Data processing method, cryptographic service device, and electronic device

Abstract

The present application provides a data processing method, a cryptographic service device, and an electronic device. The method is applied to the cryptographic service device in a cryptographic service system. The operating environment of the cryptographic service system includes: a normal execution environment and a secure execution environment based on TrustZone technology. The device includes: a security application module deployed in the secure execution environment, and a security proxy service module deployed in the normal execution environment. The method includes: the security proxy service module receives a cryptographic service call request from a business system; the security proxy service module verifies the business system and the request; when the security proxy service module determines that the business system and the cryptographic service call request have passed the verification, the security proxy service module executes the non-security requirement cryptographic operation corresponding to the cryptographic service call request or calls the security application module to execute the cryptographic service security operation corresponding to the cryptographic service call request according to the request operation type corresponding to the cryptographic service call request, to obtain an operation result.

Description

Technical Field

[0001] The present application relates to the field of information security technology, and in particular to a data processing method, a cryptographic service device, and an electronic device. Background Art

[0002] Among various methods for ensuring data security, cryptography is considered the most effective and reliable core technology. To protect the business data and operations of information systems, one approach is for the business system to provide a set of cryptographic services, with all cryptographic functions implemented by the business system's own services. However, this approach places high demands on the business system. Another approach is to utilize off-the-shelf, authoritatively certified cryptographic modules to provide all security services. In other words, the business system uses an external cryptographic module to provide cryptographic services. A cryptographic module refers to a set of hardware, software, and / or firmware contained within the cryptographic boundary that performs approved or recognized security functions (including cryptographic algorithms and key generation).

[0003] Currently, the primary way information systems utilize cryptographic services is through the use of external cryptographic modules. Cryptographic modules provide essentially the same service. Information systems implement cryptographic services such as encryption, decryption, signing, verification, and integrity checks by invoking the application programming interfaces (APIs) provided by these modules, thereby ensuring information security.

[0004] However, current cryptographic modules have difficulty in striking a balance between security and usage costs. Summary of the Invention

[0005] The purpose of the present application is to provide a data processing method, a cryptographic service device and an electronic device, which can improve the problem that the cryptographic modules in the prior art are difficult to strike a balance between security and usage cost.

[0006] In a first aspect, the present application provides a data processing method applied to a cryptographic service device in a cryptographic service system, wherein the operating environment of the cryptographic service system includes: a normal execution environment and a secure execution environment based on TrustZone technology; the cryptographic service device includes: a security application module deployed in the secure execution environment, and a security proxy service module deployed in the normal execution environment; the method includes:

[0007] The security proxy service module receives a password service call request from the business system;

[0008] The security proxy service module verifies the business system and the cryptographic service call request;

[0009] When the security proxy service module determines that the business system and the cryptographic service call request have passed the verification, it executes the non-security requirement cryptographic operation corresponding to the cryptographic service call request or calls the security application module to execute the cryptographic service security operation corresponding to the cryptographic service call request according to the request operation type corresponding to the cryptographic service call request to obtain the operation result.

[0010] In the above method, the cryptographic service provided by the cryptographic service device is implemented based on the normal execution environment and secure execution environment unique to TrustZone technology. By utilizing TrustZone's division of the normal world and the secure world, a secure proxy service module and a secure application module are deployed in the normal execution environment and the secure execution environment, respectively. This eliminates the need to rely on external independent hardware to provide cryptographic services, making it easier for users to use and less expensive. The aforementioned deployed secure proxy service module verifies both the business system and requests initiated by the business system, improving security. Upon passing verification, the secure proxy service module can complete non-security-required cryptographic operations in the normal execution environment, and can also proxy security-required cryptographic operations, calling the secure application module to perform cryptographic service security operations in the secure execution environment, thereby improving security. Since sensitive security operations are all performed in the secure execution environment protected by TrustZone, and non-security-required operations are performed in the normal execution environment, the number of accesses to the secure execution environment can be reduced while ensuring security, improving processing efficiency and facilitating user use.

[0011] In an optional embodiment, according to the request operation type corresponding to the cryptographic service call request, the non-security requirement cryptographic operation corresponding to the cryptographic service call request is executed or the security application module is called to execute the cryptographic service security operation corresponding to the cryptographic service call request to obtain an operation result, including: when it is determined that the request operation type is the first type, the security proxy service module executes the non-security requirement cryptographic operation corresponding to the cryptographic service call request to obtain an operation result; the first type indicates that only local information and / or public information in the normal execution environment needs to be used during the operation.

[0012] Through the above implementation, the switching frequency between the normal execution environment and the secure execution environment can be reduced, the interaction complexity can be reduced, and the processing efficiency can be improved.

[0013] In an optional implementation, according to the request operation type corresponding to the cryptographic service call request, executing the non-security requirement cryptographic operation corresponding to the cryptographic service call request or calling the security application module to execute the cryptographic service security operation corresponding to the cryptographic service call request to obtain an operation result, including: when determining that the request operation type is the second type, the security proxy service module calls the security application module to execute the cryptographic service security operation corresponding to the cryptographic service call request to obtain an operation result; the second type indicates the type of non-public information in the secure execution environment that needs to be used during the operation.

[0014] Through the above implementation method, based on the security protection mechanism provided by TrustZone technology, the security application module runs in a protected secure execution environment. Sensitive non-public information only exists in the secure execution environment. Operations involving non-public information can be processed in the secure execution environment protected by TrustZone. The security application module provides cryptographic services to the business system according to the calling process of the security proxy service module, thereby improving security.

[0015] In an optional embodiment, the security proxy service module calls the security application module to perform the cryptographic service security operation corresponding to the cryptographic service call request to obtain an operation result, including: the security proxy service module provides the cryptographic service call request to the security application module through a trusted transmission path formed by the client interface and the internal interface provided by the secure execution environment; the security application module authenticates the security proxy service module upon receiving the cryptographic service call request; when the security proxy service module passes the authentication, the security application module performs the cryptographic service security operation corresponding to the cryptographic service call request under the secure execution environment to obtain the operation result; the security application module sends the operation result to the security proxy service module through the trusted transmission path, so that the security proxy service module can provide the operation result to the business system.

