计算子系统进行度量；在安全子系统启动完成后，上电启动计算子系统；安全子系统对计算子系统启动过程的数据进行完整性度量。
结合第二方面，在一种可能的实现方式中，上述方法还包括：上述安全子系统对上述计算子系统运行过程的数据进行完整性度量。
结合第二方面和上述可能的实现方式，在另一种可能的实现方式中，上述安全子系统对上述计算子系统运行过程的数据进行完整性度量，包括：在上述计算子系统从丰富执行环境REE切换至可信执行环境TEE时，上述安全子系统对上述计算子系统运行的数据进行完整性度量。
结合第二方面和上述可能的实现方式，在另一种可能的实现方式中，上述安全子系统对上述计算子系统运行过程的数据进行完整性度量，包括：安全子系统定时对计算子系统运行过程的数据进行完整性度量。
结合第二方面和上述可能的实现方式，在另一种可能的实现方式中，上述安全子系统对上述计算子系统启动过程或运行过程的数据进行完整性度量，包括：上述安全子系统计算上述计算子系统启动过程或运行过程的数据的特征值，并将该特征值与基准值进行比对，以指示上述计算子系统是否被攻击。
结合第二方面和上述可能的实现方式，在另一种可能的实现方式中，在上述特征值与上述基准值相同的情况下，上述方法还包括：上述安全子系统向上述计算子系统 发送第一指示信号，该第一指示信号用于指示上述计算子系统未被攻击。
结合第二方面和上述可能的实现方式，在另一种可能的实现方式中，在上述特征值与上述基准值不同的情况下，上述方法还包括：上述安全子系统向服务器发送指示信息，该指示信息用于指示上述计算子系统被攻击；上述安全子系统向上述计算子系统发送第二指示信号，该第二指示信号用于复位上述计算子系统。
结合第二方面和上述可能的实现方式，在另一种可能的实现方式中，上述方法还包括：上述安全子系统向外部电源管理单元发送第三指示信号，该第三指示信号用于指示外部电源管理单元对上述安全子系统进行上电或下电控制。
结合第二方面和上述可能的实现方式，在另一种可能的实现方式中，上述方法还包括：上述安全子系统拦截上述计算子系统的第一访问操作，该第一访问操作用于访问上述安全子系统中除共享缓冲区以外的其他资源。
结合第二方面和上述可能的实现方式，在另一种可能的实现方式中，上述方法还包括：上述安全子系统拦截该安全子系统的第二访问操作，该第二访问操作用于请求向上述计算子系统写入数据。
上述第二方面的各种实现方式的效果描述可以参考上述第一方面的效果描述，在此不再赘述。
本申请实施例的第三方面，提供一种终端设备，该终端设备包括上述第一方面中任一实现方式所述的终端芯片以及片外内存，所述终端芯片用于从所述片外内存读取或写入数据。
附图说明
图1为本申请实施例提供的一种计算系统的安全架构示意图；
图2为本申请实施例提供的另一种计算系统的安全架构示意图；
图3为本申请实施例提供的一种终端设备的架构示意图；
图4为本申请实施例提供的另一种终端设备的架构示意图；
图5为本申请实施例提供的一种终端设备的软件架构示意图；
图6为本申请实施例提供的一种终端芯片的度量方法的流程示意图；
图7为本申请实施例提供的另一种终端芯片的度量方法的流程示意图；
图8为本申请实施例提供的一种终端芯片的度量方法的应用示意图；
图9为本申请实施例提供的另一种终端芯片的度量方法的流程示意图。
具体实施方式
下面将结合本申请实施例中的附图，对本申请实施例中的技术方案进行描述。在本申请中，“至少一个”是指一个或者多个，“多个”是指两个或两个以上。“和/或”，描述关联对象的关联关系，表示可以存在三种关系，例如，A和/或B，可以表示：单独存在A，同时存在A和B，单独存在B的情况，其中A，B可以是单数或者复数。字符“/”一般表示前后关联对象是一种“或”的关系。“以下至少一项(个)”或其类似表达，是指的这些项中的任意组合，包括单项(个)或复数项(个)的任意组合。例如，a，b或c中的至少一项(个)，可以表示：a，b，c，a和b，a和c，b和c，或，a和b和c，其中a、b和c可以是单个，也可以是多个。另外，为了便于清楚描述本申请实施例的技术方案，在本申请的实施例中，采用了“第一”、“第二”等字样对功能和作用 基本相同的相同项或相似项进行区分，本领域技术人员可以理解“第一”、“第二”等字样并不对数量和执行次序进行限定。比如，本申请实施例中的第一指示信号中的“第一”和第二指示信号中的“第二”仅用于区分不同的指示信号。本申请实施例中出现的第一、第二等描述，仅作示意与区分描述对象之用，没有次序之分，也不表示本申请实施例中对设备个数的特别限定，不能构成对本申请实施例的任何限制。
需要说明的是，本申请中，“示例性的”或者“例如”等词用于表示作例子、例证或说明。本申请中被描述为“示例性的”或者“例如”的任何实施例或设计方案不应被解释为比其他实施例或设计方案更优选或更具优势。确切而言，使用“示例性的”或者“例如”等词旨在以具体方式呈现相关概念。
目前，在计算设备中，特别是基于高级RISC机器(advanced RISC machines，ARM)架构设计的计算设备中，通常使用trustzone技术将系统级芯片(system on chip，SoC)的硬件资源和软件资源划分为两个世界，分别为安全世界(secure world)和正常世界(normal world)(也可以称为非安全世界)。对安全性要求较高的关键业务，可以在安全世界运行。对安全性要求不高的业务，可以在正常世界运行。安全世界之所以比正常世界安全，是因为安全世界运行的业务量较少，其可信计算基要远远小于正常世界的可信计算基，因此安全世界的可信度远远高于正常世界的可信度。可选的，安全世界也可以称为可信执行环境(trust execution environment，TEE)，非安全世界或正常世界也可以称为丰富执行环境(rich execution environment，REE)。
例如，如图1所示的一种计算系统的安全架构示意图，该计算系统包括REE和TEE，REE中运行的业务对安全性没有很高的要求，TEE中运行的业务对安全性要求较高。如图1所示，REE可以运行丰富操作系统(rich operating system，ROS)，用以支持用户运行丰富的应用程序(application，App)。比如，REE可以运行安卓，Linux，windows等操作系统，用以支持用户运行微信、腾讯视频等安全性要求不高的应用程序。TEE通常运行供应商自己实现的一个小的操作系统，用以支持用户运行可信应用程序(trust application，TA)，这个操作系统可以称为可信操作系统(trust operating system，TOS)。比如，TEE可以运行供应商的操作系统，用以支持用户运行有签名的APP、支付APP、人脸识别、指纹识别、密码处理、数据加解密、安全认证、密钥管理等对安全性要求较高的程序。
