Business processing method and device

Abstract

The invention discloses a service processing method and device, relates to the technical field of security, can meet the information security requirement of a functional security operating system, improves the security of service processing, and is easy to implement. According to the method, a functional security operating system (a first security operating system) with high functional security and high information security requirements can be migrated to a security world, and high-security and high-credibility services can be processed in the security world. A functional secure operating system (second secure operating system) deployed in a non-secure world can access a TEEOS to execute services through a secure TEE proxy technology, or access a local secure service to execute services.

Description

Technical Field

[0001] The present application relates to the field of security technology, and in particular to a business processing method and device. Background Art

[0002] In the related technology, the same hardware platform can support the hosting of heterogeneous operating systems to achieve the integration of computing units and the sharing of computing power. Among them, different operating systems have different functional safety and information security requirements. For some functional safety operating systems (safetyOS), both functional safety and information security attributes are required. Among the current heterogeneous operating systems, the functional safety operating system cannot independently access the trusted execution environment operating system, and it is difficult to meet the information security requirements of the functional safety operating system. Summary of the invention

[0003] The present application provides a business processing method and device, which can meet the information security requirements of a functional safety operating system, improve the security of business processing, and are easy to implement.

[0004] In order to achieve the above objectives, the present application provides the following technical solutions:

[0005] In a first aspect, the present application provides a business processing method, which is applied to a secure and trusted device, wherein the secure and trusted device includes a first secure operating system migrated from a non-secure world to a secure world, and the first secure operating system is isolated from a trusted execution environment operating system in the secure world, and the method includes: obtaining a request to execute a high-security and high-trust business; the request to execute the high-security and high-trust business includes a cryptographic request for the high-security and high-trust business; the cryptographic request includes at least one of an encryption request, a decryption request, a key export request, and a key generation request; executing the cryptographic request through a local trusted application; the trusted application sends the execution result of the cryptographic request to the high-security and high-trust application; the high-security and high-trust application executes the high-security and high-trust business according to the execution result of the cryptographic request.

[0006] The first security operating system is migrated to the secure world. The first security operating system can be an intelligent driving domain operating system. The intelligent driving domain operating system includes trusted applications and high-security and high-trust applications. The high-security and high-trust applications in the intelligent driving domain operating system issue a request to execute a high-security and high-trust business. The request includes a cryptographic request for a high-security and high-trust business, such as an encryption request. The encryption request is executed by a local trusted application to encrypt high-security and high-trust business data. The trusted application sends the encrypted high-security and high-trust business data to the high-security and high-trust application, and then the high-security and high-trust application executes the high-security and high-trust business. The high-security and high-trust application ensures the trusted security of the business through the trusted services provided in the trusted application. In addition, the high-security and high-trust application and the trusted application are located in the same system. The high-security and high-trust application can directly send the cryptographic request to the trusted application for execution and obtain the execution result, thereby ensuring the functional safety of the business. The information security requirements of the functional safety operating system are met. The isolation of the intelligent driving domain operating system from the trusted execution environment operating system in the secure world can prevent data leakage between systems, further improving the security of the method. Furthermore, this method migrates the first secure operating system to the secure world, has a high development cost and small resource usage, can evolve over a long period of time, and is easy to implement.

[0007] In one possible implementation, the high-security and high-trust business includes an autonomous driving safety business.

[0008] Optionally, the intelligent driving domain operating system includes autonomous driving safety services, such as automatic braking services, automatic cruise control services, automatic steering services, and automatic parking services.

[0009] On the second aspect, the present application provides a business processing method, which is applied to a secure and trusted device, wherein the secure and trusted device includes a trusted execution environment operating system of a secure world and a third operating system and a second secure operating system of a non-secure world. The method includes: obtaining a request to execute a business; sending the business request to the trusted execution environment operating system or a local security service based on the trust requirements and performance requirements of the business request, wherein the business request is used to trigger the trusted execution environment operating system that receives the business request, or the local security service to execute the business.

[0010] Optionally, the second secure operating system may be an instrument domain operating system, which includes secure and trusted applications, a security service scheduling module, a local security service module, etc. The secure and trusted application may send a request to execute a service to the security service scheduling module. After receiving the request to execute a service, the security service scheduling module may send the service request to the trusted execution environment operating system or the local security service according to the trust requirements and performance requirements of the service request. The trusted execution environment operating system or the local security service may execute the above service.

[0011] Optionally, the meter domain operating system may also include a cross-domain communication component for forwarding service requests.

[0012] In this way, business requests with different requirements are sent to different operating systems for execution, which can improve the security of business performance and improve efficiency. The security service scheduling module sends business requests to the trusted execution environment operating system or local security service according to the trust requirements and performance requirements of the business requests, and the process has little interference with users, thereby optimizing the overall system architecture and providing better services and user experience.

[0013] In one possible implementation, the business request is sent to the trusted execution environment operating system, or the business request is sent to the local security service based on the trust requirements and performance requirements of the business request, including: if the trust requirements of the business are greater than the performance requirements, the business request is encrypted and the encrypted business request is sent to the trusted execution environment operating system; if the performance requirements of the business request are greater than the trust requirements, the business request is sent to the local security service.

[0014] In this way, for business requests with higher trust requirements, they are encrypted and sent to the trusted execution environment operating system, which executes the business, which can prevent business data leakage, improve the security of business transmission, and ensure the trust and security of the business. For business requests with higher performance security, they are sent to the local security service, which executes the business. The efficiency and performance of business execution are improved.

[0015] Exemplarily, the service request with a trust requirement greater than the performance requirement may be a trusted service request for a real-time traffic condition and navigation display service, and the encrypted trusted service request for the real-time traffic condition and navigation display service is sent to the trusted execution environment operating system. The trusted execution environment operating system executes the real-time traffic condition and navigation display service.

[0016] The service request with a performance requirement greater than a trust requirement may be a request for an audio and multimedia control service, and the request for the audio and multimedia control service is sent to a local software algorithm, which executes the audio and multimedia control service.

[0017] In a possible implementation, the service includes a trusted and secure security instrument display service.

[0018] Exemplarily, the trusted and secure safety instrument display service may include audio and multimedia control services, real-time traffic conditions and navigation display services, etc.

[0019] On the third aspect, the present application provides a business processing method, which is applied to a secure and trusted device, wherein the secure and trusted device includes a trusted execution environment operating system of a secure world and a third operating system and a second secure operating system of a non-secure world. The method includes: a proxy client application of the third operating system receives a first request from the second secure operating system, wherein the first request is an encrypted request; the proxy client application of the third operating system sends the first request to the trusted execution environment operating system; the proxy client application is isolated from other applications and / or components of the third operating system.

[0020] Among them, the first request is an encrypted request, which can ensure the security of the request, and the proxy client application is isolated from other applications and / or components of the third operating system to prevent the first request data of the proxy client application from being leaked, further improving the security of the first request.

[0021] Optionally, the third operating system may be an entertainment domain operating system, which further includes a cross-domain notification component for receiving a first request from the second security operating system and sending the first request to a proxy client application. The proxy client application may call a trust zone driver module to send the first request to a trusted execution environment operating system.

[0022] Exemplarily, the first request may be a trusted service request for real-time traffic conditions and navigation display services.

[0023] In a possible implementation manner, the first request includes a request to execute a trusted and secure safety instrument display service.

[0024] Exemplarily, the safety instrument display service includes real-time traffic and navigation display service, user behavior analysis service, etc.

[0025] In a fourth aspect, the present application provides a business processing method, which is applied to a secure and trusted device, wherein the secure and trusted device includes a trusted execution environment operating system of a secure world and a third operating system and a second secure operating system of a non-secure world, and the method includes: the trusted execution environment operating system receives a first request from the second secure operating system, and the first request is an encrypted request; the first request includes a request to execute a first business; the first request is decrypted, and the first business is executed to obtain an execution result of the first business; the execution result of the first business is encrypted and returned to the second secure operating system.

