Data acquisition method and device, electronic equipment and storage medium

Abstract

The invention discloses a data acquisition method and device, electronic equipment and a storage medium, and relates to the technical field of computers. According to the method, the target data can be directly acquired from the memory range requested to be accessed without applying for the memory for the target data, the scene of frequently using related data can be met, and the data acquisition effectiveness is improved. The method comprises the steps that an AI processor obtains a memory access request of a target application, wherein the memory access request comprises a to-be-accessed memory range; the first secure memory driver sends the memory access request to a second secure memory driver; if it is determined that the to-be-accessed memory range is within a target memory range in the second secure memory driver, target data are obtained in the to-be-accessed memory range, and the target memory range comprises a memory range pre-allocated for the target application.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a data acquisition method, device, electronic device and storage medium. Background Art

[0002] With the development of information technologies such as big data, cloud computing, and the Internet, artificial intelligence (AI) technology represented by deep neural networks has been widely used. AI technology can enable intelligent entities such as terminals to achieve image classification, voice recognition, and unmanned driving.

[0003] When the terminal and other intelligent subjects implement related processes, due to the high security requirements of the data used, in order to prevent the data from being leaked or tampered with, it is necessary to first apply for a specific memory for the data and store the data in the specific memory. Later, when the terminal uses or processes the data, the data is obtained from the specific memory.

[0004] However, it takes a long time to apply for specific memory for data, which cannot meet the scenarios where related data is frequently used, affecting the effectiveness of data acquisition. Summary of the invention

[0005] The present application provides a data acquisition method, device, electronic device and storage medium, which solves the technical problem in the related art that it takes a long time to apply for specific memory for data, cannot meet the scenario of frequent use of related data, and affects the effectiveness of data acquisition.

[0006] The technical solution of the embodiment of the present application is as follows:

[0007] In a first aspect, a data acquisition method is provided. The method is applied to an AI processor including a REE and a TEE, and is provided with a first secure memory driver and a second secure memory driver, wherein the REE includes the first secure memory driver, and the TEE includes the second secure memory driver, and the method comprises: the AI ​​processor obtains a memory access request of a target application, wherein the memory access request includes a memory range to be accessed; the first secure memory driver sends the memory access request to the second secure memory driver; if the second secure memory driver determines that the memory range to be accessed is within a target memory range, then the target data is obtained in the memory range to be accessed, wherein the target memory range includes a memory range pre-allocated for the target application.

[0008] It can be understood that the method described in the first aspect can be executed by an electronic device, and the electronic device can be a terminal, a device including a terminal, or a chip in a terminal, or the electronic device can also be a network device, a device including a network device, or a chip in a network device. For ease of understanding, the following description is based on the example of execution by an electronic device.

[0009] In the present application, after the AI ​​processor including REE and TEE in the electronic device obtains the memory access request of the target application, the first secure memory driver included in the REE can send a memory access request to the second secure driver included in the TEE, and the second secure driver determines whether the memory range to be accessed is within the target memory range. If the second secure driver determines that the memory range to be accessed is within the target memory range, it means that the memory range requested to be accessed based on the target application is consistent with the memory range pre-allocated by the target application, that is, the target application has access rights to the memory range to be accessed, and the electronic device can obtain the target data from the memory to be accessed. In the embodiment of the present application, since the target memory range includes a memory range pre-allocated for the target application, the electronic device does not need to apply for memory for the target data in the process of obtaining the target data, and can directly obtain the target data from the memory range requested to be accessed, which can meet the scenario of frequent use of related data and improve the effectiveness of data acquisition.

[0010] In one possible design, the memory access request further includes an identifier of the target application, and the target memory range is determined based on the identifier of the target application.

[0011] Based on this possible design, after obtaining the identification of the target application, the electronic device can determine the memory range pre-allocated by the target application (i.e., the target memory range) based on the identification of the target application. That is, the electronic device can accurately and effectively determine the memory range pre-allocated by each application based on the identification of each application, thereby being able to accurately verify and identify whether each application has access rights to a certain memory range.

[0012] In a possible design, the target memory range is a memory range corresponding to an identifier of the target application in a permission control relationship, and the permission control relationship includes multiple application identifiers and memory ranges corresponding to each of the multiple application identifiers.

[0013] Based on this possible design, the permission control relationship is the relationship between the application identifier and the memory range, specifically, one application identifier corresponds to one or more memory ranges, and if an application identifier in the permission control relationship corresponds to a memory range, it means that the application corresponding to the application identifier has access rights to the memory range. The electronic device can quickly find the memory range pre-allocated for each application in the permission control relationship, thereby increasing the data acquisition rate.

[0014] In one possible design, the data acquisition method also includes: querying the permission control relationship based on the identifier of the target application, determining that the identifier of the target application exists in the permission control relationship, the permission control relationship including multiple application identifiers and memory ranges corresponding to each of the multiple application identifiers; and determining the memory range corresponding to the identifier of the target application in the permission control relationship as the target memory range.

[0015] Based on this possible design, since the permission control relationship includes multiple application identifiers and the memory ranges corresponding to each of the multiple application identifiers, the memory range corresponding to an application identifier is the memory range pre-allocated by the electronic device for the application corresponding to the application identifier. In this way, the electronic device determines the memory range corresponding to the identifier of the target application in the permission control relationship as the target memory range, that is, the memory range pre-allocated for each application can be accurately and effectively determined.

[0016] In a possible design, before obtaining the memory access request of the target application, the data acquisition method further includes: allocating a memory range to the applications corresponding to each of the multiple application identifiers based on the permission control relationship.

[0017] Based on this possible design, the permission control relationship can be a corresponding relationship pre-stored (or set) in the electronic device, and the electronic device can accurately and effectively allocate memory ranges for multiple applications installed (or included) in the electronic device based on the permission control relationship. While effectively allocating storage resources in the electronic device, it can ensure that each subsequent application can access its pre-allocated memory range.

[0018] In a possible design, the target memory range is a memory range included in the secure processing area.

[0019] Based on this possible design, the memory range (i.e., target memory range) included in the secure processing area can also be understood as secure memory. The electronic device pre-allocates secure memory for each application, which can ensure that each application can be allocated to a memory range with a higher security level, and the security of the content (including related data) stored in the secure memory is also improved. Therefore, when the electronic device accesses the relevant secure memory, the security of data acquisition can be improved.

[0020] In one possible design, the secure processing area is TEE.

[0021] Based on this possible design, since the secure processing area is TEE, and the trust level (or security) of TEE is high, that is, the target memory range is a memory with a high trust level (or security). In this way, the electronic device can obtain the target data from the memory range with a high security level, while ensuring the security of the relevant data, and improving the efficiency of applying for and releasing the secure memory.

[0022] In one possible design, the above target application is TA.

[0023] Based on this possible design, TA is an application included (or initiated) in TEE, and its trustworthiness is high. The electronic device accesses the memory range included in the more secure TEE (or secure processing area) based on the more trusted TA, and improves the security of data acquisition and data storage while ensuring that more secure memory can be allocated to the more trusted TA.