可选的，上述TOS和ROS可以通过分时复用的方式，运行在同一个处理器上。当处理器运行TOS时，称为安全世界处理器，当处理器运行ROS时，称为正常世界处理器。TOS和ROS也可以同时运行在一个处理器的不同操作系统内核kernel上。
可选的，TOS和ROS可以同时共享其他物理资源，例如，如图1所示，TOS和ROS可以同时共享中央处理器(central processing unit，CPU)、图形处理器(graphics processing unit，GPU)、神经网络处理器(neural network processing unit，NPU)、只读存储器(read only memory，ROM)、外设、一次性可编程存储器(例如，efuse)等物理资源。
虽然采用trustzone技术提高了计算系统的安全性，但是随着关键业务越来越多，trustzone隔离的安全世界的代码量越来越大，导致安全世界的可信计算基也越来越大，安全世界面临的攻击面也越来越大，因此需要新的技术来保证计算系统的安全。
一种方式是通过安全启动技术提高计算设备的安全性。安全启动技术是采用密码学手段，通过对镜像逐级校验，以确保计算设备可信。计算设备启动时运行的代码通常写在ROM中，而ROM器件的特性能够确保这段代码不会被篡改。只有当下一级要运行的镜像通过校验后，才会被计算系统执行，因此能够保证运行的镜像没有被非法篡改。
但是，安全启动技术只能保证计算设备运行的镜像没有被篡改，当系统的实现存在漏洞时，攻击者可以利用这些漏洞获得更高的权限，运行恶意代码，甚至获得对系统的访问权限。例如，攻击者可以在计算系统安全启动过程中进行攻击，利用启动流程中的代码漏洞，从而绕过启动过程中的安全校验。再例如，在计算系统安全启动过程中，恶意软件利用权限配置漏洞，能够访问整个内存空间。因此，在系统的实现存在漏洞时，安全启动技术并不能保证计算设备的安全性。
另一种方式是通过度量技术提高计算设备的安全性。例如，如图2所示的一种计算系统的安全架构示意图，通过在TEE设置完整性验证应用，并通过该完整性验证应用对REE的运行进行完整性度量。例如，如图2所示，可以通过完整性验证应用对REE中与内核相关的操作进行拦截，比如，对修改TEE操作系统的操作、将信息写入特权代码page等操作进行拦截。
但是，该方案在TEE设置的完整性验证应用仅可以对REE的运行进行度量，保证REE的运行安全，并不能发现TEE出现的漏洞。也就是说，该方案是将TEE作为完全可信任的系统，然而根据前述论述可知，TEE并不总是安全的。例如，黑帽安全技术大会Blackhat中提到的利用Android系统安全漏洞，可以攻破用户指纹识别功能，并顺利窃取到用户的指纹信息。因此，仅对REE进行度量，不对TEE进行度量，将导致TEE的安全性较低。而且，该方案不能对计算系统的启动过程进行度量，可能造成计算系统启动过程中存在漏洞被攻击者利用。
为了解决现有技术不能对计算系统启动过程进行度量，导致计算系统安全性较低的问题，本申请实施例提供一种终端芯片，该终端芯片中的安全子系统可以对计算子系统的启动过程进行完整性度量，能够确保计算子系统启动过程的安全性。
图3为本申请实施例提供的一种终端设备的架构示意图，该终端设备包括终端芯片和片外内存。终端芯片内设有安全子系统和计算子系统，安全子系统用于对计算子系统进行度量，安全子系统的启动时间早于计算子系统的启动时间。如图3所示，该安全子系统包括：完整性验证单元。该完整性验证单元，用于对计算子系统启动过程的数据进行完整性度量。
可选的，本申请实施例中完整性验证单元的功能可以采用硬件电路实现，也可以采用软件程序实现，本申请实施例对此并不限定。
示例性的，安全子系统启动完成后再启动计算子系统，由于安全子系统的启动时间早于计算子系统的启动时间，从而安全子系统可以对计算子系统启动过程的数据进行度量，以确定计算子系统启动过程中是否被恶意攻击，能够提高计算子系统启动过程的安全性。
示例性的，上述计算子系统可以包括REE和TEE，上述完整性验证单元对计算子系统启动过程的数据进行完整性度量，既可以包括对REE的启动过程的数据进行完整 性度量，也可以包括对TEE启动过程的数据进行完整性度量。
例如，计算子系统包括REE和TEE，安全子系统上电启动后，可以依次对TEE的上电启动过程和REE的上电启动过程的数据进行完整性度量，从而可以确保计算子系统启动过程的安全性。
可选的，如图3所示，安全子系统还可以包括ROM和处理器。ROM，用于存储安全子系统上电时的计算机程序。处理器，用于运行ROM中存储的计算机程序。处理器还用于运行安全子系统的操作系统。可选的，该处理器可以是一个中央处理器CPU，也可以是特定集成电路(application specific integrated circuit，ASIC)，或者是被配置成实施本申请实施例的一个或多个集成电路，例如：一个或多个微处理器(digital signal processor，DSP)，或，一个或者多个现场可编程门阵列(field programmable gate array，FPGA)。本申请实施例对于处理器的具体形式并不限定。
本申请实施例中安全子系统上电时，可以由安全子系统的处理器执行ROM中存储的计算机程序代码。而且由于本申请实施例中的安全子系统的上电启动时间早于计算子系统的上电启动时间，因此安全子系统上电启动完成后，可以对计算子系统的上电启动过程进行完整性度量，以确保计算子系统启动过程的安全性。
示例性的，上述安全子系统可以运行在一个封闭的执行环境，该安全子系统可以运行自定义的固件和操作系统。例如，如图4所示，计算子系统包括应用处理器(application central processing unit，ACPU)、随机存取存储器(Random Access Memory，RAM)、ROM、内存控制器、GPU、外设等硬件资源。安全子系统包括CPU、RAM、ROM等硬件资源，即安全子系统的硬件资源与计算子系统的硬件资源是相互独立的。
再例如，图5为一种终端设备的软件架构示意图，如图5所示，计算子系统可以包括REE和TEE，安全子系统可以运行自定义的操作系统，该自定义的操作系统可以与REE运行的ROS和TEE运行的TOS均不同，该安全子系统中的完整性验证单元可以对TEE的操作系统内核和REE的操作系统内核进行度量，以确保计算子系统的安全运行。
