A data processing method and device, electronic equipment and storage medium

Abstract

Embodiments of the present application provide a data processing method and device, electronic equipment and storage medium, the method comprising: creating a first process containing a first name and a first password; when the first process is running, writing the first name and the first password to the TCM through the driver of the TCM; when it is necessary to store or read the CA certificate or key associated with the embedded device in the TCM, verifying a second name and a second password provided by a second process; in the case of successful verification, determining a first entry number related to the CA certificate or key; storing the CA certificate or key in the TCM based on the first entry number, or obtaining a second entry number provided by the second process, and reading the CA certificate or key in the TCM based on the second entry number; wherein the first process and the second process are the same or different.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of data security, and in particular to a data processing method and device, electronic equipment and storage medium. BACKGROUND

[0002] In the field of intelligent devices of power systems, the problem of secure storage of CA (Certification Authority) root certificates and private keys is often faced. The current common solution is to store them in the file system and to perform security isolation through user permissions of the operating system. This solution cannot fundamentally guarantee security. SUMMARY

[0003] Therefore, the main purpose of the present application is to provide a data processing method and device, electronic equipment and storage medium, which can at least partially solve the above problems.

[0004] To achieve the above purpose, the technical scheme of the present application is as follows:

[0005] In a first aspect, the present application provides a data processing method applied to an embedded device with a TCM (Trusted Cryptography Module), and the method comprises the following steps:

[0006] creating a first process containing a first name and a first password; and writing the first name and the first password into the TCM through a driver of the TCM when the first process is running;

[0007] verifying a second name and a second password provided by a second process when it is necessary to store or read a CA (Certification Authority) certificate or a key associated with the embedded device in the TCM;

[0008] determining a first entry number related to the CA certificate or the key in the case of successful verification; storing the CA certificate or the key in the TCM based on the first entry number, or obtaining a second entry number provided by the second process and reading the CA certificate or the key in the TCM based on the second entry number; wherein the first process is the same as or different from the second process.

[0009] In the above scheme, in the case that the first name is a first string and the first password is a second string, the step of writing the first name and the first password into the TCM through the driver of the TCM when the first process is running comprises:

[0010] calling a write interface function to write the first string and the second string into the driver of the TCM when the first process is running.

[0011] running a driver of the TCM, converting the first string and the second string into first physical data and second physical data respectively; and writing the first physical data and the second physical data into the TCM through a physical bus.

[0012] In the above scheme, the verifying the second name and the second password provided by the second process comprises:

[0013] running the second process, and writing the second name and the second password provided by the second process into a driver of the TCM;

[0014] running a driver of the TCM, obtaining the first name and the first password stored in the TCM; comparing the first name with the second name and comparing the first password with the second password to obtain a comparison result; and obtaining a verification result based on the comparison result;

[0015] In the above scheme, in a case where the comparison result is that the first name is consistent with the second name and the first password is consistent with the second password, the verification result is verification success; and in a case where the comparison result is that the first name is inconsistent with the second name or the first password is inconsistent with the second password, the verification result is verification failure.

[0016] In the above scheme, the determining the first entry number related to the CA certificate or key comprises:

[0017] obtaining a random magic number; determining a number related to the CA certificate or key, a type of the CA certificate or key, and a data length;

[0018] forming the random magic number, the number, the type, and the data length into the first entry number according to a set format;

[0019] In the above scheme, the number related to the CA certificate or key is a number assigned to the CA certificate or key, and is used to represent that the CA certificate or key is the certificate or key managed by the first process.

[0020] In the above scheme, the storing the CA certificate or key in the TCM based on the first entry number comprises:

[0021] calling the write interface function to write the first entry number and the CA certificate or key into a driver of the TCM;

[0022] running a driver of the TCM, determining an association relationship between the first entry number and the CA certificate or key; and writing the association relationship into the TCM.

[0023] In the above scheme, the reading the CA certificate or the key in the TCM based on the second entry number comprises:

[0024] calling the write interface function to write the second entry number into the driver of the TCM;

[0025] running the driver of the TCM, searching the TCM based on the second entry number, and obtaining a search result; determining the reading result of the second process based on the search result.

[0026] In the above scheme, the determining the reading result of the second process based on the search result comprises:

[0027] in the case that the search result is that the CA certificate or the key corresponding to the second entry number is searched in the TCM, determining that the reading result of the second process is reading success; after the reading success, obtaining the CA certificate or the key corresponding to the second entry number, and returning the CA certificate or the key corresponding to the second entry number to the second process;

[0028] in the case that the search result is that the CA certificate or the key corresponding to the second entry number is not searched in the TCM, determining that the reading result of the second process is reading failure, and returning an error prompt after the reading failure.

