Security verification method, data processing system, storage medium and program product

Abstract

The present application relates to a security verification method, a data processing system, a storage medium, and a program product. The method is applied to a data processing system and includes: a data processing unit receiving a security verification request for a trusted execution environment initiated by a user device; the data processing unit sending, to the user device, operating environment information including a complete signature and a public key of the trusted execution environment in response to the security verification request; the operating environment information including the complete signature and the public key of the trusted execution environment are used to verify the security of the trusted execution environment. The method can use a root key generated from the private keys of multiple objects to verify the security of a trusted execution environment in a data processing system that includes multiple objects, while eliminating the need for users to fully trust any of the multiple objects, thereby improving the reliability of the trusted execution environment.

Description

[0001] This application is a divisional application. The application number of the original application is 202211386390.1, and the original application date is November 7, 2022. The entire content of the original application is incorporated into this application by reference. Technical Field

[0002] The present application relates to the field of data processing, and in particular to a security verification method, a data processing system, a storage medium, and a program product. Background Art

[0003] The core technology of secure and trusted computing is data isolation, which protects user data from being accessed by other entities (including administrators and other superusers). Data isolation can be achieved through a trusted executive environment (TEE). A TEE is an operating environment consisting of independent trusted zones within the processor and memory. Different trusted zones can be used to isolate different applications (such as trusted applications (TA)), preventing them from accessing each other's data. Even highly privileged applications cannot access each other's data across zones.

[0004] With the continuous development of secure computing and trusted computing, their application areas are also expanding. The computing power required is higher, and the algorithms required are more complex. This makes it difficult for a single processor to provide a trusted execution environment that meets user needs. To address this, existing technologies have proposed a method for jointly building a trusted execution environment, using a cloud platform as the controller of the trusted execution environment and multiple processors as providers of computing power and algorithms, respectively. However, in this method, the root key of the trusted execution environment is generated by the cloud platform, requiring users to trust the cloud platform. If a problem occurs with the cloud platform, the security of the trusted execution environment cannot be guaranteed, resulting in low reliability of the trusted execution environment. Summary of the Invention

[0005] In view of this, a security verification method, a data processing system, a storage medium and a program product are proposed. According to the security verification method of the present application, the method can be applied in a data processing system, and a root key generated by the private keys of multiple objects can be used to verify the security of a trusted execution environment in the data processing system, which includes multiple objects. At the same time, the user does not have to fully trust any one of the multiple objects, which can improve the reliability of the trusted execution environment.

[0006] In a first aspect, the present application provides a security verification method, which is applied to a data processing system, wherein the data processing system includes a data processing unit and a trusted execution environment, and the trusted execution environment includes two or more objects for use by a user device. The method includes: the data processing unit receives a security verification request for the trusted execution environment initiated by the user device; the data processing unit sends an operating environment information including a complete signature and a public key of the trusted execution environment to the user device in response to the security verification request, the operating environment information including the complete signature is signed by signing the operating environment information of the trusted execution environment according to the private key of each object in the trusted execution environment, and the public key of the trusted execution environment is obtained according to the private key of each object; the operating environment information including the complete signature and the public key of the trusted execution environment are used to verify the security of the trusted execution environment.

[0007] According to the security verification method provided by the present application, a security verification request for a trusted execution environment initiated by a user device is received by a data processing unit, and in response to the security verification request, operating environment information including a complete signature and a public key of the trusted execution environment are sent to the user device, so that the user device can obtain information used to verify the security of the trusted execution environment; on the one hand, the public key of the trusted execution environment is obtained based on the private key of each object, which is equivalent to multiple objects in the trusted execution environment jointly generating, controlling and using the root key of the trusted execution environment, so that the user does not have to completely trust any of the multiple objects, so the probability that the confidentiality of data is affected when the user uses the trusted execution environment due to maliciousness of a certain object is greatly reduced; on the other hand, the operating environment information including the complete signature is obtained by signing the operating environment information of the trusted execution environment according to the private key of each object in the trusted execution environment, which is equivalent to jointly verifying the operating environment information of the trusted execution environment through multiple objects, so that the security credibility of the verified trusted execution environment is increased; in summary, the security verification method of the present application can improve the reliability of the trusted execution environment.

[0008] In this scenario, users no longer completely trust any of the entities within the TEE, including the chip, cloud platform, and model / algorithm providers. Instead, they can trust that none of these entities will attempt to disrupt the TEE, tamper with service program code, or steal user data. Under this trust mechanism, as long as at least one party is honest and trustworthy, the TEE can be considered trustworthy. When executing user-specified program code on user-specified hardware, data privacy and security are guaranteed.

[0009] According to the first aspect, in a first possible implementation of the security verification method, the method further includes: each object generates its own public key and private key, and outputs the private key to the data processing unit; the data processing unit determines the public key corresponding to the synthesis result of the private key of each object based on the received private key of each object; and uses the determined public key as the public key of the trusted execution environment.

[0010] In this way, it can be ensured that the public key of the trusted execution environment corresponds to the synthesis result of the private keys of multiple objects, so that when the public key of the trusted execution environment is used as the root key, the accuracy of the root key can be guaranteed.

[0011] According to the first aspect, or the first possible implementation of the first aspect, in a second possible implementation of the security verification method, the method further includes: each object separately determines its own operating environment information and obtains the operating environment information of the other objects; each object determines the operating environment information of the trusted execution environment based on its own operating environment information and the operating environment information of the other objects; the data processing unit signs the operating environment information of the trusted execution environment based on the private key of each object to obtain the operating environment information including the complete signature.

[0012] By having multiple objects interact and authenticate each other's environments, signatures are generated when each other's environments are recognized, which can further improve the verification accuracy of the security of the trusted execution environment using the operating environment information including the complete signature.

[0013] According to the second possible implementation of the first aspect, in a third possible implementation of the security verification method, the data processing unit signs the operating environment information of the trusted execution environment according to the private key of each object to obtain the operating environment information including the complete signature, including: the data processing unit signs the operating environment information of the trusted execution environment according to the private key of each object to obtain the operating environment information including the signature fragment corresponding to each object; the data processing unit synthesizes the operating environment information including the complete signature based on the operating environment information including the signature fragment corresponding to each object.

[0014] In this way, the method of generating the operating environment information including the complete signature is made more flexible.

[0015] According to the first aspect, or any possible implementation of the first aspect above, in a fourth possible implementation of the security verification method, when determining that the trusted execution environment is secure, the method further includes: the data processing unit signs the communication key of the trusted execution environment according to the private key of each object to obtain a communication key including a complete signature, and the communication key including the complete signature is used to encrypt data input into the trusted operating environment by the user device.

[0016] In this way, during the external communication process of the trusted execution environment, the communication key that protects the communication data is obtained by signing multiple objects together, which can improve the security of data communication.

[0017] According to the fourth possible implementation manner of the first aspect, in a fifth possible implementation manner of the security verification method, the data processing unit signs the communication key of the trusted execution environment according to the private key of each object to obtain the communication key including the complete signature, including: the data processing unit signs the communication key of the trusted execution environment according to the private key of each object to obtain the communication key including the signature fragment corresponding to each object; the data processing unit synthesizes the communication key including the complete signature according to the communication key including the signature fragment corresponding to each object.

[0018] In this way, the way of generating the communication key including the complete signature is made more flexible.

[0019] According to any one of the second to fifth possible implementations of the first aspect, in a sixth possible implementation of the security verification method, the object includes a chip, the operating environment information of the chip includes chip parameters and at least one of a code summary of a user-trusted application running on the chip, and each of the objects determines its own operating environment information and obtains the operating environment information of the other objects, including: for each chip, obtaining its own operating environment information based on its own chip parameters and at least one of the code summaries of the user-trusted application running on it; issuing an information acquisition request to other objects other than itself, the information acquisition request being used to obtain the operating environment information of the other objects; and upon receiving an information acquisition request from other objects other than itself, outputting its own operating environment information to the other objects.

[0020] In this way, it is possible to support chip self-measurement and interaction measurement with other objects, thereby improving the diversity of the trusted execution environment.

[0021] According to any one of the second to sixth possible implementations of the first aspect, in the seventh possible implementation of the security verification method, the object includes a cloud platform, the operating environment information of the cloud platform includes at least one of software configuration information, virtual machine configuration information, and server configuration information, and each object determines its own operating environment information and obtains the operating environment information of the other objects, including: for each cloud platform, obtaining its own operating environment information based on at least one of its own software configuration information, virtual machine configuration information, and server configuration information; for each of the other objects, when the object is deployed on the cloud platform, determining the operating environment information of the object based on the deployment information of the object; when the object is not deployed on the cloud platform, issuing an information acquisition request to the object, the information acquisition request being used to obtain the operating environment information of the object; upon receiving an information acquisition request from an object other than itself, outputting its own operating environment information to the other objects.

[0022] In this way, it is possible to support the cloud platform's own measurement and the interaction measurement with other objects, which can further improve the diversity of the trusted execution environment.

[0023] According to the first aspect, or any possible implementation of the first aspect above, in an eighth possible implementation of the security verification method, verifying the security of the trusted execution environment includes: determining whether the public key of the trusted execution environment corresponds to the complete signature, and when the public key of the trusted execution environment corresponds to the complete signature, determining that the trusted execution environment is secure.

[0024] In this way, the security of the trusted execution environment can be verified in a relatively simple manner, thereby saving data processing costs and reducing the complexity of verification implementation.

[0025] According to the first aspect, or any one of the second to seventh possible implementations of the first aspect, in a ninth possible implementation of the security verification method, verifying the security of the trusted execution environment includes: determining whether a synthesis result of the public key of each object is consistent with the public key of the trusted execution environment, and when the synthesis result of the public key of each object is consistent with the public key of the trusted execution environment, determining that the public key of the trusted execution environment is correct; determining whether the public key of the trusted execution environment corresponds to the complete signature, and when the public key of the trusted execution environment is correct and the public key of the trusted execution environment corresponds to the complete signature, determining that the trusted execution environment is secure.

[0026] By also verifying the correctness of the public key of the trusted execution environment, the reliability of the verification result of the security of the trusted execution environment can be improved, and the verification method can be made more flexible.