可选的，上述安全子系统的处理器结构和计算子系统的处理器结构可以相同，也可以不同。例如，安全子系统的处理器架构可以为ARM架构，计算子系统的处理器结构可以为X86架构。再例如，安全子系统的处理器架构和计算子系统的处理器架构也可以均为ARM架构。
可以理解的，由于安全子系统的硬件资源与计算子系统的硬件资源之间相互独立，而且安全子系统可以运行自定义的操作系统，因此在计算子系统启动之前，安全子系统中的处理器可以运行自定义的操作系统启动安全子系统，在安全子系统启动完成后，安全子系统中的完整性验证单元可以对计算子系统启动过程中运行的数据进行完整性度量，以确保计算子系统启动过程的安全性。
可选的，安全子系统还可以包括第一交互接口，安全子系统可以通过该第一交互接口访问计算子系统的所有资源。示例性的，安全子系统可以通过第一交互接口和计算子系统的总线1，读取计算子系统中的所有资源(比如，计算子系统的RAM和寄存器中的资源)。可选的，安全子系统还可以通过第一交互接口读取片外内存中的资源。
例如，安全子系统可以读取计算子系统的RAM或片外内存(例如，双倍速率(double data rate，DDR)同步动态随机存储器)中的待执行的镜像、内存映射页表信息等与安全有关的数据。再例如，安全子系统可以读取计算子系统的寄存器中的重置向量基地址、trustzone保护控制器(trustzone protection controller，TZPC)、trustzone内存适配器(trustzone memory adapter，TZMA)、trustzone地址空间控制器(trustzone address space controller，TZASC)、异常向量表等与安全有关的数据。
可选的，如图3或图4所示，安全子系统还可以包括密码引擎(crypto engine)，密码引擎用于提供密码算法。完整性验证单元，具体用于调用密码引擎提供的密码算法，对计算子系统启动过程的数据进行完整性度量。
示例性的，密码引擎用于提供哈希算法、消息认证码(message authentication code，MAC)算法等加密算法。例如，完整性验证单元可以通过调用密码引擎提供的哈希算法，计算计算子系统启动过程的数据的哈希值。再例如，完整性验证单元可以通过调用密码引擎提供的MAC算法，计算计算子系统启动过程的数据的MAC值。
可选的，如图3或图4所示，上述安全子系统还可以包括：随机存取存储器RAM，RAM用于存储计算子系统启动过程和运行过程的数据对应的基准值。可选的，RAM还可以用于临时存储安全子系统运行时需要的其他信息。
可选的，上述完整性验证单元，具体用于调用密码引擎计算计算子系统启动过程的数据的特征值，并将该特征值与RAM中存储的基准值进行比对，以指示计算子系统是否被攻击。可以理解的，如果特征值与RAM中存储的基准值一致，则说明计算子系统未被攻击。如果特征值与RAM中存储的基准值不一致，则说明计算子系统被攻击。当安全子系统确定计算子系统被攻击时，安全子系统可以将计算子系统复位，或者也可以进行其他异常处理，本申请实施例对计算子系统被攻击时异常处理的具体方式并不进行限定，下述实施例仅以计算子系统被攻击时，安全子系统将计算子系统复位为例进行说明。
可选的，当完整性验证单元调用密码引擎提供的哈希算法计算启动过程的数据的特征值时，该特征值为哈希值。当完整性验证单元调用密码引擎提供的MAC算法计算启动过程的数据的特征值时，该特征值为MAC值。本申请实施例对于密码引擎提供的密码算法的具体类型并不限定，下述实施例仅以密码引擎提供的密码算法为哈希算法为例进行说明。
可选的，上述处理器还用于在完整性验证单元确定特征值与基准值相同的情况下，向计算子系统发送第一指示信号，该第一指示信号用于指示计算子系统未被攻击。示例性的，该第一指示信号可以为硬件信号。
可选的，在完整性验证单元确定特征值与基准值不同的情况下，上述处理器，还用于向服务器发送指示信息，该指示信息用于指示计算子系统被攻击。并向计算子系统发送第二指示信号，该第二指示信号用于复位计算子系统。示例性的，该第二指示信号可以为硬件信号。
可选的，上述计算子系统启动过程的数据可以包括计算子系统启动过程中影响计算子系统安全运行的数据。例如，上述计算子系统启动过程的数据可以包括但不限于：执行的内核代码、内存映射页表，以及REE和TEE的安全配置信息等。
例如，终端上电后，安全子系统第一个上电启动，安全子系统系统可以通过校验启动来确保自身启动的安全性。安全子系统启动完成后，计算子系统开始进行安全启动，在计算子系统启动过程中，安全子系统的完整性验证单元可以读取计算子系统安全启动过程运行的数据，并调用密码引擎计算该数据的哈希值，并将该哈希值与基准值进行比对。如果比对通过(哈希值与基准值相同)，安全子系统向计算子系统发送指示计算子系统未被攻击的第一指示信号，计算子系统接收该第一指示信号后，继续执行下一步的启动流程。如果比对不通过(哈希值与基准值不相同)，安全子系统确定计算子系统已经被攻击，安全子系统可以直接将计算子系统复位，从而保证计算子系统的敏感信息(比如，密钥)不被泄露。安全子系统也可以向服务器发送指示信息，通知服务器计算子系统被攻击，以使得供应商可以及时对计算子系统中的漏洞进行修复。
可选的，如果比对通过(特征值与基准值相同)，安全子系统也可以不向计算子系统发送指示计算子系统未被攻击的第一指示信号。也就是说，在计算子系统未被攻击时，计算子系统在启动过程中可以不管安全子系统的完整性度量结果，一步一步的执行启动流程，直到计算子系统被攻击时，安全子系统将其复位。
可以理解的，本申请实施例提供的终端芯片中，由于安全子系统的启动时间早于计算子系统的启动时间，而且安全子系统可以访问计算子系统的所有资源，因此安全子系统可以对计算子系统的启动过程进行完整性度量，以确定计算子系统启动过程中是否被恶意攻击，可以确保计算子系统启动过程的安全性。
可选的，安全子系统中的完整性验证单元，还用于对计算子系统运行过程的数据进行完整性度量。示例性的，计算子系统运行时，计算子系统的处理器可以仅运行ROS，也可以仅运行TOS，还可以同时运行ROS和TOS。
示例性的，完整性验证单元对计算子系统运行过程的数据进行完整性度量，既可以包括对REE的运行过程的数据进行完整性度量，也可以包括对TEE运行过程的数据进行完整性度量。
