Information access method and device of domain control platform

Abstract

The invention discloses an information access method and device for a domain control platform, and the method comprises the steps: controlling a business operation system to run a business program corresponding to a business instruction in response to the business instruction; if the business program runs to the information security service stage, generating an information access instruction; based on the information access instruction, controlling an information access system to send an information security service request to an information security processing platform; performing information access on the information security service request based on the information security processing platform to obtain an information access result; and the information access result is transmitted back to the business operation system through the information access system, so that the business program completes the information security service stage according to the information access result. The software operation environment is divided into the first operation platform and the second operation platform, only the information access interface of the information security service is provided in the first operation platform, and the operation of the information security service is performed in the second operation platform, so that the security and confidentiality of data and operation can be effectively ensured.

Description

Technical Field

[0001] The present application relates to the field of information security technology, and in particular to an information access method and device for a domain control platform. Background Art

[0002] With the continuous development of automobile systems, software control has gradually replaced traditional mechanical control. With the development of new functions such as OTA (Over-the-Air) and ADAS (Advanced Driving Assistance System), cars are no longer isolated islands, ushering in the era of the Internet of Everything. However, while software and the Internet bring us convenience, they also bring potential information security risks.

[0003] The amount of data generated and transmitted by vehicles has increased significantly. These data usually contain sensitive information such as location, speed, and driving route, which are at risk of leakage. With the rapid development of cross-end interconnection between people, vehicles, roads, and clouds, autonomous vehicles can exchange information through multiple channels (such as vehicles and vehicles, vehicles and infrastructure, and vehicles and clouds). It is crucial to ensure the security and integrity of these communications. Information security encryption, as a protection mechanism, not only protects data, but also ensures the intelligence integrity of information systems, making autonomous driving and Internet of Vehicles systems more reliable. In the era of autonomous driving and Internet of Vehicles, it is not only a key means of information security, but also a basic guarantee for technological development.

[0004] In the prior art, in information interaction, open source encryption libraries are widely used to encrypt data to ensure the security of communication. However, due to the lack of a security architecture that meets hierarchical security requirements, there is a risk of being easily attacked. Therefore, how to improve the security and confidentiality of data and operations in the process of information interaction has become an urgent problem to be solved. Summary of the invention

[0005] In order to solve the problems of the prior art, the present application provides an information access method and device for a domain control platform. By dividing the software operating environment into a first operating platform and a second operating platform, only an information access interface of an information security service is provided in the first operating platform, and information security service operations are performed in the second operating platform. The security and confidentiality of data and operations are effectively guaranteed through a multi-level security architecture, solving the problem of how to improve the security and confidentiality of data and operations in the process of information interaction.

[0006] According to one aspect of the present application, a method for accessing information of a domain control platform is provided, wherein the domain control platform includes a first operation platform, a second operation platform, and an information security processing platform, wherein the first operation platform runs a service operating system, the second operation platform runs an information access system, and the information security processing platform is used to process services related to information security, wherein the method includes:

[0007] In response to the service instruction, controlling the service operating system to run the service program corresponding to the service instruction;

[0008] If the business program runs to the information security service stage, an information access instruction is generated;

[0009] Based on the information access instruction, controlling the information access system to send an information security service request to the information security processing platform;

[0010] Performing information access on the information security service request based on the information security processing platform to obtain an information access result;

[0011] The information access result is transmitted back to the business operating system through the information access system, so that the business program completes the information security service stage according to the information access result.

[0012] In a possible implementation, the business operating system includes a user layer, an information security service interface, and a kernel layer, wherein the user layer is used to run business programs, the kernel layer is used to manage the first operating platform, and the user layer communicates with the kernel layer through the information security service interface.

[0013] If the business program runs to the information security service stage, generating an information access instruction includes:

[0014] When the business program at the user layer runs to the information security service stage, the information access instruction is generated;

[0015] The information access instruction is transmitted to the kernel layer through the information security service interface.

[0016] In a possible implementation, the domain control platform further includes a platform switching module, and the platform switching module is used to determine whether the information access instruction is safe.

[0017] The controlling the information access system to send an information security service request to the information security processing platform based on the information access instruction includes:

[0018] Control the kernel layer to send the information access instruction to the platform switching module, and perform a security judgment on the information access instruction based on the platform switching module to obtain a security judgment result;

[0019] Based on the security judgment result, the information access instruction is transmitted to the information access system, and the information access system performs handle matching processing on the information access instruction to obtain the information security function handle of the information access instruction;

[0020] Generate the information security service request based on the information security function handle;

[0021] Based on the inter-core communication method, the information access system is controlled to send the information security service request to the information security processing platform.

[0022] In a possible implementation, the information access system stores an information security function handle registry, where the information security function handle registry is constructed based on a preset access instruction and a security function handle corresponding to the preset access instruction.

[0023] The method of transmitting the information access instruction to the information access system based on the security judgment result, and performing handle matching processing on the information access instruction based on the information access system to obtain the information security function handle of the information access instruction includes:

[0024] If the security determination result indicates that the information access instruction satisfies a preset security access condition, transmitting the information access instruction to the information access system;

[0025] Querying the information security function handle registry based on the information access instruction to obtain a security function handle corresponding to a preset access instruction matched by the information access instruction;

[0026] Determine a security function handle corresponding to a preset access instruction that matches the information access instruction, which is the information security function handle of the information access instruction.