[0027] According to the first aspect, or any possible implementation manner from the second to the seventh possible implementation manners of the first aspect, in the tenth possible implementation manner of the security verification method, verifying the security of the trusted execution environment includes: judging the correctness of the public key certificate of each object, and when the public key certificate of each object is correct, determining that the synthesis result of the public key of each object is correct; judging whether the synthesis result of the public key of each object is consistent with the public key of the trusted execution environment, and when the synthesis result of the public key of each object is correct and the synthesis result of the public key of each object is consistent with the public key of the trusted execution environment, determining that the public key of the trusted execution environment is correct; judging whether the public key of the trusted execution environment corresponds to the complete signature, and when the public key of the trusted execution environment is correct and the public key of the trusted execution environment corresponds to the complete signature, determining that the trusted execution environment is secure.

[0028] By verifying the correctness of the synthesis result of the public key of each object and the correctness of the public key of the trusted execution environment, the reliability of the verification result of the security of the trusted execution environment is further improved, and the verification method is made more flexible.

[0029] According to any one of the first to tenth possible implementations of the first aspect, in the eleventh possible implementation of the security verification method, each object generates its own public key and private key, and outputs the private key to the data processing unit, including: generating its own public key and private key for each object; outputting its own public key certificate to other objects other than itself in the trusted execution environment; receiving the public key certificates of the other objects; judging the correctness of the public key certificates of the other objects, and when the public key certificates of each of the other objects are correct, outputting the private key to the data processing unit.

[0030] By verifying the public key certificates of other objects before outputting the private key, it is possible to ensure that other objects have a certain degree of credibility.

[0031] In a second aspect, an embodiment of the present application provides a data processing system, which includes a data processing unit and a trusted execution environment, wherein the trusted execution environment includes two or more objects for use by a user device, and the data processing unit is used to receive a security verification request for the trusted execution environment initiated by the user device; in response to the security verification request, send operating environment information including a complete signature and the public key of the trusted execution environment to the user device, the operating environment information including the complete signature is signed by signing the operating environment information of the trusted execution environment according to the private key of each object in the trusted execution environment, and the public key of the trusted execution environment is obtained according to the private key of each object; the operating environment information including the complete signature and the public key of the trusted execution environment are used to verify the security of the trusted execution environment.

[0032] According to the second aspect, in a first possible implementation of the data processing system, each object is used to generate its own public key and private key, and output the private key to the data processing unit; the data processing unit is also used to determine, based on the received private key of each object, a public key corresponding to a synthesis result of the private key of each object; and use the determined public key as the public key of the trusted execution environment.

[0033] According to the second aspect, or the first possible implementation of the second aspect, in the second possible implementation of the data processing system, each object is also used to determine its own operating environment information and obtain the operating environment information of the other objects; determine the operating environment information of the trusted execution environment based on its own operating environment information and the operating environment information of the other objects; the data processing unit is also used to sign the operating environment information of the trusted execution environment according to the private key of each object to obtain the operating environment information including the complete signature.

[0034] According to the second possible implementation manner of the second aspect, in a third possible implementation manner of the data processing system, the data processing unit signs the operating environment information of the trusted execution environment according to the private key of each object to obtain the operating environment information including the complete signature, including: the data processing unit signs the operating environment information of the trusted execution environment according to the private key of each object to obtain the operating environment information including the signature fragment corresponding to each object; the data processing unit synthesizes the operating environment information including the complete signature based on the operating environment information including the signature fragment corresponding to each object.

[0035] According to the second aspect, or any possible implementation of the second aspect above, in a fourth possible implementation of the data processing system, when determining that the trusted execution environment is secure, the data processing unit is further used to sign the communication key of the trusted execution environment according to the private key of each object to obtain a communication key including a complete signature, and the communication key including the complete signature is used to encrypt data input into the trusted operating environment by a user device.

[0036] According to a fourth possible implementation manner of the second aspect, in a fifth possible implementation manner of the data processing system, the data processing unit signs the communication key of the trusted execution environment according to the private key of each object to obtain the communication key including the complete signature, including: the data processing unit signs the communication key of the trusted execution environment according to the private key of each object to obtain the communication key including the signature fragment corresponding to each object; the data processing unit synthesizes the communication key including the complete signature according to the communication key including the signature fragment corresponding to each object.

[0037] According to any one of the second to fifth possible implementations of the second aspect, in a sixth possible implementation of the data processing system, the object includes a chip, and the operating environment information of the chip includes at least one of chip parameters and a code summary of a user-trusted application running on the chip. Each of the objects determines its own operating environment information and obtains the operating environment information of the other objects, including: for each chip, obtaining its own operating environment information based on its own chip parameters and at least one of the code summaries of the user-trusted application running on it; issuing an information acquisition request to other objects other than itself, wherein the information acquisition request is used to obtain the operating environment information of the other objects; and upon receiving an information acquisition request from other objects other than itself, outputting its own operating environment information to the other objects.

[0038] According to any one of the second to sixth possible implementations of the second aspect, in a seventh possible implementation of the data processing system, the object includes a cloud platform, and the operating environment information of the cloud platform includes at least one of software configuration information, virtual machine configuration information, and server configuration information. Each of the objects determines its own operating environment information and obtains the operating environment information of the other objects, including: for each cloud platform, obtaining its own operating environment information based on at least one of its own software configuration information, virtual machine configuration information, and server configuration information; for each of the other objects, when the object is deployed on the cloud platform, determining the operating environment information of the object based on the deployment information of the object; when the object is not deployed on the cloud platform, issuing an information acquisition request to the object, wherein the information acquisition request is used to obtain the operating environment information of the object; and upon receiving an information acquisition request from an object other than itself, outputting its own operating environment information to the other objects.

[0039] According to the second aspect, or any possible implementation of the second aspect above, in an eighth possible implementation of the data processing system, the user device is used to determine whether the public key of the trusted execution environment corresponds to the complete signature, and when the public key of the trusted execution environment corresponds to the complete signature, determine that the trusted execution environment is secure.

[0040] According to the second aspect, or any one of the second to seventh possible implementations of the second aspect, in a ninth possible implementation of the data processing system, the user device is used to determine whether a synthesis result of the public key of each object is consistent with the public key of the trusted execution environment, and when the synthesis result of the public key of each object is consistent with the public key of the trusted execution environment, determine that the public key of the trusted execution environment is correct; and determine whether the public key of the trusted execution environment corresponds to the complete signature, and when the public key of the trusted execution environment is correct and the public key of the trusted execution environment corresponds to the complete signature, determine that the trusted execution environment is secure.

[0041] According to the second aspect, or any one of the second to seventh possible implementations of the second aspect, in the tenth possible implementation of the data processing system, the user device is used to determine the correctness of the public key certificate of each object, and when the public key certificate of each object is correct, determine that the synthesis result of the public key of each object is correct; determine whether the synthesis result of the public key of each object is consistent with the public key of the trusted execution environment, and when the synthesis result of the public key of each object is correct and the synthesis result of the public key of each object is consistent with the public key of the trusted execution environment, determine that the public key of the trusted execution environment is correct; determine whether the public key of the trusted execution environment corresponds to the complete signature, and when the public key of the trusted execution environment is correct and the public key of the trusted execution environment corresponds to the complete signature, determine that the trusted execution environment is secure.

[0042] According to any one of the first to tenth possible implementations of the second aspect, in the eleventh possible implementation of the data processing system, each object generates its own public key and private key, and outputs the private key to the data processing unit, including: generating its own public key and private key for each object; outputting its own public key certificate to other objects other than itself in the trusted execution environment; receiving the public key certificates of the other objects; judging the correctness of the public key certificates of the other objects, and when the public key certificates of each of the other objects are correct, outputting the private key to the data processing unit.

[0043] In a third aspect, an embodiment of the present application provides a data processing system comprising: a processor; a memory for storing processor-executable instructions; a data processing unit configured to implement the above-mentioned first aspect or one or more of the multiple possible implementation methods of the first aspect when executing the instructions.

[0044] In a fourth aspect, an embodiment of the present application provides a non-volatile computer-readable storage medium on which computer program instructions are stored, and when the computer program instructions are executed by a processor, a data processing unit that implements the above-mentioned first aspect or one or more of the multiple possible implementation methods of the first aspect.

[0045] In a fifth aspect, an embodiment of the present application provides a computer program product comprising a computer-readable code, or a non-volatile computer-readable storage medium carrying a computer-readable code. When the computer-readable code runs in an electronic device, the processor in the electronic device executes the data processing unit of the above-mentioned first aspect or one or more of the multiple possible implementations of the first aspect.

[0046] These and other aspects of the present application will become more readily apparent from the following description of the embodiment(s). BRIEF DESCRIPTION OF THE DRAWINGS

[0047] The accompanying drawings, which are incorporated in and constitute a part of the specification, illustrate exemplary embodiments, features, and aspects of the application and, together with the description, serve to explain the principles of the application.

[0048] Figure 1 A schematic diagram showing the flow of a remote attestation method in the prior art;

[0049] Figure 2 An example of a data encryption method of prior art 1 is shown;

[0050] Figure 3a An example of a remote attestation method for a trusted execution environment with a chip as the core controller according to an embodiment of the present application is shown;

[0051] Figure 3b An example of a remote attestation method for a trusted execution environment with a cloud platform as the core controller according to an embodiment of the present application is shown;

[0052] Figure 4 An exemplary application scenario of a data processing system according to an embodiment of the present application is shown;

[0053] Figure 5 A schematic diagram illustrating a method for generating a root key of a trusted execution environment according to an embodiment of the present application is shown;

[0054] Figure 6 A schematic diagram illustrating a security verification method according to an embodiment of the present application is shown;

[0055] Figure 7 A schematic diagram illustrating a method for generating operating environment information including a complete signature according to an embodiment of the present application;

[0056] Figure 8 A schematic diagram illustrating an exemplary method for encrypting user data according to an embodiment of the present application;

[0057] Figure 9 An exemplary structural diagram of a data processing system according to an embodiment of the present application is shown. DETAILED DESCRIPTION

[0058] Various exemplary embodiments, features, and aspects of the present application will be described in detail below with reference to the accompanying drawings. The same reference numerals in the accompanying drawings represent elements with the same or similar functions. Although various aspects of the embodiments are shown in the accompanying drawings, the drawings are not necessarily drawn to scale unless otherwise indicated.

