Secure processor supporting confidential calculation and Arm CPU processor

Abstract

The invention discloses a security processor and Arm CPU processor supporting confidential computing, comprising a security processor, a memory controller and a password processing module, the security processor is divided into a confidential processor, an application processor and a trusted processor which are all provided with independent processor cores; computing software and a running environment of the security processor run on an independent processor core; after the system is powered on, the application processor is controlled to run in a common execution environment, and the confidential processor and the trusted processor run in confidential and trusted execution environments; the confidential processor and the application processor or the trusted processor load an operating system in a corresponding execution environment, a shared memory space is constructed in the memory controller, a security message queue is constructed in the shared memory space, and the password processing module is called to perform operation data encryption and decryption according to a security service request initiated by a user application program. And the corresponding confidential or trusted computing service is completed. The framework is simple, the execution efficiency is high, and user application development is easy.

Description

Technical Field

[0001] The present invention relates to the field of confidential computing and cryptographic security related to general-purpose Arm CPU processors. Background Art

[0002] Confidential computing usually refers to a trusted software execution environment built based on hardware support and combined with secure firmware and software to protect data and code in computing use. Data and code protected by a confidential computing environment cannot be physically monitored or modified by ordinary application software or privileged software. Cryptographic security is an important technology for implementing confidential computing. Cryptographic modules are usually used for the authentication, upgrade and measurement of CPU security firmware and software, and provide a trust chain for security firmware and software. Confidential computing and cryptographic security are widely used in high-security scenarios such as cloud computing, financial computing, and information technology innovation.

[0003] The Armv8TrustZone architecture is based on hardware-isolated secure memory management and secure execution state, which can realize a trusted execution environment. The Armv9CCA architecture defines a confidential computing environment for ordinary user applications based on TrustZone. For cryptographic security functions, existing CPU processors mostly use on-chip built-in cryptographic acceleration peripherals or off-chip connected cryptographic acceleration PCIe cards to implement them.

[0004] The existing Arm TrustZone and CCA technologies are based on the same processor physical core, but derive multiple virtual cores for different execution environments. Specifically, Arm adds special confidential computing hardware extensions at the processor core microarchitecture level, and defines special processor execution states and memory management models, so that the same physical core can be time-shared and reused in four execution environments: initial runtime (Root), normal runtime (Normal), trusted runtime (Secure), and confidential runtime (Realm). From the software's perspective, the four execution environments running on the same physical core use completely different software stacks, and the software running in the four execution environments are isolated from each other in terms of memory management and process management. Arm's existing technology can meet the functional requirements of confidential computing, but there are the following problems:

[0005] 1. The hardware design at the processor microarchitecture level is too complex, and more system registers and status registers need to be designed for the four execution environments; 2. Ordinary user applications usually run in the Normal environment, while confidential computing applications need to run in the Realm or Secure environment. The same physical core needs to undergo complex software context switching when changing the execution environment; 3. The virtual machines or operating system software running in the four execution environments are completely different, and the development of ordinary user applications and confidential computing applications is not user-friendly; 4. The implementation method of the cryptographic module is not clearly defined, and there is a security authentication risk.

[0006] Therefore, there is an urgent need for a safe processing system that can solve the above problems. Summary of the invention

[0007] The purpose of the present invention is to provide a secure processor and an Arm CPU processor that support confidential computing, with a simple framework and high execution efficiency, and multiple execution environments running the same operating system kernel, which is convenient for user application development.

