Data security processing system and method, storage medium and electronic device

Abstract

The invention discloses a data security processing system and method, a storage medium and an electronic device, and the system comprises a program compiler which is used for compiling a source code to obtain an executable code of an upper computer and an executable code of a lower computer; the upper computer is connected with the program compiler and used for sending to-be-processed data and a starting signal to the lower computer according to an executable code of the upper computer under the condition that the to-be-processed data is received, and the starting signal is used for starting and executing the executable code of the lower computer; the lower computer is connected with the upper computer and is used for responding to the starting signal, performing security processing on the to-be-processed data according to an executable code of the lower computer and returning a security processing result to the upper computer; by the adoption of the system, the problem that if an existing safety data processor needs to meet the requirement for high performance, a circuit is difficult to update or cost is high in the prior art is solved.

Description

Technical Field

[0001] The present application relates to the field of communications, and in particular, to a data security processing system and method, a storage medium, and an electronic device. Background Art

[0002] Secure data processors are widely used in communication systems and Internet systems. They protect information transmitted between different entities based on keys and cryptographic algorithms. There are three common processor mechanisms: CPU-based software implementation, FPGA-based implementation, and proprietary circuit-based implementation. However, these three implementation methods have the following problems: CPU-based software implementation has high CPU performance requirements, and the overall implementation security is low, which cannot meet the requirements of high-security occasions; FPGA-based implementation can achieve higher performance and security, but FPGA is extremely difficult to program and update online after deployment; proprietary circuit-based implementation methods can meet the requirements of high performance and security, but because they require a high degree of customization and a high deployment scale, the application cost is extremely high.

[0003] Regarding the related technologies, if the existing secure data processors are to meet the high performance requirements, it will lead to problems such as difficulty in updating the circuits or high costs, and no effective solution has yet been proposed. Summary of the invention

[0004] The embodiments of the present application provide a data security processing system and method, a storage medium and an electronic device to at least solve the problem in the related art that if the existing security data processor wants to meet the high performance requirements, it will cause the circuit to be difficult to update or the cost is high.

[0005] According to one embodiment of the embodiments of the present application, a data security processing system is provided, including: a program compiler, which is used to compile source code to obtain executable code of an upper computer and an executable code of a lower computer; the upper computer, which is connected to the program compiler, is used to send the data to be processed and a start signal to the lower computer according to the executable code of the upper computer when receiving the data to be processed, wherein the start signal is used to start executing the executable code of the lower computer; the lower computer, which is connected to the upper computer, is used to respond to the start signal, perform security processing on the data to be processed according to the executable code of the lower computer, and return the security processing result to the upper computer.

[0006] In an exemplary embodiment, the lower computer includes: an instruction storage unit for storing the executable code of the lower computer, and upon receiving the data to be processed and the start signal, storing the data to be processed in response to the start signal, and sending the data to be processed in groups to the instruction decoding unit by executing the executable code of the lower computer, wherein each group of the data to be processed in the grouped data to be processed includes at least instruction data.

[0007] In an exemplary embodiment, the lower computer includes: an instruction decoding unit, connected to the instruction storage unit, for decoding the instruction data in each group of data to be processed when receiving the grouped data to be processed, obtaining an operation control signal corresponding to the instruction data, and sending the operation control signal and the sub-data to be processed corresponding to the instruction data to the security operation core.

[0008] In an exemplary embodiment, the instruction decoding unit is also used to parse the instruction data to obtain an operation code of the instruction data; identify the operation code to determine the number of operands and the addressing mode of the operands, and the instruction type of the instruction data; obtain the operands according to the number of operands and the addressing mode, and generate the operation control signal according to the instruction type and the operands.

[0009] In an exemplary embodiment, the lower computer includes: a security operation kernel connected to the instruction decoding unit, and used to perform security processing on the sub-data to be processed according to the operation control signal when the operation control signal and the sub-data to be processed are received, and return the security processing result to the upper computer when the security processing result is obtained.

[0010] In an exemplary embodiment, the security operation kernel includes: a command manager, which is used to perform permission verification on the first object when receiving the operation control signal; when the first object passes the permission verification, securely process the sub-data to be processed according to the operation control signal, wherein the data to be processed is initiated by the first object.