可选的，上述计算子系统运行过程的数据可以包括计算子系统运行过程中影响计算子系统安全运行的数据。例如，计算子系统运行过程的数据可以包括但不限于：执行的内核代码、应用程序的代码、内存映射页表，以及REE和TEE的安全配置信息等。
一种实现方式中，完整性验证单元用于在计算子系统从丰富执行环境REE切换至可信执行环境TEE时，对计算子系统运行的数据进行完整性度量。
例如，在运行阶段，当计算子系统从REE切换到TEE时，安全子系统可以读取计算子系统运行的数据，并调用密码引擎计算该数据的哈希值，并将该哈希值与安全子系统预先存储的基准值进行比对。如果比对通过，安全子系统可以向计算子系统发送指示计算子系统未被攻击的第一指示信号。计算子系统接收第一指示信号后，可以切换到TEE，并执行安全业务。如果比对不通过，安全子系统确定计算子系统被攻击，安全子系统将计算子系统复位，从而保证TEE的安全性。可选的，如果比对通过，安全子系统也可以不向计算子系统发送指示计算子系统未被攻击的第一指示信号。也就是说，在计算子系统未被攻击时，计算子系统可以不管安全子系统的完整性度量结果， 从REE切换至TEE，并执行TEE的业务，直到计算子系统被攻击时，安全子系统将其复位。
另一种实现方式中，如图3或图4所示，安全子系统还可以包括：定时器。完整性验证单元还可以基于定时器，定时对计算子系统运行的数据进行完整性度量。
可选的，计算子系统运行的数据可以仅包括TEE运行的数据，也可以仅包括REE运行的数据，还可以同时包括TEE及REE运行的数据。例如，安全子系统定时对计算子系统进行完整性度量时，如果当前计算子系统的处理器仅运行TOS，那么安全子系统对TEE运行的数据进行完整性度量。再例如，安全子系统定时对计算子系统进行完整性度量时，如果当前计算子系统的处理器仅运行ROS，那么安全子系统对REE运行的数据进行完整性度量。再例如，安全子系统定时对计算子系统进行完整性度量时，如果当前计算子系统的处理器同时运行ROS和TOS，那么安全子系统对REE和TEE运行的数据进行完整性度量。
示例性的，在运行阶段，安全子系统可以定时对计算子系统运行过程的数据进行完整性度量，以当前计算子系统的处理器同时运行ROS和TOS为例，安全子系统可以定时读取REE和TEE运行的数据，对REE和TEE进行完整性度量。可以理解的，安全子系统对REE和TEE进行完整性度量的方法可以参考前述内容，在此不再赘述。
可以理解的，本申请实施例提供的终端芯片中，安全子系统不仅可以对计算子系统的启动过程进行完整性度量，也可以对计算子系统运行过程的数据进行完整性度量，因此，能够实现对计算子系统的全生命周期进行度量，以确保计算子系统的安全运行。
可选的，如图3或图4所示，安全子系统还可以包括共享缓冲区，该共享缓冲区用于计算子系统与安全子系统进行通信。例如，共享缓冲区包括Inbox和Outbox，Inbox和Outbox一般是SoC的片内缓冲区(buffer)。
可选的，如图3或图4所示，安全子系统还可以包括进程间通信(inter-process communication，IPC)模块。IPC模块用于向计算子系统中的ACPU或者安全子系统中的处理器发送中断请求，共享缓冲区用于为计算子系统中的应用处理器ACPU或者安全子系统中的处理器缓存通信数据。可选的，安全子系统还可以包括第二交互接口，计算子系统可以通过第二交互接口从安全子系统的共享缓冲区中读取数据，也可以通过第二交互接口向安全子系统中的共享缓冲区中写入数据。
示例性的，当计算子系统与安全子系统进行通信时，计算子系统通过第二交互接口，将数据写到安全子系统的共享缓冲区中，当完成写动作后，计算子系统的ACPU通过IPC模块向安全子系统的处理器发送中断请求。安全子系统的处理器接收中断请求后，从共享缓冲区中读取数据，完成通信。当安全子系统与计算子系统进行通信时，安全子系统将数据写入共享缓冲区中，当完成写动作后，安全子系统的处理器通过IPC模块向计算子系统的ACPU发送中断请求。计算子系统的ACPU接收中断请求后，通过第二交互接口从共享缓冲区中读取数据，完成通信。
可选的，如图3或图4所示，安全子系统还可以包括过滤器(filter)，该过滤器用于拦截计算子系统的第一访问操作，该第一访问操作用于请求访问安全子系统中除共享缓冲区以外的其他资源。也就是说，共享缓冲区是安全子系统中唯一可以被计算子系统访问的资源，计算子系统在访问安全子系统中除共享缓冲区以外的其他资源时， 过滤器可以将这些访问操作拦截，以确保计算子系统不能对安全子系统中的信息进行读取或更改，从而确保安全子系统的可信度。比如，计算子系统不能改写安全子系统的随机存取存储器RAM中存储的数据。可以理解的，在本申请实施例中安全子系统是一个功能简单的系统，具有很小的可信计算基，安全子系统的可信度较高。
可选的，安全子系统中的过滤器还用于拦截安全子系统的第二访问操作，该第二访问操作用于请求向计算子系统写入数据。也就是说，本申请实施例中的安全子系统可以读取计算子系统中的所有资源，但不能向计算子系统写入数据，从而避免将安全子系统中的数据暴露给计算子系统，能够进一步提高安全子系统的可信度。
可选的，安全子系统一旦上电启动后，外部电源管理单元不能对该安全子系统进行下电、复位、改变时钟状态等操作，否则可能导致安全子系统下电，无法对计算子系统进行度量，导致计算子系统的安全性降低。为了解决该问题，第一种实现方式是安全子系统使用独立的时钟和电源直接供电，不受外部电源管理单元控制。第二种实现方式是只有安全子系统给外部电源管理单元发出硬件信号，指示外部电源管理单元对安全子系统进行上电或下电控制后，外部电源管理单元才能对安全子系统进行上电或下电控制。
可选的，对应上述第一种实现方式，如图4所示，安全子系统还可以包括电源时钟管理单元，该电源时钟管理单元用于对安全子系统进行上电或下电控制。在该实现方式中，由于安全子系统中独立的设置了管理安全子系统上电或下电的电源时钟管理单元，该安全子系统的上电或下电可以不受外部电源管理单元控制，因此外部电源管理单元不能对安全子系统进行下电控制。而且采用该实现方式在安全子系统定时对计算子系统的运行过程进行完整性度量时，可以定时的通过该电源时钟管理单元对安全子系统进行上电或下电控制，降低安全子系统的能耗，节省电量。
可选的，对应上述第二种实现方式，上述处理器，还用于向外部电源管理单元发送第三指示信号，该第三指示信号用于指示外部电源管理单元对安全子系统进行上电或下电控制。在该实现方式中，外部电源管理单元只有接收到来自安全子系统的第三指示信号后，才可以对安全子系统进行下电控制，以确保计算子系统全生命周期的安全。