[0029] In a second aspect, the embodiments of the present application further provide a data processing device applied to an embedded device with a trusted cryptographic module (TCM), the device comprising a creating module, a writing module, a verifying module and a storage / reading module, wherein:

[0030] the creating module is configured to create a first process comprising a first name and a first password;

[0031] the writing module is configured to write the first name and the first password into the TCM through the driver of the TCM when the first process is running;

[0032] the verifying module is configured to verify a second name and a second password provided by a second process when it is necessary to store or read a CA certificate or a key associated with the embedded device in the TCM;

[0033] the storage / reading module is configured to determine a first entry number related to the CA certificate or the key in the case of verification success; store the CA certificate or the key in the TCM based on the first entry number, or obtain a second entry number provided by the second process, and read the CA certificate or the key in the TCM based on the second entry number; wherein the first process is the same as or different from the second process.

[0034] In the above scheme, the writing module is specifically configured to: in the case that the first name is a first string and the first password is a second string, write the first string and the second string into the driver program of the TCM by calling a writing interface function when the first process is running.

[0035] The driver program of the TCM is run to convert the first string and the second string into first physical data and second physical data respectively, and the first physical data and the second physical data are written into the TCM through a physical bus.

[0036] In the above scheme, the verification module is specifically configured to: run the second process, and write the second name and the second password provided by the second process into the driver program of the TCM.

[0037] The driver program of the TCM is run to obtain the first name and the first password stored in the TCM, compare the first name and the second name, and compare the first password and the second password to obtain a comparison result, and obtain a verification result based on the comparison result.

[0038] In the case that the comparison result is that the first name is consistent with the second name and the first password is consistent with the second password, the verification result is verification success; in the case that the comparison result is that the first name is inconsistent with the second name or the first password is inconsistent with the second password, the verification result is verification failure.

[0039] In the above scheme, the storage / reading module is specifically configured to: obtain a random magic number; determine a number related to the CA certificate or key, a type of the CA certificate or key, and a data length.

[0040] The random magic number, the number, the type, and the data length are formed into the first entry number according to a set format.

[0041] The number related to the CA certificate or key is a number assigned to the CA certificate or key, and is used to represent that the CA certificate or key is the certificate or key managed by the first process.

[0042] In the above scheme, the storage / reading module is further configured to: write the first entry number and the CA certificate or key into the driver program of the TCM by calling the writing interface function.

[0043] The driver program of the TCM is run to determine an association relationship between the first entry number and the CA certificate or key, and the association relationship is written into the TCM.

[0044] In the above scheme, the storage / reading module is further configured to invoke the write interface function to write the second entry number to a driver of the TCM.

[0045] The driver of the TCM is run to search the TCM based on the second entry number, and a search result is obtained; and the reading result of the second process is determined based on the search result.

[0046] In the above scheme, the storage / reading module is further configured to, in a case where the search result is that the TCM searches the CA certificate or the key corresponding to the second entry number, determine that the reading result of the second process is reading success; and after reading success, obtain the CA certificate or the key corresponding to the second entry number, and return the CA certificate or the key corresponding to the second entry number to the second process.

[0047] In a case where the search result is that the TCM does not search the CA certificate or the key corresponding to the second entry number, determine that the reading result of the second process is reading failure, and after reading failure, return an error prompt.

[0048] In a third aspect, an embodiment of the present application further provides a computer readable storage medium, which stores a computer program, and the computer program is executed by a processor to implement steps of the method in any of the preceding aspects.

[0049] In a fourth aspect, an embodiment of the present application further provides an electronic device, which comprises a processor and a memory for storing a computer program capable of running on the processor, wherein the processor is configured to run the computer program to implement steps of the method in any of the preceding aspects.

[0050] The embodiment of the present application provides a data processing method, device, electronic equipment and storage medium, wherein the method comprises the following steps: creating a first process containing a first name and a first password; when the first process runs, writing the first name and the first password into the TCM through the driver of the TCM; when it is needed to store or read the CA certificate or key associated with the embedded device in the TCM, verifying a second name and a second password provided by a second process; in the case of successful verification, determining a first entry number related to the CA certificate or key; based on the first entry number, storing the CA certificate or key in the TCM, or based on a second entry number provided by the second process, reading the CA certificate or key in the TCM; wherein the first process is the same as or different from the second process. The method and device provided by the present application create a process with a user name and a password, and write the user name and the password into the TCM chip through the process running. When the CA certificate or key of a certain embedded device is stored or read in the TCM chip, the user name and the password provided by the process are verified first, and then the CA certificate or key of a certain embedded device is stored or read based on the entry number provided by the process. In this way, the permission granularity is refined, the problem that the traditional embedded device can only rely on the user permission of the operating system to access the certificate or key is solved, and the problem of safe storage of the certificate and the key is solved. BRIEF DESCRIPTION OF DRAWINGS