[0011] In an exemplary embodiment, the security computing kernel includes: a plurality of security logic computing units connected to the command manager, for performing data segmentation on the sub-data to be processed upon receiving the sub-data to be processed to obtain a plurality of work items, wherein the plurality of security logic computing units correspond one-to-one to the plurality of work items; performing parallel processing on the plurality of work items through the operation control signal and the plurality of security logic computing units to obtain a plurality of sub-processing results; and merging the plurality of sub-processing results to obtain the security processing result.

[0012] According to another embodiment of the embodiment of the present application, a data security processing method is also provided, including: controlling a program compiler to compile source code to obtain an executable code of an upper computer and an executable code of a lower computer; when the upper computer receives data to be processed, controlling the upper computer to send the data to be processed and a start signal to the lower computer according to the executable code of the upper computer, wherein the start signal is used to start executing the executable code of the lower computer; in response to the start signal, controlling the lower computer to perform security processing on the data to be processed according to the executable code of the lower computer, and returning the security processing result to the upper computer.

[0013] According to another aspect of an embodiment of the present application, a computer-readable storage medium is further provided, in which a computer program is stored, wherein the computer program is configured to execute the above-mentioned data security processing method when running.

[0014] According to another aspect of an embodiment of the present application, an electronic device is provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the data security processing method through the computer program.

[0015] In an embodiment of the present application, a program compiler in the system is first controlled to compile the source code so that the upper computer and the lower computer have corresponding functions; when the upper computer receives the data to be processed, the upper computer is controlled to send the data to be processed and a start signal to the lower computer according to the executable code of the upper computer, wherein the start signal is used to start the function of the lower computer; in response to the start signal, the lower computer is controlled to perform security processing on the data to be processed according to the executable code of the lower computer, and the security processing result is returned to the upper computer; the above scheme is adopted to provide a set of low-cost security data processing system, which reduces the requirements on the host processing capability while improving data security; thereby solving the problem in the related technology that if the existing security data processor wants to meet the high performance requirements, it will cause the circuit to be difficult to update or the cost to be high. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0017] Figure 1 It is a hardware structure block diagram of a server of an optional data security processing system of an embodiment of the present application;

[0018] Figure 2 It is a structural block diagram of an optional data security processing system in an embodiment of the present application;

[0019] Figure 3 It is a structural schematic diagram of an optional lower computer in an embodiment of the present application;

[0020] Figure 4 is a schematic diagram of the structure of a secure computing kernel according to an embodiment of the present application;

[0021] Figure 5 It is a flow chart of a data security processing method according to an embodiment of the present application. DETAILED DESCRIPTION

[0022] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present application.

[0023] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0024] The method embodiment provided in the embodiment of the present application can be executed on a server or a similar computing system. Taking running on a server as an example, Figure 1 FIG. 1 is a hardware structure block diagram of a server of a data security processing system according to an embodiment of the present application. Figure 1 As shown, the server may include one or more ( Figure 1 Only one is shown in the figure) a processor 102 (the processor 102 may include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA) and a memory 104 for storing data. In an exemplary embodiment, the server may also include a transmission device 106 and an input / output device 108 for communication functions. It can be understood by those skilled in the art that Figure 1 The structure shown is only for illustration and does not limit the structure of the above server. Figure 1 More or fewer components as shown, or with Figure 1 Equivalent functions or comparisons shown Figure 1 A different configuration with more features is shown.

[0025] The memory 104 can be used to store computer programs, for example, software programs and modules of application software, such as computer programs corresponding to the data security processing system in the embodiment of the present application. The processor 102 executes various functional applications and data processing by running the computer programs stored in the memory 104, that is, to implement the above method. The memory 104 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage systems, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include a memory remotely arranged relative to the processor 102, and these remote memories may be connected to the secure text via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0026] The transmission device 106 is used to receive or send data via a network. The specific example of the above network may include a wireless network provided by a communication provider of the server. In one example, the transmission device 106 includes a network adapter (Network Interface Controller, referred to as NIC), which can be connected to other network devices through a base station so as to communicate with the Internet.

