NVRAM Data Processing Method, Electronic Device, and Readable Storage Medium

Abstract

The present application discloses an NVRAM data processing method, an electronic device, and a readable storage medium, belonging to the technical field of NVRAM. The NVRAM data processing method includes: generating, by the TPM, a first processing instruction corresponding to an NVRAM data processing operation, where the first processing instruction includes a second processing instruction; obtaining and parsing, by the NVRAM driver module, the first processing instruction to obtain the second processing instruction, and sending the second processing instruction to the second flash driver module; sending, by the second flash driver module, a command corresponding to the second processing instruction to the first flash driver module through the ATF, where the command includes a write command corresponding to a write instruction or a read command corresponding to a read instruction; performing, by the first flash driver module, data processing corresponding to the command, where the data processing includes processing of writing NVRAM data into a target storage space corresponding to the write command, or processing of reading NVRAM data from the target storage space corresponding to the read command. The present application ensures that the FTPM can write or read NVRAM data at each stage of the electronic device, improving the efficiency of the FTPM function.

Description

Technical Field

[0001] This application belongs to the technical field of NVRAM, and particularly relates to an NVRAM data processing method, an electronic device, and a readable storage medium. Background Art

[0002] A Trusted Platform Module (TPM) is a small chip system containing cryptographic operations and storage components, which is used to securely store information for verifying the security of a platform, such as passwords, certificates, or encryption keys. With the development of Advanced RISC (Reduced Instruction Set Computer, ARM) technology and cloud computing, the ARM TrustZone trusted technology for solving ARM-related technical security and trust issues has emerged. To be compatible with TPM, the TrustZone technology in the ARM platform can be used to implement a firmware-based Trusted Platform Module (FTPM) to achieve the same functions as TPM. Among the data processes participated by the FTPM, the FTPM needs to store persistent data in a Non-Volatile Random Access Memory (NVRAM).

[0003] Currently, electronic devices based on TrustZone generally include a rich execution environment (REE) and a trusted execution environment (TEE). The TEE operating system (OS) running in the TEE can support the Linux file system as an NVRAM storage medium. It can be understood that it supports the FTPM to store persistent NVRAM data in the Linux file system.

[0004] However, since the Linux file system can only be accessed after the operating system of the electronic device (including the TEE OS) is started and run, and the FTPM, as an important security component during the startup process of the electronic device, also needs to run before the operating system is started. Therefore, using the Linux file system as the NVRAM storage medium makes it impossible for the FTPM to write or read NVRAM data in the stage before the operating system runs, resulting in limited use of the FTPM function and reduced efficiency of the FTPM function. Summary of the Invention

[0005] The objective of the embodiments of the present application is to provide a method for processing NVRAM data, an electronic device, and a readable storage medium, which can solve the problem that the function of FTPM is limited in use and reduce the efficiency of the FTPM function.

[0006] To solve the above technical problems, the present application is implemented as follows:

[0007] In a first aspect, the embodiments of the present application provide a method for processing NVRAM data, which is applied to an electronic device. The electronic device includes: a trusted execution environment TEE, a rich execution environment REE, and an ARM trusted firmware ATF. The REE includes a trusted platform module TPM, a first flash driver module, and a flash storage module. A target storage space in the flash storage module is used to store NVRAM data. The TEE includes a second flash driver module and a non-volatile random access memory NVRAM driver module of a firmware-based trusted platform module FTPM trusted application TA. The method includes:

[0008] When the TPM receives an NVRAM data processing operation, a first processing instruction corresponding to the NVRAM data processing operation is generated by the TPM. The first processing instruction includes a second processing instruction, and the second processing instruction includes a write instruction corresponding to the NVRAM data storage operation or a read instruction corresponding to the NVRAM data reading operation.

[0009] The second processing instruction is obtained and parsed through the NVRAM driver module from the first processing instruction, and the second processing instruction is sent to the second flash driver module.

[0010] The command corresponding to the second processing instruction is sent to the first flash driver module through the ATF by the second flash driver module. The command includes a write command corresponding to the write instruction or a read command corresponding to the read instruction.

[0011] The data processing corresponding to the command is executed by the first flash driver module. The data processing includes the processing of writing NVRAM data into the target storage space corresponding to the write command, or the processing of reading NVRAM data from the target storage space corresponding to the read command.

[0012] Optionally, when the second processing instruction includes the write instruction, the second processing instruction includes the NVRAM data to be written. The method further includes:

[0013] The NVRAM data to be written is encrypted by the second flash driver module to obtain NVRAM write data.

[0014] The second flash drive module writes the data of the NVRAM to the shared memory, and generates a first secure monitoring call SMC instruction based on the address of the NVRAM write data in the shared memory and the write command;

[0015] The second flash drive module sends the command corresponding to the second processing instruction to the first flash drive module through the ATF, including: the second flash drive module sends the first SMC instruction to the first flash drive module through the ATF.

[0016] Optionally, the first flash drive module executes the data processing corresponding to the command, including:

[0017] The first flash drive module reads the NVRAM write data from the shared memory based on the first SMC instruction;

[0018] The first flash drive module writes the NVRAM write data to the target storage space.

[0019] Optionally, the second flash drive module encrypts the NVRAM data to be written to obtain the NVRAM write data, including:

[0020] The second flash drive module encrypts the NVRAM data to be written using the file storage key to obtain the NVRAM ciphertext data;

[0021] The second flash drive module encrypts the file storage key based on the key encryption data to obtain the encryption key, and the key encryption data includes the physical identification code of the electronic device, the physical identification code of the processor of the electronic device, and the universal unique identification code of the FTPM TA;

[0022] The second flash drive module generates the NVRAM write data, and the NVRAM write data includes the NVRAM ciphertext data and the encryption key.

[0023] Optionally, the second flash drive module encrypts the file storage key based on the key encryption data to obtain the encryption key, including:

[0024] The second flash drive module uses the key-related hash-based message authentication code HMAC algorithm based on the physical identification code of the electronic device, the static string, and the physical identification code of the processor to obtain the secure storage key;

[0025] The second flash drive module uses the HMAC algorithm based on the security storage key and the universally unique identifier of the FTPM TA to obtain a trusted application storage key;

[0026] The second flash drive module encrypts the file storage key based on the trusted application storage key to obtain an encrypted key.

[0027] Optionally, when the second processing instruction includes the read instruction, the method further includes:

[0028] The first flash drive module stores the NVRAM read data in the shared memory and generates a second SMC instruction based on the address of the NVRAM read data in the shared memory. The NVRAM read data is the NVRAM data read by the first flash drive module from the target storage space by performing data processing corresponding to the read command;

[0029] The first flash drive module sends the second SMC instruction to the second flash drive module through the ATF.

[0030] Optionally, the method further includes:

[0031] The second flash drive module reads the NVRAM read data from the shared memory based on the second SMC instruction;

[0032] The second flash drive module decrypts the NVRAM read data to obtain NVRAM plaintext data and sends the NVRAM plaintext data to the NVRAM drive module for the electronic device to use the NVRAM plaintext data.

[0033] Optionally, before generating the first processing instruction corresponding to the NVRAM data processing operation by the TPM, the method further includes:

[0034] The REE loads the Unified Extensible Firmware Interface (UEFI) firmware;

[0035] The UEFI firmware loads the OPTEE client and allocates shared memory;

[0036] The REE loads the FTPM driver to start the TPM;

[0037] After generating the first processing instruction corresponding to the NVRAM data processing operation by the TPM, the method further includes:

[0038] The OPTEE client running through the REE stores the first processing instruction in the shared memory, generates a third SMC instruction based on the address of the first processing instruction in the shared memory, and sends the third SMC instruction to the NVRAM driver module through the ATF;

[0039] The obtaining and parsing the first processing instruction by the NVRAM driver module to obtain the second processing instruction includes: the NVRAM driver module reads the first processing instruction from the shared memory based on the third SMC instruction, and parses the first processing instruction to obtain the second processing instruction.

[0040] Optionally, the REE runs a Linux operating system, and the first flash driver module runs in the kernel of the Linux operating system; the TEE runs a TEE operating system TEE OS, and the second flash driver module runs in the kernel of the TEE OS.

[0041] In a second aspect, an embodiment of the present application provides an electronic device, which includes a Trusted Execution Environment (TEE), a Rich Execution Environment (REE), and an ARM Trusted Firmware (ATF). The REE includes a Trusted Platform Module (TPM), a first flash driver module, and a flash storage module. A target storage space in the flash storage module is used to store NVRAM data. The TEE includes a second flash driver module and a Non-Volatile Random Access Memory (NVRAM) driver module for a Trusted Application (TA) of a Firmware-based Trusted Platform Module (FTPM);

[0042] The TPM is configured to generate a first processing instruction corresponding to the NVRAM data processing operation when receiving the NVRAM data processing operation. The first processing instruction includes a second processing instruction, and the second processing instruction includes a write instruction corresponding to the NVRAM data storage operation or a read instruction corresponding to the NVRAM data reading operation;

[0043] The NVRAM driver module is configured to obtain and parse the first processing instruction to obtain the second processing instruction, and send the second processing instruction to the second flash driver module;

[0044] The second flash driver module is configured to send a command corresponding to the second processing instruction to the first flash driver module through the ATF. The command includes a write command corresponding to the write instruction or a read command corresponding to the read instruction;

[0045] The first flash drive module is used to execute data processing corresponding to the command. The data processing includes processing for writing NVRAM data to the target storage space corresponding to the write command, or processing for reading NVRAM data from the target storage space corresponding to the read command.

