Distributed TEE system and communication method based on distributed TEE system

Abstract

The invention relates to a distributed TEE system and a communication method based on the distributed TEE system, the system comprises a plurality of TEEs, a secure world of each TEE comprises a key management module and a communication calling module, and a trusted operating system of each TEE comprises an encryption and decryption module. Each module is called by a security monitor in the TEE or runs in a first memory of a security world which can be accessed by a common world; the key management module is used for generating a key; the encryption and decryption module is used for encrypting specified data according to the key when the TEE responds to the memory access instruction to generate the specified data, verifying the integrity of a first data packet when receiving the first data packet transmitted by other TEEs, and decrypting the first data packet according to the key; and the communication calling module is used for packaging the encrypted specified data and / or the decrypted first data packet into a second data packet. By adopting the method, the security of data communication when the TEE system is deployed in the distributed system can be improved.

Description

Technical Field

[0001] The present application relates to the field of trusted execution environment, in particular to a distributed TEE system and a communication method based on a distributed TEE system. Background Art

[0002] TEE (Trusted Execution Environment) is a secure computing environment that combines software and hardware to ensure the confidentiality and integrity of data and code during execution. TEE provides a secure, isolated environment for mobile devices and other types of hardware to ensure that sensitive data and critical code run under protection. Current research on TEE is mostly focused on devices such as CPU (Central Processing Unit) or GPU (Graphics Processing Unit). It considers the expansion of the boundaries of TEE in the system and continuously expands the scope of TEE to protect the data of multiple devices. However, it does not consider the security issues of communication between different TEEs, and lacks security considerations for deploying TEE systems in distributed systems.

[0003] There is currently no effective solution to the problem of low data security when deploying TEE systems in distributed systems in related technologies. Summary of the Invention

[0004] Based on this, it is necessary to provide a distributed TEE system and a communication method based on the distributed TEE system to solve the problem of low data security when the TEE system is deployed in a distributed system, in response to the above technical problems.

[0005] In a first aspect, a distributed TEE system is provided in this embodiment. The distributed TEE system includes: multiple TEEs, each TEE's secure world includes a key management module and a communication call module, the TEE's trusted operating system includes an encryption and decryption module, the key management module, the communication call module, and the encryption and decryption module are called by a security monitor in the TEE or run in a first memory, and the first memory is a partial memory area in the TEE's secure world that can be accessed by programs and operating systems in the ordinary world; wherein,

[0006] The key management module is used to generate keys corresponding to each TEE;

[0007] The encryption and decryption module is configured to encrypt the specified data according to the key when the TEE generates the specified data in response to the memory access instruction; upon receiving a first data packet transmitted by another TEE, verify the integrity of the first data packet and, if the first data packet is intact, decrypt the first data packet according to the key;

[0008] The communication calling module is used to encapsulate the encrypted designated data and / or the decrypted first data packet into a second data packet.

[0009] In some embodiments, the distributed TEE system includes a primary TEE and multiple secondary TEEs, the primary TEE includes a first security monitor, and the first security monitor is provided with a first security check module, a first function call module, the key management module and the communication call module; wherein,

[0010] The first function call module is used to provide a function call interface for the encryption and decryption module of the first-level TEE;

[0011] The first security check module is used to call the encryption and decryption module of the first-level TEE through the function call interface to verify the integrity of the first data packet when the first data packet is received, and to decrypt the first data packet according to the key when the first data packet is complete.

[0012] In some embodiments, the communication calling module is configured to encapsulate the encrypted designated data and / or the decrypted first data packet into a second data packet, including:

[0013] The communication calling module of the first-level TEE is used to encapsulate the encrypted specified data into a second data packet and transmit it to the second-level TEE through the application in the TEE; and / or to encapsulate the decrypted first data packet into the second data packet when the data obtained by decrypting the first data packet is non-control data.

[0014] In some embodiments, the distributed TEE system includes a common world and a secure world that are isolated from each other, the distributed TEE system includes a primary TEE and multiple secondary TEEs, and the memory of the secure world accessible to the secondary TEE includes the first memory and the second memory; wherein,

[0015] The first memory is a memory area that can be accessed by programs and an operating system in the ordinary world based on a preset interface;

[0016] The second memory is a memory area that cannot be accessed by programs and operating systems in the ordinary world.

[0017] In some embodiments, the distributed TEE system includes a primary TEE and multiple secondary TEEs, the secondary TEE includes a second security monitor, and the second security monitor is provided with a second function call module, the key management module and the communication call module; wherein,

[0018] The second function call module is used to provide a function call interface to call the encryption and decryption module of the secondary TEE to verify the integrity of the first data packet, and decrypt the first data packet according to the key when the first data packet is complete, and / or call the encryption and decryption module of the secondary TEE to encrypt the specified data.

[0019] In some embodiments, the distributed TEE system includes a primary TEE and multiple secondary TEEs. When the secondary TEE includes multiple trusted operating systems, each trusted operating system is respectively provided with the encryption and decryption module.

[0020] In a second aspect, this embodiment provides a communication method based on a distributed TEE system, wherein the distributed TEE system includes multiple TEEs. If the secure world of the TEE includes a security monitor, the method is executed based on the security monitor. If the TEE does not include the security monitor, a first memory accessible to programs and an operating system in the ordinary world is determined in the secure memory of the TEE, and the method is executed in the first memory. The method includes:

[0021] Upon receiving a first data packet transmitted by another TEE, verify the integrity of the first data packet, and if the first data packet is complete, decrypt the first data packet based on the key corresponding to the other TEE by calling the key, and execute the corresponding memory access instruction based on the decrypted data;

[0022] When obtaining the specified data generated by the TEE in response to the memory access instruction, the key corresponding to the TEE is called to encrypt and encapsulate the specified data, and the second data packet obtained after encapsulation is transmitted to the corresponding other TEE and / or the corresponding electronic control unit.

[0023] In some embodiments, executing a corresponding memory access instruction based on the decrypted data includes:

[0024] Determining whether the data obtained after decryption of the data packet is preset control data;

[0025] If the decrypted data is the control data, sending the decrypted data to the corresponding electronic control unit;

[0026] If the data obtained after the decryption is non-control data, the data obtained after the decryption is stored in the corresponding memory.

[0027] In some embodiments, the distributed TEE system includes a mutually isolated normal world and a secure world, the normal world accessible memory is normal memory, and the secure world accessible memory is secure memory, and if the decrypted data is non-control data, storing the decrypted data in the corresponding memory includes:

[0028] When it is determined according to the data transmission type of the data packet that the data obtained after decryption belongs to the first category of data, granting read permission to the designated data and storing the data obtained after decryption in the general memory;

[0029] When it is determined according to the data transmission type of the data packet that the data obtained after decryption belongs to the second category of data, the data obtained after decryption is stored in the secure memory.

[0030] In some embodiments, after storing the decrypted data in a secure memory, the method further includes:

[0031] Encapsulating the decrypted data;

[0032] The encapsulated data packet is transmitted to the other TEE in response to the data sending instruction.

[0033] The above-mentioned distributed TEE system and the communication method based on the distributed TEE system call the key management module, the communication call module and the encryption and decryption module for operation through the security monitor, or run the key management module, the communication call module and the encryption and decryption module through the first memory, so that each TEE can first check the security of the data packet, and then execute the memory access instruction corresponding to the data packet, thereby avoiding the direct access of programs in the ordinary world to the resources of the secure world, thereby improving the security of data communication when multiple TEEs are deployed in the distributed system. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] Figure 1 Schematic diagram of the structure of a distributed TEE system in one embodiment;

[0035] Figure 2 This is a schematic diagram of the structure of a distributed TEE system in another embodiment;

[0036] Figure 3 This is a schematic diagram of the structure of a distributed TEE deployed in a smart car in one embodiment;

[0037] Figure 4This is a schematic diagram of the Level 1 Center-TEE architecture in one embodiment;

[0038] Figure 5 Schematic diagram of a 2-level subf-TEE architecture in one embodiment;

[0039] Figure 6 Schematic diagram of a 2-level subs-TEE architecture in one embodiment;

[0040] Figure 7 Schematic diagram of a 2-level subt-TEE architecture in one embodiment;

[0041] Figure 8 Schematic diagram of a second-level subf-TEE sending data to a first-level Center-TEE in one embodiment;

[0042] Figure 9 Schematic diagram of a second-level subs-TEE sending data to a first-level Center-TEE in one embodiment;

[0043] Figure 10 This is a schematic diagram of a second-level subt-TEE sending data to a first-level Center-TEE in one embodiment. DETAILED DESCRIPTION

[0044] In order to make the purpose, technical solutions and advantages of this application more clear, the following further describes this application in detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain this application and are not intended to limit this application.

