Computing device, physical input device, physical output device, and data transmission method

Abstract

The embodiment of the application discloses a kind of computing device, physical input device, physical output device and data transmission method, it is related to computer technical field, it is convenient to improve the security of data transmission between computing device and physical input and output device.The computing device includes: first processor, for running virtual machine;Memory controller, electrically connected with the first processor, first encryption and decryption engine is arranged in the memory controller;Memory, electrically connected with the memory controller;Second processor, for the first encryption and decryption engine Configuration first security key and for the second encryption and decryption engine in target physical input and output device Configuration second security key;Wherein, the first security key and the second security key are same.The application is applicable to computer security technology.

Description

TECHNICAL FIELD

[0001] The present application relates to the computer technical field, and particularly relates to a computing device, a physical input device, a physical output device and a data transmission method. BACKGROUND

[0002] A virtual machine refers to a complete computer system which is simulated by software, runs in a completely isolated environment and has complete hardware system functions. Work that can be completed in an entity computer can be realized in the virtual machine. When the virtual machine is created in the computer, part of the hard disk and memory capacity of the entity computer needs to be taken as the hard disk and memory capacity of the virtual machine. By using a computer virtualization solution, the computer physical resources are abstracted into logical resources, one computer becomes several or even hundreds of mutually isolated virtual computers, and the CPU, memory, disk and other hardware resources become a "resource pool" which can be dynamically managed, so as to improve the utilization rate of resources, simplify system management and realize computer resource integration.

[0003] However, after the input and output device is configured to the computing device, when the computing device interacts with the physical input and output device, in the data transmission process, the data can be stolen by a malicious virtual machine manager in the computing device, so that the security of data transmission between the computing device and the input and output device cannot be guaranteed. SUMMARY

[0004] Therefore, the embodiments of the present application provide a computing device, a physical input device, a physical output device, a data transmission method and system, which facilitate to improve the security of data transmission between the computing device and the physical input and output device.

[0005] In a first aspect, the embodiments of the present application provide a computing device, comprising: a first processor configured to run a virtual machine; a memory controller electrically connected to the first processor, wherein a first encryption and decryption engine is arranged in the memory controller; a memory electrically connected to the memory controller; and a second processor configured to configure a first security key for the first encryption and decryption engine and a second security key for a second encryption and decryption engine in a target physical input and output device; wherein the first security key and the second security key are the same.

[0006] The virtual machine obtains, from the memory through the memory controller, encrypted data encrypted by the first encryption and decryption engine, and writes the encrypted data to the target physical input and output device, so that the target physical input and output device decrypts the encrypted data through the second encryption and decryption engine; or the virtual machine sends data to be encrypted to the memory controller, writes the encrypted data to a specified area of the memory after encryption by the first encryption and decryption engine, so that the target physical input and output device reads the encrypted data from the specified area and decrypts the encrypted data through the second encryption and decryption engine; or the virtual machine receives encrypted data sent by the target physical input and output device, and decrypts the encrypted data through the first encryption and decryption engine; the encrypted data sent by the target physical input and output device is generated by encrypting external input data received by the target physical input and output device through the second encryption and decryption engine.

[0007] According to an implementation of the embodiment of the application, the virtual machine is further configured to: assign a first register in the target physical input and output device to indicate whether the data to be decrypted is stored in a first memory or the specified area; and the first memory is located in the target physical input and output device and is used to store the encrypted data written by the virtual machine.

[0008] According to an implementation of the embodiment of the application, the virtual machine is further configured to: assign a second register in the target physical input and output device to indicate the location of the data to be decrypted stored in the first memory or the specified area; and / or assign a third register in the target physical input and output device to indicate the size of the data to be decrypted stored in the first memory or the specified area; and the first memory is located in the target physical input and output device.

[0009] According to an implementation of the embodiment of the application, when the virtual machine writes the encrypted data to the target physical input and output device, or when the target physical input and output device reads the encrypted data from the specified area, the target physical input and output device is a display device or a printing device, so that the target physical input and output device displays or prints the decrypted data after decrypting the encrypted data through the second encryption and decryption engine; and when the target physical input and output device is a display device, the first memory is a display memory.

[0010] According to an implementation of the embodiment of the application, when the virtual machine receives the encrypted data sent by the target physical input and output device, the target physical input and output device is one of a keyboard, a mouse, a camera, a scanner, a light pen, a touch panel, a game stick, and a voice input device.

[0011] In a second aspect, embodiments of the present application provide a physical output device, comprising: an output unit configured to output received data; an input / output interface configured to be electrically connected with an input / output interface of a computing device, and configured to receive encrypted data sent by a virtual machine or a virtual machine manager on the computing device, or to directly read encrypted data from a specified area of a memory of the computing device; and a decryption engine configured to decrypt the encrypted data received from the virtual machine or the virtual machine manager, or the encrypted data directly read from the specified area of the memory of the computing device, and the decrypted data is output by the output unit.

[0012] According to an implementation of embodiments of the present application, the physical output device further comprises: a first memory and a first register; the first memory is configured to store the encrypted data sent or written by the virtual machine or the virtual machine manager; the first register is assigned by the virtual machine or the virtual machine manager; and a value of the first register is configured to indicate whether the first memory stores data to be decrypted.

[0013] According to an implementation of embodiments of the present application, the physical output device further comprises: a second register and / or a third register; the second register and the third register are assigned by the virtual machine or the virtual machine manager; a value of the second register is configured to indicate a location of the data to be decrypted stored in the first memory; and a value of the third register is configured to indicate a size of the data to be decrypted stored in the first memory.

[0014] According to an implementation of embodiments of the present application, the physical output device is a display device or a printing device; when the physical output device is a display device, the first memory is a display memory.

[0015] In a third aspect, embodiments of the present application provide a physical input device, comprising: an input unit configured to receive external data input; an input / output interface configured to be electrically connected with an input / output interface of a computing device, and configured to send encrypted data to a virtual machine or a virtual machine manager on the computing device; and a decryption engine configured to encrypt external input data received by the input unit, and the encrypted external input data is sent to the virtual machine or the virtual machine manager through the input / output interface.

[0016] According to an implementation of embodiments of the present application, the physical input device is one of a keyboard, a mouse, a camera, a scanner, a light pen, a touch panel, a game stick, and a voice input device.

[0017] In a fourth aspect, embodiments of the present application provide a data transmission method applied to a computing device, comprising: reading, by a memory controller, data encrypted by a first encryption and decryption engine from a memory; sending, by the memory controller, the encrypted data to a virtual machine; writing, by the virtual machine, the encrypted data to a target physical input and output device, so that the target physical input and output device receives the encrypted data and decrypts the encrypted data by a second encryption and decryption engine; or,

[0018] sending, by the virtual machine, data to be encrypted to the memory controller, writing, by the memory controller, the encrypted data to a specified area of the memory after encryption by the first encryption and decryption engine, so that the target physical input and output device reads the encrypted data from the specified area and decrypts the encrypted data by the second encryption and decryption engine; or,

[0019] receiving, by the virtual machine, encrypted data sent by the target physical input and output device, and decrypting, by the virtual machine, the encrypted data by the first encryption and decryption engine; the encrypted data sent by the target physical input and output device is generated by encrypting, by the target physical input and output device, external input data received by the target physical input and output device by the second encryption and decryption engine.

[0020] According to an implementation of an embodiment of the present application, after the virtual machine writes the encrypted data to the target physical input and output device, the method can further comprise: the virtual machine assigning values to a first register in the target physical input and output device to indicate whether there is data to be decrypted in a first memory; wherein the first memory is located in the target physical input and output device and is used to store the encrypted data written by the virtual machine.

[0021] According to an implementation of an embodiment of the present application, after the virtual machine writes the encrypted data to the target physical input and output device, the method further comprises: the virtual machine assigning values to a second register in the target physical input and output device to indicate the location of the data to be decrypted stored in the first memory; and / or, the virtual machine assigning values to a third register in the target physical input and output device to indicate the size of the data to be decrypted stored in the first memory.

[0022] The first memory is located in the target physical input and output device.

[0023] According to an implementation of an embodiment of the present application, the target physical input and output device is a display device; wherein the virtual machine writes the encrypted data to the target physical input and output device, comprising: the virtual machine writes encrypted image data to the display device, so that the display device receives the encrypted image data and displays after decrypting the encrypted image data by the second encryption and decryption engine.

[0024] In a fifth aspect, embodiments of the present application provide a data transmission method applied to a physical input and output device, comprising: receiving encrypted data sent or written by a virtual machine or a virtual machine manager on a computing device, and decrypting the encrypted data by a cipher engine in the physical input and output device; or reading encrypted data from a specified area in a memory on the computing device, and decrypting the encrypted data by the cipher engine in the physical input and output device; or sending external input data received to the virtual machine or the virtual machine manager after the external input data is encrypted by the cipher engine in the physical input and output device.

[0025] According to an implementable manner of an embodiment of the present application, the physical input and output device comprises a first memory and a first register; wherein the method further comprises: storing the received encrypted data in the first memory; receiving an assignment operation of the first register by the virtual machine or the virtual machine manager; and the value of the first register is used to indicate whether there is to-be-decrypted data stored in the first memory.

[0026] According to an implementable manner of an embodiment of the present application, the physical input and output device further comprises a second register and / or a third register; wherein the method further comprises: receiving an assignment operation of the second register and / or the third register by the virtual machine or the virtual machine manager; the value of the second register is used to indicate the position of the to-be-decrypted data stored in the first memory; and the value of the third register is used to indicate the size of the to-be-decrypted data stored in the first memory.

[0027] According to an implementable manner of an embodiment of the present application, the physical input and output device is a display device, and the first memory is a display memory; wherein the receiving of the encrypted data sent or written by the virtual machine or the virtual machine manager on the computing device comprises: receiving encrypted image data sent or written by the virtual machine or the virtual machine manager on the computing device; and after the receiving of the encrypted data sent or written by the virtual machine or the virtual machine manager on the computing device, the method further comprises: the display device displaying the encrypted image data received and decrypted by the cipher engine.

[0028] According to an implementable manner of an embodiment of the present application, when the physical input and output device encrypts external input data by the cipher engine and sends the encrypted external input data to the virtual machine or the virtual machine manager, the physical input and output device is one of the following: a keyboard, a mouse, a camera, a scanner, a light pen, a touch panel, a game stick, and a voice input device.

[0029] In a sixth aspect, an embodiment of the present application provides a computing device, comprising: a first processor configured to run a virtual machine manager and a virtual machine, wherein the virtual machine manager is configured to virtually create a virtual input / output device; a memory controller electrically connected to the first processor, wherein a first encryption / decryption engine is arranged in the memory controller; a memory electrically connected to the memory controller; and a second processor configured to configure a first security key for the first encryption / decryption engine and a second security key for a second encryption / decryption engine in a target physical input / output device, wherein the first security key is the same as the second security key.

[0030] The virtual machine obtains encrypted data encrypted by the first encryption / decryption engine from an encrypted memory of the virtual machine through the memory controller, and writes the encrypted data into the virtual input / output device; the virtual machine manager reads the encrypted data from the virtual input / output device, and writes or sends the encrypted data to the target physical input / output device, so that the target physical input / output device receives the encrypted data and decrypts the encrypted data by the second encryption / decryption engine, wherein the encrypted memory of the virtual machine is an encrypted storage area of the virtual machine in the memory; or,

[0031] The virtual machine manager receives encrypted data from the target physical input / output device, and writes or sends the encrypted data to the virtual input / output device; the virtual machine reads the encrypted data from the virtual input / output device, and writes the encrypted data into the memory through the memory controller; wherein the encrypted data received by the virtual machine manager is generated by encrypting external input data received by the target physical input / output device by the second encryption / decryption engine.

[0032] According to an implementation of an embodiment of the present application, the virtual machine manager is further configured to virtually create a first virtual register for a first register in the target physical input / output device; the virtual machine is further configured to assign a value to the first virtual register; the virtual machine manager reads the value of the first virtual register, and assigns the read value of the first virtual register to the first register, to indicate whether there is to-be-decrypted data stored in a first memory; wherein the first memory is located in the target physical input / output device.

[0033] According to an implementable mode of the embodiment of the present application, the virtual machine manager is further configured to virtually create a second virtual register for a second register in the target physical input / output device, and / or virtually create a third virtual register for a third register in the target physical input / output device; and the virtual machine is further configured to assign values to the second virtual register and / or the third virtual register.

[0034] The virtual machine manager reads the value of the second virtual register, and assigns the read value of the second virtual register to the second register to indicate the location of the to-be-decrypted data stored in the first memory; and / or the virtual machine manager reads the value of the third virtual register, and assigns the read value of the third virtual register to the third register to indicate the size of the to-be-decrypted data stored in the first memory.