[0046] In a third aspect, an embodiment of the present application provides an electronic device. The electronic device includes: a Trusted Execution Environment (TEE), a Rich Execution Environment (REE), and an ARM Trusted Firmware (ATF). The REE includes a Trusted Platform Module (TPM), a first flash drive module, and a flash storage module. The target storage space in the flash storage module is used to store NVRAM data. The TEE includes a second flash drive module and a Non-Volatile Random Access Memory (NVRAM) drive module for a Trusted Application (TA) of a Firmware-based Trusted Platform Module (FTPM).

[0047] The electronic device further includes: a processor, a memory, and a program or instruction stored on the memory and executable on the processor. When the program or instruction is executed by the processor, the steps of the NVRAM data processing method described above are implemented.

[0048] In a fourth aspect, an embodiment of the present application provides a readable storage medium. A program or instruction is stored on the readable storage medium. When the program or instruction is executed by a processor, the steps of the NVRAM data processing method described above are implemented.

[0049] In a sixth aspect, an embodiment of the present application provides a chip. The chip includes a processor and a communication interface. The communication interface is coupled to the processor. The processor is used to run a program or instruction to implement the method described in the first aspect.

[0050] In an embodiment of the present application, after the TPM in the REE of the electronic device receives an NVRAM data processing operation and generates a first processing instruction corresponding to the NVRAM data processing operation, the electronic device may first obtain and parse the first processing instruction through the NVRAM driver module of the FTPM TA in the TEE to obtain a second processing instruction, and send the second processing instruction to the second flash driver module. Then, the second flash driver module of the TEE transmits a command corresponding to the second processing instruction to the first flash driver module of the REE, so that the first flash driver module executes the processing operation corresponding to the received command, writes NVRAM data into the target storage space in the flash storage module of the electronic device, or reads NVRAM data from the target storage space of the flash storage module. Among them, the first processing instruction includes the second processing instruction, and the second processing instruction includes a write instruction corresponding to an NVRAM data storage operation or a read instruction corresponding to an NVRAM data read operation. The command corresponding to the second processing instruction includes a write command corresponding to the write instruction or a read command corresponding to the read instruction.

[0051] In this technical solution, the flash storage module of the electronic device is used as the NVRAM storage medium, so that the FTPM TA can use a part of the storage space of the flash storage module to store the NVRAM data that needs to be persisted. Since the flash storage module can be accessed at each working stage of the electronic device, and each of these working stages includes the UEFI startup stage and the Uboot startup stage before the operating system runs. Therefore, it is ensured that the FTPM can write or read NVRAM data at each working stage of the electronic device, ensuring the intervention and use of the FTPM in the early startup of the electronic device and improving the efficiency of the FTPM function. Moreover, in the method of using the Linux file system as the NVRAM storage medium, since the Linux file system has a certain risk of being breached, the NVRAM data stored in the Linux file system has a certain security risk. However, using an independent flash as the NVRAM storage medium avoids the problem that the NVRAM data cannot be retained due to the damage of the Linux file system, ensuring the security of the NVRAM data. Description of the Drawings

[0052] Figure 1 is a block diagram of an electronic device provided by the present application;

[0053] Figure 2 is a schematic diagram of the principle of a key encryption method provided by an embodiment of the present application;

[0054] Figure 3 is one of the flowcharts of an NVRAM data processing method provided by an embodiment of the present application;

[0055] Figure 4 It is the second flowchart of a method for processing NVRAM data provided by an embodiment of the present application;

[0056] Figure 5 It is the third flowchart of a method for processing NVRAM data provided by an embodiment of the present application;

[0057] Figure 6 It is the fourth flowchart of a method for processing NVRAM data provided by an embodiment of the present application;

[0058] Figure 7 It is the fifth flowchart of a method for processing NVRAM data provided by an embodiment of the present application;

[0059] Figure 8 It is the sixth flowchart of a method for processing NVRAM data provided by an embodiment of the present application;

[0060] Figure 9 It is a block diagram of another electronic device provided by the present application. Detailed implementation manners

[0061] Next, the technical solutions in the embodiments of the present application will be clearly and completely described in conjunction with the accompanying drawings in the embodiments of the present application. Obviously, the described embodiments are some, but not all, of the embodiments of the present application. All other embodiments obtained by those of ordinary skill in the art based on the embodiments of the present application without creative efforts shall fall within the protection scope of the present application.

[0062] The terms "first", "second", etc. in the specification and claims of the present application are used to distinguish similar objects, rather than to describe a specific order or sequence. It should be understood that such data may be interchanged under appropriate circumstances so that the embodiments of the present application can be implemented in an order different from those illustrated or described herein, and the objects distinguished by "first", "second", etc. are generally of the same type, and the number of objects is not limited. For example, the first object may be one or more. In addition, "and / or" in the specification and claims means at least one of the connected objects, and the character " / " generally represents an "or" relationship between the associated objects before and after.

[0063] For the convenience of understanding, some terms related to the present application are described below.

[0064] TEE: Runs in the Secure World (SW) to provide an execution environment for the TEE OS.

[0065] REE: Normal World (NW) provides an execution environment for common operating systems, including Linux OS and Windows OS.

[0066] TrustZone: It is a security architecture on the ARMv6 version of the post-processor, which divides the working state of the processor (central processing unit, CPU) into SWS and NWS. The purpose of TrustZone is to build a security framework to resist various possible attacks and ensure the safety of CPU operation.

[0067] TEE OS: The operating system running in TEE is called a trusted operating system, such as the open source OPTEE (OPTEE-OS).

[0068] REE OS: basic firmware and operating systems running in REE, such as Unified Extensible Firmware Interface (UEFI), Uboot, Linux OS, Windows OS, etc.

[0069] FTPM Trust Appliation (TA): During the implementation of FTPM, some modules running in TEE OS are mainly used to provide the implementation of FTPM computing logic.

[0070] ARM Trusted Firmware (ATF): The underlying firmware officially provided by ARM. This firmware unifies the ARM underlying interface standards. Different manufacturers can customize the interface to implement ATF code according to chip characteristics.

[0071] UEFI: An implementation of the Basic Input Output System (BIOS). A program solidified in a memory chip, generally used to complete computer hardware initialization, hardware self-test, and provide a hardware management interface for the operating system.

[0072] RPMB (Replay Protected Memory Block): RPMB Partition is a partition with security features in eMMC.

[0073] Please refer to Figure 1, which shows a block diagram of an electronic device provided by the present application. Optionally, the electronic device provided by the embodiments of the present application may be a mobile phone, a tablet computer, a notebook computer, a palmtop computer, a vehicle-mounted electronic device, a wearable device, an ultra-mobile personal computer (UMPC), a netbook, or a personal digital assistant (PDA), etc. The non-mobile electronic device may be a server, a Network Attached Storage (NAS), a personal computer (PC), a television (TV), a teller machine, or a self-service machine, etc. The embodiments of the present application do not make specific limitations. As Figure 1 shown, the electronic device 100 includes:

[0074] REE 101, TEE 102, and ARM ATF 103. ARM ATF 103 is abbreviated as ATF 103. REE 101 includes: TPM1011, the first flash drive module 1012, and the flash storage module. The target storage space in the flash storage module is used to store NVRAM data. TEE 102 includes the second flash drive module 1021 and the NVRAM drive module 10221 of the FTPM TA 1022.

[0075] Among them, TPM 1011 is also called the TPM device 1011. The target storage space may be a fixed storage space partitioned in the flash storage module, and this target storage space is configured as a dedicated storage space for storing NVRAM data. The address of the target storage space is stored in the first flash drive module 1012. Optionally, the flash storage module may be a Serial Peripheral Interface (SPI). For example, NOR Flash.

[0076] The TPM 1011 is used to generate a first processing instruction corresponding to the NVRAM data processing operation when receiving the NVRAM data processing operation. The first processing instruction includes a second processing instruction, and the second processing instruction includes a write instruction corresponding to the NVRAM data storage operation or a read instruction corresponding to the NVRAM data reading operation. The first processing instruction can be called a TPM instruction. The second processing instruction can be called an NVRAM instruction, which includes a write NVRAM instruction or a read NVRAM instruction. The write NVRAM instruction is used to indicate writing the NVRAM data to be written into the target storage space. The write NVRAM instruction may include the NVRAM data to be written. The read NVRAM instruction is used to indicate reading out the NVRAM data stored in the target storage space.

[0077] In the embodiments of the present application, the NVRAM data processing operation may include an NVRAM storage processing operation and an NVRAM reading processing operation. In one application scenario, the user can execute the storage operation of the NVRAM data that needs to be persistently stored by the TPM device through the TPM device running on the electronic device. Or, the user can execute the reading operation of the NVRAM data stored in the target storage space through the TPM device. In another application scenario, when the TPM device finishes executing the first processing, it can automatically receive the NVRAM data storage operation to store the NVRAM data that needs to be persistently stored and is generated after the first processing into the flash storage module. Or, when the TPM device executes the second processing, it can automatically receive the NVRAM data reading operation to read the NVRAM data required for the second processing from the flash storage module.

[0078] The NVRAM driver module 10221 is used to obtain and parse the first processing instruction to obtain the second processing instruction, and send the second processing instruction to the second flash driver module 1021.

[0079] The second flash driver module 1021 is used to send the command corresponding to the second processing instruction to the first flash driver module 1012 through the ATF 103. The command includes a write command corresponding to the write instruction or a read command corresponding to the read instruction. Among them, the TEE 102 runs the TEE OS, and the second flash driver module 1021 can run in the kernel of the TEE OS, and the kernel of the TEE OS provides support for the second flash driver module 1021. After receiving the second processing instruction, the second flash driver module 1021 generates the command corresponding to the second processing instruction, and sends the command to the first flash driver module 1012 through the ATF 103.

[0080] The first flash driver module 1012 is used to perform data processing corresponding to commands. The data processing includes processing for writing NVRAM data to the target storage space corresponding to a write command, or processing for reading NVRAM data from the target storage space corresponding to a read command. In some embodiments of the present application, the first flash driver module 1012 may perform data processing corresponding to a command according to the address of the target storage space stored therein.