[0008] In order to achieve the above-mentioned purpose, the present invention provides a security processor supporting confidential computing, including a security processor, a memory controller and a cryptographic processing module, the memory controller is connected to a memory device, the security processor is divided into a confidential processor, an application processor and a trusted processor, and the confidential processor, the application processor and the trusted processor all have independent processor cores, so that the operating system and the operating environment of the confidential processor, the application processor and the trusted processor run on the independent processor cores to execute a security processing method supporting confidential computing, the security processing method comprising: after the system is powered on, the application processor runs in a normal execution environment and loads a normal operating system for the user to register a user application and run a background program of a security service request; according to the type of the security service request, the corresponding The confidential processor or trusted processor runs in a confidential execution environment or a trusted execution environment and loads a confidential operating system or a trusted operating system to respond to the background program waiting for registration of a confidential application or a trusted application; the application processor and the corresponding confidential processor or trusted processor build a shared memory space in the memory controller, and build a security message queue in the shared memory space, and the security message queue includes a user application data queue and a security service result queue; when the user application initiates a security service request, the application processor and the corresponding confidential processor or trusted processor call the cryptographic processing module to perform corresponding encryption and decryption according to the type of the security service request, and register the corresponding confidential application or trusted application, and start the corresponding confidential computing service and trusted computing service.

[0009] Preferably, the application processor and the corresponding confidential processor or trusted processor call the cryptographic processing module to perform corresponding encryption and decryption according to the type of the security service request, and register the corresponding confidential application or trusted application, and start the corresponding confidential computing service and trusted computing service. Specifically, the user application initiates a security service request, calls the cryptographic processing module to complete the cryptographic encryption of the security service application identifier, passes the encrypted security service application identifier to the security message mailbox, calls the cryptographic processing module to complete the cryptographic encryption of the application computing data, and loads the encrypted application computing data into the user application data queue; the confidential operating system or trusted operating system corresponding to the type of the security service request responds to the background program to read the security message mailbox to obtain the security service application identifier, calls the cryptographic processing module The processing module decrypts the security service application identifier, and registers the corresponding confidential application or trusted application according to the security service application identifier; the corresponding confidential application or trusted application reads the user application data queue to obtain the encrypted application computing data, calls the cryptographic processing module to decrypt the application computing data, and starts the confidential computing service or trusted computing service according to the application computing data; after the confidential computing service or trusted computing service is started, the corresponding confidential application or trusted application calls the cryptographic processing module to complete the cryptographic encryption of the service result data, and loads the encrypted result data into the security service result queue; the user application reads the security service result queue, calls the cryptographic processing module to decrypt the result data, and completes the confidential computing service or trusted computing service.

[0010] Specifically, the security service application identifier includes: user application tag number, user application data queue first address, user application data queue size, target security service type, target security service program tag number, target security service result queue first address, and target security service result queue size.

[0011] Preferably, the cryptographic processor is a cryptographic processing module built into each of the security processors and / or a cryptographic subsystem arranged on the security processor.

[0012] Specifically, the cryptographic processor is a cryptographic coprocessor, and the steps of calling the cryptographic processing module for encryption or decryption include: the user application allocates memory space, prepares calculation data, and initiates a call to an encryption calculation library or a decryption calculation library according to the type of the security service request; the ordinary operating system and the corresponding confidential operating system or trusted operating system respond to the call of the user application, start the cryptographic coprocessor to complete the encryption operation or decryption operation; the user application reads the encryption operation result to confirm that the cryptographic coprocessor has completed the operation or reads the decryption operation result to confirm that the cryptographic coprocessor has completed the operation.

[0013] Specifically, the cryptographic processor is a cryptographic subsystem, and the steps of calling the cryptographic processing module for encryption or decryption include: the user application allocates memory space, prepares calculation data, and initiates an encryption service request or a decryption service request based on the type of the security service request; the ordinary operating system and the corresponding confidential operating system or trusted operating system respond to the encryption service request or the decryption service request, and start the cryptographic subsystem to pass the encryption service or the decryption service to the mailbox module of the cryptographic subsystem; the application parses the encryption service or the decryption service type, reads the encryption operation result to confirm that the cryptographic subsystem has completed the operation, or reads the decryption operation result to confirm that the cryptographic subsystem has completed the operation.

[0014] Preferably, after the system is powered on, the application processor and the corresponding confidential processor or trusted processor respectively run in a common execution environment and a corresponding confidential execution environment or trusted execution environment through a hardware isolation mechanism.