[0024] In one possible design, the TA is created based on a CA, which is an application initiated from a non-secure processing area.

[0025] Based on this possible design, due to the low security level of the non-secure processing area and the trustworthiness (or low security) of the CA initiated in the non-secure processing area, it may not be possible to access the memory in the secure processing area directly based on the CA. At this time, the electronic device creates a TA with a higher degree of trust based on the CA, and then obtains the target data from the memory range with a higher degree of security based on the TA. While ensuring that the target application can access the secure processing area, it prevents malicious programs from stealing or tampering, which can improve the security of related data.

[0026] In one possible design, the above-mentioned unsafe processing area is REE.

[0027] Based on this possible design, since the non-secure processing area is REE and the trustworthiness (or security) of REE is low, storing data in REE may not guarantee the security of data. Also, since the application (i.e. CA) initiated in RRE may not be able to directly access the secure memory in the secure processing area (i.e. TEE). At this time, the electronic device creates a corresponding TA that can access TEE based on the CA of REE, so that the corresponding secure memory can be allocated to each application in REE, and then the electronic device can safely and effectively obtain the target data from the secure memory of REE.

[0028] In one possible design, the data acquisition method further includes: performing data processing on the target data in the non-safe processing area.

[0029] Based on this possible design, the secure processing area only retains basic configuration functions (including determining whether the memory range to be accessed is within the target memory range), and the business entity remains in the non-secure processing area, that is, the relevant logic modules (or hardware modules) for data processing are configured to execute in the non-secure processing area, which can support multi-threading functions and various library functions, thereby improving the effectiveness of code reuse.

[0030] In a possible design, the above-mentioned memory range to be accessed includes the starting address of the memory to be accessed and the size of the memory to be accessed.

[0031] Based on this possible design, for any memory range, the memory range corresponds to a memory, and the memory range can be accurately characterized based on the starting address of the memory and the size of the memory. In this way, the electronic device can accurately determine the memory range of each memory based on the starting address of each memory and the size of each memory, so as to accurately determine whether the memory range to be accessed is within the target memory range, thereby improving the accuracy of identity verification for each application.

[0032] In one possible design, the target data mentioned above is AI data.

[0033] Based on this possible design, the electronic device pre-allocates the corresponding memory for each application, so that when a memory access request based on an application (such as a target application) is obtained to access a certain memory range (i.e., the memory range to be accessed), it can determine whether the memory range to be accessed is within the memory range pre-allocated for the target application (i.e., the target memory range), thereby completing the identity authentication of the target application. After the identity authentication of the target application is passed, it means that the target application has access rights to the memory range to be accessed. At this time, the electronic device obtains AI data from the memory range to be accessed, which can ensure the security of the AI ​​data acquisition process.

[0034] In a possible design, the data acquisition method further includes: if the memory range to be accessed is outside the target memory range, issuing an alarm message.

[0035] Based on this possible design, if the memory range to be accessed is outside the target memory range, it means that the memory range requested for access by the target application does not conform to the memory range pre-allocated by the target application, that is, the target application does not have access rights to the memory range to be accessed. At this time, the electronic device can issue an alarm message (or return an error message) to remind the current target application that there is an error and that the target application should be refused service. This can effectively reduce the risk of data tampering and save service resources of the electronic device.

[0036] In a second aspect, a data acquisition device is provided. The device is applied to an AI processor including a REE and a TEE, and is provided with a first secure memory driver and a second secure memory driver, wherein the REE includes the first secure memory driver, the TEE includes the second secure memory driver, the first secure memory driver includes a first acquisition module and a sending module, and the second secure driver includes a second acquisition module; the first acquisition module is used for the AI ​​processor to acquire a memory access request of a target application, wherein the memory access request includes a memory range to be accessed; the sending module is used for the first secure memory driver to send the memory access request to the second secure memory driver; the second acquisition module is used for acquiring target data from the memory range to be accessed if it is determined in the second secure memory driver that the memory range to be accessed is within a target memory range, wherein the target memory range includes a memory range pre-allocated for the target application.

[0037] In one possible design, the memory access request further includes an identifier of the target application, and the target memory range is determined based on the identifier of the target application.

[0038] In a possible design, the target memory range is a memory range corresponding to an identifier of the target application in a permission control relationship, and the permission control relationship includes multiple application identifiers and memory ranges corresponding to each of the multiple application identifiers.

[0039] In one possible design, the data acquisition device also includes a determination module; the determination module is used to query the permission control relationship based on the identifier of the target application, and determine that the identifier of the target application exists in the permission control relationship, and the permission control relationship includes multiple application identifiers and memory ranges corresponding to each of the multiple application identifiers; the determination module is also used to determine the memory range corresponding to the identifier of the target application in the permission control relationship as the target memory range.

[0040] In one possible design, the data acquisition device also includes an allocation module; the allocation module is used to allocate memory ranges to applications corresponding to each of the multiple application identifiers based on the permission control relationship.

[0041] In a possible design, the target memory range is a memory range included in the secure processing area.

[0042] In one possible design, the secure processing area is TEE.

[0043] In one possible design, the above target application is TA.

[0044] In one possible design, the TA is created based on a CA, which is an application initiated from a non-secure processing area.

[0045] In one possible design, the above-mentioned unsafe processing area is REE.

[0046] In one possible design, the data acquisition device also includes a processing module; the processing module is used to process the target data in the non-safe processing area.

[0047] In a possible design, the above-mentioned memory range to be accessed includes the starting address of the memory to be accessed and the size of the memory to be accessed.

[0048] In one possible design, the target data mentioned above is AI data.

[0049] In a possible design, the data acquisition device also includes an alarm module; the alarm module is used to issue an alarm message if the memory range to be accessed is outside the target memory range.

[0050] In a third aspect, a data acquisition device is provided. The data acquisition device includes: a module for executing the method described in the first aspect, such as a transceiver module and a processing module. For example, the transceiver module is used to execute the transceiver function of the data acquisition device, and the processing module is used to execute functions of the data acquisition device other than the transceiver function.

[0051] Optionally, the transceiver module may include a sending module and a receiving module, wherein the sending module is used to implement the sending function of the data acquisition device described in the second aspect, and the receiving module is used to implement the receiving function of the data acquisition device described in the second aspect.

[0052] Optionally, the data acquisition device described in the third aspect may further include a storage module, wherein the storage module stores a program or instruction. When the processing module executes the program or instruction, the data acquisition device may execute the method described in the first aspect.

[0053] It can be understood that the data acquisition device described in the third aspect can be a terminal or a network device, or a chip (system) or other parts or components that can be set in a terminal or a network device, or a device that includes a terminal or a network device, and this application does not limit this.

[0054] In addition, the technical effects of the data acquisition device described in the third aspect can refer to the technical effects of the other aspects mentioned above, and will not be repeated here.

[0055] In a fourth aspect, a data acquisition device is provided, wherein the data acquisition device comprises: a processor, wherein the processor is configured to execute the method described in the first aspect.