[0059] The word “exemplary” is used exclusively herein to mean “serving as an example, example, or illustration.” Any embodiment described herein as “exemplary” is not necessarily to be construed as preferred or advantageous over other embodiments.

[0060] In addition, numerous specific details are provided in the detailed description below to better illustrate the present application. Those skilled in the art will appreciate that the present application can be practiced without certain specific details. In some instances, methods, means, components, and circuits well known to those skilled in the art are not described in detail in order to highlight the main purpose of the present application.

[0061] The following explains the terms that may appear in the embodiments of this application.

[0062] Heterogeneous computing chip (HCC): In computing tasks that require a lot of computing power (such as those involving complex neural network models), the computing power of a single central processing unit (CPU) is often overwhelmed, and the support of various other processors such as embedded neural-network processing unit (NPU) and graphics processing unit (GPU) is needed to share the computing operations. These chips (processors) that jointly provide computing operations are collectively referred to as heterogeneous computing chips.

[0063] Trusted Execution Environment (TEE): A secure area within the processor. It runs in an isolated environment, parallel to the operating system. The processor ensures the confidentiality and integrity of code and data within the TEE. By using both hardware and software to protect data and code, the TEE is more secure than the operating system. Trusted applications running in the TEE have access to the full functionality of the processor and memory, while hardware isolation protects these components from other user applications running in the main operating system.

[0064] Remote attestation (RA) refers to a mechanism that allows users to verify the security of a trusted execution environment (TEE). When the attestation is successful, it can be assumed that the trusted execution environment (TEE) and the trusted applications running in it are user-selected and have not been tampered with, thereby providing integrity protection for secure computing and trusted computing.

[0065] Secure multi-party computation (SMPC) protocol: A subfield of cryptography that allows multiple entities to input data and perform collaborative computations without mutual trust, outputting computational results while ensuring that no party can learn the content of the data input by other entities other than the computational results.

[0066] The core technology of secure and trusted computing is data isolation, which protects user data from being accessed by other entities (including administrators and other superusers). Data isolation can be achieved using a Trusted Execution Environment (TEE). The following describes several existing methods for building a Trusted Execution Environment (TEE).

[0067] Prior art proposes carving out a protected trusted area within the application's address space (in the processor and memory), creating a container called an enclave. Different containers (trusted areas) can correspond to different applications. Containers can be used to isolate different applications (such as trusted applications (TAs)) and prevent them from accessing each other's data. Even applications with higher privileges cannot access data across these areas, thus protecting the code and data within the container from malware. A Trusted Execution Environment (TEE) can refer to the area that includes each container.

[0068] In order to verify the security of the trusted execution environment (TEE), a remote attestation method is also proposed in the prior art. Figure 1 A schematic diagram showing the flow of a remote attestation method in the prior art.

[0069] like Figure 1 As shown, assuming that the controller of the trusted execution environment TEE is chip A, the root key of the trusted execution environment TEE can be the public key and private key of chip A. The user first submits a remote attestation request to the trusted execution environment TEE. After receiving the remote attestation request, the trusted execution environment TEE measures its own operating environment, obtains a measurement result including the hardware environment parameters of the trusted execution environment TEE and the software program code summary, and uses the private key in the root key of the trusted execution environment TEE to sign the measurement result. The signed measurement result is then fed back to the user. The user can verify the signed measurement result to determine whether the hardware environment parameters of the trusted execution environment TEE and the software program code summary meet the requirements. If the requirements are met, for example, the public key of chip A can be obtained from the certification authority (CA) of the chip manufacturer of chip A, and the obtained public key can be used to verify whether the signature on the measurement result is the signature of the private key corresponding to the public key. If the verification passes, the trusted execution environment TEE can be considered secure.

[0070] After confirming that the trusted execution environment TEE is secure, users can use the trusted execution environment TEE to store and calculate data. In order to ensure data security, the prior art also proposes a data encryption method. Figure 2 An example of a data encryption method according to prior art 1 is shown.

[0071] like Figure 2 As shown, the TEE's communication key is sent to the user, serving as the encryption key for data communicated between the user and the TEE. The user uses the communication key to encrypt data, generating encrypted data x, which is then input into the TEE. After receiving the encrypted data x, the TEE decrypts it using the communication key and then uses the trusted application to compute the data.

[0072] For this prior art, the entire trusted execution environment (TEE) is controlled by a single computing chip, and the built-in private key of the computing chip serves as the trusted root key. That is, this solution is only applicable to scenarios with a single computing chip and no other controllers. If the trusted execution environment (TEE) is composed of multiple computing chips, or the cloud platform that deploys the computing chip also participates in the control, there will be a contradiction in the ownership of the trusted execution environment (TEE). At the same time, since the communication key is generated by a single computing chip, users have no choice but to trust the computing chip. Once a problem occurs with the computing chip, the security of the trusted execution environment cannot be guaranteed, resulting in a low reliability of the trusted execution environment.

[0073] Prior art 2 proposes to divide the hardware and software resources of the system on chip into two parts: a secure world (secure world) and a non-secure world (normal world). The secure world is equivalent to the trusted execution environment TEE mentioned above. All operations that require confidentiality are performed in the secure world (such as fingerprint recognition, password processing, data encryption and decryption, security authentication, etc.), and the remaining operations are performed in the non-secure world (such as user operating system, various applications, etc.). The system on chip has three states, a secure world, a non-secure world, and a supervisory mode for switching between the two; all operations similar to switching between privileged and non-privileged processes are performed through the supervisory mode. The remote attestation method and data encryption method of prior art 2 can be the same as those of prior art 1.

[0074] Regarding this second prior art, the entire trusted execution environment (TEE) is also controlled by a single chip, and the chip's built-in private key serves as the trusted root key. This is still only applicable to scenarios with a single computing chip and no other controllers. If the trusted execution environment (TEE) is composed of multiple computing chips, or the cloud platform that deploys the computing chip also participates in the control, there will be a conflict in the ownership of the trusted execution environment (TEE). At the same time, users have no choice but to trust the computing chip. Once a problem occurs with the computing chip, the security of the trusted execution environment cannot be guaranteed, resulting in a low reliability of the trusted execution environment.

[0075] With the continuous development of secure computing and trusted computing, their application areas are also expanding, requiring higher computing power and more complex algorithms. In these scenarios, the solutions of existing technologies one and two may find it difficult to provide a trusted execution environment (TEE) that meets user needs. In response to this, existing technology three proposes a method of jointly building a trusted execution environment by making the cloud platform the controller of the trusted execution environment and the multiple processors (chips) deployed on the cloud platform the providers of computing power and algorithms respectively. In existing technology three, the cloud platform is responsible for first generating the complete public key and complete private key of the trusted execution environment as the trusted root key. While the cloud platform publishes the complete public key, it also splits the complete private key into multiple private key shards and distributes them to all providers of computing power and algorithms.

[0076] Because the cloud platform is responsible for generating and managing the trusted root key, rather than relying solely on the chip, the impact of individual chip issues on the security of the trusted execution environment is significantly reduced. However, despite participating in root key management, the cloud platform does not provide comprehensive measurement of the entire trusted execution environment and independently control remote attestation. The problem of multiple chips operating independently and lacking coordination remains. Furthermore, this solution still implements a single-party controlled trusted execution environment (TEE), replacing the chip with the cloud platform, forcing users to trust the cloud platform. If the cloud platform fails, the security of the trusted execution environment cannot be guaranteed, resulting in low reliability.

[0077] Based on this, an embodiment of the present application proposes a trusted execution environment TEE with the chip (or cloud platform) as the core controller, so that the chip (or cloud platform) is responsible for both the generation and management of trusted root keys and for measuring the security of itself and other computing power providers.

[0078] Figure 3a An example of a remote certification method of a trusted execution environment with a chip as the core controller according to an embodiment of the present application is shown.

[0079] See also Figure 3a, the trusted execution environment TEE may include multiple objects such as central processing unit chips, auxiliary computing chips, model / algorithm providers, and cloud platforms. The central processing unit chip is used as the core controller, and other objects are used as service providers. The core controller can complete the measurement of its own operating environment and the operating environment of each service provider, and use its own private key as the trusted root key to sign a remote attestation certificate. Users can obtain the public key certificate of the core controller at the verification center of the manufacturer of the core controller and verify the correctness of the remote attestation certificate, thereby determining the security of the trusted execution environment. The measurement of its own operating environment and the measurement of the operating environment of each service provider can be found below and Figure 6 、 Figure 7 .

[0080] Figure 3b An example of a remote attestation method of a trusted execution environment with a cloud platform as the core controller according to an embodiment of the present application is shown.

[0081] See also Figure 3b , the trusted execution environment TEE may include multiple objects such as central processing unit chips, auxiliary computing chips, model / algorithm providers and cloud platforms. The cloud platform is the core controller and other objects are service providers. The core controller can complete the measurement of its own operating environment and the operating environment of each service provider, and use its own private key as the trusted root key to sign a remote attestation certificate. Users can obtain the public key certificate of the core controller at the verification center of the manufacturer of the core controller and verify the correctness of the remote attestation certificate, thereby determining the security of the trusted execution environment. The measurement of its own operating environment and the measurement of the operating environment of each service provider can be found below and Figure 6 、 Figure 7 .

[0082] When forming a remote attestation certificate through the above two methods of the embodiments of the present application, the trusted root key of the core controller used is the private key of a single chip or a single cloud platform, that is, the core controller measures its own operating environment and the operating environment of other service providers. Furthermore, considering that the core controller itself is the party that wants to destroy the trusted execution environment and forge the security of its own operating environment and / or the security of the operating environment of other objects, the embodiments of the present application can further use the root key generated by the private keys of multiple objects to verify the security of the trusted execution environment in the data processing system, including multiple objects, while allowing users to not fully trust any one of the multiple objects, thereby improving the reliability of the trusted execution environment.