可选的，为了避免安全子系统挂死后，会停止对计算子系统进行度量，导致计算子系统的安全性较差的问题，本申请实施例的安全子系统还可以包括看门狗Watchdog，该看门狗用于在安全子系统挂死的情况下，复位安全子系统和计算子系统。可以理解的，如果安全子系统挂死，就不会有人喂狗，看门狗超时后，会进行全系统复位，从而避免计算子系统在未保护状态下运行时被攻击。可选的，上述复位安全子系统和计算子系统包括重新启动安全子系统和计算子系统。
可选的，如图4所示，安全子系统还可以包括一次性可编程存储器(one time programable，OTP)，该一次性可编程存储器用于存储安全子系统的配置信息和一些关键密钥。示例性的，该一次性可编程存储器可以为efuse。
可以理解的，本申请实施例提供的安全子系统的上电启动时间早于计算子系统的上电启动时间，从而使得安全子系统可以对计算子系统的启动过程和运行过程进行完整性度量，即安全子系统能够对计算子系统的全生命周期进行度量，以确保计算子系 统全生命周期的安全。而且该安全子系统在对计算子系统进行度量时，不仅可以对REE进行度量，也可以对TEE进行度量，从而确保整个计算子系统的安全运行。
如图6所示，本申请实施例还提供一种终端芯片的度量方法，该终端芯片可以为上述图3或图4所示的终端芯片，该度量方法包括以下步骤：
S601、上电启动安全子系统。
该安全子系统的启动时间早于计算子系统的启动时间。例如，启动完安全子系统后再启动计算子系统。
可选的，安全子系统启动时，可以采用安全启动技术对镜像一级一级的校验，以确保安全子系统启动过程的安全性。
可选的，上述步骤S601可以由图4所示的安全子系统中的处理器通过执行ROM中存储的代码，启动安全子系统。
S602、在安全子系统启动完成后，上电启动计算子系统。
可选的，上述安全子系统启动完成后，再启动计算子系统，从而使得安全子系统可以对计算子系统的启动过程进行完整性度量。
可选的，计算子系统启动时，可以采用安全启动技术对镜像一级一级的校验，以确保计算子系统启动过程的安全性。而安全子系统对计算子系统的启动过程进行完整性度量，可以进一步确定计算子系统的启动过程是否被恶意攻击或篡改。
可选的，上述计算子系统可以包括REE和TEE。上述步骤S602中启动计算子系统可以包括：启动TEE和REE。例如，在启动计算子系统时，可以先启动TEE，再启动REE。
S603、安全子系统对计算子系统启动过程的数据进行完整性度量。
可以理解的，上述步骤S603可以由图4所示的安全子系统中的完整性验证单元调用密码引擎对计算子系统启动过程的数据进行完整性度量。关于计算子系统启动过程的数据内容，以及安全子系统对计算子系统启动过程的数据进行完整性度量的具体实现方式，可以参考前述实施例，在此不再赘述。
可选的，上述步骤S603中安全子系统对计算子系统启动过程的数据进行完整性度量，包括：安全子系统计算上述计算子系统启动过程的数据的特征值，并将该特征值与基准值进行比对。
示例性的，在安全子系统启动完成后，计算子系统开始进行安全启动，在计算子系统启动过程中，安全子系统可以先对TEE的启动过程进行完整性度量，再对REE的启动过程进行完整性度量。
可以理解的，本申请实施例提供的终端芯片的度量方法，通过安全子系统启动完成后再启动计算子系统，从而使得安全子系统可以对计算子系统的启动过程进行完整性度量，以确保计算子系统启动过程的安全性。而且该安全子系统在对计算子系统的启动过程进行度量时，不仅可以对REE的启动过程进行完整性度量，也可以对TEE的启动过程进行完整性度量，从而确保整个计算子系统启动过程的安全性。
可选的，若计算子系统启动过程的数据的特征值与基准值相同，安全子系统确定完整性度量成功。若计算子系统启动过程的数据的特征值与基准值不同，安全子系统确定完整性度量失败。
可选的，如图7所示，在步骤S603中安全子系统确定完整性度量成功的情况下，上述方法还可以包括步骤S604；在步骤S603中安全子系统确定完整性度量失败的情况下，上述方法还可以包括步骤S605-S606。
S604、在完整性度量成功的情况下，安全子系统向计算子系统发送第一指示信号。
该第一指示信号用于指示计算子系统未被攻击。
可选的，上述完整性度量成功是指计算子系统启动过程的数据的特征值与基准值比对通过，即数据的特征值与基准值相同。
可选的，在完整性度量成功的情况下，安全子系统向计算子系统发送第一指示信号，指示计算子系统未被攻击。
可选的，在安全子系统确定完整性度量成功的情况下，安全子系统也可以不向计算子系统发送指示计算子系统未被攻击的第一指示信号。例如，在计算子系统未被攻击时，计算子系统在启动过程中可以不管安全子系统的完整性度量结果，一步一步的执行启动流程，直到计算子系统被攻击时，安全子系统将其复位。
S605、在完整性度量失败的情况下，安全子系统向服务器发送指示信息。
该指示信息用于指示计算子系统被攻击。
可选的，上述完整性度量失败是指计算子系统启动过程的数据的特征值与基准值比对不通过，即数据的特征值与基准值不同。
可以理解的，在安全子系统确定完整性度量失败的情况下，通过安全子系统向服务器发送指示信息，通知服务器计算子系统被攻击，从而使得供应商可以及时对计算子系统中的漏洞进行修复，确保计算子系统的安全运行。
S606、安全子系统向计算子系统发送第二指示信号。
该第二指示信号用于复位计算子系统。
可以理解的，在完整性度量失败的情况下，安全子系统确定计算子系统被攻击，安全子系统可以直接将计算子系统复位，从而保证计算子系统的敏感信息(比如，密钥)不被泄露。
例如，以安全子系统对TEE的启动过程进行完整性度量为例，如图8所示，系统上电(例如，终端设备开机)后，安全子系统第一个上电启动，在安全子系统完成安全启动后，计算子系统上电启动，计算子系统加载ROM代码，安全子系统的完整性验证单元读取ROM代码、安全应用程序的代码、内存映射页表，以及TEE的安全配置信息等数据，并对该数据进行完整性度量。如果ROM代码对应的数据完整性度量失败，重启计算子系统。如果ROM代码对应的数据完整性度量成功，计算子系统可以继续运行ROM代码，并加载bootloader(操作系统的启动加载程序)，并进一步对加载bootloader对应的数据进行完整性度量。如果加载bootloader对应的数据完整性度量失败，重启计算子系统。如果加载bootloader对应的数据完整性度量成功，那么计算子系统继续运行bootloader代码，如此依次执行启动流程，直至TEE安全启动完成。