[0056] In a possible design solution, the data acquisition device described in the fourth aspect may further include a transceiver. The transceiver may be a transceiver circuit or an interface circuit. The transceiver may be used for the data acquisition device described in the fourth aspect to communicate with other devices.

[0057] In a possible design scheme, the data acquisition device described in the fourth aspect may also include a memory. The memory may be integrated with the processor or may be separately provided. The memory may be used to store the computer program and / or data involved in the method described in the first aspect.

[0058] In an embodiment of the present application, the communication device described in the fourth aspect may be the terminal or network device described in the first aspect, or a chip (system) or other parts or components that may be arranged in the terminal or network device, or a device including the terminal or network device.

[0059] In addition, the technical effects of the data acquisition device described in the fourth aspect can refer to the technical effects of the method described in the first aspect, and will not be repeated here.

[0060] In a fifth aspect, a data acquisition device is provided. The communication device comprises: a processor, the processor is coupled to a memory, and the processor is used to execute a computer program stored in the memory, so that the data acquisition device executes the method described in the first aspect.

[0061] In a possible design solution, the data acquisition device described in the fifth aspect may further include a transceiver. The transceiver may be a transceiver circuit or an interface circuit. The transceiver may be used for the data acquisition device described in the fifth aspect to communicate with other devices.

[0062] In an embodiment of the present application, the data acquisition device described in the fifth aspect may be the terminal or network device described in the first aspect, or a chip (system) or other parts or components that may be set in the terminal or network device, or a device that includes the terminal or network device.

[0063] In addition, the technical effects of the data acquisition device described in the fifth aspect can refer to the technical effects of the method described in the first aspect, and will not be repeated here.

[0064] In a sixth aspect, a data acquisition device is provided, comprising: a processor and a memory; the memory is used to store a computer program, and when the processor executes the computer program, the data acquisition device executes the method described in the first aspect.

[0065] In a possible design solution, the data acquisition device described in the sixth aspect may further include a transceiver. The transceiver may be a transceiver circuit or an interface circuit. The transceiver may be used for the data acquisition device described in the sixth aspect to communicate with other devices.

[0066] In an embodiment of the present application, the data acquisition device described in the sixth aspect may be the terminal or network device described in the first aspect, or a chip (system) or other parts or components that may be set in the terminal or network device, or a device that includes the terminal or network device.

[0067] In addition, the technical effects of the data acquisition device described in the sixth aspect can refer to the technical effects of the method described in the first aspect, and will not be repeated here.

[0068] In a seventh aspect, a computer-readable storage medium is provided, comprising: a computer program or instructions; when the computer program or instructions are executed on an electronic device, the electronic device executes the method described in the first aspect.

[0069] In an eighth aspect, a computer program product is provided, comprising a computer program or instructions, which, when executed on an electronic device, causes the electronic device to execute the method described in the first aspect.

[0070] It will be understood that the above general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0071] Figure 1 A schematic diagram of a process for processing AI data provided by an embodiment of the present application is shown;

[0072] Figure 2 A schematic diagram showing a principle of data processing on the TEE side provided in an embodiment of the present application is shown;

[0073] Figure 3 A schematic diagram showing a principle of memory reuse of a secure memory provided by an embodiment of the present application is shown;

[0074] Figure 4 A schematic diagram of an AI scenario provided in an embodiment of the present application is shown;

[0075] Figure 5 A schematic diagram of an NPU software architecture provided by an embodiment of the present application is shown;

[0076] Figure 6 A schematic diagram showing a principle of applying for secure memory provided by an embodiment of the present application is shown;

[0077] Figure 7 A schematic diagram showing a principle of allocating secure memory provided by an embodiment of the present application is shown;

[0078] Figure 8 A schematic diagram of a memory permission control form and a memory range form provided in an embodiment of the present application is shown;

[0079] Fig. 9 A schematic diagram of a data acquisition method provided in an embodiment of the present application is shown;

[0080] Fig.10 A structural schematic diagram of a data acquisition device provided in an embodiment of the present application is shown. DETAILED DESCRIPTION

[0081] To facilitate understanding of the solutions provided by the embodiments of the present application, some concepts involved in the present application are explained before introducing the solutions provided by the embodiments of the present application.

[0082] Artificial Intelligence (AI) technology aims to expand human intelligence by exploring the essence of wisdom so as to enable terminals and other intelligent entities to listen (including speech recognition, machine translation, etc.), see (including image recognition, text recognition, etc.), speak (including speech synthesis, human-computer dialogue, etc.), think (including human-computer chess, expert systems, etc.), learn (including knowledge representation, machine learning, etc.) and act (robots, self-driving cars, etc.). In the embodiment of the present application, the electronic device can obtain and process the target data from the memory range to be accessed, thereby obtaining the processing result of the AI ​​model.

[0083] Trusted execution environment (TEE) is usually used for digital rights management (DRM), mobile payment and sensitive data protection. Some behaviors with higher security requirements, such as fingerprint matching and signing with private keys, need to be implemented in TEE. In an embodiment of the present application, the electronic device can complete the identity verification of the target application in TEE, specifically to determine whether the memory range requested for access by the target application (i.e., the memory range to be accessed) is located in the memory range pre-allocated by the target application (i.e., the target memory range), thereby determining whether the target data can be obtained from the memory range to be accessed.

[0084] Rich execution environment (REE) is a common and open environment for all mobile devices, used to run common operating systems (OS), such as Android system, input output system (IOS), etc. In the embodiment of the present application, the electronic device can complete the data processing process in REE.

[0085] With the development of information technologies such as big data, cloud computing, and the Internet, computing platforms such as perception data and graphics processors have promoted the rapid development of artificial intelligence technologies represented by deep neural networks, greatly bridging the technological gap between science and application. Artificial intelligence technologies such as image classification, speech recognition, fingerprint recognition, and unmanned driving have achieved major technological breakthroughs, ushering in a new climax of artificial intelligence technology.

[0086] In the era of big data, it is often necessary to process a large amount of continuous and secure data, and the security and performance requirements of the data are high. A typical scenario is AI business. General AI business processes such as Figure 1 As shown, after the electronic device obtains the target data from the memory storing the target data (such as the memory to be accessed), it can configure the task model and parameters related to the target data in the neural processing unit (NPU). After that, the electronic device passes the task model and parameters related to the target data to a specific data processing program, and finally obtains the data processing result of the target data. For the data to be processed transmitted by the AI ​​hardware, first configure the task model file in the neural processing unit (NPU), set the relevant parameters, and complete the data operation. Then pass the data to a special data processing program for further processing, and finally obtain the data processing result. The above entire process is completely on the REE side.

[0087] When performing security-related services, such as face recognition and fingerprint recognition, certain security protection measures need to be taken to ensure that the data stored in the memory will not be leaked or tampered with. In security intelligence services, secure memory is required, but the main logic of security intelligence services is on the REE side. The application of secure memory operations needs to go through the REE side → advanced RISC machine trusted firmware (ATF) → TEE kernel state → TEE user state → TEE kernel state. The memory application process is long and time-consuming, which seriously affects performance in scenarios where frequent application and release are required.