[0016] Through the above implementation, the security application module verifies the security proxy service module that accesses itself, and only accepts the calling process initiated by the verified module, provides cryptographic services to the requester based on the calling process, and transmits data based on the trusted transmission path between the normal execution environment and the secure execution environment of TrustZone, thereby improving security.

[0017] In an optional embodiment, the non-public information includes: security policies and security parameters encrypted by the security mechanism of the secure execution environment, the security policy is used to be provided to the security proxy service module so that the security proxy service module can verify the business system and the cryptographic service call request according to the security policy, and the security parameters are used to be provided to the security application module so that the security application module can verify the security proxy service module according to the security parameters, or perform cryptographic service security operations according to the security parameters and the cryptographic service call request.

[0018] Through the above implementation, sensitive information involved in access control and secure computing operations is encrypted and stored in the storage environment of the TrustZone secure world (i.e., the secure execution environment). The security proxy service module and the security application module can improve security by providing security services to external business systems based on these encrypted contents.

[0019] In an optional embodiment, before the security proxy service module receives the cryptographic service call request of the business system, the method further includes: performing an initialization operation through the security proxy service module, and storing the data generated by the initialization into the secure execution environment through the security application module, and the content of the initialization operation includes: generating a key pair, generating a master key, importing a digital certificate, configuring a security policy for identity authentication, importing a trusted certificate chain, and importing at least one of a code signature.

[0020] Through the above implementation, the initial security state of the cryptographic service device can be set to facilitate calling and use.

[0021] In an optional embodiment, the security proxy service module verifies the business system and the cryptographic service call request, including: the security proxy service module obtains a pre-configured security policy; when the security proxy service module receives the cryptographic service call request, the security proxy service module authenticates the business system according to the security policy, and determines whether the cryptographic service call request is currently allowed to be processed according to the security policy.

[0022] Through the above implementation, the security proxy service module verifies access to its own business system and received requests based on pre-configured security policies before providing cryptographic services, thereby improving the overall security of cryptographic service applications.

[0023] In an optional embodiment, the cryptographic service device also includes: a secure call interface deployed in the ordinary execution environment; the secure proxy service module receives the cryptographic service call request of the business system, including: the secure proxy service module receives the cryptographic service call request sent by the business system by calling the secure call interface; after the secure proxy service module obtains the operation result, the method also includes: sending the operation result to the business system through the secure call interface.

[0024] Through the above implementation, the business system can call the cryptographic service provided by the cryptographic service device by accessing the secure call interface.

[0025] In an optional implementation, the method further includes: the security agent service module responding to the administrator's management configuration operation, and performing a key management operation, a certificate management operation, or a security policy configuration operation according to the type of the management configuration operation.

[0026] Through the above implementation, management and configuration functions such as key management, certificate management, and security policy configuration can be provided on the basis of providing reliable cryptographic services.

[0027] In an optional embodiment, the cryptographic service device includes multiple security proxy service modules and multiple security application modules; each of the multiple security proxy service modules is used to interact with at least one security application module for data, and each of the multiple security application modules is used to provide cryptographic services for at least one security proxy service module.

[0028] In a second aspect, the present application provides a cryptographic service device, comprising: a security application module deployed in a secure execution environment, and a security proxy service module deployed in a normal execution environment, wherein the secure execution environment and the normal execution environment are two operating environments provided based on TrustZone technology;

[0029] The security proxy service module is used to receive a cryptographic service call request from a business system;

[0030] The security proxy service module is further used to verify the business system and the cryptographic service call request;

[0031] The security proxy service module is also used to, when determining that the business system and the cryptographic service call request have passed verification, execute the non-security requirement cryptographic operation corresponding to the cryptographic service call request according to the request operation type corresponding to the cryptographic service call request, or call the security application module to execute the cryptographic service security operation corresponding to the cryptographic service call request to obtain the operation result.

[0032] The above-mentioned device can execute the method provided in the first aspect, which utilizes the division of the normal world and the secure world by TrustZone, and deploys the security proxy service module and the security application module in the normal execution environment and the secure execution environment respectively. It does not need to rely on external independent hardware to provide cryptographic services, which is convenient for users to use and has low cost. Among them, the security proxy service module can be used to verify the business system and the requests initiated by the business system to improve security. It can also be used to complete non-security cryptographic operations in the normal execution environment and proxy cryptographic operations with security requirements. Since sensitive security operations are performed in the secure execution environment protected by TrustZone, and non-security operations are performed in the normal execution environment, the number of visits to the secure execution environment can be reduced while ensuring security, which can improve processing efficiency and facilitate user use.

[0033] In a third aspect, the present application provides an electronic device, the electronic device having a TrustZone architecture, a cryptographic service device being deployed in the electronic device, the electronic device comprising: a memory and a processor;

[0034] The memory stores a computer program executable by the processor, and when the computer program is executed by the processor, the method described in the first aspect is implemented. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following is a brief introduction to the drawings required for use in the embodiments of the present application. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other relevant drawings can be obtained based on these drawings without creative work.

[0036] Figure 1 A schematic diagram of a cryptographic service system provided in an embodiment of the present application.

[0037] Figure 2 A schematic diagram of another cryptographic service system provided in an embodiment of the present application.

[0038] Figure 3 A flowchart of a data processing method provided in an embodiment of the present application.

[0039] Figure 4 A functional module block diagram of a cryptographic service device provided in an embodiment of the present application.

[0040] Figure 5 This is a structural block diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0041] The technical solutions in the embodiments of the present application will be described below in conjunction with the drawings in the embodiments of the present application.

[0042] A cryptographic module is a set of hardware, software, and / or firmware contained within a cryptographic boundary that performs approved or recognized security functions (including cryptographic algorithms and key generation).

[0043] In the prior art, the main implementation forms of cryptographic modules include: software development kit (SDK), embedded security element, cryptographic card, cryptographic machine, etc.

[0044] The disadvantages of existing cryptographic modules in the form of software development kits are: weak security protection capabilities, weak ability to resist attacks, and easy information leakage.

[0045] The disadvantage of existing cryptographic modules in the form of embedded security elements is that the cryptographic computing performance is limited by the processing power of the security element. Generally, the computing performance is not high, and it is difficult to provide overall security protection capabilities.