[0026] The first request is an encrypted request, which ensures the security of the first request, and the first service comes from the second security operating system, which ensures the functional security of the first service. The trusted execution environment operating system executes the first service, which ensures the trusted security of the first service. The information security requirements of the functional safety operating system are met.

[0027] Exemplarily, the trusted execution environment operating system can be a secure domain operating system. The secure domain operating system receives a trusted service request (first request) for real-time traffic conditions and navigation display services. After decrypting the request, the secure domain operating system executes the real-time traffic conditions and navigation display services, obtains the execution result, and returns it to the instrument domain operating system (second secure operating system) after encryption.

[0028] In one possible implementation, the trusted execution environment operating system receives a first request from a second secure operating system, including: the trusted execution environment operating system receives the first request from the second secure operating system through a third operating system.

[0029] In a possible implementation manner, the first service includes a trusted and secure security instrument display service.

[0030] Exemplarily, the safety instrument display service includes real-time traffic and navigation display service, user behavior analysis service, etc.

[0031] In a fifth aspect, the present application provides a business processing device, which is applied to a secure and trusted device, and the secure and trusted device includes a first secure operating system migrated from a non-secure world to a secure world, and the first secure operating system is isolated from a trusted execution environment operating system in the secure world; the first secure operating system is used to obtain a request to execute a high-security and high-trust business; the first secure operating system is also used to encrypt the request for the high-security and high-trust business through a local trusted application; the first secure operating system is also used to send the encrypted request to the high-security and high-trust application through the trusted application; the first secure operating system is also used to execute the high-security and high-trust business through the high-security and high-trust application in response to the encrypted request.

[0032] In one possible implementation, the high-security and high-trust business includes an autonomous driving safety business.

[0033] In the sixth aspect, the present application provides a business processing device, which is applied to a secure and trusted device. The secure and trusted device includes a trusted execution environment operating system of the secure world and a third operating system and a second secure operating system of the non-secure world. The device includes: a second secure operating system, which is used to obtain a request to execute a business; the second secure operating system is also used to send the business request to the trusted execution environment operating system or the local security service according to the trust requirements and performance requirements of the business request, and the business request is used to trigger the trusted execution environment operating system or the local security service to receive the business request to execute the business.

[0034] In one possible implementation, the second secure operating system is also used to: encrypt the business if the trust requirement of the business request is greater than the performance requirement, and send the encrypted business request to the trusted execution environment operating system for execution; if the performance requirement of the business request is greater than the trust requirement, send the business request to the local security service for execution.

[0035] In a possible implementation, the service includes a trusted and secure security instrument display service.

[0036] In the seventh aspect, the present application provides a business processing device, which is applied to a secure and trusted device, and the secure and trusted device includes a trusted execution environment operating system of the secure world and a third operating system and a second secure operating system of the non-secure world. The device includes: the third operating system is used to receive a business request from the second secure operating system, and the first request is an encrypted request; wherein the application that receives the business request is a proxy client application of the third operating system; the third operating system is also used to send the business request to the trusted execution environment operating system; the proxy client application is isolated from other applications and / or components of the third operating system.

[0037] In a possible implementation manner, the first request includes a request to execute a trusted and secure safety instrument display service.

[0038] In an eighth aspect, the present application provides a business processing device, which is applied to a secure and trusted device, wherein the secure and trusted device includes a trusted execution environment operating system of a secure world and a third operating system and a second secure operating system of a non-secure world. The device is also used for: the trusted execution environment operating system is used to receive a first request from the second secure operating system, wherein the first request is an encrypted request; the first request includes a request to execute a first business; the trusted execution environment operating system is also used to decrypt the first request, execute the first business, and obtain an execution result of the first business; the trusted execution environment operating system is also used to encrypt the execution result of the first business and return it to the second secure operating system.

[0039] In a possible implementation, the trusted execution environment operating system is further configured to receive the first request from the second secure operating system through a third operating system.

[0040] In a possible implementation manner, the first service includes a trusted and secure security instrument display service.

[0041] In a ninth aspect, the present application provides an electronic device for business processing, comprising a first secure operating system, a second secure operating system, a third operating system, and a trusted execution environment operating system; the electronic device executes any one of the methods described in the first to fourth aspects above.

[0042] In the tenth aspect, the present application provides a business processing system, comprising: a processor, the processor being coupled to a memory; the processor being used to execute a computer program stored in the memory so that the electronic device health assessment system performs the methods described in the first to fourth aspects.

[0043] In the eleventh aspect, the present application provides a computer-readable storage medium, which includes a computer program or instructions. When the computer program or instructions are executed on a business processing device, the business processing device executes the methods described in the first to fourth aspects.

[0044] In the twelfth aspect, the present application provides a chip system comprising at least one processor and at least one interface circuit, wherein the at least one interface circuit is used to perform transceiver functions and send instructions to at least one processor, and when the at least one processor executes the instructions, the at least one processor executes a method as described in any one of the first to fourth aspects above.

[0045] In a thirteenth aspect, the present application also provides a computer program product, comprising instructions, which, when executed on a computer, enables the computer to execute a method as described in any one of the first to fourth aspects.

[0046] In a fourteenth aspect, an embodiment of the present application provides a circuit system, the circuit system includes a processing circuit, and the processing circuit is configured to execute the method of any one of the implementations in the first aspect or the first to fourth aspects.

[0047] The technical effects corresponding to the fifth to eighth aspects and any one of the implementation methods of the fifth to eighth aspects may refer to the technical effects corresponding to the above-mentioned first to fourth aspects and any one of the implementation methods of the first to fourth aspects; the technical effects corresponding to the ninth to fourteenth aspects and any one of the implementation methods of the ninth to fourteenth aspects may refer to the technical effects corresponding to the above-mentioned first to fourth aspects and any one of the implementation methods of the first to fourth aspects, and will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] Figure 1 A schematic diagram of the architecture of an operating system provided in an embodiment of the present application;

[0049] Figure 2 A schematic diagram of the architecture of another operating system provided in an embodiment of the present application;

[0050] Figure 3 A schematic diagram of the architecture of another operating system provided in an embodiment of the present application;

[0051] Figure 4A schematic diagram of the architecture of another operating system provided in an embodiment of the present application;

[0052] Figure 5 A schematic diagram of the architecture of another operating system provided in an embodiment of the present application;

[0053] Figure 6 A flowchart of a business processing method provided in an embodiment of the present application

[0054] Figure 7 A schematic diagram of a service scheduling process provided in an embodiment of the present application;

[0055] Figure 8 A flowchart of a business processing method provided in an embodiment of the present application;

[0056] Fig. 9 A schematic diagram of a flow chart of an encryption method provided in an embodiment of the present application;

[0057] Fig.10 A flowchart of another business processing method provided in an embodiment of the present application;

[0058] Fig.11 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application;

[0059] Fig.12 A schematic diagram of the structure of a chip system provided in an embodiment of the present application. DETAILED DESCRIPTION

[0060] The terms "including" and "having" and any variations thereof mentioned in the description of the embodiments of the present application are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device including a series of steps or units is not limited to the listed steps or units, but may optionally include other steps or units that are not listed, or may optionally include other steps or units that are inherent to these processes, methods, products or devices.

[0061] It should be noted that, in the embodiments of the present application, words such as "exemplary" or "for example" are used to indicate examples, illustrations or descriptions. Any embodiment or design described as "exemplary" or "for example" in the embodiments of the present application should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of words such as "exemplary" or "for example" is intended to present related concepts in a specific way.

[0062] In the description of the embodiments of the present application, unless otherwise specified, the meaning of "multiple" refers to two or more. The "and / or" in this article is only a description of the association relationship of the associated objects, indicating that there can be three relationships. For example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone.

[0063] First, some technical terms involved in the embodiments of the present application are introduced:

[0064] 1. Virtual machine (VM) technology: In this technology, independent virtual computers can be created based on hypervisor virtualization technology. The created virtual computers can be referred to as virtual machines. Multiple virtual machines can be isolated from each other. An operating system can be installed in a virtual machine, and applications can be run in the operating system.

