A secure memory zero-copy management method, system, device and storage medium

Abstract

The application discloses a kind of safe memory zero-copy management method, system, device and storage medium, method includes: in response to the sending request of target data, based on the configuration information of target physical memory, generate the first mapping relationship of target data and target physical memory;According to the first mapping relationship, the memory area of target physical memory for storing target data is configured as safe memory, and the second mapping relationship that trusted execution environment accesses safe memory is established;Based on the second mapping relationship, notify the data operation number of the use object of target data in trusted execution environment.This embodiment of the application realizes zero-copy by the mode of page table mapping management, and data is transmitted from non-safe memory into safe memory;The embodiment of the application improves the efficiency of memory from non-safe memory into safe memory, reduces the requirement of DRM scheme to device physical memory capacity, and can be widely applied in memory configuration technical field.

Description

Technical Field

[0001] This invention relates to the field of memory configuration technology, and in particular to a secure memory zero-copy management method, system, device, and storage medium. Background Technology

[0002] DRM (Digital Rights Management) is a copyright protection solution for high-definition videos. It primarily prevents the leakage of high-definition video data and protects the copyright rights of the creators. To prevent video data theft, the video data is encrypted when sent from the server to the device. The device reads the encrypted video during playback, decrypting it as it plays. This way, even if a user copies and publishes the video file online, the published video is encrypted and cannot be played by others who download it, preventing video data leakage. Furthermore, to protect the data used for actual playback after decryption, a Trusted Execution Environment (TEE) technology is introduced. The actual decryption process takes place within the TEE, and the decrypted video data is stored in secure memory accessible only to the TEE. This means that even if a hacker infiltrates the TEE and gains control, they still cannot access the secure memory accessible only to the TEE, thus preventing them from obtaining the decrypted video stored in secure memory. This more effectively protects the security of video data.

[0003] To transfer data from a rich execution environment to a trusted execution environment for processing, existing technologies divide memory into three parts: insecure memory, shared memory, and secure memory. Insecure memory is used by the rich execution environment, secure memory by the trusted execution environment, and shared memory is used for data exchange between the two environments. However, transferring data from insecure memory to secure memory requires at least two copies: 1. from insecure memory to shared memory; 2. from shared memory to secure memory. This makes the data and memory configuration process extremely cumbersome. Summary of the Invention

[0004] In view of this, embodiments of the present invention provide a secure memory zero-copy management method, system, device and storage medium, which can realize secure memory zero-copy management.

[0005] On one hand, embodiments of the present invention provide a secure memory zero-copy management method, including: In response to the request to send target data, a first mapping relationship between the target data and the target physical memory is generated based on the configuration information of the target physical memory; Based on the first mapping relationship, the memory region in the target physical memory that stores the target data is configured as secure memory, and a second mapping relationship for the trusted execution environment to access secure memory is established. Based on the second mapping relationship, the target data user is notified to perform data operations in a trusted execution environment.

[0006] Optionally, the method further includes: In response to a memory region reclamation request, the region to be reclaimed in the target physical memory is determined based on the first mapping relationship; Based on the areas to be reclaimed, the memory management module of the trusted execution environment is notified to perform memory reclamation.

[0007] Optionally, memory reclamation processing includes at least one of the following: Clean up the data in the area to be reclaimed; Configure and convert secure memory to insecure memory; Clear the second mapping relationship for trusted execution environment access to secure memory.

[0008] Optionally, the target data includes several data pages; in response to a request to send the target data, based on the configuration information of the target physical memory, a first mapping relationship between the target data and the target physical memory is generated, including: In response to the request to send target data, obtain the virtual addresses of each data page in the target data; Based on the configuration information of the target physical memory, determine the physical addresses of discrete memory within the target physical memory; Based on the virtual address and physical address, generate the first mapping relationship between the target data and the target physical memory.

[0009] Optionally, based on the first mapping relationship, the memory region in the target physical memory that stores the target data is configured as safe memory, including: Based on the first mapping relationship, determine the memory region in the target physical memory used to store the target data; Configure the memory region permissions for the target physical memory and designate the memory region as safe memory.