[0046] The disadvantages of existing password modules in the form of password cards are that they require the business operation device environment to have a PCI (Peripheral Component Interconnect) interface or PCI-E slot, there is a problem of low matching between the hardware device driver structure and the operation environment, and the device structure cost is high.

[0047] The disadvantages of existing cryptographic modules in the form of cryptographic machines are that they require a supporting environment for running the cryptographic machine (such as power supply, rack, network, etc.), the equipment deployment is complex, and the equipment structure cost is high.

[0048] Therefore, various existing cryptographic modules have more or less some deficiencies in use, such as weak security performance, low processing efficiency, high requirements for the hardware interface of the operating environment, or complex structure resulting in high cost of use.

[0049] In view of this, the inventors have proposed the following embodiments after research, providing a cryptographic service device that is easy to use, has high security performance and high computing and processing performance. The cryptographic service device is implemented based on TrustZone technology and can be used as a new cryptographic module. The data processing method executed based on the cryptographic service device can provide safe and reliable cryptographic services for the business system, ensure data security and operation process security, and the entire device can be deployed in the form of a computer software program without relying on external independent hardware, which can reduce the hardware deployment complexity of the equipment and reduce the cost of use.

[0050] See also Figure 1 , Figure 1 A schematic diagram of a cryptographic service system provided in an embodiment of the present application.

[0051] like Figure 1 As shown, the cryptographic service system has a software and hardware platform that complies with the TrustZone architecture. In the embodiment of the present application, the operating environment of the cryptographic service system includes: a normal execution environment (also known as a rich execution environment, Rich Execution Environment, referred to as REE) based on TrustZone technology and a secure execution environment (also known as a trusted execution environment, Trusted Execution Environment, referred to as TEE).

[0052] The normal execution environment includes a normal operating system (or rich operating system) and client applications running on the normal operating system. This normal execution environment can be regarded as an environment constrained by the normal operating system under the TrustZone architecture.

[0053] The secure execution environment includes a secure operating system (also known as a trusted operating system) and secure applications running on the secure operating system. This secure execution environment can be considered an environment constrained by the secure operating system within the TrustZone architecture. The secure execution environment (TEE) is an independent operating environment running outside of the standard operating system and is hardware-trusted.

[0054] Under the TrustZone architecture, even if security measures such as device access control, device data encryption mechanisms, application runtime isolation mechanisms, and permission-based access control are implemented in a normal execution environment, it will still be difficult to ensure data security if sensitive data is not isolated and protected.

[0055] Ordinary operating systems and applications running on them cannot directly access the hardware and software resources within the secure execution environment. However, the Ordinary Execution Environment (REE) and the Secure Execution Environment (TEE) can run in parallel, and they can interact securely through a trusted transmission path formed by the client interface (TEE client interface) and internal interface (TEE internal interface) provided by the secure execution environment. The component responsible for this interactive capability in this trusted transmission path is the trusted firmware under the TrustZone architecture.

[0056] The Secure Execution Environment (TEE) provides a trusted runtime environment for trusted applications (e.g., trusted software authorized through the TEE). It ensures end-to-end security by protecting data confidentiality and integrity and controlling data access rights. The TEE offers superior security protection for data and operations compared to the Regular Execution Environment (REE).

[0057] Considering that the Secure Execution Environment (TEE) under the TrustZone architecture can provide comprehensive security protection for information systems, and that TrustZone technology isolates and divides the Normal Execution Environment (REE) and the Secure Execution Environment (TEE), distinguishing between the Normal World formed by the Normal Execution Environment and the Secure World formed by the Secure Execution Environment, in the embodiments of this application, these two environments of TrustZone technology are used to provide cryptographic services and storage services for the information system.

[0058] In the embodiments of this application, Figure 1 As shown, a cryptographic service device is deployed in the cryptographic service system, which includes a secure application module deployed in a secure execution environment and a secure proxy service module deployed in a common execution environment.

[0059] Optionally, the cryptographic service device may further include a secure calling interface deployed in the common execution environment.

[0060] The secure call interface can be implemented in a variety of ways, each of which conforms to the corresponding interface specifications. For example, it can be, but is not limited to: a development library provided by the Java runtime environment that conforms to the JCE (Java Cryptography Extension) interface standard, a development library that provides a PKCS#11 interface that conforms to cryptographic devices, a development library that conforms to the national secret cryptographic device interface specification, or a development library for a custom interface. These development libraries serve as interface libraries, providing interface functions that conform to standard specifications. The provided interfaces can serve as secure call interfaces for interacting with external business systems (information systems) in embodiments of the present application.

[0061] The security proxy service module can be implemented in the form of an independent process program and can be implemented in multiple languages ​​(for example, C / C++ language, Go language, etc.).

[0062] The security proxy service module in the embodiment of the present application can interact indirectly with the external business system through the security call interface, or directly interact with the external business system through an agreed protocol (this method is regarded as: merging the security call interface into the security proxy service module).

[0063] In an embodiment of the present application, the security proxy service module can complete cryptographic operations with non-security requirements and cryptographic operations with proxy security requirements, that is, the security proxy service module can provide some services to the business system on its own without calling the security application module in the secure execution environment, and can also provide some cryptographic services to the business system through the called security application module when calling the security application module in the secure execution environment.

[0064] The security proxy service module can implement some data management configuration and initialization functions, and can identify requests from business systems to determine whether to provide services for the request and whether to call the security application module to provide services.

[0065] The security application module can respond to calls from the security proxy service module and verify the security proxy service module. Based on the calls from the security proxy service module, the security application module can perform true security operations (operations involving private keys, symmetric keys, and other non-public information required for encryption and decryption), including but not limited to: signing / encrypting with private keys, encrypting / decrypting with symmetric keys, and calculating HMAC (Hash-based Message Authentication Code, a key-related security authentication code).

[0066] In the embodiments of this application, Figure 2 As shown, there can be multiple security proxy service modules deployed in a common execution environment (such as Figure 2 There can be multiple security application modules deployed in a secure execution environment (e.g. Figure 2 C1 and C2 in the diagram).

[0067] exist Figure 2 In the example shown, the security proxy service module B1 can interact directly with the business system A1, or indirectly with the business system A2 through a secure call interface. The security proxy service module B2 can interact directly with the business system A3.