[0065] 2. TrustZone Technology:

[0066] Through TrustZone technology, the computer system can be physically isolated into a secure world and a non-secure world to protect the security and integrity of data and prevent data from being attacked maliciously. Based on the trust zone technology, electronic devices (such as mobile phones, tablets, car-mounted devices, etc.) isolate system resources into two worlds, the non-secure world (normal world) and the secure world (secure world). A rich execution environment (REE) runs in the non-secure world. A trusted execution environment (TEE) runs in the secure world.

[0067] REE is also called common execution environment, which includes rich execution environment operating system (REE OS) and client application (CA) running on general-purpose processor.

[0068] It should be noted that REE does not mean that the operating system or software running in it is malicious, but that the security of REE is lower than that of TEE. Generally, the business of the operating system located in REE can call the TA service in TEE to ensure the trustworthiness and security of the business.

[0069] TEE, also known as secure execution environment, can run a trusted execution environment operating system (TEE OS) to provide CA with reliable trusted security services (such as fingerprint matching services, password verification services, face matching services, etc.). These trusted security services can run on TEE OS in the form of trusted applications (TA).

[0070] TEE can be applied to one or more of the following purposes: 1. Content protection mechanism: for some high-definition movies, music, etc., to prevent others from using them. 2. Mobile financial services: mobile payment, etc. 3. Authentication: fingerprint recognition, facial recognition, etc. 4. Protection of confidential information for enterprises or governments.

[0071] As a possible implementation method, the trust zone mechanism can set the security-sensitive memory as secure memory by configuring the trust zone address space control (TZASC) register and the trust zone memory adapter (TZMA) register, so that REE cannot access this memory.

[0072] Optionally, in the non-secure world, there may be three working modes, namely, exception level 0 (EL0), exception level 1 (EL1) and exception level 2 (EL2). EL0 mode refers to a mode for running user programs, and EL1 mode refers to a mode for running the kernel of an operating system. EL2 mode refers to a mode for running a virtual machine monitor. The exception level of EL1 mode is higher than that of EL0 mode, and the exception level of EL2 mode is higher than that of EL1 mode.

[0073] Optionally, there are three working modes in the secure world, namely, secure state exception level 2 (secure state, exception level 3, SEL2) mode, secure state exception level 1 (secure state, exception level 1, SEL1) mode, and secure state exception level 0 (secure state, exception level 0, SEL0) mode. Among them, SEL0 mode refers to a mode for running user programs, and SEL1 mode refers to a mode for running the kernel of an operating system. SEL2 mode refers to a mode for running a virtual machine monitor. Among them, the secure state exception level of SEL1 mode is higher than that of SEL0 mode, and the secure state exception level of SEL2 mode is higher than that of SEL1 mode.

[0074] 3. Vehicle functional safety integrity level (ASIL):

[0075] The vehicle functional safety standard ISO26262 defines the vehicle safety integrity level, which is divided into four levels from low to high: ASIL-A, ASIL-B, ASIL-C, and ASIL-D. The greater the security risk of the operating system, the higher the corresponding functional safety requirement level, and the higher the security protection required.

[0076] A service processing method and device provided in an embodiment of the present application are described in detail below with reference to the accompanying drawings.

[0077] In one embodiment, in scenarios such as in-vehicle scene virtualization, in-vehicle scene containerization, and mobile terminal devices, it is supported to carry heterogeneous operating systems on the same hardware platform. Taking in-vehicle scene virtualization as an example, in the intelligent driving scenario, it is necessary to deploy safetyOS that carries real-time and safe autonomous driving services and a general OS that carries intelligent vehicle control services. In the smart cockpit scenario, it is necessary to deploy safetyOS that carries safety instrument displays and a general OS that carries entertainment applications.

[0078] like Figure 1As shown in the figure, the deployment of the operating system for the intelligent driving scenario and the intelligent cockpit scenario in the vehicle scenario. Among them, the functional safety level requirement of the intelligent driving domain can be ASIL-D. The intelligent driving scenario includes a trusted execution environment operating system, a secure operating system, and a general operating system. The trusted execution environment operating system can ensure the trusted security of the applications and services therein, in which trusted applications are deployed. The secure operating system can ensure the functional safety of the applications and services in the operating system, in which high-security and high-trust applications related to autonomous driving are deployed. High-security and high-trust applications can call the confidential services provided by the trusted applications in the trusted execution environment to achieve the trusted goals.

[0079] Among them, trusted security refers to the integrity, confidentiality and availability of applications, services, data, etc. in the operating system, preventing unauthorized access, data leakage, malicious attacks and other security threats, and ensuring the stable operation and reliability of the operating system.

[0080] Functional safety means that the operating system can maintain safe operation in the event of a fault or error and avoid unacceptable risks to personnel, the environment or property. The operating system includes functional safety features such as fault detection, fault tolerance, self-diagnosis and correction to ensure that the operating system can maintain a safe state in the event of a fault.

[0081] Optionally, the functional safety level of the safety operating system can be ASIL-B. There is no requirement for functional safety and trusted safety in general operating systems, in which applications such as software upgrades, data downloads, and data uploads are deployed.

[0082] The smart cockpit scenario includes a trusted execution environment operating system, a secure operating system, and a general operating system. The general operating system in the smart cockpit scenario can be the same or different from the general operating system in the smart driving scenario.

[0083] Optionally, the trusted execution environment can ensure the trusted security of applications and services in the operating system, in which trusted applications are deployed. The secure operating system can ensure the functional security of applications and services in the operating system, in which secure and trusted instrument applications are deployed, such as automobile instrument display applications, navigation applications, etc.

[0084] Optionally, the functional safety level of the safety operating system of the smart cockpit scenario and the functional safety level of the smart cockpit scenario can both be ASIL-B.

[0085] Optional, general operating system for smart cockpit scenario, general operating system for smart driving scenario has no functional safety and trusted safety requirements. Among them, entertainment-related applications, such as music applications, are deployed in the general operating system for smart cockpit scenario.

[0086] Optionally, the hardware devices in the security operating system of the smart cockpit scenario, the general operating system of the smart cockpit scenario, the security operating system of the smart driving scenario, and the general operating system of the smart driving scenario can all be managed uniformly using a virtual machine monitor (VMM) (also called a hypervisor), and the hardware devices can be shared or exclusively used by a virtual machine in a shared or direct manner.

[0087] Optionally, ARM TrustZone Firmware (ATF) runs on the TrustZone in the architecture to manage communication and resource access between the secure world (trusted execution environment operating system) and the non-secure world (secure operating system and general operating system Android) in the smart driving scenario and the smart cockpit scenario.

[0088] In the deployment method of the operating systems for the above-mentioned intelligent driving scenarios and intelligent cockpit scenarios, the functional safety operating system cannot directly access TEEOS to complete the information security service call, so it is difficult to meet the information security requirements of the functional safety operating system.

[0089] In related technologies, technicians can use TEE proxy technology to enable functional safety operating systems to access TEEOS to meet the information security requirements of functional safety operating systems. Figure 2 As shown in the figure, the general operating system can directly access TEEOS through the hypervisor and ATF, and call the TA in TEEOS to complete the information security business. The functional safety operating system sends the request to access TEEOS to the general operating system through the communication channel between the functional safety operating system and the general operating system. The general operating system accesses TEEOS on behalf of the safety operating system and calls the TA in TEEOS to complete the information security business. However, in the vehicle scenario where CPU and memory resources are relatively tight, if all Tee requests of the operating system are executed by proxy, the overhead is large. The proxy channel is also vulnerable to external attacks, resulting in data leakage.

[0090] Alternatively, technicians can implement functional safety operating system access to TEEOS through TEE virtualization technology based on secure state, exception level 2 (SEL2) to meet the information security requirements of functional safety operating system. Figure 3As shown in the figure, the virtualization technology of the secure world can deploy multiple TEEOS in the secure world, and each operating system has a dedicated TEEOS. The general operating system can directly access TEEOS0 through the hypervisor and ATF, and the functional safety operating system can directly access TEEOS1 through the hypervisor and ATF. If the car includes multiple general operating systems and multiple functional safety operating systems, multiple TEEOS are required, which has high development costs and large resource usage, is not easy to implement, and is difficult to evolve in the long term.