本申请实施例提供的度量方法，通过安全子系统启动完成后再启动计算子系统，从而使得安全子系统可以对计算子系统的启动过程进行完整性度量，以确保计算子系统启动过程的安全性。而且该安全子系统在对计算子系统的启动过程进行度量时，不仅可以对REE的启动过程进行完整性度量，也可以对TEE的启动过程进行完整性度 量，从而确保整个计算子系统启动过程的安全性。该方法还可以在安全子系统确定计算子系统被攻击的情况下，通过向服务器发送指示信息，通知服务器计算子系统被攻击，从而使得供应商可以及时对计算子系统中的漏洞进行修复，确保计算子系统的安全运行。并在计算子系统被攻击的情况下，将计算子系统复位，从而保证计算子系统的敏感信息不被泄露。
如图9所示，本申请实施例还提供一种终端芯片的度量方法，该度量方法在上述步骤S604之后，还可以包括以下步骤：
S901、安全子系统对计算子系统运行过程的数据进行完整性度量。
可以理解的，上述步骤S901可以由图4所示的安全子系统中的完整性验证单元调用密码引擎对计算子系统运行过程的数据进行完整性度量。关于计算子系统运行过程的数据的内容，以及安全子系统对计算子系统运行过程的数据进行完整性度量的具体实现方式，可以参考前述实施例，在此不再赘述。
可选的，上述步骤S901中安全子系统对计算子系统运行过程的数据进行完整性度量，包括：安全子系统计算上述计算子系统运行过程的数据的特征值，并将该特征值与基准值进行比对。
可选的，上述步骤S901中安全子系统对计算子系统运行过程的数据进行完整性度量时，安全子系统可以定时对计算子系统运行过程的数据进行完整性度量。该计算子系统可以仅包括REE，或，仅包括TEE，或，既包括TEE又包括REE。
可以理解的，本申请实施例提供的终端芯片的度量方法，通过安全子系统启动完成后再启动计算子系统，从而使得安全子系统可以对计算子系统的启动过程和运行过程进行完整性度量，即安全子系统能够对计算子系统的全生命周期进行度量，以确保计算子系统全生命周期的安全。而且该安全子系统在对计算子系统进行度量时，不仅可以对REE进行完整性度量，也可以对TEE进行完整性度量，从而确保整个计算子系统的安全。
可选的，如图9所示，在步骤S901中安全子系统确定完整性度量成功的情况下，上述方法还可以包括步骤S902；在步骤S901中安全子系统确定完整性度量失败的情况下，上述方法还可以包括步骤S903-S904。
S902、在完整性度量成功的情况下，安全子系统向计算子系统发送第一指示信号。
该第一指示信号用于指示计算子系统未被攻击。
可选的，上述完整性度量成功是指计算子系统运行过程的数据的特征值与基准值比对通过，即数据的特征值与基准值相同。
可选的，在完整性度量成功的情况下，安全子系统向计算子系统发送第一指示信号，指示计算子系统未被攻击。
可选的，在安全子系统确定完整性度量成功的情况下，安全子系统也可以不向计算子系统发送指示计算子系统未被攻击的第一指示信号。例如，在计算子系统未被攻击时，计算子系统在启动过程中可以不管安全子系统的完整性度量结果，一步一步的执行运行流程，直到计算子系统被攻击时，安全子系统将其复位。
S903、在完整性度量失败的情况下，安全子系统向服务器发送指示信息。
该指示信息用于指示计算子系统被攻击。
可选的，上述完整性度量失败是指计算子系统运行过程的数据的特征值与基准值比对不通过，即数据的特征值与基准值不同。
可以理解的，在安全子系统确定完整性度量失败的情况下，通过安全子系统向服务器发送指示信息，通知服务器计算子系统运行过程被攻击，从而使得供应商可以及时对计算子系统中的漏洞进行修复，确保计算子系统的安全运行。
S904、安全子系统向计算子系统发送第二指示信号。
该第二指示信号用于复位计算子系统。
可以理解的，在完整性度量失败的情况下，安全子系统确定计算子系统被攻击，安全子系统可以直接将计算子系统复位，从而保证计算子系统的敏感信息(比如，密钥)不被泄露。
本申请实施例提供的终端芯片的度量方法，通过安全子系统启动完成后再启动计算子系统，从而使得安全子系统可以对计算子系统的启动过程和运行过程进行完整性度量，即安全子系统能够对计算子系统的全生命周期进行度量，以确保计算子系统全生命周期的安全。而且该安全子系统在对计算子系统进行度量时，不仅可以对REE进行完整性度量，也可以对TEE进行完整性度量，从而确保整个计算子系统的安全。该方法还可以在安全子系统确定计算子系统被攻击的情况下，通过向服务器发送指示信息，通知服务器计算子系统被攻击，从而使得供应商可以及时对计算子系统中的漏洞进行修复，确保计算子系统的安全运行。并在计算子系统被攻击的情况下，将计算子系统复位，从而保证计算子系统的敏感信息不被泄露。
本申请实施例还提供一种终端设备，该终端设备包括如图3或图4所示的终端芯片以及片外内存，所述终端芯片用于从所述片外内存读取或写入数据。
结合本申请公开内容所描述的方法或者算法的步骤可以硬件的方式来实现，也可以是由处理器执行软件指令的方式来实现。软件指令可以由相应的软件模块组成，软件模块可以被存放于随机存取存储器(Random Access Memory，RAM)、闪存、可擦除可编程只读存储器(Erasable Programmable ROM，EPROM)、电可擦可编程只读存储器(Electrically EPROM，EEPROM)、寄存器、硬盘、移动硬盘、只读光盘(CD-ROM)或者本领域熟知的任何其它形式的存储介质中。一种示例性的存储介质耦合至处理器，从而使处理器能够从该存储介质读取信息，且可向该存储介质写入信息。当然，存储介质也可以是处理器的组成部分。处理器和存储介质可以位于ASIC中。另外，该ASIC可以位于终端接口设备中。当然，处理器和存储介质也可以作为分立组件存在于终端接口设备中。
本领域技术人员应该可以意识到，在上述一个或多个示例中，本发明所描述的功能可以用硬件、软件、固件或它们的任意组合来实现。当使用软件实现时，可以将这些功能存储在计算机可读介质中或者作为计算机可读介质上的一个或多个指令或代码进行传输。计算机可读介质包括计算机存储介质和通信介质，其中通信介质包括便于从一个地方向另一个地方传送计算机程序的任何介质。存储介质可以是通用或专用计算机能够存取的任何可用介质。
以上所述的具体实施方式，对本发明的目的、技术方案和有益效果进行了进一步详细说明，所应理解的是，以上所述仅为本发明的具体实施方式而已，并不用于限定 本发明的保护范围，凡在本发明的技术方案的基础之上，所做的任何修改、等同替换、改进等，均应包括在本发明的保护范围之内。