[0068] Both B1 and B2 can call security application modules such as C1 and C2 deployed in the secure execution environment through the trusted transmission path between the normal execution environment and the secure execution environment.

[0069] It should be noted that Figure 1 、 Figure 2 The architecture shown is for illustration only.

[0070] The following is an introduction to a data processing method provided in an embodiment of the present application.

[0071] See also Figure 3 , Figure 3 A flowchart of a data processing method provided in an embodiment of the present application.

[0072] The data processing method can be applied to a cryptographic service device in the aforementioned cryptographic service system, and the method can be implemented by the cryptographic service device. The cryptographic service device includes: a secure application module deployed in a secure execution environment, a secure proxy service module deployed in a common execution environment, and may also include a secure call interface deployed in the common execution environment.

[0073] like Figure 3 As shown, the method includes: steps S31-S33.

[0074] S31: The security proxy service module receives a cryptographic service call request from the business system.

[0075] The secure proxy service module can directly receive cryptographic service call requests from business systems through an agreed-upon protocol, or it can receive cryptographic service call requests from business systems through a secure call interface deployed in a common execution environment. Specifically, a business system can invoke cryptographic services provided by the cryptographic service device by accessing the secure call interface, and the secure proxy service module can receive cryptographic service call requests sent by the business system through the secure call interface.

[0076] Optionally, the secure call interface may encapsulate the data to be operated in the cryptographic service call request and then send it to the secure proxy service module.

[0077] Among them, the password service call request of the business system is a business request and can carry business data and password data.

[0078] This business data indicates which cryptographic service the business system currently requires. It can be used to identify the data object to be processed. The business data can be used to determine which operation to perform on the object and which cryptographic service to provide. For example, the business data can be used to determine whether a signature operation, signature verification operation, or encryption and decryption operation is required for the signature document provided by the business system.

[0079] The cryptographic data carried in the cryptographic service call request can be used as an identifier to find the actual key. Based on the cryptographic data carried in the cryptographic service call request, the actual key required for the signing operation, signature verification operation, encryption and decryption operation, etc. can be determined.

[0080] In an application scenario, when a business system needs to call the cryptographic service device of an embodiment of the present application to perform a signing operation, the cryptographic service call request may include: business data (signature text) and cryptographic data such as the signature algorithm and key identifier. The business data (signature text) here is the object to be signed. When executing the method provided by the embodiment of the present application, the cryptographic service device can determine what key to use and how to generate it, or which key to use, and how to sign the object based on the cryptographic data such as the signature algorithm and key identifier carried in the request.

[0081] In another application scenario, when the business system needs to call the cryptographic service device of the embodiment of the present application to perform a signature verification operation, the cryptographic service call request may include: business data (original signature) and cryptographic data such as signature algorithm, signature value, and public key information.

[0082] S32: The security proxy service module verifies the business system and the password service call request.

[0083] When receiving a cryptographic service call request, the secure proxy service module can authenticate the business system as the requester and determine whether to provide the service to the requester. The secure proxy service module can also verify the cryptographic service call request to determine whether the request is legitimate and whether the cryptographic service required by the request can be supported and provided based on the content of the request.

[0084] As an implementation of the above S32, S32 may include: S321-S322.

[0085] S321: The security proxy service module obtains a pre-configured security policy.

[0086] Among them, the security policy may include but is not limited to whitelists, blacklists, code signatures, feature information and other contents. The code signature in the security policy is used for identity authentication. The feature information in the security policy can be used to determine the types of cryptographic services that can be supported and provided (such as signature operations, signature verification operations, encryption and decryption operations and other cryptographic services). In an embodiment of the present application, the security policy that has been initialized and configured is stored in a secure storage space in a secure execution environment (for example, saved to a secure storage module in a secure application module).

[0087] S322: When receiving the password service call request, the security proxy service module authenticates the business system according to the security policy, and determines whether the password service call request is currently allowed to be processed according to the security policy.

[0088] By matching the business system's identity and cryptographic service call request with the security policy, it can be determined whether the business system is a requester permitted by the security policy. Based on the matching results, it can be determined whether the cryptographic service required by the request is a cryptographic service permitted by the security policy. The secure proxy service module checks received requests against the pre-set security policy. Only requests that pass the security policy check are allowed to proceed; otherwise, the service is denied.

[0089] It is understandable that the security proxy service module may also obtain a security policy when receiving a cryptographic service call request, and verify the business system and the cryptographic service call request based on the obtained security policy.

[0090] Optionally, after being started, the security proxy service module can load the security policy stored in the secure execution environment into its own process space for caching, so that when a cryptographic service call request is received, it can quickly verify it based on the cached security policy. Of course, it is also possible to temporarily access the security policy stored in the secure execution environment when the security policy is needed for verification (this method is relatively inefficient).

[0091] Based on the implementation of S321-S322 above, the secure proxy service module verifies access to its own business system and received requests based on pre-configured security policies before providing cryptographic services, thereby improving the overall security of the cryptographic service application. The secure proxy service module only allows access to itself by requestors that comply with the security policies and only processes requests that comply with the security policies.

[0092] S33: When the security proxy service module determines that the business system and the cryptographic service call request have passed the verification, it executes the non-security requirement cryptographic operation corresponding to the cryptographic service call request or calls the security application module to execute the cryptographic service security operation corresponding to the cryptographic service call request according to the request operation type corresponding to the cryptographic service call request to obtain the operation result.

[0093] After the secure proxy service module obtains the operation result, it can send the operation result to the business system to respond to the business system's request. Optionally, after the secure proxy service module obtains the operation result, it can send the operation result to the business system based on the agreed protocol or secure call interface in the same manner as the aforementioned cryptographic service call request.

[0094] As an implementation of the above S33, S33 may include: S331.

[0095] S331: When it is determined that the requested operation type is the first type, the security proxy service module executes the non-security-required cryptographic operation corresponding to the cryptographic service call request to obtain an operation result.

[0096] The first type indicates a type that only needs to use local information and / or public information in a common execution environment during operation.

