Security verification method, data processing system, storage medium and program product

Abstract

The invention relates to a security verification method, a data processing system, a storage medium and a program product, the method is applied to the data processing system, and the method comprises the following steps: a data processing unit receives a security verification request initiated by user equipment for a trusted execution environment; the data processing unit responds to the security verification request and sends running environment information including a complete signature and a public key of a trusted execution environment to the user equipment; comprising the completely signed operation environment information and the public key of the trusted execution environment for verifying the security of the trusted execution environment. According to the method, the security of the trusted execution environment comprising the multiple objects in the data processing system can be verified by using the root key generated by the private keys of the multiple objects, and meanwhile, a user does not need to completely trust any object in the multiple objects, so that the reliability of the trusted execution environment can be improved.

Description

[0001] This application is a divisional application. The application number of the original application is 202211386390.1, and the original application date is November 7, 2022. The entire contents of the original application are incorporated into this application by reference. Technical Field

[0002] The present application relates to the field of data processing, and in particular to a security verification method, a data processing system, a storage medium and a program product. Background Art

[0003] The core technology of secure computing and trusted computing is data isolation, which is to protect user data from being accessed by other entities (including super users such as administrators). Data isolation can be achieved based on a trusted executive environment (TEE). A trusted execution environment (TEE) is an operating environment consisting of independent trusted areas divided from the processor and memory, where different trusted areas can be used to isolate different applications (such as trusted applications (TA)) to prevent them from accessing each other's data. Even applications with higher privileges cannot access across areas.

[0004] With the continuous development of secure computing and trusted computing, their application fields are also expanding. The required computing power is higher and the required algorithms are more complex, making it difficult for a single processor to provide a trusted execution environment that meets user needs. In this regard, the prior art proposes a method in which a cloud platform is used as the controller of the trusted execution environment and multiple processors are used as providers of computing power and algorithms to jointly build a trusted execution environment. However, in this method, the root key of the trusted execution environment is generated by the cloud platform, so users are required to trust the cloud platform. Once a problem occurs with the cloud platform, the security of the trusted execution environment cannot be guaranteed, resulting in low reliability of the trusted execution environment. Summary of the invention

[0005] In view of this, a security verification method, a data processing system, a storage medium and a program product are proposed. According to the security verification method of the present application, the method can be applied in a data processing system, and a root key generated by private keys of multiple objects can be used to verify the security of a trusted execution environment in the data processing system that includes multiple objects. At the same time, the user does not have to fully trust any one of the multiple objects, thereby improving the reliability of the trusted execution environment.

[0006] In a first aspect, the present application provides a security verification method, which is applied to a data processing system, wherein the data processing system includes a data processing unit and a trusted execution environment, wherein the trusted execution environment includes two or more objects for use by a user device, and the method includes: the data processing unit receives a security verification request for the trusted execution environment initiated by the user device; the data processing unit sends, in response to the security verification request, operating environment information including a complete signature and a public key of the trusted execution environment to the user device, the operating environment information including the complete signature is signed according to the private key of each object in the trusted execution environment, and the public key of the trusted execution environment is obtained according to the private key of each object; the operating environment information including the complete signature and the public key of the trusted execution environment are used to verify the security of the trusted execution environment.

[0007] According to the security verification method provided by the present application, a security verification request for a trusted execution environment initiated by a user device is received by a data processing unit, and in response to the security verification request, operating environment information including a complete signature and a public key of the trusted execution environment are sent to the user device, so that the user device can obtain information used to verify the security of the trusted execution environment; on the one hand, the public key of the trusted execution environment is obtained based on the private key of each object, which is equivalent to multiple objects in the trusted execution environment jointly generating, controlling and using the root key of the trusted execution environment, so that the user does not have to fully trust any of the multiple objects, so the probability that the confidentiality of data is affected when the user uses the trusted execution environment due to maliciousness of a certain object is greatly reduced; on the other hand, the operating environment information containing the complete signature is obtained by signing the operating environment information of the trusted execution environment according to the private key of each object in the trusted execution environment, which is equivalent to jointly verifying the operating environment information of the trusted execution environment through multiple objects, so that the security credibility of the trusted execution environment determined by the verification is increased; in summary, the security verification method of the present application can improve the reliability of the trusted execution environment.

[0008] In this case, users no longer have to fully trust any object in the trusted execution environment, such as the chip, cloud platform, model / algorithm provider, etc., but believe that these objects will not all want to destroy the trusted execution environment, tamper with the service program code, or steal the user's data. Under this trust mechanism, as long as at least one party is honest and trustworthy, the trusted execution environment can be considered trustworthy, and the privacy and security of the data can be guaranteed when the user-specified program code is run under the user-specified hardware configuration to process the user's data.

[0009] According to the first aspect, in a first possible implementation of the security verification method, the method further includes: each object generates its own public key and private key, and outputs the private key to the data processing unit; the data processing unit determines the public key corresponding to the synthesis result of the private key of each object based on the received private key of each object; and uses the determined public key as the public key of the trusted execution environment.

[0010] In this way, it can be ensured that the public key of the trusted execution environment corresponds to the synthesis result of the private keys of multiple objects, so that when the public key of the trusted execution environment is used as the root key, the accuracy of the root key can be guaranteed.

[0011] According to the first aspect, or the first possible implementation manner of the first aspect, in a second possible implementation manner of the security verification method, the method further includes: each object separately determines its own operating environment information, and obtains the operating environment information of the other objects; each object determines the operating environment information of the trusted execution environment based on its own operating environment information and the operating environment information of the other objects; the data processing unit signs the operating environment information of the trusted execution environment according to the private key of each object, and obtains the operating environment information including the complete signature.

[0012] By having multiple objects interact and authenticate each other's environments, signatures are generated when each other's environments are recognized, which can further improve the accuracy of verification of the security of the trusted execution environment using the operating environment information including the complete signature.

[0013] According to the second possible implementation manner of the first aspect, in a third possible implementation manner of the security verification method, the data processing unit signs the operating environment information of the trusted execution environment according to the private key of each object to obtain the operating environment information including the complete signature, including: the data processing unit signs the operating environment information of the trusted execution environment according to the private key of each object to obtain the operating environment information including the signature fragment corresponding to each object; the data processing unit synthesizes the operating environment information including the complete signature based on the operating environment information including the signature fragment corresponding to each object.

[0014] In this way, the method of generating the operating environment information including the complete signature is made more flexible.

[0015] According to the first aspect, or any possible implementation of the first aspect above, in a fourth possible implementation of the security verification method, when determining that the trusted execution environment is secure, the method further includes: the data processing unit signs the communication key of the trusted execution environment according to the private key of each object to obtain a communication key including a complete signature, and the communication key including the complete signature is used to encrypt data input into the trusted operating environment by a user device.

[0016] In this way, during the external communication process of the trusted execution environment, the communication key that protects the communication data is signed by multiple objects, which can improve the security of data communication.

[0017] According to the fourth possible implementation manner of the first aspect, in a fifth possible implementation manner of the security verification method, the data processing unit signs the communication key of the trusted execution environment according to the private key of each object to obtain the communication key including the complete signature, including: the data processing unit signs the communication key of the trusted execution environment according to the private key of each object to obtain the communication key including the signature fragment corresponding to each object; the data processing unit synthesizes the communication key including the complete signature according to the communication key including the signature fragment corresponding to each object.

[0018] In this way, the way of generating the communication key including the complete signature is made more flexible.

[0019] According to any one of the second to fifth possible implementations of the first aspect, in a sixth possible implementation of the security verification method, the object includes a chip, the operating environment information of the chip includes chip parameters and at least one of a code summary of a user-trusted application running on the chip, and each of the objects determines its own operating environment information respectively, and obtains the operating environment information of the other objects, including: for each chip, obtaining its own operating environment information based on its own chip parameters and at least one of the code summaries of the user-trusted application running on it; issuing an information acquisition request to other objects other than itself, the information acquisition request being used to obtain the operating environment information of the other objects; and upon receiving an information acquisition request from other objects other than itself, outputting its own operating environment information to the other objects.

[0020] In this way, it is possible to support chip self-measurement and interaction measurement with other objects, thereby improving the diversity of the trusted execution environment.

[0021] According to any one of the second to sixth possible implementations of the first aspect, in a seventh possible implementation of the security verification method, the object includes a cloud platform, the operating environment information of the cloud platform includes at least one of software configuration information, virtual machine configuration information, and server configuration information, and each of the objects determines its own operating environment information respectively, and obtains the operating environment information of the other objects, including: for each cloud platform, obtaining its own operating environment information according to at least one of its own software configuration information, virtual machine configuration information, and server configuration information; for each of the other objects, when the object is deployed on the cloud platform, determining the operating environment information of the object according to the deployment information of the object; when the object is not deployed on the cloud platform, issuing an information acquisition request to the object, the information acquisition request being used to obtain the operating environment information of the object; when receiving an information acquisition request from an object other than itself, outputting its own operating environment information to the other objects.

[0022] In this way, it is possible to support the cloud platform's own measurement and the interaction measurement with other objects, which can further improve the diversity of the trusted execution environment.

[0023] According to the first aspect, or any possible implementation of the first aspect above, in an eighth possible implementation of the security verification method, verifying the security of the trusted execution environment includes: determining whether the public key of the trusted execution environment corresponds to the complete signature, and when the public key of the trusted execution environment corresponds to the complete signature, determining that the trusted execution environment is secure.

[0024] In this way, the security of the trusted execution environment can be verified in a relatively simple manner, thereby saving data processing costs and reducing the complexity of verification implementation.

[0025] According to the first aspect, or any one of the second to seventh possible implementations of the first aspect, in a ninth possible implementation of the security verification method, verifying the security of the trusted execution environment includes: determining whether a synthesis result of the public key of each object is consistent with the public key of the trusted execution environment, and when the synthesis result of the public key of each object is consistent with the public key of the trusted execution environment, determining that the public key of the trusted execution environment is correct; determining whether the public key of the trusted execution environment corresponds to the complete signature, and when the public key of the trusted execution environment is correct and the public key of the trusted execution environment corresponds to the complete signature, determining that the trusted execution environment is secure.

