Method and system for implementing secure processing of data using a processing application

Abstract

Disclosed is a method and system for implementing secure processing of data using a processing application. Specifically, a non-transitory computer-readable storage medium, a secure application framework, a system, and a computer-implemented method for implementing secure processing of data using a processing application configured to process data are disclosed. The method includes steps performed within a secure application framework running in a trusted execution environment. Data encrypted using a first random key is received, the first random key is received in a secure manner, and the encrypted data is decrypted using the first random key. The data is then input into the processing application, the processing application is executed to process the input data, and output data is received from the processing application. A second random key is generated, the output data is encrypted using the second random key, the second random key is encrypted using a public key of a storage device, and the encrypted output data and the encrypted second random key are sent to the storage device.

Description

Technical Field

[0001] The present invention relates to secure processing of encrypted data, and in particular to implementing secure processing of data when using untrusted processing applications. Such secure processing is implemented by executing the untrusted processing application by a secure application framework running in a trusted execution environment. Background Art

[0002] In applications where an authorized party wants to process encrypted data, such as video data or other image data captured in a camera and stored in encrypted form, security issues arise when processing applications that cannot ensure security. For example, since the encrypted data first needs to be decrypted before running the processing application, there is no guarantee that the processing application will not make any decrypted data accessible to unauthorized parties. In addition, it may be difficult, cumbersome, or even impermissible to adjust the processing application to ensure security. Schemes using homomorphic encryption have been proposed, in which the processing application can process encrypted data without decryption, and the results provided are also encrypted. However, this scheme is computationally intensive and is not suitable for all algorithms. Summary of the invention

[0003] An object of the present invention is to provide a computer-implemented method, secure application framework and system for implementing secure processing of data using an untrusted processing application configured to process data, which overcomes or mitigates the problems in known methods and systems.

[0004] According to a first aspect, a computer-implemented method for implementing secure processing of data using a processing application configured to process data is provided. The method is performed within a secure application framework running in a trusted execution environment, and includes receiving data encrypted using a first random key, receiving the first random key in a secure manner, and decrypting the encrypted data using the first random key to obtain data. The method also includes inputting the data to the processing application, executing the processing application to process the input data, and receiving output data from the processing application. The method further includes generating a second random key, encrypting the output data using the second random key, encrypting the second random key using a public key of a storage device, and sending the encrypted output data and the encrypted second random key to the storage device.

[0005] A trusted execution environment is a secure environment within a processing device. A trusted execution environment provides an execution space that provides an increased level of security relative to an untrusted execution environment such as a standard operating system. Applications executed within a trusted execution environment are isolated, thereby ensuring the privacy of the application's code and any data.

[0006] The secure application framework is configured to control all inputs to and outputs from the processing application. By running the secure application framework in a trusted execution environment, it can be ensured that decrypted data will not leak from the processing application outside the trusted execution environment.

[0007] Receiving the first random key in a secure manner means receiving the first random key in a manner in which the privacy of the first random key is protected, i.e. the first random key will not be disclosed to unauthorized parties in an unencrypted form. This can be achieved, for example, by receiving the first random key in an encrypted form or via a secure channel.

[0008] According to a second aspect, a non-transitory computer readable storage medium having stored thereon instructions for implementing the method according to the first aspect when executed by a system having processing capabilities.

[0009] According to a third aspect, a secure application framework configured to run in a trusted execution environment is provided. The secure application framework is configured to execute: an encrypted data receiving function configured to receive data encrypted using a first random key; a secure key receiving function configured to receive the first random key in a secure manner, and a data decryption function configured to decrypt the encrypted data using the first random key to obtain data. The secure application framework is further configured to execute: an input function configured to input data into a processing application; an execution function configured to execute the processing application to process the input data, and an output data receiving function configured to receive output data from the processing application. The secure application framework is further configured to execute: a second random key generation function configured to generate a second random key; an output data encryption function configured to encrypt output data using the second random key; a second random key encryption function configured to encrypt the second random key using the public key of the storage device, and an encrypted output data sending function configured to send the encrypted output data and the encrypted second random key to the storage device.