[0035] According to an implementable mode of the embodiment of the present application, the target physical input / output device is a display device or a printing device; and when the target physical input / output device is a display device, the first memory is a display memory.

[0036] According to an implementable mode of the embodiment of the present application, when the virtual machine manager receives the encrypted data from the target physical input / output device, the target physical input / output device is one of a keyboard, a mouse, a camera, a scanner, a light pen, a touch panel, a game stick, and a voice input device.

[0037] In a seventh aspect, the embodiments of the present application provide a data transmission method applied to a computing device, including: a virtual machine manager virtually creating a virtual input / output device; a virtual machine obtaining encrypted data encrypted by a first encryption / decryption engine from an encrypted memory of the virtual machine through a memory controller, and writing the encrypted data into the virtual input / output device; the virtual machine manager reading the encrypted data from the virtual input / output device, and writing or sending the encrypted data to a target physical input / output device, so that the target physical input / output device receives the encrypted data and decrypts the encrypted data through a second encryption / decryption engine, wherein the encrypted memory of the virtual machine is an encrypted storage area of the virtual machine in the memory; or

[0038] The virtual machine manager receives the encrypted data from the target physical input / output device, and writes or sends the encrypted data to the virtual input / output device, the virtual machine reads the encrypted data from the virtual input / output device, and writes the encrypted data into the memory through the memory controller; wherein the encrypted data received by the virtual machine manager is generated by the target physical input / output device encrypting the received external input data through the second encryption / decryption engine.

[0039] According to an implementation of the embodiment of the present application, when the virtual machine manager virtualizes a virtual input / output device, the method further comprises: the virtual machine manager virtualizes a first virtual register for a first register in the target physical input / output device; the virtual machine assigns a value to the first virtual register; the virtual machine manager reads the value of the first virtual register, and assigns the read value of the first virtual register to the first register, to indicate whether there is to-be-decrypted data stored in the first memory; wherein the first memory is located in the target physical input / output device.

[0040] According to an implementation of the embodiment of the present application, when the virtual machine manager virtualizes a virtual input / output device, the method further comprises: the virtual machine manager virtualizes a second virtual register for a second register in the target physical input / output device, and / or virtualizes a third virtual register for a third register in the target physical input / output device; the virtual machine assigns a value to the second virtual register and / or the third virtual register.

[0041] The virtual machine manager reads the value of the second virtual register, and assigns the read value of the second virtual register to the second register, to indicate the position of the to-be-decrypted data stored in the first memory; and / or the virtual machine manager reads the value of the third virtual register, and assigns the read value of the third virtual register to the third register, to indicate the size of the to-be-decrypted data stored in the first memory.

[0042] According to an implementation of the embodiment of the present application, the target physical input / output device is a display device, and the encrypted data is encrypted image data; wherein the virtual machine manager writes or sends the read encrypted data to the target physical input / output device, so that the target physical input / output device decrypts the encrypted data through the second encryption / decryption engine, comprising: the virtual machine manager writes or sends the read encrypted image data to the target physical input / output device, so that the target physical input / output device displays after decrypting the encrypted image data through the second encryption / decryption engine.

[0043] In an eighth aspect, embodiments of the present application provide a data transmission system, comprising: a computing device and a physical output device connected thereto; wherein the computing device is the computing device provided in any of the preceding implementation manners, and the physical output device is the physical output device provided in any of the preceding implementation manners; or the data transmission system comprises: a computing device and a physical input device connected thereto; wherein the computing device is the computing device provided in any of the preceding implementation manners, and the physical input device is the physical input device provided in any of the preceding implementation manners.

[0044] Embodiments of the present application provide a computing device, a physical input device, a physical output device, a data transmission method and system. In the computing device, the second processor can configure a first security key for the first encryption and decryption engine in the memory controller and configure a second security key for the second encryption and decryption engine in the target physical input / output device, wherein the first security key and the second security key are the same. In this way, the virtual machine running on the computing device can obtain encrypted data encrypted by the first encryption and decryption engine from the memory through the memory controller, and write the encrypted data to the target physical input / output device, so that the target physical input / output device decrypts the encrypted data through the second encryption and decryption engine. Alternatively, the virtual machine receives the encrypted data sent by the target physical input / output device and decrypts the encrypted data through the first encryption and decryption engine. That is, in the embodiments of the present application, the data transmitted between the computing device and the target physical input / output device is transmitted in an encrypted form. Even if the encrypted data is stolen by a malicious virtual machine manager during transmission, the malicious virtual machine manager cannot decrypt the encrypted data, thereby ensuring the security of data transmission between the computing device and the physical input / output device. BRIEF DESCRIPTION OF DRAWINGS

[0045] In order to more clearly illustrate the technical solutions of the embodiments of the present application or the prior art, the drawings needed in the embodiments or prior art description will be briefly introduced. Obviously, the drawings in the following description are only some embodiments of the present application, and those skilled in the art can obtain other drawings according to these drawings without creative labor.

[0046] Figure 1A A structural schematic diagram of a computing device and a target physical input / output device provided in embodiments of the present application;

[0047] Figure 1B A structural schematic diagram of a target physical input / output device provided in embodiments of the present application;

[0048] Figure 2An output device structure schematic diagram provided by an embodiment of the present application;

[0049] Figure 3 An input device structure schematic diagram provided by an embodiment of the present application;

[0050] Figure 4 A data transmission method flow chart provided by an embodiment of the present application;

[0051] Figure 5A Another data transmission method flow chart provided by an embodiment of the present application;

[0052] Figure 5B Still another data transmission method flow chart provided by an embodiment of the present application;

[0053] Figure 6 Another computing device and target physical input / output device structure schematic diagram provided by an embodiment of the present application;

[0054] Figure 7 Another output device structure schematic diagram provided by an embodiment of the present application;

[0055] Figure 8 Another input device structure schematic diagram provided by an embodiment of the present application;

[0056] Figure 9A Still another data transmission method flow chart provided by an embodiment of the present application;

[0057] Figure 9B Still another data transmission method flow chart provided by an embodiment of the present application;

[0058] Figure 10A Still another data transmission method flow chart provided by an embodiment of the present application;

[0059] Figure 10B Still another data transmission method flow chart provided by an embodiment of the present application;

[0060] Figure 11 Still another computing device and target physical input / output device structure schematic diagram provided by an embodiment of the present application. DETAILED DESCRIPTION

[0061] The embodiments of the present application will be described in detail below with reference to the drawings.

[0062] It should be noted that the described embodiments are only some of the embodiments of the present application, but not all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative work fall within the scope of protection of the present application.

[0063] In a first aspect, embodiments of this application provide a computing device that facilitates improved security of data transmission between the computing device and physical input / output devices.

[0064] Figure 1A A schematic diagram of a computing device structure is provided for an embodiment of this application, such as... Figure 1A As shown in the embodiments of this application, the computing device 1 may include a system-on-a-chip (SoC) 11 and a memory 12. The SoC 11 may include a first processor 111, a memory controller 112, and a second processor 113. The first processor 111 is used to run a virtual machine. The memory controller 112 is electrically connected to the first processor 111 and includes a first encryption / decryption engine. The memory 12 is electrically connected to the memory controller 112. The second processor 113 is used to configure a first security key for the first encryption / decryption engine and a second security key for the second encryption / decryption engine in the target physical input / output device 200. The first security key and the second security key are the same.

[0065] The virtual machine retrieves encrypted data encrypted by the first encryption / decryption engine from memory 12 via memory controller 112, and writes the encrypted data to target physical input / output device 200, so that target physical input / output device 200 receives the encrypted data and decrypts it using the second encryption / decryption engine; alternatively, the virtual machine sends data to be encrypted to memory controller 112, encrypts it using the first encryption / decryption engine, and writes it to a designated area of ​​memory 12, so that target physical input / output device 200 reads the encrypted data from the designated area and decrypts it using the second encryption / decryption engine; alternatively, the virtual machine receives encrypted data sent by target physical input / output device 200 and decrypts it using the first encryption / decryption engine; the encrypted data sent by target physical input / output device 200 is generated by target physical input / output device 200 encrypting received external input data using the second encryption / decryption engine.

[0066] Specifically, the first processor 111 can be referred to as the processor core, which is used to run virtual machines; the first processor 111 can be a 32-bit processor or a 64-bit processor, etc.

[0067] The memory controller 112 is electrically connected to the first processor 111 and the memory 12. Therefore, it can select different memory address spaces according to the address information issued by the first processor 111, and then the virtual machine can write data to the selected memory space.

[0068] The second processor 113 can be referred to as a security processor or a platform security processor (PSP), and can also be referred to as a security co-processor, etc. The security processor is a processor designed to help a system achieve functional safety.

[0069] The memory in the embodiment can be a memory applied to a server, for example, a memory with high stability and error correction performance by using ECC (Error Checking and Correcting), ChipKill, or hot plug technology, etc.

[0070] Since the second processor 113 can configure a first security key for the first encryption and decryption engine in the memory controller 112, and configure a second security key for the second encryption and decryption engine of the target physical input and output device 200, the first security key and the second security key are the same. In this way, the virtual machine running on the computing device can obtain encrypted data encrypted by the first encryption and decryption engine from the memory 12 through the memory controller 112, and write the encrypted data to the target physical input and output device 200, so that the target physical input and output device 200 decrypts the encrypted data through the second encryption and decryption engine; in one example, when writing the encrypted data to the target physical input and output device 200, the DMA (Direct Memory Access) technology can be used to achieve it. The DMA technology refers to an interface technology in which an external device directly exchanges data with a system memory without passing through a CPU.

[0071] Alternatively, the memory controller 112 can write the encrypted data to a specified area in the virtual machine memory, and specifically, the specified area is a mapped storage area of the target physical input and output device 200. The target physical input and output device 200 can read the encrypted data from the specified area and further decrypt the encrypted data by using the second encryption and decryption engine to obtain the decrypted data.

[0072] Alternatively, the virtual machine receives the encrypted data sent by the target physical input and output device 200, and decrypts the encrypted data through the first encryption and decryption engine.

[0073] That is, in the above three implementation manners of the embodiment of the application, the data transmitted between the computing device and the target physical input and output device 200 is transmitted in an encrypted form. Even if the encrypted data is stolen by a malicious virtual machine manager during transmission, the malicious virtual machine manager cannot decrypt the encrypted data, thereby ensuring the security of data transmission between the computing device and the physical input and output device.

[0074] In one implementation, the PSP can configure a first security key for a first encryption / decryption engine in the memory controller 112, and the virtual machine can share the first security key with the target physical input / output device 200, so that the PSP can configure a second security key identical to the first security key for a second encryption / decryption engine.

[0075] More specifically, in the process of sharing the security key by the virtual machine with the target physical input / output device 200, the target physical input / output device 200 can be first authenticated, and only the target input / output device that has passed the authentication can share the security key with the virtual machine, so as to prevent the security key from being stolen, and thus ensure the security of the encrypted data in the subsequent transmission process.

[0076] Taking the target physical input / output device 200 as a secure display device as an example, the principle is explained as follows:

[0077] Step 1. In the process of producing the secure display device, a pair of unique public and private key pair is pre-installed therein, the private key is written into the secure display device and cannot be read out, and only the secure display device has it. After generating a legal certificate authority (CA) certificate by using the public key, the CA certificate is written into the secure display device, each secure display device has a unique serial number ID, and the PSP public key is also written into the secure display device.

[0078] Step 2. When the virtual machine adds the secure display device, the virtual machine manager starts the authentication process and sends an authentication request message to the secure display device.

[0079] Step 3. After receiving the authentication request message, the secure display device generates a random number, encrypts the random number by using the PSP public key, and then digitally signs the encrypted random number and the serial number ID by using the private key of the secure display device. The digitally signed data and the CA certificate of the secure display device are returned to the virtual machine manager, and then forwarded to the PSP by the virtual machine manager, and the security authentication is performed by the PSP.

[0080] Step 4. After receiving the authentication information, the PSP first verifies the legality of the secure display device public key by using the CA certificate, and verifies the digital signature of the random number ciphertext and the serial number ID in the authentication information by using the secure display device public key. After the verification is passed, the PSP decrypts the random number by using its own private key, derives a transmission key by using the random number, encrypts the first encryption key (generated by the PSP) of the virtual machine by using the transmission key, and returns it to the virtual machine manager, which transmits it to the secure display device. At the same time, the PSP records the serial number ID of the secure display device.

[0081] Step 5, after receiving the ciphertext of the first encryption key, the secure display device derives the transmission key from the random number in the same way, and decrypts the ciphertext of the first encryption key using the transmission key to obtain the first encryption key, and configures the first encryption key into the second encryption and decryption engine.

[0082] Through the above steps, the first encryption key can be securely shared between the virtual machine and the target input / output device.