[0026] By also verifying the correctness of the public key of the trusted execution environment, the reliability of the verification result of the security of the trusted execution environment can be improved, and the verification method can be made more flexible.

[0027] According to the first aspect, or any one of the second to seventh possible implementations of the first aspect, in the tenth possible implementation of the security verification method, verifying the security of the trusted execution environment includes: judging the correctness of the public key certificate of each object, and when the public key certificate of each object is correct, determining that the synthesis result of the public key of each object is correct; judging whether the synthesis result of the public key of each object is consistent with the public key of the trusted execution environment, and when the synthesis result of the public key of each object is correct and the synthesis result of the public key of each object is consistent with the public key of the trusted execution environment, determining that the public key of the trusted execution environment is correct; judging whether the public key of the trusted execution environment corresponds to the complete signature, and when the public key of the trusted execution environment is correct and the public key of the trusted execution environment corresponds to the complete signature, determining that the trusted execution environment is secure.

[0028] By verifying the correctness of the synthesis result of the public key of each object and the correctness of the public key of the trusted execution environment, the reliability of the verification result of the security of the trusted execution environment is further improved, and the verification method is made more flexible.

[0029] According to any one of the first to tenth possible implementations of the first aspect, in the eleventh possible implementation of the security verification method, each object generates its own public key and private key, and outputs the private key to the data processing unit, including: for each object, generating its own public key and private key; outputting its own public key certificate to other objects in the trusted execution environment except itself; receiving the public key certificates of the other objects; judging the correctness of the public key certificates of the other objects, and when the public key certificates of each of the other objects are correct, outputting the private key to the data processing unit.

[0030] By verifying the public key certificates of other objects before outputting the private key, it is possible to ensure that other objects have a certain degree of credibility.

[0031] In a second aspect, an embodiment of the present application provides a data processing system, the system comprising a data processing unit and a trusted execution environment, the trusted execution environment comprising two or more objects for use by a user device, the data processing unit being used to receive a security verification request for the trusted execution environment initiated by the user device; in response to the security verification request, sending to the user device operating environment information including a complete signature and a public key of the trusted execution environment, the operating environment information including the complete signature being obtained by signing the operating environment information of the trusted execution environment according to the private key of each object in the trusted execution environment, the public key of the trusted execution environment being obtained according to the private key of each object; the operating environment information including the complete signature and the public key of the trusted execution environment are used to verify the security of the trusted execution environment.

[0032] According to the second aspect, in a first possible implementation of the data processing system, each object is used to generate its own public key and private key, and output the private key to the data processing unit; the data processing unit is also used to determine, based on the received private key of each object, a public key corresponding to a synthesis result of the private key of each object; and use the determined public key as the public key of the trusted execution environment.

[0033] According to the second aspect, or the first possible implementation of the second aspect, in the second possible implementation of the data processing system, each object is also used to determine its own operating environment information and obtain the operating environment information of the other objects; determine the operating environment information of the trusted execution environment based on its own operating environment information and the operating environment information of the other objects; the data processing unit is also used to sign the operating environment information of the trusted execution environment according to the private key of each object to obtain the operating environment information including the complete signature.

[0034] According to the second possible implementation manner of the second aspect, in a third possible implementation manner of the data processing system, the data processing unit signs the operating environment information of the trusted execution environment according to the private key of each object to obtain the operating environment information including the complete signature, including: the data processing unit signs the operating environment information of the trusted execution environment according to the private key of each object to obtain the operating environment information including the signature fragment corresponding to each object; the data processing unit synthesizes the operating environment information including the complete signature based on the operating environment information including the signature fragment corresponding to each object.

[0035] According to the second aspect, or any possible implementation of the second aspect above, in a fourth possible implementation of the data processing system, when determining that the trusted execution environment is secure, the data processing unit is also used to sign the communication key of the trusted execution environment according to the private key of each object to obtain a communication key including a complete signature, and the communication key including the complete signature is used to encrypt data input into the trusted operating environment by a user device.

[0036] According to a fourth possible implementation manner of the second aspect, in a fifth possible implementation manner of the data processing system, the data processing unit signs the communication key of the trusted execution environment according to the private key of each object to obtain the communication key including a complete signature, including: the data processing unit signs the communication key of the trusted execution environment according to the private key of each object to obtain the communication key including a signature fragment corresponding to each object; the data processing unit synthesizes the communication key including the complete signature according to the communication key including the signature fragment corresponding to each object.

[0037] According to any one of the second to fifth possible implementations of the second aspect, in a sixth possible implementation of the data processing system, the object includes a chip, the operating environment information of the chip includes at least one of chip parameters and a code summary of a user-trusted application running on the chip, and each of the objects determines its own operating environment information respectively, and obtains the operating environment information of the other objects, including: for each chip, obtaining its own operating environment information based on its own chip parameters and at least one of the code summaries of the user-trusted application running on it; issuing an information acquisition request to other objects other than itself, the information acquisition request being used to obtain the operating environment information of the other objects; and upon receiving an information acquisition request from other objects other than itself, outputting its own operating environment information to the other objects.

[0038] According to any one of the second to sixth possible implementations of the second aspect, in a seventh possible implementation of the data processing system, the object includes a cloud platform, the operating environment information of the cloud platform includes at least one of software configuration information, virtual machine configuration information, and server configuration information, and each of the objects determines its own operating environment information and obtains the operating environment information of the other objects, including: for each cloud platform, obtaining its own operating environment information according to at least one of its own software configuration information, virtual machine configuration information, and server configuration information; for each of the other objects, when the object is deployed on the cloud platform, determining the operating environment information of the object according to the deployment information of the object; when the object is not deployed on the cloud platform, issuing an information acquisition request to the object, the information acquisition request being used to obtain the operating environment information of the object; and when receiving an information acquisition request from an object other than itself, outputting its own operating environment information to the other objects.

[0039] According to the second aspect, or any possible implementation of the second aspect above, in an eighth possible implementation of the data processing system, the user device is used to determine whether the public key of the trusted execution environment corresponds to the complete signature, and when the public key of the trusted execution environment corresponds to the complete signature, determine that the trusted execution environment is secure.

[0040] According to the second aspect, or any one of the second to seventh possible implementations of the second aspect, in a ninth possible implementation of the data processing system, the user device is used to determine whether a synthesis result of the public key of each object is consistent with the public key of the trusted execution environment, and when the synthesis result of the public key of each object is consistent with the public key of the trusted execution environment, determine that the public key of the trusted execution environment is correct; and determine whether the public key of the trusted execution environment corresponds to the complete signature, and when the public key of the trusted execution environment is correct and the public key of the trusted execution environment corresponds to the complete signature, determine that the trusted execution environment is secure.

[0041] According to the second aspect, or any possible implementation manner of the second to seventh possible implementation manners of the second aspect, in the tenth possible implementation manner of the data processing system, the user device is used to determine the correctness of the public key certificate of each object, and when the public key certificate of each object is correct, determine that the synthesis result of the public key of each object is correct; determine whether the synthesis result of the public key of each object is consistent with the public key of the trusted execution environment, and when the synthesis result of the public key of each object is correct and the synthesis result of the public key of each object is consistent with the public key of the trusted execution environment, determine that the public key of the trusted execution environment is correct; determine whether the public key of the trusted execution environment corresponds to the complete signature, and when the public key of the trusted execution environment is correct and the public key of the trusted execution environment corresponds to the complete signature, determine that the trusted execution environment is secure.

[0042] According to any one of the first to tenth possible implementations of the second aspect, in an eleventh possible implementation of the data processing system, each object generates its own public key and private key, and outputs the private key to the data processing unit, including: for each object, generating its own public key and private key; outputting its own public key certificate to other objects in the trusted execution environment except itself; receiving the public key certificates of the other objects; judging the correctness of the public key certificates of the other objects, and when the public key certificates of each of the other objects are correct, outputting the private key to the data processing unit.

[0043] In a third aspect, an embodiment of the present application provides a data processing system, comprising: a processor; a memory for storing processor executable instructions; wherein the processor is configured to implement the above-mentioned first aspect or one or more of the multiple possible implementation methods of the first aspect when executing the instructions.

[0044] In a fourth aspect, an embodiment of the present application provides a non-volatile computer-readable storage medium having computer program instructions stored thereon, which, when executed by a processor, implement a data processing unit of the above-mentioned first aspect or one or more of the multiple possible implementation methods of the first aspect.

[0045] In a fifth aspect, an embodiment of the present application provides a computer program product, comprising a computer-readable code, or a non-volatile computer-readable storage medium carrying a computer-readable code. When the computer-readable code runs in an electronic device, a processor in the electronic device executes the above-mentioned first aspect or a data processing unit of one or more of the multiple possible implementation methods of the first aspect.

[0046] These and other aspects of the present application will become more apparent from the following description of the embodiment(s). BRIEF DESCRIPTION OF THE DRAWINGS

[0047] The accompanying drawings, which are incorporated in and constitute a part of the specification, illustrate exemplary embodiments, features, and aspects of the present application and, together with the description, serve to explain the principles of the present application.

[0048] Figure 1 A schematic diagram showing the flow of a remote attestation method in the prior art;

[0049] Figure 2 An example of a data encryption method of prior art 1 is shown;

[0050] Figure 3a An example of a remote certification method of a trusted execution environment with a chip as a core controller according to an embodiment of the present application is shown;

[0051] Figure 3b An example of a remote attestation method of a trusted execution environment with a cloud platform as the core controller according to an embodiment of the present application is shown;

[0052] Figure 4 An exemplary application scenario of a data processing system according to an embodiment of the present application is shown;

[0053] Figure 5 A schematic diagram showing a method for generating a root key of a trusted execution environment according to an embodiment of the present application;

[0054] Figure 6 A schematic diagram showing a security verification method according to an embodiment of the present application;

[0055] Figure 7 A schematic diagram showing a method for generating operating environment information including a complete signature according to an embodiment of the present application;

[0056] Figure 8 A schematic diagram showing an exemplary method for encrypting user data according to an embodiment of the present application;

[0057] Fig. 9 An exemplary structural diagram of a data processing system according to an embodiment of the present application is shown. DETAILED DESCRIPTION

[0058] Various exemplary embodiments, features and aspects of the present application will be described in detail below with reference to the accompanying drawings. The same reference numerals in the accompanying drawings represent elements with the same or similar functions. Although various aspects of the embodiments are shown in the accompanying drawings, the drawings are not necessarily drawn to scale unless otherwise specified.