[0027] In this embodiment, a data security processing system is provided. Figure 2 This is a structural block diagram of an optional data security processing system according to an embodiment of the present application, the system includes the following components:

[0028] A program compiler 22, used to compile the source code to obtain the executable code of the upper computer and the executable code of the lower computer;

[0029] The upper computer 24 is connected to the program compiler 22, and is used for sending the data to be processed and a start signal to the lower computer 26 according to the executable code of the upper computer when receiving the data to be processed, wherein the start signal is used to start the execution of the executable code of the lower computer;

[0030] The lower computer 26 is connected to the upper computer 24 , and is used to respond to the start signal, perform security processing on the data to be processed according to the executable code of the lower computer, and return the security processing result to the upper computer 24 .

[0031] Through the above system, the program compiler in the system is first controlled to compile the source code so that the upper computer and the lower computer have corresponding functions; when the upper computer receives the data to be processed, the upper computer is controlled to send the data to be processed and the start signal to the lower computer according to the executable code of the upper computer, wherein the start signal is used to start the function of the lower computer; in response to the start signal, the lower computer is controlled to perform security processing on the data to be processed according to the executable code of the lower computer, and the security processing result is returned to the upper computer; by adopting the above scheme, a set of low-cost security data processing system is provided, which reduces the requirements on the host processing capability while improving data security; thereby solving the problem in the related technology that if the existing security data processor wants to meet the high performance requirements, it will cause the circuit to be difficult to update or the cost to be high.

[0032] It should be noted that the overall application program of the above-mentioned system includes the upper computer code and the lower computer (equivalent to the security data processor) code. Different from FPGA development, the codes of the upper computer and the lower computer both support the use of common computer languages, such as C and C++ for source code writing, and are compiled into upper computer executable code and lower computer executable code through the compiler; the above-mentioned method is adopted to realize the use of general language instead of specific mechanism such as FPGA hardware language-based programming method for security data processing, which reduces the development difficulty and improves the efficiency; and the computing power of security calculations is guaranteed by hardware processors such as the lower computer, which reduces the requirements for host processing capabilities and improves security; and the implementation mechanism combining hardware and software overcomes the customization disadvantages of dedicated circuits, improves versatility, and reduces application costs.

[0033] Optionally, the structure of the lower computer 26 is as follows: Figure 3 As shown, it includes the following units:

[0034] The instruction storage unit 32 is used to store the executable code of the lower computer. When receiving the data to be processed and the start signal, the instruction storage unit 32 stores the data to be processed in response to the start signal, and sends the data to be processed in groups to the instruction decoding unit 34 by executing the executable code of the lower computer, wherein each group of the data to be processed in the grouped data to be processed includes at least instruction data.

[0035] After the data to be processed and the start signal are sent to the lower computer, they first enter the instruction storage unit of the lower computer. The instruction storage unit is used to store the executable code and the data to be processed of the lower computer. The start signal is used to start the executable code of the lower computer. The code drives the instruction storage unit to group the data to be processed first, and then send the grouped data to be processed to the instruction decoding unit in groups, so that the instruction decoding unit processes the data to be processed one by one.

[0036] The instruction decoding unit 34 is connected to the instruction storage unit 32, and is used to decode the instruction data in each group of data to be processed after receiving the grouped data to be processed, obtain the operation control signal corresponding to the instruction data, and send the operation control signal and the sub-data to be processed corresponding to the instruction data to the security operation core 36.

[0037] The instruction decoding unit is responsible for instruction parsing. Driven by the executable code of the lower computer stored in the instruction storage unit, the instruction decoding unit decodes the instruction data in each group of data to be processed, obtains the operation control signal corresponding to the instruction data, and sends the operation control signal and the sub-data to be processed corresponding to the instruction data to the security operation core. The sub-data to be processed is the data to be manipulated by the operation control signal.

[0038] Optionally, the above-mentioned instruction decoding unit 34 specifically decodes the instruction data in the following manner: first, the instruction data is parsed to obtain the operation code of the instruction data; then the operation code is identified to determine the number of operands and the addressing method of the operands and the instruction type of the instruction data; then, these operands are obtained respectively according to the number of operands and the addressing method; finally, the operation control signal is generated according to the instruction type and the operand.

[0039] Optionally, the present application also provides an optional working method of an instruction decoding unit, which specifically includes the following process:

[0040] Step 1: Instruction decoding: First, the instruction decoding unit reads the instruction from the instruction memory (equivalent to the above-mentioned instruction storage unit). Usually, the instruction consists of multiple bit fields, and the instruction decoding unit needs to parse these fields to obtain the instruction's opcode and operand.