[0083] In addition, in order to prevent the virtual machine manager from replacing or adding the secure display device, the PSP can also verify the serial number ID of the secure display device, which can be verified in the following way:

[0084] During the startup process of the virtual machine, the serial number ID of the secure display device allowed to display the confidential image can be passed to the PSP through a secure call; when authenticating the secure display device, the PSP checks the serial number ID of the current secure display device according to the aforementioned white list, and only when the secure display device is allowed by the virtual machine (i.e. in the white list), the PSP will pass and configure the encryption key;

[0085] Alternatively,

[0086] Another specific implementation is that when the PSP configures the encryption key in the secure display device, it also records the serial number ID of the secure display device; the virtual machine can obtain the secure display device ID that passes the aforementioned security authentication step from the PSP through a secure call; the user of the virtual machine can compare the ID of the secure display device with the serial number ID white list of the secure display device to determine whether the current secure display device is in the white list.

[0087] The virtual machine in the embodiment of the application can directly write data into the target physical input / output device 200, and this working state can be referred to as a pass-through state in which the virtual machine and the target physical input / output device 200 work. In the pass-through state, the target physical input / output device 200 is a local device.

[0088] When the target physical input / output device 200 is an output device, the virtual machine can obtain encrypted data encrypted by the first security key in the first encryption and decryption engine from the corresponding position in the memory 12 through the memory controller 112, and write the encrypted data into the target physical input / output device 200, so that the target physical input / output device 200 decrypts the encrypted data through the second security key in the second encryption and decryption engine to obtain decrypted data for subsequent data output operation.

[0089] When the target physical input / output device 200 is an input device, after receiving external data (e.g., externally input text information, audio information, etc.), the target physical input / output device 200 can first encrypt the external data using the second security key in the second encryption / decryption engine, thereby generating encrypted data, which is then stored at the target location. The virtual machine can read this encrypted information from the target location and use the first security key in the first encryption / decryption engine to perform a decryption operation on the encrypted data, thereby obtaining decrypted data in plaintext format for subsequent processing.

[0090] In the existing technology, since physical input / output devices do not support encryption and decryption functions, computing devices can only transmit data in plaintext format when transmitting data with the target physical input / output device 200. If this input / output data is stolen by a malicious virtual machine manager, it will pose a significant security risk.

[0091] In contrast, in the two data transmission methods (input data and output data) described above in this application, whether the virtual machine sends data to the physical output device or receives data from the physical input device, the data is transmitted in encrypted form. This ensures that even if the encrypted data is stolen by a malicious virtual machine manager, it cannot be decrypted, thus guaranteeing the security of the data during transmission.

[0092] Figure 1B A schematic diagram of a target physical input / output device structure is provided for an embodiment of this application, such as... Figure 1B As shown, the target physical input / output device 200 includes a first memory 204. To facilitate the target physical input / output device 200 in determining whether encrypted data exists in the first memory 204, in one embodiment of this application, the target physical input / output device 200 also includes a first register 201. Accordingly, the virtual machine can also be used to assign a value to the first register 201 in the target physical input / output device 200 to indicate whether the first memory 204 stores data to be decrypted.

[0093] In the embodiment of the present application, the first register 201 is a flag register, and the first register 201 is used to indicate whether there is data to be decrypted in the first memory 204. Generally, the default value of the first register 201 is 0, and when the virtual machine writes encrypted data into the first memory 204 of the target physical input / output device 200, the value of the first register 201 can be assigned as 1. Therefore, the target physical input / output device 200 can read the value of the first register 201, and can determine whether there is data to be decrypted in the first memory 204 according to the value of the first register 201. If there is, the target physical input / output device 200 can perform a decryption operation by using the second encryption / decryption engine, otherwise, it is not necessary to perform a decryption operation.

[0094] Similarly, in order to facilitate the physical output device to obtain the position information and / or size information of the data to be decrypted in the first memory 204, in an embodiment of the present application, the target physical input / output device 200 further comprises a second register 202 and / or a third register 203, and accordingly, the virtual machine can further be configured to: assign a value to the second register 202 in the target physical input / output device 200 to indicate the position of the data to be decrypted stored in the first memory 204; and / or assign a value to the third register 203 in the target physical input / output device 200 to indicate the size of the data to be decrypted stored in the first memory 204.

[0095] For example, when the target physical input / output device 200 is a display device, the value in the second register 202 is used to indicate the starting display position of the display data on the display screen, i.e., the starting horizontal coordinate and the starting vertical coordinate of the starting pixel point. The value in the third register 203 is used to indicate the length occupied by the display data in the horizontal coordinate direction and the vertical coordinate direction, i.e., how many pixel points are occupied. The target physical input / output device 200 can obtain the position information and the size information of the data to be decrypted on the display screen by reading the values of the second register 202 and the third register 203, and then can display the decrypted data at the corresponding position on the display screen. When the target physical input / output device 200 is a printing device, the virtual machine can set the second register 202 and the third register 203 in the same way, so that the printing device can read the values of the two registers, and then can print in the specified area.

[0096] Optionally, in an embodiment of the present application, when the virtual machine writes the encrypted data into the target physical input / output device 200, the target physical input / output device 200 can be a display device or a printing device, so that the target physical input / output device 200 displays or prints the decrypted data after the second encryption / decryption engine decrypts the encrypted data; when the target physical input / output device 200 is a display device, the first memory 204 is a display memory.

[0097] The target physical input / output device 200 can be an input device or an output device. In an embodiment of the present application, when the virtual machine writes the encrypted data into the target physical input / output device 200, the target physical input / output device 200 is an output device, and more specifically, the target physical input / output device 200 can be a printing device or a display device. After receiving the encrypted data, the target physical input / output device 200 can perform decryption operation by using the second encryption / decryption engine, and then can display or print the decrypted data. The target physical input / output device 200 can be a display device, and correspondingly, the first memory 204 is a display memory for storing the decrypted image data, so that the present application can realize secure transmission of printing data and display data.

[0098] Optionally, in an embodiment of the present application, when the virtual machine receives the encrypted data sent by the target physical input / output device 200, the target physical input / output device 200 can be one of the following: a keyboard, a mouse, a camera, a scanner, a light pen, a touch panel, a game stick, and a voice input device.

[0099] In daily applications, when a computing device interacts with the outside world, it needs to receive encrypted data transmitted by various physical input devices. In an embodiment of the present application, when the target physical input / output device 200 is an input device, it can be any of the above input devices, and has a wide range of applications. Therefore, through the present application, the encrypted data transmission between various input devices and the virtual machine can be realized, and the security of various input data in transmission is improved.

[0100] In a second aspect, an embodiment of the present application provides a physical output device, which facilitates improving the security of data transmission between a computing device and a physical output device.

[0101] As Figure 2As shown, the physical output device 2 provided by the embodiment of the present application can include: an input / output interface 21, an encryption / decryption engine 22, and an output unit 23; the input / output interface 21 is electrically connected with the input / output interface of the computing device, and receives the encrypted data sent by the virtual machine on the computing device; the encryption / decryption engine 22 is used for decrypting the encrypted data received from the virtual machine; and the output unit 23 is used for outputting the decrypted data.

[0102] In the embodiment of the present application, the physical output device can be electrically connected with the computing device through the input / output interface 21. When the virtual machine needs to output data through the physical output device, the physical output device 2 can receive the encrypted data written by the virtual machine through the input / output interface 21, and decrypt the encrypted data by using the encryption / decryption engine 22, and then further output the decrypted data through the output unit 23. In this way, even if the encrypted data is stolen by the malicious virtual machine manager in the transmission process, the malicious virtual machine manager cannot decrypt the encrypted data, thereby ensuring the security of data transmission between the computing device and the physical output device.

[0103] In order to facilitate the physical output device to determine whether there is encrypted data in the first memory, in an embodiment of the present application, the output device 2 can further include: a first memory and a first register; the first memory is used for storing the encrypted data written by the virtual machine; and the first register is assigned by the virtual machine; the value of the first register is used for indicating whether there is decrypted data in the first memory.

[0104] In the embodiment of the present application, the first register is a flag register, which is used for indicating whether there is decrypted data in the first memory. For example, the default value of the first register is 0. When the virtual machine writes the encrypted data into the first memory of the output device 2, the value of the first register can be assigned as 1. Then the physical output device can read the value of the first register, and determine whether there is decrypted data in the first memory according to the value of the first register. When there is decrypted data, the decryption operation can be performed by using the encryption / decryption engine 22, otherwise, the decryption operation does not need to be performed.

[0105] Similarly, in order to facilitate the physical output device to obtain the position information and / or size information of the decrypted data in the first memory, the physical output device 2 can further include: a second register and / or a third register; the second register and the third register are assigned by the virtual machine; the value of the second register is used for indicating the position of the decrypted data stored in the first memory; and the value of the third register is used for indicating the size of the decrypted data stored in the first memory.

[0106] In this embodiment, when the physical output device 2 is a display device, the second register is used to indicate the starting display position of the display data on the display screen, i.e., the horizontal and vertical coordinates of the starting pixel. The third register is used to indicate the length of the display data in the horizontal and vertical directions, i.e., how many pixels it occupies. The target physical input / output device can read the values ​​of the second and / or third registers and display the data to be decrypted at the corresponding position. When the target physical input / output device is a printing device, the virtual machine can set the second and third registers in the same way, so that the target physical input / output device can read the values ​​of both and thus control the specific area of ​​the printed content.

[0107] Optionally, the physical output device 2 can be a display device or a printing device; wherein, when the physical output device 2 is a display device, the first memory is video memory.

[0108] In this embodiment, the physical output device 2 can be a display device or a printing device to achieve display output or print output. For example, the physical output device 2 can be a display device, and the first memory can be video memory, used to store the image data to be decrypted. Therefore, the video memory in the display device can receive the image data to be decrypted from the virtual machine, decrypt it, and then output the decrypted image data, thereby realizing the secure transmission of image data.

[0109] Thirdly, embodiments of this application provide a physical input device that facilitates improved security of data transmission between a computing device and a physical input device.

[0110] like Figure 3 As shown in the embodiment of this application, a physical input device 3 is provided. The physical input device may include: an input unit 31, an encryption / decryption engine 32, and an input / output interface 33. The input unit 31 is used to receive external data input. The encryption / decryption engine 32 is used to encrypt the external input data received by the input unit 31, and the encrypted external input data is sent to the virtual machine through the input / output interface. The input / output interface 33 is used to be electrically connected to the input / output interface of the computing device and to send encrypted data to the virtual machine.

[0111] In this embodiment, the physical input device can directly send encrypted data to the virtual machine. This working state can be referred to as the virtual machine and the physical input device working in a pass-through state. In the pass-through state, the physical input device is a local device.

[0112] The physical input device is electrically connected with the computing device through an input-output interface. When the physical input device sends the decrypted data to the computing device, the physical input device can first encrypt the external input data obtained from the input unit 31 through the encryption-decryption engine, and send the encrypted data to the virtual machine through the input-output interface, so that the virtual machine performs corresponding processing after receiving the encrypted data. In this way, even if the encrypted data is stolen by a malicious virtual machine manager during transmission, the malicious virtual machine manager cannot decrypt the encrypted data, thereby ensuring the security of data transmission between the computing device and the physical input device.

[0113] Optionally, the physical input device 3 is one of a keyboard, a mouse, a camera, a scanner, a light pen, a touch panel, a game stick, and a voice input device.

[0114] In daily applications, the computing device needs to receive encrypted data transmitted by various physical input devices when interacting with the outside world. In the embodiments of the present application, the physical input device can be any of the above input devices, and the application range is wide. Therefore, through the embodiments of the present application, encrypted data transmission of various input devices and virtual machines can be realized, and the security of various input data in transmission is improved.

[0115] In a fourth aspect, the embodiments of the present application provide a data transmission method, which facilitates to improve the security of data transmission between a computing device and a physical input-output device.

[0116] As shown in FIG. 1, the embodiments of the present application provide a data transmission method, which is applied to a computing device, and includes the following steps. Figure 4 As shown in FIG. 1, the embodiments of the present application provide a data transmission method, which is applied to a computing device, and includes the following steps.

[0117] In the embodiments of the present application, the memory controller can read the data encrypted by the first encryption-decryption engine from the memory, thereby obtaining the encrypted data, and send the encrypted data to the virtual machine. Then, the virtual machine writes the encrypted data to the target physical input-output device, so that the target physical input-output device decrypts the encrypted data through the second encryption-decryption engine configured with the same security key, thereby obtaining the decrypted data. In one example, the DMA technology can be used when writing the encrypted data to the target physical input-output device.

[0118] In the embodiment of the present application, the virtual machine can directly write data into the target physical input / output device, and the working state can be referred to as a pass-through state in which the virtual machine and the target physical input / output device work. In the pass-through state, the target physical input / output device is a local device.