[0059] The word “exemplary” is used exclusively herein to mean “serving as an example, example, or illustration.” Any embodiment described herein as “exemplary” is not necessarily to be construed as preferred or advantageous over other embodiments.

[0060] In addition, in order to better illustrate the present application, numerous specific details are given in the following specific embodiments. It should be understood by those skilled in the art that the present application can also be implemented without certain specific details. In some examples, methods, means, components and circuits well known to those skilled in the art are not described in detail in order to highlight the subject matter of the present application.

[0061] The following is an explanation of the terms that may appear in the embodiments of the present application.

[0062] Heterogeneous computing chip (HCC): In computing tasks that require a lot of computing power (such as those involving complex neural network models), the computing power of a single central processing unit (CPU) is often overwhelmed and requires the support of various other processors such as embedded neural-network processing unit (NPU) and graphics processing unit (GPU) to share computing operations. These chips (processors) that jointly provide computing operations are collectively referred to as heterogeneous computing chips.

[0063] Trusted Execution Environment TEE: A secure area within the processor. It runs in an independent environment and runs in parallel with the operating system. The processor ensures that the confidentiality and integrity of the code and data in the trusted execution environment are protected. By using both hardware and software to protect data and code, the trusted execution environment TEE will be more secure than the operating system. Trusted applications running in the trusted execution environment TEE can access the full functionality of the processor and memory, while hardware isolation protects these components from other user applications running in the main operating system.

[0064] Remote attestation (RA) refers to a mechanism that allows users to verify the security of a trusted execution environment (TEE). When the attestation is successful, it can be considered that the trusted execution environment (TEE) and the trusted applications running in it are selected by the user and have not been tampered with, thereby providing integrity protection for secure computing and trusted computing.

[0065] Secure multi-party computation (SMPC) protocol: It is a subfield of cryptography that allows multiple objects to input data separately for collaborative computing without mutual trust, output the calculation results, and ensure that no party can know the content of the data input by other objects except the calculation results.

[0066] The core technology of secure computing and trusted computing is data isolation, which protects user data from being accessed by other entities (including administrators and other super users). Data isolation can be achieved based on the trusted execution environment TEE. The following introduces several existing methods for building a trusted execution environment.

[0067] Prior art 1 proposes to divide a protected trusted area in the address space of the application (in the processor and memory), which becomes a container called enclave. Different containers (trusted areas) can correspond to different applications. Containers can be used to isolate different applications (such as trusted applications TA) to prevent them from accessing each other's data. Even applications with higher privileges cannot access across areas, so that the code and data in the container can be protected from damage by malware. Trusted Execution Environment TEE can refer to the area that includes each container.

[0068] In order to verify the security of the trusted execution environment TEE, the prior art also proposes a remote attestation method. Figure 1 A schematic diagram showing the flow of a remote attestation method in the prior art.

[0069] like Figure 1 As shown, assuming that the controller of the trusted execution environment TEE is chip A, the root key of the trusted execution environment TEE can be the public key and private key of chip A. The user first submits a remote attestation request to the trusted execution environment TEE. After receiving the remote attestation request, the trusted execution environment TEE measures its own operating environment, obtains measurement results including the hardware environment parameters of the trusted execution environment TEE and the software program code summary, and uses the private key in the root key of the trusted execution environment TEE to sign the measurement results. The signed measurement results are then fed back to the user. The user can check the signed measurement results to determine whether the hardware environment parameters of the trusted execution environment TEE and the software program code summary meet the requirements. If the requirements are met, for example, the public key of chip A can be obtained from the certification authority (CA) of the chip manufacturer of chip A, and the obtained public key can be used to verify whether the signature on the measurement result is the signature of the private key corresponding to the public key. If the verification passes, the trusted execution environment TEE can be considered secure.

[0070] After confirming that the trusted execution environment TEE is secure, users can use the trusted execution environment TEE to store and calculate data. In order to ensure data security, the prior art also proposes a data encryption method. Figure 2 An example of a data encryption method according to prior art 1 is shown.

[0071] like Figure 2 As shown, the communication key of the trusted execution environment TEE is sent to the user as the encryption key for the communication data between the latter and the trusted execution environment. The user can use the communication key to encrypt the data to obtain the encrypted data x, and then input it to the trusted execution environment TEE. After receiving the encrypted data x, the trusted execution environment TEE decrypts it using the communication key and then uses the trusted application to calculate the data.

[0072] For this prior art one, the entire trusted execution environment TEE is controlled by a unique computing chip, and the built-in private key of the computing chip is used as the trusted root key, that is, this solution is only applicable to scenarios with a unique computing chip and no other controllers. If the trusted execution environment TEE is composed of multiple computing chips, or the cloud platform that deploys the computing chip also participates in the control, there will be a contradiction in the ownership of the trusted execution environment TEE control. At the same time, since the communication key is generated by a single computing chip, the user has no choice but to trust the computing chip. Once there is a problem with the computing chip, the security of the trusted execution environment cannot be guaranteed, resulting in low reliability of the trusted execution environment.

[0073] Prior art 2 proposes to divide the hardware and software resources of the system on chip into two parts: a secure world and a non-secure world. The secure world is equivalent to the trusted execution environment TEE mentioned above. All operations that require confidentiality are performed in the secure world (such as fingerprint recognition, password processing, data encryption and decryption, security authentication, etc.), and the remaining operations are performed in the non-secure world (such as user operating system, various applications, etc.). The system on chip has three states, a secure world, a non-secure world, and a supervisory mode for switching between the two; all operations similar to switching between privileged and non-privileged processes are performed through the supervisory mode. The remote attestation method and data encryption method of prior art 2 can be the same as prior art 1.

[0074] For the second prior art, the entire trusted execution environment TEE is also controlled by a unique chip, and the chip's built-in private key is used as a trusted root key, which is only applicable to scenarios with a unique computing chip and no other controllers. If the trusted execution environment TEE is composed of multiple computing chips, or the cloud platform that deploys the computing chip also participates in the control, there will be a contradiction in the ownership of the trusted execution environment TEE control. At the same time, users have no choice but to trust the computing chip. Once there is a problem with the computing chip, the security of the trusted execution environment cannot be guaranteed, resulting in low reliability of the trusted execution environment.

[0075] With the continuous development of secure computing and trusted computing, their application areas are also expanding, requiring higher computing power and more complex algorithms. In these scenarios, the solutions of prior art one and prior art two may be difficult to provide a trusted execution environment TEE that meets user needs. In this regard, prior art three proposes a method of jointly building a trusted execution environment by making the cloud platform the controller of the trusted execution environment and the multiple processors (chips) deployed on the cloud platform as providers of computing power and algorithms respectively. In prior art three, the cloud platform is responsible for first generating a complete public key and a complete private key of the trusted execution environment as the trusted root key. While the cloud platform publishes the complete public key, it splits the complete private key into multiple private key fragments and distributes them to all providers of computing power and algorithms.

[0076] Since the generation and management of the trusted root key is the responsibility of the cloud platform, rather than relying entirely on the chip, the impact of problems with individual chips on the security of the trusted execution environment will be much reduced. However, despite participating in root key management, the cloud platform does not provide a comprehensive measurement of the entire trusted execution environment and independently controls remote attestation. There is still the problem of multiple chips acting independently and not being able to coordinate and unify. Moreover, this solution still implements a unilaterally controlled trusted execution environment TEE, but replaces the chip with a cloud platform, and users must trust the cloud platform. Once a problem occurs with the cloud platform, the security of the trusted execution environment cannot be guaranteed, resulting in low reliability of the trusted execution environment.

[0077] Based on this, an embodiment of the present application proposes a trusted execution environment TEE with a chip (or cloud platform) as the core controller, so that the chip (or cloud platform) is responsible for both the generation and management of trusted root keys and for measuring the security of itself and other computing power providers.

[0078] Figure 3a An example of a remote certification method of a trusted execution environment with a chip as the core controller according to an embodiment of the present application is shown.

[0079] See also Figure 3a, the trusted execution environment TEE may include multiple objects such as a central processing unit chip, an auxiliary computing chip, a model / algorithm provider, and a cloud platform. The central processing unit chip is used as the core controller, and other objects are used as service providers. The core controller can complete the measurement of its own operating environment and the operating environment of each service provider, and use its own private key as the trusted root key to sign a remote attestation certificate. Users can obtain the public key certificate of the core controller at the verification center of the manufacturer of the core controller and verify the correctness of the remote attestation certificate, thereby determining the security of the trusted execution environment. The measurement of its own operating environment and the measurement of the operating environment of each service provider can be found below and Figure 6 , Figure 7 .

[0080] Figure 3b An example of a remote certification method of a trusted execution environment with a cloud platform as the core controller according to an embodiment of the present application is shown.

[0081] See also Figure 3b , the trusted execution environment TEE may include multiple objects such as a central processing unit chip, an auxiliary computing chip, a model / algorithm provider, and a cloud platform. The cloud platform is the core controller, and other objects are service providers. The core controller can complete the measurement of its own operating environment and the operating environment of each service provider, and use its own private key as the trusted root key to sign a remote attestation certificate. Users can obtain the core controller's public key certificate at the verification center of the core controller's manufacturer and verify the correctness of the remote attestation certificate, thereby determining the security of the trusted execution environment. The measurement of its own operating environment and the measurement of the operating environment of each service provider can be found below and Figure 6 , Figure 7 .

[0082] When a remote attestation certificate is formed through the above two methods of the embodiments of the present application, the trusted root key of the core controller used is the private key of a single chip or a single cloud platform, that is, the core controller measures its own operating environment and the operating environment of other service providers. Furthermore, considering that the core controller itself is the party that wants to destroy the trusted execution environment and forge the security of its own operating environment and / or the security of the operating environment of other objects, the embodiments of the present application can further use the root key generated by the private keys of multiple objects to verify the security of the trusted execution environment in the data processing system, including multiple objects, while allowing users to not fully trust any one of the multiple objects, thereby improving the reliability of the trusted execution environment.