Claims (28)

  1. 一种终端芯片，其特征在于，所述终端芯片包括计算子系统和安全子系统，所述安全子系统用于对所述计算子系统进行度量，所述安全子系统的启动时间早于所述计算子系统的启动时间，所述安全子系统包括：完整性验证单元；
    所述完整性验证单元，用于对所述计算子系统启动过程的数据进行完整性度量。
  2. 根据权利要求1所述的终端芯片，其特征在于，所述安全子系统还包括：第一交互接口，所述安全子系统通过所述第一交互接口访问所述计算子系统的所有资源。
  3. 根据权利要求1或2所述的终端芯片，其特征在于，所述完整性验证单元，还用于对所述计算子系统运行过程的数据进行完整性度量。
  4. 根据权利要求3所述的终端芯片，其特征在于，所述完整性验证单元，具体用于在所述计算子系统从丰富执行环境REE切换至可信执行环境TEE时，对所述计算子系统运行的数据进行完整性度量。
  5. 根据权利要求3或4所述的终端芯片，其特征在于，所述安全子系统还包括：定时器，所述定时器用于计时；
    所述完整性验证单元，具体还用于基于所述定时器，定时对所述计算子系统运行的数据进行完整性度量。
  6. 根据权利要求1-5中任一项所述的终端芯片，其特征在于，所述安全子系统还包括：共享缓冲区，所述共享缓冲区用于所述计算子系统与所述安全子系统进行通信。
  7. 根据权利要求6所述的终端芯片，其特征在于，所述安全子系统还包括：过滤器，
    所述过滤器，用于拦截所述计算子系统的第一访问操作，所述第一访问操作用于请求访问所述安全子系统中除所述共享缓区以外的其他资源。
  8. 根据权利要求7所述的终端芯片，其特征在于，所述过滤器，还用于拦截所述安全子系统的第二访问操作，所述第二访问操作用于请求向所述计算子系统写入数据。
  9. 根据权利要求1-8中任一项所述的终端芯片，其特征在于，所述安全子系统还包括：只读存储器ROM和处理器，
    所述ROM，用于存储所述安全子系统上电时的计算机程序；
    所述处理器，用于运行所述ROM中存储的所述计算机程序。
  10. 根据权利要求1-9中任一项所述的终端芯片，其特征在于，所述安全子系统还包括密码引擎，
    所述密码引擎，用于提供密码算法；
    所述完整性验证单元，具体用于调用所述密码引擎提供的密码算法，对所述计算子系统启动过程和运行过程的数据进行完整性度量。
  11. 根据权利要求10所述的终端芯片，其特征在于，所述安全子系统还包括：随机存取存储器RAM，所述RAM用于存储所述计算子系统启动过程和运行过程的数据对应的基准值。
  12. 根据权利要求11所述的终端芯片，其特征在于，所述完整性验证单元，具体用于调用所述密码引擎提供的密码算法，计算所述计算子系统启动过程和运行过程的数据的特征值，并将所述特征值与所述RAM中存储的基准值进行比对，以指示所述 计算子系统是否被攻击。
  13. 根据权利要求12所述的终端芯片，其特征在于，处理器，还用于在所述特征值与所述基准值相同的情况下，向所述计算子系统发送第一指示信号，所述第一指示信号用于指示所述计算子系统未被攻击。
  14. 根据权利要求12所述的终端芯片，其特征在于，处理器，还用于：
    在所述特征值与所述基准值不同的情况下，向服务器发送指示信息，所述指示信息用于指示所述计算子系统被攻击；向所述计算子系统发送第二指示信号，所述第二指示信号用于复位所述计算子系统。
  15. 根据权利要求1-14中任一项所述的终端芯片，其特征在于，所述安全子系统还包括：电源时钟管理单元；
    所述电源时钟管理单元，用于对所述安全子系统进行上电或下电控制。
  16. 根据权利要求1-14中任一项所述的终端芯片，其特征在于，处理器还用于向外部电源管理单元发送第三指示信号，所述第三指示信号用于指示所述外部电源管理单元对所述安全子系统进行上电或下电控制。
  17. 根据权利要求1-16中任一项所述的终端芯片，其特征在于，所述安全子系统还包括：看门狗；
    所述看门狗用于在所述安全子系统挂死的情况下，复位所述安全子系统和所述计算子系统。
  18. 一种终端芯片的度量方法，其特征在于，所述终端芯片包括计算子系统和安全子系统，所述方法包括：
    上电启动所述安全子系统；所述安全子系统用于对所述计算子系统进行度量；
    在所述安全子系统启动完成后，上电启动所述计算子系统；
    所述安全子系统对所述计算子系统启动过程的数据进行完整性度量。
  19. 根据权利要求18所述的方法，其特征在于，所述方法还包括：
    所述安全子系统对所述计算子系统运行过程的数据进行完整性度量。
  20. 根据权利要求19所述的方法，其特征在于，所述安全子系统对所述计算子系统运行过程的数据进行完整性度量，包括：
    在所述计算子系统从丰富执行环境REE切换至可信执行环境TEE时，所述安全子系统对所述计算子系统运行的数据进行完整性度量。
  21. 根据权利要求19所述的方法，其特征在于，所述安全子系统对所述计算子系统运行过程的数据进行完整性度量，包括：
    所述安全子系统定时对所述计算子系统运行过程的数据进行完整性度量。
  22. 根据权利要求18-21中任一项所述的方法，其特征在于，所述安全子系统对所述计算子系统启动过程或运行过程的数据进行完整性度量，包括：
    所述安全子系统计算所述计算子系统启动过程或运行过程的数据的特征值，并将所述特征值与基准值进行比对，以指示所述计算子系统是否被攻击。
  23. 根据权利要求22所述的方法，其特征在于，在所述特征值与所述基准值相同的情况下，所述方法还包括：
    所述安全子系统向所述计算子系统发送第一指示信号，所述第一指示信号用于指 示所述计算子系统未被攻击。
  24. 根据权利要求22所述的方法，其特征在于，在所述特征值与所述基准值不同的情况下，所述方法还包括：
    所述安全子系统向服务器发送指示信息，所述指示信息用于指示所述计算子系统被攻击；
    所述安全子系统向所述计算子系统发送第二指示信号，所述第二指示信号用于复位所述计算子系统。
  25. 根据权利要求18-24中任一项所述的方法，其特征在于，所述方法还包括：
    所述安全子系统向外部电源管理单元发送第三指示信号，所述第三指示信号用于指示所述外部电源管理单元对所述安全子系统进行上电或下电控制。
  26. 根据权利要求18-25中任一项所述的方法，其特征在于，所述方法还包括：
    所述安全子系统拦截所述计算子系统的第一访问操作，所述第一访问操作用于访问所述安全子系统中除共享缓冲区以外的其他资源。
  27. 根据权利要求18-26中任一项所述的方法，其特征在于，所述方法还包括：
    所述安全子系统拦截所述安全子系统的第二访问操作，所述第二访问操作用于请求向所述计算子系统写入数据。
  28. 一种终端设备，其特征在于，所述终端设备包括如权利要求1-17中任一项所述的终端芯片以及片外内存，所述终端芯片用于从所述片外内存读取或写入数据。
PCT/CN2021/073663 2021-01-25 2021-01-25 一种终端芯片及其度量方法 WO2022155973A1 (zh)