[0119] In the embodiment of the present application, the implementation process of steps S11-S13 can refer to the related content of the embodiment of the first aspect, which will not be described here.

[0120] The embodiment of the present application can also provide another data transmission method, and the specific implementation manner can be that the virtual machine sends to-be-encrypted data to the memory controller, writes the to-be-encrypted data into a specified area of the memory after encryption by the first encryption / decryption engine, so that the target physical input / output device reads the encrypted data from the specified area and decrypts the encrypted data by using the second encryption / decryption engine.

[0121] Specifically, the memory controller can write the encrypted data into a specified area in the virtual machine memory, and the specified area is a mapping storage area of the target physical input / output device. The target physical input / output device can read the encrypted data from the specified area and further decrypt the encrypted data by using the second encryption / decryption engine to obtain decrypted data.

[0122] The embodiment of the present application also provides another data transmission method, and the specific implementation manner can be that the virtual machine receives encrypted data sent by the target physical input / output device and decrypts the encrypted data by using the first encryption / decryption engine. The encrypted data sent by the target physical input / output device is generated by encrypting external input data received by the target physical input / output device by using the second encryption / decryption engine. That is, the virtual machine can directly receive the encrypted external input data and decrypt the encrypted external input data by using the first encryption / decryption engine to obtain the plaintext format of the external input data.

[0123] Therefore, in the three data transmission methods provided in the embodiment of the present application, the data is transmitted in the form of ciphertext between the computing device and the target physical input / output device, so that even if the ciphertext data is stolen by the virtual machine manager, the encrypted data cannot be decrypted, thereby ensuring the security of the data in the transmission process.

[0124] In order to facilitate the target physical input / output device to determine whether the encrypted data exists in the first memory, after the virtual machine writes the encrypted data into the target physical input / output device, the method can further include that the virtual machine assigns a value to a first register in the target physical input / output device to indicate whether the to-be-decrypted data is stored in the first memory. The first memory is located in the target physical input / output device.

[0125] In the embodiments of the present application, when the target physical input / output device is an output device, the target physical input / output device can further be provided with a first register, which is a flag register, and the first register is used to indicate whether there is to-be-decrypted data in the first memory. Generally, the default value of the first register is 0, and after the virtual machine writes the encrypted data into the first memory of the target physical input / output device, the value of the first register can be assigned as 1. Therefore, the target physical input / output device can read the value of the first register, and according to the value of the first register, it can be determined whether there is to-be-decrypted data in the first memory. If there is, the target physical input / output device can perform a decryption operation by using the second encryption / decryption engine, otherwise, it does not need to perform a decryption operation.

[0126] Similarly, in order to facilitate the physical output device to obtain the position information and / or size information of the to-be-decrypted data in the first memory, in an embodiment of the present application, after the virtual machine writes the encrypted data into the target physical input / output device, the method can further include: the virtual machine assigns a value to a second register in the target physical input / output device to indicate the position of the to-be-decrypted data stored in the first memory; and / or, the virtual machine assigns a value to a third register in the target physical input / output device to indicate the size of the to-be-decrypted data stored in the first memory; wherein the first memory is located in the target physical input / output device.

[0127] In the embodiments of the present application, the target physical output device can further be provided with a second register and / or a third register, the second register is used to indicate the position of the to-be-decrypted data in the first memory, and the third register is used to indicate the size of the to-be-decrypted data. For example, when the target physical output device is a display device, the second register is used to indicate the starting display position of the display data on the display screen, i.e., the horizontal coordinate and vertical coordinate of the starting pixel point. The third register is used to indicate the length of the display data in the horizontal coordinate direction and the vertical coordinate direction, i.e., how many pixel points it occupies. Therefore, after the virtual machine writes the encrypted data into the target physical input / output device, the virtual machine can assign values to the second register and the third register according to actual needs, and the target physical input / output device can read the values of the second register and / or the third register, and display the to-be-decrypted data to the corresponding position. When the target physical output device is a printing device, the virtual machine can set the second register and the third register in the same way, so that the target physical input / output device can read the values of the two registers, and thus can control the specific area of the printed content.

[0128] Optionally, the target physical input / output device is a display device; and the writing of the encrypted data into the target physical input / output device by the virtual machine can include: writing, by the virtual machine, encrypted image data into the display device, so that the display device receives the encrypted data and displays the encrypted image data after decryption by a second encryption / decryption engine.

[0129] In the embodiments of the present application, the target physical input / output device can be a display device. The virtual machine can write encrypted image data into the display device, specifically into the memory of the display device. The display device can receive the encrypted image data and decrypt the encrypted image data using a second encryption / decryption engine to obtain decrypted image data, and display the decrypted image data using a display screen.

[0130] In a fifth aspect, the embodiments of the present application provide a data transmission method, which facilitates improving the security of data transmission between a computing device and a physical output device.

[0131] As shown in Figure 5A The embodiments of the present application provide a data transmission method, which is applied to a physical output device and includes the following steps:

[0132] S21, receiving encrypted data written by a virtual machine on a computing device;

[0133] S22, decrypting the encrypted data by an encryption / decryption engine in the physical output device.

[0134] In the embodiments of the present application, the physical output device (specifically the memory in the physical output device) can receive encrypted data written by a virtual machine on a computing device. Then, the physical output device can decrypt the encrypted data using an encryption / decryption engine to obtain decrypted data.

[0135] When the virtual machine sends output data to the physical output device, the data is transmitted to the target physical output device in the form of ciphertext, so that even if the ciphertext data is stolen by a malicious virtual machine manager, the encrypted data cannot be decrypted, thereby ensuring the security of the data in the transmission process.

[0136] In order to facilitate the physical output device to determine whether there is encrypted data in the first memory, the physical output device can include a first memory and a first register; and the method further includes: storing the received encrypted data in the first memory; receiving an assignment operation of the virtual machine on the first register; and the value of the first register is used to indicate whether there is decrypted data stored in the first memory.

[0137] In the embodiment of the present application, the output device is provided with a first register and a first memory, wherein the first register is a flag register, and the first memory is used to store the encrypted data written from the virtual machine, and the first register is used to indicate whether there is to-be-decrypted data in the first memory. For example, the default value of the first register is 0, when the virtual machine writes the encrypted data into the first memory of the output device, the value of the first register can be assigned as 1, and then the physical output device can read the value of the first register, and can determine whether there is to-be-decrypted data in the first memory according to the value of the first register, when there is to-be-decrypted data, the decryption operation can be performed by using the encryption and decryption engine, otherwise, the decryption operation does not need to be performed.

[0138] Similarly, in order to facilitate the physical output device to obtain the position information and / or size information of the to-be-decrypted data in the first memory, in an embodiment of the present application, the physical output device can further include a second register and / or a third register;

[0139] The method can further include: receiving the assignment operation of the virtual machine to the second register and / or the third register; the value of the second register is used to indicate the position of the to-be-decrypted data stored in the first memory; and the value of the third register is used to indicate the size of the to-be-decrypted data stored in the first memory.

[0140] In the embodiment of the present application, the physical output device can further be provided with a second register and / or a third register, the second register is used to indicate the position of the to-be-decrypted data, and the third register is used to indicate the size of the to-be-decrypted data. For example, when the physical output device is a display device, the second register is used to indicate the starting display position of the display data on the display screen, that is, the horizontal coordinate and the vertical coordinate of the starting pixel point. The third register is used to indicate the length of the display data in the horizontal coordinate direction and the vertical coordinate direction, that is, how many pixel points are occupied. Therefore, the physical output device can read the values of the second register and / or the third register, and display the to-be-decrypted data to the corresponding position. When the physical output device is a printing device, the virtual machine can set the second register and the third register in the same way, so that the physical output device can read the values of the two, and can control the specific area of the printing content.

[0141] Optionally, the physical output device is a display device, and the first memory is a display memory; wherein the receiving the encrypted data written by the virtual machine on the computing device can include: receiving the encrypted image data written by the virtual machine on the computing device;

[0142] After receiving the encrypted data written by the virtual machine on the computing device, the method can further include:

[0143] The encrypted image data received by the display device is decrypted by the encryption and decryption engine and then displayed.

[0144] In the embodiments of the present application, the display device can receive encrypted image data, decrypt the encrypted image data by using the encryption and decryption engine to obtain decrypted image data, and display the decrypted image data by using the display screen.

[0145] In a sixth aspect, the embodiments of the present application provide a data transmission method, which facilitates improving the security of data transmission between a computing device and a physical input device.

[0146] As shown in Figure 5B The data transmission method provided by the embodiments of the present application is applied to a physical input device and includes the following steps.

[0147] S31, encrypting the received external input data by using the encryption and decryption engine in the physical input device;

[0148] S32, sending the encrypted data to a virtual machine on the computing device.

[0149] In the embodiments of the present application, the physical input device and the virtual machine work in a pass-through state, the physical input device can receive external input data, encrypt the input data by using the encryption and decryption engine to obtain encrypted data, and send the encrypted data to the virtual machine on the computing device, thereby realizing encrypted data transmission and further ensuring the security of the input data in the transmission process.

[0150] Optionally, when the physical input device encrypts the external input data by using the encryption and decryption engine and sends the encrypted data to the virtual machine, the physical input device is one of a keyboard, a mouse, a camera, a scanner, a light pen, a touch panel, a game stick, and a voice input device.

[0151] In daily applications, the computing device needs to receive encrypted data transmitted by various physical input devices when interacting with the outside world. In the embodiments of the present application, the physical input device can be any of the input devices described above, and the application range is wide. Therefore, the embodiments of the present application can realize encrypted data transmission between various input devices and the virtual machine, and improve the security of various input data in the transmission.

[0152] In a seventh aspect, the embodiments of the present application provide a computing device, which facilitates improving the security of data transmission between the computing device and a physical input / output device.

[0153] As shown in Figure 6As shown, the embodiment of the present application provides a computing device 4, which can include: a system on chip 41 and a memory 42, wherein the system on chip 41 can include: a first processor 411, a memory controller 412 and a second processor 413; wherein the first processor 411 is configured to run a virtual machine manager and a virtual machine, the virtual machine manager is configured to virtually output a virtual input / output device; the memory controller 412 is electrically connected with the first processor 411, and a first encryption / decryption engine is arranged in the memory controller 412. The memory 42 is electrically connected with the memory controller 412; the second processor 413 is configured to configure a first security key for the first encryption / decryption engine and a second security key for a second encryption / decryption engine in a target physical input / output device; wherein the first security key and the second security key are the same.

[0154] The virtual machine obtains, through the memory controller 412, encrypted data encrypted by the first encryption / decryption engine from an encrypted memory of the virtual machine, and writes the encrypted data into the virtual input / output device; the virtual machine manager reads the encrypted data from the virtual input / output device, and writes or sends the encrypted data to the target physical input / output device 300, so that the target physical input / output device 300 receives the encrypted data and decrypts the encrypted data through the second encryption / decryption engine, wherein the encrypted memory of the virtual machine is an encrypted storage area of the virtual machine in the memory 42.

[0155] Alternatively, the virtual machine manager receives the encrypted data from the target physical input / output device 300, and writes or sends the encrypted data to the virtual input / output device; the virtual machine reads the encrypted data from the virtual input / output device, and writes the encrypted data into the memory 42, and decrypts the encrypted data through the first encryption / decryption engine; wherein the encrypted data received by the virtual machine manager is generated by the target physical input / output device 300 by encrypting the received external input data through the second encryption / decryption engine.

[0156] The virtual machine in the embodiment of the present application and the physical input / output device work in a non-pass-through state, which is different from the aforementioned pass-through state. In the non-pass-through state, the virtual machine needs to read the encrypted data from the virtual machine memory and then store the encrypted data into the virtual input / output device (specifically, the virtual memory of the virtual input / output device). Then the virtual machine manager reads the encrypted data from the virtual input / output device and writes the encrypted data into the target physical input / output device 300. In the non-pass-through state, the physical input / output device can be a local device or a remote device.

[0157] The first processor 411 can be referred to as a processor core, and is configured to run a virtual machine and a virtual machine manager, where the virtual machine manager is configured to virtually output a virtual input / output device. The first processor 411 can be a 32-bit processor or a 64-bit processor.

[0158] The memory controller 412 is electrically connected to the first processor 411 and the memory 42, and thus can select different memory address spaces according to address information sent by the first processor 411, so that the virtual machine can write data into the selected memory space.

[0159] Further, the second processor 413 in the computing device can be referred to as a security processor or a platform security processor (PSP), and can also be referred to as a security co-processor. The security processor is a processor designed to help the system achieve functional safety.

[0160] The memory in this embodiment can be a memory applied to a server, for example, a memory with high stability and error correction performance by using ECC (Error Checking and Correcting), ChipKill, or hot plug technology.