[0015] Preferably, the security processor also has an independent timer module and a watchdog module.

[0016] Preferably, the security processor, memory controller and cryptographic processing module are integrated on a security processor chip.

[0017] The present invention also provides an Arm CPU processor, comprising the security processor as described above.

[0018] Compared with the prior art, the processor micro-architecture design of the present invention has low complexity, and a confidential computing application system can be constructed based on existing mature processor cores. Moreover, confidential computing or trusted computing software runs on independent physical processor cores, and does not use virtual cores constructed by ordinary execution environments, so the execution efficiency is high. On the other hand, when the user application of the present invention calls confidential or trusted applications, there is no need to go through complex and heavy software context switching, and the three execution environments run the same operating system kernel, the user development interface is unified, which is convenient for user application development and can support national secret certification. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] Figure 1 It is a structural diagram of a secure processor supporting confidential computing according to the present invention.

[0020] Figure 2 It is a flow chart of providing confidential services in the security processing method supporting confidential computing of the present invention.

[0021] Figure 3 It is a flow chart of providing trusted services in the security processing method supporting confidential computing of the present invention. DETAILED DESCRIPTION

[0022] In order to explain the technical content, structural features, achieved objectives and effects of the present invention in detail, the following is a detailed description in conjunction with the implementation methods and the accompanying drawings.

[0023] refer to Figure 1 The present invention provides a security processor 10 supporting confidential computing, including a security processor 10, a memory controller 30 and a cryptographic processing module. The security processor 10 is divided into a confidential processor 12, an application processor 11 and a trusted processor 13. The confidential processor 12, the application processor 11 and the trusted processor 13 all have independent processor cores, interrupt controllers and memory isolation modules. The computing software and operating environment of the confidential processor 12, the application processor 11 and the trusted processor 13 run on their own independent processor cores; the computing software of the confidential processor 12, the application processor 11 and the trusted processor 13 can enable the security processor 10, the memory controller 30 and the cryptographic processing module to execute a security processing method supporting confidential computing. Among them, the memory controller 30 is connected to the memory device 31, and the security processor 10 can communicate with the memory controller 30 through the system bus network.

[0024] The application system includes three independent and parallel execution environments, namely the confidential execution environment, the general execution environment, and the trusted execution environment. The general environment runs the mainstream operating system for users and allows users to register applications by themselves. The confidential environment and the trusted environment can independently run operating systems with the same kernel as the mainstream operating system, and can independently develop and register confidential applications and trusted applications according to user security requirements. The message interaction between user applications and confidential applications or trusted applications is realized through the request and response background program. The request and response background program completes the exchange of messages and data through the secure message mailbox module and the secure message queue. The software and hardware startup and interaction process of user applications requesting confidential or trusted services is shown in the figure below.

[0025] Among them, the cryptographic processing module is a cryptographic coprocessor built into each of the security processors 10 and / or a cryptographic subsystem 20 set on the security processor 10. The system can call the cryptographic service provided by the cryptographic subsystem 20 through a driver. The cryptographic subsystem includes a microcontroller, a mailbox module, a cryptographic engine, a true random number module, a key management module and a bus interface. The microcontroller module of the cryptographic subsystem runs the security firmware solidified in the chip hardware to provide a basic trust root for the security processor. The mailbox module parses the cryptographic service request transmitted by the processor subsystem and feeds back the completion status of the cryptographic calculation to the processor subsystem. The cryptographic engine and the true random number module are responsible for completing the encryption and decryption calculation tasks corresponding to the cryptographic service, and complete the memory transfer of the calculation data and the result data through the bus interface. The key management module is responsible for the processing and caching of the keys required for the encryption and decryption algorithm.

[0026] refer to Figure 2 When the security processing method performs confidential computing services, it includes steps S11 to S15.

[0027] S11, the system is powered on.