[0051] Figure 1 A flowchart of a data processing method provided by the embodiment of the present application is shown;

[0052] Figure 2 A process diagram of writing the CA certificate or key into the TCM provided by the embodiment of the present application is shown;

[0053] Figure 3 A process diagram of reading the CA certificate or key in the TCM provided by the embodiment of the present application is shown;

[0054] Figure 4 A structure diagram of the entry number provided by the embodiment of the present application is shown;

[0055] Figure 5 A working principle structure diagram provided by the embodiment of the present application is shown;

[0056] Figure 6 A structure diagram of a data processing device provided by the embodiment of the present application is shown;

[0057] Figure 7 A hardware structure diagram of an electronic equipment provided by the embodiment of the present application is shown. DETAILED DESCRIPTION

[0058] Various embodiments of the present application are described in more detail below. Embodiments can be configured or arranged differently to form other embodiments that are variations of any disclosed embodiment. Therefore, the present application is not limited to the embodiments set forth in this document. Rather, the described embodiments are provided so that the present application will be thorough and complete, and will fully convey the scope of the application to those skilled in the art. It should be noted that references to "an embodiment," "another embodiment," etc. do not necessarily mean the same embodiment, and different references to "an embodiment" do not necessarily refer to the same embodiment. It is to be understood that the terms "first," "second," "third," and the like can be used herein to describe various elements, but these elements should not be limited by these terms. These terms are used to distinguish one element from another. Thus, a first element could also be termed a second or third element in another embodiment, without departing from the spirit and scope of the present application.

[0059] The drawings are not necessarily to scale and, in some instances, proportions can have been exaggerated in order to clearly convey the concepts of the embodiments. When an element or layer is referred to as being "on" or "connected to" another element or layer, it can be directly on or connected to the other element or layer or intervening elements or layers can be present. In contrast, when an element is referred to as being "directly on" or "directly connected to" another element, there are no intervening elements or layers present.

[0060] The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the present application. As used herein, the singular forms "a", "an" and "the" are intended to include the plural forms as well, unless the context clearly indicates otherwise. The terms "comprises", "comprising", "includes", "including" and "contains" used herein can be, unless otherwise defined, used in the sense that the term "comprises" means specifying the presence of stated features, integers, steps or components but does not preclude the presence or addition of one or more other features, integers, steps, components or groups thereof. The term "and / or", used herein includes any and all combinations of one or more of the associated listed items. Unless otherwise defined, all terms used herein including technical and scientific terms have the same meaning as commonly understood by one of ordinary skill in the art to which this application pertains in view of the present disclosure. It will be further understood that terms, such as those defined in commonly used dictionaries, should be interpreted as having a meaning that is consistent with their meaning in the context of the specification and relevant art and should not be interpreted in an overly formal or overly literal sense.

[0061] In the following description, numerous specific details are set forth to provide a thorough understanding of the invention, which can be practiced without some or all of these specific details. In other instances, well-known processing structures and / or processes have not been described in detail so as not to unnecessarily obscure the invention. It should also be understood that, in some cases, unless otherwise specifically apparent to those skilled in the art, a feature or element described with respect to one embodiment may be used alone or in combination with other features or elements of another embodiment. Various embodiments of the invention are described in detail below with reference to the accompanying drawings. The following description focuses on detail to facilitate understanding of embodiments of the invention. Well-known technical details may have been omitted so as not to obscure the features and aspects of the invention.

[0062] The present invention will now be described in further detail with reference to the accompanying drawings and specific embodiments.

[0063] like Figure 1 As shown, it illustrates a flowchart of a data processing method provided by an embodiment of the present invention. Figure 1 In this context, the method is applied to an embedded device with a TCM, and the specific steps include:

[0064] S101: Create a first process containing a first name and a first password;

[0065] S102: When the first process is running, the first name and the first password are written into the TCM through the driver of the TCM;

[0066] S103: When it is necessary to store or read the CA certificate or key associated with the embedded device in the TCM, verify the second name and second password provided by the second process;

[0067] S104: If the verification is successful, determine the first entry number associated with the CA certificate or key; store the CA certificate or key in the TCM based on the first entry number, or obtain the second entry number provided by the second process, and read the CA certificate or key in the TCM based on the second entry number; wherein the first process and the second process may be the same or different.