[0041] Step 2: Operation code recognition: Based on the operation code of the instruction, the instruction decoding unit can determine the type and operation mode of the instruction. This information includes whether the instruction is an arithmetic instruction, a logical instruction, a branch instruction, or a memory instruction, as well as the number of operands and addressing mode of the instruction.

[0042] Step 3: Operand acquisition: Based on the addressing mode of the instruction, the instruction decoding unit can determine the source of the operand. For example, the operand may come from a register, memory, or other register file. The instruction decoding unit needs to obtain the operand from the corresponding source based on the field information of the instruction.

[0043] Step 4: Generate operation control signals: According to the instruction opcode and operand, the instruction decoding unit needs to generate corresponding operation control signals so that the subsequent execution stage can correctly execute the instruction. These operation control signals include enable signals for reading and writing registers, control signals for ALU operations, selection signals for data paths, etc.

[0044] In summary, the instruction decoding unit of the secure data processor is mainly responsible for parsing the opcode and operand of the instruction, and generating corresponding operation control signals based on this information so that the instruction can be correctly executed in the subsequent execution stage.

[0045] The security operation core 36 is connected to the instruction decoding unit, and is used to perform security processing on the sub-data to be processed according to the operation control signal when the operation control signal and the sub-data to be processed are received, and return the security processing result to the host computer when the security processing result is obtained.

[0046] The security operation kernel is responsible for completing the actual data cryptographic operation. When receiving the operation control signal and the sub-data to be processed sent by the instruction decoding unit, it performs security processing on the sub-data to be processed according to the operation control signal. After obtaining the security processing result, it returns the security processing result to the host computer.

[0047] Optionally, the structure of the security operation kernel 36 is as follows: Figure 4 As shown, it includes the following devices:

[0048] The command manager 42 is used to perform permission verification on the first object when receiving the operation control signal; when the first object passes the permission verification, securely process the sub-data to be processed according to the operation control signal, wherein the sub-data to be processed is initiated by the first object.

[0049] The command manager is used to parse the commands input by the user, that is, to parse the operation control signal, identify the keywords, parameters and options of the command; and verify the authority of the user (equivalent to the first object mentioned above) to ensure that the user has sufficient authority to execute the command; if it is determined that the user passes the authority verification, the sub-data to be processed is securely processed according to the operation control signal, and the first object is the initiator of the data to be processed.

[0050] There are multiple security logic calculation units 44, which are connected to the command manager and are used to perform data segmentation on the sub-data to be processed when receiving the sub-data to be processed to obtain multiple work items, wherein the multiple security logic calculation units correspond one-to-one to the multiple work items; the multiple work items are processed in parallel through the operation control signal and the multiple security logic calculation units to obtain multiple sub-processing results; and the multiple sub-processing results are merged to obtain the security processing result.

[0051] The security processing process of the sub-data to be processed is carried out in a security logic calculation unit. There are multiple security logic calculation units, and these multiple security logic calculation units are parallel and have the same structure. When the sub-data to be processed is received, the sub-data to be processed is first split into data to obtain multiple work items. The multiple security logic calculation units correspond to the multiple work items one by one. The multiple work items are processed in parallel through operation control signals and the multiple security logic calculation units to obtain multiple sub-processing results, which are merged to obtain the security processing result.

[0052] Optionally, the security processing process of the above-mentioned data to be processed can also be implemented by the following scheme, which specifically includes the following steps:

[0053] Step 1: User inputs a command: The user inputs a command on the command line or graphical interface;

[0054] Step 2: Command parsing: The command manager parses the command entered by the user and identifies the command's keywords, parameters, and options.

[0055] Step 3: Permission verification: The command manager will verify the user's permissions to ensure that the user has sufficient permissions to execute the command;

[0056] Step 4: Command execution: The command manager passes the parsed command to the corresponding kernel or system component (equivalent to the above-mentioned security logic computing unit) for execution; this may involve operations on system resources, such as creating, deleting, and modifying files or directories; process management, such as starting, stopping, and monitoring processes; network management, such as configuring network interfaces and setting firewall rules;

[0057] Step 5: Result feedback: The command manager returns the execution result to the user; this may be a success or failure message, or the output of the command execution;

[0058] Step 6: Error handling: If errors occur during command execution, the command manager will replenish and handle these errors. It may provide error messages to the user or take appropriate measures for error repair or processing.