[0028] S12, the application processor 11 runs in a common execution environment and loads a common operating system for the user to register a user application and run a background program for a security service request; at this time, the type of the security service request is a confidential service request.

[0029] S13, according to the type of the security service request, the corresponding confidential processor runs in a confidential execution environment and loads a confidential operating system to respond to the background program waiting for registration of a confidential application program;

[0030] Step S12 and step S13 are specifically as follows: after the system is powered on, the application processor 11 and the confidential processor 12 respectively run in the common execution environment and the confidential execution environment through the hardware isolation mechanism; the application processor 11 loads and starts the common operating system through the trusted secure boot process for the user to register the application and runs the background program requested by the security service. The confidential processor 12 loads the confidential operating system through the trusted secure boot process, runs the confidential service response background program, and waits for the registration of the confidential program.

[0031] S14, the application processor 11 and the confidential processor 12 construct a shared memory space in the memory controller 30, and construct a secure message queue in the shared memory space, wherein the secure message queue includes a user application data queue and a security service result queue.

[0032] S15, when the user application initiates a security service request, based on the type of the security service request, the application processor 11 and the corresponding confidential processor 12 call the cryptographic processing module to perform corresponding encryption and decryption, and register the corresponding confidential application or trusted application, and start the corresponding confidential computing service.

[0033] Step S15 includes steps S151 to S156.

[0034] S151, the user application of the application processor 11 initiates a security service request, calls the password processing module to complete the password encryption of the security service application identifier, and transmits the encrypted security service application identifier to the security message mailbox 40. The user application calls the password processing module to complete the password encryption of the security service application identifier.

[0035] Among them, the security service request includes a security service application identifier, and the security service application identifier includes: user application tag number, user application data queue starting address, user application data queue size, target security service type, target security service program tag number, target security service result queue starting address, and target security service result queue size.

[0036] The target security service type determines whether it is a confidential service or a trusted service.

[0037] S152, the user application calls the password processing module to complete the password encryption of the application computing data, and loads the encrypted application computing data into the user application data queue.

[0038] When the cryptographic processor is a cryptographic coprocessor, the steps of calling the cryptographic processing module for encryption include: the user application allocates memory space, prepares calculation data, and initiates an encryption calculation library call; the ordinary operating system responds to the application call, starts the cryptographic coprocessor of the application processor 11 to complete the encryption operation; the user application reads the encryption operation result to confirm that the cryptographic coprocessor of the application processor 11 has completed the operation.

[0039] When the cryptographic processor is the cryptographic subsystem 20, the steps of calling the cryptographic processing module for encryption include: the user application allocates memory space, prepares operation data, and initiates an encryption service request or a decryption service request; the ordinary operating system responds to the encryption service request or the decryption service request, starts the cryptographic subsystem 20 to pass the encryption service or the decryption service to the mailbox module of the cryptographic subsystem 20; the microcontroller of the cryptographic subsystem parses the encryption service or the decryption service type, obtains the operation data, drives the cryptographic engine and the true random number module, and writes the operation result back to the memory space through the bus interface; the user application reads the encryption operation result or the decryption operation result to confirm that the cryptographic subsystem has completed the operation.

[0040] S153, the confidentiality processor 12 responds to the background program to read the security message mailbox 40, calls the cryptographic processing module to decrypt the security service application identifier, and registers the corresponding confidential application according to the security service application identifier.

[0041] S154, the confidential application reads the user application data queue to obtain the encrypted application computing data, calls the cryptographic processing module to decrypt the application computing data, and starts the confidential computing service or the trusted computing service according to the application computing data.

[0042] S155, after the confidential computing service or trusted computing service is started, the confidential application calls the cryptographic processing module to complete the cryptographic encryption of the service result data, and loads the encrypted result data into the security service result queue.

[0043] S156, the user application reads the security service result queue to obtain result data, calls the cryptographic processing module to decrypt the result data, and completes the confidential computing service.