[0045] In related technologies, to protect safety-critical applications and data, ARM initially proposed the TrustZone architecture (a TEE architecture) in 2009. This architecture divides the system into a secure world and a normal world, with safety-critical data only accessible and usable in the secure world. In 2013, Intel proposed the SGX (Software Guard Extensions) design, introducing the concept of enclaves. When a normal user program uses safety-critical data, an enclave is created. All operations on safety-critical data are performed within the enclave. Once the data leaves the enclave, it is automatically encrypted to prevent sensitive data leakage. In 2016, AMD proposed the Secure Encrypted Virtualization (SEV) architecture, which stores security-critical data in encrypted form. When this data is needed, it is loaded into a virtual machine for decryption, and all related data operations are enclosed within the virtual machine. With the rise of the RISC-V (Reduced Instruction Set Computer-Vector Extensions) instruction set architecture, the business and academic communities have gradually begun to research RISC-V-based TEE architectures. In 2020, Keystone was first proposed. This technology utilizes the RISC-V architecture's unique PMP (Physical Memory Protection) mechanism to create enclaves and limit their permissions, becoming the first TEE design based on the RISC-V architecture. In 2021, Shanghai Jiao Tong University designed and implemented a scalable RISC-V-based TEE system called "Penglai." The Penglai architecture extends existing RISC-V hardware primitives to allow for scalable physical memory isolation. In 2021, ARM proposed the more complex and fine-grained CCA (Confidential Compute Architecture) architecture, which implements virtual machine-level isolation protection and restricts the use of security-critical data to the Realm (the Realm world in the ARM CCA architecture) VM (Virtual Machine). In 2023, Intel also proposed a virtual machine-level TEE architecture—Intel TDX—which uses security-critical data only within confidential VMs and isolates confidential VMs from the hardware.

[0046] However, the above-mentioned TEE architectures are all focused on the CPU, without considering the interaction between the CPU and the device. With the advent of the big data era, many applications have begun to use heterogeneous devices such as FPGA (Field Programmable Gate Array), GPU, NPU (Neural Processing Unit) to improve program performance, which is also accompanied by various security risks. Therefore, the academic community has begun to study extending the TEE boundary to the heterogeneous device side to ensure the comprehensive security of data between the CPU and heterogeneous devices. In 2018, a GPU-supported TEE architecture was proposed - Graviton. It redefines the interface between the GPU driver and hardware, introduces the concept of security context, and realizes the secure isolation of device interaction data. In 2019, the HIX architecture was proposed. This architecture extends the CPU TEE to the GPU by reconstructing the GPU device driver to ensure the security of data flowing from the CPU to the GPU. In 2022, various heterogeneous device TEE architectures such as StrongBox, TNPU, and CRONUS were proposed. The StrongBox architecture was expanded on the basis of TrustZone to ensure the security of general computing on integrated GPUs; the TNPU architecture mainly focuses on designing low-overhead integrity protection and data encryption solutions to achieve high-performance, low-loss, secure and trusted NPU; the CRONUS architecture takes into account the commonalities of different devices and designs a universal TEE architecture suitable for a variety of heterogeneous devices, supporting simultaneous connection of different devices and providing a secure and isolated execution environment for multiple devices. In 2024, the CAGE architecture was proposed, which extended ARM CCA, introduced a shadow task mechanism, and combined multiple GPTs (Granule Protection Table) to collaboratively protect GPU computing tasks; in the same year, the ACAI architecture was proposed. This architecture mainly focuses on the damage that damaged heterogeneous devices may cause to system memory when connected to the CPU. By deploying SMMU (device-side Memory Management Unit) and GPC (Granule Protection Check) checks, data from heterogeneous devices are security checked and isolated, thereby protecting data security on the CPU side.

[0047] However, the above-mentioned related technologies lack consideration for deploying TEEs in distributed systems, do not support deploying different TEEs in distributed systems, and do not consider the communication security issues between different TEEs.

[0048] To solve this problem, in one embodiment, a distributed TEE system is provided, which can be applied to terminals including but not limited to various personal computers, laptops, smart phones, tablets, Internet of Things devices, portable wearable devices, etc. Internet of Things devices can be smart speakers, smart TVs, smart air conditioners, smart car-mounted devices, etc. Portable wearable devices can be smart watches, smart bracelets, head-mounted devices, etc. The various modules in the distributed TEE system of this embodiment can be fully or partially implemented by software, hardware, and a combination thereof. The above-mentioned modules can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory of the computer device in the form of software, so that the processor can call and execute the operations corresponding to the above modules.

[0049] Figure 1 A schematic diagram of the distributed TEE system in this embodiment is provided. Figure 1 As shown, the distributed TEE system includes multiple TEEs. Each TEE's secure world includes a key management module and a communication call module, and the TEE's trusted operating system includes an encryption and decryption module. The key management module, communication call module, and encryption and decryption module are invoked by the TEE's security monitor or run in the first memory, which is a memory area in the TEE's secure world that is accessible to programs and the operating system in the normal world.

[0050] Among them, each TEE includes a secure world and a normal world that are isolated from each other, and the secure world and the normal world cannot directly access each other's data. The security monitor is used to provide a security service interface to the normal world, so that the normal world can access it through the security service interface provided by the security monitor. When the TEE includes a security monitor, the key management module, the communication call module and the encryption and decryption module are called by the security monitor to run, so that when data is communicated between TEEs, the data can be security checked based on the security monitor to prevent the programs in the normal world from directly accessing the resources of the secure world. When the TEE does not include a security monitor, the secure memory accessible to the secure world is at risk of being directly accessed by the programs and operating system in the normal world. By setting a first memory in the secure memory that can be accessed by the programs and operating system in the normal world, and performing security checks on the communication data between TEEs based on this special memory area of ​​the first memory, the effect of preventing the programs in the normal world from directly accessing the resources of the secure world can also be achieved.

[0051] Figure 1In [1], the key management module is responsible for generating keys for each TEE. Different TEEs have different keys, and these keys can be associated and stored with the corresponding TEE's identity through a mapping. Alternatively, different TEEs can have different identities, and keys can be generated based on these identities. Keys generated by the key management module are stored in secure memory, inaccessible to programs and the operating system in the normal world.

[0052] The encryption and decryption module is used to encrypt the specified data according to the key when the TEE generates the specified data in response to the memory access instruction; verify the integrity of the first data packet when receiving the first data packet transmitted by other TEEs, and decrypt the first data packet according to the key if the first data packet is complete.

[0053] The encryption / decryption module may store one or more encryption / decryption algorithms. Each encryption / decryption algorithm includes a corresponding function interface. Functions are called through the function interfaces in the encryption / decryption module to encrypt the specified data and decrypt the first data packet. If the first data packet is incomplete or cannot be decrypted using the key corresponding to the TEE module's identity identifier, the data packet is discarded.

[0054] Alternatively, integrity verification can be implemented using a hash value check: after performing an XOR operation on the calculated hash value and the hash value contained in the first data packet, if the result is non-zero, the integrity check is determined to have failed and the data packet is directly discarded; otherwise, the integrity check passes. It is understood that data packet integrity verification can also be implemented using other existing methods.

[0055] The communication calling module is used to encapsulate the encrypted designated data and / or the decrypted first data packet into a second data packet.

[0056] The first data packet is the data packet received by the TEE, and the second data packet is the data packet to be sent. Both the first data packet and the second data packet are TEE communication data packets. By encapsulating the data obtained after decryption of the first data packet as the second data packet, the specified data can be transmitted to the corresponding other TEE, and the key management module and encryption and decryption module in the other TEE can implement security verification of the data packet. Optionally, the communication call module is used to encapsulate the encrypted data into a TEE communication data packet and transmit it to the system where the corresponding other TEE is located via Ethernet.