[0091] Alternatively, technicians can use Mediator-based TEE virtualization technology to enable functional safety operating systems to access TEEOS to meet the information security requirements of functional safety operating systems. Figure 4 As shown in the figure, multiple operating systems in the non-secure world communicate with a TEEOS in the secure world through the Mediator in the Hypervisor. The Mediator can implement TA process-level isolation to ensure the normal progress of the requested business. However, technicians need to modify the Hypervisor and TEEOS at the same time, and the coupling requirements between multiple components are too high and difficult to achieve.

[0092] To solve the above problems, an embodiment of the present application provides a business processing method. This method can meet the information security requirements of a functional safety operating system. Migrate a functional safety operating system (first safety operating system) with high functional safety and high information security requirements in the non-safe world to the safe world. In this way, the functional safety operating system can directly call the local TA of the safe world to complete high functional safety and high information security services (high security and high trust services). For a functional safety operating system (second safety operating system) deployed in the non-safe world, TEEOS can be accessed through secure TEE proxy technology to meet the information security requirements of the functional safety operating system. Alternatively, a functional safety operating system deployed in the non-safe world can also access local security services to meet the information security requirements of the functional safety operating system. It can be seen that the technical solution of the embodiment of the present application can meet the information security requirements of the functional safety operating system and is easy to implement.

[0093] Optionally, the service processing method may also be a request processing method in a service, wherein the operating system may execute the service or respond to the request, and the embodiments of the present application do not impose any specific restrictions on this.

[0094] Optionally, the service processing method is applied in a vehicle-mounted scenario. The vehicle system includes an intelligent driving domain operating system, a security domain operating system, an entertainment domain operating system, and an instrument domain operating system. It should be understood that the vehicle may also include other operating systems, and the embodiments of the present application do not specifically limit this.

[0095] Among them, the intelligent driving domain operating system is used to carry high-security and high-reliability services. For example, real-time autonomous driving services, to achieve autonomous navigation, control and operation of the vehicle, and complete functions such as automatic braking, automatic steering and automatic parking; high-precision maps and positioning services, to provide detailed information such as the vehicle's location, road environment, traffic signs, etc., to support autonomous driving services. Driving behavior analysis services, to analyze and evaluate the driver's behavior in real time. For example, detecting the driver's fatigue level, concentration, etc. It should be understood that the automotive intelligent driving domain operating system may also include other services, and this application does not impose specific restrictions on this.

[0096] The security domain operating system is used to carry highly reliable cryptography-related services. For example, encryption and decryption services ensure the security of sensitive data during transmission and storage by encrypting and decrypting sensitive data. Key management services provide secure key generation, storage and distribution mechanisms to ensure the confidentiality and integrity of keys. Security protocol implementation services implement various security protocols, such as the secure sockets layer (SSL) protocol to protect the security of network communications and the Internet protocol security (IPSec) to protect the security of network layer data. These protocols rely on cryptographic algorithms and key management services, and are implemented and managed in the security domain operating system. It should be understood that the automotive safety domain operating system may also include other services, and this application does not impose specific restrictions on this.

[0097] The entertainment domain operating system is used to carry general rich-ecosystem entertainment services and multimedia services, and provides a secure service proxy channel for other operating systems in the non-secure world through secure TEE proxy technology. For example, in the car audio service, the driver can play music, broadcast, etc. In the entertainment media service, the driver or passengers can watch movies, play videos, play games, etc. It should be understood that the car entertainment domain operating system may also include other services, and this application does not make specific restrictions on this.

[0098] The instrument domain operating system is used to carry real-time safety instrument display related services with functional safety requirements. For example, the speed and rotation speed display service is used to display the current speed of the vehicle and the current speed of the engine. The temperature and pressure monitoring service is used to monitor the temperature and pressure of the vehicle in real time and remind the driver in abnormal situations. Real-time traffic and navigation display services, the vehicle dashboard can display traffic information and navigation instructions in real time, including real-time traffic conditions, navigation maps and turn instructions, etc., to help the driver choose the best route and navigate. Among them, the real-time traffic and navigation display services involve functions such as path planning algorithms and real-time user positioning. Audio and multimedia control services, for example, audio and multimedia control buttons or touch screens integrated on the vehicle dashboard are used to adjust the volume, switch radio stations, select music playlists, etc., to provide convenient and safe audio and entertainment operations. It should be understood that the automotive instrument domain operating system may also include other services, and this application does not impose specific restrictions on this.

[0099] Optionally, the embodiment of the present application can use virtualization technology to virtualize multiple operating systems in the vehicle scene, and then deploy operating systems with different security levels on different virtual devices. The hardware of the entire system is managed uniformly by a virtual machine monitor (VMM) (also called a hypervisor), and the hardware devices can be shared or exclusively used by a virtual machine (VM) in a shared or direct manner. In this solution, different operating systems are deployed in different virtual machines.

[0100] Exemplarily, the intelligent driving domain operating system is deployed in virtual machine 1 of the secure world; the security domain operating system is deployed in virtual machine 0 of the secure world; the entertainment domain operating system is deployed in virtual machine 1 of the non-secure world; and the instrument domain operating system is deployed in virtual machine 0 of the non-secure world.

[0101] Optionally, the embodiment of the present application can deploy a secure hypervisor based on the SEL2 hardware characteristics to isolate multiple VMs in the secure world. And deploy a non-secure hypervisor to isolate multiple VMs in the non-secure world. Each VM is isolated to ensure the security of data in the VM.

[0102] The method provided in the embodiments of the present application is described below with reference to the accompanying drawings.

[0103] like Figure 5The figure is a schematic diagram of the operating system architecture of the embodiment of the present application. Among them, the first secure operating system and the trusted execution environment operating system are located in the secure world, and the third operating system and the second secure operating system are located in the non-secure world. For other components in the operating system and the connection relationship between the components, please refer to the following examples. Figure 7 , Figure 8 The architecture shown will not be described in detail.

[0104] refer to Figure 5 For the first secure operating system (functionally secure operating system) deployed in the secure world, the local TA of the secure world is called to encrypt high-security and high-trust services. Optionally, the TA in the first secure operating system can also be used to decrypt high-security and high-trust services, perform key derivation, key generation, etc. This application takes the encryption of high-security and high-trust services by trusted applications as an example.

[0105] Optionally, the first security operating system includes multiple high-security and high-trust applications (high functional safety and high information security applications), and the high-security and high-trust applications can call the local TA encryption high-security and high-trust services of the security world. Exemplarily, the first security operating system can be an intelligent driving domain operating system.

[0106] Taking the first security operating system as the intelligent driving domain operating system as an example, the intelligent driving domain operating system is installed in VM1 of the security world. The intelligent driving domain operating system is installed with an autonomous driving application, and a trusted application is also installed in VM1.

[0107] like Figure 6 As shown, the process of the intelligent driving domain operating system executing high-security and high-trust services may include the following steps S201-S204:

[0108] S201. The high-security and high-trust application sends a request to encrypt high-security and high-trust business data to a local trusted application.

[0109] Optionally, the high-security and high-trust application in the intelligent driving domain operating system can initiate a request to encrypt high-security and high-trust business data to the trusted application. For example, the autonomous driving application in the intelligent driving domain operating system sends a request to encrypt automatic braking business data, and sends the encrypted business data request to the trusted application of the intelligent driving domain operating system.

[0110] S202. The local trusted application encrypts the high-security and high-trust business data to obtain the encrypted high-security and high-trust business data.

[0111] Optionally, after receiving the request to encrypt the high-security and high-trustworthiness business data, the local trusted application encrypts the high-security and high-trustworthiness business data in response to the request to obtain the encrypted high-security and high-trustworthiness business data.

[0112] Exemplarily, after the local trusted application receives a request to encrypt the automatic braking business data, the trusted application responds to the request and encrypts the automatic braking business data to obtain the encrypted automatic braking business data.