[0044] When the cryptographic processor is a cryptographic coprocessor, the steps of calling the cryptographic processing module for encryption or decryption include: the user application allocates memory space, prepares calculation data, and initiates a call to an encryption calculation library or a decryption calculation library; the ordinary operating system and the corresponding confidential operating system respond to the application call and start the cryptographic coprocessor to complete the encryption operation or decryption operation; the user application reads the encryption operation result to confirm that the cryptographic coprocessor has completed the operation or reads the decryption operation result to confirm that the cryptographic coprocessor has completed the operation.

[0045] When the cryptographic processor is the cryptographic subsystem 20, the user application allocates memory space, prepares operation data, and initiates an encryption service request or a decryption service request according to the type of the security service request; the ordinary operating system and the corresponding confidential operating system respond to the encryption service request or the decryption service request, start the cryptographic subsystem 20 to pass the encryption service or the decryption service to the mailbox module of the cryptographic subsystem 20; the microcontroller of the cryptographic subsystem parses the encryption service or the decryption service type, obtains the operation data, drives the cryptographic engine and the true random number module, and writes the operation result back to the memory space through the bus interface; the user application reads the encryption operation result or the decryption operation result to confirm that the cryptographic subsystem 20 has completed the operation.

[0046] refer to Figure 3 When the security processing method performs trusted computing services, it includes steps S21 to S25.

[0047] S21, after the system is powered on.

[0048] S22, the application processor 11 runs in a common execution environment and loads a common operating system for the user to register a user application and run a background program of a security service request; at this time, the type of the security service request is a trusted service request.

[0049] S23, according to the type of the security service request, the corresponding trusted processor runs in a trusted execution environment and loads a trusted operating system to respond to the background program waiting for registration of a trusted application.

[0050] Step S22 and step S23 are specifically as follows: after the system is powered on, the application processor 11 and the trusted processor 13 respectively run in the common execution environment and the trusted execution environment through the hardware isolation mechanism; the application processor 11 loads and starts the common operating system through the trusted secure boot process for the user to register the application program and runs the background program requested by the security service. The trusted processor 13 loads the trusted operating system through the trusted secure boot process, runs the trusted service response background program, and waits for the registration of the trusted program.

[0051] S24, the application processor 11 and the trusted processor 13 construct a shared memory space in the memory controller 30, and construct a security message queue in the shared memory space, wherein the security message queue includes a user application data queue and a security service result queue.

[0052] S25, when the user application initiates a security service request, the application processor 11 and the corresponding trusted processor 13 call the cryptographic processing module to perform corresponding encryption and decryption according to the type of the security service request, and register the corresponding trusted application or trusted application, and start the corresponding trusted computing service.

[0053] Step S25 includes steps S251 to S256.

[0054] S251, the user application of the application processor 11 initiates a security service request and transmits the encrypted security service application identifier to the security message mailbox 40. The user application calls the password processing module to complete the password encryption of the security service application identifier.

[0055] The security service application identifier includes: user application tag number, user application data queue first address, user application data queue size, target security service type, target security service program tag number, target security service result queue first address, and target security service result queue size.

[0056] S252, the user application calls the password processing module to complete the password encryption of the application computing data, and loads the encrypted application computing data into the user application data queue.

[0057] When the cryptographic processor is a cryptographic coprocessor, the steps of calling the cryptographic processing module for encryption include: the user application allocates memory space, prepares calculation data, and initiates an encryption calculation library call; the ordinary operating system responds to the application call, starts the cryptographic coprocessor of the application processor 11 to complete the encryption operation; the user application reads the encryption operation result to confirm that the cryptographic coprocessor of the application processor 11 has completed the operation.