[0057] In this embodiment, the key management module, the communication call module and the encryption and decryption module are called to run by the security monitor, or the methods in the key management module, the communication call module and the encryption and decryption module are run through the first memory, so that when TEE systems communicate data between TEEs, the security of the data packet can be checked first, and then the memory access instructions corresponding to the data packet are executed, thereby preventing programs in the ordinary world from directly accessing resources in the secure world, improving the security of data communication when multiple TEEs are deployed in a distributed system, and can be applied to various types of TEEs.

[0058] In some of these embodiments, Figure 2 Provides another structural diagram of a distributed TEE system, such as Figure 2 As shown in the figure, a distributed TEE system includes a primary TEE and multiple secondary TEEs. The primary TEE is responsible for managing the interaction and security between different TEEs. The primary TEE can communicate with one or more secondary TEEs via Ethernet. The architecture of each secondary TEE can be different or the same. Each secondary TEE can be applied to different subsystems of the terminal.

[0059] In one embodiment, the first-level TEE includes a first security monitor, in which a first security check module, a first function call module, a key management module and a communication call module are provided; wherein the first function call module is used to provide a function call interface for the encryption and decryption module of the first-level TEE; the first security check module is used to call the encryption and decryption module of the first-level TEE through the function call interface to verify the integrity of the first data packet when the first data packet is received from the second-level TEE, and to decrypt the first data packet according to the key when the first data packet is complete.

[0060] Optionally, the first security check module obtains the integrity of the data packet from the function in the encryption and decryption module through the first function call module, and determines whether the data packet passes the integrity check based on the function execution result and preset standards. The first security check module may also obtain the key generated by the key management module based on the secondary TEE, and obtain the decrypted data of the first data packet through the function in the first function call module using the key as a parameter.

[0061] Furthermore, after decrypting the first data packet, the first security check module can also determine the data type according to the transmission data type of the data packet, and encapsulate or transmit the data based on the data type through the communication call module. Among them, when the data is the control data of the terminal, the data obtained after decryption is analyzed in combination with the current execution environment context to see whether it can be executed. If the data can be executed, the CAN data packet corresponding to the control instruction is sent to the corresponding ECU (Electronic Control Unit) via the CAN (Controller Area Network) bus. When the data is non-control data of the terminal, data reading is allowed, and the data can also be encapsulated through the communication call module. In this embodiment, a first-level TEE is provided with a first security monitor. When the first-level TEE receives a data packet transmitted from a second-level TEE, the data packet is verified based on the first security monitor to determine whether the data packet has been tampered with and is safe, thereby improving the security of data communication between TEEs after the distributed system deploys TEEs.

[0062] Furthermore, in one embodiment, the communication call module is used to encapsulate the encrypted specified data and / or the decrypted first data packet into a second data packet, including: a communication call module of the first-level TEE, used to encapsulate the encrypted specified data into a second data packet and transmit it to the second-level TEE through an application in the TEE; and / or, when the data obtained by decrypting the first data packet is non-control data, encapsulating the decrypted first data packet into a second data packet.

[0063] The first data packet is the data packet received by the TEE, and the second data packet is the data packet to be sent. Both the first data packet and the second data packet are TEE communication data packets. Optionally, when the first-level TEE needs to send the data to the second-level TEE, after obtaining the data obtained after decrypting the first data packet, it can also encrypt the data through the encryption and decryption module, and then encapsulate the data into a TEE communication data packet.

[0064] Optionally, the TEE communication data packet encapsulated by the communication call module includes three parts: a header, a data portion, and a tail. The header field includes, but is not limited to, the TID (TEE Identity) and data type fields of the secondary TEE to be received. The data portion field is the encrypted data, and the tail field is a hash value of the header field and the data portion. In this embodiment, the communication call module encapsulates the data packet so that the secondary TEE that receives the second data packet can perform an integrity check on the second data packet.

[0065] In one embodiment, a distributed TEE system includes a normal world and a secure world that are isolated from each other. The distributed TEE system includes a first-level TEE and multiple second-level TEEs. The memory of the secure world accessible to the second-level TEE includes a first memory and a second memory; wherein, the first memory is a memory area that can be accessed by programs and operating systems in the normal world based on a preset interface; the second memory is a memory area that cannot be accessed by programs and operating systems in the normal world.

[0066] The preset interface can be the interface corresponding to the encryption and decryption module in the current secondary TEE, or it can be another pre-set interface, without limitation. Optionally, the key generated by the storage key management module can be stored in a secondary memory that is inaccessible to the public world to ensure accuracy during data packet security verification. The secondary TEE can also store security-critical data in the secondary memory.

[0067] Setting up a first memory and a second memory in one or more TEEs among multiple secondary TEEs without setting up a security monitor can improve the real-time performance of secondary TEE data processing. Therefore, the secondary TEE in this embodiment can be set up in one or more systems within the terminal with relatively high real-time requirements. To improve the security of data communication, this embodiment obtains a special area in the memory of the secure world accessible to the secondary TEE as the first memory. Applications and control systems in the ordinary world can access the first memory through calls from the terminal system, but cannot access the second memory, thereby achieving access isolation when the ordinary world accesses the secondary TEE.

[0068] In one embodiment, a distributed TEE system includes a first-level TEE and multiple second-level TEEs, the second-level TEE includes a second security monitor, the second security monitor is provided with a second function call module, a key management module and a communication call module, the second function call module includes a function call interface of the encryption and decryption module; wherein, the second function call module is used to provide a function call interface to call the encryption and decryption module of the second-level TEE to verify the integrity of the first data packet, and decrypt the first data packet according to the key when the first data packet is complete, and / or call the encryption and decryption module of the second-level TEE to encrypt the specified data.

[0069] Among them, the second function call module includes the function call interface of each function stored in the encryption and decryption module of the current secondary TEE. A second security monitor can be set in one or more TEEs among multiple secondary TEEs. Optionally, when the secondary TEE receives a communication data packet sent by the primary TEE, it calls the function stored in the encryption and decryption module of the current secondary TEE through the second function call module, and performs an integrity check on the first data packet based on the called function. When the first data packet is complete, the key corresponding to the primary TEE stored in the key management module is obtained, and the data part of the second data packet is decrypted based on the key and the function in the encryption and decryption module. In this embodiment, by setting a second security monitor in the secondary TEE to be responsible for checking the communication data packet, the data communication security is improved. The secondary TEE in this embodiment can be set in the terminal, in one or more systems with relatively low real-time requirements.

[0070] In one embodiment, a distributed TEE system includes a primary TEE and multiple secondary TEEs. When the secondary TEE includes multiple trusted operating systems, each trusted operating system is provided with an encryption and decryption module. At the same time, the secondary TEE includes a third security monitor, which is provided with a third function call module, a key management module, and a communication call module. The third function call module includes a function call interface of the encryption and decryption module in the current secondary TEE; wherein the third function call module is used to call the encryption and decryption module to verify the integrity of the first data packet, and decrypt the first data packet according to the key if the first data packet is complete, and / or call the encryption and decryption module in the current secondary TEE to encrypt specified data.

[0071] Optionally, the multiple trusted operating systems included in the secondary TEE are trusted micro-operating systems. One or more of the multiple secondary TEEs in the distributed TEE system can be set as the secondary TEE in this embodiment. Multiple trusted operating systems are set to correspond to different trusted applications in the secondary TEE.

[0072] Furthermore, in one embodiment, the multiple secondary TEEs in the distributed TEE system may include at least one of the following secondary TEEs: a secondary TEE equipped with a first memory and a second memory, a secondary TEE equipped with a second security monitor, and a secondary TEE equipped with a third security monitor. This allows the distributed TEE system to accommodate different types of TEEs while ensuring data communication security.

[0073] Based on the same inventive concept, the present application also provides an embodiment of the present invention. Figure 1The communication method based on the distributed TEE system in the distributed TEE system shown. The implementation solution provided by this method is similar to the implementation solution described in the above method. Therefore, the specific limitations of the communication method based on the distributed TEE system in one or more method embodiments provided below can be referred to the limitations of the system embodiment above and will not be repeated here.