[0010] According to a fourth aspect, there is provided a system including a secure application framework according to the second aspect, and a device including a security module. The security module is configured to execute: a storage device key generation function configured to generate a private key / public key pair of the storage device; an encrypted key reception function configured to receive a first random key encrypted using the public key of the storage device; a first random key decryption function configured to decrypt the first random key using the private key of the storage device; and a secure key sending function configured to send the first random key to the secure application framework in a secure manner.

[0011] Further scope of application of the present invention will become apparent from the detailed description given below. However, it should be understood that the detailed description and specific examples, although indicating preferred embodiments of the present invention, are given by way of illustration only, because various changes and modifications within the scope of the present invention will become apparent to those skilled in the art from the detailed description.

[0012] Therefore, it should be understood that the present invention is not limited to the specific components of the described system or the actions of the described method, because such devices and methods can vary. It should also be understood that the terms used herein are only for the purpose of describing specific embodiments and are not intended to be limiting. It must be noted that, as used in the specification and the appended claims, the articles "a", "the" and "said" are intended to indicate the presence of one or more elements, unless the context clearly indicates otherwise. Thus, for example, references to "a unit" or "the unit" may include several devices, etc. In addition, the words "comprise", "include" and similar expressions do not exclude other elements or steps. BRIEF DESCRIPTION OF THE DRAWINGS

[0013] The above and other aspects of the present invention will now be described in more detail with reference to the accompanying drawings. The accompanying drawings should not be considered limiting but are for explanation and understanding. The same reference numerals refer to the same elements throughout.

[0014] Figure 1 is a schematic block diagram of an example system in which embodiments of the present disclosure may be implemented.

[0015] Figure 2 is a flow chart of an embodiment of a method for implementing secure processing of data using a processing application configured to process the data.

[0016] Figure 3 is a signaling diagram of an embodiment of a method for implementing secure processing of data using a processing application configured to process the data.

[0017] Figure 4 is a schematic block diagram of an embodiment of a secure application framework configured to run in a trusted execution environment.

[0018] Figure 5 is a schematic block diagram of an embodiment of a system for implementing secure processing of data using a processing application configured to process the data. DETAILED DESCRIPTION

[0019] The present invention will now be described more fully below with reference to the accompanying drawings, in which currently preferred embodiments of the present invention are shown. However, the present invention may be implemented in a variety of different forms and should not be construed as being limited to the embodiments set forth herein. Instead, these embodiments are provided for comprehensiveness and completeness and to convey the scope of the present invention to those skilled in the art.

[0020] Figure 1 1 is a schematic block diagram of an example system in which embodiments of the present disclosure may be implemented. Data in the form of video data or other image data is captured in the camera 100 and encrypted with the aid of a random key. The encrypted data is then sent from the camera 100 to and stored in the storage device 110, which may be located at the camera 100 or at a different location. Since the data is encrypted with the aid of a random key, the data may be securely stored in the storage device 110 even if the party operating the storage device 110 is different from the party owning the camera 100. In addition, the camera 100 is connected to a second device 140 including a security module 145, a private key / public key pair of the storage device 110 is generated in the security module 145, and a public key of the private key / public key pair of the storage device 110 is provided from the second device 140 to the camera 100. The camera 100 may then wrap (encrypt) the random key and the public key of the storage device 110 into a key envelope. The key package (the random key encrypted with the public key of the storage device 110) is then sent to the storage device 110 and stored therein. The random key is then typically discarded in the camera 100. If a processing application 126 configured to process data (e.g., analyze or modify data) is to be used (and for which the privacy of the data cannot be ensured), an embodiment of a secure application framework 125 and methods and systems related thereto are provided, as described below in conjunction with Figures 2 to 5 The secure application framework 125 is configured to run in a trusted execution environment 122, which may be located in the first device 120. The secure application framework 125 is typically implemented in software and is executed in the trusted execution environment 122. The secure application framework 125 is responsible for processing the execution of the application 126, which is also executed in the trusted execution environment 122. The secure application framework 125 is loaded and started by software in an application framework 128 that is executed outside the trusted execution environment 122.

[0021] It should be noted that the storage device 110, the first device 120, and the second device 140 do not have to be separate devices. For example, the secure application framework 125 can be run in a trusted execution environment 122 configured as a secure area of ​​a conventional processor (not shown) of the storage device 110, and the second device 140 can be a separate chip in the storage device 110 connected to the processor of the storage device 110.