[0059] In general, the command manager of the secure computing kernel is responsible for parsing and executing commands entered by the user, while ensuring permissions and security, and achieving management and control of system resources and functions.

[0060] Through the description of the above implementation methods, those skilled in the art can clearly understand that the method according to the embodiment of the present application can be implemented by means of software plus a necessary general hardware platform, and of course, it can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, a disk, or an optical disk), and includes a number of instructions for a terminal device (which can be a mobile phone, a computer, a server, or a network device, etc.) to execute the methods of the following embodiments of the present application.

[0061] Figure 5 is a flow chart of a data security processing method according to an embodiment of the present application; Figure 5 As shown, the following steps are included:

[0062] Step S502, the control program compiler compiles the source code to obtain the executable code of the upper computer and the executable code of the lower computer;

[0063] Step S504, when the upper computer receives the data to be processed, controlling the upper computer to send the data to be processed and a start signal to the lower computer according to the executable code of the upper computer, wherein the start signal is used to start executing the executable code of the lower computer;

[0064] Step S506, in response to the start signal, controlling the lower computer to perform security processing on the data to be processed according to the executable code of the lower computer, and returning the security processing result to the upper computer.

[0065] Through the above steps, the program compiler in the system is first controlled to compile the source code so that the upper computer and the lower computer have corresponding functions; when the upper computer receives the data to be processed, the upper computer is controlled to send the data to be processed and the start signal to the lower computer according to the executable code of the upper computer, wherein the start signal is used to start the function of the lower computer; in response to the start signal, the lower computer is controlled to perform security processing on the data to be processed according to the executable code of the lower computer, and the security processing result is returned to the upper computer; the above scheme is adopted to provide a set of low-cost security data processing system, which reduces the requirements on the host processing capability while improving data security; thereby solving the problem in the related technology that if the existing security data processor wants to meet the high performance requirements, it will cause the circuit to be difficult to update or the cost to be high.

[0066] An embodiment of the present application further provides a storage medium, which includes a stored program, wherein the program executes any of the above methods when it is run.

[0067] Optionally, in this embodiment, the storage medium may be configured to store program codes for executing the following steps:

[0068] S1, the control program compiler compiles the source code to obtain the executable code of the upper computer and the executable code of the lower computer;

[0069] S2, when the upper computer receives the data to be processed, controlling the upper computer to send the data to be processed and a start signal to the lower computer according to the executable code of the upper computer, wherein the start signal is used to start executing the executable code of the lower computer;

[0070] S3, in response to the start signal, controlling the lower computer to perform security processing on the data to be processed according to the executable code of the lower computer, and returning the security processing result to the upper computer.

[0071] In an exemplary embodiment, the computer-readable storage medium may include, but is not limited to, various media that can store computer programs, such as a USB flash drive, a read-only memory (ROM), a random access memory (RAM), a mobile hard disk, a magnetic disk or an optical disk.

[0072] For specific examples in this embodiment, reference may be made to the examples described in the above embodiments and exemplary implementation modes, and this embodiment will not be described in detail herein.

[0073] An embodiment of the present application further provides an electronic device, including a memory and a processor, wherein a computer program is stored in the memory, and the processor is configured to run the computer program to execute the steps in any one of the above method embodiments.

[0074] Optionally, in this embodiment, the processor may be configured to perform the following steps through a computer program:

[0075] S1, the control program compiler compiles the source code to obtain the executable code of the upper computer and the executable code of the lower computer;

[0076] S2, when the upper computer receives the data to be processed, controlling the upper computer to send the data to be processed and a start signal to the lower computer according to the executable code of the upper computer, wherein the start signal is used to start executing the executable code of the lower computer;

[0077] S3, in response to the start signal, controlling the lower computer to perform security processing on the data to be processed according to the executable code of the lower computer, and returning the security processing result to the upper computer.

[0078] Optionally, the electronic device may further include a transmission device and an input / output device, wherein the transmission device is connected to the processor, and the input / output device is connected to the processor.