[0097] In embodiments of the present application, operations that can be performed solely using local or public information in the normal execution environment without requiring the use of the secure application module in the secure execution environment include, but are not limited to, operations such as signature verification and hash calculation that do not require the use of sensitive information. Operations that do not require the use of sensitive keys (public keys can be considered insensitive keys) can be directly performed by the secure proxy service module in the normal execution environment, completing the operations directly in the normal world without invoking the secure application module in the secure execution environment.

[0098] Optionally, the security proxy service module may include a security control submodule and a security service submodule.

[0099] When determining that the requested operation type is the first type, the security control submodule may call the security service submodule to execute the non-security-required password operation corresponding to the password service call request to obtain an operation result.

[0100] Based on the implementation of S331, the switching frequency between the normal execution environment and the secure execution environment can be reduced, the interaction complexity can be reduced, and the processing efficiency can be improved.

[0101] As another implementation of the above S33, S33 may include: S332.

[0102] S332: When it is determined that the requested operation type is the second type, the security proxy service module calls the security application module to perform the cryptographic service security operation corresponding to the cryptographic service call request and obtains the operation result.

[0103] The second type indicates a type that requires the use of non-public information in a secure execution environment during operation.

[0104] The non-public information may include: security policies and security parameters encrypted by the security mechanism of the secure execution environment.

[0105] The security policy is used to provide the security proxy service module so that the security proxy service module can verify the business system and password service call requests based on the security policy.

[0106] The security parameters are used to be provided to the security application module so that the security application module can verify the security proxy service module according to the security parameters, or perform cryptographic service security operations according to the security parameters and the cryptographic service call request.

[0107] Security parameters may include, but are not limited to, password information, identity verification data, code signature information, secure proxy file paths, and various keys (e.g., key information used for encryption, decryption, signing, and other operations). The code signature information and secure proxy file paths in the security parameters can be used to authenticate the security proxy service module, and the password information and identity verification data can be used to authenticate the security proxy service module, as well as to authenticate the administrator of the cryptographic service device (e.g., in a login authentication scenario). It is understood that any form of parameter used for access control or sensitive information for parameter security operations can be encrypted and stored in a secure execution environment as non-public information. Each module in the cryptographic service device can determine which parameters and policies in the non-public information need to be used based on the type of request actually received and the type of requester.

[0108] Since various sensitive information involved in access control and security computing operations is encrypted and stored in the storage environment of the TrustZone secure world (i.e., the secure execution environment), the security proxy service module and the security application module can improve security when providing security services to external business systems based on this encrypted content.

[0109] In an embodiment of the present application, operations that must be provided through a secure execution environment may include: signing operations involving private keys, encryption operations involving private keys, encryption / decryption operations involving symmetric keys, HMAC calculation operations, and other security operations that truly require the use of sensitive information.

[0110] Optionally, when the security proxy service module includes a security control sub-module and a security service sub-module, the security control sub-module can be used to call the security application module through the security service sub-module to perform the cryptographic service security operation corresponding to the cryptographic service call request when determining that the requested operation type is the second type, and obtain the operation result.

[0111] Based on the implementation method of S332 and the security protection mechanism provided by TrustZone technology, the security application module runs in a protected secure execution environment. Sensitive non-public information only exists in the secure execution environment. Operations involving non-public information can be processed in the secure execution environment protected by TrustZone. The security application module provides cryptographic services for the business system according to the calling process of the security proxy service module, thereby improving security.

[0112] In the above-described methods S31-S33, the cryptographic services provided by the cryptographic service device are implemented based on the TrustZone technology's unique normal execution environment and secure execution environment. This provides cryptographic services for information systems and business systems based on TrustZone technology, leveraging TrustZone's division of the normal world into the secure world and deploying a secure proxy service module and a secure application module in the normal execution environment and the secure execution environment, respectively. This eliminates the need for external independent hardware to provide cryptographic services, making them user-friendly and cost-effective. The aforementioned secure proxy service module verifies both the business system and requests initiated by the business system, enhancing security. Upon successful verification, the secure proxy service module can complete non-security-required cryptographic operations in the normal execution environment and can also proxy security-required cryptographic operations. The secure proxy service module then calls the secure application module to perform secure cryptographic service operations in the secure execution environment, further enhancing security. Since sensitive security operations are performed in the TrustZone-protected secure execution environment, while non-security-required operations are performed in the normal execution environment, access to the secure execution environment can be reduced while ensuring security, improving processing efficiency and facilitating user use.

[0113] Optionally, the step in which the security proxy service module invoking the security application module to execute the cryptographic service security operation corresponding to the cryptographic service call request and obtain the operation result in S332 may include: S3321-S3324.

[0114] S3321: The secure proxy service module provides the cryptographic service call request to the secure application module through the trusted transmission path formed by the client interface and internal interface provided by the secure execution environment.

[0115] S3322: When the security application module receives the cryptographic service call request, it authenticates the security proxy service module.

[0116] When the security application module receives a request from the security proxy service module, it can verify the security proxy service module by invoking security parameters and provide cryptographic services to the business system. If the TrustZone underlying platform already supports the verification mechanism, it only needs to follow its mechanism. If the TrustZone underlying platform supports an extension mechanism, it can use a code signing mechanism for identity authentication. When the security application module receives a request, it can verify the code signature of the requester (here, the requester can be the security proxy service module) according to the code signature verification mechanism.

[0117] S3323: When the security proxy service module passes the identity authentication, the security application module executes the cryptographic service security operation corresponding to the cryptographic service call request in the secure execution environment and obtains the operation result.

[0118] S3324: The security application module sends the operation result to the security proxy service module through the trusted transmission path, so that the security proxy service module can provide the operation result to the business system.

[0119] Optionally, the security proxy service module includes: a security control submodule and a security service submodule, and the security application module includes: a security storage module and a security calculation module.

[0120] When the security control submodule determines that the requested operation type is the second type, the security service submodule may provide the cryptographic service call request to the security operation module via a trusted transmission path formed by the client interface and internal interface provided by the secure execution environment. Upon receiving the cryptographic service call request, the security operation module may authenticate the security proxy service module using the security policy stored in the secure storage module. Upon successful authentication of the security proxy service module, the security operation module may access the non-public information stored in the secure storage module within the secure execution environment based on the cryptographic service call request and perform the cryptographic service security operation corresponding to the cryptographic service call request based on the non-public information, thereby obtaining an operation result. The security operation module may also transmit the operation result to the security service submodule via the trusted transmission path, so that the security service submodule can provide the operation result to the business system.