[0068] It should be noted that the operating system running in the embedded device can be a Linux operating system, and the TCM driver can be implemented by a standard Linux kernel module, which is an interface for reading and writing between a process and a TCM chip, and a direct interaction object of the process, that is, the TCM driver can be a bridge for communication between the process and the TCM chip. The process can be a running activity of a program on a certain data set in a computer, and is a basic unit of resource allocation and scheduling of an operating system, and is the basis of operating system structure. The process is an entity of a program, and is a dynamic concept, that is, it is an active entity. The first process can be any process created in the embedded device, which includes a first name and a first password, which are equivalent to the private identification of the first process itself, and can also be called the username and password of the first process.

[0069] When the first process runs, the first process writes the first name and the first password to the TCM through the driver of the TCM. Specifically, in some embodiments, when the first name is a first string and the first password is a second string, for S102, it can include:

[0070] The first name and the first password are written to the TCM through the driver of the TCM, including:

[0071] When the first process runs, a write interface function is called to write the first string and the second string to the driver of the TCM.

[0072] The driver of the TCM is run to convert the first string and the second string into first physical data and second physical data respectively, and the first physical data and the second physical data are written to the TCM through a physical bus.

[0073] It should be noted that the write interface function can be a write function, which is a C language function, and can have two structures. One is: ssize_t write(int fd, const void*buf, size_t nbyte), where fd can be a file descriptor; buf can be a specified buffer, i.e., a pointer, pointing to a memory unit; nbyte can be the specified number of bytes to be written to the file; the return value of this type of write function is the number of bytes written to the file when the write is successful; and when the write fails, -1 is output. The other is: write(const char*str, int n), where str is a character pointer or character array used to store a string; n is an int type number indicating the number of characters in the output display string, for example, write("string", strlen("string") indicates outputting the string constant.

[0074] Herein, when the first process is running, the operating system in the embedded device can call the aforementioned write function to write the first string contained in the first process and the second string to the driver of the TCM, and then when the driver of the TCM is running, the driver of the TCM converts the first string and the second string into first physical data and second physical data, respectively. Since the first process and the driver of the TCM can be recognized, but the TCM chip cannot be recognized, when the driver of the TCM is running, the first string and the second string need to be converted into first physical data and second physical data that can be recognized by the TCM chip, and then the first physical data and the second physical data are transmitted to the TCM chip through a physical bus. The physical bus can be a serial peripheral interface (SPI) bus, or other available physical buses.

[0075] Thereafter, if there is a need to store or read the CA certificate or key of the embedded device in the TCM chip, the name and password provided by the process need to be verified first, and when the verification is successful, storage or reading is performed. In actual application, for S103, it can include:

[0076] Running the second process, and writing the second name and the second password provided by the second process to the driver of the TCM;

[0077] running a driver of the TCM to obtain the first name and the first password stored in the TCM; comparing the first name with the second name and comparing the first password with the second password to obtain a comparison result; and obtaining a verification result based on the comparison result;

[0078] In a case where the comparison result is that the first name is consistent with the second name and the first password is consistent with the second password, the verification result is verification success; and in a case where the comparison result is that the first name is not consistent with the second name or the first password is not consistent with the second password, the verification result is verification failure.

[0079] It should be noted that the process described herein is a process of verifying a name and a password, and the second process is only used for convenience to describe a noun with the same meaning in different processes, and is not used to limit the present application. Specifically, when the second process is running, the second name and the second password provided are written into the driver of the TCM, and then the driver of the TCM is run. In the process of running the driver, the first name and the first password stored in the TCM are obtained; the first name is compared with the second name, and the first password is compared with the second password to obtain a comparison result; and a verification result is obtained based on the comparison result. Only in a case where the first password is consistent with the second password and the first name is consistent with the second name, the verification is successful; otherwise, the verification is failed.

[0080] In a case where the verification is successful, a storage or reading operation is performed; and in a case where the verification is failed, subsequent access is refused.

[0081] In actual application, in a case where the verification is successful, determining the first entry number related to the CA certificate or key in S104 can include:

[0082] obtaining a random magic number; determining a number related to the CA certificate or key, a type of the CA certificate or key, and a data length;

[0083] forming the first entry number according to the random magic number, the number, the type, and the data length in a set format;

[0084] The number related to the CA certificate or key is a number assigned to the CA certificate or key, and is used to represent that the CA certificate or key is the first certificate or key managed by the first process.

[0085] It should be noted that, in C language, the magic number can be a constant directly used, that is, a constant, and the random magic number referred to herein is a random constant, that is, a random number. The number can refer to the number of the first process managed certificate or key. One process can manage multiple CA root certificates and multiple private keys (that is, keys), and each management is assigned a number for the CA root certificate and the key, and the number can be sequentially increased, such as 1, 2, 3, and the like. It should be understood that each CA certificate or key has its own category, which is its type; each CA certificate or key has a certain length. That is, the first entry number can be composed of a random magic number, the number, the type, and the data length according to a set format.