[0083] Figure 4 An exemplary application scenario of a data processing system according to an embodiment of the present application is shown.

[0084] like Figure 4 As shown, the data processing system of an embodiment of the present application may include a data processing unit and a trusted execution environment TEE. The trusted execution environment TEE may include two or more objects for use by a user device, where the objects may be the central processing unit chip, cloud platform, auxiliary computing chip, model / algorithm provider, etc. mentioned above.

[0085] Each object can be set on an independent terminal device or server, or can be set together on the same terminal device or server, and this application does not limit this. The data processing unit can be set on the same terminal device as one or more objects, or can be set separately on a terminal device or server. For example, the terminal device of this application can be a smart phone, a netbook, a tablet computer, a laptop computer, a wearable electronic device (such as a smart bracelet, a smart watch, etc.), a TV, a virtual reality device, a stereo, an electronic ink, and the like.

[0086] The trusted applications described above can be run on each hardware chip, and the code of the trusted application may include models and / or algorithms, etc. The cloud platform can deploy the above hardware chips and models / algorithms provided by the model / algorithm provider, and can package and provide a trusted execution environment to the user device.

[0087] In this application scenario, the data processing system executes the security verification method of the embodiment of the present application, so that each object can participate in the management and control of the trusted execution environment by providing its own private key, for example, participating in the generation of the root key of the trusted execution environment (for example, see below and Figure 5 ), participate in remote attestation of the security of the trusted execution environment by the user device (examples of which can be found below and Figure 6 , Figure 7 ), participate in data transmission from user devices to the trusted execution environment (examples of which can be found below and Figure 8 ) and so on.

[0088] Among them, when each object participates in the remote attestation of the security of the trusted execution environment by the user device, in addition to measuring and determining the operating environment information by themselves, multiple objects can also measure and determine each other's operating environment information. The final overall operating environment information of the trusted execution environment is also signed using the private keys of multiple objects, representing everyone's unanimous agreement. When the user device remotely attests the security of the trusted execution environment and the user device transmits data to the trusted execution environment, the user does not have to verify with each object one by one, but instead verifies the operating environment information jointly signed by multiple objects (that is, the operating environment information including the complete signature described below, which is equivalent to the remote attestation certificate described above), which greatly improves the user experience. When the user device transmits data to the trusted execution environment, the communication key used to encrypt the user's data can also be a communication key jointly signed by multiple objects (that is, the communication key including the complete signature described below), which improves the security of communication.

[0089] The following first introduces an exemplary method for the data processing system of an embodiment of the present application to generate a root key of a trusted execution environment. Figure 5 A schematic diagram showing a method for generating a root key of a trusted execution environment according to an embodiment of the present application.

[0090] like Figure 5 As shown, in a possible implementation, the method includes steps S51-S53:

[0091] In step S51, each object generates its own public key and private key, and outputs the private key to the data processing unit.

[0092] Step S52: The data processing unit determines a public key corresponding to a synthesis result of the private keys of each object according to the received private keys of each object.

[0093] Step S53: Use the determined public key as the public key of the trusted execution environment TEE.

[0094] In this way, it can be ensured that the public key of the trusted execution environment corresponds to the synthesis result of the private keys of multiple objects, so that when the public key of the trusted execution environment is used as the root key, the accuracy of the root key can be guaranteed.

[0095] For example, each object, as a provider of computing services, can generate its own public key and private key based on existing technologies, where the public key corresponds to the private key. For each object, after the private key is output to the data processing unit, the private key can also be used to obtain the root key corresponding to the trusted execution environment, the operating environment information including the signature slice of the object, and the communication key including the signature slice of the object.

[0096] Optionally, before outputting the private key to the data processing unit, each object may verify the trustworthiness of other objects in the trusted execution environment except itself. For example, in one possible implementation, step S51 includes:

[0097] For each object, generate its own public key and private key;

[0098] Outputting its own public key certificate to other objects in the trusted execution environment except itself;

[0099] Receiving a public key certificate of the other object;

[0100] The correctness of the public key certificates of the other objects is determined, and when the public key certificates of each of the other objects are correct, the private key is output to the data processing unit.

[0101] By verifying the public key certificates of other objects before outputting the private key, it is possible to ensure that other objects have a certain degree of credibility.

[0102] For example, when each object generates its own public key and private key, the verification center of the manufacturer (such as a chip manufacturer) or operator (such as a cloud platform operator) corresponding to the object will issue a public key certificate for the object to prove that a public key does belong to a certain chip or cloud platform. For each object, after generating its own public key and private key, the public key certificate issued by the verification center can be output to other objects in the trusted execution environment except itself. At the same time, it also receives public key certificates from other objects in the trusted execution environment except itself.

[0103] In this case, for each object, the correctness of all received public key certificates can be judged. For example, a query request including relevant information of the public key certificate (such as certificate code, etc.) can be issued to the verification center corresponding to each public key certificate. After receiving the query request, the verification center can check whether the certificate is indeed issued by the verification center, and feedback the query result to the object that issued the query request. For example, when it is checked that it is indeed a certificate issued by itself, a query result indicating that the certificate is correct can be issued; otherwise, a query result indicating that the certificate is incorrect can be issued. Each object can judge the correctness of the public key certificates of other objects based on the received query results. When it is judged that the public key certificates of other objects are all correct, it can be considered that the other objects have a certain degree of credibility, and then output their own private keys to the data processing unit.

[0104] Among them, for each object, it may not receive the public key certificates of all objects except itself. In this case, when judging the correctness of the public key certificates of other objects, it is sufficient to judge the correctness of the public key certificates received by itself. Even when an object has not received any public key certificates, it can directly output its own private key to the data processing unit without judging whether other objects are trustworthy.

[0105] The data processing unit may support the secure multi-party computing protocol of the prior art. In step S52, when the data processing unit determines the public key corresponding to the synthesis result of the private key of each object based on the received private key of each object, the secure multi-party computing protocol may be used to determine the public key.

[0106] The following describes an exemplary implementation method of using a secure multi-party computing protocol to obtain a public key corresponding to the synthesis result of the private key of each object in an embodiment of the present application.

[0107] For example, a secure multi-party computing protocol can be implemented by a data processing unit. Each object inputs its own private key to the data processing unit as a secret input, so that other objects cannot know the specific content of the private key input by the object. Without leaking the input, the data processing unit can calculate a public key by executing the secure multi-party computing protocol, and the public key can be a public key corresponding to the synthesis result of the private key of each object. The synthesis result of the private key of each object is not used as a key.

[0108] Optionally, after calculating the public key corresponding to the synthesis result of the private key of each object (hereinafter referred to as the calculated public key), each object can also provide its own public key to other objects for other objects to verify the correctness of the calculated public key.

[0109] For example, the verification may include two aspects: on the one hand, whether the private key of each object is input into the data processing unit for calculation, and on the other hand, whether the synthesis result of the public key of each object is consistent with the calculated public key. When the conditions that the private key of each object is input into the data processing unit for calculation and the synthesis result of the public key of each object is consistent with the calculated public key are met at the same time, it is determined that the calculated public key is correct.

[0110] Those skilled in the art will understand that Figure 5The calculation method of the public key corresponding to the synthesis result of the private key of each object shown is only an example. In actual applications, there may be more or fewer objects in the trusted execution environment. For example, in the least case, the object may have only one central processing unit chip and one auxiliary computing chip, that is, only the central processing unit chip and one auxiliary computing chip participate in the calculation of the public key. For another example, in the most common case, the objects in the trusted execution environment may have multiple central processing unit chips, multiple auxiliary computing chips, multiple cloud platforms, and multiple model / algorithm providers, and may even include software providers such as operating systems, and these objects can participate in the calculation of the public key. This application does not limit the number and type of specific objects involved in the calculation of the public key.

[0111] In step S53, the data processing unit may optionally directly use the calculated public key as the public key of the trusted execution environment, or may first perform the above verification method to verify the correctness of the calculated public key, and then use it as the public key of the trusted execution environment when the calculated public key is verified to be correct. In this case, the calculated public key is used as the root key of the trusted execution environment, so that the reliability of the trusted execution environment is guaranteed.

[0112] The present application embodiment adopts Figure 5 The method shown obtains the calculated public key, so that the number of private keys that can be supported by the secure multi-party computing protocol is not limited, and the trusted execution environment can support an unlimited number of objects, and the types and methods of the secure multi-party computing protocol are not limited. The flexibility of the method for determining the public key of the trusted execution environment can be improved.

[0113] The following describes an exemplary method for performing security verification according to an embodiment of the present application. Figure 6 A schematic diagram showing a security verification method according to an embodiment of the present application is shown.

[0114] Before using the trusted execution environment, if the user needs to determine the security of the trusted execution environment, he can submit a security verification request to the data processing unit. Figure 6 As shown, in a possible implementation, the method includes steps S61-S62:

[0115] Step S61, the data processing unit receives a security verification request for a trusted execution environment initiated by a user device;

[0116] Step S62, the data processing unit sends the operating environment information including the complete signature and the public key of the trusted execution environment to the user device in response to the security verification request, wherein the operating environment information including the complete signature is obtained by signing the operating environment information of the trusted execution environment according to the private key of each object in the trusted execution environment, and the public key of the trusted execution environment is obtained according to the private key of each object;

[0117] The operating environment information including the complete signature and the public key of the trusted execution environment are used to verify the security of the trusted execution environment.

[0118] For example, when the data processing unit receives a security verification request (equivalent to the remote attestation request described above), it can be considered that the user needs to verify the security of the trusted execution environment provided to the user. Therefore, in response to the security verification request, the data processing unit can send the user device the operating environment information including the complete signature (equivalent to the certificate of the remote attestation described above) and the public key of the trusted execution environment. The public key of the trusted execution environment has been generated when the trusted execution environment is constructed. For an exemplary method of obtaining it, please refer to the above and Figure 5 The operating environment information including the complete signature may be generated and sent by the data processing unit after receiving the security verification request, or may be generated after the trusted execution environment is built and sent when the security verification request is received. This application does not limit this. An exemplary method for generating the operating environment information including the complete signature can be found below. Figure 7 The user device can use the operating environment information including the complete signature and the public key of the trusted execution environment to verify the security of the trusted execution environment.