[0083] Figure 4 An exemplary application scenario of the data processing system according to an embodiment of the present application is shown.

[0084] like Figure 4 As shown, the data processing system of an embodiment of the present application may include a data processing unit and a trusted execution environment TEE. The trusted execution environment TEE may include two or more objects for use by user devices, where the objects may be the central processing unit chip, cloud platform, auxiliary computing chip, model / algorithm provider, etc. mentioned above.

[0085] Each object can be set on an independent terminal device or server, or can be set together on the same terminal device or server, and this application does not limit this. The data processing unit can be set on the same terminal device as one or more objects, or can be set separately on a terminal device or server. For example, the terminal device of this application can be a smart phone, a netbook, a tablet computer, a laptop computer, a wearable electronic device (such as a smart bracelet, a smart watch, etc.), a TV, a virtual reality device, a speaker, an electronic ink, and the like.

[0086] Each hardware chip can run the trusted applications described above, and the code of the trusted applications may include models and / or algorithms. The cloud platform can deploy the hardware chips and the models / algorithms provided by the model / algorithm providers, and can package and provide a trusted execution environment to user devices.

[0087] In this application scenario, the data processing system executes the security verification method of the embodiment of the present application, so that each object can participate in the management and control of the trusted execution environment by providing its own private key, for example, participating in the generation of the root key of the trusted execution environment (for example, see below and Figure 5 ), participate in remote attestation of the security of the user device to the trusted execution environment (examples of which can be found below and Figure 6 、 Figure 7 ), participate in data transmission from user devices to the trusted execution environment (for examples, see below and Figure 8 ) and so on.

[0088] Among them, when each object participates in the remote attestation of the security of the trusted execution environment by the user device, in addition to measuring and determining the operating environment information by themselves, multiple objects can also measure and determine each other's operating environment information. The final overall operating environment information of the trusted execution environment is also signed using the private keys of multiple objects, representing everyone's unanimous agreement. When the user device remotely attests to the security of the trusted execution environment, and when the user device transmits data to the trusted execution environment, the user does not have to verify with each object one by one, but instead verifies the operating environment information jointly signed by multiple objects (that is, the operating environment information including the complete signature described below, which is equivalent to the remote attestation certificate described above), which greatly improves the user experience. When the user device transmits data to the trusted execution environment, the communication key used to encrypt the user's data can also be the communication key jointly signed by multiple objects (that is, the communication key including the complete signature described below), which improves the security of the communication.

[0089] The following first introduces an exemplary method for the data processing system of an embodiment of the present application to generate a root key of a trusted execution environment. Figure 5 A schematic diagram illustrating a method for generating a root key of a trusted execution environment according to an embodiment of the present application is shown.

[0090] like Figure 5 As shown, in a possible implementation, the method includes steps S51-S53:

[0091] In step S51 , each object generates its own public key and private key, and outputs the private key to the data processing unit.

[0092] In step S52 , the data processing unit determines a public key corresponding to a synthesis result of the private keys of each object based on the received private keys of each object.

[0093] Step S53: Use the determined public key as the public key of the trusted execution environment TEE.

[0094] In this way, it can be ensured that the public key of the trusted execution environment corresponds to the synthesis result of the private keys of multiple objects, so that when the public key of the trusted execution environment is used as the root key, the accuracy of the root key can be guaranteed.

[0095] For example, each object, acting as a computing service provider, can generate its own public and private keys based on existing technologies, where the public and private keys correspond to each other. After the private key is output to the data processing unit, it can be used to obtain the root key corresponding to the trusted execution environment, the runtime environment information including the signature slice of the object, and the communication key including the signature slice of the object.

[0096] Optionally, before outputting the private key to the data processing unit, each object may verify the trustworthiness of other objects in the trusted execution environment, except for itself. For example, in one possible implementation, step S51 includes:

[0097] For each object, generate its own public key and private key;

[0098] Outputting its own public key certificate to the trusted execution environment and other objects except itself;

[0099] receiving a public key certificate of the other object;

[0100] The correctness of the public key certificates of the other objects is judged, and when the public key certificates of each of the other objects are correct, the private key is output to the data processing unit.

[0101] By verifying the public key certificates of other objects before outputting the private key, it is possible to ensure that other objects have a certain degree of credibility.

[0102] For example, when each object generates its own public key and private key, the verification center of the manufacturer (such as a chip manufacturer) or operator (such as a cloud platform operator) corresponding to the object will issue a public key certificate for the object to prove that a certain public key does belong to a certain chip or cloud platform. For each object, after generating its own public key and private key, the public key certificate issued by the verification center can be output to other objects in the trusted execution environment except itself. At the same time, it also receives public key certificates from other objects in the trusted execution environment except itself.

[0103] In this case, for each object, the correctness of all received public key certificates can be determined. For example, a query request including relevant information of the public key certificate (such as the certificate code, etc.) can be sent to the verification center corresponding to the issuance of each public key certificate. After receiving the query request, the verification center can check whether the certificate is indeed issued by the verification center and feedback the query result to the object that issued the query request. For example, when it is checked that the certificate is indeed issued by itself, a query result indicating that the certificate is correct can be issued; otherwise, a query result indicating that the certificate is incorrect can be issued. This allows each object to determine the correctness of the public key certificates of other objects based on the received query results. When it is determined that the public key certificates of other objects are all correct, it can be considered that the other objects have a certain degree of credibility, and then the private key of the object itself can be output to the data processing unit.

[0104] Each object may not receive public key certificates for all objects except itself. In this case, when verifying the validity of other objects' public key certificates, it only needs to verify the validity of its own received public key certificate. Even if an object has not received any public key certificates, it can directly output its own private key to the data processing unit without further verifying the trustworthiness of other objects.

[0105] The data processing unit can support the secure multi-party computing protocol of the existing technology. In step S52, when the data processing unit determines the public key corresponding to the synthesis result of the private key of each object based on the received private key of each object, the secure multi-party computing protocol can be used to determine it.

[0106] The following describes an exemplary implementation of the present application of using a secure multi-party computing protocol to obtain a public key corresponding to the synthesis result of the private key of each object.

[0107] For example, a secure multi-party computation protocol can be implemented by a data processing unit. Each object inputs its own private key into the data processing unit as a secret input, preventing other objects from knowing the specific content of the private key input by the object. Without leaking the input, the data processing unit can execute the secure multi-party computation protocol to calculate a public key. This public key can be a public key corresponding to the result of combining the private keys of each object. The result of combining the private keys of each object is not used as a key.

[0108] Optionally, after calculating the public key corresponding to the synthesis result of each object's private key (hereinafter referred to as the calculated public key), each object can also provide its own public key to other objects for other objects to verify the correctness of the calculated public key.

[0109] For example, verification may include two aspects: first, whether the private key of each object has been input into the data processing unit for calculation, and second, whether the synthesis result of the public key of each object is consistent with the calculated public key. If the conditions of both the private key of each object being input into the data processing unit for calculation and the synthesis result of the public key of each object being consistent with the calculated public key are met, the calculated public key is determined to be correct.

[0110] It should be understood by those skilled in the art that Figure 5The calculation method of the public key corresponding to the synthesis result of the private key of each object shown is only an example. In actual applications, there may be more or fewer objects in the trusted execution environment. For example, in the least case, the object may have only one central processing unit chip and one auxiliary computing chip, that is, only the central processing unit chip and the auxiliary computing chip participate in the calculation of the public key. For another example, in the most common case, the objects in the trusted execution environment may have multiple central processing unit chips, multiple auxiliary computing chips, multiple cloud platforms and multiple model / algorithm providers, and may even include software providers such as operating systems. These objects can participate in the calculation of the public key. This application does not limit the number and type of specific objects involved in the calculation of the public key.

[0111] In step S53, the data processing unit can optionally directly use the calculated public key as the public key of the trusted execution environment, or it can first verify the correctness of the calculated public key using the verification method described above. Once the calculated public key is verified to be correct, it is used as the public key of the trusted execution environment. In this case, the calculated public key is used as the root key of the trusted execution environment, thereby ensuring the reliability of the trusted execution environment.

[0112] The embodiment of the present application adopts Figure 5 The method shown herein calculates a public key, thereby making it possible to implement an unlimited number of private keys that can be supported as input in a secure multi-party computation protocol. This allows a trusted execution environment to support an unlimited number of objects and also allows for unrestricted types and methods of secure multi-party computation protocols. This can increase the flexibility of how public keys are determined in a trusted execution environment.

[0113] The following describes an exemplary method for performing security verification according to an embodiment of the present application. Figure 6 A schematic diagram showing a security verification method according to an embodiment of the present application is shown.

[0114] Before using the trusted execution environment, if the user needs to confirm the security of the trusted execution environment, he can submit a security verification request to the data processing unit. Figure 6 As shown, in a possible implementation, the method includes steps S61-S62:

[0115] Step S61: The data processing unit receives a security verification request for a trusted execution environment initiated by a user device;

[0116] Step S62: In response to the security verification request, the data processing unit sends the operating environment information including the complete signature and the public key of the trusted execution environment to the user device. The operating environment information including the complete signature is signed by using the private key of each object in the trusted execution environment. The public key of the trusted execution environment is obtained based on the private key of each object.

[0117] The runtime environment information including the complete signature and the public key of the trusted execution environment are used to verify the security of the trusted execution environment.

[0118] For example, when the data processing unit receives a security verification request (equivalent to the remote attestation request described above), it can be considered that the user needs to verify the security of the trusted execution environment provided to the user. Therefore, in response to the security verification request, the data processing unit can send the user device the operating environment information including the complete signature (equivalent to the remote attestation certificate described above) and the public key of the trusted execution environment. The public key of the trusted execution environment has been generated when the trusted execution environment is constructed. The exemplary method of obtaining it can be found in the above and Figure 5 The operating environment information including the complete signature can be generated and sent by the data processing unit after receiving the security verification request, or it can be generated after the trusted execution environment is built and sent when the security verification request is received. This application does not limit this. An exemplary method for generating the operating environment information including the complete signature can be found below. Figure 7 The user device can use the operating environment information including the complete signature and the public key of the trusted execution environment to verify the security of the trusted execution environment.