Priority Applications (4)

Application Number Priority Date Filing Date Title
EP21920365.0A EP4273722A4 (en) 2021-01-25 2021-01-25 TERMINAL CHIP AND MEASUREMENT METHOD THEREFOR
CN202180084411.1A CN116601629A (zh) 2021-01-25 2021-01-25 一种终端芯片及其度量方法
PCT/CN2021/073663 WO2022155973A1 (zh) 2021-01-25 2021-01-25 一种终端芯片及其度量方法
US18/356,463 US20230367913A1 (en) 2021-01-25 2023-07-21 Terminal chip and measurement method thereof

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2021/073663 WO2022155973A1 (zh) 2021-01-25 2021-01-25 一种终端芯片及其度量方法

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US18/356,463 Continuation US20230367913A1 (en) 2021-01-25 2023-07-21 Terminal chip and measurement method thereof

Publications (1)

Publication Number Publication Date
WO2022155973A1 true WO2022155973A1 (zh) 2022-07-28

Family

ID=82548386

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2021/073663 WO2022155973A1 (zh) 2021-01-25 2021-01-25 一种终端芯片及其度量方法

Country Status (4)

Country Link
US (1) US20230367913A1 (zh)
EP (1) EP4273722A4 (zh)
CN (1) CN116601629A (zh)
WO (1) WO2022155973A1 (zh)

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104918116A (zh) * 2015-05-28 2015-09-16 北京视博数字电视科技有限公司 用于智能终端的资源播放方法及系统
WO2019225849A1 (ko) * 2018-05-25 2019-11-28 주식회사 수산아이앤티 게스트 운영체제의 무결성과 파일 입출력 제어를 통해서 보안 서비스를 제공하는 보안 장치 및 방법
CN111177703A (zh) * 2019-12-31 2020-05-19 青岛海尔科技有限公司 操作系统数据完整性的确定方法及装置
CN112016090A (zh) * 2019-05-30 2020-12-01 阿里巴巴集团控股有限公司 安全计算卡，基于安全计算卡的度量方法及系统

Family Cites Families (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US9047471B2 (en) * 2012-09-25 2015-06-02 Apple Inc. Security enclave processor boot control
CN109075815A (zh) * 2016-08-09 2018-12-21 华为技术有限公司 一种片上系统和处理设备
US10402567B2 (en) * 2017-06-25 2019-09-03 Microsoft Technology Licensing, Llc Secure boot for multi-core processor
EP3570197A1 (en) * 2018-05-16 2019-11-20 Gemalto Sa Electronic system and method for preventing malicious actions on a processing system of the electronic system

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104918116A (zh) * 2015-05-28 2015-09-16 北京视博数字电视科技有限公司 用于智能终端的资源播放方法及系统
WO2019225849A1 (ko) * 2018-05-25 2019-11-28 주식회사 수산아이앤티 게스트 운영체제의 무결성과 파일 입출력 제어를 통해서 보안 서비스를 제공하는 보안 장치 및 방법
CN112016090A (zh) * 2019-05-30 2020-12-01 阿里巴巴集团控股有限公司 安全计算卡，基于安全计算卡的度量方法及系统
CN111177703A (zh) * 2019-12-31 2020-05-19 青岛海尔科技有限公司 操作系统数据完整性的确定方法及装置

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP4273722A4 *

Also Published As

Publication number Publication date
US20230367913A1 (en) 2023-11-16
EP4273722A4 (en) 2024-03-13
EP4273722A1 (en) 2023-11-08
CN116601629A (zh) 2023-08-15

Similar Documents

Publication Publication Date Title
US9542114B2 (en) Methods and apparatus to protect memory regions during low-power states
CN106605233B (zh) 使用处理器提供可信执行环境
TWI451338B (zh) 用以執行保全嵌入式容器之處理器擴充技術
CN110414235B (zh) 一种基于ARM TrustZone的主动免疫的双体系结构系统
CN109669734B (zh) 用于启动设备的方法和装置
US7392415B2 (en) Sleep protection
JP6053786B2 (ja) Ａｒｍ（登録商標）トラストゾーン実施のためのファームウェア基盤トラステッドプラットフォームモジュール（ｔｐｍ）
US20160350534A1 (en) System, apparatus and method for controlling multiple trusted execution environments in a system
KR20160146955A (ko) 인증된 변수의 관리
CN102063591A (zh) 基于可信平台的平台配置寄存器参考值的更新方法
US8843742B2 (en) Hypervisor security using SMM
CN116049825A (zh) 管理基板管理控制器的存储器中的秘密的存储
US20190114433A1 (en) Method and Apparatus for Boot Variable Protection
WO2022155973A1 (zh) 一种终端芯片及其度量方法
US10417429B2 (en) Method and apparatus for boot variable protection
US20230254151A1 (en) System and method for remote startup management
JP6494143B2 (ja) 装置、方法、集積回路、プログラム、及び有形のコンピュータ可読記憶媒体
JP6316370B2 (ja) 装置、方法、集積回路、プログラム、及び有形のコンピュータ可読記憶媒体
Cheng et al. An Attack-Immune Trusted Architecture for Supervisory Intelligent Terminal
CN118211239A (zh) 一种安全架构系统、实现安全可信启动的方法和计算设备
WO2019112972A1 (en) Method and apparatus for boot variable protection
Zhang et al. Protecting Code Confidentiality in Flash Controller-Based Secure Execution Environment

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 21920365

Country of ref document: EP

Kind code of ref document: A1

WWE Wipo information: entry into national phase

Ref document number: 202180084411.1

Country of ref document: CN

ENP Entry into the national phase

Ref document number: 2021920365

Country of ref document: EP

Effective date: 20230802

NENP Non-entry into the national phase

Ref country code: DE