[0119] According to the security verification method of the embodiment of the present application, a security verification request for a trusted execution environment initiated by a user device is received by a data processing unit, and in response to the security verification request, the operating environment information including a complete signature and the public key of the trusted execution environment are sent to the user device, so that the user device can obtain information used to verify the security of the trusted execution environment; on the one hand, the public key of the trusted execution environment is obtained based on the private key of each object, which is equivalent to multiple objects in the trusted execution environment jointly generating, controlling and using the root key of the trusted execution environment, so that the user does not have to fully trust any of the multiple objects, so the probability that the confidentiality of data is affected when the user uses the trusted execution environment due to maliciousness of a certain object is greatly reduced; on the other hand, the operating environment information containing the complete signature is obtained by signing the operating environment information of the trusted execution environment according to the private key of each object in the trusted execution environment, which is equivalent to jointly verifying the operating environment information of the trusted execution environment through multiple objects, so that the security credibility of the trusted execution environment determined by the verification is increased; in summary, the security verification method of the embodiment of the present application can improve the reliability of the trusted execution environment.

[0120] In this case, users no longer have to fully trust any object in the trusted execution environment, such as the chip, cloud platform, model / algorithm provider, etc., but believe that these objects will not all want to destroy the trusted execution environment, tamper with the service program code, or steal the user's data. Under this trust mechanism, as long as at least one party is honest and trustworthy, the trusted execution environment can be considered trustworthy, and the privacy and security of the data can be guaranteed when the user-specified program code is run under the user-specified hardware configuration to process the user's data.

[0121] The following first introduces an exemplary method for generating operating environment information including a complete signature. Figure 7 A schematic diagram showing a method for generating operating environment information including a complete signature according to an embodiment of the present application.

[0122] like Figure 7 As shown, in a possible implementation, the method further includes:

[0123] Each of the objects determines its own operating environment information and obtains the operating environment information of the other objects;

[0124] Each object determines the operating environment information of the trusted execution environment according to the operating environment information of the object itself and the operating environment information of the other objects;

[0125] The data processing unit signs the operating environment information of the trusted execution environment according to the private key of each object to obtain the operating environment information including the complete signature.

[0126] By having multiple objects interact and authenticate each other's environments, signatures are generated when each other's environments are recognized, which can further improve the accuracy of verification of the security of the trusted execution environment using the operating environment information including the complete signature.

[0127] For example, if Figure 7 As shown, each object can determine its own operating environment information (i.e., self-measurement) by measuring its own operating environment, and obtain the operating environment information of other objects (i.e., interaction measurement) through the interactive measurement of the operating environment between objects. Among them, for different objects, the methods of determining their own operating environment information and obtaining the operating environment information of other objects may be different. The following text takes the objects as chips and cloud platforms as examples to give examples of determining their own operating environment information and obtaining the operating environment information of other objects.

[0128] Each object can determine the operating environment information of the trusted execution environment based on its own operating environment information and the operating environment information of other objects, so that the operating environment information of the trusted execution environment includes the operating environment information of each object. Each object can input the operating environment information of the trusted execution environment determined by itself into the data processing unit.

[0129] In an ideal state, if each object is indeed trustworthy, and there are no errors in the measurement of each object's own operating environment and the measurement of the operating environment interaction between objects, then the operating environment information of the trusted execution environment determined by each object can be the same. In this case, the data processing unit can sign the operating environment information of the trusted execution environment determined by any object according to the private key of each object (which has been input into the data processing unit in step S51) to obtain the operating environment information including the complete signature. In this regard, the embodiments of the present application propose two exemplary implementation methods.

[0130] In one possible implementation, the data processing unit signs the operating environment information of the trusted execution environment according to the private key of each object to obtain the operating environment information including the complete signature. The operating environment information of the trusted execution environment input by any object can be used as the signature object to be signed, and the signature object is signed according to the private key of each object previously input into the data processing unit, so as to directly obtain and output the signed operating environment information of each object (i.e., the operating environment information including the complete signature).

[0131] In another possible implementation, the data processing unit signs the operating environment information of the trusted execution environment according to the private key of each object to obtain the operating environment information including the complete signature, including:

[0132] The data processing unit signs the operating environment information of the trusted execution environment according to the private key of each object to obtain the operating environment information including the signature fragment corresponding to each object;

[0133] The data processing unit synthesizes the operating environment information including the complete signature according to the operating environment information including the signature fragment corresponding to each object.

[0134] In this way, the method of generating the operating environment information including the complete signature is made more flexible.

[0135] For example, the data processing unit signs the operating environment information of the trusted execution environment according to the private key of each object to obtain the operating environment information including the complete signature. It can also be that the operating environment information of the trusted execution environment input by any object is used as the signature object to be signed, and the signature object is signed separately according to the private key of each object previously input into the data processing unit (input when determining the public key of the trusted execution environment), first obtaining the operating environment information including the signature fragment corresponding to each object, and then synthesizing the operating environment information including the signature fragment corresponding to each object to obtain and output the operating environment information including the complete signature.

[0136] Those skilled in the art should understand that although only two exemplary implementations of the fully signed operating environment information are provided in the embodiments of the present application, there are more ways to obtain the fully signed operating environment information in actual applications. As long as the exemplary implementations of the fully signed operating environment information that can be implemented based on the prior art can be used in the embodiments of the present application, the embodiments of the present application do not limit this.

[0137] The following describes an example of how an object determines its own operating environment information and obtains the operating environment information of other objects when the objects are chips and cloud platforms.

[0138] In a possible implementation, the object includes a chip, the operating environment information of the chip includes at least one of a chip parameter and a code summary of a user trusted application running on the chip, and each of the objects determines its own operating environment information and obtains the operating environment information of the other objects, including:

[0139] For each chip, obtaining its own operating environment information according to at least one of its own chip parameters and a code summary of a user trusted application program running on the chip;

[0140] Sending an information acquisition request to other objects except itself, wherein the information acquisition request is used to obtain the operating environment information of the other objects;

[0141] When receiving an information acquisition request from an object other than itself, the operating environment information of the object is output to the other object.

[0142] For example, see Figure 7The objects included in the trusted execution environment may include various types of chips, such as the central processing unit chip, auxiliary computing chip and other hardware chips mentioned above. For each hardware chip, certain chip parameters are pre-designed, such as the chip's main frequency, bus frequency, etc., which can characterize the hardware environment of the chip; the code of the user trusted application runs on it, and the code summary can characterize the software environment of the chip. In this case, for each chip, the measurement of its own (software and / or hardware) operating environment is completed, which can be based on at least one of its own chip parameters and the code summary of the user trusted application running on it, to obtain its own operating environment information, and based on this, determine whether its own operating environment meets the requirements.

[0143] It is understandable that the data that can characterize the hardware environment of the chip should be more than just the chip parameters, and the data that can characterize the software environment of the chip should be more than just the code summary of the user's trusted application running on the chip. As long as the chip obtains its own operating environment information, the data used is indeed the data that can characterize the hardware environment and / or software environment of the chip. The embodiments of the present application do not limit the specific data used when the chip obtains its own operating environment information.

[0144] In order to complete the interaction measurement with other objects, the chip can send information acquisition requests (such as measurement tasks) to other objects except itself. The information acquisition request is used to obtain the operating environment information of other objects. Figure 7 , other objects may include model / algorithm providers and cloud platforms. Optionally, the information acquisition request does not have to be sent to all objects except itself. For example, when the central processing unit chip only sends an information acquisition request to the cloud platform, it can be considered that the central processing unit chip does not need to measure the operating environment of other objects except the cloud platform. Other objects that receive the information acquisition request can feed back their own determined operating environment information to the chip that initiated the information acquisition request. In this case, the chip can measure the received operating environment information of other objects to determine whether the operating environment of other objects meets the requirements.

[0145] Similarly, when the chip receives an information acquisition request from an object other than itself, it also outputs its own operating environment information to the other object, so that the other object can measure the operating environment of the chip.

[0146] In this way, it is possible to support chip self-measurement and interaction measurement with other objects, thereby improving the diversity of the trusted execution environment.

[0147] In a possible implementation, the object includes a cloud platform, the operating environment information of the cloud platform includes at least one of software configuration information, virtual machine configuration information, and server configuration information, and each of the objects determines its own operating environment information and obtains the operating environment information of the other objects, including:

[0148] For each cloud platform, obtain its own operating environment information according to at least one of its own software configuration information, virtual machine configuration information, and server configuration information;

[0149] For each of the other objects, when the object is deployed on the cloud platform, determining the operating environment information of the object according to the deployment information of the object;

[0150] When the object is not deployed on the cloud platform, sending an information acquisition request to the object, wherein the information acquisition request is used to obtain the operating environment information of the object;

[0151] When receiving an information acquisition request from an object other than itself, the operating environment information of the object is output to the other object.

[0152] For example, see Figure 7 , the objects included in the trusted execution environment may include cloud platforms. For each cloud platform, servers (such as bare metal servers) are pre-configured, so the server configuration information can represent the hardware environment of the cloud platform; and software, virtual machines, etc. are configured, so the software configuration information and virtual machine configuration information can represent the software environment of the cloud platform. In this case, for each cloud platform, the measurement of its own (software and / or hardware) operating environment is completed, which can be based on at least one of its own software configuration information, virtual machine configuration information, and server configuration information, to obtain its own operating environment information, and based on this, determine whether its own operating environment meets the requirements.

[0153] It is understandable that the data that can represent the hardware environment of the cloud platform should be more than just server configuration information, and the data that can represent the software environment of the cloud platform should be more than just software configuration information and virtual machine configuration information. As long as the cloud platform obtains its own operating environment information, the data used is indeed the data that can represent the hardware environment and / or software environment of the cloud platform. The embodiments of the present application do not limit the specific data used when the cloud platform obtains its own operating environment information.