[0119] According to the security verification method of the embodiment of the present application, a security verification request for a trusted execution environment initiated by a user device is received through a data processing unit, and in response to the security verification request, the operating environment information including a complete signature and the public key of the trusted execution environment are sent to the user device, so that the user device can obtain information used to verify the security of the trusted execution environment; on the one hand, the public key of the trusted execution environment is obtained based on the private key of each object, which is equivalent to multiple objects in the trusted execution environment jointly generating, controlling and using the root key of the trusted execution environment, so that the user does not have to fully trust any of the multiple objects, so the probability of the confidentiality of the data being affected when the user uses the trusted execution environment due to the maliciousness of a certain object is greatly reduced; on the other hand, the operating environment information including the complete signature is obtained by signing the operating environment information of the trusted execution environment according to the private key of each object in the trusted execution environment, which is equivalent to jointly verifying the operating environment information of the trusted execution environment through multiple objects, so that the security credibility of the verified trusted execution environment is increased; in summary, the security verification method of the embodiment of the present application can improve the reliability of the trusted execution environment.

[0120] In this scenario, users no longer completely trust any of the entities within the TEE, including the chip, cloud platform, and model / algorithm providers. Instead, they can trust that none of these entities will attempt to disrupt the TEE, tamper with service program code, or steal user data. Under this trust mechanism, as long as at least one party is honest and trustworthy, the TEE can be considered trustworthy. When executing user-specified program code on user-specified hardware, data privacy and security are guaranteed.

[0121] The following first introduces an exemplary method for generating operating environment information including a complete signature. Figure 7 A schematic diagram showing a method for generating operating environment information including a complete signature according to an embodiment of the present application is shown.

[0122] like Figure 7 As shown, in a possible implementation, the method further includes:

[0123] Each of the objects determines its own operating environment information and obtains the operating environment information of the other objects;

[0124] Each object determines the operating environment information of the trusted execution environment based on the operating environment information of the object and the operating environment information of the other objects;

[0125] The data processing unit signs the operating environment information of the trusted execution environment according to the private key of each object to obtain the operating environment information including the complete signature.

[0126] By having multiple objects interact and authenticate each other's environments, signatures are generated when each other's environments are recognized, which can further improve the verification accuracy of the security of the trusted execution environment using the operating environment information including the complete signature.

[0127] For example, if Figure 7 As shown, each object can determine its own operating environment information (i.e., self-measurement) by measuring its own operating environment, and obtain the operating environment information of other objects (i.e., interaction measurement) through the interactive measurement of the operating environments between objects. The methods for determining its own operating environment information and obtaining the operating environment information of other objects may vary for different objects. The following text provides examples of determining its own operating environment information and obtaining the operating environment information of other objects, using chips and cloud platforms as examples.

[0128] Each object can determine the operating environment information of the trusted execution environment based on its own operating environment information and the operating environment information of other objects, so that the operating environment information of the trusted execution environment includes the operating environment information of each object. Each object can input the operating environment information of the trusted execution environment determined by itself into the data processing unit.

[0129] Ideally, if each object is truly trustworthy and there are no errors in each object's measurement of its own operating environment and the measurement of the operating environment interactions between objects, then the operating environment information of the trusted execution environment determined by each object can be the same. In this case, the data processing unit can sign the operating environment information of the trusted execution environment determined by any object based on the private key of each object (which has been input into the data processing unit in step S51), thereby obtaining operating environment information including a complete signature. In this regard, the present application proposes two exemplary implementation methods.

[0130] In one possible implementation, the data processing unit signs the operating environment information of the trusted execution environment according to the private key of each object to obtain the operating environment information including the complete signature. The operating environment information of the trusted execution environment input by any object can be used as the signature object to be signed, and the signature object is signed according to the private key of each object previously input into the data processing unit, and the operating environment information including the signature of each object (i.e., the operating environment information including the complete signature) is directly obtained and output.

[0131] In another possible implementation, the data processing unit signs the operating environment information of the trusted execution environment according to the private key of each object to obtain the operating environment information including the complete signature, including:

[0132] The data processing unit signs the operating environment information of the trusted execution environment according to the private key of each object to obtain the operating environment information corresponding to each object including the signature fragment;

[0133] The data processing unit synthesizes the operating environment information including the complete signature according to the operating environment information including the signature fragment corresponding to each object.

[0134] In this way, the method of generating the operating environment information including the complete signature is made more flexible.

[0135] For example, the data processing unit signs the operating environment information of the trusted execution environment according to the private key of each object to obtain the operating environment information including the complete signature. It can also be that the operating environment information of the trusted execution environment input by any object is used as the signature object to be signed, and the signature object is signed separately according to the private key of each object previously input into the data processing unit (input when determining the public key of the trusted execution environment). First, the operating environment information including the signature fragment corresponding to each object is obtained, and then the operating environment information including the signature fragment corresponding to each object is synthesized to obtain the operating environment information including the complete signature and output it.

[0136] Those skilled in the art will appreciate that, although only two exemplary implementations of obtaining fully signed runtime environment information are provided in the embodiments of this application, in actual applications, there are more than one way to obtain fully signed runtime environment information. Any exemplary implementation of obtaining fully signed runtime environment information that is achievable based on existing technology may be used in the embodiments of this application, and this embodiment of the application does not impose any limitation thereto.

[0137] The following describes an example of how an object determines its own operating environment information and obtains the operating environment information of other objects when the objects are chips and cloud platforms.

[0138] In one possible implementation, the object includes a chip, and the operating environment information of the chip includes at least one of chip parameters and a code summary of a user trusted application running on the chip. Each of the objects determines its own operating environment information and obtains the operating environment information of the other objects, including:

[0139] For each chip, obtain its own operating environment information based on at least one of its own chip parameters and a code summary of a user trusted application running on the chip;

[0140] Sending an information acquisition request to other objects except itself, wherein the information acquisition request is used to obtain the operating environment information of the other objects;

[0141] When receiving an information acquisition request from an object other than itself, the operating environment information of the object is output to the other object.

[0142] For example, see Figure 7The objects included in the trusted execution environment may include various types of chips, such as the central processing unit chip, auxiliary computing chip and other hardware chips mentioned above. For each hardware chip, certain chip parameters are pre-designed, such as the chip's main frequency, bus frequency, etc., which can characterize the hardware environment of the chip; the code of the user trusted application runs on it, and the code summary can characterize the software environment of the chip. In this case, for each chip, the measurement of its own (software and / or hardware) operating environment is completed, which can be based on at least one of its own chip parameters and the code summary of the user trusted application running on it, to obtain its own operating environment information, and based on this, determine whether its own operating environment meets the requirements.

[0143] It is understandable that the data that can characterize the hardware environment of the chip should be more than the chip parameters, and the data that can characterize the software environment of the chip should be more than the code summary of the user-trusted application running on the chip. As long as the chip obtains its own operating environment information, the data used is indeed the data that can characterize the hardware environment and / or software environment of the chip. The embodiments of the present application do not limit the specific data used when the chip obtains its own operating environment information.

[0144] In order to complete the interaction measurement with other objects, the chip can send information acquisition requests (such as measurement tasks) to other objects except itself. The information acquisition request is used to obtain the operating environment information of other objects. Figure 7 , other objects may include model / algorithm providers and cloud platforms. Optionally, the information acquisition request does not have to be sent to all objects except itself. For example, when the central processing unit chip only sends an information acquisition request to the cloud platform, it can be considered that the central processing unit chip does not need to measure the operating environment of other objects except the cloud platform. Other objects that receive the information acquisition request can feed back their own determined operating environment information to the chip that initiated the information acquisition request. In this case, the chip can measure the received operating environment information of other objects to determine whether the operating environment of other objects meets the requirements.

[0145] Similarly, when the chip receives an information acquisition request from an object other than itself, it also outputs its own operating environment information to the other object, so that the other object can measure the chip's operating environment.

[0146] In this way, it is possible to support chip self-measurement and interaction measurement with other objects, thereby improving the diversity of the trusted execution environment.

[0147] In one possible implementation, the object includes a cloud platform, and the operating environment information of the cloud platform includes at least one of software configuration information, virtual machine configuration information, and server configuration information. Each of the objects determines its own operating environment information and obtains the operating environment information of the other objects, including:

[0148] For each cloud platform, obtain its own operating environment information based on at least one of its own software configuration information, virtual machine configuration information, and server configuration information;

[0149] For each of the other objects, when the object is deployed on the cloud platform, determining the operating environment information of the object according to the deployment information of the object;

[0150] When the object is not deployed on the cloud platform, sending an information acquisition request to the object, wherein the information acquisition request is used to obtain the operating environment information of the object;

[0151] When receiving an information acquisition request from an object other than itself, the operating environment information of the object is output to the other object.

[0152] For example, see Figure 7 The objects included in the trusted execution environment may include cloud platforms. For each cloud platform, servers (such as bare metal servers) are pre-configured, so the server configuration information can represent the cloud platform's hardware environment; and software, virtual machines, etc. are pre-configured, so the software configuration information and virtual machine configuration information can represent the cloud platform's software environment. In this case, for each cloud platform, the measurement of its own (software and / or hardware) operating environment can be completed by obtaining its own operating environment information based on at least one of its own software configuration information, virtual machine configuration information, and server configuration information, and based on this, determining whether its own operating environment meets the requirements.

[0153] It is understandable that the data that can represent the hardware environment of the cloud platform should be more than just server configuration information, and the data that can represent the software environment of the cloud platform should be more than just software configuration information and virtual machine configuration information. As long as the cloud platform obtains its own operating environment information, it uses data that can indeed represent the hardware environment and / or software environment of the cloud platform. The embodiments of the present application do not limit the specific data used when the cloud platform obtains its own operating environment information.