[0081] Among them, the REE 101 runs the REE OS, and the first flash driver module 1012 may run in the kernel of the REE OS, and the kernel of the REE OS provides support for the first flash driver module 1012. The REE OS may be a Linux operating system. Optionally, the write command may include the NVRAM data to be written. After receiving the write command, the first flash driver module 1012 may parse the write command to obtain the NVRAM data to be written provided by the write instruction in the write command, and perform data processing corresponding to the write command to write the NVRAM data to the target storage space. Optionally, please continue to refer to Figure 1 , the REE runs the Linux operating system, and the first flash driver module runs in the kernel of the Linux operating system; the TEE runs the TEE operating system TEE OS, and the second flash driver module runs in the kernel of the TEE OS.

[0082] In the embodiments of the present application, the NVRAM driver module of the FTPM TA in the TEE may transmit a write instruction or a read instruction for NVRAM data included in the first processing instruction generated by the TPM for reading or writing NVRAM data to the second flash driver module of the TEE. The second flash driver module of the TEE may transmit a command corresponding to the write instruction or a command corresponding to the read instruction to the first flash driver module of the REE, so that the first flash driver module performs a processing operation corresponding to the received command to write NVRAM data to the flash storage module, or read NVRAM data from the flash storage module.

[0083] In the technical solution of this application, the flash storage module of the electronic device is used as the NVRAM storage medium, so that part of the storage space of the flash storage module can be used by the FTPM TA to store the NVRAM data that needs to be persisted. Since the flash storage module can be accessed at each working stage of the electronic device, and these working stages include the UEFI startup stage and the Uboot startup stage before the operating system runs. Therefore, it is ensured that the FTPM can write or read NVRAM data at each working stage of the electronic device, which ensures the intervention and use of the FTPM in the early startup of the electronic device and improves the efficiency of the FTPM function. Moreover, in the method of using the Linux file system as the NVRAM storage medium, since the Linux file system has a certain risk of being breached, the NVRAM data stored in the Linux file system has a certain security risk. However, by using an independent flash as the NVRAM storage medium, the problem that the NVRAM data cannot be retained due to the damage of the Linux file system is avoided, and the security of the NVRAM data is ensured.

[0084] Further, in the related art, the TEE OS running in the TEE also supports the RPMB as the NVRAM storage medium. However, the RPMB is usually configured more in mobile terminals and less in ARM servers, and it is not easy to configure the RPMB for the ARM server through device expansion. Therefore, using the RPMB as the NVRAM storage medium has certain limitations in terms of the type of electronic device. Since flash exists in various types of electronic devices, compared with the related art, the universality of using the flash of the electronic device as the NVRAM storage medium is higher.

[0085] In the embodiment of this application, the NVRAM data processing operation includes the NVRAM storage processing operation and the NVRAM reading processing operation. Correspondingly, the second processing instruction includes: a write instruction corresponding to the NVRAM data storage operation or a read instruction corresponding to the NVRAM data reading operation. The embodiment of this application will further illustrate the two cases where the second processing instruction includes a write instruction and a read instruction respectively.

[0086] For the case of storing NVRAM data: the second processing instruction includes a write instruction and the NVRAM data to be written.

[0087] The second flash drive module 1021 is further configured to: encrypt the NVRAM data to be written to obtain the NVRAM write data. Store the NVRAM write data in the shared memory, and generate a first Secure Monitor Call (SMC) instruction based on the address of the NVRAM write data in the shared memory and the write command. Send the first SMC instruction to the first flash drive module 1012 through the ATF 103.

[0088] Among them, the second flash drive module 1021 can, after obtaining the second processing instruction, parse the second processing instruction to obtain the NVRAM data to be written, so as to encrypt the NVRAM data to be written to obtain the NVRAM write data. Optionally, the algorithms for the second flash drive module 1021 to encrypt the NVRAM data to be written may include AES, RC4, DES, 3DES, RC5, RC6, etc.

[0089] In the embodiment of the present application, the shared memory may be a dedicated memory allocated by the UEFI firmware for the interaction between the REE 101 and the TEE 102 when the electronic device loads the UEFI firmware in the UEFI phase. The second flash drive module 1021 stores the NVRAM write data in the shared memory and records the address of the NVRAM write data in the shared memory. Among them, the address may include the start address of the NVRAM write data in the shared memory and the data length of the NVRAM write data. The second flash drive module 1021 generates a first SMC instruction based on the address of the NVRAM write data in the shared memory and the write command. The first SMC instruction includes the address of the NVRAM write data in the shared memory and the write command.

[0090] Correspondingly and optionally, the first flash drive module 1012 is further configured to: read the NVRAM write data from the shared memory based on the first SMC instruction, and write the NVRAM write data in the target storage space to perform the data processing corresponding to the write command.

[0091] Among them, the first flash drive module 1012 can, after receiving the first SMC instruction through the ATF 103, parse the first SMC instruction to obtain the address of the NVRAM write data in the shared memory and the write command. The first flash drive module 1012 reads the NVRAM write data from the shared memory based on the address, and performs the data processing corresponding to the write command to write the NVRAM write data in the target storage space within the flash storage module.

[0092] In this way, due to the addition of the TEE OS secure storage mechanism, that is, the second flash drive module can encrypt the NVRAM data to be written, so that the NVRAM data stored in the flash storage module is the encrypted NVRAM write data. Therefore, the security of the NVRAM data stored in the flash storage module is improved.

[0093] As described above, there are various encryption algorithms that can be used in the implementation process of the second flash drive module 1021 encrypting the NVRAM data to be written to obtain the NVRAM write data. An exemplary description will be given below for one encryption process case in the embodiments of the present application.

[0094] Optionally, the second flash drive module 1021 is further configured to: encrypt the NVRAM data to be written using a file storage key to obtain NVRAM ciphertext data. Encrypt the file storage key based on the key encryption data to obtain an encrypted key. Generate NVRAM write data, where the NVRAM write data includes the NVRAM ciphertext data and the encrypted key.

[0095] Among them, the key encryption data includes the physical identification code of the electronic device, the physical identification code of the processor of the electronic device, and the universally unique identifier of the FTPM TA. The file storage key can be generated using a random number. Optionally, the algorithm for the second flash drive module 1021 to encrypt the NVRAM data to be written using the file storage key may include AES, RC4, DES, 3DES, RC5, RC6, AES_CBC algorithm, etc. The algorithm for encrypting the file storage key based on the key encryption data may include hash-based message authentication code (HMAC), AES, RC4, DES, 3DES, RC5, RC6, etc.

[0096] Exemplarily, such as Figure 2As shown in the figure, the second flash drive module 1021 is further configured to: use the HMAC algorithm based on the physical identification code (HUK) of the electronic device, the static string (String_for_ssk_gen), and the physical identification code (Chip_ID) of the processor of the electronic device to obtain a secure storage key (Secure Storage KEY, SSK). Use the HMAC algorithm based on the secure storage key and the universally unique identifier (UUID) of the FTPM TA to obtain a trusted application storage key (Trusted Applicant Storage KEY, TSK). Encrypt the file storage key (FEK) based on the trusted application storage key to obtain an encrypted key (enc_fek). It should be noted that the static string can be fixed characters. Figure 2 Taking the encryption process of the file storage key using the AES_CBC algorithm based on the trusted application storage key in Figure 2 as an example for illustrative description.

[0097] Optionally, the first flash drive module 1012 is further configured to generate a processing status after performing data processing corresponding to the write command. Generate a fourth SMC instruction based on the processing status, and transmit the fourth SMC instruction to the second flash drive module 1021 through the ATF 103. The second flash drive module 1021 is further configured to transmit the received fourth SMC instruction to the NVRAM drive module 10221 to indicate the execution status of the write command of the electronic device. Among them, the processing status includes but is not limited to: the write completion status or the unsuccessful write status. The write completion status indicates that the NVRAM data is successfully written, that is, the write command is successfully executed. The unsuccessful write status indicates that the NVRAM data is not successfully written, that is, the write command is executed failed.

[0098] For the case of storing NVRAM data: the second processing instruction includes a read instruction.

[0099] Optionally, the first flash drive module 1012 is further configured to: store the NVRAM read data in the shared memory, generate a second SMC instruction based on the address of the NVRAM read data in the shared memory, and send the second SMC instruction to the second flash drive module 1021 through the ATF 103.

[0100] Among them, the NVRAM read data is the NVRAM data read by the first flash drive module from the target storage space after performing data processing corresponding to the read command. Exemplarily, the first flash drive module reads the stored NVRAM data from the target storage space based on the address of the target storage space in the flash storage module.

[0101] It should be noted that the NVRAM data stored in the flash storage module is the NVRAM write data, that is, when the second flash driver module 1021 has the function of encrypting the NVRAM data to be written, the NVRAM read data is the encrypted data.

[0102] Optionally, the second flash driver module 1021 is further configured to: read the NVRAM read data from the shared memory based on the second SMC instruction, decrypt the NVRAM read data to obtain the NVRAM plaintext data, and send the NVRAM plaintext data to the NVRAM driver module 10221 for the electronic device to use the NVRAM plaintext data.

[0103] Among them, after obtaining the second SMC instruction through the ATF 103, the second flash driver module 1021 can parse the second SMC instruction to obtain the address of the NVRAM read data in the shared memory, and read the NVRAM read data from the shared memory based on this address. The second flash driver module 1021 can decrypt the NVRAM read data based on the decryption algorithm corresponding to the encryption algorithm to obtain the NVRAM plaintext data.

[0104] When the NVRAM write data stored in the flash storage module includes the NVRAM ciphertext data and the encryption key, the NVRAM read data includes the NVRAM ciphertext data and the encryption key.