[0088] At the same time, since the NPU driver is located on the REE side, its configuration parameters may be modified and the data may be leaked or counterfeited.

[0089] In summary, a method is needed to manage the secure memory in the secure intelligence business to increase the memory application speed, improve the performance of the NPU driver, and ensure the security of the memory.

[0090] In order to solve the problem of long and time-consuming AI memory application process, in one implementation method, the entire business process is transplanted to the security side, and the data acquisition and processing process can be completed in TEE. Figure 2 As shown, the data to be processed is stored in the secure memory on the TEE side during initialization. The server can initiate a memory access request in the TEE user state, perform parameter verification in the TEE kernel state, and obtain the task model and related parameters from the secure memory in the TEE kernel state before performing data processing in the TEE user state. The data processing process is as follows: Figure 2 As shown, it may include inputting the input parameters of the task model into the task model to obtain the output parameters (or output results) of the task model. After parameter verification and model calculation on the TEE side, the results are returned to the secure memory on the TEE side. Figure 1 The process eliminates the data flow from the REE side to the TEE side, improving the memory application performance and business security.

[0091] but, Figure 2 The method of migrating the entire security intelligence service to the TEE side has the following problems: First, the TEE side environment has poor or no support for functions such as multithreading. In addition, the TEE side has poor support for various library functions and cannot use the library functions on the REE side. In addition, the code used to migrate the entire security intelligence service to the TEE side is quite different from the original code, and code reuse cannot be achieved.

[0092] In another possible implementation, memory application performance is improved by memory reuse. Figure 3As shown, in the initialization phase, the business driver 101 in the TEE kernel state can directly send a secure memory application to the secure memory driver 102 in the TEE kernel state, that is, request the secure memory driver 102 in the TEE kernel state to allocate secure memory for the (trusted application, TA) 103 in the TEE user state. After that, the TA 103 in the TEE user state can directly use (or access) the secure memory corresponding to the TA103 in the TEE kernel state. The client application (client application, CA) 104 in the REE user state can request allocation (and then access) of the secure memory in the TEE kernel state from the secure memory driver 102 in the TEE kernel state via the memory driver 105 in the REE kernel state and the TA103 in the TEE user state. Thus, the electronic device can implement the memory reuse process of the secure memory in the business driver 106 in the REE kernel state and the business driver 101 in the TEE kernel state. This implementation method arranges the secure intelligent business on the REE side, and the application performance of the secure memory can be improved by memory reuse. During the initialization process, the secure intelligent business driver on the TEE side applies for secure memory. By reusing the secure memory, the secure intelligent business driver on the REE side can directly use the secure memory, reducing the number of secure memory transfers between the REE side and the TEE side and improving business operation performance.

[0093] but, Figure 3 The memory reuse method shown in has the following problems: first, it is necessary to add memory application, memory release and data transmission channels in TA and CA, which will increase the complexity of the business. In addition, the code used to implement memory reuse will be more complicated and difficult to understand, increasing the maintenance cost of the system. In addition, when the system supports third-party development, this method cannot constrain third parties to use memory reuse or memory cache pools, which will affect the effectiveness of memory reuse.

[0094] Based on this, an embodiment of the present application provides a data acquisition method. After the AI ​​processor including REE and TEE in the electronic device obtains the memory access request of the target application, the first secure memory driver included in the REE can send a memory access request to the second secure driver included in the TEE, and the second secure driver determines whether the memory range to be accessed is within the target memory range. If the second secure driver determines that the memory range to be accessed is within the target memory range, it means that the memory range requested to be accessed based on the target application is consistent with the memory range pre-allocated by the target application, that is, the target application has access rights to the memory range to be accessed, and the electronic device can obtain the target data from the memory to be accessed. In the embodiment of the present application, since the target memory range includes the memory range pre-allocated for the target application, the electronic device does not need to apply for memory for the target data in the process of obtaining the target data, and can directly obtain the target data from the memory range requested to be accessed, which can meet the scenario of frequent use of related data and improve the effectiveness of data acquisition.

[0095] In order to enable ordinary persons in the art to better understand the technical solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the accompanying drawings.

[0096] It is understood that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present application. Instead, they are merely examples of devices and methods consistent with some aspects of the present application as detailed in the attached claims.

[0097] It should also be understood that the term “comprising” indicates the presence of described features, integers, steps, operations, elements and / or components, but does not exclude the presence or addition of one or more other features, integers, steps, operations, elements and / or components.

[0098] The data acquisition method provided in the embodiment of the present application can be executed by an electronic device. The data acquisition method provided in the embodiment of the present application can act on the electronic device to realize the process of acquiring relevant data.

[0099] In one example, the electronic device can be a terminal, which can also be called user equipment (UE), access terminal, subscriber unit (subscriber unit), user station, mobile station (MS), mobile station, remote station, remote terminal, mobile device, user terminal, terminal, wireless communication device, user agent or user device. The terminal in the embodiments of the present application can be a mobile phone, a cellular phone, a smart phone, a tablet computer, a wireless data card, a personal digital assistant (PDA), a wireless modem, a handset, a laptop computer, a machine type communication (MTC) terminal, a computer with a wireless transceiver function, a virtual reality (VR) terminal, an augmented reality (AR) terminal, a smart home device (for example, a refrigerator, a television, an air conditioner, an electric meter, etc.), an intelligent robot, a robotic arm, a workshop equipment, a wireless terminal in industrial control, a wireless terminal in self driving, a wireless terminal in remote medical, a wireless terminal in a smart grid, a wireless terminal in transportation safety, a wireless terminal in a smart city, a wireless terminal in a smart home, a vehicle-mounted terminal, a roadside unit with a terminal function, and a wireless terminal in a smart city. The terminal of the present application may also be a vehicle-mounted module, a vehicle-mounted module, a vehicle-mounted component, a vehicle-mounted chip or a vehicle-mounted unit built into a vehicle as one or more components or units. The terminal may also be other devices with terminal functions, for example, the terminal may also be a device that functions as a terminal in device to device (D2D) communication.

[0100] The embodiments of the present application do not limit the device form of the terminal. The device for realizing the function of the terminal can be a terminal; it can also be a device that can support the terminal to realize the function, such as a chip system. The device can be installed in the terminal, or used in combination with the terminal. In the embodiments of the present application, the chip system can be composed of chips, or it can include chips and other discrete devices.

[0101] In another example, the electronic device may be a server, which may be an independent physical server, a server cluster or a distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, network acceleration services (content delivery network, CDN), as well as big data and artificial intelligence platforms.