[0161] The target physical input / output device 300 is a physical input / output device that needs to perform data transmission with the virtual machine.

[0162] In this embodiment, the second processor 413 is configured to configure a first security key for a first encryption and decryption engine in the memory controller 412, and to configure a second security key for a second encryption and decryption engine of the target physical input / output device 300, where the first security key is the same as the second security key. In this way, when the computing device performs data transmission with the target physical input / output device 300, the first security key can be used in the virtual machine to encrypt the data before transmitting the data to the physical input / output device, and then the second security key can be used in the physical input / output device to decrypt the encrypted data; or the second security key can be used in the physical input / output device to encrypt the data before transmitting the data to the virtual machine, and then the first security key can be used in the virtual machine to decrypt the encrypted data. In this way, even if the encrypted data is stolen by a malicious virtual machine manager during transmission, the malicious virtual machine manager cannot decrypt the encrypted data, thereby ensuring the security of data transmission between the computing device and the physical input / output device.

[0163] In one implementation, the security processor can configure a first security key for a first encryption / decryption engine in the memory controller 412, and the virtual machine can share the first security key to the target physical input / output device 300, so that the target physical input / output device 300 can configure the same security key for a second encryption / decryption engine. When the target physical input / output device 300 is a local output device, the virtual machine can obtain encrypted data encrypted by the first security key in the first encryption / decryption engine from a corresponding location in the memory 42 through the memory controller 412, and write the encrypted data into a virtual input / output device, and then the virtual machine manager reads the encrypted data from the virtual input / output device and writes the encrypted data into the target physical device, so that the target physical input / output device 300 decrypts the encrypted data by the second security key in the second encryption / decryption engine to obtain decrypted data for subsequent data output operation.

[0164] When the target physical input / output device 300 is a local input device, after receiving external data (e.g., externally inputted text information, audio information, etc.), the target physical input / output device 300 can first encrypt the external data by the second security key in the second encryption / decryption engine to generate encrypted data and store the encrypted data at a target location. The virtual machine manager can read the encrypted data from the target location and store the encrypted data into a virtual physical input / output device, the virtual machine reads the encrypted data from the virtual input / output device and stores the encrypted data into the memory, and performs decryption operation on the encrypted data by the first security key in the first encryption / decryption engine to obtain decrypted data in plaintext format for subsequent processing.

[0165] The data transmission process of the remote type physical input / output device is similar to that of the local type physical input / output device, and the difference is that, taking a remote type output device as an example, after the virtual machine reads encrypted data encrypted by the first security key in the first encryption / decryption engine from a corresponding location in the memory, the virtual machine calls a driver of the remote output device to store the encrypted data into a virtual physical input / output device, and then the virtual machine manager reads the encrypted data from the virtual input / output device and sends the encrypted data to a corresponding agent program of the remote physical output device through a network, so that the agent program writes the encrypted data into the physical input / output device. The above only takes a remote physical output device as an example for principle description, and when the remote physical device is an input device, the data transmission manner is similar to that of the remote output device, and the difference is only in the direction of data transmission, and the data transmission manner of the remote input device will not be described in detail herein.

[0166] In the prior art, since the physical input / output device does not support the encryption and decryption function, the computing device can only perform the data transmission in the plaintext format when performing the data transmission with the target physical input / output device 300, and once the input / output data is stolen by the virtual machine manager, a great security risk is caused.

[0167] In comparison, in the above two data transmission modes (input data and output data) of the present application, whether the local input / output device or the remote input / output device, when performing the data transmission with the virtual machine, whether the virtual machine sends data to the physical output device or the virtual machine receives data from the physical input device, the data needs to be transmitted in the ciphertext form, so that even if the ciphertext data is stolen by the malicious virtual machine manager, the encrypted data cannot be decrypted, thereby ensuring the security of the data in the transmission process.

[0168] In order to facilitate the target physical input / output device 300 to judge whether there is encrypted data in the first memory, in an embodiment of the present application, the virtual machine manager is further configured to virtually create a first virtual register for the first register in the target physical input / output device 300; the virtual machine is configured to assign a value to the first virtual register; the virtual machine manager reads the value of the first virtual register and assigns the read value of the first virtual register to the first register to indicate whether the decrypted data is stored in the first memory; wherein the first memory is located in the target physical input / output device 300.

[0169] In the embodiment of the present application, when the target physical input / output device 300 is an output device, the first memory is used to store the decrypted data written from the virtual machine manager, and the first memory can be located in the target physical input / output device 300.

[0170] The target physical input / output device 300 can also be provided with a first register, which is a flag register, and the first register is used to indicate whether there is decrypted data in the first memory. The virtual machine manager can virtually create a corresponding first virtual register for the first register in the target physical input / output device 300.

[0171] Generally, the default value of the first register is 0, indicating that there is no decrypted data in the first memory. When the virtual machine manager writes encrypted data into the first memory of the target physical input / output device 300, the virtual machine manager can read the value in the first virtual register and assign the value to the first register, wherein the first virtual register is pre-assigned by the virtual machine as 1. Then, the target physical input / output device 300 can read the value of the first register and judge whether there is decrypted data in the first memory according to the value of the first register.

[0172] Similarly, in order to facilitate the physical output device to obtain the position information and / or size information of the to-be-decrypted data in the first memory, in an embodiment of the present application, the virtual machine manager is further configured to virtually create a second virtual register for a second register in the target physical input / output device 300, and / or virtually create a third virtual register for a third register in the target physical input / output device 300;

[0173] The virtual machine is further configured to assign values to the second virtual register and / or the third virtual register;

[0174] The virtual machine manager reads the value of the second virtual register, and assigns the read value of the second virtual register to the second register to indicate the position of the to-be-decrypted data stored in the first memory; and / or,

[0175] The virtual machine manager reads the value of the third virtual register, and assigns the read value of the third virtual register to the third register to indicate the size of the to-be-decrypted data stored in the first memory.

[0176] In the embodiment of the present application, when the target physical input / output device 300 is an output device, the second register and / or the third register can also be arranged in the target physical input / output device 300, and when the virtual machine manager writes encrypted data into the first memory of the target physical input / output device 300, the virtual machine manager can read the value in the second virtual register and / or the third virtual register, and assign the value to the second register and / or the third register, wherein the second virtual register and / or the third virtual register are pre-assigned by the virtual machine according to actual needs.

[0177] The second register is used to indicate the position of the to-be-decrypted data, and the third register is used to indicate the size of the to-be-decrypted data. For example, when the target physical input / output device 300 is a display device, the value in the second register is used to indicate the starting display position of the display data on the display screen, i.e., the starting horizontal coordinate and the starting vertical coordinate of the starting pixel point. The value in the third register is used to indicate the length occupied by the display data in the horizontal coordinate direction and the vertical coordinate direction, i.e., how many pixel points are occupied. The target physical input / output device 300 can obtain the position information and the size information of the to-be-decrypted data by reading the values of the second register and the third register, and then can display the decrypted to-be-decrypted data at the corresponding position on the display screen.

[0178] Optionally, in an embodiment of the present application, the target physical input / output device 300 is a display device or a printing device; when the target physical input / output device 300 is a display device, the first memory is a display memory.

[0179] In the embodiment of the present application, the target physical input / output device 300 can be a display device or a printing device to realize display output or printing output. For example, the physical output device can be a display device, and the first memory can be a display memory for storing the image data to be decrypted. Thus, the display memory in the display device can receive the image data to be decrypted from the virtual machine and decrypt the image data, and then output the decrypted image data, thereby realizing secure transmission of the image data.

[0180] Optionally, in an embodiment of the present application, the target physical input / output device 300 is one of a keyboard, a mouse, a camera, a scanner, a light pen, a touch panel, a game stick, and a voice input device when the virtual machine manager receives the encrypted data from the target physical input / output device 300.

[0181] In daily applications, a computing device needs to receive encrypted data transmitted by various physical input devices when interacting with the outside world. In the embodiment of the present application, the target physical input / output device 300 can be any of the above input devices when it is used as an input device, and thus has a wide range of applications. Thus, the embodiment of the present application can realize encrypted data transmission between various input devices and the virtual machine, and improve the security of various input data in transmission.

[0182] In the eighth aspect, the embodiment of the present application provides a physical output device, which can improve the security of data transmission between a computing device and a physical output device.

[0183] As shown in FIG. 8, the physical output device provided by the embodiment of the present application can include an input / output interface 51, a decryption engine 52, and an output unit 53. Figure 7 The input / output interface 51 is electrically connected with an input / output interface of a computing device, and receives encrypted data sent by a virtual machine manager on the computing device. The decryption engine 52 decrypts the encrypted data received from the virtual machine manager, and the decrypted data is output by the output unit 53.

[0184] In the embodiment of the present application, the physical output device and the virtual machine work in a non-pass-through state, and the physical output device can be a local device or a remote device.

[0185] The physical output device is electrically connected with the computing device through the input-output interface. When the virtual machine needs to output data through the physical output device, the physical output device can receive the encrypted data written by the virtual machine manager through the input-output interface 51, and decrypt the encrypted data by using the encryption and decryption engine. After obtaining the decrypted data, the decrypted data can be further output through the output unit 53. Even if the encrypted data is stolen by a malicious virtual machine manager during transmission, the malicious virtual machine manager cannot decrypt the encrypted data, so that the security of data transmission between the computing device and the physical input-output device is ensured.

[0186] When the physical output device is a local device or a remote device, the transmission path of the encrypted data can refer to the related description in the sixth aspect embodiment, which will not be repeated here.

[0187] In order to facilitate the physical output device to judge whether there is encrypted data in the first memory, in an embodiment of the present application, the physical output device can further include a first memory and a first register; wherein the first memory is used to store the encrypted data sent or written by the virtual machine manager; the first register is assigned by the virtual machine manager; and the value of the first register is used to indicate whether there is decrypted data in the first memory.

[0188] In the embodiment of the present application, the first register and the first memory are provided in the physical output device. The first register is a flag register, and the first memory is used to store the encrypted data written (for a local physical output device) or sent (for a remote physical output device) from the virtual machine manager. The first register is used to indicate whether there is decrypted data in the first memory. For example, the default value of the first register is 0. When the virtual machine writes the encrypted data into the first memory of the physical output device, the value of the first register can be assigned as 1. The virtual machine can assign the value of the first virtual register as 1, and then the virtual machine manager reads the value in the first virtual register and assigns the value to the first register. Further, the target physical input-output device 300 can read the value of the first register, and according to the value of the first register, it can be judged whether there is decrypted data in the first memory. When there is decrypted data, the decryption operation can be performed by using the encryption and decryption engine, otherwise, the decryption operation is not needed to be performed.

[0189] Similarly, in order to facilitate the physical output device in obtaining the location and / or size information of the data to be decrypted in the first memory, in one embodiment of this application, the physical output device may further include: a second register and / or a third register; wherein the second register and the third register are assigned values ​​by the virtual machine manager; the value of the second register is used to indicate the location of the data to be decrypted stored in the first memory; and the value of the third register is used to indicate the size of the data to be decrypted stored in the first memory.

[0190] In this embodiment of the application, the physical output device may also be provided with a second register and / or a third register. When the virtual machine manager writes encrypted data to the first memory of the physical output device, the virtual machine can assign values ​​to the second virtual register and / or the third virtual register as needed. Then the virtual machine manager reads the values ​​in the second virtual register and / or the third virtual register and assigns the values ​​to the second register and / or the third register.

[0191] The second register indicates the location of the data to be decrypted, and the third register indicates the size of the data. For example, when the physical output device is a display device, the value in the second register indicates the starting display position of the data on the screen, i.e., the starting horizontal and vertical coordinates of the starting pixel. The value in the third register indicates the length occupied by the data in the horizontal and vertical directions, i.e., how many pixels it occupies. By reading the values ​​of the second and third registers, the physical output device can obtain the location and size information of the data to be decrypted, and then decrypt the data and display it at the corresponding position on the screen.

[0192] Optionally, in one embodiment of this application, the physical output device is a display device or a printing device; wherein, when the physical output device is a display device, the first memory is video memory.

[0193] In this embodiment, the physical output device can be a display device or a printing device to achieve display output or print output. For example, the physical output device can be a display device, and the first memory can be video memory, used to store the image data to be decrypted. Therefore, the video memory in the display device can receive the image data to be decrypted from the virtual machine, decrypt it, and then output the decrypted image data, thereby realizing the secure transmission of image data.

[0194] Ninthly, embodiments of this application provide a physical input device that facilitates improved security of data transmission between a computing device and a physical input device.

[0195] like Figure 8As shown, the embodiment of the present application provides a physical input device, which can include: an input unit 61, configured to receive external data input; an encryption and decryption engine 62, configured to encrypt the external input data received by the input unit, and send the encrypted external input data to the virtual machine manager through the input and output interface; and an input and output interface 63, configured to be electrically connected with the input and output interface of the computing device, and send the encrypted data to the virtual machine manager on the computing device.