[0154] In order to complete the interaction measurement with other objects, the cloud platform needs to obtain the operating environment information of other objects except itself. Figure 7, other objects may include model / algorithm providers and chips. In one example, the model / algorithm provider and the chip may be deployed on the cloud platform. During the deployment of these objects on the cloud platform, their own software / hardware operating environment information has been provided to the cloud platform. In this regard, the cloud platform can directly use the operating environment information obtained during deployment to measure the operating environment of these objects. For objects that are not deployed on the cloud platform (not shown), the cloud platform can issue an information acquisition request to the object, and the information acquisition request is used to obtain the operating environment information of the object. Optionally, considering that the software / hardware operating environment of the object may change after it is deployed on the cloud platform, the cloud platform can also issue an information acquisition request to the object deployed on the cloud platform to re-acquire the operating environment information of the object to ensure the accuracy of the operating environment information of other objects other than itself.

[0155] Optionally, the information acquisition request does not have to be sent to all objects except itself. For example, when the cloud platform only sends an information acquisition request to the central processing unit chip, it can be considered that the cloud platform does not need to measure the operating environment of other objects except the central processing unit chip. Other objects that receive the information acquisition request can feed back their own determined operating environment information to the cloud platform that initiated the information acquisition request. In this case, the cloud platform can measure the operating environment information received from other objects to determine whether the operating environment of other objects meets the requirements.

[0156] Similarly, when the cloud platform receives an information acquisition request from an object other than itself, it also outputs its own operating environment information to the other object, so that the other object can measure the operating environment of the cloud platform.

[0157] In this way, it is possible to support the cloud platform's own measurement and the interaction measurement with other objects, which can further improve the diversity of the trusted execution environment.

[0158] Those skilled in the art should understand that in actual applications, in addition to chips and cloud platforms, the trusted execution environment may also include more types of objects, such as the model / algorithm providers mentioned above, etc. For the hardware objects among these other types of objects, the way they measure themselves and the way they interact with other objects for measurement, please refer to the chips described above; for the software objects among these other types of objects, the way they measure themselves and the way they interact with other objects for measurement, please refer to the cloud platform described above, and no further details will be given here.

[0159] After the data processing unit sends the operating environment information including the complete signature and the public key of the trusted execution environment to the user device, the user device can verify the security of the trusted execution environment based on the operating environment information including the complete signature and the public key of the trusted execution environment. The following introduces several exemplary methods for the user device to verify the security of the trusted execution environment according to embodiments of the present application.

[0160] In a possible implementation, verifying the security of the trusted execution environment includes:

[0161] It is determined whether the public key of the trusted execution environment corresponds to the complete signature, and when the public key of the trusted execution environment corresponds to the complete signature, it is determined that the trusted execution environment is secure.

[0162] For example, verification may include two aspects: on the one hand, whether the private key of each object is input into the data processing unit for calculation (which can be verified by the data processing unit and the verification result is sent to the user device without leaking the private key of each object to other objects and the user device), and on the other hand, whether the public key of the trusted execution environment corresponds to the complete signature (which can be verified by the user device). When the conditions that the private key of each object is input into the data processing unit for calculation and the public key of the trusted execution environment corresponds to the complete signature are met at the same time, the user device determines that the calculated public key is correct.

[0163] In this way, the security of the trusted execution environment can be verified in a relatively simple manner, thereby saving data processing costs and reducing the complexity of verification implementation.

[0164] Optionally, since the public key of the trusted execution environment is used when verifying the security of the trusted execution environment, the user may also choose to verify the correctness of the public key of the trusted execution environment.

[0165] In a possible implementation, verifying the security of the trusted execution environment includes:

[0166] Determining whether a synthesis result of the public key of each object is consistent with the public key of the trusted execution environment, and when the synthesis result of the public key of each object is consistent with the public key of the trusted execution environment, determining that the public key of the trusted execution environment is correct;

[0167] Determine whether the public key of the trusted execution environment corresponds to the complete signature, and determine that the trusted execution environment is secure when the public key of the trusted execution environment is correct and the public key of the trusted execution environment corresponds to the complete signature.

[0168] For example, the correctness of the public key of the trusted execution environment can be verified by determining whether the synthesis result of the public key of each object is consistent with the public key of the trusted execution environment. When the synthesis result of the public key of each object is consistent with the public key of the trusted execution environment, the public key of the trusted execution environment is determined to be correct. For an exemplary implementation method, see the relevant description of step S52 above. Thereafter, it is determined whether the public key of the trusted execution environment corresponds to the complete signature. When the public key of the trusted execution environment is correct and the public key of the trusted execution environment corresponds to the complete signature, the trusted execution environment is determined to be secure.

[0169] By also verifying the correctness of the public key of the trusted execution environment, the reliability of the verification result of the security of the trusted execution environment can be improved, and the verification method can be made more flexible.

[0170] Optionally, since the synthesis result of the public key of each object is used when verifying the correctness of the public key of the trusted execution environment, the user may also choose to verify the correctness of the synthesis result of the public key of each object.

[0171] In a possible implementation, verifying the security of the trusted execution environment includes:

[0172] Determining the correctness of the public key certificate of each object, and when the public key certificate of each object is correct, determining that the synthesis result of the public key of each object is correct;

[0173] Determining whether a synthesis result of the public key of each object is consistent with the public key of the trusted execution environment, and when the synthesis result of the public key of each object is correct and the synthesis result of the public key of each object is consistent with the public key of the trusted execution environment, determining that the public key of the trusted execution environment is correct;

[0174] Determine whether the public key of the trusted execution environment corresponds to the complete signature, and determine that the trusted execution environment is secure when the public key of the trusted execution environment is correct and the public key of the trusted execution environment corresponds to the complete signature.

[0175] For example, the correctness of the synthesis result of the public key of each object can be verified by judging the correctness of the public key certificate of each object. When the public key certificates of each object are correct, it is determined that the synthesis result of the public key of each object is correct. For an exemplary implementation, please refer to the relevant description of step S51 above. Then, it is determined whether the synthesis result of the public key of each object is consistent with the public key of the trusted execution environment. When the synthesis result of the public key of each object is correct and the synthesis result of the public key of each object is consistent with the public key of the trusted execution environment, it is determined that the public key of the trusted execution environment is correct. For an exemplary implementation, please refer to the relevant description of step S52 above. Finally, it is determined whether the public key of the trusted execution environment corresponds to the complete signature. When the public key of the trusted execution environment is correct and the public key of the trusted execution environment corresponds to the complete signature, it is determined that the trusted execution environment is secure.

[0176] By verifying the correctness of the synthesis result of the public key of each object and the correctness of the public key of the trusted execution environment, the reliability of the verification result of the security of the trusted execution environment is further improved, and the verification method is made more flexible.

[0177] After the security verification of the trusted execution environment is completed and passed, the user device can assume that the security of the trusted execution environment when providing computing services for itself can be guaranteed. In this case, the user can input the data to be calculated into the trusted execution environment for calculation. Optionally, in order to further improve the security of the user's data, the user's data can be encrypted before being input into the trusted execution environment.

[0178] The following describes an exemplary method for encrypting user data according to an embodiment of the present application. Figure 8 A schematic diagram showing an exemplary method for encrypting user data according to an embodiment of the present application.

[0179] like Figure 8 As shown, in a possible implementation, when determining that the trusted execution environment is secure, the method further includes:

[0180] The data processing unit signs the communication key of the trusted execution environment according to the private key of each object to obtain a communication key including a complete signature, and the communication key including the complete signature is used to encrypt data input into the trusted operating environment by a user device.

[0181] In this way, during the external communication process of the trusted execution environment, the communication key that protects the communication data is signed by multiple objects, which can improve the security of data communication.

[0182] For example, if Figure 8As shown, the trusted execution environment may include a random number generator for randomly generating a communication key (i.e., the communication key of the trusted execution environment). The data processing unit may sign the communication key of the trusted execution environment according to the private key of each object to obtain a communication key including a complete signature. Its exemplary implementation method is similar to the method in which the data processing unit can sign the operating environment information of the trusted execution environment according to the private key of each object.

[0183] For example, in one possible implementation, the data processing unit signs the communication key of the trusted execution environment according to the private key of each object to obtain the communication key including the complete signature. The communication key of the trusted execution environment may be used as the signature object to be signed, and the signature object is signed according to the private key of each object previously input into the data processing unit (input when determining the public key of the trusted execution environment), and the communication key including the signature of each object (i.e., the communication key including the complete signature) is directly obtained and output.

[0184] For another example, in another possible implementation, the data processing unit signs the communication key of the trusted execution environment according to the private key of each object to obtain a communication key including a complete signature, including:

[0185] The data processing unit signs the communication key of the trusted execution environment according to the private key of each object, and obtains the communication key corresponding to each object including the signature fragment;

[0186] The data processing unit synthesizes the communication key including the complete signature according to the communication key including the signature fragment corresponding to each object.

[0187] For example, the data processing unit signs the communication key of the trusted execution environment according to the private key of each object to obtain the communication key including the complete signature. It can also be that the communication key of the trusted execution environment is used as the signature object that needs to be signed, and the signature object is signed according to the private key of each object previously input into the data processing unit (input when determining the public key of the trusted execution environment). First, the communication key including the signature fragment corresponding to each object is obtained, and then the communication key including the signature fragment corresponding to each object is synthesized to obtain the communication key including the complete signature and output it.

[0188] In this way, the way of generating the communication key including the complete signature is made more flexible.

[0189] Those skilled in the art should understand that although only two exemplary implementations of the communication key for obtaining a complete signature are provided in the embodiments of the present application, there are more ways to obtain the communication key for a complete signature in practical applications. As long as the exemplary implementation of the communication key for obtaining a complete signature that can be implemented based on the prior art can be used in the embodiments of the present application, the embodiments of the present application do not limit this.

[0190] The data processing unit can output the communication key including the complete signature to the user device, and the user device can use the key to encrypt the data to be input into the trusted operating environment. The data encrypted using the communication key including the complete signature can be input into the trusted execution environment. After the object in the trusted execution environment receives the encrypted data, it can obtain the communication key including the complete signature from the data processing unit, use the communication key including the complete signature to decrypt the received encrypted data, and then perform corresponding operations on the decrypted data.

[0191] The embodiment of the present application provides a data processing system, the structure diagram of which can be seen in the above Figure 4 .