[0154] In order to complete the interaction measurement with other objects, the cloud platform needs to obtain the operating environment information of other objects besides itself. Figure 7, other objects may include model / algorithm providers and chips. In one example, the model / algorithm provider and the chip may be deployed on the cloud platform. During the deployment of these objects on the cloud platform, their own software / hardware operating environment information has been provided to the cloud platform. In this regard, the cloud platform can directly use the operating environment information obtained at the time of deployment to measure the operating environment of these objects. For objects that are not deployed on the cloud platform (not shown), the cloud platform can issue an information acquisition request to the object, and the information acquisition request is used to obtain the operating environment information of the object. Optionally, considering that the software / hardware operating environment of the object may change after it is deployed on the cloud platform, the cloud platform can also issue an information acquisition request to the object deployed on the cloud platform to re-acquire the operating environment information of the object to ensure the accuracy of the acquired operating environment information of other objects except itself.

[0155] Optionally, the information acquisition request need not be sent to all objects except the cloud platform itself. For example, if the cloud platform only sends the information acquisition request to the central processing unit chip, it can be assumed that the cloud platform does not need to measure the operating environment of other objects besides the central processing unit chip. Other objects that receive the information acquisition request can feed back their determined operating environment information to the cloud platform that initiated the information acquisition request. In this case, the cloud platform can measure the operating environment information received from other objects to determine whether the operating environment of other objects meets the requirements.

[0156] Similarly, when the cloud platform receives an information acquisition request from an object other than itself, it also outputs its own operating environment information to the other object, allowing the other object to measure the operating environment of the cloud platform.

[0157] In this way, it is possible to support the cloud platform's own measurement and the interaction measurement with other objects, which can further improve the diversity of the trusted execution environment.

[0158] Those skilled in the art should understand that in actual applications, in addition to chips and cloud platforms, the trusted execution environment may also include more types of objects, such as the model / algorithm providers mentioned above, etc. For the hardware objects among these other types of objects, the way they measure themselves and the way they interact with other objects for measurement can be found in the chips described above; for the software objects among these other types of objects, the way they measure themselves and the way they interact with other objects for measurement can be found in the cloud platform described above, and no further details will be given here.

[0159] After the data processing unit sends the fully signed runtime environment information and the public key of the trusted execution environment to the user device, the user device can verify the security of the trusted execution environment based on the fully signed runtime environment information and the public key of the trusted execution environment. The following describes several exemplary methods for a user device to verify the security of a trusted execution environment according to embodiments of the present application.

[0160] In one possible implementation, verifying the security of the trusted execution environment includes:

[0161] Determine whether the public key of the trusted execution environment corresponds to the complete signature, and determine that the trusted execution environment is secure when the public key of the trusted execution environment corresponds to the complete signature.

[0162] For example, verification may include two aspects: first, whether the private key of each object has been input into the data processing unit for calculation (which can be verified by the data processing unit and the verification result is sent to the user device without leaking the private key of each object to other objects or the user device); and second, whether the public key of the trusted execution environment corresponds to the complete signature (which can be verified by the user device). When the conditions of each object's private key being input into the data processing unit for calculation and the public key of the trusted execution environment corresponding to the complete signature are simultaneously met, the user device determines that the calculated public key is correct.

[0163] In this way, the security of the trusted execution environment can be verified in a relatively simple manner, thereby saving data processing costs and reducing the complexity of verification implementation.

[0164] Optionally, since the public key of the trusted execution environment is used when verifying the security of the trusted execution environment, the user may also choose to verify the correctness of the public key of the trusted execution environment.

[0165] In one possible implementation, verifying the security of the trusted execution environment includes:

[0166] Determining whether a synthesis result of the public keys of each object is consistent with the public key of the trusted execution environment, and determining that the public key of the trusted execution environment is correct when the synthesis result of the public keys of each object is consistent with the public key of the trusted execution environment;

[0167] Determine whether the public key of the trusted execution environment corresponds to the complete signature, and determine that the trusted execution environment is secure when the public key of the trusted execution environment is correct and the public key of the trusted execution environment corresponds to the complete signature.

[0168] For example, the correctness of the trusted execution environment's public key can be verified by determining whether the resultant of synthesizing the public keys of each object is consistent with the public key of the trusted execution environment. If the resultant of synthesizing the public keys of each object is consistent with the public key of the trusted execution environment, the public key of the trusted execution environment is determined to be correct. For an exemplary implementation of this, see the description of step S52 above. Thereafter, it is determined whether the public key of the trusted execution environment corresponds to the complete signature. If the public key of the trusted execution environment is correct and the public key of the trusted execution environment corresponds to the complete signature, the trusted execution environment is determined to be secure.

[0169] By also verifying the correctness of the public key of the trusted execution environment, the reliability of the verification result of the security of the trusted execution environment can be improved, and the verification method can be made more flexible.

[0170] Optionally, since the synthesis result of the public key of each object is used when verifying the correctness of the public key of the trusted execution environment, the user can also choose to verify the correctness of the synthesis result of the public key of each object.

[0171] In one possible implementation, verifying the security of the trusted execution environment includes:

[0172] Determining the correctness of the public key certificate of each object, and when the public key certificate of each object is correct, determining that the synthesis result of the public key of each object is correct;

[0173] Determining whether a synthesis result of the public key of each object is consistent with the public key of the trusted execution environment, and determining that the public key of the trusted execution environment is correct when the synthesis result of the public key of each object is correct and the synthesis result of the public key of each object is consistent with the public key of the trusted execution environment;

[0174] Determine whether the public key of the trusted execution environment corresponds to the complete signature, and determine that the trusted execution environment is secure when the public key of the trusted execution environment is correct and the public key of the trusted execution environment corresponds to the complete signature.

[0175] For example, the correctness of the synthesis result of each object's public key can be verified by determining the correctness of each object's public key certificate. When the public key certificate of each object is correct, the synthesis result of each object's public key is determined to be correct. For an exemplary implementation, see the relevant description of step S51 above. Then, it is determined whether the synthesis result of each object's public key is consistent with the public key of the trusted execution environment. When the synthesis result of each object's public key is correct and the synthesis result of each object's public key is consistent with the public key of the trusted execution environment, the public key of the trusted execution environment is determined to be correct. For an exemplary implementation, see the relevant description of step S52 above. Finally, it is determined whether the public key of the trusted execution environment corresponds to the complete signature. When the public key of the trusted execution environment is correct and the public key of the trusted execution environment corresponds to the complete signature, the trusted execution environment is determined to be secure.

[0176] By verifying the correctness of the synthesis result of the public key of each object and the correctness of the public key of the trusted execution environment, the reliability of the verification result of the security of the trusted execution environment is further improved, and the verification method is made more flexible.

[0177] After the trusted execution environment's security is verified and passed, the user device can assume that the trusted execution environment's computing services are secure. In this case, the user can enter the data they wish to calculate into the trusted execution environment for computation. Optionally, to further enhance the security of user data, the user data can be encrypted before entering the trusted execution environment.

[0178] The following describes an exemplary method for encrypting user data according to an embodiment of the present application. Figure 8 A schematic diagram illustrating an exemplary method for encrypting user data according to an embodiment of the present application.

[0179] like Figure 8 As shown, in a possible implementation, when determining that the trusted execution environment is secure, the method further includes:

[0180] The data processing unit signs the communication key of the trusted execution environment according to the private key of each object to obtain a communication key including a complete signature, and the communication key including the complete signature is used to encrypt data input into the trusted execution environment by the user device.

[0181] In this way, during the external communication process of the trusted execution environment, the communication key that protects the communication data is obtained by signing multiple objects together, which can improve the security of data communication.

[0182] For example, if Figure 8As shown, the trusted execution environment may include a random number generator for randomly generating a communication key (i.e., the communication key of the trusted execution environment). The data processing unit may sign the communication key of the trusted execution environment based on the private key of each object to obtain a communication key including a complete signature. Its exemplary implementation method is similar to the method in which the data processing unit can sign the operating environment information of the trusted execution environment based on the private key of each object.

[0183] For example, in one possible implementation, the data processing unit signs the communication key of the trusted execution environment according to the private key of each object to obtain a communication key including a complete signature. The communication key of the trusted execution environment can be used as the signature object that needs to be signed, and the signature object is signed according to the private key of each object previously input into the data processing unit (input when determining the public key of the trusted execution environment), and the communication key including the signature of each object (i.e., the communication key including the complete signature) is directly obtained and output.

[0184] For another example, in another possible implementation, the data processing unit signs the communication key of the trusted execution environment according to the private key of each object to obtain a communication key including a complete signature, including:

[0185] The data processing unit signs the communication key of the trusted execution environment according to the private key of each object, and obtains the communication key corresponding to each object including the signature fragment;

[0186] The data processing unit synthesizes the communication key including the complete signature according to the communication key including the signature fragment corresponding to each object.

[0187] For example, the data processing unit signs the communication key of the trusted execution environment according to the private key of each object to obtain a communication key including a complete signature. Alternatively, the communication key of the trusted execution environment can be used as the signature object to be signed, and the signature object is signed separately according to the private key of each object previously input into the data processing unit (input when determining the public key of the trusted execution environment). First, the communication key including the signature fragment corresponding to each object is obtained, and then the communication key including the signature fragment corresponding to each object is synthesized to obtain the communication key including the complete signature and output it.

[0188] In this way, the way of generating the communication key including the complete signature is made more flexible.

[0189] Those skilled in the art will appreciate that, although only two exemplary implementations of a communication key for obtaining a complete signature are provided in the embodiments of this application, in actual applications, there are more than one way to obtain a communication key for obtaining a complete signature. Any exemplary implementation of a communication key for obtaining a complete signature that is achievable based on existing technology may be used in the embodiments of this application, and this embodiment of the application does not impose any limitation thereto.

[0190] The data processing unit can output the communication key including the complete signature to the user device, which can use the key to encrypt data intended for input into the trusted execution environment. The data encrypted using the communication key including the complete signature can be input into the trusted execution environment. Upon receiving the encrypted data, the object in the trusted execution environment can obtain the communication key including the complete signature from the data processing unit, decrypt the received encrypted data using the communication key including the complete signature, and then perform corresponding operations on the decrypted data.

[0191] The embodiment of the present application provides a data processing system, the structure diagram of which can be found in the above Figure 4 .