[0074] In one embodiment, a communication method based on a distributed TEE system can be applied to the distributed system described in any of the above system embodiments. The distributed TEE system includes multiple TEEs. If the secure world of the TEE includes a security monitor, the communication method based on the distributed TEE system of this embodiment is executed based on the security monitor. If the TEE does not include a security monitor, a first memory accessible to programs and operating systems in the ordinary world is determined in the secure memory of the TEE, and the communication method based on the distributed TEE system of this embodiment is executed in the first memory, including:

[0075] Upon receiving a first data packet transmitted by another TEE, verify the integrity of the first data packet, and if the first data packet is complete, decrypt the first data packet based on the key by calling the key corresponding to the other TEE, and execute the corresponding memory access instruction based on the decrypted data;

[0076] When obtaining the specified data generated by the TEE in response to the memory access instruction, the key corresponding to the TEE is called to encrypt and encapsulate the specified data, and the second data packet obtained after encapsulation is transmitted to the corresponding other TEE and / or the corresponding electronic control unit.

[0077] Optionally, a communication method based on a distributed TEE system is executed in a terminal deployed with a distributed TEE system, and the electronic control unit is a control unit in the terminal. The security world of each TEE includes a key management module and a communication call module, and the trusted operating system of the TEE includes an encryption and decryption module. Generate a key corresponding to the TEE based on the key management module in the distributed system. Verify the integrity of the first data packet based on the encryption and decryption module, and call the keys corresponding to other TEEs if the first data packet is complete; or when obtaining the specified data generated by the TEE in response to the memory access instruction, call the key corresponding to the TEE to encrypt the specified data. The communication call module is used to encapsulate the encrypted specified data and / or the decrypted first data packet into a second data packet.

[0078] Optionally, the encapsulated second data packet is transmitted to the corresponding electronic control unit via the CAN bus, and the encapsulated second data packet is transmitted to the corresponding other TEE via Ethernet or the first data packet transmitted by the other TEE is received.

[0079] Furthermore, the distributed TEE system includes a primary TEE and multiple secondary TEEs. The primary TEE is responsible for managing the interaction and security between different TEEs. The primary TEE can receive the first data packet transmitted by the secondary TEE via Ethernet, or transmit the second data packet to the secondary TEE via Ethernet. Each secondary TEE can communicate with the primary TEE via Ethernet.

[0080] In this embodiment, data communication is implemented based on a TEE deployed with a security monitor or a first memory set in a secure memory, so that each TEE performs a security check after receiving a data packet and then determines whether to execute the memory access instruction, thereby improving the security of data communication.

[0081] In one embodiment, executing a memory access instruction based on the data obtained after decryption includes: determining whether the data obtained after decryption of the data packet is preset control data; if the data obtained after decryption is control data, sending the decrypted data to a corresponding electronic control unit; if the data obtained after decryption is non-control data, storing the decrypted data in a corresponding memory.

[0082] The preset control data refers to data used by the electronic control unit to control the operation of the terminal. Optionally, before sending the decrypted control data to the corresponding electronic control unit, a security check may be performed on the decrypted data in conjunction with the current execution environment context. If the security check passes, the step of sending the decrypted data to the corresponding electronic control unit is executed.

[0083] For non-control data, the decrypted data is stored in the normal memory of the normal world, or in the secure memory of the secure world. Furthermore, in one embodiment, the distributed TEE system includes a normal world and a secure world that are isolated from each other, the normal world's accessible memory is the normal memory, and the secure world's accessible memory is the secure memory. If the decrypted data is non-control data, the decrypted data is stored in the corresponding memory, including: if the decrypted data is determined to belong to the first category of data based on the data transmission type of the data packet, the designated data is granted read permission and the decrypted data is stored in the normal memory; if the decrypted data is determined to belong to the second category of data based on the data transmission type of the data packet, the decrypted data is stored in the secure memory.

[0084] The first type of data is not strongly related to security operations, while the second type of data is strongly related to terminal security operations. Storing the first type of data in the normal memory area can reduce the burden on the secure world; storing the second type of data in the secure memory area can improve the data security of the TEE system.

[0085] Furthermore, in one embodiment, after storing the decrypted data in the secure memory, the method further includes: encapsulating the decrypted data; and transmitting the encapsulated data packet to another TEE in response to a data transmission instruction. Optionally, when the second type of data stored in the secure memory area needs to be sent to another subsystem, the function call interface provided by the function call module in the above-mentioned distributed TEE system embodiment is used to call the function in the encryption and decryption module to encrypt the second type of data. The encrypted data is then encapsulated into a TEE communication data packet through the communication call module and transmitted to the other TEE via Ethernet.

[0086] In some of these embodiments, Figure 3 Provides a distributed TEE deployed in smart cars, such as Figure 3 As shown, a first-level TEE is deployed in the central control system of the smart car to obtain a level 1 Center-TEE. Among them, the level 1 Center-TEE is responsible for managing the interaction and security between different TEEs, and the level 1 Center-TEE communicates with the level 2 TEE via Ethernet. Taking the smart car as the background, one or more level 2 TEEs can be set according to application requirements. Optionally, multiple level 2 TEEs are set, namely, subf-TEE with high real-time requirements, subs-TEE with low real-time requirements, and subt-TEE designed for T-BOX (Telematics Box, telematics processor). Among them, the level 2 TEE can be applied to intelligent driving systems, real-time navigation systems, intelligent cockpit systems, T-BOX, etc. in smart cars. It can be understood that, Figure 3 The distributed TEE shown can also be applied to other terminals besides smart cars, including but not limited to various personal computers, laptops, smartphones, tablets, IoT devices, portable wearable devices, etc.

[0087] In one embodiment, Figure 4 A schematic diagram of the 1-level Center-TEE architecture is provided, as shown in Figure 4As shown in the figure, the Level 1 Center-TEE is divided into two parts: the Normal World and the Secure World. The Normal World and the Secure World are isolated from each other and cannot directly access each other's data. The Normal World consists of normal applications (App) and the normal operating system (OS); the Secure World consists of the Trusted Application (Tapp), the Trusted OS, and the Secure Monitor (SM). Correspondingly, the system memory is also divided into Normal Memory and Secure Memory, which can only be accessed by programs and the operating system in the corresponding world.

[0088] The Security Monitor (SM) in the Level 1 Center-TEE is responsible for security operations such as context switching and security checks between the Secure World and the Normal World. Optionally, the Security Monitor (SM) provides a security service interface to the Normal World. When an App needs to access data in the Secure World or use security services, the Normal World switches to the Secure World through the SMC (Secure Monitor Call) interface, transfers control authority to the SM, and the SM executes the corresponding security service. The Secure World's TApp and Trusted OS are responsible for executing and calling programs involving security-critical data; the Normal World's Apps and OS are responsible for executing and calling programs that do not involve security-critical data.

[0089] Optionally, an encryption and decryption module is added to the Trusted OS of the Level 1 Center-TEE. This module is responsible for data encryption and decryption when this TEE communicates with other TEEs. Specifically, the Enc-Dec module (encryption and decryption module) added to the Trusted OS module of the Level 1 Center-TEE includes: AES encryption algorithm (Advanced Encryption Standard), SM2 national encryption algorithm, SHA3 (Secure Hash Algorithm 3) hash algorithm, SM3 national encryption algorithm, etc. At the same time, corresponding function interfaces tos_sm_enc, tos_sm_dec, and tos_sm_hash are added. This allows the SM of the Level 1 Center-TEE to initiate encryption and decryption operation commands and / or hash operation commands by calling the corresponding function interfaces, and actually execute the corresponding function operations in the Trusted OS, thereby reducing the code size of the SM.

[0090] Optionally, the SM of the Level 1 Center-TEE corresponds to the first security monitor in the above embodiment. A sub-TEE management module is added to the initial SM design of the Level 1 Center-TEE. The sub-TEE management module is responsible for communication management between different TEEs, specifically including securely generating, storing, and managing encryption and decryption keys used for communication with the Level 2 TEE (referred to as TEE communication encryption and decryption keys), calling encryption and decryption functions to encrypt and decrypt data, performing security checks on data from the Level 2 TEE, and encapsulating data into TEE communication packets.