[0022] Now refer to Figure 2 An embodiment of a computer-implemented method 200 for implementing secure processing of data using a processing application 126 configured to process data is described. Embodiments of the method may be used, for example, in conjunction with Figure 1 The described system is implemented.

[0023] According to an embodiment of the method 200, the following steps are performed within a secure application framework 125 running in a trusted execution environment 122, such as an open portable TEE (OP-TEE). First, data encrypted using a first random key is received S210. The first random key is then received S215 in a secure manner, and the encrypted data is decrypted S220 using the first random key. Thus, the data is obtained in a decrypted form and input S225 to a processing application 126. The processing application 126 is then executed S230 to process the input data. The processing can be any type of processing, such as data analysis or data adjustment. The data can, for example, be video data. The analysis can then involve analysis of the movement of a person for creating a heat map of the movement, and the adjustment can be, for example, masking the face by pixelation.

[0024] The processing application 126 is executed by the secure application framework 125. Since the processing application 126 runs in the trusted execution environment 122, only a limited number of functions are allowed for the processing application 126, and these functions are executed by the secure application framework 125. Since the secure application framework 125 runs in the trusted execution environment 122, it can also be ensured that no other data can be provided from the processing application 126 to the outside of the trusted execution environment 122 except for the data controlled by the secure application framework 125.

[0025] Once the processing application 126 has processed the input data, output data from the processing application 126 is received S235. The output data typically includes the result of the processing. A second random key is then generated S240, and the output data is encrypted S245 using the second random key. The second random key is then encrypted S250 using the public key of the storage device 110. Another formulation of this is to wrap the second random key with the public key of the storage device 110 in a key package. Finally, the encrypted output data and the encrypted second random key are sent S255 to the storage device 110 for storage.

[0026] It should be noted that Figure 2 The order of steps in the flowchart is not necessarily performed in the order shown in the flowchart. Specifically, a step that is not indicated as being dependent on input from a previous step may be performed before the previous step. Similarly, a step that is not indicated as providing an output to a subsequent step may be performed after the subsequent step.

[0027] In the secure application framework 125, a public key of the storage device 110 may be requested from another device, such as a device that generates a private key / public key pair of the storage device 110, such as the device 140 including the security module 145. The public key of the storage device 110 is then received in the secure application framework 125.

[0028] The device 140 including the security module 145 can be any device including a module capable of handling sensitive data at a security level required by the relevant application, such as a function or chip within the storage device 110. The security module 145 is a module capable of managing private key / public key pairs in a secure manner, thereby preventing the public key or other sensitive data from being disclosed to unauthorized parties. Specifically, the security module 145 is a module capable of generating a private key / public key pair, decrypting data encrypted using a public key of the generated private key / public key pair (such as a random key), and sending the decrypted data to another device in a secure manner. Sending data in a secure manner means that the data is sent in such a way that the privacy of the data is secure, i.e., the data will not be disclosed to unauthorized parties in an unencrypted form.

[0029] The security module 145 may be, for example, a trusted platform module (TPM) or a secure element (SE). The security module 145 may be implemented using hardware or software or a combination of both.

[0030] Within the device 140 including the security module 145, a private key / public key pair for the storage device 110 may be generated. Furthermore, a first random key encrypted using the public key of the storage device 110 may, for example, be received from the storage device 110 and decrypted within the device 140 including the security module 145 using the private key of the storage device 110. The first random key may then be sent to the secure application framework 125 in a secure manner.

[0031] Sending the first random key to the secure application framework 125 in a secure manner may be achieved, for example, by sending the first random key in encrypted form or via a secure channel (not shown).

[0032] When the first random key in encrypted form is sent, a private key / public key pair of the processing application 126 is first generated in the secure application framework 125 running in the trusted execution environment 122. The public key of the processing application 126 is then sent to the device 140 including the security module 145. In the device 140 including the security module 145, the first random key is encrypted using the public key of the processing application 126, and the first random key encrypted using the public key of the processing application 126 is sent to the secure application framework 125. Then, in the secure application framework 125, the first random key is decrypted using the private key of the processing application 126.