[0105] Correspondingly and optionally, the second flash driver module 1021 can also be configured to: decrypt the encryption key to obtain the file storage key, and decrypt the NVRAM ciphertext data in the NVRAM read data based on the file storage key to obtain the NVRAM plaintext data.

[0106] Exemplarily, the second flash driver module 1021 is further configured to: use the HMAC algorithm based on the physical identification code (HUK) of the electronic device, the static string (String_for_ssk_gen), and the physical identification code (Chip_ID) of the processor of the electronic device to obtain the secure storage key, use the HMAC algorithm based on the secure storage key and the universally unique identifier (UUID) of the FTPM TA to obtain the trusted application storage key, decrypt the encryption key based on the trusted application storage key to obtain the file storage key (FEK), and decrypt the NVRAM ciphertext data in the NVRAM read data based on the file storage key to obtain the NVRAM plaintext data.

[0107] In some embodiments of the present application, the electronic device 100 may further include: UEFI firmware and an OPTEE client. Optionally, the REE 101 runs a Linux operating system, and the first flash driver module 1012 runs in the kernel of the Linux operating system. The TEE 102 runs a TEE operating system TEE OS, and the second flash driver module 1021 runs in the kernel of the TEE OS.

[0108] The REE 101 of the electronic device is used to load the UEFI firmware to start the UEFI firmware and execute the power-on process of the electronic device. The UEFI firmware is used to load the OPTEE client, allocate shared memory, and load the FTPM driver to start the TPM 1011 after being loaded by the REE 101.

[0109] The TPM 1011 is further used to send the first processing instruction to the OPTEE client after generating the first processing instruction. The OPTEE client is used to store the received first processing instruction in the shared memory after being loaded, generate a third SMC instruction based on the address of the first processing instruction in the shared memory, and send the third SMC instruction to the NVRAM driver module 10221 through the ATF 103.

[0110] The NVRAM driver module 10221 is further used to read the first processing instruction from the shared memory based on the third SMC instruction and parse the first processing instruction to obtain the second processing instruction. That is, the process by which the NVRAM driver module 10221 obtains the first processing instruction includes: the NVRAM driver module 10221 reads the first processing instruction from the shared memory based on the third SMC instruction.

[0111] Among them, after obtaining the third SMC instruction through the ATF 103, the NVRAM driver module 10221 parses the third SMC instruction to obtain the address of the first processing instruction in the shared memory, and reads the first processing instruction from the shared memory based on this address.

[0112] Optionally, the OPTEE client may also perform security verification on the received first processing instruction to ensure the security of each data transmitted in the electronic device. The OPTEE client is further used to: perform data verification on the first processing instruction, and store the first processing instruction in the shared memory in the case of successful data verification. In the case of unsuccessful data verification, the step of storing the first processing instruction in the shared memory may not be executed. Optionally, the process by which the OPTEE client performs data verification on the first processing instruction may include: verifying whether the instruction format of the first processing instruction is correct using the TPM instruction rule in the TPM specification.

[0113] In summary, in the electronic device provided by the embodiment of the present application, the TPM of the REE is used to generate a first processing instruction corresponding to the NVRAM data processing operation when receiving the NVRAM data processing operation. The first processing instruction includes a second processing instruction, and the second processing instruction includes a write instruction corresponding to the NVRAM data storage operation or a read instruction corresponding to the NVRAM data reading operation. The NVRAM driver module in the FTPM TA of the TEE is used to obtain and parse the first processing instruction to obtain the second processing instruction, and send the second processing instruction to the second flash driver module. The second flash driver module of the TEE is used to send the command corresponding to the second processing instruction to the first flash driver module of the REE through the ATF, and the command includes a write command corresponding to the write instruction or a read command corresponding to the read instruction. The first flash driver module of the REE is used to execute the data processing corresponding to the command, and the data processing includes the processing of writing NVRAM data into the target storage space in the flash storage module corresponding to the write command, or the processing of reading NVRAM data from the target storage space in the flash storage module corresponding to the read command.

[0114] In this technical solution, the NVRAM driver module of the FTPM TA in the TEE can transmit a write instruction or a read instruction for NVRAM data included in the first processing instruction generated by the TPM for reading or writing NVRAM data to the second flash driver module of the TEE. The second flash driver module of the TEE can transmit a command corresponding to the write instruction or a command corresponding to the read instruction to the first flash driver module of the REE, so that the first flash driver module executes the processing operation corresponding to the received command to write NVRAM data to the flash storage module or read NVRAM data from the flash storage module. In the technical solution of this application, the flash storage module of the electronic device is used as the NVRAM storage medium, so that part of the storage space of the flash storage module can be used by the FTPM TA to store the NVRAM data that needs to be persisted. Since the flash storage module can be accessed at each working stage of the electronic device, and these working stages include the UEFI startup stage and the Uboot startup stage before the operating system runs. Therefore, it is ensured that the FTPM can write or read NVRAM data at each working stage of the electronic device, ensuring the intervention and use of the FTPM in the early startup of the electronic device and improving the efficiency of the FTPM function. Moreover, in the method of using the Linux file system as the NVRAM storage medium, since the Linux file system has a certain risk of being breached, the NVRAM data stored in the Linux file system has a certain security risk. By using an independent flash as the NVRAM storage medium, the problem that the NVRAM data cannot be retained due to the damage of the Linux file system is avoided, ensuring the security of the NVRAM data.

[0115] Further, in the related art, the TEE OS running in the TEE also supports the RPMB as the NVRAM storage medium. However, the RPMB is usually configured more in mobile terminals and less in ARM servers, and it is not easy to configure the RPMB for the ARM server through device expansion. Therefore, using the RPMB as the NVRAM storage medium has certain limitations in terms of the type of electronic device. Since flash exists in various types of electronic devices, compared with the related art, using the flash of the electronic device as the NVRAM storage medium has higher universality.

[0116] Please refer to Figure 3 , which shows a flowchart of an NVRAM data processing method provided by an embodiment of this application. The NVRAM data processing method is applied to the electronic device provided by the embodiment of this application. For example, it is applied to Figure 1 the electronic device shown. As Figure 3 shown, the NVRAM data processing method includes:

[0117] Step 301: When the TPM of the REE receives an NVRAM data processing operation, generate a first processing instruction corresponding to the NVRAM data processing operation through the TPM of the REE. The first processing instruction includes a second processing instruction, and the second processing instruction includes a write instruction corresponding to an NVRAM data storage operation or a read instruction corresponding to an NVRAM data reading operation.

[0118] The first processing instruction can be referred to as a TPM instruction. The second processing instruction can be referred to as an NVRAM instruction, which includes a write NVRAM instruction or a read NVRAM instruction. The write NVRAM instruction is used to indicate writing the NVRAM data to be written into the target storage space. The read NVRAM instruction is used to indicate reading the NVRAM data stored in the target storage space.

[0119] In the embodiments of the present application, the NVRAM data processing operation may include an NVRAM storage processing operation and an NVRAM reading processing operation. In one application scenario, the user can execute a storage operation on the NVRAM data that needs to be persistently stored by the TPM device through the TPM device running on the electronic device. Alternatively, the user can execute a reading operation on the NVRAM data stored in the target storage space through the TPM device. In another application scenario, the TPM device can automatically receive an NVRAM data storage operation when the first processing is completed, so as to store the NVRAM data that needs to be persistently stored and is generated after the first processing into the flash storage module. Alternatively, the TPM device can automatically receive an NVRAM data reading operation when the second processing is executed, so as to read the NVRAM data required for the second processing from the flash storage module.

[0120] Step 302: Obtain and parse the first processing instruction through the NVRAM driver module of the FTPM TA in the TEE to obtain the second processing instruction, and send the second processing instruction to the second flash driver module.

[0121] Step 303: Send the command corresponding to the second processing instruction to the first flash driver module through the second flash driver module of the TEE via the ATF. The command includes a write command corresponding to the write instruction or a read command corresponding to the read instruction.

[0122] Among them, the TEE 102 runs the TEE OS, and the second flash driver module 1021 can run in the kernel of the TEE OS, and the kernel of the TEE OS provides support for the second flash driver module 1021. After receiving the second processing instruction, the second flash driver module 1021 generates a command corresponding to the second processing instruction, and sends the command to the first flash driver module 1012 through the ATF 103.

[0123] Step 304: Execute data processing corresponding to the command through the first flash drive module of the REE. The data processing includes processing for writing NVRAM data to the target storage space corresponding to the write command, or processing for reading NVRAM data from the target storage space corresponding to the read command.

[0124] In some embodiments of the present application, the electronic device can execute data processing corresponding to the command according to the address of the target storage space stored in the first flash drive module. Among them, the REE runs the REE OS, and the first flash drive module can run in the kernel of the REE OS, and the kernel of the REE OS provides support for the first flash drive module. The REE OS can be a Linux operating system. Optionally, the write command can include the NVRAM data to be written. After receiving the write command, the electronic device can parse the write command through the first flash drive module to obtain the NVRAM data to be written provided by the write instruction in the write command, and execute the data processing corresponding to the write command to write the NVRAM data to the target storage space.

[0125] In the embodiments of the present application, the NVRAM drive module of the FTPM TA in the TEE of the electronic device can transmit a write instruction or a read instruction for the NVRAM data included in the first processing instruction generated by the TPM to the second flash drive module of the TEE according to the first processing instruction for reading or writing NVRAM data generated by the TPM. The second flash drive module of the TEE transmits a command corresponding to the write instruction or a command corresponding to the read instruction to the first flash drive module of the REE, so that the first flash drive module executes the processing operation corresponding to the received command to write NVRAM data to the flash storage module, or read NVRAM data from the flash storage module.