[0010] Optionally, a second mapping relationship for accessing secure memory by the trusted execution environment is established, including: Obtain the physical address of safe memory; Based on the physical address, generate the execution virtual address for the trusted execution environment to access secure memory; A second mapping relationship is established based on the physical address and the execution virtual address.

[0011] Optionally, based on the second mapping relationship, the target data user is notified to perform data operations in a trusted execution environment, including: Based on the second mapping relationship, establish access links for secure memory to the target data's users in the trusted execution environment; Based on the access link, the user is notified to perform data operations on the target data in a trusted execution environment.

[0012] On the other hand, embodiments of the present invention provide a secure memory zero-copy management system, including: The first module is used to respond to the request to send target data and generate a first mapping relationship between target data and target physical memory based on the configuration information of target physical memory; The second module is used to configure the memory region storing target data in the target physical memory as secure memory according to the first mapping relationship, and to establish a second mapping relationship for the trusted execution environment to access secure memory; The third module is used to notify the target data user to perform data operations in a trusted execution environment based on the second mapping relationship.

[0013] On the other hand, embodiments of the present invention provide a secure memory zero-copy management device, including a processor and a memory; Memory is used to store programs; The processor executes the program as described above.

[0014] On the other hand, embodiments of the present invention provide a computer-readable storage medium storing a program that is executed by a processor to implement the method described above.

[0015] This invention also discloses a computer program product or computer program, which includes computer instructions stored in a computer-readable storage medium. A processor of a computer device can read the computer instructions from the computer-readable storage medium and execute the computer instructions, causing the computer device to perform the aforementioned method.

[0016] In this embodiment of the invention, in response to a request to send target data, a first mapping relationship between the target data and the target physical memory is generated based on the configuration information of the target physical memory. According to the first mapping relationship, the memory region in the target physical memory storing the target data is configured as secure memory, and a second mapping relationship is established for access to secure memory from a trusted execution environment. Based on the second mapping relationship, the user of the target data is notified to perform data operations in the trusted execution environment. This embodiment of the invention, through the first and second mapping relationships, implements a page table-based mapping management method, enabling secure state transitions in the memory region storing the target data in the target physical memory, thereby achieving zero-copy data transfer from insecure memory to secure memory. This embodiment of the invention improves the efficiency of transferring data from insecure memory to secure memory, reduces the additional physical memory consumption caused by physically distinguishing between insecure memory, shared memory, and secure memory, and lowers the physical memory capacity requirements of the DRM solution for the device. Attached Figure Description

[0017] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0018] Figure 1 A flowchart illustrating a secure memory zero-copy management method provided in an embodiment of the present invention; Figure 2 This invention provides a rich execution environment for sending data to a trusted execution environment. Figure 3 A schematic diagram of the process architecture for reclaiming the memory area storing data after the trusted execution environment has been used in the rich execution environment according to an embodiment of the present invention; Figure 4 This is a schematic diagram of a secure memory zero-copy management system provided in an embodiment of the present invention; Figure 5 This is a schematic diagram of a secure memory zero-copy management device provided in an embodiment of the present invention. Detailed Implementation

[0019] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention.

[0020] First, it's important to note that the introduction of a Trusted Execution Environment (TEE) to protect DRM (Digital Rights Management) videos necessitates transferring large amounts of video data from a Rich Execution Environment (REE) to the TEE's dedicated secure memory. This places higher demands on the device's physical memory capacity and memory management.

[0021] In view of this, embodiments of the present invention reduce capacity and requirements through relevant memory management strategies, thereby increasing the applicability of this DRM video playback scheme based on a trusted execution environment. On one hand, referring to... Figure 1 The present invention provides a secure memory zero-copy management method, comprising: S100: In response to the request to send target data, generate a first mapping relationship between target data and target physical memory based on the configuration information of target physical memory; It should be noted that the target data includes several data pages; in some embodiments, step S100 may include: in response to a request to send the target data, obtaining the virtual address of each data page in the target data; determining the physical address of discrete memory in the target physical memory based on the configuration information of the target physical memory; and generating a first mapping relationship between the target data and the target physical memory based on the virtual address and the physical address.

[0022] In some specific embodiments, such as Figure 2 As shown, taking the scenario of a rich execution environment sending data to a trusted execution environment as an example: First, the rich execution environment memory management module receives a request to send data (usually from a DRM video client); then, the rich execution environment memory management module generates the memory mapping relationship of the data to be transmitted, and then sends it to the trusted execution environment memory management module.