[0102] The data acquisition method, device, electronic device, and storage medium provided in the embodiments of the present application are applied to large-scale continuous and secure data processing scenarios, which have high requirements on data security and performance. Figure 4 In the AI ​​scenario shown, in this AI scenario, the AI ​​data that the electronic device needs to obtain from the secure memory includes the image data passed in by the user and the feature data passed in by the central processing unit (CPU). The electronic device obtains the image data passed in by the user and the feature data passed in by the CPU from the secure memory, and can input the image data passed in by the user and the feature data passed in by the CPU into the intelligent business module, and the intelligent business module performs AI reasoning on the image data and the feature data to obtain the output result. Afterwards, the electronic device sends the output result to the video output (video output, VO), the video graphics sub-system (video graphics sub-system, VGS) and the video encoding module (Video Encoder, VENC), respectively, so as to display and play the relevant video.

[0103] in, Figure 4 The intelligent business module in the system may include an AI processor, such as an NPU (or a smart vision processor (SVP) NPU (which can also be understood as a neural network inference engine)), that is, AI data processing can be performed by the NPU. It should be understood that the AI ​​processor may include but is not limited to the NPU and may also be other processors with AI data processing functions, such as a CPU, etc. This application is described using the NPU as an example.

[0104] In the embodiment of the present application, the software architecture of the NPU is as follows Figure 5As shown. Among them, the TEE side of the NPU includes a memory hardware access control module 201, a secure memory driver 202 and a business driver 203, the memory hardware access control module 201 belongs to the user state in the TEE, and the secure memory driver 202 and the business driver 203 are the kernel state in the data TEE. Among them, the secure memory driver 202 includes a memory software access control module 2021 and a memory management module 2022, and the business driver 203 includes a parameter verification module 2031. And the electronic device includes a secure memory driver 204 and a business logic module 205 on the REE side, the secure memory driver 204 includes a memory management module 2041, and the business logic module 205 includes an AI reasoning module 2051, wherein the secure memory driver 204 belongs to the kernel state in the REE, and the business logic module 205 belongs to the user state in the REE.

[0105] Specifically, the memory hardware access control module 201 can complete hardware access control based on the memory partition form configured by the electronic device, which can be implemented using a trust zone address space controller (TZASC). Among them, the memory partition form is a configuration form for the partition of system memory and hardware permissions. Specifically, the electronic device can divide a larger memory from the system memory as secure memory. The memory partition form may include multiple services (including secure intelligent services and ordinary services) and the memory range corresponding to each of the multiple services. The memory partition form includes ordinary secure memory and intelligent business secure memory, and the intelligent business secure memory allows the CPU, NPU and specific data input hardware (such as a fingerprint reading module) to access it in hardware.

[0106] The memory management module 2022 is used to manage the secure memory in the TEE and allocate a corresponding memory range for each TA. Users are allowed to apply for memory from the general secure memory range and the intelligent business secure memory range recorded in the memory partition form, and can also perform software access control on the memory based on the memory permission control form.

[0107] The memory software access control module 2021 is used to verify the identity of the application that initiates the memory access request on the REE side. Specifically, the memory software access control module 2021 can determine whether the memory range requested by an application to access is within the memory range pre-allocated by the application based on the memory permission control form.

[0108] It should be understood that the above-mentioned memory permission control form can be divided based on the memory partition form and stored in the electronic device. The memory permission control form can indicate which TAs are allowed to access a specific memory range. The memory ranges in the memory permission control form are all secure memories related to smart business in the above-mentioned memory partition form. The electronic device can obtain a memory range form based on the memory permission control form. The memory range form includes multiple memory identifiers (or memory numbers) and the memory ranges corresponding to each of the multiple memory identifiers. The memory range form is used to specify a unique number for each memory range in the memory permission control form.

[0109] In addition, the electronic device may also generate a task model form, which includes multiple memory identifiers and task models corresponding to each of the multiple memory identifiers. The task model form is used to indicate that when a task model is used, the task model and / or the data of the task model are stored in a memory range corresponding to the memory identifier corresponding to the task model.

[0110] The business driver 203 is used to configure the memory partition form and the memory permission control form to the parameter verification module 2031, and configure the task model to the AI ​​reasoning module 2051.

[0111] The parameter verification module 2031 is used to perform parameter verification on the input parameters of the task model, specifically to verify whether the memory range of the input parameters determined from the memory range form is within the corresponding memory range in the memory permission control form. If the memory range of the input parameters is within the corresponding memory range, the parameter verification module will send the input parameters to the AI ​​reasoning module 2051. If the memory range of the input parameters is outside the corresponding memory range, the NPU logic will deny service. It should be understood that the parameter verification module 2031 and the AI ​​reasoning module 2051 are included in the NPU logic.

[0112] The AI ​​reasoning module 2051 is used to perform data processing (or AI reasoning) on ​​the above input parameters (or target data in the above embodiments).

[0113] The memory management module 2041 is used to manage the normal memory in the REE, and is also used to send a memory access request to the secure memory driver 202, that is, to request access to the secure memory in the TEE. In addition, the memory management module 2041 is also used for the user to apply for secure memory from the memory range recorded in the memory permission control form.

[0114] In an embodiment of the present application, the NPU may include TEE and REE, wherein TEE may include TEE user state and TEE kernel state, and REE may include REE user state and REE kernel state. In the initialization phase, the business driver in the TEE kernel state may send a memory request to the secure memory driver in the TEE kernel state, that is, request the secure memory driver in the TEE kernel state to allocate secure memory for each TA in the TEE user state. Afterwards, each TA in the TEE user state can directly use (or access) the secure memory corresponding to each TA in the TEE kernel state (that is, the memory range pre-allocated by each TA).

[0115] Similarly, during the initialization phase, the business driver in the REE kernel state can send a memory request to the secure memory driver in the REE kernel state, and the secure memory driver in the REE kernel state can allocate memory in the REE kernel state (which can be understood as ordinary memory) for each CA in the REE user state. Afterwards, each CA in the REE user state can directly use (or access) the ordinary memory in the REE kernel state corresponding to each CA.

[0116] The main process of the embodiment of the present application involves: in the initialization phase, the business driver in the REE kernel state can send a memory application to the secure memory driver in the TEE kernel state via the secure memory driver in the REE kernel state, that is, request the secure memory driver in the TEE kernel state to allocate secure memory for each CA in the REE user state. After the secure memory application is completed, each CA in the REE user state can create a TA, and send a memory access request to the secure memory driver in the REE kernel state based on the created TA, and then the secure memory driver in the REE kernel state will forward the memory access request to the secure memory driver in the TEE kernel state. After the secure memory driver in the TEE kernel state passes the identity verification of the created TA, the secure memory driver in the TEE kernel state can notify the created TA via the secure memory driver in the REE kernel state that it has the access rights of the TEE kernel state. At this time, the target data can be obtained from the secure memory of the TEE kernel state based on the created TA.

[0117] For example, Figure 6As shown. In the initialization phase, the business driver 301 in the TEE kernel state can directly send a secure memory request to the secure memory driver 302 in the TEE kernel state, that is, request the secure memory driver 302 in the TEE kernel state to allocate secure memory for the TA 303 in the TEE user state. Afterwards, the TA 303 in the TEE user state can directly use (or access) the secure memory corresponding to the TA 303 in the TEE kernel state. Similarly, the business driver 304 in the REE kernel state can also directly send a normal memory request to the secure memory driver 305 in the REE kernel state, that is, request the secure memory driver 305 in the REE kernel state to allocate normal memory for the CA 306 in the REE user state. Afterwards, the CA306 in the REE user state can directly use (or access) the normal memory corresponding to the CA306 in the TEE kernel state.