[0086] For example, as shown in Figure 2 , a structure diagram of an entry number composed according to a set format provided by an embodiment of the application is shown. In Figure 2 , one entry number occupies 32 bits (bit), wherein the random magic number occupies 8 bits; the number occupies 4 bits; the type of the CA certificate or key occupies 4 bits; and the data length of the CA certificate or key occupies 16 bits. Specifically, the random magic number can occupy bits 24 to 31 of the entry number, that is, 24 bits to 31 bits; the number occupies bits 20 to 23 of the entry number, that is, 20 bits to 23 bits; the type of the CA certificate or key can occupy bits 16 to 19 of the entry number, that is, 16 bits to 19 bits; and the data length of the CA certificate or key can occupy bits 0 to 15 of the entry number, that is, 0 bits to 15 bits.

[0087] In some embodiments, the random magic number can be an 8-bit character selected by the second process; the number and the type of the CA certificate or key can be a number between 0 and 15; and the data length can be the actual length of the CA certificate or key.

[0088] After obtaining the first entry number, in some embodiments, the storing of the CA certificate or key in the TCM based on the first entry number comprises:

[0089] calling the write interface function to write the first entry number and the CA certificate or key into the driver program of the TCM;

[0090] running the driver program of the TCM to determine the association relationship of the first entry number and the CA certificate or key; and writing the association relationship into the TCM.

[0091] It should be noted that the second process writes the first entry number into the driver of the TCM through the write interface function, and the driver of the TCM determines the association between the first entry number and the CA certificate or key to be stored, and then writes the association into the TCM chip.

[0092] Specifically, the process of storing the CA certificate or key is as shown in the following table: Figure 3 Figure 3 In the table, the specific process of storing the CA certificate or key is as follows:

[0093] S301: Obtain the second name and the second password provided by the second process;

[0094] S302: When the second process is running, call the write function to write the second name and the second password into the driver of the TCM;

[0095] S303: Run the driver of the TCM to verify the second name and the second password provided by the second process;

[0096] S304: When the verification is successful, determine the first entry number related to the CA certificate or key; call the write function to write the first entry number and the CA certificate or key into the driver of the TCM;

[0097] S305: Run the driver of the TCM to determine the association between the first entry number and the CA certificate or key; and write the association into the TCM through the physical bus.

[0098] In some embodiments, when it is necessary to read the CA certificate or key stored in the TCM, it is necessary to first obtain the second entry number from the second process, and then read the CA certificate or key in the TCM based on the second entry number.

[0099] For the reading of the CA certificate or key in the TCM based on the second entry number, the following can be included:

[0100] Call the write interface function to write the second entry number into the driver of the TCM;

[0101] Run the driver of the TCM to search the TCM based on the second entry number, obtain a search result, and determine a reading result of the second process based on the search result.

[0102] In some embodiments, the determination of the reading result of the second process based on the search result includes:

[0103] ​In a case that the search result is that the TCM searches the CA certificate or the key corresponding to the second entry number, it is determined that the reading result of the second process is reading success; after the reading success, the CA certificate or the key corresponding to the second entry number is obtained, and the CA certificate or the key corresponding to the second entry number is returned to the second process;

[0104] In a case that the search result is that the TCM does not search the CA certificate or the key corresponding to the second entry number, it is determined that the reading result of the second process is reading failure, and after the reading failure, an error prompt is returned.

[0105] It should be noted that the foregoing process is a process of reading the CA certificate or the key, and the second process needs to provide an entry number, i.e., a second entry number, required for searching. The CA certificate or the key is read based on the second entry number. It should be understood that the CA certificate or the key corresponding to the second entry number is stored in the TCM and can be searched; if not, it cannot be searched. After the search, the searched CA certificate or key is returned. In a case that the search is not successful, an error prompt is returned. The error prompt can be in any form, such as text information or a number indicating that the search is not successful.

[0106] Specifically, the process of reading the CA certificate or the key is as shown in Figure 4 , and a specific process of reading the CA certificate or the key is as follows. Figure 4

[0107] S401: Obtain a second name and a second password provided by a second process;

[0108] S402: When the second process runs, a write function is called to write the second name and the second password into a driver of the TCM;

[0109] S403: Run the driver of the TCM to verify the second name and the second password provided by the second process;

[0110] S404: When the verification is successful, obtain a second entry number provided by the second process;

[0111] S405: Call the write interface function to write the second entry number into the driver of the TCM;

[0112] S406: Run the driver of the TCM to search the TCM based on the second entry number, obtain a search result, and determine a reading result of the second process based on the search result;

[0113] ​If the search result is that the TCM searches for the CA certificate or the key corresponding to the second entry number, it is determined that the reading result of the second process is reading success; after reading success, the CA certificate or the key corresponding to the second entry number is obtained, and the CA certificate or the key corresponding to the second entry number is returned to the second process; if the search result is that the TCM does not search for the CA certificate or the key corresponding to the second entry number, it is determined that the reading result of the second process is reading failure, and an error prompt is returned after reading failure.