[0023] S200. Based on the first mapping relationship, configure the memory region storing the target data in the target physical memory as secure memory, and establish a second mapping relationship for the trusted execution environment to access secure memory; It should be noted that, in some embodiments, configuring the memory region in the target physical memory that stores the target data as secure memory according to the first mapping relationship may include: determining the memory region in the target physical memory used to store the target data according to the first mapping relationship; configuring the memory region's permissions according to the configuration information of the target physical memory; and configuring the memory region as secure memory.

[0024] In some specific embodiments, such as Figure 2 As shown, taking the scenario of a rich execution environment sending data to a trusted execution environment as an example: The Trusted Execution Environment (TEE) memory management module, based on the received memory mapping relationship, instructs the secure memory configuration device to configure the corresponding memory region as secure memory for protection. This secure memory configuration device can be implemented through a dedicated memory protection device built into the System-on-Chip (SoC). Specifically, this device reads protection configuration information from memory and configures the specified region. The protection method is as follows: The configuration information designates a specific memory region as "safe memory," and the protection device checks all accesses to this region. If the entity initiating the access (CPU, data transfer module, video playback module, video decoding module, etc.) does not have the corresponding permissions configured in the configuration information, the access to that memory region will fail. Furthermore, protection can also be implemented in the following ways: The configuration information specifies the memory access mapping table for different access subjects. All accesses to memory by any subject will be translated into accesses to another address according to the configuration information. When a subject's mapping table does not contain a mapping relationship pointing to the protected area, all accesses issued by that subject cannot form accesses to the specified memory protection area, indirectly preventing that subject from accessing the specified memory, thus achieving protection.

[0025] In some embodiments, establishing a second mapping relationship for trusted execution environment access to secure memory may include: obtaining the physical address of secure memory; generating an execution virtual address for trusted execution environment access to secure memory based on the physical address; and establishing a second mapping relationship based on the physical address and the execution virtual address.

[0026] In some specific embodiments, such as Figure 2 As shown, taking the scenario of a rich execution environment sending data to a trusted execution environment as an example: Based on the received memory mapping relationships, the Trusted Execution Environment (TEE) memory management module can establish a mapping relationship for secure memory access (configured in the aforementioned steps) through the control of the memory management unit (MMU). This mapping configuration can be implemented through the memory management unit within the System-on-a-Chip (SoC). The MMU reads configuration information from memory, and all CPU accesses to memory are translated into accesses to other addresses based on this configuration information; this "translation" is the so-called "mapping." By modifying the configuration information, CPU accesses to the mapped virtual addresses are translated into accesses to the physical memory specified in the configuration information. Therefore, by modifying the MMU's configuration information, CPU access to specific physical memory regions can be established.

[0027] It should also be noted that the secure memory configuration device can be replaced with a global MMU, which prevents the rich execution environment from accessing specific regions by removing the rich execution environment's addressing of protected regions. That is, by: 1. Secure memory configuration device → Rich execution environment can find a secure area and initiates access, but access is denied; Replace with: 2. Global MMU → Rich execution environment cannot find a secure region, and cannot initiate access.

[0028] S300. Based on the second mapping relationship, notify the target data user to perform data operations in the trusted execution environment.

[0029] It should be noted that in some embodiments, step S300 may include: establishing an access link for the target data user to secure memory in a trusted execution environment based on the second mapping relationship; and notifying the user to perform data operations on the target data in the trusted execution environment according to the access link.

[0030] In some specific embodiments, such as Figure 2 As shown, taking the scenario of a rich execution environment sending data to a trusted execution environment as an example: Based on the received memory mapping relationship, the Trusted Execution Environment (TEE) memory management module can notify the user of the data sent in (usually the decryption module for DRM videos) within the TEE.

[0031] It should be noted that, in some embodiments, the method may further include the following steps: in response to a memory region reclamation request, determining a region to be reclaimed in the target physical memory based on a first mapping relationship; and, according to the region to be reclaimed, notifying the memory management module of the trusted execution environment to perform memory reclamation processing.