[0192] In one possible implementation, the system includes a data processing unit and a trusted execution environment, wherein the trusted execution environment includes two or more objects for use by a user device; the data processing unit is used to receive a security verification request for the trusted execution environment initiated by the user device; in response to the security verification request, send operating environment information including a complete signature and a public key of the trusted execution environment to the user device, wherein the operating environment information including the complete signature is signed by signing the operating environment information of the trusted execution environment according to the private key of each object in the trusted execution environment, and the public key of the trusted execution environment is obtained according to the private key of each object; the operating environment information including the complete signature and the public key of the trusted execution environment are used to verify the security of the trusted execution environment.

[0193] In a possible implementation, each object is used to generate its own public key and private key, and output the private key to the data processing unit;

[0194] The data processing unit is further configured to determine, based on the received private key of each object, a public key corresponding to a synthesis result of the private key of each object; and use the determined public key as the public key of the trusted execution environment.

[0195] In one possible implementation, each object is further configured to determine its own operating environment information and obtain the operating environment information of the other objects; and determine the operating environment information of the trusted execution environment based on its own operating environment information and the operating environment information of the other objects;

[0196] The data processing unit is further configured to sign the operating environment information of the trusted execution environment according to the private key of each object to obtain the operating environment information including the complete signature.

[0197] In a possible implementation, the data processing unit signs the operating environment information of the trusted execution environment according to the private key of each object to obtain the operating environment information including the complete signature, including:

[0198] The data processing unit signs the operating environment information of the trusted execution environment according to the private key of each object to obtain the operating environment information corresponding to each object including the signature fragment;

[0199] The data processing unit synthesizes the operating environment information including the complete signature according to the operating environment information including the signature fragment corresponding to each object.

[0200] In one possible implementation, when determining the security of the trusted execution environment, the data processing unit is also used to sign the communication key of the trusted execution environment according to the private key of each object to obtain a communication key including a complete signature, and the communication key including the complete signature is used to encrypt data input into the trusted execution environment by the user device.

[0201] In a possible implementation, the data processing unit signs the communication key of the trusted execution environment according to the private key of each object to obtain the communication key including the complete signature, including:

[0202] The data processing unit signs the communication key of the trusted execution environment according to the private key of each object to obtain the communication key corresponding to each object including the signature fragment;

[0203] The data processing unit synthesizes the communication key including the complete signature according to the communication key including the signature fragment corresponding to each object.

[0204] In one possible implementation, the object includes a chip, and the operating environment information of the chip includes at least one of chip parameters and a code summary of a user trusted application running on the chip; each object separately determines its own operating environment information and obtains the operating environment information of the other objects, including:

[0205] For each chip, obtain its own operating environment information based on at least one of its own chip parameters and a code summary of a user trusted application running on the chip;

[0206] Sending an information acquisition request to other objects except itself, wherein the information acquisition request is used to obtain the operating environment information of the other objects;

[0207] When receiving an information acquisition request from an object other than itself, the operating environment information of the object is output to the other object.

[0208] In one possible implementation, the object includes a cloud platform, and the operating environment information of the cloud platform includes at least one of software configuration information, virtual machine configuration information, and server configuration information; each object separately determines its own operating environment information and obtains the operating environment information of the other objects, including:

[0209] For each cloud platform, obtain its own operating environment information based on at least one of its own software configuration information, virtual machine configuration information, and server configuration information;

[0210] For each of the other objects, when the object is deployed on the cloud platform, determining the operating environment information of the object according to the deployment information of the object;

[0211] When the object is not deployed on the cloud platform, sending an information acquisition request to the object, wherein the information acquisition request is used to obtain the operating environment information of the object;

[0212] When receiving an information acquisition request from an object other than itself, the operating environment information of the object is output to the other object.

[0213] In a possible implementation, the user device is configured to determine whether the public key of the trusted execution environment corresponds to the complete signature, and determine that the trusted execution environment is secure when the public key of the trusted execution environment corresponds to the complete signature.

[0214] In one possible implementation, the user device is used to determine whether a synthesis result of the public key of each object is consistent with the public key of the trusted execution environment, and when the synthesis result of the public key of each object is consistent with the public key of the trusted execution environment, determine that the public key of the trusted execution environment is correct; and determine whether the public key of the trusted execution environment corresponds to the complete signature, and when the public key of the trusted execution environment is correct and the public key of the trusted execution environment corresponds to the complete signature, determine that the trusted execution environment is secure.

[0215] In one possible implementation, the user device is used to determine the correctness of the public key certificate of each object, and when the public key certificate of each object is correct, determine that the synthesis result of the public key of each object is correct; determine whether the synthesis result of the public key of each object is consistent with the public key of the trusted execution environment, and when the synthesis result of the public key of each object is correct and the synthesis result of the public key of each object is consistent with the public key of the trusted execution environment, determine that the public key of the trusted execution environment is correct; determine whether the public key of the trusted execution environment corresponds to the complete signature, and when the public key of the trusted execution environment is correct and the public key of the trusted execution environment corresponds to the complete signature, determine that the trusted execution environment is secure.

[0216] In a possible implementation, each object generates its own public key and private key, and outputs the private key to the data processing unit, including:

[0217] For each object, generate its own public key and private key;

[0218] Outputting its own public key certificate to the trusted execution environment and other objects except itself;

[0219] receiving a public key certificate of the other object;

[0220] The correctness of the public key certificates of the other objects is judged, and when the public key certificates of each of the other objects are correct, the private key is output to the data processing unit.

[0221] An embodiment of the present application provides a data processing system, comprising: a processor and a memory for storing processor-executable instructions; wherein the processor is configured to implement the above-mentioned data processing unit when executing the instructions.

[0222] An embodiment of the present application provides a non-volatile computer-readable storage medium having computer program instructions stored thereon. When the computer program instructions are executed by a processor, the above-mentioned data processing unit is implemented.

[0223] An embodiment of the present application provides a computer program product, including a computer-readable code, or a non-volatile computer-readable storage medium carrying the computer-readable code. When the computer-readable code runs in a processor of an electronic device, the processor in the electronic device executes the above-mentioned data processing unit.

[0224] Figure 9 An exemplary structural diagram of a data processing system according to an embodiment of the present application is shown.

[0225] like Figure 9As shown, the data processing system may include at least one of a mobile phone, a foldable electronic device, a tablet computer, a desktop computer, a laptop computer, a handheld computer, a notebook computer, an ultra-mobile personal computer (UMPC), a netbook, a cellular phone, a personal digital assistant (PDA), an augmented reality (AR) device, a virtual reality (VR) device, an artificial intelligence (AI) device, a wearable device, an in-vehicle device, a smart home device, or a smart city device, or a server device. The embodiment of the present application does not impose any special restrictions on the specific type of the data processing system.

[0226] The data processing system may include a processor 110, a memory 121, and a communication module 160. It should be understood that the structure illustrated in the embodiments of the present application does not constitute a specific limitation on the data processing system. In other embodiments of the present application, the data processing system may include more or fewer components than shown, or may combine or split certain components, or arrange the components differently. The components shown in the diagram may be implemented in hardware, software, or a combination of software and hardware.

[0227] The processor 110 may include one or more processing units. For example, the processor 110 may include an application processor (AP), a modem processor, a graphics processing unit (GPU), an image signal processor (ISP), a controller, a video codec, a digital signal processor (DSP), a baseband processor, and / or a neural-network processing unit (NPU). The different processing units may be independent devices or integrated into one or more processors.

[0228] The processor can generate operation control signals based on instruction opcodes and timing signals to complete the control of instruction fetching and execution.

[0229] Processor 110 may also be provided with a memory for storing instructions and data. In some embodiments, the memory in processor 110 may be a cache memory. This memory may store instructions or data that have been used or are frequently used by processor 110, such as the public key of the trusted execution environment in the embodiments of the present application. If processor 110 needs to use this instruction or data, it can directly call it from this memory. This avoids repeated accesses, reduces the waiting time of processor 110, and thus improves system efficiency.

[0230] The memory 121 can be used to store computer executable program code, which includes instructions. The memory 121 may include a program storage area and a data storage area. Among them, the program storage area can store an operating system, an application required for at least one function (such as a secure multi-party computing protocol), etc. The data storage area can store data acquired or created during the use of the data processing unit (such as a public key of a trusted execution environment, etc.). In addition, the memory 121 may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, a universal flash storage (UFS), etc. The processor 110 implements the various methods performed by the above-mentioned data processing unit by running instructions stored in the memory 121, and / or instructions stored in a memory provided in the processor.

[0231] The communication module 160 can be used to receive data (such as a security verification request in the embodiment of the present application) from other devices or equipment through wireless communication / wired communication, and output data to other devices or equipment. For example, wireless communication solutions including WLAN (such as Wi-Fi network), Bluetooth (BT), global navigation satellite system (GNSS), frequency modulation (FM), near field communication technology (NFC), infrared technology (IR), etc. can be provided.

[0232] A computer-readable storage medium may be a tangible device that can hold and store instructions used by an instruction execution device. A computer-readable storage medium may be, for example, but is not limited to, an electrical storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination thereof. More specific examples (a non-exhaustive list) of computer-readable storage media include: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a static random access memory (SRAM), a portable compact disc read-only memory (CD-ROM), a digital versatile disc (DVD), a memory stick, a floppy disk, a mechanical encoding device, such as a punch card or a raised structure in a groove having instructions stored thereon, and any suitable combination thereof.

[0233] The computer-readable program instructions or codes described herein can be downloaded from a computer-readable storage medium to each computing / processing device, or downloaded to an external computer or external storage device via a network, such as the Internet, a local area network, a wide area network, and / or a wireless network. The network can include copper transmission cables, fiber optic transmission, wireless transmission, routers, firewalls, switches, gateway computers, and / or edge servers. The network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards the computer-readable program instructions to be stored in the computer-readable storage medium in each computing / processing device.