[0033] When the first random key is sent via a secure channel, a secure channel may be established for communication between the device 140 including the security module 145 and the secure application framework 125 running in the trusted execution environment 122. Then, the first random key is sent in a secure manner by sending the first random key to the secure application framework 125 running in the trusted execution environment 122 via the secure channel. The secure channel may be implemented by the trusted execution environment 122 generating a private key / public key pair for the channel. The device 140 including the security module 145 may then encrypt data using a public key of the private key / public key pair for the channel. Alternatively, the device 140 including the security module 145 may encrypt a symmetric key generated by the device 140 including the security module 145 using a public key of the private key / public key pair for the channel, and send the encrypted symmetric key to the trusted execution environment 122. Then, the symmetric key may be used to encrypt data sent using the secure channel.

[0034] Now combine Figure 3 To describe an embodiment of a computer-implemented method for implementing secure processing of data using a processing application 126 configured to process data, Figure 3 The signaling between different entities related to the method is shown. The entities involved are the storage device 110, the security module 145, the application framework 128, the trusted execution environment 122, the secure application framework 125 and the processing application 126.

[0035] An embodiment of the method can be, for example, in combination with Figure 1The system described is implemented in the described system. In this case, the camera 100 has captured and encrypted data in the form of video data or other image data with the help of a first random key generated in the camera 100. The private key / public key pair of the storage device 110 has been generated in the device, for example in the device 140 including the security module 145, and the public key of the storage device 110 has been provided to the camera 100. The camera 100 then encrypts the first random key using the public key of the storage device 110, and then preferably discards the first random key so that it is no longer available in the camera 100. The encrypted data and the encrypted first random key are then transmitted to the storage device 110 and stored therein. The only way to access the data in decrypted form is to decrypt the first random key and then decrypt the encrypted data using the first random key. To do this, it is necessary to access the private key of the storage device 110 stored in the security module 145.

[0036] When data is to be processed by a processing application 126 that cannot ensure data privacy, a request is sent 301 to the application framework 128 to start processing of such data using the processing application 126. The request may include the processing application 126, or the processing application 126 may be or has been downloaded from another device, such as the device of the provider of the processing application 126. The application framework 128 is typically configured in the same device as the secure application framework 125 and the trusted execution environment 122. The application framework 128 then prepares 302 instructions to the secure application framework 125 to execute the processing application 126 on the selected data, while also configuring the secure application framework 125 to decrypt the random key of the selected data using the required encryption key and encrypt the resulting random key. This means that the processing application 126 and the secure application framework 125 are configured so that the processing application 126 can only receive and provide data and be executed based on instructions initiated by the secure application framework 125.

[0037] Now, in order to access the data, the first random key for encrypting the data on the storage device 110 is required, and in order to access the first random key, the private key of the storage device 110 is required, because the first random key is stored encrypted using the private key of the storage device 110. However, instead of providing the private key of the secure application framework 125 to the storage device 110 in a secure manner, an alternative scheme is used to provide access to the data without providing the private key of the storage device 110 outside the security module 145. This is beneficial because the private key of the storage device 110 can be used to encrypt other data that the secure application framework 125 may not be authorized to access. The first way to provide the first random key to the secure application framework 125 from the security module 145 is by means of a secure channel. The second way is to send the first random key encrypted using a different private key / public key pair, such as a key pair associated with the processing application 126. These two ways have been described above. In the following, the scheme according to the second way is used.

[0038] The secure application framework 125 is configured to generate 303 a private key / public key pair for the processing application 126. The key pair may be unique to the processing application 126, or it may be the same for multiple processing applications. Since the secure application framework 125 is configured to run in the trusted execution environment 122, it can be ensured that the private key of the processing application 126 is not leaked outside the trusted execution environment 122. The public key of the processing application 126 is then sent 304 from the secure application framework 125 to the security module 145. The security module repackages 305 the first random key using the public key for the processing application 126. This means that the security module 145 first decrypts the encrypted first random key using the private key of the storage device 110, and then encrypts the first random key using the public key of the processing application 126.

[0039] The processing application 126 can now be run, so the application framework indicates 306 to the trusted execution environment 122 that the processing application 126 should be run with reference to the data stored encrypted in the storage device 110. The trusted execution environment 122 then launches 307 the secure application framework 125 to begin executing the processing application 126. The secure application framework 125 receives 308 the data encrypted using the first random key from the storage device 110, and receives 309 the rewrapped first random key from the security module 145. Since the received first random key has been rewrapped using the public key of the processing application 126, the secure application framework 125 can decrypt 310 the first random key using the private key of the processing application 126. Using the first random key, the secure application framework 125 can then decrypt 311 the data using the first random key that has been generated and saved in the secure application framework 125. The decrypted data is then provided 312 to the processing application 126, and the processing application 126 is then executed in the secure application framework 125 running the trusted execution environment 122. Once the processing application 126 processes the data, output data including the processing results is received 313 from the processing application 126 in the secure application framework 125 .