[0079] Optionally, the specific examples in this embodiment may refer to the examples described in the above embodiments and optional implementation modes, and this embodiment will not be described in detail here.

[0080] Obviously, those skilled in the art should understand that the above modules or steps of the present application can be implemented with a general computing system, they can be concentrated on a single computing system, or distributed on a network composed of multiple computing systems, and optionally, they can be implemented with program codes executable by the computing system, so that they can be stored in a storage system and executed by the computing system, and in some cases, the steps shown or described can be executed in a different order from that herein, or they can be made into individual integrated circuit modules, or multiple modules or steps therein can be made into a single integrated circuit module for implementation. Thus, the present application is not limited to any specific combination of hardware and software.

[0081] The above description is only the preferred embodiment of the present application and is not intended to limit the present application. For those skilled in the art, the present application may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the principles of the present application shall be included in the protection scope of the present application.

Claims

1. A data security processing system, characterized in that: include: A program compiler is used to compile the source code to obtain the executable code of the upper computer and the executable code of the lower computer; The upper computer is connected to the program compiler and is used to send the data to be processed and a start signal to the lower computer according to the executable code of the upper computer when receiving the data to be processed, wherein the start signal is used to start executing the executable code of the lower computer; The lower computer is connected to the upper computer and is used to respond to the start signal, perform security processing on the data to be processed according to the executable code of the lower computer, and return the security processing result to the upper computer.

2. The data security processing system according to claim 1, characterized in that: The lower computer comprises: An instruction storage unit is used to store the executable code of the lower computer. When receiving the data to be processed and the start signal, the instruction storage unit stores the data to be processed in response to the start signal, and sends the data to be processed in groups to the instruction decoding unit by executing the executable code of the lower computer, wherein each group of the data to be processed after grouping includes at least instruction data.

3. The data security processing system according to claim 2, characterized in that: The lower computer comprises: An instruction decoding unit is connected to the instruction storage unit and is used to decode the instruction data in each group of data to be processed when receiving the grouped data to be processed, obtain an operation control signal corresponding to the instruction data, and send the operation control signal and the sub-data to be processed corresponding to the instruction data to the security operation core.

4. The data security processing system according to claim 3, characterized in that: The instruction decoding unit is also used to parse the instruction data to obtain the operation code of the instruction data; identify the operation code to determine the number of operands and the addressing method of the operands, and the instruction type of the instruction data; obtain the operands according to the number of operands and the addressing method, and generate the operation control signal according to the instruction type and the operands.

5. The data security processing system according to claim 3, characterized in that: The lower computer comprises: The security operation core is connected to the instruction decoding unit and is used to perform security processing on the sub-data to be processed according to the operation control signal when the operation control signal and the sub-data to be processed are received, and return the security processing result to the host computer when the security processing result is obtained.

6. The data security processing system according to claim 5, characterized in that: The security computing kernel includes: The command manager is used to perform permission verification on the first object when receiving the operation control signal; when the first object passes the permission verification, securely process the sub-data to be processed according to the operation control signal, wherein the sub-data to be processed is initiated by the first object.

7. The data security processing system according to claim 6, characterized in that: The security computing kernel includes: There are multiple security logic computing units, which are connected to the command manager and are used to perform data segmentation on the sub-data to be processed when the sub-data to be processed is received, so as to obtain multiple work items, wherein the multiple security logic computing units correspond one-to-one to the multiple work items; the multiple work items are processed in parallel through the operation control signal and the multiple security logic computing units to obtain multiple sub-processing results; and the multiple sub-processing results are merged to obtain the security processing result.

8. A data security processing method, applied to the data security processing system according to any one of claims 1 to 7, characterized in that: include: The control program compiler compiles the source code to obtain the executable code of the upper computer and the executable code of the lower computer; When the host computer receives the data to be processed, controlling the host computer to send the data to be processed and a start signal to the slave computer according to the executable code of the host computer, wherein the start signal is used to start executing the executable code of the slave computer; In response to the start signal, the lower computer is controlled to perform security processing on the data to be processed according to the executable code of the lower computer, and the security processing result is returned to the upper computer.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium includes a stored program, wherein the program executes the method of claim 8 when executed.

10. An electronic device comprising a memory and a processor, characterized in that: A computer program is stored in the memory, and the processor is configured to execute the method of claim 8 through the computer program.

Images