[0091] Specifically, the sub-TEE Management module (sub-TEE management module) added to the SM of the level 1 Center-TEE specifically includes: Key Management (key management module), Enc_Dec Call (function call module), sub_TEESecurity Check (security check module) and TEE2TEE Call (communication call module). Among them, the Key Management module is responsible for the secure generation, storage, and management of TEE communication encryption and decryption keys. The key generation function Key_Gen generates the corresponding TEE communication encryption and decryption key TKey based on the level 2 TEE identity identifier TID, and stores and maintains the mapping table TID_Tkey_MapTable between TID and TKey. The mapping table is stored in the secure memory area and can only be accessed and modified by SM; the Enc_Dec Call module is responsible for providing a calling interface for the encryption and decryption functions and / or hash functions of the Enc-Dec module in the Trusted OS, including the sm_tos_enc, sm_tos_dec, and sm_tos_hash function calling interfaces; the sub_TEE Security Check module is responsible for data analysis and security checks on TEE communication data packets, including integrity verification, data format checks, etc. The integrity verification needs to be implemented in coordination with the Enc_Dec Call module, and data analysis needs to be combined with the current execution environment context and data content to complete security analysis; TEE2TEE The Call module is responsible for encapsulating the data sent to the Level 2 TEE into a TEE communication data packet. The data packet is divided into three parts: header, data part, and tail. The header field includes the Level 2 TEE identity TID and data type Type. The data part is the encrypted data. The tail field is the hash value of the header field and the data part, which is used for subsequent integrity verification.

[0092] For example, when the level 1 TEE receives a communication data packet from the level 2 TEE, it first uses the sub_TEESecurity Check module to perform an integrity check. It needs to call the sm_tos_hash function of the Enc_Dec Call module to perform a hash operation, and perform an XOR operation on the calculated hash value and the hash value contained in the data packet. If the result is non-zero, the integrity check fails and the data packet is directly discarded. Otherwise, the integrity check passes and the data packet has not been tampered with. The identity identifier TID of the corresponding level 2 TEE is extracted from the communication data packet, and the corresponding TEE communication encryption and decryption key is searched in the mapping table TID_Tkey_MapTable. The key is used as a parameter to call the sm_tos_dec function of the Enc_Dec Call module to correctly decrypt the message, and then subsequent data analysis and security checks are performed. The data type of the data packet transmission is extracted from the communication data packet. If it is non-control data such as "camera collection data" or "radar reception data", the data is granted read-only permission. If it is control data such as "open the rear window" or "turn on the air conditioner", a further security check is performed. Combined with the current execution environment context, the current vehicle status is analyzed to determine whether the corresponding behavior can be executed. If the security check passes, the CAN data packet corresponding to the control instruction is sent to the corresponding ECU via the CAN bus. Non-control data is divided into ordinary data and safety-critical data. For ordinary data (such as music and social communication messages), which is not strongly related to security operations, the permission is set to non-writable and it is directly stored in the ordinary memory area. Ordinary programs can read but not modify it, reducing the burden on the security world. Ordinary programs can directly send ordinary data to the subsystems of the smart car via Ethernet. For safety-critical data (such as vehicle environment data and vehicle status data), the data is first stored in the secure memory area. When the Level 1 Center-TEE needs to send security-critical data to other subsystems, it uses the sm_tos_enc function of the Enc_Dec Call module to encrypt it, and then uses the TEE2TEE Call module to encapsulate the encrypted data into a TEE communication data packet and transmit it to the corresponding Level 2 TEE via Ethernet.

[0093] In one embodiment, Figure 5 A 2-level subf-TEE architecture diagram is provided, such as Figure 5As shown, the Level 2 subf-TEE is divided into a secure world and a normal world. The two worlds are isolated from each other and cannot directly access each other's data. The normal world consists of normal applications (Apps) and a normal operating system (OS); the secure world consists of trusted applications (TApps), a trusted operating system (Trusted OS), a key management module (Key Management), and a TEE2TEE call module for inter-TEE communication. Because the secure world lacks a security monitor (SM), it can meet the requirements of high-speed data processing. The normal world's apps and OS are responsible for executing and calling programs that do not involve security-critical data, while the secure world's TApps and Trusted OS are responsible for executing and calling programs that do involve security-critical data.

[0094] Correspondingly, the 2-level subf-TEE system memory is divided into normal memory and secure memory. The secure memory includes the first memory and the second memory in the above embodiment, wherein the first memory is Figure 5 The NSC (Non-Secure Callable) memory in the RAID 5 is a secure memory area that can be accessed by ordinary applications through system calls.

[0095] The NSC memory area is set up because subf-TEE lacks a security monitor (SM) to perform security checks on access from the normal world to secure world resources. Without isolation of this access, normal programs could directly access secure world resources through function calls. This would significantly increase the likelihood that secure memory could be arbitrarily accessed by normal programs, violating the system's memory isolation. Therefore, the NSC memory area is specifically designated as a dedicated area for normal programs to access secure memory data. This allows normal programs (Apps) and trusted programs (TApps) to access NSC memory and normal memory, respectively, through specific function calls. This meets application requirements while ensuring secure data isolation.

[0096] Optionally, an encryption and decryption module is added to the Trusted OS of the subf-TEE level 2. This module is responsible for data encryption and decryption when this TEE communicates with other TEEs. Specifically, the Enc-Dec module (encryption and decryption module) added to the Trusted OS of the subf-TEE level 2 includes: AES encryption algorithm, SM2 national secret algorithm, SHA3 hash algorithm, SM3 national secret algorithm, etc. At the same time, the corresponding function interfaces tos_app_enc, tos_app_dec, and tos_app_hash are added to allow apps in the ordinary world to call the corresponding function interfaces to initiate encryption and decryption operation instructions or hash operation commands, and actually execute the corresponding function operations in the Trusted OS;

[0097] Optionally, two modules, Key Management and TEE2TEE Call, are added to the secure world of the Level 2 subf-TEE. The functions of the added modules include secure generation, storage, and management of TEE communication encryption and decryption keys, and TEE communication data packet encapsulation of data. Specifically, the Key Management module is responsible for the secure generation, storage, and management of TEE communication encryption and decryption keys. The key generation function Key_Gen generates the corresponding key TKey based on the current TEE identity and stores it in a secure memory area other than the NSC memory. The TEE2TEE Call module is responsible for encapsulating the data sent to the Level 1 Center-TEE into a TEE communication data packet. The data packet is divided into three parts: header, data part, and tail. The header field includes the Level 2 TEE identity TID and data type Type. The data part is the encrypted data. The tail field is the hash value of the header field and the data part, which is used for subsequent integrity verification.

[0098] For example, when subf-TEE receives a communication data packet from level 1 Center-TEE, it first uses the tos_app_hash function of the Enc-Dec module in Trusted OS to perform an integrity check on the data packet. If the XOR result of the calculated hash value and the hash value in the data packet is not zero, that is, the data packet has been tampered with, the data packet is directly discarded. Otherwise, the integrity check passes, and then the key TKey stored in the secure memory is used to decrypt the data part of the communication data packet to obtain the correct data.

[0099] For example, when subf-TEE needs to send non-control data or control instructions to Center-TEE, it first encrypts the data using the key TKey, and then encapsulates it into a TEE communication data packet through the TEE2TEE Call module. The encapsulation process includes setting header information, calculating tail values, etc. Finally, the TEE communication data packet is transmitted to Center-TEE via Ethernet.

[0100] In one embodiment, Figure 6 A 2-level subs-TEE architecture diagram is provided, such as Figure 6As shown, the Level 2 subs-TEE is divided into the Normal World and the Secure World. The Normal World and the Secure World are isolated from each other and cannot directly access each other's data. The Normal World consists of normal applications (Apps) and the normal operating system (OS), while the Secure World consists of trusted applications (TApps), the trusted operating system (Trusted OS), and the security monitor (SM). The SM in the Level 2 subs-TEE is responsible for security operations such as context switching and security checks between the Secure World and the Normal World. Optionally, the SM in the Level 2 subs-TEE provides a security service interface to the Normal World. When an App needs to access data from the Secure World or use security services, the Normal World switches to the Secure World through the SMC call interface, transfers control to the SM, and the SM executes the corresponding security services. The Normal World's Apps and OS are responsible for executing and calling programs that do not involve security-critical data, while the Secure World's TApps and Trusted OS are responsible for executing and calling programs that do involve security-critical data.