[0040] Since not only the data but also the result of the processing (output data) may be sensitive data for which privacy (access) should be controlled, the output data should also be encrypted before being transmitted outside the trusted execution environment 122. Specifically, the encryption may be in such a way that only parties that can access the original data on the storage device 110 should have access to the result (output data). To this end, a second random key is generated 314 in the secure application framework 125. Furthermore, a public key for the storage device 110 is received 315 from the security module 145 in the secure application framework 125, and the second random key is encrypted (wrapped in a key file) 316 using the public key of the storage device 110. The encrypted second random key (key file) is then sent 317 to the storage device 110. Finally, the output data is encrypted 318 using the second random key and sent 319 to the storage device 110. Since the output data is encrypted using the second random key, and the second random key is encrypted using the public key of storage device 110, only parties that can access the original data on storage device 110, that is, parties that can access the private key of storage device 110, can access the output data.

[0041] Now combine Figure 4 Describe an embodiment of the secure application framework 425, such as in conjunction with Figure 1 The secure application framework 125 described herein is configured to be used in a trusted execution environment such as a Figure 1 The secure application framework 425 may be implemented in a trusted execution environment as described above. Figure 1 The described system is implemented.

[0042] According to an embodiment, the secure application framework 425 is configured to run in the trusted execution environment 122 and execute an encrypted data receiving function 430 configured to receive data encrypted using a first random key; a secure key receiving function 432 configured to receive the first random key in a secure manner, and a data decryption function 434 configured to decrypt the encrypted data using the first random key to obtain the data in a decrypted form. The secure application framework 425 is further configured to execute an input function 436 configured to input data to the processing application 126; an execution function 438 configured to execute the processing application 126 to process the input data; and an output data receiving function 440 configured to receive output data from the processing application 126. The secure application framework 425 is further configured to execute a second random key generation function 442, configured to generate a second random key; an output data encryption function 444, configured to encrypt output data using the second random key; a second random key encryption function 446, configured to encrypt the second random key using the public key of the storage device 110, and a sending function 448, configured to send the encrypted output data and the encrypted second random key to the storage device 110.

[0043] In order to receive the first random key in a secure manner in the security key receiving function 432, the security key receiving function may, for example, be configured to receive the first random key in an encrypted form or via a secure channel.

[0044] In a configuration where the first random key is received in encrypted form, the secure application framework 425 is further configured to execute a processing application key generation function 440 configured to generate a private key / public key pair for the processing application 126. The secure key reception function 432 is further configured to receive the first random key encrypted using the public key of the processing application 126 and to decrypt the first random key using the private key of the processing application 126.

[0045] In the configuration of receiving the first random key via a secure channel, the security key receiving function 432 is further configured to receive the first random key via a secure channel. Such a secure channel can be established for communication between the device 140 including the security module 145 and the security application framework 125, 425 running in the trusted execution environment 122. Then, the first random key is sent in a secure manner by sending the first random key to the security application framework 425 running in the trusted execution environment 122 via the secure channel. The secure channel can be implemented by generating a private key / public key pair of the channel in the trusted execution environment 122, and then the device 140 including the security module 145 can encrypt data using the public key of the private key / public key pair of the channel. Therefore, when data such as the first random key are to be securely received in the security application framework 425, they are encrypted using the public key of the private key / public key pair of the channel. Alternatively, the device 140 including the security module 145 may encrypt a symmetric key generated by the device 140 including the security module 145 using a public key of a private key / public key pair of a channel, and send the encrypted symmetric key to the trusted execution environment 122. Then, data such as the first random key, which is securely received using the secure channel, is encrypted using the symmetric key.