[0058] When the cryptographic processor is the cryptographic subsystem 20, the steps of calling the cryptographic processing module for encryption include: the user application allocates memory space, prepares operation data, and initiates an encryption service request or a decryption service request; the ordinary operating system responds to the encryption service request or the decryption service request, starts the cryptographic subsystem 20 to pass the encryption service or the decryption service to the mailbox module of the cryptographic subsystem 20; the microcontroller of the cryptographic subsystem parses the encryption service or the decryption service type, obtains the operation data, drives the cryptographic engine and the true random number module, and writes the operation result back to the memory space through the bus interface; the user application reads the encryption operation result or the decryption operation result to confirm that the cryptographic subsystem has completed the operation.

[0059] S253, the trusted processor 13 responds to the background program to read the security message mailbox 40, calls the cryptographic processing module to decrypt the security service application identifier, and registers the corresponding trusted application according to the security service application identifier.

[0060] S254, the trusted application reads the user application data queue to obtain the encrypted application computing data, calls the cryptographic processing module to decrypt the application computing data, and starts the trusted computing service or the trusted computing service according to the application computing data.

[0061] S255, after the trusted computing service or the trusted computing service is started, the trusted application calls the cryptographic processing module to complete cryptographic encryption of the service result data, and loads the encrypted result data into the security service result queue.

[0062] S256, the user application reads the security service result queue to obtain result data, calls the cryptographic processing module to decrypt the result data, and completes the trusted computing service.

[0063] When the cryptographic processor is a cryptographic coprocessor, the steps of calling the cryptographic processing module for encryption or decryption include: the user application allocates memory space, prepares calculation data, and initiates a call to an encryption calculation library or a decryption calculation library; the ordinary operating system and the corresponding trusted operating system respond to the application call and start the cryptographic coprocessor to complete the encryption operation or decryption operation; the user application reads the encryption operation result to confirm that the cryptographic coprocessor has completed the operation or reads the decryption operation result to confirm that the cryptographic coprocessor has completed the operation.

[0064] When the cryptographic processor is the cryptographic subsystem 20, the user application allocates memory space, prepares operation data, and initiates an encryption service request or a decryption service request according to the type of the security service request; the ordinary operating system and the corresponding trusted operating system respond to the encryption service request or the decryption service request, start the cryptographic subsystem 20 to pass the encryption service or the decryption service to the mailbox module of the cryptographic subsystem 20; the microcontroller of the cryptographic subsystem parses the encryption service or the decryption service type, obtains the operation data, drives the cryptographic engine and the true random number module, and writes the operation result back to the memory space through the bus interface; the user application reads the encryption operation result or the decryption operation result to confirm that the cryptographic subsystem 20 has completed the operation.

[0065] Preferably, the security processor 10 also has an independent timer module and a watchdog module.

[0066] Preferably, the security processor 10, the memory controller 30 and the cryptographic processing module are integrated on a security processor 10 chip.

[0067] The present invention also provides an Arm CPU processor, comprising the security processor 10 as described above.

[0068] The above disclosure is only the preferred embodiment of the present invention, which certainly cannot be used to limit the scope of rights of the present invention. Therefore, equivalent changes made according to the scope of the patent application of the present invention are still within the scope covered by the present invention.

Claims

1. A secure processor supporting confidential computing, characterized in that: The invention comprises a security processor, a memory controller and a cryptographic processing module, wherein the memory controller is connected to a memory device, the security processor is divided into a confidential processor, an application processor and a trusted processor, and the confidential processor, the application processor and the trusted processor all have independent processor cores, so that the operating system and the operating environment of the confidential processor, the application processor and the trusted processor run on the independent processor cores, so as to execute a security processing method supporting confidential computing, wherein the security processing method comprises: After the system is powered on, the application processor runs in a normal execution environment and loads a normal operating system for users to register user applications and run background programs requested by security services; According to the type of the security service request, the corresponding confidential processor or trusted processor runs in a confidential execution environment or a trusted execution environment and loads a confidential operating system or a trusted operating system to respond to the background program waiting for registration of a confidential application or a trusted application; The application processor and the corresponding confidential processor or trusted processor construct a shared memory space in a memory controller, and construct a secure message queue in the shared memory space, wherein the secure message queue includes a user application data queue and a security service result queue; When the user application initiates a security service request, the application processor and the corresponding confidential processor or trusted processor call the cryptographic processing module to perform corresponding encryption and decryption based on the type of the security service request, register the corresponding confidential application or trusted application, and start the corresponding confidential computing service or trusted computing service.