[0032] In some embodiments, the memory reclamation process may include at least one of the following: cleaning up the data in the area to be reclaimed; converting secure memory to insecure memory; and clearing the second mapping relationship between the trusted execution environment and secure memory.

[0033] In some specific embodiments, such as Figure 3 As shown, taking the scenario where the rich execution environment reclaims the memory area storing data after the trusted execution environment has finished using it as an example, the steps include: (1) The rich execution environment memory management module receives a request to reclaim a memory area (usually from a DRM video client). (2) The rich execution environment memory management module notifies the trusted execution environment memory management module of the areas that need to be reclaimed; (3) The Trusted Execution Environment memory management module addresses areas that need to be reclaimed: ①Clean up the data in this area; ② Instruct the secure memory configuration device to restore the corresponding memory region to insecure memory, thus enabling the rich execution environment to use it. ③ Control the MMU to delete the mapping relationship for trusted execution environment access to this memory.

[0034] To fully illustrate the overall data flow principle of the method in the embodiments of the present invention, the technical solution of the present invention will be further described below in conjunction with some specific embodiments. It should be understood that the following is an explanation of the present invention and should not be regarded as a limitation of the present invention.

[0035] like Figure 2 As shown, the method flow of this embodiment of the invention can be implemented through the following steps: 1. Notification of Data to be Sent. The DRM video client sends information about the data to be transferred to the Trusted Execution Environment (TEE) to the rich execution environment's memory management module. This information typically includes metadata about the data pages to be transmitted to the TEE, such as the page's virtual address and mapped physical address. These pages are discretely distributed in physical memory and mapped into contiguous memory blocks by the rich execution environment's memory management module.

[0036] 2. The memory management module of the rich execution environment sends this metadata (such as the virtual address of the page, the mapped physical address, etc.) to the memory management module of the trusted execution environment.

[0037] 3. The memory management module of the Trusted Execution Environment modifies the configuration information of the secure memory configuration device and sets the physical memory region corresponding to the data page sent in step 2 as protected memory (secure memory). 4. Modify the memory management module of the trusted execution environment (MMU) to map the data pages sent in step 2, so that the trusted execution environment can operate on these data pages; 5. The Trusted Execution Environment's memory management module notifies the DRM video decryption module of the data sent in (mainly virtual address information). The DRM video decryption module then operates on the data based on the received virtual address. The specific operations are controlled by other communication processes between the DRM video client and the DRM video decryption module.

[0038] In summary, this invention, through a fine-grained secure memory configuration device, can separately designate memory regions discretely distributed as secure memory. Furthermore, through a memory management module in a rich execution environment, when data transmission is required, this module organizes mapping relationships, recording which memory region each part of the data to be transmitted is stored in, and sends this information to the management module in the trusted execution environment. Additionally, through the memory management module in the trusted execution environment, during data transmission, this module establishes corresponding mapping relationships in the memory management unit based on the received mapping relationships, and simultaneously modifies the secure memory configuration, setting the corresponding memory region as secure memory. Upon receiving a release request, the data in the corresponding region is cleared, configured back to non-secure memory, and the mapping relationship is deleted. Compared with the prior art, this invention has at least the following beneficial effects: This invention, through fine-grained secure memory configuration combined with a page table-based mapping management method by the Memory Management Unit (MMU), allows a set of discrete memory locations to be both non-secure and secure memory. This enables zero-copy data transfer from non-secure to secure memory. It improves the efficiency of transferring data from non-secure to secure memory and reduces the additional physical memory consumption caused by physically distinguishing between non-secure, shared, and secure memory. It also lowers the physical memory capacity requirements of DRM solutions on devices.

[0039] like Figure 4 As shown, on the other hand, embodiments of the present invention provide a secure memory zero-copy management system 400, including: a first module 410, configured to generate a first mapping relationship between target data and target physical memory based on the configuration information of target physical memory in response to a target data sending request; a second module 420, configured to configure the memory area storing target data in target physical memory as secure memory according to the first mapping relationship, and establish a second mapping relationship for trusted execution environment to access secure memory; and a third module 430, configured to notify the user of target data to perform data operations in trusted execution environment based on the second mapping relationship.