[0126] In the technical solution of this application, the flash storage module of the electronic device is used as the NVRAM storage medium, so that part of the storage space of the flash storage module can be used by the FTPM TA to store the NVRAM data that needs to be persisted. Since the flash storage module can be accessed at each working stage of the electronic device, and these working stages include the UEFI startup stage and the Uboot startup stage before the operating system runs. Therefore, it is ensured that the FTPM can write or read NVRAM data at each working stage of the electronic device, which ensures the intervention and use of the FTPM in the early startup of the electronic device and improves the efficiency of the FTPM function. Moreover, in the method of using the Linux file system as the NVRAM storage medium, since the Linux file system has a certain risk of being breached, the NVRAM data stored in the Linux file system has a certain security risk. However, using an independent flash as the NVRAM storage medium avoids the problem that the NVRAM data cannot be retained due to the damage of the Linux file system, and ensures the security of the NVRAM data.

[0127] Furthermore, in the related art, the TEE OS running in the TEE also supports the RPMB as the NVRAM storage medium. However, the RPMB is usually configured more in mobile terminals and less in ARM servers, and it is not easy to configure the RPMB for the ARM server through device expansion. Therefore, using the RPMB as the NVRAM storage medium has certain limitations in terms of the type of electronic device. Since flash exists in various types of electronic devices, compared with the related art, using the flash of the electronic device as the NVRAM storage medium has higher universality.

[0128] In the embodiment of this application, the NVRAM data processing operation includes the NVRAM storage processing operation and the NVRAM reading processing operation, that is, the processing of NVRAM data includes the storage processing of NVRAM data and the reading processing of NVRAM data. In the embodiment of this application, taking the two processing situations of the storage processing of NVRAM data and the reading processing of NVRAM data as examples, the NVRAM data processing method of this application is further described.

[0129] For the situation of storing NVRAM data: The second processing instruction includes a write instruction and the NVRAM data to be written.

[0130] Please refer to Figure 4 , which shows a flowchart of a NVRAM data processing method provided by the embodiment of this application. The NVRAM data processing method is applied to the electronic device provided by the embodiment of this application. For example, it is applied to the electronic device shown in Figure 1 As shown. Such as Figure 4As shown in the figure, the NVRAM data processing method includes:

[0131] Step 401: When the TPM receives an NVRAM data processing operation, generate a first processing instruction corresponding to the NVRAM data processing operation through the REE's TPM. The first processing instruction includes a second processing instruction, and the second processing instruction includes a write instruction corresponding to the NVRAM data storage operation and the NVRAM data to be written.

[0132] For the explanation and implementation of this step, reference can be made to the corresponding parts in the foregoing step 301. This application embodiment will not elaborate on this.

[0133] Step 402: Obtain and parse the first processing instruction through the NVRAM driver module of the FTPM TA in the TEE to obtain the second processing instruction, and send the second processing instruction to the second flash driver module.

[0134] For the explanation and implementation of this step, reference can be made to the corresponding parts in the foregoing step 302. This application embodiment will not elaborate on this.

[0135] Step 403: Encrypt the NVRAM data to be written through the second flash driver module of the TEE to obtain the NVRAM write data.

[0136] Among them, after obtaining the second processing instruction, the second flash driver module can parse the second processing instruction to obtain the NVRAM data to be written, so as to encrypt the NVRAM data to be written to obtain the NVRAM write data. Optionally, the algorithms for the second flash driver module to encrypt the NVRAM data to be written may include AES, RC4, DES, 3DES, RC5, RC6, etc.

[0137] As mentioned above, there are various encryption algorithms that can be used in the implementation process of the second flash driver module to encrypt the NVRAM data to be written to obtain the NVRAM write data. This application embodiment will exemplarily illustrate the following encryption process situation.

[0138] Optionally, the process for the electronic device to encrypt the NVRAM data to be written through the second flash driver module to obtain the NVRAM write data may include the following steps 4031 to 4033.

[0139] In step 4031, encrypt the NVRAM data to be written through the second flash driver module of the TEE using the file storage key to obtain the NVRAM ciphertext data.

[0140] In the embodiments of the present application, the file storage key may be generated by a random number. Optionally, the algorithms for the second flash drive module to encrypt the NVRAM data to be written using the file storage key may include AES, RC4, DES, 3DES, RC5, RC6, AES_CBC algorithm, etc.

[0141] In step 4032, the second flash drive module of the TEE encrypts the file storage key based on the key-encrypted data to obtain an encrypted key.

[0142] In the embodiments of the present application, the key-encrypted data includes the physical identification code of the electronic device, the physical identification code of the processor of the electronic device, and the universal unique identifier of the FTPM TA. Optionally, the algorithms for encrypting the file storage key based on the key-encrypted data may include Hash-based Message Authentication Code (HMAC) related to the key, AES, RC4, DES, 3DES, RC5, RC6, etc.

[0143] Exemplarily, the process by which the electronic device encrypts the file storage key based on the key-encrypted data through the second flash drive module to obtain an encrypted key includes:

[0144] The second flash drive module uses the HMAC algorithm based on the physical identification code of the electronic device, the static string, and the physical identification code of the processor to obtain a secure storage key. The second flash drive module uses the HMAC algorithm based on the secure storage key and the universal unique identifier of the FTPM TA to obtain a trusted application storage key. The second flash drive module encrypts the file storage key based on the trusted application storage key to obtain an encrypted key. Optionally, the second flash drive module uses the AES_CBC algorithm based on the trusted application storage key to encrypt the file storage key to obtain an encrypted key.

[0145] In step 4033, the second flash drive module of the TEE generates NVRAM write data, and the NVRAM write data includes NVRAM ciphertext data and an encrypted key.

[0146] Step 404: The second flash drive module of the TEE stores the NVRAM write data in the shared memory, and generates a first SMC instruction based on the address of the NVRAM write data in the shared memory and the write command.

[0147] In an embodiment of the present application, the shared memory can be the dedicated memory allocated by the UEFI firmware for the interaction between the REE and the TEE when the electronic device loads the UEFI firmware in the UEFI phase. The electronic device stores the NVRAM written data in the shared memory through the second flash driver module and records the address of the NVRAM written data in the shared memory. Among them, the address can include the start address of the NVRAM written data in the shared memory and the data length of the NVRAM written data. The electronic device generates a first SMC instruction through the second flash driver module based on the address of the NVRAM written data in the shared memory and the write command. The first SMC instruction includes the address of the NVRAM written data in the shared memory and the write command.

[0148] Step 405: Send the first SMC instruction to the first flash driver module through the ATF by the second flash driver module of the TEE.

[0149] Step 406: Read the NVRAM written data from the shared memory by the first flash driver module of the REE based on the first SMC instruction.

[0150] In an embodiment of the present application, after receiving the first SMC instruction through the ATF, the electronic device can parse the first SMC instruction through the first flash driver module to obtain the address of the NVRAM written data in the shared memory and the write command. And the electronic device reads the NVRAM written data from the shared memory based on the address through the first flash driver module.

[0151] Step 407: Write the NVRAM written data into the target storage space by the first flash driver module of the REE.

[0152] The explanation and implementation method of this step can refer to the corresponding part of the explanation and implementation method in the foregoing step 304. The embodiments of the present application will not elaborate on this.

[0153] Optionally, after writing the NVRAM written data into the target storage space by the first flash driver module, the electronic device can generate a processing state. Generate a fourth SMC instruction based on the processing state through the first flash driver module, and transmit the fourth SMC instruction to the second flash driver module through the ATF. The electronic device transmits the received fourth SMC instruction to the NVRAM driver module to indicate the execution situation of the write command. Among them, the processing state includes but is not limited to: the write completion state or the non-write success state. The write completion state indicates that the NVRAM data is written successfully, that is, the write command is executed successfully. The non-write success state indicates that the NVRAM data is not written successfully, that is, the write command is executed failed.

[0154] For the case of storing NVRAM data: The second processing instruction includes a read instruction.

[0155] Please refer to Figure 5 , which shows a flowchart of an NVRAM data processing method provided by an embodiment of the present application. The NVRAM data processing method is applied to the electronic device provided by the embodiment of the present application. For example, it is applied to Figure 1 the electronic device shown in Figure 5 As shown in

[0156] Step 501: When the TPM receives an NVRAM data processing operation, generate a first processing instruction corresponding to the NVRAM data processing operation through the TPM of the REE. The first processing instruction includes a second processing instruction, and the second processing instruction includes a read instruction corresponding to the NVRAM data reading operation.

[0157] The explanation and implementation method of this step can refer to the explanation and implementation method of the corresponding part in the foregoing step 301. The embodiments of the present application will not elaborate on this.

[0158] Step 502: Obtain and parse the first processing instruction through the NVRAM driver module of the FTPM TA in the TEE to obtain the second processing instruction, and send the second processing instruction to the second flash driver module.

[0159] The explanation and implementation method of this step can refer to the explanation and implementation method of the corresponding part in the foregoing step 302. The embodiments of the present application will not elaborate on this.

[0160] Step 503: Send the command corresponding to the second processing instruction to the first flash driver module through the second flash driver module of the TEE via the ATF. The command includes the read command corresponding to the read instruction.

[0161] The explanation and implementation method of this step can refer to the explanation and implementation method of the corresponding part in the foregoing step 303. The embodiments of the present application will not elaborate on this.

[0162] Step 504: Execute the data processing corresponding to the command through the first flash driver module of the REE to read the NVRAM data from the target storage space to obtain the NVRAM read data.

[0163] The explanation and implementation method of this step can refer to the explanation and implementation method of the corresponding part in the foregoing step 304. The embodiments of the present application will not elaborate on this.

[0164] It should be noted that the NVRAM data stored in the flash storage module can be NVRAM write data, that is, the NVRAM read data is the data after encryption processing.