[0121] The data stored in the secure storage module primarily includes data involved in cryptographic operations or access control (such as the aforementioned non-public information), and may include but is not limited to cryptographic parameters, sensitive keys (private keys, symmetric keys), detailed security policy data, trust certificates, etc. Some of this data may be generated during initialization, while others may be generated by administrators through management and configuration operations such as data management, updates, and configuration.

[0122] Through the above-mentioned implementation methods of S3321-S3324, the security application module verifies the access to its own security proxy service module, and only accepts the calling process initiated by the verified module, provides cryptographic services to the requester based on the calling process, and transmits data based on the trusted transmission path between the normal execution environment and the secure execution environment of TrustZone, thereby improving security.

[0123] Optionally, before the above S31, the data processing method may further include: S30.

[0124] S30: Perform initialization operations through the security proxy service module, and store the data generated by the initialization into the secure execution environment through the security application module. The content of the initialization operation includes: generating a key pair, generating a master key, importing a digital certificate, configuring a security policy for identity authentication, importing a trusted certificate chain, and importing at least one of the code signatures.

[0125] The initialization process is performed under secure and reliable conditions. Sensitive key information, such as the generated key pair and master key, as well as imported content, can be used to participate in cryptographic operations or control access. The master key can be used to encrypt the aforementioned non-public information (e.g., a public-private key pair) in a secure execution environment (this encryption process is independent of the business system's request and is used to encrypt some or all sensitive information in the cryptographic service device). The master key can be a symmetric key.

[0126] The administrator generated by initialization can subsequently manage the cryptographic service device. The generated private key can be used for business signing operations, and the generated public key can be used to apply for a signing certificate, representing the identity of the cryptographic service device. The generated master key is used by the secure application module to encrypt internal data in the secure execution environment. The initialization process also sets the initial default security policy. The public and private keys in the key pair generated by initialization are primarily used for signing and verifying signatures in response to business system requests, and can also be used for encryption and decryption in response to business system requests.

[0127] Optionally, the initialization operation can be performed by the security management submodule in the security proxy service module, and the data generated by the initialization can be stored in the security storage module of the security application module. In the embodiment of the present application, the non-public information when the initialization is completed is only stored in the secure execution environment.

[0128] Through the above initialization, the initial security state of the cryptographic service device can be set to facilitate calling and use.

[0129] Among them, the secure storage module can be used to store important, sensitive, non-public information. Using the security mechanism of the secure world, various information involved in access control and secure computing operations (including private key data, symmetric encryption data, encryption master key, security authentication code key, and other keys) is encrypted and stored in the storage space of the secure storage module. When the secure computing module needs to use this data, the secure storage module reads the data from the actual storage address, and then uses the security mechanism of the TrustZone secure world to decrypt the acquired data and provide it to the user (the secure computing module or the requester who has agreed to use it). The secure computing module can call the secure storage module to obtain the non-public information required for the computing process, execute the corresponding cryptographic algorithm to obtain the computing result, and obtain the operation result based on this.

[0130] Optionally, in addition to processing the cryptographic service call request of the business system, the above data processing method may further include: S34.

[0131] S34: The security proxy service module responds to the administrator's management configuration operation and performs a key management operation, a certificate management operation, or a security policy configuration operation according to the type of the management configuration operation.

[0132] Optionally, the security management submodule within the security proxy service module can be responsible for certificate / key management, security policy configuration, and configuration information setup. This submodule can be used to generate, update, and destroy keys, generate and import certificate requests, add, delete, query, and modify security policies, and set and modify parameters required for the cryptographic service device's service operations.

[0133] Through this implementation, it is possible to provide key management, certificate management, security policy configuration and other management and configuration functions on the basis of providing reliable cryptographic services. It is understandable that those skilled in the art can adopt more module division methods to implement the aforementioned functions.

[0134] In an embodiment of the present application, the cryptographic service device may include multiple security agent service modules and multiple security application modules.

[0135] Each of the multiple security agent service modules is used to perform data interaction with at least one security application module.

[0136] Each of the plurality of security application modules is configured to provide cryptographic services for at least one security agent service module.

[0137] Based on the same inventive concept, Figure 4 As shown, the embodiment of the present application also provides a password service device, Figure 4 A functional module block diagram of a cryptographic service device provided in an embodiment of the present application.

[0138] like Figure 4 As shown, the device includes: a security application module 410 deployed in a secure execution environment (TEE), and a security proxy service module 420 deployed in a normal execution environment (REE). The secure execution environment and the normal execution environment are two operating environments provided based on TrustZone technology.

[0139] The security proxy service module 420 is used to receive a cryptographic service call request from a business system.

[0140] The security proxy service module 420 is also used to verify the business system and cryptographic service call requests.

[0141] The security proxy service module 420 is also used to execute the non-security requirement cryptographic operation corresponding to the cryptographic service call request according to the request operation type corresponding to the cryptographic service call request when determining that the business system and the cryptographic service call request have passed the verification, or to call the security application module 410 to execute the cryptographic service security operation corresponding to the cryptographic service call request to obtain the operation result.

[0142] The aforementioned method can be executed by the above-mentioned device. The cryptographic service provided by the cryptographic service device is implemented based on the normal execution environment and secure execution environment unique to TrustZone technology. It provides cryptographic services for information systems and business systems based on TrustZone technology, takes advantage of TrustZone's division of the normal world and the secure world, and deploys a security proxy service module 420 and a security application module 410 in the normal execution environment and the secure execution environment, respectively. There is no need to rely on external independent hardware to provide cryptographic services, which is convenient for users to use and has low usage costs. Among them, the security proxy service module 420 can be used to verify business systems and requests initiated by business systems to improve security. It can also be used to complete non-security-required cryptographic operations in the normal execution environment and proxy cryptographic operations with security requirements. Since sensitive security operations are performed in the secure execution environment protected by TrustZone, and non-security-required operations are performed in the normal execution environment, the number of accesses to the secure execution environment can be reduced while ensuring security, which can improve processing efficiency and facilitate user use.