[0192] In one possible implementation, the system includes a data processing unit and a trusted execution environment, the trusted execution environment including two or more objects for use by a user device; the data processing unit is used to receive a security verification request for the trusted execution environment initiated by the user device; in response to the security verification request, send to the user device operating environment information including a complete signature and a public key of the trusted execution environment, the operating environment information including the complete signature is signed according to the private key of each object in the trusted execution environment, and the public key of the trusted execution environment is obtained according to the private key of each object; the operating environment information including the complete signature and the public key of the trusted execution environment are used to verify the security of the trusted execution environment.

[0193] In a possible implementation, each object is used to generate its own public key and private key, and output the private key to the data processing unit;

[0194] The data processing unit is further configured to determine, based on the received private key of each object, a public key corresponding to a synthesis result of the private key of each object; and use the determined public key as the public key of the trusted execution environment.

[0195] In a possible implementation, each object is further used to respectively determine its own operating environment information and obtain the operating environment information of the other objects; determine the operating environment information of the trusted execution environment according to the operating environment information of the own and the operating environment information of the other objects;

[0196] The data processing unit is further configured to sign the operating environment information of the trusted execution environment according to the private key of each object to obtain the operating environment information including the complete signature.

[0197] In a possible implementation, the data processing unit signs the operating environment information of the trusted execution environment according to the private key of each object to obtain the operating environment information including the complete signature, including:

[0198] The data processing unit signs the operating environment information of the trusted execution environment according to the private key of each object to obtain the operating environment information including the signature fragment corresponding to each object;

[0199] The data processing unit synthesizes the operating environment information including the complete signature according to the operating environment information including the signature fragment corresponding to each object.

[0200] In one possible implementation, when determining that the trusted execution environment is secure, the data processing unit is also used to sign the communication key of the trusted execution environment according to the private key of each object to obtain a communication key including a complete signature, and the communication key including the complete signature is used to encrypt data input into the trusted operating environment by a user device.

[0201] In a possible implementation, the data processing unit signs the communication key of the trusted execution environment according to the private key of each object to obtain the communication key including the complete signature, including:

[0202] The data processing unit signs the communication key of the trusted execution environment according to the private key of each object to obtain the communication key corresponding to each object including the signature fragment;

[0203] The data processing unit synthesizes the communication key including the complete signature according to the communication key including the signature fragment corresponding to each object.

[0204] In a possible implementation, the object includes a chip, and the operating environment information of the chip includes at least one of a chip parameter and a code summary of a user trusted application program running on the chip; each of the objects determines its own operating environment information respectively, and obtains the operating environment information of the other objects, including:

[0205] For each chip, obtaining its own operating environment information according to at least one of its own chip parameters and a code summary of a user trusted application program running on the chip;

[0206] Sending an information acquisition request to other objects except itself, wherein the information acquisition request is used to obtain the operating environment information of the other objects;

[0207] When receiving an information acquisition request from an object other than itself, the operating environment information of the object is output to the other object.

[0208] In a possible implementation, the object includes a cloud platform, and the operating environment information of the cloud platform includes at least one of software configuration information, virtual machine configuration information, and server configuration information; each object determines its own operating environment information and obtains the operating environment information of the other objects, including:

[0209] For each cloud platform, obtain its own operating environment information according to at least one of its own software configuration information, virtual machine configuration information, and server configuration information;

[0210] For each of the other objects, when the object is deployed on the cloud platform, determining the operating environment information of the object according to the deployment information of the object;

[0211] When the object is not deployed on the cloud platform, sending an information acquisition request to the object, wherein the information acquisition request is used to obtain the operating environment information of the object;

[0212] When receiving an information acquisition request from an object other than itself, the operating environment information of the object is output to the other object.

[0213] In a possible implementation, the user device is used to determine whether the public key of the trusted execution environment corresponds to the complete signature, and when the public key of the trusted execution environment corresponds to the complete signature, determine that the trusted execution environment is secure.

[0214] In one possible implementation, the user device is used to determine whether a synthesis result of the public key of each object is consistent with the public key of the trusted execution environment, and when the synthesis result of the public key of each object is consistent with the public key of the trusted execution environment, determine that the public key of the trusted execution environment is correct; and determine whether the public key of the trusted execution environment corresponds to the complete signature, and when the public key of the trusted execution environment is correct and the public key of the trusted execution environment corresponds to the complete signature, determine that the trusted execution environment is secure.

[0215] In one possible implementation, the user device is used to determine the correctness of the public key certificate of each object, and when the public key certificate of each object is correct, determine that the synthesis result of the public key of each object is correct; determine whether the synthesis result of the public key of each object is consistent with the public key of the trusted execution environment, and when the synthesis result of the public key of each object is correct and the synthesis result of the public key of each object is consistent with the public key of the trusted execution environment, determine that the public key of the trusted execution environment is correct; determine whether the public key of the trusted execution environment corresponds to the complete signature, and when the public key of the trusted execution environment is correct and the public key of the trusted execution environment corresponds to the complete signature, determine that the trusted execution environment is secure.

[0216] In a possible implementation, each object generates its own public key and private key, and outputs the private key to the data processing unit, including:

[0217] For each object, generate its own public key and private key;

[0218] Outputting its own public key certificate to other objects in the trusted execution environment except itself;

[0219] Receiving a public key certificate of the other object;

[0220] The correctness of the public key certificates of the other objects is determined, and when the public key certificates of each of the other objects are correct, the private key is output to the data processing unit.

[0221] An embodiment of the present application provides a data processing system, comprising: a processor and a memory for storing processor-executable instructions; wherein the processor is configured to implement the above-mentioned data processing unit when executing the instructions.

[0222] An embodiment of the present application provides a non-volatile computer-readable storage medium on which computer program instructions are stored. When the computer program instructions are executed by a processor, the above-mentioned data processing unit is implemented.

[0223] An embodiment of the present application provides a computer program product, including a computer-readable code, or a non-volatile computer-readable storage medium carrying the computer-readable code. When the computer-readable code runs in a processor of an electronic device, the processor in the electronic device executes the above-mentioned data processing unit.

[0224] Fig. 9 An exemplary structural diagram of a data processing system according to an embodiment of the present application is shown.

[0225] like Fig. 9As shown, the data processing system may include at least one of a mobile phone, a foldable electronic device, a tablet computer, a desktop computer, a laptop computer, a handheld computer, a notebook computer, an ultra-mobile personal computer (UMPC), a netbook, a cellular phone, a personal digital assistant (PDA), an augmented reality (AR) device, a virtual reality (VR) device, an artificial intelligence (AI) device, a wearable device, an in-vehicle device, a smart home device, or a smart city device, and a server device. The embodiment of the present application does not impose any special restrictions on the specific type of the data processing system.

[0226] The data processing system may include a processor 110, a memory 121, and a communication module 160. It is understood that the structure illustrated in the embodiment of the present application does not constitute a specific limitation on the data processing system. In other embodiments of the present application, the data processing system may include more or fewer components than shown in the figure, or combine certain components, or split certain components, or arrange the components differently. The illustrated components may be implemented in hardware, software, or a combination of software and hardware.

[0227] The processor 110 may include one or more processing units, for example, the processor 110 may include an application processor (AP), a modem processor, a graphics processor (GPU), an image signal processor (ISP), a controller, a video codec, a digital signal processor (DSP), a baseband processor, and / or a neural-network processing unit (NPU), etc. Different processing units may be independent devices or integrated into one or more processors.

[0228] The processor can generate operation control signals based on instruction opcodes and timing signals to complete the control of instruction fetching and execution.

[0229] A memory may also be provided in the processor 110 for storing instructions and data. In some embodiments, the memory in the processor 110 may be a cache memory. The memory may store instructions or data that have been used or are frequently used by the processor 110, such as the public key of the trusted execution environment in the embodiment of the present application. If the processor 110 needs to use the instruction or data, it may be directly called from the memory. This avoids repeated access, reduces the waiting time of the processor 110, and thus improves the efficiency of the system.

[0230] The memory 121 can be used to store computer executable program code, which includes instructions. The memory 121 may include a program storage area and a data storage area. Among them, the program storage area can store an operating system, an application required for at least one function (such as a secure multi-party computing protocol), etc. The data storage area can store data acquired or created during the use of the data processing unit (such as a public key of a trusted execution environment, etc.). In addition, the memory 121 may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, a universal flash storage (UFS), etc. The processor 110 implements the various methods performed by the above-mentioned data processing unit by running instructions stored in the memory 121, and / or instructions stored in a memory provided in the processor.

[0231] The communication module 160 can be used to receive data (such as the security verification request in the embodiment of the present application) from other devices or equipment through wireless communication / wired communication, and output data to other devices or equipment. For example, wireless communication solutions including WLAN (such as Wi-Fi network), Bluetooth (BT), global navigation satellite system (GNSS), frequency modulation (FM), near field communication technology (NFC), infrared technology (IR), etc. can be provided.

[0232] A computer-readable storage medium may be a tangible device that can hold and store instructions used by an instruction execution device. A computer-readable storage medium may be, for example, but not limited to, an electrical storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination thereof. More specific examples (a non-exhaustive list) of computer-readable storage media include: a portable computer disk, a hard disk, a random access memory (RAM), a read only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a static random access memory (SRAM), a portable compact disc read-only memory (CD-ROM), a digital versatile disc (DVD), a memory stick, a floppy disk, a mechanical encoding device, such as a punch card or a raised structure in a groove on which instructions are stored, and any suitable combination thereof.

[0233] The computer-readable program instructions or codes described herein can be downloaded from a computer-readable storage medium to each computing / processing device, or downloaded to an external computer or external storage device via a network, such as the Internet, a local area network, a wide area network, and / or a wireless network. The network can include copper transmission cables, optical fiber transmissions, wireless transmissions, routers, firewalls, switches, gateway computers, and / or edge servers. The network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards the computer-readable program instructions for storage in the computer-readable storage medium in each computing / processing device.