[0196] In the embodiment of the present application, the physical input device and the virtual machine work in a non-pass-through state, and the physical output device is a local device or a remote device.

[0197] The physical input device and the computing device are electrically connected through the input and output interface. When the physical input device sends external input data to the computing device, the encryption and decryption engine in the physical input device can encrypt the external data received by the input unit, and send the encrypted data to the virtual machine manager through the input and output interface, so as to realize encrypted transmission of data and improve the security of data transmission between the computing device and the physical input device.

[0198] Optionally, in an embodiment of the present application, the physical input device is one of the following: a keyboard, a mouse, a camera, a scanner, a light pen, a touch panel, a game stick, and a voice input device.

[0199] In daily applications, the computing device needs to receive encrypted data transmitted by various physical input devices when interacting with the outside world. In the embodiment of the present application, the target physical input and output device 300 can be any of the above input devices when serving as an input device, and has a wide range of applications. Therefore, through the embodiment of the present application, encrypted data transmission of various input devices and virtual machines can be realized, and the security of various input data in transmission can be improved.

[0200] In a tenth aspect, the embodiment of the present application provides a data transmission method, which facilitates improving the security of data transmission between a computing device and a physical input and output device.

[0201] As shown, the embodiment of the present application provides a data transmission method, which is applied to a computing device, and can include: Figure 9A

[0202] S41, a virtual machine manager virtually creates a virtual input and output device;

[0203] S42, the virtual machine acquires encrypted data encrypted by the first encryption and decryption engine from the encrypted memory of the virtual machine through a memory controller, and writes the encrypted data into the virtual input and output device;

[0204] ​S43, the virtual machine manager reads the encrypted data from the virtual input / output device and writes or sends the encrypted data to a target physical input / output device 300, so that the target physical input / output device 300 receives the encrypted data and decrypts the encrypted data by a second encryption / decryption engine, wherein the encrypted memory of the virtual machine is an encrypted storage area of the virtual machine in the memory.

[0205] In the embodiments of the present application, the virtual machine and the target physical output device work in a non-pass-through state, and the target physical input / output device 300 can be a local device or a remote device. The virtual machine manager can virtually output a virtual input / output device corresponding to the physical input / output device.

[0206] When the target physical input / output device 300 is a local output device, the virtual machine can obtain encrypted data encrypted by a first security key in the first encryption / decryption engine from a corresponding position in the memory through the memory controller, and write the encrypted data into the virtual input / output device. Then the virtual machine manager reads the encrypted data from the virtual input / output device and writes the encrypted data into the target physical device, so that the target physical input / output device 300 decrypts the encrypted data by a second security key in the second encryption / decryption engine to obtain decrypted data for subsequent data output operation.

[0207] The data transmission process of the remote physical input / output device is similar to that of the local physical input / output device, and the difference is that, taking the remote output device as an example, after the virtual machine reads the encrypted data encrypted by the first security key in the first encryption / decryption engine from the corresponding position in the memory, the virtual machine calls the driver of the remote output device to store the encrypted data into the virtual physical input / output device. Then the virtual machine manager reads the encrypted data from the virtual input / output device and sends the encrypted data to the agent program corresponding to the physical output device through the network, so that the agent program writes the encrypted data into the physical input / output device.

[0208] In the prior art, since the physical input / output device does not support encryption / decryption function, the computing device can only perform data transmission in plaintext format when performing data transmission with the target physical input / output device 300. Once the input / output data is stolen by a malicious virtual machine manager, a great security risk will be caused.

[0209] In comparison, in the embodiment of the present application, whether it is a local output device or a remote output device, when data is transmitted to the virtual machine, the data is transmitted in the form of ciphertext, specifically, the data is encrypted by using a first security key in the virtual machine and then transmitted to the physical input / output device, and then the encrypted data can be decrypted by using a second security key in the physical input / output device, so that even if the ciphertext data is stolen by the virtual machine manager, the encrypted data cannot be decrypted, thereby ensuring the security of the data in the transmission process.

[0210] In order to facilitate the target physical input / output device 300 to determine whether there is encrypted data in the first memory, in an embodiment of the present application, when the virtual machine manager virtualizes a virtual input / output device, the method can further include that the virtual machine manager virtualizes a first virtual register for a first register in the target physical input / output device 300; the virtual machine assigns a value to the first virtual register; the virtual machine manager reads the value of the first virtual register and assigns the read value of the first virtual register to the first register to indicate whether the first memory stores the data to be decrypted; wherein the first memory is located in the target physical input / output device 300.

[0211] In the embodiment of the present application, when the target physical input / output device 300 is an output device, the target physical input / output device 300 can further be provided with a first register, which is a flag register, and the first register is used to indicate whether there is data to be decrypted in the first memory. The virtual machine manager can virtualize a corresponding first virtual register for the first register in the target physical input / output device 300.

[0212] Generally, the default value of the first register is 0, indicating that there is no data to be decrypted in the first memory, and the value of the first register is 1, indicating that there is data to be decrypted in the first memory. When the virtual machine manager writes encrypted data into the first memory of the target physical input / output device 300, the virtual machine manager can read the value in the first virtual register and assign the value to the first register, wherein the first virtual register is pre-assigned a value of 1 by the virtual machine. Therefore, the target physical input / output device 300 can read the value of the first register and determine whether there is data to be decrypted in the first memory according to the value of the first register.

[0213] In order to facilitate the target physical input / output device 300 to obtain the position information and size information of the encrypted data in the first memory, in an embodiment of the present application, when the virtual machine manager virtualizes a virtual input / output device, the method can further include that the virtual machine manager virtualizes a first virtual register for a first register in the target physical input / output device 300; the virtual machine assigns a value to the first virtual register; the virtual machine manager reads the value of the first virtual register and assigns the read value of the first virtual register to the first register to indicate whether the first memory stores the data to be decrypted; wherein the first memory is located in the target physical input / output device 300.

[0214] The virtual machine manager virtually creates a second virtual register for a second register in the target physical input / output device 300 and / or virtually creates a third virtual register for a third register in the target physical input / output device 300; the virtual machine assigns values to the second virtual register and / or the third virtual register; the virtual machine manager reads the value of the second virtual register and assigns the read value of the second virtual register to the second register to indicate the location of the to-be-decrypted data stored in the first memory; and / or,

[0215] The virtual machine manager reads the value of the third virtual register and assigns the read value of the third virtual register to the third register to indicate the size of the to-be-decrypted data stored in the first memory.

[0216] In the embodiments of the present application, when the target physical input / output device 300 is an output device, the target physical input / output device 300 can further be provided with a second register and / or a third register. When the virtual machine manager writes encrypted data into the first memory of the target physical input / output device 300, the virtual machine manager can read the value in the second virtual register and / or the third virtual register and assign the value to the second register and / or the third register, where the second virtual register and / or the third virtual register are pre-assigned by the virtual machine according to actual needs.

[0217] The second register is used to indicate the location of the to-be-decrypted data, and the third register is used to indicate the size of the to-be-decrypted data. For example, when the target physical input / output device 300 is a display device, the value in the second register is used to indicate the starting display location of the display data on the display screen, i.e., the starting horizontal coordinate and the starting vertical coordinate of the starting pixel point. The value in the third register is used to indicate the length occupied by the display data in the horizontal coordinate direction and the vertical coordinate direction, i.e., how many pixel points are occupied. The target physical input / output device 300 can obtain the location information and the size information of the to-be-decrypted data by reading the values of the second register and the third register, and then can display the decrypted data at the corresponding location on the display screen.

[0218] Optionally, in an embodiment of the present application, the target physical input / output device 300 is a display device, and the encrypted data is encrypted image data; wherein the virtual machine manager writes or sends the read encrypted data to the target physical input / output device 300, so that the target physical input / output device 300 decrypts the encrypted data by using a second encryption / decryption engine, which can include that the virtual machine manager writes or sends the read encrypted image data to the target physical input / output device 300, so that the target physical input / output device 300 decrypts the encrypted image data by using a second encryption / decryption engine and then displays.

[0219] In an embodiment of the present application, the target physical input / output device 300 can be a display device, and the encrypted data can be encrypted image data.

[0220] When the display device is a local display device, the virtual machine manager can write the read encrypted image data into the display device, specifically into the memory of the display device, the display device can receive the encrypted image data, decrypt the encrypted image data by using a second encryption / decryption engine to obtain decrypted image data, and display the decrypted image data by using a display screen.

[0221] When the display device is a remote display device, the virtual machine can call the driver of the remote output device to store the encrypted image data into a virtual physical input / output device, and then the virtual machine manager reads the encrypted image data from the virtual input / output device and sends the encrypted image data to the corresponding agent program of the physical input / output device through a network, so that the agent program writes the encrypted image data into the physical input / output device.

[0222] In an eleventh aspect, an embodiment of the present application provides a data transmission method, which facilitates to improve the security of data transmission between a computing device and a physical input / output device.

[0223] As shown in Figure 9B , an embodiment of the present application provides a data transmission method applied to a computing device, which can include:

[0224] S51, a virtual machine manager virtually outputs a virtual input / output device;

[0225] S52, the virtual machine manager receives encrypted data from the target physical input / output device 300 and writes or sends the encrypted data to the virtual input / output device;

[0226] S53, the virtual machine reads the encrypted data from the virtual input / output device and writes the encrypted data into memory, and decrypts the encrypted data by using the first encryption / decryption engine; wherein the encrypted data received by the virtual machine manager is generated by the target physical input / output device 300 by encrypting the received external input data by using the second encryption / decryption engine.

[0227] In the embodiment of the present application, when the target physical input / output device 300 is a local input device, after receiving external data (for example, externally inputted text information, audio information, etc.), the target physical input / output device 300 can first encrypt the external data by using the second security key in the second encryption / decryption engine, thereby generating encrypted data and storing the encrypted data in a target position. The virtual machine manager can read the encrypted data from the target position and store the encrypted data into the virtual physical input / output device, the virtual machine reads the encrypted data from the virtual input / output device and stores the encrypted data into memory, and performs a decryption operation on the encrypted data by using the first security key in the first encryption / decryption engine, thereby obtaining decrypted data in plaintext format for subsequent processing. In this way, even if the encrypted data is stolen by a malicious virtual machine manager during transmission, the malicious virtual machine manager cannot decrypt the encrypted data, thereby ensuring the security of data transmission between the computing device and the physical input / output device.

[0228] In the embodiment of the eleventh aspect, the data transmission process is described by taking a remote physical output device as an example. When the remote physical device is an input device, the data transmission manner is similar to that of the remote output device, and the difference is only in the direction of data transmission. Therefore, the data transmission manner of the remote input device is not described in detail herein.

[0229] In the twelfth aspect, the embodiment of the present application provides a data transmission method, which can improve the security of data transmission between a computing device and a physical output device.

[0230] As shown in FIG. 6, the embodiment of the present application provides a data transmission method applied to a physical output device, which includes the following steps. Figure 10A

[0231] S61, receiving encrypted data sent or written by a virtual machine manager on a computing device;

[0232] S62, decrypting the encrypted data by using an encryption / decryption engine in the physical output device.

[0233] In the embodiment of the present application, the physical output device and the virtual machine work in a non-pass-through state, and the physical output device is a local device or a remote device.

[0234] ​The physical output device stores the encrypted data in the memory, which can be written by a virtual machine manager on the computing device (for a local physical output device) or transmitted over a network (for a remote physical output device). The physical output device can then decrypt the encrypted data using the encryption / decryption engine to obtain decrypted data. Even if the encrypted data is stolen by a malicious virtual machine manager during transmission, the malicious virtual machine manager cannot decrypt the encrypted data, thereby ensuring the security of data transmission between the computing device and the physical output device.

[0235] The virtual machine transmits data to the target output device in the form of ciphertext, so that even if the ciphertext data is stolen by a malicious virtual machine manager, the malicious virtual machine manager cannot decrypt the encrypted data, thereby ensuring the security of data during transmission.

[0236] To facilitate the physical output device to determine whether there is encrypted data in the first memory, in an embodiment of the present application, the physical output device includes a first memory and a first register.

[0237] The method further includes storing the received encrypted data in the first memory and receiving a value assignment operation of the first register by the virtual machine manager. The value of the first register indicates whether there is decrypted data in the first memory.

[0238] In an embodiment of the present application, the output device is provided with a first register and a first memory. The first register is a flag register, the first memory is used to store encrypted data written from the virtual machine manager, and the first register is used to indicate whether there is decrypted data in the first memory.