[0046] The first random key may be received in a secure manner from a device 140 including a security module 145, which may be any device including a module capable of processing sensitive data at a security level required by the relevant application. Receiving data in a secure manner means receiving the data in such a manner that the privacy of the data is protected, i.e., the data is not disclosed to unauthorized parties in an unencrypted form. The security module 145 may be, for example, a trusted platform module (TPM) or a security element (SE). The security module may be implemented using hardware or software or a combination of both.

[0047] The security application framework 425 can also be configured to execute a request function 442 and a storage device public key receiving function 444, wherein the request function 442 is configured to request the device 140 including the security module 145 to provide the public key of the storage device 110, and the storage device public key receiving function 444 is configured to receive the public key of the storage device 110 from the device 140 including the security module 145.

[0048] According to the combination Figure 2 and Figure 3 The corresponding steps of the described method 200 can further modify the functions of the secure application framework 425 and can add more functions.

[0049] Now combine Figure 5An embodiment of a system 500 for implementing secure processing of data using a processing application 126 configured to process data is described. Embodiments of the system 500 may be used, for example, in conjunction with Figure 1 The described system is implemented.

[0050] The system 500 includes a secure application framework 525 configured to run in the trusted execution environment 122, such as in conjunction with Figure 4 The security application framework 425 described herein or in combination with Figure 1 The secure application framework 125 described above can be configured in a first device 520 that includes a processor (not shown) running the trusted execution environment 122.

[0051] The system further includes a second device 540, the second device 540 includes a security module 545, the security module 545 is configured to perform a storage device key generation function 550 configured to generate a private key / public key pair of the storage device 110 and an encrypted key receiving function 552 configured to receive a first random key encrypted using the public key of the storage device 110. The security module 545 is further configured to perform a first random key decryption function 554 configured to decrypt the first random key using the private key of the storage device 110, and a secure key sending function 556 configured to send the first random key to the secure application framework 525 in a secure manner.

[0052] Device 540 including security module 545 may be any device including a module capable of handling sensitive data at the security level required by the relevant application. Security module 545 is a module capable of managing private key / public key pairs in a secure manner, thereby preventing public keys or other sensitive data from being disclosed to unauthorized parties.

[0053] The security module 545 may be, for example, a trusted platform module (TPM) or a secure element (SE). The security module may be implemented using hardware or software or a combination of both.

[0054] According to the combination Figure 2 and Figure 3 The corresponding steps of the method 200 described and the combination Figure 4 The functions of the security application framework 525 of the system 500 can be further adjusted, and more functions can be added. Figure 2 and Figure 3 The corresponding steps of the described method 200 and the functions of the security module 545 of the system 500 can be further adjusted, and more functions can be added.

[0055] Those skilled in the art will recognize that the present invention is not limited to the above-described embodiments. On the contrary, within the scope of the appended claims, multiple modifications and variations are possible. By studying the drawings, the disclosure and the appended claims, those skilled in the art can understand and implement these modifications and variations when practicing the claimed invention.

Claims

1. A computer-implemented method (200) for implementing secure processing of data using an untrusted processing application configured to process data, the method comprising, within a secure application framework running in a trusted execution environment and controlling all inputs to and outputs from the untrusted processing application: receiving (S210) the data encrypted using a first random key; receiving (S215) the first random key in a secure manner; decrypting (S220) the encrypted data using the first random key, thereby obtaining the data; inputting (S225) the data obtained by decryption into the untrusted processing application; executing ( S230 ) the untrusted processing application in the trusted execution environment to process the input data; receiving (235) output data from the untrusted processing application; generating (S240) a second random key; encrypting (S245) the output data using the second random key; encrypting (S250) the second random key using a public key of the storage device; as well as sending (S255) the encrypted output data and the encrypted second random key to the storage device; Wherein, the storage device is located outside the trusted execution environment.

2. The method (200) according to claim 1, further comprising: In an apparatus including a security module: generating a private key / public key pair for the storage device; receiving the first random key encrypted using the public key of the storage device; decrypting the first random key encrypted using the public key of the storage device using the private key of the storage device; as well as The first random key obtained by the decryption is sent to the secure application framework in a secure manner.

3. The method (200) of claim 1, further comprising: Within the secure application framework running in the trusted execution environment: generating a private key / public key pair for the untrusted processing application, Wherein, receiving the first random key in a secure manner comprises: receiving the first random key encrypted using the public key of the untrusted processing application; and The first random key encrypted using the public key of the untrusted processing application is decrypted using the private key of the untrusted processing application.