[0165] Step 505: Store the NVRAM read data into the shared memory through the first flash driver module of the REE, generate a second SMC instruction based on the address of the NVRAM read data in the shared memory, and send the second SMC instruction to the second flash driver module through the ATF.

[0166] Step 506: Read the NVRAM read data from the shared memory through the second flash driver module of the TEE based on the second SMC instruction.

[0167] In the embodiment of the present application, after obtaining the second SMC instruction through the ATF, the second flash driver module can parse the second SMC instruction to obtain the address of the NVRAM read data in the shared memory. Read the NVRAM read data from the shared memory based on this address.

[0168] Step 507: Decrypt the NVRAM read data through the second flash driver module of the TEE to obtain the NVRAM plaintext data, and send the NVRAM plaintext data to the NVRAM driver module for the electronic device to use the NVRAM plaintext data.

[0169] In the embodiment of the present application, the second flash driver module can decrypt the NVRAM read data based on the decryption algorithm corresponding to the encryption algorithm to obtain the NVRAM plaintext data.

[0170] When the NVRAM write data stored in the flash storage module includes NVRAM ciphertext data and an encryption key, the NVRAM read data includes NVRAM ciphertext data and an encryption key.

[0171] Optionally, the process of decrypting the NVRAM read data through the second flash driver module by the second flash driver module to obtain the NVRAM plaintext data may include:

[0172] Decrypt the encryption key through the second flash driver module to obtain a file storage key, and decrypt the NVRAM ciphertext data in the NVRAM read data based on the file storage key to obtain the NVRAM plaintext data.

[0173] Exemplarily, the electronic device uses the HMAC algorithm through the second flash drive module based on the physical identification code of the electronic device, the static string, and the physical identification code of the processor of the electronic device to obtain a secure storage key. Based on the secure storage key and the universally unique identifier of the FTPM TA, the HMAC algorithm is used to obtain a trusted application storage key. Based on the trusted application storage key, the encryption key is decrypted to obtain a file storage key. Based on the file storage key, the NVRAM ciphertext data in the NVRAM read data is decrypted to obtain NVRAM plaintext data.

[0174] In the embodiments of the present application, since the TEE OS secure storage mechanism is added, that is, the second flash drive module can encrypt the NVRAM data to be written, so that the NVRAM data stored in the flash storage module is the encrypted NVRAM write data. Therefore, the security of the NVRAM data stored in the flash storage module is improved.

[0175] Please refer to Figure 6 , which shows the flowchart of a method for processing NVRAM data provided by the embodiments of the present application. The NVRAM data processing method is applied to the electronic device provided by the embodiments of the present application. For example, it is applied to the electronic device shown in Figure 1 . As shown in Figure 6 , the NVRAM data processing method includes:

[0176] UEFI phase:

[0177] Step 601, load the UEFI firmware through the REE.

[0178] In some embodiments of the present application, the electronic device loads the UEFI firmware to start the UEFI firmware and execute the power-on process of the electronic device.

[0179] Step 602, load the OPTEE client through the UEFI firmware of the REE and allocate shared memory.

[0180] In some embodiments of the present application, after the electronic device starts the UEFI firmware, the electronic device sequentially experiences the secure verification (SEC) and the early EFI initialization (PEI) phases in the UEFI phase, and then enters the driver execution environment (DXE) phase. In the early stage of the DXE phase, the electronic device initializes and manages the memory of the electronic device through the UEFI firmware. During the process of initializing and managing the memory of the electronic device, the electronic device loads the OPTEE client through the UEFI firmware and allocates shared memory for the interaction between the TEE and the REE.

[0181] TPM device startup phase:

[0182] Step 603: Load the FTPM driver through the REE to start the TPM.

[0183] In some embodiments of the present application, the electronic device loads the FTPM driver through the Linux operating system running on the REE to start the TPM, so that the TPM is in an available state.

[0184] NVRAM data processing stage:

[0185] Step 604: When the TPM receives an NVRAM data processing operation, generate a first processing instruction corresponding to the NVRAM data processing operation through the TPM of the REE. The first processing instruction includes a second processing instruction, and the second processing instruction includes a write instruction corresponding to an NVRAM data storage operation or a read instruction corresponding to an NVRAM data read operation.

[0186] The explanation and implementation method of this step can refer to the corresponding part of the foregoing step 304. The embodiments of the present application will not elaborate on this.

[0187] It should be noted that in some embodiments of the present application, after generating the first processing instruction corresponding to the NVRAM data processing operation through the TPM, the first processing instruction can be sent to the OPTEE client running on the REE. Exemplarily, the electronic device sends the first processing instruction to the daemon process tee-supplicant of the OPTEE client running on the REE through the TPM.

[0188] Step 605: Store the first processing instruction in the shared memory through the OPTEE client running on the REE, generate a third SMC instruction based on the address of the first processing instruction in the shared memory, and send the third SMC instruction to the NVRAM driver module of the FTPM TA through the ATF.

[0189] In some embodiments of the present application, the OPTEE client running on the REE verifies and processes the received first processing instruction. In the case of successful verification, the first processing instruction is stored in the shared memory. In the case of unsuccessful verification, the step of storing the first processing instruction in the shared memory is not executed.

[0190] Exemplarily, the electronic device stores the first processing instruction in the shared memory through the daemon process tee-supplicant of the OPTEE client running on the REE, generates a third SMC instruction based on the address of the first processing instruction in the shared memory, and sends the third SMC instruction to the NVRAM driver module of the FTPM TA through the ATF.

[0191] Step 606: The NVRAM driver module of the TEE reads the first processing instruction from the shared memory based on the third SMC instruction, parses the first processing instruction to obtain the second processing instruction, and sends the second processing instruction to the second flash driver module.

[0192] Step 607: The second flash driver module of the TEE sends the command corresponding to the second processing instruction to the first flash driver module through the ATF. The command includes the write command corresponding to the write instruction or the read command corresponding to the read instruction.

[0193] The explanation and implementation method of this step can refer to the corresponding part of the foregoing step 303. This application embodiment will not elaborate on this.

[0194] Step 608: The first flash driver module of the REE executes the data processing corresponding to the command. The data processing includes the processing of writing NVRAM data to the target storage space corresponding to the write command, or the processing of reading NVRAM data from the target storage space corresponding to the read command.

[0195] The explanation and implementation method of this step can refer to the corresponding part of the foregoing step 304. This application embodiment will not elaborate on this.

[0196] In summary, for the NVRAM data processing method provided by this application embodiment, after the TPM in the REE of the electronic device receives the NVRAM data processing operation and generates the first processing instruction corresponding to the NVRAM data processing operation, the electronic device can first obtain and parse the first processing instruction through the NVRAM driver module of the FTPM TA in the TEE to obtain the second processing instruction, and send the second processing instruction to the second flash driver module. Furthermore, the second flash driver module of the TEE transmits the command corresponding to the second processing instruction to the first flash driver module of the REE, so that the first flash driver module executes the processing operation corresponding to the received command, writes NVRAM data into the target storage space in the flash storage module of the electronic device, or reads NVRAM data from the target storage space of the flash storage module. Among them, the first processing instruction includes the second processing instruction, and the second processing instruction includes the write instruction corresponding to the NVRAM data storage operation or the read instruction corresponding to the NVRAM data reading operation. The command corresponding to the second processing instruction includes the write command corresponding to the write instruction or the read command corresponding to the read instruction.

[0197] In this technical solution, the flash storage module of the electronic device is used as the NVRAM storage medium, so that part of the storage space of the flash storage module can be used by the FTPM TA to store the NVRAM data that needs to be persisted. Since the flash storage module can be accessed at each working stage of the electronic device, and these working stages include the UEFI startup stage and the Uboot startup stage before the operating system runs. Therefore, it is ensured that the FTPM can write or read NVRAM data at each working stage of the electronic device, which ensures the intervention and use of the FTPM in the early startup of the electronic device and improves the efficiency of the FTPM function. Moreover, in the method of using the Linux file system as the NVRAM storage medium, since the Linux file system has a certain risk of being breached, the NVRAM data stored in the Linux file system has a certain security risk. However, by using an independent flash as the NVRAM storage medium, the problem that the NVRAM data cannot be retained due to the damage of the Linux file system is avoided, which ensures the security of the NVRAM data.

[0198] Furthermore, in the related technology, the TEE OS running in the TEE also supports the RPMB as the NVRAM storage medium. However, the RPMB is usually configured more in mobile terminals and less in ARM servers, and it is not easy to configure the RPMB for the ARM server through device expansion. Therefore, using the RPMB as the NVRAM storage medium has certain limitations in terms of the type of electronic device. Since flash exists in various types of electronic devices, compared with the related technology, using the flash of the electronic device as the NVRAM storage medium has higher universality.

[0199] Please refer to Figure 7 , which shows the flowchart of an NVRAM data processing method provided by an embodiment of the present application. The NVRAM data processing method is applied to the electronic device provided by the embodiment of the present application. For example, it is applied to Figure 1 the electronic device shown. The NVRAM data processing method can be executed by the REE of the electronic device. As Figure 7 shown, the NVRAM data processing method includes:

[0200] Step 701: When the TPM receives an NVRAM data processing operation, the REE generates a first processing instruction corresponding to the NVRAM data processing operation through the TPM. The first processing instruction includes a second processing instruction, and the second processing instruction includes a write instruction corresponding to an NVRAM data storage operation or a read instruction corresponding to an NVRAM data reading operation. The first processing instruction is obtained by the TEE through the NVRAM driver module and parsed to obtain the second processing instruction, and the second processing instruction is sent to the second flash driver module. The command corresponding to the second processing instruction is sent to the first flash driver module through the ATF by the second flash driver module. The command includes a write command corresponding to the write instruction or a read command corresponding to the read instruction.