[0118] In addition, CA 306 in REE user state can create a corresponding TA, and apply for secure memory to secure memory driver 302 in TEE kernel state via secure memory driver 305 in REE kernel state based on business driver 304 in REE kernel state. After the secure memory application is completed, CA 306 in REE user state can send a memory access request to secure memory driver 305 in REE kernel state based on the created TA. Afterwards, secure memory driver 305 in RRE kernel state will send the memory access request to secure memory driver 302 in TEE kernel state. After secure memory driver 302 in TEE kernel state performs identity verification on the created TA and passes it, secure memory driver 302 in TEE kernel state can notify CA 306 in REE user state via secure memory driver 305 in REE kernel state that the created TA has access rights to secure memory in TEE kernel state. At this time, the TA created based on CA 306 can obtain corresponding data from secure memory in TEE kernel state.

[0119] That is, the AI ​​processor (or NPU) in this application includes two secure memory drivers, which are deployed on the REE side and the TEE side respectively. Among them, the secure memory driver on the TEE side only retains the basic configuration functions, specifically to determine whether the memory range to be accessed is within the target memory range. The main body of the security intelligence service is still deployed on the REE side. By allocating secure memory to the security intelligence service in advance and creating the corresponding memory partition form, it is ensured that the data in the memory cannot be stolen or tampered with through other hardware such as ciphers.

[0120] In addition, the memory permission control form, memory range form, and task model form can associate the memory range, TA, memory number, and task model. This ensures that the data in the memory can only be read and written by the specified TA, preventing malicious programs from stealing or tampering. That is: through the above four forms (including the memory partition form, memory permission control form, memory range form, and task model form), data security is guaranteed in hardware and software. In the business process, secure memory can be directly applied in REE user state, REE kernel state, TEE user state, and TEE kernel state, which reduces the process and improves the efficiency of memory application.

[0121] In this application, the method for allocating secure memory for secure intelligence services can refer to Figure 7 As shown: the secure media memory zone (SMMZ) 401 is used to pre-allocate corresponding memory ranges for TAs (including TA2...TAN, N is an integer greater than or equal to 2) in the secure intelligent service. When the TA included in the secure intelligent service needs to access the secure memory, it can directly access the memory range corresponding to the TA in the secure memory 402 and obtain the data stored in the memory range.

[0122] The TA (e.g., TA1) in the normal service (or non-secure intelligent service) needs to reach the encryption abstraction layer 404 (libutee) from the SMMZ 403 (which can be understood as the secure memory driver on the REE side in the above embodiment), call the SMMZ 405 in the TEE through the system, and apply for secure memory from the SMMZ 405.

[0123] In addition, other security modules in TEE (including key management module 406 (cipher)) can directly apply for secure memory from SMMZ405.

[0124] based on Figure 7 The memory allocation process shown in the figure can obtain the corresponding memory partition form, memory permission control form, memory range form and task model form. For example, Figure 8 The memory permission control form and memory range form are shown. Specifically, Figure 8 The memory range table in the NPU logic shown in FIG. 1 includes multiple memory numbers and memory ranges corresponding to the multiple memory numbers. Figure 8 The memory permission control form shown in includes UUIDs of multiple TAs and memory ranges corresponding to the UUIDs of the multiple TAs. The multiple memory ranges included in the memory range form are the same as the multiple memory ranges included in the memory permission control form.

[0125] Combine the following Figure 5The NPU architecture shown in the figure introduces the data acquisition method provided by the embodiment of the present application. Specifically, Fig. 9 As shown, the data acquisition method provided in the embodiment of the present application may include S101-S107.

[0126] S101, in the initialization phase, the memory management module in the secure memory driver in the TEE kernel state divides the memory of all applications based on the memory partitioning form, allocates memory ranges to multiple TAs based on the memory permission control form, allocates memory numbers to multiple task models based on the task model form, and divides memory ranges for multiple memory numbers based on the memory range form.

[0127] In combination with the description of the above embodiments, the memory permission control form includes multiple TAs and memory ranges corresponding to each of the multiple TAs, the task model form includes multiple memory numbers and task models corresponding to each of the multiple memory numbers, and the memory range form includes multiple memory numbers and memory ranges corresponding to each of the multiple memory numbers.

[0128] S102: The memory management module in the secure memory driver in the REE kernel state obtains a memory access request of the target application in the REE user state.

[0129] The target application is an application program included in (or installed in) the electronic device, such as a video application, a text application, or a map application with high credibility.

[0130] The memory access request may be used to request access to a certain memory range, which may be referred to as a memory range to be accessed. The memory access request includes the memory range to be accessed. The memory range request includes an identifier of a target application and / or an identifier of a target task model.

[0131] Specifically, a memory range includes a starting address of a memory and the size of the memory. Optionally, the electronic device can determine the ending address of the memory based on the starting address of the memory and the size of the memory, and use the starting address and the ending address as the memory range of the memory.

[0132] In an optional implementation, the target application is a TA, which is created based on a CA, and the CA is an application that exists (or initiates a request) in a non-secure processing area (eg, REE).

[0133] In an embodiment of the present application, REE is a processing area that can be directly operated (or touched) by the user, and the display interface of the electronic device may include the respective identifications of multiple CAs. When the user needs to obtain target data, a CA corresponding to the target data can be determined from multiple CAs, and a preset operation (such as a click operation) can be performed on the CA. In response to the user's preset operation on the CA, the electronic device can create a TA based on the CA, the substance (or type) of the TA is the same as the substance (or type) of the CA, and the credibility of the TA is higher than the credibility of the CA. Thus, the electronic device can initiate a memory access request based on the TA, that is, request access to the above-mentioned memory range to be accessed.

[0134] S103. The memory management module in the secure memory driver in the REE kernel state sends a memory access request to the memory software access control module in the secure memory driver in the TEE kernel state.

[0135] S104. The memory software access control module in the secure memory driver in the TEE kernel state determines whether the memory to be accessed is within the target memory range.

[0136] The target memory range may include a memory range pre-allocated for the target application.

[0137] In the present application, the electronic device can pre-allocate memory ranges for multiple applications installed thereon, and one application can correspond to one or more memory ranges. Specifically, the memory range can be allocated to the application according to the application identifier or the type of application, for example, the memory range can be allocated to the application corresponding to each of the multiple application identifiers based on multiple application identifiers and permission control relationships. Specifically, the electronic device can query the permission control relationship based on an application identifier to determine that the application identifier exists in the permission control relationship, and then determine the memory range corresponding to the application identifier as the pre-allocated memory range of the application corresponding to the application identifier.