[0239] Generally, the default value of the first register is 0, indicating that there is no decrypted data in the first memory. When the value of the first register is 1, it indicates that there is decrypted data in the first memory. When the first memory of the physical output device receives encrypted data written by the virtual machine manager, the virtual machine manager can read the value in the first virtual register and assign the value to the first register, where the first virtual register is pre-assigned to 1 by the virtual machine. Therefore, after receiving the value assignment operation of the first register by the virtual machine manager, the physical output device can read the value of the first register and determine whether there is decrypted data in the first memory according to the value of the first register. When there is decrypted data, the decryption operation can be performed using the encryption / decryption engine, otherwise the decryption operation does not need to be performed.

[0240] Similarly, in order to facilitate the physical output device to obtain the position information and / or size information of the to-be-decrypted data in the first memory, in an embodiment of the present application, the physical output device further comprises a second register and / or a third register; wherein the method further comprises: receiving the assignment operation of the virtual machine manager to the second register and / or the third register; the value of the second register is used to indicate the position of the to-be-decrypted data stored in the first memory; and the value of the third register is used to indicate the size of the to-be-decrypted data stored in the first memory.

[0241] In an embodiment of the present application, the second register and / or the third register and the first memory can also be arranged in the physical output device; the first memory is used to store the to-be-decrypted data received from the virtual machine manager; the second register is used to indicate the position of the to-be-decrypted data; and the third register is used to indicate the size of the to-be-decrypted data.

[0242] For example, when the physical output device is a display device, the second register is used to indicate the starting display position of the display data on the display screen, i.e. the horizontal coordinate and vertical coordinate of the starting pixel point. The third register is used to indicate the length of the display data in the horizontal coordinate direction and the vertical coordinate direction, i.e. how many pixel points are occupied. Therefore, after receiving the assignment operation of the virtual machine manager to the second register and / or the third register, the physical output device can read the values of the second register and / or the third register, and display the to-be-decrypted data to the corresponding position on the display screen. When the physical output device is a printing device, the virtual machine manager can set the second register and the third register in the same way, so that after receiving the assignment operation, the physical output device can read the values of the two registers, and thus can control the specific area of the printing content.

[0243] Optionally, in an embodiment of the present application, the physical output device is a display device, and the first memory is a display memory; wherein the receiving of the encrypted data sent or written by the virtual machine manager on the computing device comprises: receiving the encrypted image data sent or written by the virtual machine manager on the computing device; and after receiving the encrypted data sent or written by the virtual machine manager on the computing device, the method further comprises: the display device displays the decrypted image data obtained by decrypting the received encrypted image data by using the encryption and decryption engine.

[0244] In an embodiment of the present application, the display device can receive the encrypted image data sent (for a remote type of display device) or written (for a local type of display device) by the virtual machine manager, and decrypt the encrypted image data by using the encryption and decryption engine to obtain decrypted image data, and display the decrypted image data by using the display screen.

[0245] In a thirteenth aspect, an embodiment of the present application provides a data transmission method, which can improve the security of data transmission between a computing device and a physical input device.

[0246] As shown in Figure 10B In an embodiment of the present application, a data transmission method is provided, which is applied to a physical input device and includes the following steps:

[0247] S71, encrypting the received external input data by using an encryption and decryption engine in the physical input device;

[0248] S72, sending the encrypted data to a virtual machine on the computing device.

[0249] In an embodiment of the present application, the physical input device can receive external input data, encrypt the input data by using an encryption and decryption engine, obtain encrypted data, and send the encrypted data to a virtual machine on the computing device, thereby completing the encrypted transmission of the input data, and even if the ciphertext data is stolen by a malicious virtual machine manager, the encrypted data cannot be decrypted, thereby ensuring the security of the data in the transmission process.

[0250] Optionally, in an embodiment of the present application, when the physical input device encrypts the external input data by using the encryption and decryption engine and sends the encrypted data to the computing device, the physical input device is one of a keyboard, a mouse, a camera, a scanner, a light pen, a touch panel, a game stick, and a voice input device.

[0251] In daily applications, when a computing device interacts with the outside world, it needs to receive encrypted data transmitted by various physical input devices. In an embodiment of the present application, when the target physical input and output device 300 is used as an input device, it can be any of the above input devices, and has a wide range of applications. Therefore, through the embodiment of the present application, encrypted data transmission between various input devices and virtual machines can be realized, and the security of various input data in the transmission process is improved.

[0252] In a fourteenth aspect, an embodiment of the present application provides a computing device, which facilitates the security of data transmission between the computing device and a physical input and output device.

[0253] Figure 11 A structure diagram of a computing device and a target physical input and output device provided in an embodiment of the present application is shown in Figure 11As shown, the computing device 11 in the embodiment of the present application is basically the same as the computing device 1 in the embodiment of the first aspect, except that the specified region in the memory in the embodiment of the present application is used to store the encrypted data written by the virtual machine, which has the same function as the first memory in the embodiment of the first aspect. The encrypted data is pre-encrypted by the first encryption and decryption engine in the memory controller and stored in the specified region. When the encrypted data is transmitted, the encrypted data can be read from the specified region and transmitted to the second encryption and decryption engine, so that the second encryption and decryption engine decrypts the encrypted data. In one example, the encrypted data can be read from the specified region by using the DMA technology.

[0254] Optionally, in one embodiment of the present application, similar to the embodiment of the first aspect, the virtual machine in the embodiment of the present application can also be used to assign a value to the first register in the target physical input and output device 400, to indicate whether the decrypted data is stored in the specified region. The remaining part of the embodiment of the present application is the same as the description in the embodiment of the first aspect, and will not be repeated here. Therefore, the target physical input and output device 200 can read the value of the first register, and according to the value of the first register, it can be determined whether the decrypted data exists in the specified region. If it exists, the target physical input and output device 400 can perform the decryption operation by using the second encryption and decryption engine, otherwise, it does not need to perform the decryption operation.

[0255] Optionally, in one embodiment of the present application, similar to the embodiment of the first aspect, the virtual machine in the embodiment of the present application can also be used to assign a value to the second register in the target physical input and output device 400, to indicate the position of the decrypted data stored in the specified region; and / or assign a value to the third register in the target physical input and output device 400, to indicate the size of the decrypted data stored in the specified region. For example, when the target physical input and output device 400 is a display device, the value in the second register is used to indicate the starting display position of the display data on the display screen, i.e. the starting horizontal coordinate and the starting vertical coordinate of the starting pixel point. The value in the third register is used to indicate the length occupied by the display data in the horizontal coordinate direction and the vertical coordinate direction, i.e. how many pixel points are occupied.

[0256] Correspondingly, the embodiment of the present application also provides a physical output device. The physical output device in the embodiment of the present application is basically the same as the physical output device in the embodiment of the first aspect, except that the specified region in the memory in the embodiment of the present application is used to store the encrypted data written by the virtual machine, which has the same function as the first memory in the embodiment of the first aspect. The encrypted data is pre-encrypted by the first encryption and decryption engine in the memory controller and stored in the specified region. When the encrypted data is transmitted, the encrypted data can be read from the specified region and transmitted to the second encryption and decryption engine, so that the second encryption and decryption engine decrypts the encrypted data. In one example, the encrypted data can be read from the specified region by using the DMA technology. Figure 2The physical output device shown is basically the same, except that in the present embodiment, the input / output interface 21 is configured to read encrypted data directly from a designated area of the memory of the computing device; the encryption / decryption engine 22 is configured to decrypt the encrypted data read directly from the designated area of the memory of the computing device, and the decrypted data is output through the output unit; and the output unit 23 is configured to output the received data. In the present embodiment, the data transmitted between the computing device and the physical input / output device is encrypted data, which can improve the security of data transmission between the computing device and the physical input / output device.

[0257] The present embodiment also provides a data transmission method, which is applied to a physical input / output device and includes reading encrypted data from a designated area of the memory of a computing device and decrypting the encrypted data through an encryption / decryption engine in the physical input / output device. In the present embodiment, the data transmitted between the computing device and the physical input / output device is encrypted data, which can improve the security of data transmission between the computing device and the physical input / output device.

[0258] In a fifteenth aspect, the present embodiment provides a data transmission system, which can improve the security of data transmission between a computing device and a physical input / output device.

[0259] The present embodiment provides a data transmission system, which includes a computing device and a physical output device connected thereto; wherein the computing device is any one of the computing devices provided in the present embodiment, and the physical output device is any one of the physical output devices provided in the present embodiment; or the data transmission system includes a computing device and a physical input device connected thereto; wherein the computing device is any one of the computing devices provided in the present embodiment, and the physical input device is any one of the physical input devices provided in the present embodiment.

[0260] In the present embodiment, even if the encrypted data is stolen by a malicious virtual machine manager during transmission, the malicious virtual machine manager cannot decrypt the encrypted data, thus ensuring the security of data transmission between the computing device and the physical input / output device.

[0261] It is to be noted that, in the present document, relational terms such as first and second, and the like can be used solely to distinguish one entity or action from another entity or action without necessarily requiring or implying any actual such relationship or order between such entities or actions. Moreover, the terms "comprises", "comprising", or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but can include other elements not expressly listed or inherent to such process, method, article, or apparatus. An element proceeded by "comprises... a" does not, without more constraints, exclude the presence of additional identical elements in the process, method, article, or apparatus that comprises the element.

[0262] Each of the embodiments in the present specification is described in a related manner, and the same or similar parts between the embodiments can be referred to each other. Each of the embodiments focuses on the difference from other embodiments.

[0263] Especially, for the device embodiments, since they are basically similar to the method embodiments, the description is relatively simple, and the relevant parts can be referred to the part of the description of the method embodiments.

[0264] For the convenience of description, the above device is described in various units / modules respectively according to functions. Of course, in the implementation of the present application, the functions of each unit / module can be implemented in the same or multiple software and / or hardware.

[0265] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiments can be completed by a computer program instructing related hardware. The program can be stored in a computer readable storage medium, and when the program is executed, the processes of the above-mentioned embodiments can be included. The storage medium can be a magnetic disc, an optical disc, a read-only memory (ROM) or a random access memory (RAM), etc.

[0266] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited to this. Any changes or replacements within the technical scope disclosed in the present application can be easily thought by those skilled in the art, and should be covered in the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.

Claims

1. A computing device, characterized in that, include: The first processor is used to run the virtual machine; A memory controller is electrically connected to the first processor, and a first encryption / decryption engine is provided in the memory controller; The memory is electrically connected to the memory controller; The second processor is configured to configure a first security key for the first encryption / decryption engine and a second security key for the second encryption / decryption engine in the target physical input / output device; wherein the first security key and the second security key are the same, and wherein the second processor is a security processor; The virtual machine retrieves encrypted data, encrypted by the first encryption / decryption engine, from the memory via the memory controller, and writes the encrypted data to the target physical input / output device, so that the target physical input / output device can decrypt the encrypted data via the second encryption / decryption engine; or... The virtual machine sends the data to be encrypted to the memory controller, encrypts it using the first encryption / decryption engine, and writes it to a designated area of ​​the memory. The target physical input / output device then reads the encrypted data from the designated area and decrypts it using the second encryption / decryption engine; or... The virtual machine receives encrypted data sent by the target physical input / output device and decrypts the encrypted data through the first encryption / decryption engine; the encrypted data sent by the target physical input / output device is generated by the target physical input / output device encrypting received external input data through the second encryption / decryption engine. When the virtual machine writes the encrypted data to the target physical input / output device, the target physical input / output device is a display device or a printing device.

2. The computing device according to claim 1, characterized in that, The virtual machine is also used to: assign a value to a first register in the target physical input / output device to indicate whether there is data to be decrypted stored in the first memory or the specified area; wherein the first memory is located in the target physical input / output device and is used to store encrypted data written by the virtual machine.

3. The computing device according to claim 1, characterized in that, The virtual machine is also used for: Assign a value to the second register in the target physical input / output device to indicate the location of the data to be decrypted stored in the first memory or the designated area; and / or, Assign a value to the third register in the target physical input / output device to indicate the size of the data to be decrypted stored in the first memory or the designated area; The first memory is located in the target physical input / output device.

4. The computing device according to claim 2, characterized in that, When the target physical input / output device reads encrypted data from the designated area, the target physical input / output device is a display device or a printing device, so that after the target physical input / output device decrypts the encrypted data through the second encryption / decryption engine, it displays or prints the decrypted data. When the target physical input / output device is a display device, the first memory is video memory.

5. The computing device according to claim 1, characterized in that, When the virtual machine receives encrypted data sent by the target physical input / output device, the target physical input / output device is one of the following: Keyboard, mouse, camera, scanner, light pen, touch panel, joystick, voice input device.