[0101] Correspondingly, the system memory is also divided into normal memory and secure memory, which can only be accessed by programs and operating systems in the corresponding world.

[0102] Optionally, an encryption and decryption module is added to the Trusted OS in the second-level subs-TEE. This module is responsible for data encryption and decryption when this TEE communicates with other TEEs. Specifically, the Enc-Dec module added to the Trusted OS module of the second-level subs-TEE includes the AES encryption algorithm, the SM2 national secret algorithm, the SHA3 hash algorithm, the SM3 national secret algorithm, etc., and the corresponding function interfaces tos_sm_enc, tos_sm_dec, and tos_sm_hash are added. This allows the SM to initiate encryption and decryption commands and / or hash operation commands by calling the corresponding function interfaces, and actually execute the corresponding function operations in the Trusted OS, thereby reducing the amount of code in the SM.

[0103] Optionally, the SM in the level 2 subs-TEE corresponds to the second security monitor in the above embodiment. On the basis of the initial SM design, three modules, namely Key Management, Enc_Dec Call, and TEE2TEE Call, are added. The three added modules are respectively responsible for securely generating, storing, and managing TEE communication encryption and decryption keys; calling encryption and decryption functions to perform encryption and decryption operations on data; and encapsulating data into TEE communication data packets. Specifically, the Key Management module is responsible for the secure generation, storage, and management of TEE communication encryption and decryption keys. The key generation function Key_Gen generates the corresponding key TKey based on the current TEE identity and stores it in the secure memory area; the Enc_Dec Call module is responsible for providing a calling interface for the encryption and decryption functions and / or hash functions of the Enc-Dec module in the Trusted OS, including the sm_tos_enc, sm_tos_dec, and sm_tos_hash function calling interfaces; the TEE2TEE Call module is responsible for encapsulating the data sent to the Level 1 Center-TEE into a TEE communication data packet. The data packet is divided into three parts: header, data, and tail. The header field includes the Level 2 TEE identity TID and data type Type. The data part is the encrypted data. The tail field is the hash value of the header field and the data part, which is used for subsequent integrity verification.

[0104] For example, when subs-TEE receives a communication data packet from level 1 Center-TEE, it first uses the sm_tos_hash function of the Enc_Dec Call module to perform an integrity check on the data packet. If the XOR result of the calculated hash value and the hash value in the data packet is not zero, that is, the data packet has been tampered with, the data packet is directly discarded. Otherwise, the integrity check passes, and then the key TKey stored in the secure memory is used to decrypt the data part of the communication data packet to obtain the correct data.

[0105] When subs-TEE needs to send non-control data or control instructions to Center-TEE, it first encrypts the data using the key TKey and then encapsulates it into a TEE communication data packet through the TEE2TEE Call module. The encapsulation process includes setting header information, calculating tail values, etc. Finally, the TEE communication data packet is transmitted to Center-TEE via Ethernet.

[0106] In one embodiment, Figure 7 A 2-level subt-TEE architecture diagram is provided, such as Figure 7As shown in the figure, the Level 2 subt-TEE system is divided into the Normal World and the Secure World. The Normal World and the Secure World are isolated from each other and cannot directly access each other's data. The Normal World consists of normal applications App and normal operating systems OS, while the Secure World consists of trusted applications, trusted micro-operation systems mOSs (micro operating systems), and security monitors SM. Trusted applications include one or more of the three categories of OTApp, MoApp, and InfApp. Correspondingly, system memory is also divided into Normal Memory and Secure Memory, which can only be accessed by programs and operating systems in the corresponding worlds.

[0107] The SM in the Level 2 subt-TEE is responsible for security operations such as context switching and security checks between the secure and normal worlds. Specifically, the SM in the Level 2 subt-TEE provides a security service interface to the normal world. When an app needs to access data in the secure world or use security services, the normal world switches to the secure world through the SMC call interface, transferring control to the SM, which then executes the corresponding security service. Apps and the OS in the normal world are responsible for executing and calling programs that do not involve security-critical data, while trusted applications and the trusted micro-operating system (mOS) in the secure world are responsible for executing and calling programs that do involve security-critical data. Different mOSs are designed for different types of trusted applications to manage and schedule them.

[0108] Optionally, the second-level subt-TEE includes multiple trusted operating systems. An encryption and decryption module is added to each mOS, which is responsible for data encryption and decryption when the corresponding trusted application communicates with other TEEs. Specifically, the Enc-Dec module added to each mOS module includes: AES encryption algorithm, SM2 national secret algorithm, SHA3 hash algorithm, SM3 national secret algorithm, etc. At the same time, the corresponding function interfaces mos_sm_enc, mos_sm_dec, and mos_sm_hash are added to allow the SM to initiate encryption and decryption commands and / or hash operation commands by calling the corresponding function interfaces, and actually execute the corresponding function operations in the mOS, reducing the amount of code in the SM.

[0109] Optionally, the SM in the level 2 subs-TEE corresponds to the third security monitor in the above embodiment, and three modules, Key Management, Enc_Dec Call, and TEE2TEE Call, are added on the basis of the initial SM design. The three modules are responsible for the following three functions: securely generating, storing, and managing TEE communication encryption and decryption keys; calling encryption and decryption functions to perform encryption and decryption operations on data; and encapsulating data into TEE communication data packets. Specifically, the Key Management module is responsible for the secure generation, storage, and management of TEE communication encryption and decryption keys. The key generation function Key_Gen generates the corresponding key TKey based on the current TEE identity and stores it in the secure memory area; the Enc_Dec Call module is responsible for providing a calling interface for the encryption and decryption functions and / or hash functions of the Enc-Dec module in mOS, including the sm_mos_enc, sm_mos_dec, and sm_mos_hash function calling interfaces; the TEE2TEE Call module is responsible for encapsulating the data sent to the Level 1 Center-TEE into a TEE communication data packet. The data packet is divided into three parts: header, data, and tail. The header field includes the Level 2 TEE identity TID and data type Type, the data part is the encrypted data, and the tail field is the hash value of the header field and the data part, which is used for subsequent integrity verification.

[0110] For example, when subt-TEE receives a communication data packet from level 1 Center-TEE, it first uses the sm_mos_hash function of the Enc_Dec Call module to perform an integrity check on the data packet. If the check fails, that is, the data packet has been tampered with, the data packet is directly discarded. Otherwise, the integrity check passes, and then the key TKey stored in the secure memory is used to decrypt the data part of the communication data packet to obtain the correct data.

[0111] For example, when subt-TEE needs to send non-control data or control instructions to Center-TEE, it first encrypts the data using the key TKey, and then encapsulates it into a TEE communication data packet through the TEE2TEE Call module. The encapsulation process includes setting header information, calculating tail values, etc. Finally, the TEE communication data packet is transmitted to Center-TEE via Ethernet.

[0112] In one embodiment, based on Figure 3The distributed TEE of a smart car shown in the figure illustrates the complete data flow process of a distributed TEE system application. The second-level TEE sends control data and / or non-control data to the first-level Center-TEE, including: the second-level subf-TEE sends control data and / or non-control data to the first-level Center-TEE; the second-level subs-TEE sends control data and / or non-control data to the first-level Center-TEE; and the second-level subt-TEE sends control data and / or non-control data to the first-level Center-TEE.