[0138] Specifically, pre-allocating a memory range (i.e., a target memory range) for a target application can also be understood as pre-allocating access rights to the target memory range for the target application or the target application having access rights to the target memory range, and the electronic device can access the content stored in the target memory range based on the target application.

[0139] S105. If the memory software access control module in the secure memory driver in the TEE kernel state determines that the memory range to be accessed is within the target memory range, the parameter verification module in the business driver in the TEE kernel state verifies the input data of the AI ​​model.

[0140] In an embodiment of the present application, the electronic device can perform identity verification on the application that initiates the memory access request (i.e., the target application) based on the target memory range. If the memory range to be accessed is within the target memory range, it means that the memory range accessed based on the target application request meets the memory range pre-allocated by the target application, that is, the target application has access rights to the memory range to be accessed, and the electronic device can obtain the target data from the memory range to be accessed, and the target data is stored in the memory range to be accessed.

[0141] In an optional implementation, the electronic device may determine the target memory range based on the identifier of the target application and the above-mentioned memory permission control form.

[0142] Specifically, the memory software access control module in the secure memory driver of the TEE kernel state can query the permission control relationship (i.e., the above-mentioned memory permission control form) based on the identifier of the target application, and determine that the identifier of the target application exists in the permission control relationship. And the memory range corresponding to the identifier of the target application in the permission control relationship is determined as the target memory range.

[0143] The permission control relationship includes a plurality of application identifiers and memory ranges corresponding to the plurality of application identifiers. The memory range corresponding to an application identifier is a memory range pre-allocated by the electronic device for the application corresponding to the application identifier.

[0144] Exemplarily, an application identifier (or an application identifier) ​​may be a universally unique identifier (UUID).

[0145] Exemplarily, the following Table 1 is an example of a permission control relationship provided in an embodiment of the present application. Specifically, the permission control relationship includes three application identifiers (including application identifier 1, application identifier 2, and application identifier 3) and the memory ranges corresponding to each of the three application identifiers. Specifically, the memory range corresponding to application identifier 1 includes memory range 1 and memory range 2, the memory range corresponding to application identifier 2 includes memory 3, and the memory range corresponding to application identifier 3 includes memory range 4, memory range 5, and memory range 6.

[0146] Table 1

[0147]

[0148]

[0149] Assuming that the identifier of the target application is application identifier 1, the electronic device determines that the target memory range includes memory range 1 and memory range 2.

[0150] In another optional implementation, the electronic device may also determine the memory number corresponding to the target task model from the task model form based on the identifier of the target task model, and determine the memory range corresponding to the memory number in the memory range form as the target memory range.

[0151] S106. After the parameter verification module in the business driver in the TEE kernel state verifies the input data of the target task model, the parameter verification module in the business driver in the TEE kernel state will obtain the input data of the target task model from the secure memory in the TEE kernel state and send the input data to the AI ​​reasoning module in the REE user state.

[0152] S107. After receiving the input data of the target task model, the AI ​​reasoning module in the REE user state performs AI reasoning on the input data to obtain the reasoning result of the target task model.

[0153] The input data is AI data, which may be data included in specific data input hardware such as NPU. AI data may include task models and data related to the task models (including weights, parameters, etc.). Specifically, the task models may include speech recognition models, image recognition models, fingerprint recognition models, etc.

[0154] Optionally, if the memory software access control module in the secure memory driver in the TEE kernel state determines that the memory range to be accessed is outside the target memory range, the electronic device can issue an alarm message. Specifically, if the memory range to be accessed is outside the target memory range, it means that the memory range requested for access based on the target application does not conform to the memory range pre-allocated by the target application, that is, the target application does not have access rights to the memory range to be accessed. At this time, the electronic device can issue an alarm message (or return an error message) to remind the current target application that there is an error and that services should be refused for the target application, which can effectively reduce the risk of data tampering while saving service resources of the electronic device.

[0155] based on Fig. 9According to the method shown, after the AI ​​processor including REE and TEE in the electronic device obtains the memory access request of the target application, the first secure memory driver included in the REE can send a memory access request to the second secure driver included in the TEE, and the second secure driver determines whether the memory range to be accessed is within the target memory range. If the second secure driver determines that the memory range to be accessed is within the target memory range, it means that the memory range requested to be accessed based on the target application is consistent with the memory range pre-allocated by the target application, that is, the target application has access rights to the memory range to be accessed, and the electronic device can obtain the target data from the memory to be accessed. In the embodiment of the present application, since the target memory range includes a memory range pre-allocated for the target application, the electronic device does not need to apply for memory for the target data in the process of obtaining the target data, and can directly obtain the target data from the memory range requested to be accessed, which can meet the scenario of frequent use of related data and improve the effectiveness of data acquisition.

[0156] In one implementation of the embodiment of the present application, the processing area included in the electronic device can be divided into a secure processing area and a non-secure processing area, and the security level (or degree of trustworthiness) of the secure processing area is higher than the security level (or degree of trustworthiness) of the non-secure processing area. Specifically, the secure processing area can be a TEE, and the non-secure processing area can be a REE.

[0157] Among them, the memory range pre-allocated by each application (including the target memory range) and the memory range to be accessed are the memory range included in the secure processing area (or TEE), which can also be called secure memory.

[0158] It can be understood that, in actual implementation, the electronic device described in the embodiment of the present application may include one or more hardware structures and / or software modules for implementing the aforementioned corresponding data acquisition method, and these execution hardware structures and / or software modules may constitute an electronic device. It should be easily appreciated by those skilled in the art that, in conjunction with the algorithm steps of each example described in the embodiment applied for herein, the present application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a function is executed in the form of hardware or computer software driving hardware depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present application.

[0159] Fig.10 is a schematic diagram of the structure of another data acquisition device provided by the present application. Fig.10The data acquisition device 50 may include at least one processor 501 and a memory 503 for storing processor executable instructions. The processor 501 is configured to execute instructions in the memory 503 to implement the data acquisition method in the above embodiment.

[0160] In addition, the data acquisition device 50 may further include a communication bus 502 and at least one communication interface 504 .

[0161] The processor 501 may be a central processing unit (CPU), a microprocessing unit, an ASIC, or one or more integrated circuits for controlling the execution of the program of the present application.

[0162] Communication bus 502 may include a pathway for transmitting information between the above-mentioned components.

[0163] The communication interface 504 uses any transceiver or other device for communicating with other devices or communication networks, such as Ethernet, radio access network (RAN), wireless local area networks (WLAN), etc.

[0164] The memory 503 may be a read-only memory (ROM) or other types of static storage devices that can store static information and instructions, a random access memory (RAM) or other types of dynamic storage devices that can store information and instructions, or an electrically erasable programmable read-only memory (EEPROM), a compact disc read-only memory (CD-ROM) or other optical disc storage, optical disc storage (including compressed optical disc, laser disc, optical disc, digital versatile disc, Blu-ray disc, etc.), a magnetic disk storage medium or other magnetic storage device, or any other medium that can be used to carry or store the desired program code in the form of an instruction or data structure and can be accessed by a computer, but is not limited thereto. The memory may be independent and connected to the processing unit via a bus. The memory may also be integrated with the processing unit.