[0040] In some embodiments, the system further includes: a fourth module, configured to, in response to a memory region reclamation request, determine a region to be reclaimed in the target physical memory based on a first mapping relationship; and, based on the region to be reclaimed, notify the memory management module of the trusted execution environment to perform memory reclamation processing.

[0041] The content of the method embodiments of the present invention is applicable to the system embodiments. The specific functions implemented in the system embodiments are the same as those in the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above methods.

[0042] like Figure 5 As shown, another aspect of the present invention provides a secure memory zero-copy management device 500, including a processor 510 and a memory 520; Memory 520 is used to store programs; The processor 510 executes the program as described above.

[0043] The content of the method embodiments of the present invention is applicable to the device embodiments. The specific functions implemented by the device embodiments are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above methods.

[0044] Another aspect of this invention provides a computer-readable storage medium storing a program that is executed by a processor to implement the method described above.

[0045] The content of the method embodiments of the present invention is applicable to the computer-readable storage medium embodiments. The specific functions implemented by the computer-readable storage medium embodiments are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above methods.

[0046] This invention also discloses a computer program product or computer program, which includes computer instructions stored in a computer-readable storage medium. A processor of a computer device can read the computer instructions from the computer-readable storage medium and execute the computer instructions, causing the computer device to perform the aforementioned method.

[0047] In some alternative embodiments, the functions / operations mentioned in the block diagrams may not occur in the order shown in the operation diagrams. For example, depending on the functions / operations involved, two consecutively shown blocks may actually be executed substantially simultaneously, or the blocks may sometimes be executed in reverse order. Furthermore, the embodiments presented and described in the flowcharts of this invention are provided by way of example to provide a more comprehensive understanding of the technology. The disclosed methods are not limited to the operations and logic flows presented herein. Alternative embodiments are contemplated in which the order of various operations is changed and sub-operations described as part of a larger operation are executed independently.

[0048] Furthermore, although the invention has been described in the context of functional modules, it should be understood that, unless otherwise stated, one or more of the functions and / or features may be integrated into a single physical device and / or software module, or one or more functions and / or features may be implemented in a separate physical device or software module. It is also understood that a detailed discussion of the actual implementation of each module is unnecessary for understanding the invention. Rather, given the properties, functions, and internal relationships of the various functional modules in the apparatus disclosed herein, the actual implementation of the module will be understood within the scope of conventional skill of an engineer. Therefore, those skilled in the art can implement the invention as set forth in the claims using ordinary techniques without excessive experimentation. It is also understood that the specific concepts disclosed are merely illustrative and not intended to limit the scope of the invention, which is determined by the full scope of the appended claims and their equivalents.

[0049] If a function is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this invention, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of this invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0050] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as a sequenced list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by, or in conjunction with, an instruction execution means, apparatus, or device (such as a computer-based device, a processor-including device, or other means that can fetch and execute instructions from, or in conjunction with, an instruction execution means, apparatus, or device). For the purposes of this specification, "computer-readable medium" can be any means that can contain, store, communicate, propagate, or transmit programs for use by, or in conjunction with, an instruction execution means, apparatus, or device.

[0051] More specific examples (a non-exhaustive list) of computer-readable media include: electrical connections (electronic devices) having one or more wires, portable computer disk drives (magnetic devices), random access memory (RAM), read-only memory (ROM), erasable and editable read-only memory (EPROM or flash memory), fiber optic devices, and portable optical disc read-only memory (CDROM). Furthermore, computer-readable media can even be paper or other suitable media on which programs can be printed, because programs can be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, interpreting, or otherwise processing as necessary, and then stored in computer memory.

[0052] It should be understood that various parts of the present invention can be implemented in hardware, software, firmware, or a combination thereof. In the above embodiments, multiple steps or methods can be implemented in software or firmware stored in memory and executed by a suitable instruction execution device. For example, if implemented in hardware, as in another embodiment, it can be implemented using any one or a combination of the following techniques known in the art: discrete logic circuits having logic gates for implementing logical functions on data signals, application-specific integrated circuits (ASICs) having suitable combinational logic gates, programmable gate arrays (PGAs), field-programmable gate arrays (FPGAs), etc.

[0053] In the description of this specification, references to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of the invention. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples.