[0113] Figure 8 Provides a schematic diagram of a 2-level subf-TEE sending data to a 1-level Center-TEE. Figure 8 The numbers 1 to 15 in the table are used to indicate the order in which data is sent. Figure 8As shown in the figure, the subf-TEE's trusted application, TApp, calls a function to initiate TEE communication. TApp first transmits data to the Trusted OS. The Trusted OS encrypts the data and passes it to the TEE2TEE Call module. The TEE2TEE Call module then encapsulates the data, adding the subf-TEE's TID and data type as the TEE communication packet header. It then uses a hash function within the Trusted OS to calculate the hash value, which serves as the packet's footer. This results in the final TEE communication packet. This packet is then transmitted back to TApp via Trusted OS. TApp then sends the encapsulated TEE communication packet via Ethernet to the Level 1 Center-TEE. The Center-TEE's TApp receives the packet and passes it to the Security Monitor (SM) via the Trusted OS. The TEE2TEECall within the SM performs a security check using the sub_TEE Security Check module. This security check includes integrity verification and data analysis. If the check fails, the packet is discarded. If it passes, the security check calls the Enc_Dec Call module for decryption, retrieving the correct data. If the correct data obtained is control data, such as a car turning, the control instruction is directly passed to TApp through Trusted OS, and TApp sends the corresponding CAN data packet to the corresponding ECU. If the correct data obtained is non-control data, such as car environment data, the data is encapsulated into a new TEE communication data packet, and the data packet is passed to TApp through Trusted OS, and TApp sends it to other Level 2 TEEs via Ethernet. Taking the other Level 2 TEE as subs-TEE as an example, after the TApp of subs-TEE receives the TEE communication data packet, it passes the data packet to SM through Trusted OS, and the TEE2TEE Call module of SM decapsulates it and calls the Enc_Dec Call module for integrity verification and decryption to obtain the correct data. It is understandable that other Level 2 TEEs can also be subf-TEE and subt-TEE, which will not be described in detail here.

[0114] Take the requirement for the intelligent driving system to transmit environmental data collected by the surround-view camera to the central control screen of the intelligent cockpit system as an example. The intelligent driving system (subf-TEE) creates a trusted application (TApp). TApp transmits the environmental data collected by the surround-view camera to the Trusted OS in the subf-TEE. The Trusted OS in the subf-TEE encrypts the data using the key stored in secure memory and transmits the encrypted data to the TEE2TEE Call module in the subf-TEE. The TEE2TEE Call module in the subf-TEE encapsulates the encrypted data into a TEE communication packet. The encapsulation process includes setting header information and calculating a hash value of the header information and data as the packet's tail data. In the subf-TEE, the TEE2TEE Call module transmits the encapsulated TEE communication packet back to the Trusted OS. The Trusted OS transmits the packet back to the TApp in the subf-TEE. The TApp in the subf-TEE then sends the TEE communication packet corresponding to the environmental data collected by the surround-view camera to the central control system (Center-TEE) via Ethernet.

[0115] The TApp of the central control system receives the data packet, and TApp passes the data packet to the Trusted OS of Center-TEE. The Trusted OS passes it to the SM of Center-TEE. The TEE2TEE Call module in the sub_TEE Management module in the SM decapsulates the data packet to obtain the data of each part of the data packet, and then calls the sub_TEESecurity Check module to perform a security check on the data packet, including integrity verification and data analysis. After the security check passes, the decrypted environmental data is encapsulated into a new TEE communication data packet. This is because the TID and TKey of the subsequent level 2 TEE are different from the previous ones, so they need to be re-encrypted and encapsulated. The TEE2TEE Call module transmits the encapsulated new TEE communication data packet back to the Trusted OS in Center-TEE. The Trusted OS passes the TEE communication data packet to TApp in Center-TEE, and TApp sends it to the smart cockpit system (subs-TEE) via Ethernet.

[0116] After receiving the TEE communication data packet, the TApp of the smart cockpit system passes it to the Trusted OS of subs-TEE. The Trusted OS passes it to the SM of subs-TEE. The TEE2TEE Call module of SM decapsulates it and calls the Enc_Dec Call module in subs-TEE for integrity verification and decryption. It successfully obtains the environmental data collected by the surround-view camera and displays it on the central control screen.

[0117] Figure 9 A schematic diagram of a 2-level subs-TEE sending data to a 1-level Center-TEE is provided. In FIG9 , numbers 15 to 30 are used to indicate the order in which data is sent. Figure 9 As shown in the figure, in subs-TEE, TApp calls a function to initiate TEE communication. TApp first transmits the data to Trusted OS, and Trusted OS transmits the data to SM. The TEE2TEE Call module in SM calls the Enc_Dec Call module to encrypt the data, calculate the hash value of the header information and the data part, and encapsulate the original data into a TEE communication data packet. The encapsulated data packet is then transmitted to TApp through Trusted OS. TApp sends the TEE communication data packet to the level 1 Center-TEE via Ethernet.

[0118] The Center-TEE's TApp receives the data packet and passes it to the Security Monitor (SM) via the Trusted OS. The TEE2TEE Call within the SM performs a security check using the sub_TEE Security Check module, including integrity verification and data analysis. If the check passes, the Enc_Dec Call module is invoked to decrypt the data and retrieve the correct data. If the data is control data, such as opening a window, the control command is directly transmitted to the TApp via the Trusted OS, and the TApp sends the corresponding CAN data packet to the corresponding ECU. If the data is non-control data, such as driver status data, it is encapsulated into a new TEE communication data packet and passed to the TApp via the Trusted OS. The TApp then sends it via Ethernet to another Level 2 TEE, such as the subf-TEE. After receiving the TEE communication data packet, the subf-TEE's TApp passes it to the TEE2TEE Call module via the Trusted OS for decapsulation, integrity verification, and decryption, retrieving the correct data.

[0119] For ease of understanding, let's take the example of "the driver opening the door via the central control screen." When the driver clicks the "Open Door" button on the central control screen, the intelligent cockpit system (subs-TEE) creates a trusted application (TApp). TApp transmits the control data to the subs-TEE's Trusted OS, which then transmits the data to the security monitor (SM). The SM encapsulates the data into a TEE communication data packet via the TEE2TEECall module. The encapsulation process includes setting header information such as the TID and data type. The Enc_Dec Call module is called to encrypt the data using the encryption key TKey stored in secure memory. A hash function is then called to calculate the hash value of the header information and data portion as the tail data of the TEE communication packet. The SM transmits the encapsulated TEE communication packet back to the Trusted OS, which transmits the packet back to TApp. TApp sends the TEE communication packet corresponding to the control instruction to the central control system (Center-TEE) via Ethernet. TApp in the central control system receives the packet and transmits it to the Trusted OS in the central control system. The Trusted OS transmits it to the SM. The TEE2TEE Call module in the sub_TEE Management module in the SM decapsulates the packet to obtain the various data components of the packet. The sub_TEE Security Check module is then called to perform a security check on the packet, including integrity verification and data analysis. If the security check passes, the decrypted control instruction is transmitted back to the Trusted OS, which transmits the control instruction back to TApp. TApp then sends the CAN packet containing the control instruction to the corresponding ECU via the CAN bus, successfully opening the door.

[0120] Figure 10 A schematic diagram of a 2-level subt-TEE sending data to a 1-level Center-TEE is provided. In FIG10 , numbers 31 to 46 are used to indicate the order in which data is sent. Figure 10 As shown in the figure, in subt-TEE, trusted applications such as OTApp and MoApp initiate TEE communication by calling functions. TApp first transmits the data to the corresponding mOS, and mOS transmits the data to SM. The TEE2TEE Call module in SM calls the Enc_Dec Call module to encrypt the data, calculate the hash value of the header information and the data part, encapsulate the original data into a TEE communication data packet, and then transmit the encapsulated data packet back to TApp through mOS. TApp sends the TEE communication data packet to the level 1 Center-TEE via Ethernet.

[0121] The Center-TEE's TApp receives the data packet and passes it to the Security Monitor (SM) via the Center-TEE's Trusted OS. The TEE2TEE Call within the SM performs a security check using the sub_TEE Security Check module, including integrity verification and data analysis. If the check passes, the Enc_Dec Call module is invoked to decrypt the data and retrieve the correct data. If the data is control data, such as a mobile app controlling the door opening, the control command is directly transmitted to the TApp via the Trusted OS, and the TApp sends the corresponding CAN data packet to the corresponding ECU. If the data is non-control data, such as OTA (Over-the-Air Technology) update data, the data is encapsulated into a new TEE communication data packet and passed to the TApp via the Trusted OS. The TApp then sends it via Ethernet to another Level 2 TEE, such as the subs-TEE. Upon receiving the TEE communication data packet, the subs-TEE's TApp passes it to the SM's TEE2TEE Call module via the Trusted OS for decapsulation, integrity verification, and decryption, retrieving the correct data.