[0114] The nouns appearing herein have been described in detail in the foregoing, and will not be described again here.

[0115] Based on the foregoing description, the data processing method provided by the embodiment of the application has the specific principle structure as shown in the figure Figure 5 The process is taken as an access permission unit, the CA certificate or the key is stored by using the hardware TCM chip, the first security credential is realized through the name and the password verification of the process, the second security guarantee is realized through the entry number storage or search reading, the management granularity is refined, and the storage of the TCM chip hardware avoids the possibility that the CA certificate or the key is lost due to damage of an operating system.

[0116] Based on the foregoing inventive concept, the embodiment of the application further provides a data processing device, as shown in the figure Figure 6 The figure shows the structure schematic diagram of the data processing device provided by the embodiment of the application. In the figure Figure 6 The data processing device 60 can be applied to an embedded device with a trusted cryptographic module TCM, and specifically includes a creating module 601, a writing module 602, a verifying module 603 and a storing / reading module 604, wherein

[0117] The creating module 601 is configured to create a first process containing a first name and a first password.

[0118] The writing module 602 is configured to write the first name and the first password into the TCM through a driver of the TCM when the first process runs.

[0119] The verifying module 603 is configured to verify a second name and a second password provided by a second process when it is necessary to store or read a CA certificate or a key associated with the embedded device in the TCM.

[0120] The storage / reading module 604 is configured to, in the case of successful verification, determine a first entry number related to the CA certificate or key, store the CA certificate or key in the TCM based on the first entry number, or obtain a second entry number provided by the second process, and read the CA certificate or key in the TCM based on the second entry number; the first process and the second process are the same or different.

[0121] In some embodiments, the writing module is specifically configured to, in the case that the first name is a first string and the first password is a second string, write the first string and the second string into a driver of the TCM by calling a writing interface function when the first process is running.

[0122] The driver of the TCM is run to convert the first string and the second string into first physical data and second physical data respectively, and the first physical data and the second physical data are written into the TCM through a physical bus.

[0123] In some embodiments, the verification module is specifically configured to run the second process, and write the second name and the second password provided by the second process into the driver of the TCM.

[0124] The driver of the TCM is run to obtain the first name and the first password stored in the TCM, compare the first name and the second name, and compare the first password and the second password to obtain a comparison result, and obtain a verification result based on the comparison result.

[0125] In the case that the comparison result is that the first name is consistent with the second name and the first password is consistent with the second password, the verification result is successful verification; in the case that the comparison result is that the first name is inconsistent with the second name or the first password is inconsistent with the second password, the verification result is failed verification.

[0126] In some embodiments, the storage / reading module is specifically configured to obtain a random magic number, determine a number related to the CA certificate or key, a type of the CA certificate or key, and a data length.

[0127] The random magic number, the number, the type, and the data length are formed into the first entry number according to a set format.

[0128] The number related to the CA certificate or key is a number assigned to the CA certificate or key, and is used to represent that the CA certificate or key is the certificate or key managed by the first process.

[0129] In some embodiments, the storage / reading module is further configured to invoke the write interface function to write the first entry number and the CA certificate or key to a driver of the TCM.

[0130] The driver of the TCM is run to determine the association between the first entry number and the CA certificate or key, and the association is written to the TCM.

[0131] In some embodiments, the storage / reading module is further configured to invoke the write interface function to write the second entry number to the driver of the TCM.

[0132] The driver of the TCM is run to search the TCM based on the second entry number to obtain a search result, and the reading result of the second process is determined based on the search result.

[0133] In the above scheme, the storage / reading module is further configured to, in a case where the search result is that the TCM searches for the CA certificate or key corresponding to the second entry number, determine that the reading result of the second process is reading success, and after reading success, obtain the CA certificate or key corresponding to the second entry number and return the CA certificate or key corresponding to the second entry number to the second process.

[0134] In a case where the search result is that the TCM does not search for the CA certificate or key corresponding to the second entry number, it is determined that the reading result of the second process is reading failure, and after reading failure, an error prompt is returned.

[0135] The data processing apparatus provided by the embodiments of the present application and the data processing method provided above belong to the same inventive concept, and the terms appearing here have been explained in detail above and will not be repeated here.