[0113] Optionally, when local trusted applications encrypt business data for automatic braking, they can access the security engine to improve the performance and confidentiality of trusted applications. Optional trusted applications can also access the security engine when performing trusted services such as decryption operations or key derivation to improve the performance and confidentiality of trusted applications.

[0114] S203: The local trusted application returns the encrypted high-security and high-trust business data to the high-security and high-trust application.

[0115] For example, the local trusted application can return the encrypted automatic braking business data to the autonomous driving application.

[0116] S204: The high-security and high-trust application executes the high-security and high-trust service according to the encrypted high-security and high-trust service data.

[0117] Optionally, the local trusted application may return the encrypted request data of the high-security and high-trustworthiness service to the high-security and high-trustworthiness application, and the high-security and high-trustworthiness application executes the high-security and high-trustworthiness service according to the returned service request data.

[0118] Optionally, after receiving the encrypted request data of the high-security and high-trustworthiness service, the high-security and high-trustworthiness application may decrypt the request data of the high-security and high-trustworthiness service, and execute the high-security and high-trustworthiness service according to the decrypted service request data.

[0119] Exemplarily, after receiving the encrypted request data for the automatic braking service, the automatic braking application may decrypt the request data for the automatic braking service, and execute the automatic braking service according to the decrypted request data for the automatic braking service.

[0120] Still refer to Figure 5 For the second safety operating system (functional safety operating system) deployed in the non-safe world, business distribution is carried out according to the performance requirements and trust requirements of the business requests.

[0121] Optionally, the second secure operating system may include secure and trusted applications, a secure service scheduling module, a local secure service module, etc.

[0122] The secure and trusted application may issue a security service request (or security service), and send the security service request to the security service scheduling module.

[0123] The security service scheduling module is used to manage and schedule security-related business requests (service requests). The security service scheduling module receives business from security business requesters and distributes the requests to appropriate security services for execution based on the performance requirements, trust requirements, type, priority and other relevant information of the request. For example, the request is sent to the local security service module or the trusted application of the secure world.

[0124] Among them, the local security service module is a module that provides security service functions in the local environment. The local security service module executes security services in a shorter time and has higher performance.

[0125] Optionally, in the embodiment of the present application, the secure and trusted application may issue a security service request and send the security service request to the security service scheduling module. After receiving the security service request, the security service scheduling module may distribute the security service request according to the performance requirements, trust requirements, etc. of the security service request.

[0126] Optionally, the performance requirements of the security service request (service performance requirements) include the time (response time) requirement for executing the security service, throughput, scalability, etc. Among them, the service usually needs to be executed within a specified time. A high performance requirement for the service means a short time to execute the service, and a low performance requirement for the service means a long time to execute the service. The throughput of the service means the amount of service processed by the operating system per unit time. The scalability of the service means that the operating system can increase or decrease the resources for executing the service according to the growth or decrease of the service.

[0127] Optionally, the performance requirement level of the service can be determined according to the length of time it takes to execute the service. The shorter the time it takes to execute the service, the higher the performance requirement level of the service. The higher the performance requirement level, the higher the corresponding performance requirement. For example, when the time it takes to execute the service is between [0, 0.02] s, the performance requirement level of the service is level 4; when the time it takes to execute the service is between (0, 0.05] s, the performance requirement level of the service is level 3; when the time it takes to execute the service is between (0, 05, 0.1] s, the performance requirement level of the service is level 2; when the time it takes to execute the service is between [0.1, 0.5] s, the performance requirement level of the service is level 1. It should be understood that the above-mentioned division of service performance requirement levels is only an example, and the division of service performance requirement levels can also be in other ways, and the embodiments of the present application do not impose specific limitations on this.

[0128] The trust requirements of security business requests (business trust requirements) include information security, authentication and authorization, security audit and monitoring, etc. during the execution of the business. The higher the trust requirements of the business, the higher the trust security of the business. Among them, the information security during the execution of the business includes the security of user data or data generated during the execution of the business. A high trust requirement of the business means that the information security requirements are high during the execution of the business, and a low trust requirement of the business means that the information security requirements are low during the execution of the business. Authentication and authorization of the business means that the execution of the business requires identity authentication, access permission control, etc. For example, only authorized users can access specific resources, and users need to be authenticated before access. Security audit and monitoring of the business means that the business needs to have a security audit and monitoring mechanism. For example, logging, anomaly detection, intrusion detection and real-time monitoring, etc., to ensure the trust security of the business.

[0129] Optionally, the trust requirements of the business can be divided into different levels.

[0130] For example, for some non-sensitive businesses, the requirements for information security are relatively low, and identity authentication and authorization are not required, and there is no security audit and monitoring, etc., then the trust requirement level of the business is level 1; for some more sensitive businesses, the requirements for information security are relatively high, and identity authentication and authorization, as well as security audit and monitoring, etc. may be required, then the trust requirement level of the business is level 2; for some sensitive businesses, there are more stringent information security requirements, further identity authentication and authorization, and continuous security audit and monitoring, etc. are required, then the trust requirement level of the business is level 3; for some highly sensitive businesses, there are extremely high information security requirements, multiple identity authentication and authorization, as well as continuous and advanced security audit and monitoring, etc. are required, then the trust requirement level of the business is level 4. It should be understood that the above-mentioned division of the business trust requirement level is only an example, and the division of the business trust requirement level can also be in other ways, and the embodiments of the present application do not make specific restrictions on this.

[0131] Optionally, the security service scheduling module distributes services according to the performance requirement level and the trust requirement level of the service requests.

[0132] Optionally, when the performance requirement level of the security service is higher than the trust requirement level, the security service scheduling module may send the request for the service to the local security service module for execution.

[0133] Exemplarily, when the time for executing an audio and multimedia control service (such as clicking a music play button service) needs to be between (0, 0.05]s, the performance requirement level of the audio and multimedia control service is level 3. The audio and multimedia control service is a non-sensitive service with low requirements for information security. It does not require identity authentication and authorization, nor does it have security auditing and monitoring, etc., so the trust requirement level of the audio and multimedia control service is level 1. The performance requirement level of the audio and multimedia control service is higher than the trust requirement level, and the security service scheduling module can send the request for the audio and multimedia control service to the local security service module for execution.

[0134] Optionally, when the trust requirement level of the security service is higher than the performance requirement level, the security service scheduling module may forward the request for the service to the TA of the trusted execution environment operating system for execution through the secure TEE proxy technology.

[0135] Exemplarily, the time for responding to a trusted request for real-time traffic and navigation display services (such as a trusted request for navigation display services) needs to be between (0, 05, 0.1]s, and the performance requirement level of the trusted request for real-time traffic and navigation display services is level 2. Trusted requests for real-time traffic and navigation display services are requests for sensitive services, and have strict information security requirements, requiring further identity authentication and authorization, as well as continuous security auditing and monitoring, etc., then the trusted requirement level of trusted requests for real-time traffic and navigation display services is level 3; the trusted requirement level of trusted requests for real-time traffic and navigation display services is higher than the performance requirement level, and the security service scheduling module forwards the trusted request for real-time traffic and navigation display services to the TA response of the trusted execution environment operating system through the secure TEE proxy technology.

[0136] Optionally, when the trust requirement level of the service is the same as the performance requirement level, the security service scheduling module can forward the service to the TA of the trusted execution environment operating system for execution through the secure TEE proxy technology. Alternatively, the security service scheduling module sends the request for the service to the local security service module. This embodiment of the application does not impose specific restrictions on this.

[0137] Alternatively, when the performance requirement level of the service is higher than or equal to the first threshold and the trust requirement level is lower than the second threshold, the security service scheduling module can send the request for the service to the local security service module. When the trust requirement level of the service is higher than or equal to the second threshold and the performance requirement level is lower than the first threshold, the security service scheduling module can forward the service to the TA of the trusted execution environment operating system for execution through the secure TEE proxy technology.