[0143] Optionally, the security proxy service module 420 includes a security control submodule 421 and a security service submodule 422. The security service submodule 422 may be responsible for executing or acting as a proxy for cryptographic operations and for interacting with the security application module 410 in the secure world (secure execution environment) to implement cryptographic service functions such as encryption, decryption, signing, verification, hashing, and HMAC (security authentication code). Those skilled in the art may add other cryptographic service functions as needed and classify them so that the security control submodule 421 can distinguish whether it is necessary to call the security application module 410 to provide the corresponding cryptographic service based on the classification.

[0144] Optionally, upon determining that the requested operation type is a first type, the security control submodule 421 may call the security service submodule 422 to perform a non-security-required cryptographic operation corresponding to the cryptographic service call request, and obtain an operation result. The first type indicates that only local information and / or public information in a normal execution environment is required during the operation.

[0145] Optionally, upon determining that the requested operation type is the second type, the security control submodule 421 may be configured to invoke the security application module 410 via the security service submodule 422 to perform the cryptographic service security operation corresponding to the cryptographic service call request, thereby obtaining an operation result. The second type indicates a type of operation that requires the use of non-public information within a secure execution environment during the operation.

[0146] Optionally, the security application module 410 includes: a security storage module 411 and a security calculation module 412 .

[0147] The aforementioned security service submodule 422 can be used to provide the cryptographic service call request to the security operation module 412 through the trusted transmission path formed by the client interface and internal interface provided by the secure execution environment when the security control submodule 421 determines that the requested operation type is the second type.

[0148] The security operation module 412 may be configured to authenticate the security proxy service module 420 through the security policy stored in the security storage module 411 upon receiving a cryptographic service call request.

[0149] The security operation module 412 can also be used to: when the security proxy service module 420 passes the identity authentication, access the non-public information stored in the security storage module 411 according to the cryptographic service call request in the secure execution environment, and perform the cryptographic service security operation corresponding to the cryptographic service call request according to the non-public information to obtain the operation result.

[0150] The security operation module 412 may also be configured to send the operation result to the security service submodule 422 via a trusted transmission path, so that the security service submodule 422 can provide the operation result to the business system.

[0151] Optionally, the security proxy service module 420 can also be used to: perform initialization operations and store the data generated by the initialization into a secure execution environment through the security application module 410. The content of the initialization operation includes: generating a key pair, generating a master key, importing a digital certificate, configuring a security policy for identity authentication, importing a trusted certificate chain, and importing at least one of a code signature.

[0152] Optionally, the security control submodule 421 can be used to obtain a pre-configured security policy, and can also be used to authenticate the business system according to the security policy when receiving a password service call request, and to determine whether the password service call request is currently allowed to be processed according to the security policy.

[0153] Optionally, the cryptographic service device may further include: a secure calling interface 430 deployed in a common execution environment.

[0154] The secure call interface 430 is used to send the cryptographic service call request of the business system to the secure proxy service module 420, and is also used to send the operation result obtained by the secure proxy service module 420 according to the cryptographic service call request to the business system.

[0155] Optionally, the security agent service module 420 may further include: a security management submodule 423 .

[0156] The security management submodule 423 may be used to respond to the administrator's management configuration operation and perform a key management operation, a certificate management operation, or a security policy configuration operation according to the type of the management configuration operation.

[0157] For other details about the cryptographic service device of the embodiment of the present application, please refer to the relevant description of the cryptographic service system and / or data processing method mentioned above. The effects, implementation details, etc. of the same principles will not be repeated here.

[0158] Based on the same inventive concept, Figure 5 As shown, an embodiment of the present application further provides an electronic device having a TrustZone architecture, in which the aforementioned cryptographic service device is deployed, and the electronic device includes: a memory 501, a processor 502, and a communication bus 503. The communication bus 503 is used to implement direct or indirect connections between various components in the electronic device.

[0159] The electronic device has a computing and processing capability and can be a desktop device such as a server or a computer, or a mobile terminal. The electronic device can be any device having an ARM processor and a TrustZone architecture, and deployed with the aforementioned cryptographic service device.

[0160] The memory 501 is a storage medium, the processor 502 has arithmetic processing capabilities, and a computer program is stored in the memory 501. When the computer program is executed by the processor 502, the aforementioned method is implemented.

[0161] I understand. Figure 5 The structure shown is for illustration only. In actual application, the electronic device may include Figure 5 The structure shown in the figure may include more components, for example, a display for operating an interface or displaying some data provided to the user for viewing, or the electronic device may have Figure 5 Different component configurations are shown.

[0162] In summary, the data processing method, cryptographic service device, and electronic device provided in the embodiments of the present application perform truly secure operations in a secure execution environment protected by TrustZone, thereby improving security. Furthermore, cryptographic services can be provided to business systems without the need for additional hardware modules, fully utilizing the existing native technologies of electronic devices and reducing the cost of using cryptographic services. Among them, non-secure operations are all performed in a normal execution environment, reducing the number of accesses to the secure execution environment, and improving computing efficiency while maintaining security. Furthermore, upon receiving an access call from a business system, the normal execution environment performs security policy verification on the business system's request, thereby improving the security of the cryptographic application. The secure execution environment authenticates the security proxy service module 420, thereby enhancing the protection of sensitive information and improving the security of the cryptographic service device itself.

[0163] In the embodiments provided herein, it should be understood that the disclosed devices and methods may be implemented in other ways. The device embodiments described above are merely illustrative. For example, the module division is merely a logical functional division, and actual implementation may employ other division methods. The connections discussed may be through some communication interface, indirect coupling or communication connection between devices or units, and may be electrical, mechanical, or other forms.

[0164] In addition, the units described as separate components may or may not be physically separate and may be located in one place or distributed across multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of this embodiment.

[0165] Furthermore, the functional modules in each embodiment of the present application can be integrated together to form an independent part, or each module can exist independently, or two or more modules can be integrated to form an independent part.

[0166] It should be noted that if the functions of the cryptographic service device are implemented in the form of a software function module and sold or used as an independent product, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, or the part that contributes to the prior art, or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes a number of instructions for causing a computer device to execute all or part of the steps of the various embodiments of the method of this application.