4. The method (200) according to claim 3, further comprising: Within the secure application framework running in the trusted execution environment: sending said public key of said untrusted processing application to a device comprising a security module, and in said device comprising said security module: receiving the public key of the untrusted processing application; encrypting the first random key using the public key of the untrusted processing application; as well as The first random key encrypted using the public key of the untrusted processing application is sent to the secure application framework.

5. The method (200) according to claim 4, further comprising: In the device including the security module: generating a private key / public key pair for the storage device; receiving the first random key encrypted using the public key of the storage device; as well as The first random key encrypted using the public key of the storage device is decrypted using the private key of the storage device.

6. The method (200) of claim 2, further comprising: establishing a secure channel for communication between the device including the security module and the secure application framework running in the trusted execution environment, Wherein, in the device including the security module, sending the first random key to the secure application framework in a secure manner comprises: The first random key is sent via the secure channel to the secure application framework running in the trusted execution environment.

7. A non-transitory computer-readable storage medium having stored thereon instructions for implementing the method according to any one of claims 1 to 6 when executed by a system having processing capabilities.

8. An electronic device comprising: A processor running a trusted execution environment running a secure application framework to control all inputs to and outputs from an untrusted process application, the secure application framework performing: an encrypted data receiving function (430) configured to receive data encrypted using a first random key; a secure key receiving function (432) configured to receive the first random key in a secure manner; a data decryption function (434), configured to decrypt the encrypted data using the first random key, thereby obtaining the data; an input function (436) configured to input the data obtained by decryption into the untrusted processing application; an execution function (438) configured to execute the untrusted processing application in the trusted execution environment to process the input data; as well as an output data receiving function (440) configured to receive output data from the untrusted processing application; a second random key generation function (442) configured to generate a second random key; an output data encryption function (444) configured to encrypt the output data using the second random key; a second random key encryption function (446) configured to encrypt the second random key using a public key of the storage device; a sending function (448) configured to send the encrypted output data and the encrypted second random key to the storage device, Wherein, the storage device is located outside the trusted execution environment.

9. The electronic device according to claim 8, wherein: The secure application framework is further configured to perform: a process application key generation function (450) configured to generate a private key / public key pair for the untrusted process application, Wherein, the security key receiving function (432) is further configured to: receiving the first random key encrypted using the public key of the untrusted processing application; and The first random key encrypted using the public key of the untrusted processing application is decrypted using the private key of the untrusted processing application.

10. The electronic device according to claim 8, wherein: The security key receiving function is further configured to: The first random key is received via a secure channel.

11. A system (500), comprising: The electronic device according to claim 8; as well as An apparatus (140, 540) comprising a security module (145, 545) configured to perform: A storage device key generation function is configured to generate a private key / public key pair for the storage device; an encrypted key receiving function is configured to receive the first random key encrypted using the public key of the storage device; a first random key decryption function is configured to decrypt the first random key encrypted using the public key of the storage device using the private key of the storage device; and a secure key sending function is configured to send the first random key obtained by the decryption to the secure application framework in a secure manner.

12. The system (500) of claim 11, wherein: The secure application framework (425, 525) is further configured to perform: a process application key generation function configured to generate a private key / public key pair for the untrusted process application, Wherein, the security key receiving function is further configured as follows: receiving the first random key encrypted using the public key of the untrusted processing application; and The first random key encrypted using the public key of the untrusted processing application is decrypted using the private key of the untrusted processing application.

13. The system (500) of claim 12, wherein: The secure application framework (425, 525) is further configured to perform: a processing application key sending function configured to send the public key of the untrusted processing application to the device including the security module, And wherein the device including the security module is further configured to execute: a processing application key receiving function configured to receive the public key of the untrusted processing application; a first random key encryption function configured to encrypt, using the public key of the untrusted processing application, the first random key decrypted using the private key of the storage device; and The encrypted first random key sending function is configured to send the first random key encrypted using the public key of the untrusted processing application to the secure application framework.

14. The system (500) according to claim 11, further configured to perform: a secure channel establishment function configured to establish a secure channel for communication between the device including the security module and the secure application framework running in the trusted execution environment, And among them, The secure key sending function is configured to send the first random key to the secure application framework via the secure channel.

Images