[0201] Step 702: The REE performs data processing corresponding to the command through the first flash driver module. The data processing includes processing of writing NVRAM data into the target storage space corresponding to the write command, or processing of reading NVRAM data from the target storage space corresponding to the read command.

[0202] Optionally, the REE performing data processing corresponding to the command through the first flash driver module includes:

[0203] The REE reads NVRAM write data from the shared memory based on the first SMC instruction through the first flash driver module. The first SMC instruction is an instruction generated by the TEE storing the NVRAM write data into the shared memory through the second flash driver module, based on the address of the NVRAM write data in the shared memory and the write command. The NVRAM write data is the data obtained by the TEE encrypting the NVRAM data to be written through the second flash driver module.

[0204] The REE writes the NVRAM write data into the target storage space through the first flash driver module.

[0205] Optionally, when the second processing instruction includes a read instruction, the NVRAM data processing method includes:

[0206] The REE stores the NVRAM read data into the shared memory through the first flash driver module, and generates a second SMC instruction based on the address of the NVRAM read data in the shared memory. The NVRAM read data is the NVRAM data read from the target storage space by the first flash driver module performing data processing corresponding to the read command.

[0207] The REE sends the second SMC instruction to the second flash driver module through the ATF by the first flash driver module.

[0208] Optionally, before generating a first processing instruction corresponding to the NVRAM data processing operation through the TPM, the NVRAM data processing method further includes:

[0209] The REE loads the UEFI firmware;

[0210] The REE loads the OPTEE client through the UEFI firmware and allocates shared memory;

[0211] The REE loads the FTPM driver to start the TPM;

[0212] After generating the first processing instruction corresponding to the NVRAM data processing operation through the TPM, the method further includes:

[0213] The OPTEE client running on the REE stores the first processing instruction in the shared memory, generates a third SMC instruction based on the address of the first processing instruction in the shared memory, and sends the third SMC instruction to the NVRAM driver module through the ATF. The third SMC instruction is used for the TEE to read the first processing instruction from the shared memory based on the third SMC instruction through the NVRAM driver module.

[0214] Optionally, the REE runs a Linux operating system, and the first flash driver module runs in the kernel of the Linux operating system.

[0215] Please refer to Figure 8 , which shows a flowchart of an NVRAM data processing method provided by an embodiment of the present application. The NVRAM data processing method is applied to the electronic device provided by the embodiment of the present application. For example, it is applied to Figure 1 the electronic device shown. The NVRAM data processing method can be executed by the TEE of the electronic device. As Figure 8 shown, the NVRAM data processing method includes:

[0216] Step 801, the TEE obtains and parses the first processing instruction through the NVRAM driver module of the FTPM TA to obtain a second processing instruction, and sends the second processing instruction to the second flash driver module. The first processing instruction is generated by the REE's TPM when receiving the NVRAM data processing operation. The first processing instruction includes the second processing instruction, and the second processing instruction includes a write instruction corresponding to the NVRAM data storage operation or a read instruction corresponding to the NVRAM data read operation.

[0217] Step 802: The TEE sends, through the second flash driver module, the command corresponding to the second processing instruction to the first flash driver module of the REE via the ATF, so that the REE executes the data processing corresponding to the command through the first flash driver module. The data processing includes the processing of writing NVRAM data to the target storage space corresponding to the write command, or the processing of reading NVRAM data from the target storage space corresponding to the read command.

[0218] Optionally, when the second processing instruction includes a write instruction, the second processing instruction includes the NVRAM data to be written; the NVRAM data processing method includes:

[0219] The TEE encrypts the NVRAM data to be written through the second flash driver module to obtain NVRAM write data;

[0220] The TEE stores the NVRAM write data in the shared memory through the second flash driver module, and generates a first SMC instruction based on the address of the NVRAM write data in the shared memory and the write command;

[0221] The TEE sends, through the second flash driver module, the command corresponding to the second processing instruction to the first flash driver module via the ATF, including: sending the first SMC instruction to the first flash driver module through the second flash driver module via the ATF.

[0222] Optionally, the TEE encrypts the NVRAM data to be written through the second flash driver module to obtain NVRAM write data, including:

[0223] The TEE encrypts the NVRAM data to be written through the second flash driver module using the file storage key to obtain NVRAM ciphertext data;

[0224] The TEE encrypts the file storage key based on the key encryption data through the second flash driver module to obtain an encryption key. The key encryption data includes the physical identification code of the electronic device, the physical identification code of the processor of the electronic device, and the universal unique identifier of the FTPM TA;

[0225] The TEE generates NVRAM write data through the second flash driver module. The NVRAM write data includes NVRAM ciphertext data and the encryption key.

[0226] Optionally, the TEE encrypts the file storage key based on the key encryption data through the second flash driver module to obtain an encryption key, including:

[0227] The TEE uses the key-related Hash-based Message Authentication Code (HMAC) algorithm through the second flash driver module based on the physical identification code of the electronic device, the static string, and the physical identification code of the processor to obtain the secure storage key;

[0228] The TEE uses the HMAC algorithm through the second flash driver module based on the secure storage key and the Universally Unique Identifier (UUID) of the FTPM TA to obtain the trusted application storage key;

[0229] The TEE encrypts the file storage key through the second flash driver module based on the trusted application storage key to obtain the encryption key.

[0230] Optionally, the NVRAM data processing method further includes:

[0231] The TEE reads the NVRAM read data from the shared memory through the second flash driver module based on the second SMC instruction. The second SMC instruction is that the REE stores the NVRAM read data in the shared memory through the first flash driver module, generates the second SMC instruction based on the address of the NVRAM read data in the shared memory, and the NVRAM read data is the NVRAM data read from the target storage space by the first flash driver module performing the read command corresponding data processing;

[0232] The TEE decrypts the NVRAM read data through the second flash driver module to obtain the NVRAM plaintext data, and sends the NVRAM plaintext data to the NVRAM driver module for the electronic device to use the NVRAM plaintext data.

[0233] Optionally, the TEE obtains and parses the first processing instruction through the NVRAM driver module to obtain the second processing instruction, including: The TEE reads the first processing instruction from the shared memory through the NVRAM driver module based on the third SMC instruction, and parses the first processing instruction to obtain the second processing instruction.

[0234] Optionally, the TEE runs the Trusted Execution Environment Operating System (TEE OS), and the second flash driver module runs in the kernel of the TEE OS.

[0235] It should be noted that in the embodiments of the present application, each method-side embodiment and each device-side embodiment can refer to each other. Among them, each method-side embodiment includes but is not limited to Figures 3 to 8 the embodiments shown, and the device-side embodiments include but are not limited to Figure 1 the embodiments shown.

[0236] In summary, in the NVRAM data processing method provided by the embodiments of the present application, after the TPM in the REE of the electronic device receives an NVRAM data processing operation and generates a first processing instruction corresponding to the NVRAM data processing operation, the electronic device can first obtain and parse the first processing instruction through the NVRAM driver module of the FTPM TA in the TEE to obtain a second processing instruction, and send the second processing instruction to the second flash driver module. Furthermore, the second flash driver module of the TEE transmits a command corresponding to the second processing instruction to the first flash driver module of the REE, so that the first flash driver module executes the processing operation corresponding to the received command, writes NVRAM data into the target storage space in the flash storage module of the electronic device, or reads NVRAM data from the target storage space in the flash storage module. Among them, the first processing instruction includes the second processing instruction, and the second processing instruction includes a write instruction corresponding to an NVRAM data storage operation or a read instruction corresponding to an NVRAM data read operation. The command corresponding to the second processing instruction includes a write command corresponding to the write instruction or a read command corresponding to the read instruction.

[0237] In this technical solution, the flash storage module of the electronic device is used as the NVRAM storage medium, so that the FTPM TA can use a part of the storage space of the flash storage module to store the NVRAM data that needs to be persisted. Since the flash storage module can be accessed in each working stage of the electronic device, and these working stages include the UEFI startup stage and the Uboot startup stage before the operating system runs. Therefore, it is ensured that the FTPM can write or read NVRAM data in each working stage of the electronic device, ensuring the intervention and use of the FTPM in the early startup of the electronic device and improving the efficiency of the FTPM function. Moreover, in the method of using the Linux file system as the NVRAM storage medium, since the Linux file system has a certain risk of being breached, the NVRAM data stored in the Linux file system has a certain security risk. However, using an independent flash as the NVRAM storage medium avoids the problem that the NVRAM data cannot be retained due to the damage of the Linux file system, ensuring the security of the NVRAM data.

[0238] Optionally, such as Figure 9As shown in the figure, an embodiment of the present application further provides an electronic device. The electronic device 900 includes: a TEE, a REE, and an ARM ATF. The REE includes a TPM, a first flash drive module, and a flash storage module. The target storage space in the flash storage module is used to store NVRAM data. The TEE includes a second flash drive module and an NVRAM drive module of the FTPM TA. The electronic device 900 further includes a processor 901, a memory 902, and a program or instruction stored on the memory 902 and executable on the processor 901. When the program or instruction is executed by the processor 901, it implements each process of the above-mentioned NVRAM data processing method embodiment and can achieve the same technical effect. To avoid repetition, it will not be elaborated here.

[0239] It should be noted that the functions of the components in the electronic device 900 in the embodiment of the present application can refer to the functions of the corresponding parts in the electronic device 100 provided in the foregoing embodiment, and will not be elaborated here.

[0240] An embodiment of the present application further provides a readable storage medium. A program or instruction is stored on the readable storage medium. When the program or instruction is executed by a processor, it implements each process of the above-mentioned NVRAM data processing method embodiment and can achieve the same technical effect. To avoid repetition, it will not be elaborated here.