[0138] Exemplarily, the first threshold is 3, and the second threshold is 2. The performance requirement level for executing audio and multimedia control services is level 3, which is equal to the first threshold 3; the trust requirement level is level 1, which is less than the second threshold 2. Then the security service scheduling module can send the request for audio and multimedia control services to the local security service module. The trust requirement level for the trusted request for executing real-time traffic and navigation display services is level 3, which is higher than the second threshold 3; the performance requirement level is level 2, which is less than the first threshold 3. The security service scheduling module forwards the trusted request for real-time traffic and navigation display services to the TA of the trusted execution environment operating system for execution through the secure TEE proxy technology.

[0139] Optionally, when the performance requirement level of the service is higher than the first threshold and the trust requirement level is higher than the second threshold, the security service scheduling module can forward the service to the TA of the trusted execution environment operating system through the secure TEE proxy technology for execution. Alternatively, the security service scheduling module sends the request for the service to the local security service module. This embodiment of the application does not impose specific restrictions on this.

[0140] In the embodiment of the present application, when the performance requirement level of a service is higher than the trust requirement level, the security service scheduling module sends the request of the service to the local security service module. When the trust requirement level of the service is higher than the performance requirement level, the security service scheduling module forwards the service to the TA of the trusted execution environment operating system through the secure TEE proxy technology for execution as an example.

[0141] Optional, such as Figure 7 As shown, the security service may come from the user state or the kernel state, and the embodiments of the present application do not impose specific restrictions on this.

[0142] Optionally, for security service requests in user mode, security services issued by secure and trusted applications access cryptographic services, and then the security service scheduling module distributes the security services according to the performance requirements and trust requirements of the security services.

[0143] For kernel-mode security service requests, the security service access cryptography subsystem issued by the security trust module is then distributed by the security service scheduling module based on the performance and trust requirements of the security service.

[0144] In one embodiment, if Figure 7 As shown, for services with performance requirements higher than trust requirements, they are executed through local software algorithms.

[0145] Among them, local software algorithms can perform security operations.

[0146] For example, the performance requirements of the audio and multimedia control services deployed in the instrument domain operating system in the non-secure world are higher than the trust requirements, and the audio and multimedia control services are executed through local software algorithms. A larger processing bandwidth and a smaller processing delay can be obtained to meet the performance requirements of the audio and multimedia control services.

[0147] In another embodiment, for business requests with higher trust requirements than performance requirements, secure TEE proxy technology is used to forward the requests to the TA of the trusted execution environment operating system for execution.

[0148] Optionally, the trusted execution environment operating system is taken as the security domain operating system as an example. Figure 8 As shown, when the trust requirement of the service request is higher than the performance requirement, the request for the secure service is forwarded to the TA response of the TEE's security domain operating system through the secure TEE proxy technology.

[0149] For example, the trusted requirements of the trusted requests of the real-time traffic and navigation display services deployed in the instrument domain operating system in the non-secure world are higher than the performance requirements, and the trusted service requests of the real-time traffic and navigation display services need to be forwarded to the TA of the secure domain operating system of the TEE for response, so as to meet the trusted requirements of the trusted requests of the real-time traffic and navigation display services.

[0150] Optionally, the security service scheduling module is also used to encrypt the security service to ensure the security of the service proxy process.

[0151] Optionally, the security service scheduling module can use the advanced encryption standard-galois / counter mode (AES-GCM) symmetric encryption algorithm based on GCM mode to encrypt the commands and data in the trusted request of the real-time traffic and navigation display services. Among them, the symmetric key (proxy tunnel key, PTK) of the AES-GCM symmetric encryption algorithm is negotiated through the preset public key.

[0152] Optional, such as Fig. 9As shown, the sender and the receiver can negotiate in advance to determine the preset public key of the receiver, and the sender holds the preset public key. After that, the sender calls the true random number generator of the kernel layer to generate a true random number, and generates a symmetric key based on the true random number. The sender uses the preset public key of the receiver to asymmetrically encrypt the symmetric key to generate a digital envelope. The sender transmits the digital envelope to the receiver through the data path. After the receiver receives the digital envelope, it asymmetrically decrypts the digital envelope using the receiver's private key to obtain the symmetric key, and saves the symmetric key locally. When the receiver receives the encrypted security service request, the symmetric key can be used to decrypt the security service request, and then respond to the security service request.

[0153] Optionally, after the sender generates the symmetric key, the sender and the receiver may mutually confirm the validity of the symmetric key to ensure that the generated symmetric key can be used for encryption and decryption requested in subsequent security services.

[0154] It should be understood that the encryption algorithm in the embodiment of the present application is illustrated by taking the AES-GCM algorithm as an example, but the embodiment of the present application can also adopt other encryption algorithms, such as the advanced encryption standard based on CCM mode (AES-CMAC / counterMode, AES-CCM) algorithm, the advanced encryption standard based on CBC mode (advanced encryption standard-cipher block chaining, AES-CBC) algorithm or triple data encryption (triple data encryption algorithm, 3DES) algorithm, etc., and the embodiment of the present application is not limited to this.

[0155] Specifically, the instrument domain operating system executes the secure TEE proxy technology through the proxy client application in the third operating system. The third operating system is an entertainment domain operating system as an example. Fig.10 As shown, the trusted service request of the real-time traffic condition and navigation display business of the instrument domain operating system is encrypted in the security service scheduling module. The encrypted key data (data of the trusted service request of the real-time traffic condition and navigation display business) needs to be forwarded to the TA response of the security domain operating system of the TEE through the entertainment domain operating system using the secure TEE proxy technology. It includes the following steps S301-S307:

[0156] S301. The instrument domain operating system encrypts the trusted service request for the real-time traffic condition and navigation display business.

[0157] Optionally, trusted service requests for real-time traffic and navigation display services are symmetrically encrypted using the AES-GCM algorithm in the secure service scheduling module.

[0158] Optionally, the symmetric key for encrypting the trusted service request for the real-time traffic condition and navigation display business needs to be negotiated and determined by the instrument domain operating system of the sender of the request and the security domain operating system of the receiver.

[0159] Exemplarily, the instrument domain operating system may negotiate with the security domain operating system in advance to determine the preset public key of the security domain operating system, and the instrument domain operating system holds the preset public key. Afterwards, the instrument domain operating system generates a symmetric key based on a true random number. The instrument domain operating system uses the preset public key of the security domain operating system to asymmetrically encrypt the symmetric key to generate a digital envelope. The instrument domain operating system sends the digital envelope to the security domain operating system. After receiving the digital envelope, the security domain operating system asymmetrically decrypts the digital envelope using the private key of the security domain operating system to obtain the symmetric key, and saves the symmetric key in the security domain operating system.

[0160] Optionally, the instrument domain operating system may encrypt trusted service requests for real-time traffic conditions and navigation display services using a symmetric key.

[0161] Optionally, during the encryption process of the trusted service request, a nonce value based on a true random number is preset for anti-replay verification.

[0162] S302: The instrument domain operating system sends the encrypted trusted service request for the real-time traffic condition and navigation display service to the entertainment domain operating system.

[0163] Optionally, the instrument domain operating system may send the encrypted trusted service request of the real-time traffic condition and navigation display service to the entertainment domain operating system through a communication channel. The communication channel may be a physical network card exchange channel, a virtual network card exchange channel, or a kernel proxy channel. This embodiment of the application does not impose any specific restrictions on this.

[0164] Specifically, the security service scheduling module in the instrument domain operating system sends the encrypted trusted service request of the real-time traffic condition and navigation display service to the cross-domain communication component of the kernel layer. After receiving the encrypted trusted service request of the real-time traffic condition and navigation display service, the cross-domain communication component of the instrument domain operating system sends the encrypted trusted service request of the real-time traffic condition and navigation display service to the cross-domain communication component of the kernel layer of the entertainment domain operating system through the communication channel.

[0165] Optionally, the cross-domain communication component of the entertainment domain operating system can send the encrypted trusted service request of the real-time traffic condition and navigation display service to the proxy client application, which performs service proxy forwarding.

[0166] Among them, the proxy client application can be deployed in the user state of the entertainment domain operating system. After receiving the encrypted trusted service request for real-time traffic conditions and navigation display services, the proxy client application deployed in the user state can directly send a high-level request to the entertainment domain operating system. The entertainment domain operating system will provide the corresponding high-level interface and abstraction layer. The proxy client application can directly perform proxy forwarding of the service without directly operating the underlying hardware devices or making complex system calls, and the implementation is relatively simple.