[0234] The computer program instructions for performing the operation of the present application may be assembly instructions, instruction set architecture (ISA) instructions, machine instructions, machine-related instructions, microcode, firmware instructions, state setting data, or source code or object code written in any combination of one or more programming languages, including object-oriented programming languages, such as Smalltalk, C++, etc., and conventional procedural programming languages, such as "C" language or similar programming languages. The computer-readable program instructions may be executed entirely on the user's computer, partially on the user's computer, as an independent software package, partially on the user's computer, partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer via any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., using an Internet service provider to connect via the Internet). In some embodiments, by utilizing the state information of computer-readable program instructions to personalize an electronic circuit, such as a programmable logic circuit, a field-programmable gate array (FPGA) or a programmable logic array (PLA), the electronic circuit can execute the computer-readable program instructions to implement various aspects of the present application.

[0235] Various aspects of the present application are described herein with reference to the flowcharts and / or block diagrams of the methods, devices (systems) and computer program products according to the embodiments of the present application. It should be understood that each box in the flowchart and / or block diagram and the combination of each box in the flowchart and / or block diagram can be implemented by computer-readable program instructions.

[0236] These computer-readable program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, thereby producing a machine, so that when these instructions are executed by the processor of the computer or other programmable data processing device, a device that implements the functions / actions specified in one or more boxes in the flowchart and / or block diagram is generated. These computer-readable program instructions can also be stored in a computer-readable storage medium, and these instructions cause the computer, programmable data processing device, and / or other equipment to work in a specific manner, so that the computer-readable medium storing the instructions includes a manufactured product, which includes instructions for implementing various aspects of the functions / actions specified in one or more boxes in the flowchart and / or block diagram.

[0237] Computer-readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device so that a series of operating steps are performed on the computer, other programmable data processing apparatus, or other device to produce a computer-implemented process, thereby causing the instructions executed on the computer, other programmable data processing apparatus, or other device to implement the functions / actions specified in one or more boxes in the flowchart and / or block diagram.

[0238] The flow chart and block diagram in the accompanying drawings show the possible architecture, function and operation of the device, system, method and computer program product according to multiple embodiments of the present application. In this regard, each square frame in the flow chart or block diagram can represent a part of a module, program segment or instruction, and a part of the module, program segment or instruction includes one or more executable instructions for realizing the logical function of the specification. In some alternative implementations, the functions marked in the square frame can also occur in a sequence different from that marked in the accompanying drawings. For example, two continuous square frames can actually be executed substantially in parallel, and they can also be executed in reverse order sometimes, depending on the functions involved.

[0239] It should also be noted that each box in the block diagram and / or flowchart, and combinations of boxes in the block diagram and / or flowchart, can be implemented by hardware (such as a circuit or an application-specific integrated circuit (ASIC)) that performs the corresponding function or action, or can be implemented by a combination of hardware and software, such as firmware.

[0240] Although the present invention is described herein in conjunction with various embodiments, in the process of implementing the claimed invention, those skilled in the art may understand and implement other variations of the disclosed embodiments by viewing the drawings, the disclosure, and the appended claims. In the claims, the word "comprising" does not exclude other components or steps, and "one" or "an" does not exclude multiple situations. A single processor or other unit may implement several functions listed in the claims. Certain measures are recorded in different dependent claims, but this does not mean that these measures cannot be combined to produce good results.

[0241] The embodiments of the present application have been described above, and the above description is exemplary, not exhaustive, and is not limited to the disclosed embodiments. Many modifications and changes are obvious to those of ordinary skill in the art without departing from the scope of the described embodiments. The selection of terms used herein is intended to best explain the principles of the embodiments, practical applications, or improvements to the technology in the market, or to enable other persons of ordinary skill in the art to understand the embodiments disclosed herein.

Claims

1. A security verification method, characterized in that: The method is applied to a data processing system, the data processing system includes a data processing unit and a trusted execution environment, the trusted execution environment includes two or more objects for use by a user device, and the method includes: The data processing unit receives a security verification request initiated by the user equipment for the trusted execution environment; In response to the security verification request, the data processing unit sends the operating environment information including the complete signature and the public key of the trusted execution environment to the user device, the operating environment information including the complete signature is signed by the operating environment information of the trusted execution environment according to the private key of each object in the trusted execution environment, and the public key of the trusted execution environment is obtained according to the private key of each object.

2. The method according to claim 1, characterized in that The method further comprises: Each object generates its own public key and private key, and outputs the private key to the data processing unit; The data processing unit determines, based on the received private key of each object, a public key corresponding to a synthesis result of the private key of each object; The determined public key is used as the public key of the trusted execution environment.

3. The method according to claim 1 or 2, characterized in that: The method further comprises: Each of the objects determines its own operating environment information and obtains the operating environment information of the other objects; Each object determines the operating environment information of the trusted execution environment according to its own operating environment information and the operating environment information of other objects; The data processing unit signs the operating environment information of the trusted execution environment according to the private key of each object to obtain the operating environment information including the complete signature.

4. The method according to claim 3, characterized in that The data processing unit signs the operating environment information of the trusted execution environment according to the private key of each object to obtain the operating environment information including the complete signature, including: The data processing unit signs the operating environment information of the trusted execution environment according to the private key of each object to obtain the operating environment information including the signature fragment corresponding to each object; The data processing unit synthesizes the operating environment information including the complete signature according to the operating environment information including the signature fragment corresponding to each object.

5. The method according to any one of claims 1 to 4, characterized in that: When determining that the trusted execution environment is secure, the method further includes: The data processing unit signs the communication key of the trusted execution environment according to the private key of each object to obtain a communication key including a complete signature, and the communication key including the complete signature is used to encrypt data input into the trusted operating environment by a user device.

6. The method according to claim 5, characterized in that The data processing unit signs the communication key of the trusted execution environment according to the private key of each object to obtain a communication key including a complete signature, including: The data processing unit signs the communication key of the trusted execution environment according to the private key of each object to obtain the communication key corresponding to each object including the signature fragment; The data processing unit synthesizes the communication key including the complete signature according to the communication key including the signature fragment corresponding to each object.

7. The method according to any one of claims 3 to 6, characterized in that: The object includes a chip, and the operating environment information of the chip includes at least one of a chip parameter and a code summary of a user trusted application program running on the chip. Each object determines its own operating environment information and obtains the operating environment information of other objects, including: For each chip, obtaining its own operating environment information according to at least one of its own chip parameters and a code summary of a user trusted application program running on the chip; Sending an information acquisition request to other objects except itself, wherein the information acquisition request is used to obtain the operating environment information of the other objects; When receiving an information acquisition request from an object other than itself, the operating environment information of the object is output to the other object.

8. The method according to any one of claims 3 to 7, characterized in that: The object includes a cloud platform, and the operating environment information of the cloud platform includes at least one of software configuration information, virtual machine configuration information, and server configuration information. Each object determines its own operating environment information and obtains the operating environment information of other objects, including: For each cloud platform, obtain its own operating environment information according to at least one of its own software configuration information, virtual machine configuration information, and server configuration information; For each of the other objects, when the object is deployed on the cloud platform, determining the operating environment information of the object according to the deployment information of the object; When the object is not deployed on the cloud platform, sending an information acquisition request to the object, wherein the information acquisition request is used to obtain the operating environment information of the object; When receiving an information acquisition request from an object other than itself, the operating environment information of the object is output to the other object.

9. The method according to any one of claims 1 to 8, characterized in that: Verifying the security of the trusted execution environment includes: It is determined whether the public key of the trusted execution environment corresponds to the complete signature, and when the public key of the trusted execution environment corresponds to the complete signature, it is determined that the trusted execution environment is secure.

10. The method according to any one of claims 1 to 8, characterized in that: The method further comprises: Determining whether a synthesis result of the public key of each object is consistent with the public key of the trusted execution environment, and when the synthesis result of the public key of each object is consistent with the public key of the trusted execution environment, determining that the public key of the trusted execution environment is correct; Determine whether the public key of the trusted execution environment corresponds to the complete signature, and determine that the trusted execution environment is secure when the public key of the trusted execution environment is correct and the public key of the trusted execution environment corresponds to the complete signature.

11. The method according to any one of claims 1 to 8, characterized in that: The method further comprises: Determining the correctness of the public key certificate of each object, and when the public key certificate of each object is correct, determining that the synthesis result of the public key of each object is correct; Determining whether a synthesis result of the public key of each object is consistent with the public key of the trusted execution environment, and when the synthesis result of the public key of each object is correct and the synthesis result of the public key of each object is consistent with the public key of the trusted execution environment, determining that the public key of the trusted execution environment is correct; Determine whether the public key of the trusted execution environment corresponds to the complete signature, and determine that the trusted execution environment is secure when the public key of the trusted execution environment is correct and the public key of the trusted execution environment corresponds to the complete signature.

12. The method according to any one of claims 2 to 11, characterized in that: Each object generates its own public key and private key, and outputs the private key to the data processing unit, including: For each object, generate its own public key and private key; Outputting its own public key certificate to other objects in the trusted execution environment except itself; Receiving a public key certificate of the other object; The correctness of the public key certificates of the other objects is determined, and when the public key certificates of each of the other objects are correct, the private key is output to the data processing unit.

13. A data processing system, characterized in that: The system includes a data processing unit and a trusted execution environment, wherein the trusted execution environment includes two or more objects for use by a user device. The data processing unit is used to receive a security verification request for the trusted execution environment initiated by the user device; in response to the security verification request, send operating environment information including a complete signature and a public key of the trusted execution environment to the user device, the operating environment information including the complete signature is signed by the operating environment information of the trusted execution environment according to the private key of each object in the trusted execution environment, and the public key of the trusted execution environment is obtained according to the private key of each object.

14. A data processing system, characterized in that: include: processor; a memory for storing processor-executable instructions; Wherein, the processor is configured to implement the data processing unit described in any one of claims 1-12 when executing the instructions.

15. A non-volatile computer-readable storage medium having computer program instructions stored thereon, characterized in that: When the computer program instructions are executed by a processor, the data processing unit according to any one of claims 1 to 12 is implemented.

16. A computer program product comprising computer readable code, or a non-volatile computer readable storage medium carrying computer readable code, characterized in that: When the computer readable code is executed in an electronic device, a processor in the electronic device executes the data processing unit according to any one of claims 1 to 12.

Images