Secure virtualization system suitable for use in trusted execution environment (TEE)

Abstract

The invention discloses a secure virtualization system suitable for use in a trusted execution environment (TEE). The system includes at least one virtual machine, at least one trusted application (TA) and the at least one trusted execution environment. The virtual machine is built through Micro Hypervisor. The trusted execution environment is run on the virtual machine. The trusted application isrun in the trusted execution environment of the virtual machine. The trusted execution environment is configured to access the virtual machine in a first mode to realize calling of resources. Under the first mode, the virtual machine allows accessing of the trusted execution environment to the resources after it is determined that the trusted execution environment has access authority. The systemhas the advantages of: on the basis of trusted virtualization technology, building the virtual machine through the Micro Hypervisor, and running the GP (Global Platform) TEE and the corresponding TAon the virtual machine. Both the TEE and the TA are run on the respective virtual machine, thus complete isolation is realized, and security is greatly improved.

Description

technical field [0001] The invention relates to a security virtualization technology of a mobile device, in particular to a security virtualization system suitable for a trusted execution environment. Background technique [0002] TEE is the abbreviation of Trusted Execution Environment. The current trusted execution environment is mainly based on the trusted execution environment built on the security area of ​​the processor in the smart terminal (such as a smart phone). TEE is an independent execution area, which provides many security properties, such as isolation, TA integrity, etc. At the same time, TEE also ensures the security of code and data loaded into TEE. The traditional TEE technology includes ARM's TrustZone and so on. The GP organization (GlobalPlatform, Global Platform International Standards Organization) has announced the basic protection scope of TEE, related APIs and security attributes, and TEEs that meet this standard are called GPTEE. At the same ti...

AI Technical Summary

Problems solved by technology

The disadvantage of this method is that the operation space for running the operating system on the process is very small. If the TEE is used as a software layer parallel to the TA, the memory area will be shared between the TA and the TEE, and it is impossible to guarantee the operation of multiple TAs. the isolation between; create a safety hazard

Images