[0122] For ease of understanding, let's take "remote control of opening the car door with a mobile phone" as an example: the MoApp of the T-Box (subt-TEE) receives the control command from the mobile phone, and MoApp passes the "open the car door" control command to mOS2. The mOS passes the control command to the SM. The TEE2TEE Call module in the SM calls the Enc_Dec Call module, uses the corresponding key stored in the secure memory to encrypt the control signal, and encapsulates the encrypted data into a TEE communication data packet. The encapsulation process includes setting the header information, calculating the hash value of the header information and the data part as the tail data of the data packet. The TEE2TEE Call module transmits the encapsulated TEE communication data packet back to mOS2, and mOS2 transmits it back to MoApp. MoApp sends this data packet to the central control system (Center-TEE) via Ethernet. The TApp of the central control system receives the data packet, and TApp passes the data packet to the Trusted OS. The Trusted OS passes it to the SM. The TEE2TEECall module in the sub_TEE Management module in the SM decapsulates the data packet to obtain the data of each part of the data packet, and then calls the sub_TEE The SecurityCheck module performs a security check on the data packet, including integrity verification and data analysis. If the security check passes, the decrypted control command is transmitted back to the Trusted OS, which then transmits it to the TApp. The TApp then transmits the CAN data packet corresponding to the control command to the corresponding ECU via the CAN bus, and the door is successfully opened.

[0123] It is understandable that the encryption and decryption algorithms and hash algorithms used in this technical solution can be replaced by other algorithms with the same functions without affecting the overall design concept of this technical solution.

[0124] Related technologies: Existing technologies lack consideration for deploying TEEs in distributed systems and do not support deploying different TEEs in distributed systems. To address this issue, this technical solution proposes an innovative distributed TEE architecture that allows different TEEs to be deployed in different subsystems (or devices), securely isolates security-critical tasks, and ensures secure interaction between different TEEs. This distributed TEE can be deployed in different subsystems of smart cars to effectively ensure the safe driving of smart cars.

[0125] The distributed system in this embodiment can support distributed heterogeneous computing; it can support different devices to adopt different TEE architectures, and effectively ensure the communication security between different TEEs by encrypting and encapsulating data packets, thereby comprehensively ensuring the data security of the distributed system.

[0126] In one embodiment, a computer device is further provided, including a memory and a processor. The memory stores a computer program, and the processor implements the steps in the above method embodiments when executing the computer program.

[0127] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps in the above-mentioned method embodiments are implemented.

[0128] In one embodiment, a computer program product is provided, including a computer program, which implements the steps in the above-mentioned method embodiments when executed by a processor. A person of ordinary skill in the art will understand that all or part of the processes in the above-mentioned method embodiments can be implemented by instructing the relevant hardware through a computer program. The computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the above-mentioned method embodiments. Among them, any reference to memory, database or other media used in the embodiments provided in this application may include at least one of non-volatile and volatile memory. Non-volatile memory may include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory may include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in the various embodiments provided herein may include at least one of a relational database and a non-relational database. Non-relational databases may include, but are not limited to, distributed databases based on blockchains. The processor involved in the various embodiments provided herein may be, but are not limited to, a general-purpose processor, a central processing unit, a graphics processing unit, a digital signal processor, a programmable logic unit, a data processing logic unit based on quantum computing, and the like.

[0129] The technical features of the above embodiments can be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0130] The above-described embodiments merely represent several implementation methods of the present application. While the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the present application. It should be noted that a person of ordinary skill in the art may make various modifications and improvements without departing from the spirit of the present application, and these modifications and improvements fall within the scope of protection of the present application. Therefore, the scope of protection of the present application shall be determined by the appended claims.

Claims

1. A distributed TEE system, characterized in that: The distributed TEE system includes: multiple TEEs, each of which includes a key management module and a communication call module in its secure world, and an encryption and decryption module in its trusted operating system. The key management module, the communication call module, and the encryption and decryption module are called by a security monitor in the TEE or run in a first memory, and the first memory is a partial memory area in the secure world of the TEE that can be accessed by programs and operating systems in the ordinary world; wherein, The key management module is used to generate a key corresponding to each of the TEEs; The encryption and decryption module is used to encrypt the specified data according to the key when the TEE generates the specified data in response to the memory access instruction; when receiving the first data packet transmitted by other TEEs, verify the integrity of the first data packet, and decrypt the first data packet according to the key if the first data packet is complete; The communication calling module is used to encapsulate the encrypted designated data and / or the decrypted first data packet into a second data packet.

2. The system according to claim 1, characterized in that The distributed TEE system includes a primary TEE and multiple secondary TEEs, the primary TEE includes a first security monitor, the first security monitor is provided with a first security check module, a first function call module, the key management module and the communication call module; wherein, The first function calling module is used to provide a function calling interface of the encryption and decryption module of the first-level TEE; The first security check module is used to call the encryption and decryption module of the first-level TEE through the function call interface to verify the integrity of the first data packet when the first data packet is received and to decrypt the first data packet according to the key when the first data packet is complete.

3. The system according to claim 2, characterized in that The communication calling module is used to encapsulate the encrypted designated data and / or the decrypted first data packet into a second data packet, including: The communication calling module of the first-level TEE is used to encapsulate the encrypted designated data into a second data packet and transmit it to the second-level TEE through the application in the TEE; and / or, when the data obtained by decrypting the first data packet is non-control data, encapsulate the decrypted first data packet into the second data packet.

4. The system according to claim 1, characterized in that The distributed TEE system includes a common world and a secure world that are isolated from each other, the distributed TEE system includes a primary TEE and multiple secondary TEEs, and the memory of the secure world accessible by the secondary TEE includes the first memory and the second memory; wherein, The first memory is a memory area that can be accessed by programs and operating systems in the ordinary world based on a preset interface; The second memory is a memory area that cannot be accessed by programs and operating systems in the ordinary world.

5. The system according to claim 1, characterized in that The distributed TEE system includes a primary TEE and multiple secondary TEEs, the secondary TEE includes a second security monitor, and the second security monitor is provided with a second function call module, the key management module and the communication call module; wherein, The second function calling module is used to provide a function calling interface to call the encryption and decryption module of the secondary TEE to verify the integrity of the first data packet, and decrypt the first data packet according to the key if the first data packet is complete, and / or call the encryption and decryption module of the secondary TEE to encrypt the specified data.

6. The system according to claim 5, characterized in that The distributed TEE system includes a primary TEE and multiple secondary TEEs, the secondary TEE includes multiple trusted operating systems, and each of the trusted operating systems is respectively provided with the encryption and decryption module.

7. A communication method based on a distributed TEE system, characterized in that: The distributed TEE system includes multiple TEEs. If the secure world of the TEE includes a security monitor, the method is executed based on the security monitor. If the TEE does not include the security monitor, a first memory that can be accessed by a program and an operating system in the ordinary world is determined in the secure memory of the TEE, and the method is executed in the first memory. The method includes: Upon receiving a first data packet transmitted by another TEE, verify the integrity of the first data packet, and if the first data packet is complete, decrypt the first data packet based on the key by calling the key corresponding to the other TEE, and execute the corresponding memory access instruction based on the decrypted data; When obtaining the specified data generated by the TEE in response to the memory access instruction, calling the key corresponding to the TEE to encrypt and encapsulate the specified data, and transmitting the second data packet obtained after encapsulation to the corresponding other TEE and / or the corresponding electronic control unit.

8. The method according to claim 7, characterized in that The executing corresponding memory access instruction based on the decrypted data includes: Determining whether the data obtained after decryption of the data packet is preset control data; If the decrypted data is the control data, sending the decrypted data to a corresponding electronic control unit; If the decrypted data is non-control data, the decrypted data is stored in a corresponding memory.

9. The method according to claim 8, characterized in that The distributed TEE system includes a common world and a secure world that are isolated from each other, the common world has a common memory accessible to it, the secure world has a secure memory accessible to it, and if the decrypted data is non-control data, the decrypted data is stored in the corresponding memory, including: When it is determined according to the data transmission type of the data packet that the data obtained after decryption belongs to the first category of data, granting the designated data a readable permission, and storing the data obtained after decryption in the ordinary memory; When it is determined according to the data transmission type of the data packet that the decrypted data belongs to the second category of data, the decrypted data is stored in the secure memory.

10. The method according to claim 9, characterized in that After storing the decrypted data in a secure memory, the method further includes: Encapsulating the decrypted data; In response to the data sending instruction, the encapsulated data packet is transmitted to the other TEEs.

Images