6. A physical output device, characterized in that, include: The output unit is used to output the received data; Input / output interface, used to electrically connect to the input / output interface of a computing device, and to receive encrypted data sent by a virtual machine or virtual machine manager on the computing device, or to directly read encrypted data from a specified area of ​​the memory of the computing device; An encryption / decryption engine is used to decrypt encrypted data received from a virtual machine or virtual machine manager, or encrypted data read directly from a specified area in the memory of the computing device, and the decrypted data is output through the output unit. The virtual machine or virtual machine manager is run by a first processor, and the computing device includes a second processor, which is a security processor. The second processor is used to configure a first security key for a first encryption / decryption engine and a second security key for the encryption / decryption engine in the physical output device. The first security key and the second security key are the same. The first encryption / decryption engine is used to encrypt the data to be encrypted and write it to the physical output device or to a specified area in the memory, so that the physical output device can read the encrypted data from the specified area. The physical output device is a display device or a printing device.

7. The physical output device according to claim 6, characterized in that, Also includes: First memory and first register; The first memory is used to store encrypted data sent or written by the virtual machine or virtual machine manager; The first register is assigned a value by the virtual machine or the virtual machine manager; the value of the first register is used to indicate whether there is data to be decrypted stored in the first memory.

8. The physical output device according to claim 7, characterized in that, Also includes: A second register and / or a third register; wherein the second register and the third register are assigned values ​​by the virtual machine or the virtual machine manager; The value of the second register is used to indicate the location of the data to be decrypted stored in the first memory; The value of the third register is used to indicate the size of the data to be decrypted stored in the first memory.

9. The physical output device according to claim 7, characterized in that, When the physical output device is a display device, the first memory is video memory.

10. A physical input device, characterized in that, include: The input unit is used to receive external data input; Input / output interface, used to electrically connect to the input / output interface of a computing device and send encrypted data to a virtual machine or virtual machine manager on the computing device; An encryption / decryption engine is used to encrypt the external input data received by the input unit, and the encrypted external input data is sent to the virtual machine or virtual machine manager through the input / output interface; The virtual machine or virtual machine manager is run by a first processor, and the computing device includes a second processor, which is a security processor. The second processor is used to configure a first security key for a first encryption / decryption engine and a second security key for the encryption / decryption engine in the physical input device. The first security key and the second security key are the same. The first encryption / decryption engine is used to decrypt the encrypted data received from the input / output interface.

11. The physical input device according to claim 10, characterized in that, The physical input device is one of the following: Keyboard, mouse, camera, scanner, light pen, touch panel, joystick, voice input device.

12. A data transmission method, characterized in that, Applied to computing devices, including: The memory controller reads data encrypted by a first encryption / decryption engine from memory; the memory controller sends the encrypted data to the virtual machine; the virtual machine writes the encrypted data to a target physical input / output device, so that the target physical input / output device receives the encrypted data and decrypts it using a second encryption / decryption engine; or... The virtual machine sends the data to be encrypted to the memory controller, encrypts it using a first encryption / decryption engine, and writes it to a designated area of ​​memory. The target physical input / output device then reads the encrypted data from this designated area and decrypts it using a second encryption / decryption engine; or... The virtual machine receives encrypted data sent by the target physical input / output device and decrypts the encrypted data through a first encryption / decryption engine; the encrypted data sent by the target physical input / output device is generated by the target physical input / output device encrypting the received external input data through a second encryption / decryption engine. The virtual machine is run by a first processor, and the computing device includes a second processor, which is a security processor. The second processor is used to configure a first security key for the first encryption / decryption engine and a second security key for the second encryption / decryption engine in the target physical input / output device. The first security key and the second security key are the same. When the virtual machine writes the encrypted data to the target physical input / output device, the target physical input / output device is a display device or a printing device.

13. The method according to claim 12, characterized in that, After the virtual machine writes the encrypted data to the target physical input / output device, the method further includes: The virtual machine assigns a value to the first register in the target physical input / output device to indicate whether there is data to be decrypted stored in the first memory; wherein, the first memory is located in the target physical input / output device and is used to store the encrypted data written by the virtual machine.

14. The method according to claim 12, characterized in that, After the virtual machine writes the encrypted data to the target physical input / output device, the method further includes: The virtual machine assigns a value to the second register in the target physical input / output device to indicate the location of the data to be decrypted stored in the first memory; and / or, The virtual machine assigns a value to the third register in the target physical input / output device to indicate the size of the data to be decrypted stored in the first memory; The first memory is located in the target physical input / output device.

15. The method according to claim 12, characterized in that, The target physical input / output device is a display device; The virtual machine writes the encrypted data to the target physical input / output device, including: The virtual machine writes encrypted image data to the display device, so that the display device receives the encrypted image data and displays it after decrypting it through a second encryption / decryption engine.

16. A data transmission method, characterized in that, Applied to physical input / output devices, including: Receive encrypted data sent or written by a virtual machine or virtual machine manager on a computing device, and decrypt the encrypted data using an encryption / decryption engine in the physical input / output device; or... Encrypted data is read from a designated area of ​​memory on the computing device and decrypted using an encryption / decryption engine in the physical input / output device; or... The received external input data is encrypted by the encryption / decryption engine in the physical input / output device and then sent to the virtual machine or virtual machine manager on the computing device. The virtual machine or virtual machine manager is run by a first processor, and the computing device includes a second processor, which is a security processor. The second processor is used to configure a first security key for a first encryption / decryption engine and a second security key for the encryption / decryption engine in a physical input / output device. The first security key and the second security key are the same. The first encryption / decryption engine is used to encrypt the data to be encrypted and write it to the physical input / output device or to a specified area in the memory, so that the physical input / output device can read the encrypted data from the specified area. When the virtual machine writes the encrypted data to the physical input / output device, the physical input / output device is a display device or a printing device.

17. The method according to claim 16, characterized in that, The physical input / output device includes a first memory and a first register; The method further includes: The received encrypted data is stored in the first memory; The virtual machine or the virtual machine manager assigns a value to the first register; the value of the first register is used to indicate whether there is data to be decrypted stored in the first memory.

18. The method according to claim 17, characterized in that, The physical input / output device further includes a second register and / or a third register; The method further includes: Receive assignment operations from the virtual machine or the virtual machine manager on the second register and / or the third register; The value of the second register is used to indicate the location of the data to be decrypted stored in the first memory; The value of the third register is used to indicate the size of the data to be decrypted stored in the first memory.

19. The method according to claim 17, characterized in that, The physical input / output device is a display device, and the first memory is video memory; The receiving of encrypted data sent or written by the virtual machine on the computing device or the virtual machine manager includes: receiving encrypted image data sent or written by the virtual machine on the computing device or the virtual machine manager. After receiving encrypted data sent or written by a virtual machine on the computing device or by the virtual machine manager, the method further includes: The encrypted image data received by the display device is decrypted by the encryption / decryption engine and then displayed.

20. The method according to claim 16, characterized in that, When the physical input / output device encrypts external input data using an encryption / decryption engine and sends it to the virtual machine or the virtual machine manager, the physical input / output device is one of the following: Keyboard, mouse, camera, scanner, light pen, touch panel, joystick, voice input device.

21. A computing device, characterized in that, include: A first processor is used to run a virtual machine manager and a virtual machine, wherein the virtual machine manager is used to virtualize a virtual input / output device; A memory controller is electrically connected to the first processor, and a first encryption / decryption engine is provided in the memory controller; The memory is electrically connected to the memory controller; The second processor is configured to configure a first security key for the first encryption / decryption engine and a second security key for the second encryption / decryption engine in the target physical input / output device; wherein the first security key and the second security key are the same, and wherein the second processor is a security processor; The virtual machine obtains encrypted data encrypted by the first encryption / decryption engine from the virtual machine's encrypted memory through the memory controller, and writes the encrypted data to the virtual input / output device. The virtual machine manager reads the encrypted data from the virtual input / output device and writes or sends the encrypted data to the target physical input / output device, so that the target physical input / output device receives the encrypted data and decrypts it through the second encryption / decryption engine. The encrypted memory of the virtual machine is the encrypted storage area of ​​the virtual machine in the memory. or, The virtual machine manager receives encrypted data from the target physical input / output device and writes or sends the encrypted data to the virtual input / output device. The virtual machine reads the encrypted data from the virtual input / output device and writes the encrypted data into the memory through the memory controller. The encrypted data received by the virtual machine manager is generated by the target physical input / output device encrypting received external input data through the second encryption / decryption engine. When the virtual machine manager writes the encrypted data to the target physical input / output device, the target physical input / output device is a display device or a printing device.

22. The computing device according to claim 21, characterized in that, The virtual machine manager is also used to create a first virtual register for the first register in the target physical input / output device; The virtual machine is also used to assign a value to the first virtual register; The virtual machine manager reads the value of the first virtual register and assigns the read value of the first virtual register to the first register to indicate whether there is data to be decrypted stored in the first memory; wherein, the first memory is located in the target physical input / output device.

23. The computing device according to claim 22, characterized in that, The virtual machine manager is also configured to virtualize a second virtual register for the second register in the target physical input / output device, and / or virtualize a third virtual register for the third register in the target physical input / output device; The virtual machine is also used to assign values ​​to the second virtual register and / or the third virtual register; The virtual machine manager reads the value of the second virtual register and assigns the read value to the second register to indicate the location of the data to be decrypted stored in the first memory; and / or, The virtual machine manager reads the value of the third virtual register and assigns the read value of the third virtual register to the third register to indicate the size of the data to be decrypted stored in the first memory.

24. The computing device according to claim 22, characterized in that, The target physical input / output device is a display device or a printing device; When the target physical input / output device is a display device, the first memory is video memory.

25. The computing device according to claim 21, characterized in that, When the virtual machine manager receives encrypted data from the target physical input / output device, the target physical input / output device is one of the following: Keyboard, mouse, camera, scanner, light pen, touch panel, joystick, voice input device.

26. A data transmission method, characterized in that, Applied to computing devices, including: The virtual machine manager creates a virtual input / output device; The virtual machine obtains encrypted data encrypted by a first encryption / decryption engine from the virtual machine's encrypted memory through the memory controller, and writes the encrypted data to the virtual input / output device. The virtual machine manager reads the encrypted data from the virtual input / output device and writes or sends the encrypted data to the target physical input / output device, so that the target physical input / output device receives the encrypted data and decrypts it through a second encryption / decryption engine. The encrypted memory of the virtual machine is the encrypted storage area of ​​the virtual machine in the memory. or, The virtual machine manager receives encrypted data from the target physical input / output device and writes or sends the encrypted data to the virtual input / output device. The virtual machine reads the encrypted data from the virtual input / output device and writes the encrypted data into memory through the memory controller. The encrypted data received by the virtual machine manager is generated by the target physical input / output device encrypting received external input data through the second encryption / decryption engine. The virtual machine manager is run by a first processor, and the computing device includes a second processor, which is a security processor. The second processor is used to configure a first security key for the first encryption / decryption engine and a second security key for the encryption / decryption engine in the target physical input / output device. The first security key and the second security key are the same. When the virtual machine manager writes the encrypted data to the target physical input / output device, the target physical input / output device is a display device or a printing device.

27. The method according to claim 26, characterized in that, When the virtual machine manager creates a virtual input / output device, the method further includes: The virtual machine manager creates a first virtual register for the first register in the target physical input / output device; The virtual machine assigns a value to the first virtual register; The virtual machine manager reads the value of the first virtual register and assigns the read value of the first virtual register to the first register to indicate whether there is data to be decrypted stored in the first memory; wherein, the first memory is located in the target physical input / output device.

28. The method according to claim 27, characterized in that, When the virtual machine manager creates a virtual input / output device, the method further includes: The virtual machine manager creates a second virtual register for the second register in the target physical input / output device, and / or creates a third virtual register for the third register in the target physical input / output device; The virtual machine assigns values ​​to the second virtual register and / or the third virtual register; The virtual machine manager reads the value of the second virtual register and assigns the read value to the second register to indicate the location of the data to be decrypted stored in the first memory; and / or, The virtual machine manager reads the value of the third virtual register and assigns the read value of the third virtual register to the third register to indicate the size of the data to be decrypted stored in the first memory.

29. The method according to claim 26, characterized in that, The target physical input / output device is a display device, and the encrypted data is encrypted image data; The virtual machine manager reads the encrypted data and writes it to or sends it to the target physical input / output device, so that the target physical input / output device can decrypt the encrypted data through a second encryption / decryption engine, including: The virtual machine manager reads the encrypted image data and writes it to or sends it to the target physical input / output device, so that the target physical input / output device can decrypt the encrypted image data through the second encryption / decryption engine and then display it.

30. A data transmission system, characterized in that, include: A computing device and a physical output device connected thereto; wherein the computing device is any one of claims 1 to 5 or claims 21 to 25, and the physical output device is any one of claims 6 to 9; or, The data transmission system includes: A computing device and a physical input device connected thereto; wherein the computing device is any one of claims 1 to 5 or claims 21 to 25, and the physical input device is any one of claims 10 to 11.

Images