2. The security processor according to claim 1, wherein: The application processor and the corresponding confidential processor or trusted processor call the cryptographic processing module to perform corresponding encryption and decryption according to the type of the security service request, register the corresponding confidential application or trusted application, and start the corresponding confidential computing service and trusted computing service, specifically including: The user application initiates a security service request, calls the password processing module to complete the password encryption of the security service application identifier, transmits the encrypted security service application identifier to the security message mailbox, calls the password processing module to complete the password encryption of the application computing data, and loads the encrypted application computing data into the user application data queue; The confidential operating system or trusted operating system corresponding to the type of the security service request responds to the background program reading the security message mailbox to obtain the security service application identifier, calling the cryptographic processing module to decrypt the security service application identifier, and registering the corresponding confidential application or trusted application according to the security service application identifier; The corresponding confidential application or trusted application reads the user application data queue to obtain the encrypted application computing data, calls the cryptographic processing module to decrypt the application computing data, and starts the confidential computing service or trusted computing service according to the application computing data; After the confidential computing service or trusted computing service is started, the corresponding confidential application or trusted application calls the cryptographic processing module to complete the cryptographic encryption of the service result data, and loads the encrypted result data into the security service result queue; The user application reads the security service result queue, calls the cryptographic processing module to decrypt the result data, and completes the confidential computing service or the trusted computing service.

3. The security processor according to claim 1, wherein: The cryptographic processor is a cryptographic processing module built into each of the security processors and / or a cryptographic subsystem set on the security processor.

4. The security processor according to claim 3, wherein: The cryptographic processor is a cryptographic coprocessor, and the steps of calling the cryptographic processing module for encryption or decryption include: The user application allocates memory space, prepares computing data, and initiates a call to an encryption computing library or a decryption computing library according to the type of the security service request; The common operating system and the corresponding confidential operating system or trusted operating system respond to the call of the user application program and start the cryptographic coprocessor to complete the encryption operation or decryption operation; The user application reads the encryption operation result to confirm that the cryptographic coprocessor has completed the operation or reads the decryption operation result to confirm that the cryptographic coprocessor has completed the operation.

5. The security processor according to claim 3, wherein: The cryptographic processor is a cryptographic subsystem, and the steps of calling the cryptographic processing module for encryption or decryption include: The user application allocates memory space, prepares operation data, and initiates an encryption service request or a decryption service request according to the type of the security service request; The common operating system and the corresponding confidential operating system or trusted operating system respond to the encryption service request or the decryption service request, and start the cryptographic subsystem to deliver the encryption service or the decryption service to the mailbox module of the cryptographic subsystem; The microcontroller of the cryptographic subsystem parses the encryption service or decryption service type, obtains operation data, drives the cryptographic engine and the true random number module, and writes the operation result back to the memory space through the bus interface; The user application reads the encryption operation result or the decryption operation result to confirm that the cryptographic subsystem has completed the operation.

6. The security processor of claim 2, wherein: The security service application identifier includes: user application mark number, user application data queue first address, user application data queue size, target security service type, target security service program mark number, target security service result queue first address, and target security service result queue size.

7. The security processor of claim 1, wherein: After the system is powered on, the application processor and the corresponding confidential processor or trusted processor respectively run in a common execution environment and a corresponding confidential execution environment or trusted execution environment through a hardware isolation mechanism.

8. The security processor of claim 1, wherein: The safety processor also has an independent timer module and a watchdog module.

9. The security processor of claim 1, wherein: The security processor, memory controller and password processing module are integrated on a security processor chip.

10. An Arm CPU processor, characterized in that: Comprising a security processor as claimed in any one of claims 1 to 9.

Images