[0167] Alternatively, the proxy client application can also be deployed in the kernel state of the entertainment domain operating system. The proxy client application deployed in the user state has better security and performance and can isolate user state attacks. The proxy client application is safer when performing business proxy forwarding.

[0168] Optionally, the proxy client application can isolate the proxy client application of the entertainment domain operating system from other applications or components of the entertainment domain operating system through permission control mechanisms such as the security enhancement to Linux (SELinux), so as to prevent other applications or components of the entertainment domain operating system from obtaining information of the proxy client application, causing information leakage and reduced security.

[0169] S303: The entertainment domain operating system receives the encrypted trusted service request for the real-time traffic condition and navigation display service, and sends the encrypted trusted service request for the real-time traffic condition and navigation display service to the security domain operating system through the proxy client application.

[0170] Optional, such as Figure 8 As shown, the embodiment of the present application is introduced by taking the deployment of the proxy client application in the kernel state of the entertainment domain operating system as an example.

[0171] Optionally, the proxy client application may call a TrustZone driver (TZdriver) to send the encrypted trusted service request for the real-time traffic condition and navigation display service to the security domain operating system.

[0172] Among them, TZdriver is the driver of the security domain operating system in the kernel of the entertainment domain operating system, which can be used to complete the communication between the entertainment domain operating system and the security domain operating system. TZdriver enables protected data transmission between the secure world and the non-secure world, while ensuring the confidentiality and integrity of the trusted service requests for encrypted real-time traffic conditions and navigation display services.

[0173] Specifically, TzDriver can forward the encrypted trusted service request of the real-time traffic condition and navigation display business to the trusted application of the security domain operating system of the TEE through the secure monitoring mode call (secure monitor call, SMC) instruction.

[0174] The SMC instruction is an instruction in the ARM architecture that is used to communicate and switch between the secure world and the non-secure world. It allows the proxy client application in the non-secure world to initiate requests and call trusted applications in the secure world.

[0175] S304: The security domain operating system decrypts the encrypted trusted service request for the real-time traffic condition and navigation display business.

[0176] Optionally, after receiving the encrypted trusted service request for the real-time traffic condition and navigation display service, the trusted application in the security domain operating system can parse the nonce random number stored in the request and perform an anti-replay attack check on the encrypted trusted service request for the real-time traffic condition and navigation display service. If the check fails, the request is an illegal request and the next step is not performed. If the check succeeds, the request is a legal request and the trusted application can use the stored symmetric key to decrypt the request and obtain the command and data plaintext in the trusted service request for the real-time traffic condition and navigation display service. Among them, the symmetric key is the symmetric key obtained from the instrument domain operating system in step 301.

[0177] S305: The trusted application in the security domain operating system responds to the trusted service request for the real-time traffic condition and navigation display business and obtains a response result.

[0178] Optionally, the trusted application calls an actual business trusted application to respond to the request through a TA-TA interface according to the type of the trusted service request for the real-time traffic condition and navigation display business.

[0179] There are multiple TAs in the security domain operating system, and each TA is an independent execution entity with its own secure execution environment and resources. TA can provide different security functions and services, such as encryption and decryption, secure storage, and secure authentication. The TA-TA interface allows secure data transmission and mutual calls between different TAs. The trusted application calls the corresponding TA through the TA-TA interface to execute the real-time traffic and navigation display application to respond to the trusted service request of the real-time traffic and navigation display business, and obtains the response result, that is, the return value of the trusted service request of the real-time traffic and navigation display business.

[0180] S306: The trusted application in the security domain operating system returns a response result to the entertainment domain operating system.

[0181] Optionally, the trusted application encrypts the response result using the AES-GCM algorithm and returns the encrypted response result to the proxy client application of the entertainment domain operating system to prevent security data leakage. After receiving the encrypted response result, the proxy client application returns the encrypted response result to the security service scheduling module of the instrument domain operating system. After the security service scheduling module receives the encrypted response result, the security service scheduling module decrypts the encrypted response result, obtains the response result of the trusted service request for the real-time traffic and navigation display business, and returns it to the secure trusted application.

[0182] S307: The entertainment domain operating system returns the execution result to the instrument domain operating system.

[0183] Optionally, after receiving the encrypted response result, the proxy client application of the entertainment domain operating system returns the encrypted response result to the security service scheduling module of the instrument domain operating system. After receiving the encrypted response result, the security service scheduling module decrypts the encrypted response result, obtains the response result of the trusted service request of the real-time traffic and navigation display business, and returns it to the secure and trusted application.

[0184] The instrument domain operating system is a functional safety operating system. The security domain operating system is located in the security world. Through the trusted services provided in the trusted applications of the security domain operating system, the trusted security of the trusted service requests for real-time traffic conditions and navigation display services is guaranteed. The information security requirements of the functional safety operating system are met. The trusted service requests for real-time traffic conditions and navigation display services are encrypted during forwarding to prevent data leakage, ensuring the functional safety of responding to trusted service requests for real-time traffic conditions and navigation display services.

[0185] Fig.11 The schematic diagram of the structure of the electronic device involved in the above embodiment is shown, including: a processing unit 1101, a storage unit 1102, a sending unit 1103, and a receiving unit 1104. The device may include a first secure operating system, a second secure operating system, a third operating system, a trusted execution environment operating system, or other forms of devices.

[0186] Taking the device as a device including a first security operating system as an example, the processing unit 1101 is used to support Figure 6 Steps S201-S204 in, and / or other processes for the technology described herein.

[0187] Taking the device as a device including a second security operating system as an example, the processing unit 1101 is used to support Fig.10 Step S301 in, and / or other processes for the technology described herein.

[0188] Taking the device as a device including a trusted execution environment operating system as an example, the processing unit 1101 is used to support Fig.10 Steps S304, S305, and / or other processes for the technology described in this article.

[0189] The storage unit 1102 is used to support the device to store the results of the security check and / or other processes used in the technology described in this document.

[0190] Taking the device as a device including a second security operating system as an example, the sending unit 1103 is used to support Fig.10 Step S301 in, and / or other processes for the technology described herein. Receiving unit 1104, for supporting Fig.10 Step S307 in, and / or other processes for the technology described herein.

[0191] Taking the device as a device including a third operating system as an example, the sending unit 1103 is used to support Fig.10 Step S303 in, and / or other processes for the technology described herein. Receiving unit 1104, for supporting Fig.10 Step S302 in, and / or other processes for the technology described herein.

[0192] Taking the device as a device including a trusted execution environment operating system as an example, the sending unit 1103 is used to support Fig.10 Step S306 in, and / or other processes for the technology described herein. Receiving unit 1104, for supporting Fig.10 Step S303 in, and / or other processes for the technology described herein.

[0193] Among them, all relevant contents of each step involved in the above method embodiment can be referred to the functional description of the corresponding functional unit, and will not be repeated here.

[0194] The present application also provides a chip system, such as Fig.12 As shown, the chip system includes at least one processor 1201 and at least one interface circuit 1202. The processor 1201 and the interface circuit 1202 can be interconnected via lines. For example, the interface circuit 1202 can be used to receive signals from other devices. For another example, the interface circuit 1202 can be used to send signals to other devices (such as processor 1201). Exemplarily, the interface circuit 1202 can read instructions stored in the memory and send the instructions to the processor 1201. When the instructions are executed by the processor 1201, the electronic device can execute the various steps in the method in the above embodiment. Of course, the chip system may also include other discrete devices, which is not specifically limited in the embodiments of the present application.

[0195] An embodiment of the present application also provides a computer-readable storage medium, in which computer instructions are stored. When the computer instructions are executed on an electronic device, the electronic device executes the above-mentioned related method steps to implement the method in the above-mentioned embodiment.

[0196] The embodiment of the present application also provides a computer program product. When the computer program product is run on a computer, the computer is enabled to execute the above-mentioned related steps to implement the method in the above-mentioned embodiment.