[0165] The memory 503 is used to store instructions for executing the solution of the present application, and the execution is controlled by the processor 501. The processor 501 is used to execute the instructions stored in the memory 503, so as to realize the functions in the method of the present application.

[0166] In a specific implementation, as an embodiment, the processor 501 may include one or more CPUs, such as Fig.10 CPU0 and CPU1 in.

[0167] In a specific implementation, as an embodiment, the data acquisition device 50 may include multiple processors, such as Fig.10 501 and processor 507 in the embodiment of the present invention. Each of these processors may be a single-CPU processor or a multi-CPU processor. The processor herein may refer to one or more devices, circuits, and / or processing cores for processing data (e.g., computer program instructions).

[0168] In a specific implementation, as an embodiment, the data acquisition device 50 may also include an output device 505 and an input device 506. The output device 505 communicates with the processor 501 and can display information in a variety of ways. For example, the output device 505 may be a liquid crystal display (LCD), a light emitting diode (LED) display device, a cathode ray tube (CRT) display device, or a projector. The input device 506 communicates with the processor 501 and can accept user input in a variety of ways. For example, the input device 506 may be a mouse, a keyboard, a touch screen device, or a sensor device.

[0169] In one embodiment, the CPU may also establish a logical relationship with the AI ​​processor or NPU in the above embodiments. For example, the CPU may include the NPU, or the electronic device may include the CPU and the NPU, or the CPU and the NPU may be deployed independently.

[0170] The naming of the acquisition module mentioned in the present application is not limited and can also be named by other names, such as receiving module or receiving unit. In addition, the acquisition module can be divided into smaller-granularity functional units according to its functions, and each functional unit combination executes the function of the acquisition module, etc., without limitation.

[0171] Those skilled in the art will understand that Fig.10 The structure shown in the figure does not constitute a limitation on the data acquisition device 50, and the data acquisition device 50 may include more or less components than those shown in the figure, or combine certain components, or adopt a different component arrangement.

[0172] In addition, the present application also provides a computer-readable storage medium, including instructions, which, when executed by an electronic device, enable the electronic device to execute the data acquisition method provided in the above embodiment.

[0173] In addition, the present application also provides a computer program product, including instructions, which, when executed by an electronic device, enable the electronic device to execute the data acquisition method provided in the above embodiment.

[0174] Those skilled in the art will readily appreciate other embodiments of the present application after considering the specification and practicing the invention disclosed herein. The present application is intended to cover any modification, use or adaptation of the present application, which follows the general principles of the present application and includes common knowledge or customary techniques in the art that are not disclosed in the present application. The specification and examples are intended to be exemplary only, and the true scope and spirit of the present application are indicated by the claims.

Claims

1. A data acquisition method, characterized in that: An artificial intelligence (AI) processor including a rich execution environment (REE) and a trusted execution environment (TEE) is provided with a first secure memory driver and a second secure memory driver, wherein the REE includes the first secure memory driver and the TEE includes the second secure memory driver, and the method includes: The AI ​​processor obtains a memory access request of a target application, where the memory access request includes a memory range to be accessed; The first secure memory driver sends the memory access request to the second secure memory driver; If it is determined in the second secure memory driver that the memory range to be accessed is within a target memory range, target data is acquired from the memory range to be accessed, and the target memory range includes a memory range pre-allocated for the target application.

2. The data acquisition method according to claim 1, characterized in that: The memory access request also includes an identifier of the target application, and the target memory range is determined based on the identifier of the target application.

3. The data acquisition method according to claim 2, characterized in that: The target memory range is a memory range corresponding to the identifier of the target application in the permission control relationship, and the permission control relationship includes multiple application identifiers and memory ranges corresponding to each of the multiple application identifiers.

4. The data acquisition method according to claim 2 or 3, characterized in that: The method further comprises: Querying the permission control relationship based on the identifier of the target application, and determining that the identifier of the target application exists in the permission control relationship, wherein the permission control relationship includes multiple application identifiers and memory ranges corresponding to each of the multiple application identifiers; The memory range corresponding to the identifier of the target application in the permission control relationship is determined as the target memory range.

5. The data acquisition method according to claim 3 or 4, characterized in that: Before obtaining the memory access request of the target application, the method further includes: Based on the permission control relationship, a memory range is allocated to the application corresponding to each of the multiple application identifiers.

6. The data acquisition method according to any one of claims 1 to 5, characterized in that: The target memory range is a memory range included in the secure processing area.

7. The data acquisition method according to claim 6, characterized in that: The secure processing area is a trusted execution environment TEE.

8. The data acquisition method according to any one of claims 1 to 7, characterized in that: The target application is a trusted application TA.

9. The data acquisition method according to claim 8, characterized in that: The TA is created based on a client application CA, which is an application initiated from a non-secure processing area.

10. The data acquisition method according to claim 9, characterized in that: The non-secure processing area is a rich execution environment REE.

11. The data acquisition method according to claim 9 or 10, characterized in that: The method further comprises: The target data is processed in the non-secure processing area.

12. The data acquisition method according to any one of claims 1 to 11, characterized in that: The memory range to be accessed includes a starting address of the memory to be accessed and a size of the memory to be accessed.

13. The data acquisition method according to any one of claims 1 to 12, characterized in that: The target data is artificial intelligence AI data.

14. The data acquisition method according to any one of claims 1 to 13, characterized in that: The method further comprises: If the memory range to be accessed is outside the target memory range, an alarm message is issued.

15. A data acquisition device, characterized in that: An artificial intelligence AI processor is applied to a rich execution environment (REE) and a trusted execution environment (TEE), and is provided with a first secure memory driver and a second secure memory driver, wherein the REE includes the first secure memory driver, the TEE includes the second secure memory driver, the first secure memory driver includes a first acquisition module and a sending module, and the second secure driver includes a second acquisition module; The first acquisition module is used for the AI ​​processor to acquire a memory access request of a target application, where the memory access request includes a memory range to be accessed; The sending module is configured to send the memory access request from the first secure memory driver to the second secure memory driver; The second acquisition module is used to acquire target data from the memory range to be accessed if it is determined in the second secure memory driver that the memory range to be accessed is within a target memory range, and the target memory range includes a memory range pre-allocated for the target application.

16. An electronic device, characterized in that: The electronic device comprises: Memory; Communication interface; one or more processors; Wherein, one or more computer programs are stored in the memory, and the one or more computer programs include instructions. When the instructions are executed by the electronic device, the electronic device executes the data acquisition method as described in any one of claims 1-14.

17. A computer-readable storage medium, characterized in that: The method comprises computer instructions, and when the computer instructions are executed on an electronic device, the electronic device executes the data acquisition method according to any one of claims 1 to 14.

18. A computer program product comprising instructions, characterized in that When the instruction is executed on an electronic device, the electronic device executes the data acquisition method according to any one of claims 1 to 14.

Images