[0241] Wherein, the processor is the processor in the electronic device described in the above embodiment. The readable storage medium includes a computer-readable storage medium, such as a computer read-only memory (Read-Only Memory, ROM), a random access memory (Random Access Memory, RAM), a magnetic disk, or an optical disk, etc.

[0242] Another embodiment of the present application provides a chip. The chip includes a processor and a communication interface. The communication interface is coupled to the processor. The processor is used to run a program or instruction to implement each process of the above-mentioned NVRAM data processing method embodiment and can achieve the same technical effect. To avoid repetition, it will not be elaborated here.

[0243] It should be understood that the chip mentioned in the embodiment of the present application can also be referred to as a system-on-chip, a system chip, a chip system, or a system-on-chip, etc.

[0244] It should be noted that in this text, the term "including", "comprising" or any other variant thereof is intended to cover non-exclusive inclusion, such that a process, method, article or device comprising a series of elements includes not only those elements but also other elements not expressly listed, or elements that are inherent to such process, method, article or device. Without further limitation, an element defined by the statement "comprising one..." does not exclude the presence of additional identical elements in the process, method, article or device comprising that element. In addition, it should be pointed out that the scope of the methods and devices in the embodiments of the present application is not limited to performing functions in the order shown or discussed, but may also include performing functions in a substantially simultaneous manner or in the reverse order according to the functions involved. For example, the described methods may be performed in an order different from that described, and various steps may be added, omitted, or combined. Additionally, features described with reference to certain examples may be combined in other examples.

[0245] Through the description of the above embodiments, those skilled in the art can clearly understand that the above-described example methods can be implemented by means of software plus a necessary general hardware platform. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation. Based on this understanding, the technical solution of the present application, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) and includes several instructions for causing a terminal (which can be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in various embodiments of the present application.

[0246] The embodiments of the present application have been described above in conjunction with the accompanying drawings. However, the present application is not limited to the above specific embodiments. The above specific embodiments are merely illustrative and not restrictive. Those of ordinary skill in the art, under the inspiration of the present application and without departing from the purpose of the present application and the scope protected by the claims, can still make many forms, all of which fall within the protection scope of the present application.

Claims

1. A method for processing NVRAM data, characterized in that, Applied to an electronic device, the electronic device includes: a Trusted Execution Environment (TEE), a Rich Execution Environment (REE), and an ARM Trusted Firmware (ATF). The REE includes a Trusted Platform Module (TPM), a first flash driver module, and a flash storage module. A target storage space in the flash storage module is used to store Non-Volatile Random Access Memory (NVRAM) data. The TEE includes a second flash driver module and a non-volatile random access memory (NVRAM) driver module for a Trusted Application (TA) of a Firmware-based Trusted Platform Module (FTPM). The method includes: When the TPM receives an NVRAM data processing operation, generate a first processing instruction corresponding to the NVRAM data processing operation through the TPM. The first processing instruction includes a second processing instruction, and the second processing instruction includes a write instruction corresponding to the NVRAM data storage operation or a read instruction corresponding to the NVRAM data read operation. Obtain and parse the first processing instruction through the NVRAM driver module to obtain the second processing instruction, and send the second processing instruction to the second flash driver module. Send a command corresponding to the second processing instruction through the second flash driver module to the first flash driver module through the ATF. The command includes a write command corresponding to the write instruction or a read command corresponding to the read instruction. Execute data processing corresponding to the command through the first flash driver module. The data processing includes processing of writing NVRAM data to the target storage space corresponding to the write command, or processing of reading NVRAM data from the target storage space corresponding to the read command. Before generating the first processing instruction corresponding to the NVRAM data processing operation through the TPM, the method further includes: Load a Unified Extensible Firmware Interface (UEFI) firmware through the REE. Load an OPTEE client through the UEFI firmware and allocate shared memory. Load an FTPM driver through the REE to start the TPM.

2. The method according to claim 1, characterized in that, In the case where the second processing instruction includes the write instruction, the second processing instruction includes the NVRAM data to be written. The method further includes: Encrypt the NVRAM data to be written through the second flash driver module to obtain NVRAM write data. Store the NVRAM write data in the shared memory through the second flash driver module, and generate a first Secure Monitor Call (SMC) instruction based on the address of the NVRAM write data in the shared memory and the write command. The step of sending a command corresponding to the second processing instruction through the second flash driver module to the first flash driver module through the ATF includes: sending a first SMC instruction through the second flash driver module to the first flash driver module through the ATF.

3. The method according to claim 2, wherein The step of executing data processing corresponding to the command through the first flash driver module includes: The first flash drive module reads the NVRAM write data from the shared memory based on the first SMC instruction; The first flash drive module writes the NVRAM write data to the target storage space.

4. The method according to claim 2 or 3, characterized in that The second flash drive module encrypts the NVRAM data to be written to obtain the NVRAM write data, including: The second flash drive module encrypts the NVRAM data to be written using the file storage key to obtain the NVRAM ciphertext data; The second flash drive module encrypts the file storage key based on the key encryption data, and the obtained encryption key, where the key encryption data includes the physical identification code of the electronic device, the physical identification code of the processor of the electronic device, and the universal unique identifier of the FTPM TA; The second flash drive module generates the NVRAM write data, and the NVRAM write data includes the NVRAM ciphertext data and the encryption key.

5. The method according to claim 4, characterized in that, The second flash drive module encrypts the file storage key based on the key encryption data to obtain the encryption key, including: The second flash drive module uses the key-related hash-based message authentication code HMAC algorithm based on the physical identification code of the electronic device, the static string, and the physical identification code of the processor to obtain the secure storage key; The second flash drive module uses the HMAC algorithm based on the secure storage key and the universal unique identifier of the FTPM TA to obtain the trusted application storage key; The second flash drive module encrypts the file storage key based on the trusted application storage key to obtain the encryption key.

6. The method according to claim 2, characterized in that When the second processing instruction includes the read instruction, the method further includes: The first flash drive module stores the NVRAM read data in the shared memory, and generates a second SMC instruction based on the address of the NVRAM read data in the shared memory. The NVRAM read data is the NVRAM data read by the first flash drive module from the target storage space in response to the execution of the read command; The first flash drive module sends the second SMC instruction to the second flash drive module through the ATF.

7. The method according to claim 6, wherein The method further includes: The second flash drive module reads the NVRAM read data from the shared memory based on the second SMC instruction; The second flash drive module decrypts the NVRAM read data to obtain the NVRAM plaintext data, and sends the NVRAM plaintext data to the NVRAM drive module for the electronic device to use the NVRAM plaintext data.

8. The method according to claim 1, characterized in that After generating a first processing instruction corresponding to the NVRAM data processing operation through the TPM, the method further includes: The OPTEE client running through the REE stores the first processing instruction in the shared memory, generates a third SMC instruction based on the address of the first processing instruction in the shared memory, and sends the third SMC instruction to the NVRAM driver module through the ATF; The obtaining and parsing the first processing instruction by the NVRAM driver module to obtain the second processing instruction includes: the NVRAM driver module reads the first processing instruction from the shared memory based on the third SMC instruction and parses the first processing instruction to obtain the second processing instruction.

9. The method according to claim 1, wherein The REE runs a Linux operating system, and the first flash driver module runs in the kernel of the Linux operating system; the TEE runs a TEE operating system TEE OS, and the second flash driver module runs in the kernel of the TEE OS.

10. An electronic device, characterized in that, The electronic device includes: a trusted execution environment TEE, a rich execution environment REE, and an ARM trusted firmware ATF. The REE includes a trusted platform module TPM, a first flash driver module, and a flash storage module. A target storage space in the flash storage module is used to store NVRAM data. The TEE includes a second flash driver module and a non-volatile random access memory NVRAM driver module of a trusted application TA of a firmware-based trusted platform module FTPM; The TPM is used to generate a first processing instruction corresponding to the NVRAM data processing operation when receiving the NVRAM data processing operation. The first processing instruction includes a second processing instruction, and the second processing instruction includes a write instruction corresponding to the NVRAM data storage operation or a read instruction corresponding to the NVRAM data reading operation; The NVRAM driver module is used to obtain and parse the first processing instruction to obtain the second processing instruction, and send the second processing instruction to the second flash driver module; The second flash driver module is used to send a command corresponding to the second processing instruction to the first flash driver module through the ATF. The command includes a write command corresponding to the write instruction or a read command corresponding to the read instruction; The first flash driver module is used to execute data processing corresponding to the command. The data processing includes processing of writing NVRAM data to the target storage space corresponding to the write command, or processing of reading NVRAM data from the target storage space corresponding to the read command; Before generating a first processing instruction corresponding to the NVRAM data processing operation through the TPM, the REE loads a Unified Extensible Firmware Interface UEFI firmware; The UEFI firmware is used to load the OPTEE client and allocate shared memory; The REE loads the FTPM driver to start the TPM.

11. An electronic device, characterized in that, The electronic device includes: a Trusted Execution Environment (TEE), a Rich Execution Environment (REE), and an ARM Trusted Firmware (ATF). The REE includes a Trusted Platform Module (TPM), a first flash drive module, and a flash storage module. A target storage space in the flash storage module is used to store Non-Volatile Random Access Memory (NVRAM) data. The TEE includes a second flash drive module and a Non-Volatile Random Access Memory (NVRAM) drive module for a Trusted Application (TA) of a Firmware-based Trusted Platform Module (FTPM). The electronic device further includes: a processor, a memory, and a program or instructions stored on the memory and executable on the processor. When the program or instructions are executed by the processor, the steps of the NVRAM data processing method according to any one of claims 1 to 9 are implemented.

12. A readable storage medium, characterized in that, A program or instructions are stored on the readable storage medium. When the program or instructions are executed by the processor, the steps of the NVRAM data processing method according to any one of claims 1 to 9 are implemented.

Images