[0054] Although embodiments of the invention have been shown and described, those skilled in the art will understand that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the claims and their equivalents.

[0055] The above is a detailed description of the preferred embodiments of the present invention. However, the present invention is not limited to the embodiments. Those skilled in the art can make various equivalent modifications or substitutions without departing from the spirit of the present invention. All such equivalent modifications or substitutions are included within the scope defined by the claims of the present invention.

Claims

1. A secure memory zero-copy management method, characterized in that, include: In response to a request to send target data, a first mapping relationship between the target data and the target physical memory is generated based on the configuration information of the target physical memory. Based on the first mapping relationship, the memory region in the target physical memory that stores the target data is configured as secure memory, and a second mapping relationship for trusted execution environment to access the secure memory is established; Based on the second mapping relationship, the target data user is notified to perform data operations in the trusted execution environment; The target data includes several data pages; the step of generating a first mapping relationship between the target data and the target physical memory in response to the target data sending request, based on the configuration information of the target physical memory, includes: In response to a request to send target data, obtain the virtual address of each data page in the target data; Based on the configuration information of the target physical memory, determine the physical addresses of discrete memory within the target physical memory; Based on the virtual address and the physical address, a first mapping relationship between the target data and the target physical memory is generated; The establishment of the second mapping relationship for trusted execution environment access to secure memory includes: Obtain the physical address of the secure memory; Based on the physical address, an execution virtual address is generated for the trusted execution environment to access the secure memory; A second mapping relationship is established based on the physical address and the execution virtual address.

2. The secure memory zero-copy management method according to claim 1, characterized in that, The method further includes: In response to a memory region reclamation request, the region to be reclaimed in the target physical memory is determined based on the first mapping relationship; Based on the area to be reclaimed, the memory management module of the trusted execution environment is notified to perform memory reclamation.

3. The secure memory zero-copy management method according to claim 2, characterized in that, The memory reclamation process includes at least one of the following: Perform a cleanup operation on the data in the area to be recycled; The secure memory is configured and converted into insecure memory; Clear the second mapping relationship between the trusted execution environment and the secure memory.

4. The secure memory zero-copy management method according to claim 1, characterized in that, The step of configuring the memory region in the target physical memory storing the target data as secure memory according to the first mapping relationship includes: Based on the first mapping relationship, determine the memory region in the target physical memory used to store the target data; The configuration information of the target physical memory is used to configure the permissions of the memory region, and the memory region is configured as secure memory.

5. A secure memory zero-copy management method according to claim 1, characterized in that, The step of notifying the user of the target data to perform data operations in the trusted execution environment based on the second mapping relationship includes: Based on the second mapping relationship, an access link is established between the target data user and the secure memory in the trusted execution environment; Based on the access link, the user is notified to perform data operations on the target data in the trusted execution environment.

6. A secure memory zero-copy management system, characterized in that, include: The first module is used to respond to a request to send target data and generate a first mapping relationship between the target data and the target physical memory based on the configuration information of the target physical memory; The second module is used to configure the memory region storing the target data in the target physical memory as secure memory according to the first mapping relationship, and to establish a second mapping relationship for the trusted execution environment to access the secure memory. The third module is used to notify the user of the target data to perform data operations in the trusted execution environment based on the second mapping relationship; The target data includes several data pages; the step of generating a first mapping relationship between the target data and the target physical memory in response to the target data sending request, based on the configuration information of the target physical memory, includes: In response to a request to send target data, obtain the virtual address of each data page in the target data; Based on the configuration information of the target physical memory, determine the physical addresses of discrete memory within the target physical memory; Based on the virtual address and the physical address, a first mapping relationship between the target data and the target physical memory is generated; The establishment of the second mapping relationship for trusted execution environment access to secure memory includes: Obtain the physical address of the secure memory; Based on the physical address, an execution virtual address is generated for the trusted execution environment to access the secure memory; A second mapping relationship is established based on the physical address and the execution virtual address.

7. A secure memory zero-copy management device, comprising a processor and a memory; The memory is used to store programs; The processor executes the program to implement the method as described in any one of claims 1 to 5.

8. A computer-readable storage medium, characterized in that, The storage medium stores a program that is executed by a processor to implement the method as described in any one of claims 1 to 5.

Images