[0167] In this document, relational terms such as first and second, etc. are used merely to distinguish one entity or operation from another entity or operation, but do not necessarily require or imply any actual relationship or order between these entities or operations.

[0168] The above are merely examples of the present application and are not intended to limit the scope of protection of the present application. Those skilled in the art will appreciate that various modifications and variations are possible. Any modifications, equivalent substitutions, or improvements made within the spirit and principles of the present application shall be included within the scope of protection of the present application.

Claims

1. A data processing method, characterized in that: A cryptographic service device is applied to a cryptographic service system, wherein the operating environment of the cryptographic service system includes: a normal execution environment and a secure execution environment based on TrustZone technology; the cryptographic service device includes: a security application module deployed in the secure execution environment, and a security proxy service module deployed in the normal execution environment; and the method includes: The security proxy service module receives a password service call request from the business system; The security proxy service module verifies the business system and the cryptographic service call request; When the security proxy service module determines that the business system and the cryptographic service call request have passed verification, the security proxy service module executes the non-security-required cryptographic operation corresponding to the cryptographic service call request or calls the security application module to execute the cryptographic service security operation corresponding to the cryptographic service call request, and obtains an operation result according to the request operation type corresponding to the cryptographic service call request; The step of performing, according to the request operation type corresponding to the cryptographic service call request, a non-security-required cryptographic operation corresponding to the cryptographic service call request or calling the security application module to perform the cryptographic service security operation corresponding to the cryptographic service call request, and obtaining an operation result includes: When determining that the requested operation type is a first type, the security proxy service module performs the non-security-required cryptographic operation corresponding to the cryptographic service call request to obtain an operation result; the first type indicates a type that only requires the use of local information and / or public information in the common execution environment during the operation; When it is determined that the requested operation type is the second type, the security proxy service module calls the security application module to perform the cryptographic service security operation corresponding to the cryptographic service call request to obtain an operation result; the second type indicates the type of non-public information that needs to be used in the secure execution environment during the operation.

2. The method according to claim 1, characterized in that The security proxy service module calls the security application module to perform the cryptographic service security operation corresponding to the cryptographic service call request, and obtains the operation result, including: The secure proxy service module provides the cryptographic service call request to the secure application module through a trusted transmission path formed by a client interface and an internal interface provided by the secure execution environment; The security application module performs identity authentication on the security proxy service module when receiving the cryptographic service call request; When the security proxy service module passes the identity authentication, the security application module performs the cryptographic service security operation corresponding to the cryptographic service call request in the secure execution environment to obtain the operation result; The security application module sends the operation result to the security agent service module through the trusted transmission path, so that the security agent service module provides the operation result to the business system.

3. The method according to claim 1, characterized in that The non-public information includes: security policies and security parameters encrypted by the security mechanism of the secure execution environment, the security policy is used to be provided to the security proxy service module so that the security proxy service module can verify the business system and the cryptographic service call request according to the security policy, and the security parameters are used to be provided to the security application module so that the security application module can verify the security proxy service module according to the security parameters, or perform cryptographic service security operations according to the security parameters and the cryptographic service call request.

4. The method according to claim 1, wherein Before the security proxy service module receives the cryptographic service call request from the business system, the method further includes: The initialization operation is performed through the security proxy service module, and the data generated by the initialization is stored in the secure execution environment through the security application module. The content of the initialization operation includes: generating a key pair, generating a master key, importing a digital certificate, configuring a security policy for identity authentication, importing a trusted certificate chain, and importing at least one of a code signature.

5. The method according to claim 1, wherein The security proxy service module verifies the business system and the cryptographic service call request, including: The security proxy service module obtains a pre-configured security policy; When receiving the password service call request, the security proxy service module authenticates the business system according to the security policy, and determines whether the password service call request is currently allowed to be processed according to the security policy.

6. The method according to claim 1, characterized in that The cryptographic service device further comprises: a secure call interface deployed in the common execution environment; The secure proxy service module receives a cryptographic service call request from a business system, comprising: the secure proxy service module receives the cryptographic service call request sent by the business system by calling the secure call interface; After the security proxy service module obtains the operation result, the method further includes: sending the operation result to the business system through the security call interface.

7. The method according to claim 1, characterized in that The method further comprises: The security agent service module responds to the administrator's management configuration operation and performs a key management operation, a certificate management operation, or a security policy configuration operation according to the type of the management configuration operation.

8. The method according to any one of claims 1 to 7, characterized in that The cryptographic service device includes a plurality of security proxy service modules and a plurality of security application modules; Each of the multiple security agent service modules is used to perform data interaction with at least one security application module, and each of the multiple security application modules is used to provide cryptographic services for at least one security agent service module.

9. A cryptographic service device, characterized in that: include: A secure application module deployed in a secure execution environment, and a secure proxy service module deployed in a normal execution environment, wherein the secure execution environment and the normal execution environment are two operating environments provided based on TrustZone technology; The security proxy service module is used to receive a cryptographic service call request from a business system; The security proxy service module is further used to verify the business system and the cryptographic service call request; The security proxy service module is further configured to, upon determining that the business system and the cryptographic service call request have passed verification, execute the non-security-required cryptographic operation corresponding to the cryptographic service call request according to the request operation type corresponding to the cryptographic service call request, or to call the security application module to execute the cryptographic service security operation corresponding to the cryptographic service call request, and obtain an operation result; The security proxy service module is specifically used to, when determining that the requested operation type is the first type, execute the non-security-required cryptographic operation corresponding to the cryptographic service call request to obtain an operation result; the first type indicates that only local information and / or public information in the ordinary execution environment needs to be used during the operation; when determining that the requested operation type is the second type, the security proxy service module calls the security application module to execute the cryptographic service security operation corresponding to the cryptographic service call request to obtain an operation result; the second type indicates that non-public information in the secure execution environment needs to be used during the operation.

10. An electronic device, characterized in that: The electronic device has a TrustZone architecture, a cryptographic service device is deployed in the electronic device, and the electronic device includes: a memory and a processor; The memory stores a computer program executable by the processor, and when the computer program is executed by the processor, the method according to any one of claims 1 to 7 is implemented.

Images