[0136] The embodiments of the present application further provide a computer readable storage medium having a computer program stored thereon, wherein the computer program is executed by a processor to implement the steps of the above method embodiments, and the storage medium includes various storage media capable of storing program codes, such as mobile storage devices, read-only memories (ROMs), random access memories (RAMs), magnetic discs or optical discs.

[0137] The embodiments of the present application further provide an electronic device, which includes a processor and a memory for storing a computer program capable of running on the processor, wherein the processor is configured to execute the computer program to perform the steps of the above method embodiments stored in the memory.

[0138] Figure 7 A hardware structure schematic diagram of an electronic device provided by an embodiment of the present application is shown in FIG. 7. The electronic device 70 includes at least one processor 701, a memory 702, and optionally, at least one communication interface 703. The various components in the electronic device 70 are coupled together by a bus system 704, which can be understood as a communication path that is used to enable communication between the components. The bus system 704 can include a data bus, a power bus, a control bus, and a state signal bus. However, for the sake of clarity, only the bus system 704 is shown in FIG. 7. Figure 7 The various buses in the bus system 704 are collectively referred to as the bus system 704.

[0139] It can be appreciated that the memory 702 can be volatile memory or nonvolatile memory, or both. Access to the memory 702 by other components of the device 700 can be controlled by a bus controller, bridge, or controller. Nonvolatile memory can be, for example, read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), a magnetic random access memory (FRAM), flash memory, a magnetic surface memory, an optical disc, or a compact disc read-only memory (CD-ROM). The magnetic surface memory can be a magnetic disc memory or a magnetic tape memory. Volatile memory can be, for example, random access memory (RAM), used as external cache. By way of example, and not limitation, many forms of RAM can be used, such as static random access memory (SRAM), synchronous static random access memory (SSRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM), and direct ram bus random access memory (DRRAM).The memory 702 described in the embodiments of the present application is intended to include, but is not limited to, these and any other suitable type of memory.

[0140] The memory 702 in the embodiments of the present application is used to store various types of data to support the operation of the electronic device 70. Examples of these data include: any computer program for operating on the electronic device 70, such as the implementation of obtaining the first communication address of the second subsystem for the first subsystem and obtaining the second communication address of the first subsystem for the second subsystem, etc., the program implementing the method of the embodiments of the present application can be contained in the memory 702.

[0141] The method disclosed in the embodiments of the present application can be applied to the processor 701 or implemented by the processor 701. The processor can be an integrated circuit chip with processing capability. In the implementation process, each step of the above method can be completed by the integrated logic circuit of hardware in the processor or the instruction in the form of software. The above processor can be a general processor, a digital signal processor (DSP), or other programmable logic device, discrete gate or transistor logic device, discrete hardware component, etc. The processor can implement or execute the disclosed methods, steps and logic block diagrams in the embodiments of the present application. The general processor can be a microprocessor or any conventional processor, etc. In combination with the steps of the method disclosed in the embodiments of the present application, the above-mentioned method can be directly embodied as a hardware decoding processor for execution, or a combination of hardware and software modules in the decoding processor for execution. The software module can be located in a storage medium, which is located in the memory, and the processor reads the information in the memory and combines the hardware to complete the steps of the above method.

[0142] In exemplary embodiments, the electronic device 70 can be implemented by one or more application specific integrated circuits (ASICs), DSPs, programmable logic devices (PLDs), complex programmable logic devices (CPLDs), field programmable gate arrays (FPGAs), general-purpose processors, controllers, microcontrollers (MCUs), microprocessors (Microprocessors), or other electronic elements, for executing the above method.

[0143] In several embodiments provided by the present application, it should be understood that the disclosed devices and methods can be implemented in other manners. The embodiments described above are merely exemplary, for example, the division of the units is only a logical function division, and there can be other division manners in actual implementation. For example, a plurality of units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the displayed or discussed coupling, or direct coupling or communication connection between the components can be indirect coupling or communication connection through some interfaces, devices or units, and can be electrical, mechanical or in other forms. The units described as separated components can or can not be physically separated, and the components displayed as units can or can not be physical units, i.e. can be located in one place, or distributed on a plurality of network units; some or all of the units can be selected according to actual needs to achieve the purposes of the embodiments. In addition, the units in the embodiments of the present application can be integrated in a processing unit, or each unit can be a separate physical unit, or two or more units can be integrated in a unit, and the integrated unit can be implemented in the form of hardware or hardware plus software function unit.

[0144] The above description is merely illustrative of the preferred embodiments of the present application and is not used to limit the protection scope of the present application.