[0234] The computer program instructions for performing the operations of the present application may be assembly instructions, instruction set architecture (ISA) instructions, machine instructions, machine-dependent instructions, microcode, firmware instructions, state setting data, or source code or object code written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Smalltalk, C++, and conventional procedural programming languages ​​such as "C" or similar programming languages. The computer-readable program instructions may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer via any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider). In some embodiments, by utilizing state information of computer-readable program instructions to personalize an electronic circuit, such as a programmable logic circuit, a field-programmable gate array (FPGA), or a programmable logic array (PLA), the electronic circuit can execute the computer-readable program instructions, thereby implementing various aspects of the present application.

[0235] Various aspects of the present application are described herein with reference to flowcharts and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the present application. It should be understood that each block of the flowcharts and / or block diagrams, and combinations of blocks in the flowcharts and / or block diagrams, can be implemented by computer-readable program instructions.

[0236] These computer-readable program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, thereby producing a machine, so that when these instructions are executed by the processor of the computer or other programmable data processing device, a device is generated that implements the functions / actions specified in one or more blocks in the flowchart and / or block diagram. These computer-readable program instructions can also be stored in a computer-readable storage medium, where these instructions cause the computer, programmable data processing device, and / or other device to operate in a specific manner. Thus, the computer-readable medium storing the instructions comprises an article of manufacture that includes instructions for implementing various aspects of the functions / actions specified in one or more blocks in the flowchart and / or block diagram.

[0237] Computer-readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device so that a series of operational steps are performed on the computer, other programmable data processing apparatus, or other device to produce a computer-implemented process, thereby causing the instructions executed on the computer, other programmable data processing apparatus, or other device to implement the functions / actions specified in one or more blocks in the flowchart and / or block diagram.

[0238] The flow charts and block diagrams in the accompanying drawings show the possible architecture, functions and operations of the devices, systems, methods and computer program products according to multiple embodiments of the present application. In this regard, each box in the flow chart or block diagram can represent a part for a module, program segment or instruction, and the part for the module, program segment or instruction comprises one or more executable instructions for realizing the logical function of the specification. In some alternative implementations, the functions marked in the box can also occur in a sequence different from that marked in the accompanying drawings. For example, two continuous boxes can actually be performed substantially in parallel, and they can sometimes also be performed in the opposite order, depending on the function involved.

[0239] It should also be noted that each box in the block diagram and / or flowchart, and combinations of boxes in the block diagram and / or flowchart, can be implemented by hardware (such as a circuit or an application-specific integrated circuit (ASIC)) that performs the corresponding function or action, or can be implemented by a combination of hardware and software, such as firmware.

[0240] Although the present invention is described herein in conjunction with various embodiments, in the process of implementing the claimed invention, those skilled in the art can understand and implement other variations of the disclosed embodiments by reviewing the drawings, the disclosure, and the appended claims. In the claims, the word "comprising" does not exclude other components or steps, and "a" or "an" does not exclude multiple situations. A single processor or other unit can implement several functions listed in the claims. Certain measures are recorded in different dependent claims, but this does not mean that these measures cannot be combined to produce good results.

[0241] The embodiments of the present application have been described above. The above description is illustrative and not exhaustive, and is not limited to the disclosed embodiments. Many modifications and variations will be apparent to those skilled in the art without departing from the scope of the described embodiments. The terminology used herein is selected to best explain the principles of the embodiments, practical applications, or improvements to the technology in the market, or to enable other persons skilled in the art to understand the embodiments disclosed herein.

Claims

1. A security verification method, characterized in that: The method is applied to a data processing system, the data processing system including a data processing unit and a trusted execution environment, the trusted execution environment including two or more objects for use by a user device, and the method includes: The data processing unit receives a security verification request for the trusted execution environment initiated by the user equipment; In response to the security verification request, the data processing unit sends the operating environment information including the complete signature and the public key of the trusted execution environment to the user device, the operating environment information including the complete signature is signed by the operating environment information of the trusted execution environment according to the private key of each object in the trusted execution environment, and the public key of the trusted execution environment is obtained according to the private key of each object. The operating environment information including the complete signature and the public key of the trusted execution environment are used to verify the security of the trusted execution environment.

2. The method according to claim 1, characterized in that The method further comprises: Each object generates its own public key and private key, and outputs the private key to the data processing unit; The data processing unit determines, based on the received private key of each object, a public key corresponding to a synthesis result of the private key of each object; The determined public key is used as the public key of the trusted execution environment.

3. The method according to claim 1 or 2, characterized in that The method further comprises: Each of the objects determines its own operating environment information and obtains the operating environment information of the other objects; Each object determines the operating environment information of the trusted execution environment based on its own operating environment information and the operating environment information of other objects; The data processing unit signs the operating environment information of the trusted execution environment according to the private key of each object to obtain the operating environment information including the complete signature.

4. The method according to claim 3, characterized in that The data processing unit signs the operating environment information of the trusted execution environment according to the private key of each object to obtain the operating environment information including the complete signature, including: The data processing unit signs the operating environment information of the trusted execution environment according to the private key of each object to obtain the operating environment information corresponding to each object including the signature fragment; The data processing unit synthesizes the operating environment information including the complete signature according to the operating environment information including the signature fragment corresponding to each object.

5. The method according to any one of claims 1 to 4, characterized in that When determining that the trusted execution environment is secure, the method further includes: The data processing unit signs the communication key of the trusted execution environment according to the private key of each object to obtain a communication key including a complete signature, and the communication key including the complete signature is used to encrypt data input into the trusted execution environment by the user device.

6. The method according to claim 5, characterized in that The data processing unit signs the communication key of the trusted execution environment according to the private key of each object to obtain a communication key including a complete signature, including: The data processing unit signs the communication key of the trusted execution environment according to the private key of each object to obtain the communication key corresponding to each object including the signature fragment; The data processing unit synthesizes the communication key including the complete signature according to the communication key including the signature fragment corresponding to each object.

7. The method according to any one of claims 3 to 6, characterized in that: The object includes a chip, and the operating environment information of the chip includes at least one of chip parameters and a code summary of a user trusted application running on the chip. Each object determines its own operating environment information and obtains the operating environment information of other objects, including: For each chip, obtain its own operating environment information based on at least one of its own chip parameters and a code summary of a user trusted application running on the chip; Sending an information acquisition request to other objects except itself, wherein the information acquisition request is used to obtain the operating environment information of the other objects; When receiving an information acquisition request from an object other than itself, the operating environment information of the object is output to the other object.

8. The method according to any one of claims 3 to 7, characterized in that: The object includes a cloud platform, and the operating environment information of the cloud platform includes at least one of software configuration information, virtual machine configuration information, and server configuration information. Each object determines its own operating environment information and obtains the operating environment information of other objects, including: For each cloud platform, obtain its own operating environment information based on at least one of its own software configuration information, virtual machine configuration information, and server configuration information; For each of the other objects, when the object is deployed on the cloud platform, determining the operating environment information of the object according to the deployment information of the object; When the object is not deployed on the cloud platform, sending an information acquisition request to the object, wherein the information acquisition request is used to obtain the operating environment information of the object; When receiving an information acquisition request from an object other than itself, the operating environment information of the object is output to the other object.

9. The method according to any one of claims 1 to 8, characterized in that Verifying the security of the trusted execution environment includes: Determine whether the public key of the trusted execution environment corresponds to the complete signature, and determine that the trusted execution environment is secure when the public key of the trusted execution environment corresponds to the complete signature.

10. The method according to any one of claims 1 to 8, characterized in that The method further comprises: Determining whether a synthesis result of the public keys of each object is consistent with the public key of the trusted execution environment, and determining that the public key of the trusted execution environment is correct when the synthesis result of the public keys of each object is consistent with the public key of the trusted execution environment; Determine whether the public key of the trusted execution environment corresponds to the complete signature, and determine that the trusted execution environment is secure when the public key of the trusted execution environment is correct and the public key of the trusted execution environment corresponds to the complete signature.

11. The method according to any one of claims 1 to 8, characterized in that The method further comprises: Determining the correctness of the public key certificate of each object, and when the public key certificate of each object is correct, determining that the synthesis result of the public key of each object is correct; Determining whether a synthesis result of the public key of each object is consistent with the public key of the trusted execution environment, and determining that the public key of the trusted execution environment is correct when the synthesis result of the public key of each object is correct and the synthesis result of the public key of each object is consistent with the public key of the trusted execution environment; Determine whether the public key of the trusted execution environment corresponds to the complete signature, and determine that the trusted execution environment is secure when the public key of the trusted execution environment is correct and the public key of the trusted execution environment corresponds to the complete signature.

12. The method according to any one of claims 2 to 11, characterized in that: Each object generates its own public key and private key, and outputs the private key to the data processing unit, including: For each object, generate its own public key and private key; Outputting its own public key certificate to the trusted execution environment and other objects except itself; receiving a public key certificate of the other object; The correctness of the public key certificates of the other objects is judged, and when the public key certificates of each of the other objects are correct, the private key is output to the data processing unit.

13. A data processing system, characterized in that: The system includes a data processing unit and a trusted execution environment, wherein the trusted execution environment includes two or more objects for use by a user device. The data processing unit is used to receive a security verification request for the trusted execution environment initiated by the user equipment; in response to the security verification request, send the operating environment information including the complete signature and the public key of the trusted execution environment to the user equipment, the operating environment information including the complete signature is signed by the operating environment information of the trusted execution environment according to the private key of each object in the trusted execution environment, the public key of the trusted execution environment is obtained according to the private key of each object, and the operating environment information including the complete signature and the public key of the trusted execution environment are used to verify the security of the trusted execution environment.

14. A data processing system, characterized in that: include: processor; a memory for storing processor-executable instructions; Wherein, the processor is configured to implement the data processing unit according to any one of claims 1 to 12 when executing the instructions.

15. A non-volatile computer-readable storage medium having computer program instructions stored thereon, characterized in that: When the computer program instructions are executed by a processor, the data processing unit according to any one of claims 1 to 12 is implemented.

16. A computer program product comprising computer-readable code, or a non-volatile computer-readable storage medium carrying computer-readable code, characterized in that: When the computer-readable code is executed in an electronic device, a processor in the electronic device executes the data processing unit according to any one of claims 1 to 12.

Images