[0197] In addition, an embodiment of the present application also provides a device, which may specifically be a component or a module, and the device may include a connected processor and a memory; wherein the memory is used to store computer-executable instructions, and when the device is running, the processor may execute the computer-executable instructions stored in the memory so that the device executes the methods in the above-mentioned method embodiments.

[0198] Among them, the electronic device, computer-readable storage medium, computer program product or chip provided in the embodiments of the present application are all used to execute the corresponding methods provided above. Therefore, the beneficial effects that can be achieved can refer to the beneficial effects in the corresponding methods provided above, and will not be repeated here.

[0199] Through the description of the above implementation methods, technicians in the relevant field can clearly understand that for the convenience and simplicity of description, only the division of the above functional modules is used as an example. In actual applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device is divided into different functional modules to complete all or part of the functions described above. The specific working process of the system, device and unit described above can refer to the corresponding process in the aforementioned method embodiment, and will not be repeated here.

[0200] In the several embodiments provided in the present application, it should be understood that the disclosed method can be implemented in other ways. For example, the electronic device embodiments described above are only schematic. For example, the division of the modules or units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of modules or units, which can be electrical, mechanical or other forms.

[0201] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0202] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0203] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) or a processor to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: flash memory, mobile hard disk, read-only memory, random access memory, disk or optical disk and other media that can store program instructions.

[0204] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any changes or substitutions within the technical scope disclosed in the present application should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A business processing method, characterized in that: Applied to a secure and trusted device, the secure and trusted device includes a first secure operating system migrated from a non-secure world to a secure world, the first secure operating system is isolated from a trusted execution environment operating system in the secure world, the method includes: Obtaining a request for executing a high-security and high-trust service; the request for executing the high-security and high-trust service includes a cryptographic request for the high-security and high-trust service; the cryptographic request includes at least one of an encryption request, a decryption request, a key derivation request, and a key generation request; Executing the cryptographic request through a local trusted application; The trusted application sends a cryptographic request execution result to the high-security and high-trust application; The high-security and high-trust application executes the high-security and high-trust service according to the cryptographic request execution result.

2. The method according to claim 1, characterized in that The high-security and high-trust services include autonomous driving safety services.

3. A business processing method, characterized in that: Applied to a secure and trusted device, the secure and trusted device includes a trusted execution environment operating system of a secure world and a third operating system and a second secure operating system of a non-secure world, the method includes: Obtain a request to execute a business; According to the trust requirements and performance requirements of the business request, the business request is sent to the trusted execution environment operating system or the local security service, and the business request is used to trigger the trusted execution environment operating system or the local security service that receives the business request to execute the business.

4. The method according to claim 3, characterized in that According to the trust requirements and performance requirements of the service request, sending the service request to a trusted execution environment operating system or a local security service includes: If the trust requirement of the service request is greater than the performance requirement, encrypting the service request and sending the encrypted service request to the trusted execution environment operating system; If the performance requirement of the service request is greater than the trust requirement, the service request is sent to the local security service.

5. The method according to claim 4, characterized in that The services include reliable and secure security instrument display services.

6. A business processing method, characterized in that: Applied to a secure and trusted device, the secure and trusted device includes a trusted execution environment operating system of a secure world and a third operating system and a second secure operating system of a non-secure world, the method includes: The proxy client application of the third operating system receives a first request from the second secure operating system, where the first request is an encrypted request; the proxy client application of the third operating system sends the first request to the trusted execution environment operating system; the proxy client application is isolated from other applications and / or components of the third operating system.

7. The method according to claim 6, characterized in that The first request includes a request to execute a trusted and secure safety instrument display service.

8. A business processing method, characterized in that: Applied to a secure and trusted device, the secure and trusted device includes a trusted execution environment operating system of a secure world and a third operating system and a second secure operating system of a non-secure world, the method includes: The trusted execution environment operating system receives a first request from the second secure operating system, where the first request is an encrypted request; the first request includes a request to execute a first service; decrypting the first request, executing the first service, and obtaining an execution result of the first service; The execution result of the first service is encrypted and returned to the second secure operating system.

9. The method according to claim 8, characterized in that The trusted execution environment operating system receives a first request from a second secure operating system, including: The trusted execution environment operating system receives the first request from the second secure operating system through a third operating system.

10. The method according to claim 8 or 9, characterized in that: The first service includes a reliable and secure security instrument display service.

11. A service processing device, characterized in that: Applied to a secure and trusted device, the secure and trusted device comprising a first secure operating system migrated from a non-secure world to a secure world, the first secure operating system being isolated from a trusted execution environment operating system in the secure world; The first security operating system is used to obtain a request for executing a high-security and high-trust service; the request for executing the high-security and high-trust service includes a cryptographic request for the high-security and high-trust service; the cryptographic request includes at least one of an encryption request, a decryption request, a key derivation request, and a key generation request; The first secure operating system is further used to execute the cryptographic request through a local trusted application; The first secure operating system is further used to send a cryptographic request execution result to the high-security and high-trust application through the trusted application; The first secure operating system is further used to execute the high-security and high-trustworthiness service through the high-security and high-trustworthiness application according to the execution result of the cryptographic request.

12. The device according to claim 11, characterized in that The high-security and high-trust services include autonomous driving safety services.

13. A service processing device, characterized in that: Applied to a secure and trusted device, the secure and trusted device includes a trusted execution environment operating system of a secure world and a third operating system and a second secure operating system of a non-secure world, the device includes: The second secure operating system is used to obtain a request for executing a service; The second secure operating system is also used to send the service request to a trusted execution environment operating system or a local security service based on the trust requirements and performance requirements of the service request, and the service request is used to trigger the reception of the service request, and the trusted execution environment operating system or the local security service executes the service.

14. The device according to claim 13, characterized in that The second secure operating system is further used for: If the trust requirement of the service request is greater than the performance requirement, encrypting the service request and sending the encrypted service request to the trusted execution environment operating system; If the performance requirement of the service request is greater than the trust requirement, the service request is sent to the local security service.

15. The device according to claim 14, characterized in that The services include reliable and secure security instrument display services.

16. A service processing device, characterized in that: Applied to a secure and trusted device, the secure and trusted device includes a trusted execution environment operating system of a secure world and a third operating system and a second secure operating system of a non-secure world, the device includes: The third operating system is used to receive a service request from the second secure operating system, wherein the first request is an encrypted request; wherein the application receiving the service request is a proxy client application of the third operating system; The third operating system is further used to send the service request to the trusted execution environment operating system; the proxy client application is isolated from other applications and / or components of the third operating system.

17. The device according to claim 16, characterized in that The first request includes a request to execute a trusted and secure safety instrument display service.

18. A service processing device, characterized in that: The invention is applied to a secure and trusted device, wherein the secure and trusted device includes a trusted execution environment operating system of a secure world and a third operating system and a second secure operating system of a non-secure world, and the device is further used for: The trusted execution environment operating system is used to receive a first request from a second secure operating system, wherein the first request is an encrypted request; the first request includes a request to execute a first service; The trusted execution environment operating system is further used to decrypt the first request, execute the first service, and obtain an execution result of the first service; The trusted execution environment operating system is further used to encrypt the execution result of the first service and return it to the second secure operating system.

19. The device according to claim 18, characterized in that The trusted execution environment operating system is further used to receive the first request from the second secure operating system through a third operating system.

20. The device according to claim 18 or 19, characterized in that The first service includes a reliable and secure security instrument display service.

21. A computer-readable storage medium, characterized in that: The method comprises computer instructions, which, when executed on an electronic device, cause the electronic device to execute the method as claimed in claim 1 or 2, or execute the method as claimed in any one of claims 3-5, or execute the method as claimed in claim 6 or 7, or execute the method as claimed in any one of claims 8-10.

22. A computer program product, characterized in that When the computer program product runs on a computer, the computer is enabled to execute the method according to claim 1 or 2, or the method according to any one of claims 3-5, or the method according to claim 6 or 7, or the method according to any one of claims 8-10.

Images