Claims

1. A data processing method, characterized in that, The method, applied to an embedded device with a Trusted Cryptographic Module (TCM), includes: Create a first process containing a first name and a first password; During the execution of the first process, the first name and the first password are written to the TCM through the driver of the TCM; the driver is implemented by the operating system in the embedded device and is used for communication between the process and the TCM; When it is necessary to store or retrieve the CA certificate or key associated with the embedded device in the TCM, verify the second name and second password provided by the second process; If verification is successful, the second process uses a write interface function to write the first entry number into the TCM's driver. When the TCM's driver runs, it determines the first entry number associated with the CA certificate or key; calls the write interface function to write the first entry number and the CA certificate or key into the TCM's driver; runs the TCM's driver to determine the association between the first entry number and the CA certificate or key; and writes the association into the TCM; or... The write interface function is called to write the second entry number into the TCM driver; the TCM driver is run, and the TCM is searched based on the second entry number to obtain the search result; if the search result shows that a CA certificate or key corresponding to the second entry number is found in the TCM, the read result of the second process is determined to be a successful read; after a successful read, the CA certificate or key corresponding to the second entry number is obtained, and the CA certificate or key corresponding to the second entry number is returned to the second process; wherein, the first process and the second process may be the same or different; The step of determining the first entry number associated with the CA certificate or key includes: Obtain a random magic number; determine the number associated with the CA certificate or key, the type of the CA certificate or key, and the data length; The random magic number, the number, the type, and the data length are combined according to a set format to form the first entry number; The number associated with the CA certificate or key is a number assigned to the CA certificate or key, used to indicate which certificate or key the CA certificate or key is managed by the first process.

2. The method according to claim 1, characterized in that, When the first name is a first string and the first password is a second string, the step of writing the first name and the first password into the TCM through the TCM driver during the execution of the first process includes: When the first process runs, the write interface function is called to write the first string and the second string into the driver of the TCM; Run the driver program of the TCM to convert the first string and the second string into first physical data and second physical data, respectively; write the first physical data and the second physical data into the TCM through the physical bus.

3. The method according to claim 1, characterized in that, The verification of the second name and second password provided by the second process includes: Run the second process and write the second name and the second password provided by the second process into the driver of the TCM; Run the driver program of the TCM to obtain the first name and the first password stored in the TCM; compare the first name and the second name, and compare the first password and the second password to obtain a comparison result; obtain a verification result based on the comparison result. Wherein, if the comparison result is that the first name and the second name are the same and the first password and the second password are the same, the verification result is successful; if the comparison result is that the first name and the second name are different or the first password and the second password are different, the verification result is unsuccessful.

4. The method according to claim 1, characterized in that, After obtaining the search results for the TCM based on the second entry number, the method further includes: If the search result indicates that no CA certificate or key corresponding to the second entry number is found in the TCM, the second process is determined to have failed to read the data, and an error message is returned after the failure.

5. A data processing apparatus, characterized in that, An embedded device with a Trusted Cryptographic Module (TCM) is provided, comprising: a creation module, a writing module, a verification module, and a storage / reading module, wherein; The creation module is used to create a first process containing a first name and a first password; The writing module is used to write the first name and the first password into the TCM through the driver of the TCM when the first process is running; the driver is implemented by the operating system in the embedded device and is used for communication between the process and the TCM. The verification module is used to verify the second name and second password provided by the second process when it is necessary to store or read the CA certificate or key associated with the embedded device in the TCM. The storage / read module is configured to, upon successful verification, use the second process to write the first entry number into the TCM's driver program via a write interface function. During the execution of the TCM's driver program, it determines the first entry number associated with the CA certificate or key; calls the write interface function to write the first entry number and the CA certificate or key into the TCM's driver program; runs the TCM's driver program to determine the association between the first entry number and the CA certificate or key; and writes the association into the TCM; or... The write interface function is called to write the second entry number into the TCM driver; the TCM driver is run, and the TCM is searched based on the second entry number to obtain the search result; if the search result shows that a CA certificate or key corresponding to the second entry number is found in the TCM, the read result of the second process is determined to be a successful read; after a successful read, the CA certificate or key corresponding to the second entry number is obtained, and the CA certificate or key corresponding to the second entry number is returned to the second process; wherein, the first process and the second process may be the same or different; The step of determining the first entry number associated with the CA certificate or key includes: Obtain a random magic number; determine the number associated with the CA certificate or key, the type of the CA certificate or key, and the data length; The random magic number, the number, the type, and the data length are combined according to a set format to form the first entry number; The number associated with the CA certificate or key is a number assigned to the CA certificate or key, used to indicate which certificate or key the CA certificate or key is managed by the first process.

6. A computer-readable storage medium, characterized in that, The readable storage medium stores a computer program; when the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 4.

7. An electronic device, characterized in that, The electronic device includes: a processor and a memory for storing a computer program capable of running on the processor, wherein, when the processor runs the computer program, it performs the steps of the method according to any one of claims 1 to 4.

Images