[0027] In a possible implementation, the preset access instruction includes a first access instruction, a second access instruction, a third access instruction and a fourth access instruction, wherein the first access instruction represents an encryption and decryption function, the second access instruction represents an information summary function, the third access instruction represents a random number generation function, and the fourth access instruction represents a key generation function.

[0028] The method for constructing the information security function handle registry comprises:

[0029] Determine that the security function handle corresponding to the first access instruction is a first function handle, where the first function handle is used to mark a first function module of the information security processing platform, and the first function module is used to implement encryption and decryption processing;

[0030] Determine that the security function handle corresponding to the second access instruction is a second function handle, where the second function handle is used to mark a second function module of the information security processing platform, and the second function module is used to implement information digest processing;

[0031] Determine that the security function handle corresponding to the third access instruction is a third function handle, the third function handle is used to mark a third function module of the information security processing platform, and the third function module is used to implement random number generation processing;

[0032] Determine that the security function handle corresponding to the fourth access instruction is a fourth function handle, the fourth function handle is used to mark a fourth function module of the information security processing platform, and the fourth function module is used to implement key generation processing;

[0033] Based on the correspondence between the first access instruction and the first function handle, the correspondence between the second access instruction and the second function handle, the correspondence between the third access instruction and the third function handle, and the correspondence between the fourth access instruction and the fourth function handle, the information security function handle registry is constructed.

[0034] In a possible implementation, the step of determining that the security function handle corresponding to the preset access instruction that matches the information access instruction is the information security function handle of the information access instruction includes:

[0035] If the information access instruction matches the first access instruction, determining that the first function handle is the information security function handle;

[0036] If the information access instruction matches the second access instruction, determining that the second function handle is the information security function handle;

[0037] If the information access instruction matches the third access instruction, determining that the third function handle is the information security function handle;

[0038] If the information access instruction matches the fourth access instruction, the fourth function handle is determined to be the information security function handle.

[0039] In a possible implementation, the information accessing the information security service request based on the information security processing platform to obtain the information access result includes:

[0040] Based on the information security function handle corresponding to the information security service request, determining a function module of the information security processing platform corresponding to the information security service request;

[0041] In a case where the information security function handle is the first function handle, determining that the function module of the information security processing platform corresponding to the information security service request is the first function module;

[0042] In a case where the information security function handle is the second function handle, determining that the function module of the information security processing platform corresponding to the information security service request is the second function module;

[0043] In a case where the information security function handle is the third function handle, determining that the function module of the information security processing platform corresponding to the information security service request is the third function module;

[0044] In a case where the information security function handle is the fourth function handle, determining that the function module of the information security processing platform corresponding to the information security service request is the fourth function module;

[0045] Based on the functional module of the information security processing platform corresponding to the information security service request, information access is performed on the information security service request to obtain the information access result.

[0046] In a possible implementation, the function module of the information security processing platform corresponding to the information security service request performs information access on the information security service request to obtain the information access result, including:

[0047] When the functional module of the information security processing platform corresponding to the information security service request is the first functional module, encryption and decryption processing is performed on the information security service request based on the first functional module to obtain an encryption and decryption processing result, and the encryption and decryption processing result is determined as the information access result;

[0048] When the function module of the information security processing platform corresponding to the information security service request is the second function module, performing information digest processing on the information security service request based on the second function module to obtain an information digest processing result, and determining the information digest processing result as the information access result;

[0049] When the function module of the information security processing platform corresponding to the information security service request is the third function module, performing random number generation processing on the information security service request based on the third function module to obtain a random number generation result, and determining the random number generation result as the information processing result;

[0050] The functional module of the information security processing platform corresponding to the information security service request is the fourth functional module, and key generation processing is performed on the information security service request based on the fourth functional module to obtain a key generation result, and the key generation result is determined to be the information processing result.

[0051] In a possible implementation, the method further includes:

[0052] If the security judgment result indicates that the information access instruction does not meet the preset security access condition, generating prompt information;

[0053] Feedback the prompt information to the business program.

[0054] On the other hand, an information access device for a domain control platform is provided, wherein the domain control platform includes a first operation platform, a second operation platform and an information security processing platform, wherein the first operation platform runs a business operating system, the second operation platform runs an information access system, and the information security processing platform is used to process business related to information security, and the device includes:

[0055] A business program running module, used to control the business operating system to run the business program corresponding to the business instruction in response to the business instruction;

[0056] An information access instruction generation module, used to generate an information access instruction if the business program runs to the information security service stage;

[0057] An information security service request sending module, used to control the information access system to send an information security service request to the information security processing platform based on the information access instruction;

[0058] An information access module, used to perform information access on the information security service request based on the information security processing platform to obtain an information access result;

[0059] The information access feedback module is used to transmit the information access result back to the business operating system through the information access system, so that the business program completes the information security service stage according to the information access result.

[0060] In a possible implementation, the business operating system includes a user layer, an information security service interface, and a kernel layer, wherein the user layer is used to run business programs, the kernel layer is used to manage the first operating platform, and the user layer communicates with the kernel layer through the information security service interface.

[0061] The information access instruction generating module is used to:

[0062] When the business program at the user layer runs to the information security service stage, the information access instruction is generated;

[0063] The information access instruction is transmitted to the kernel layer through the information security service interface.

[0064] In a possible implementation, the domain control platform further includes a platform switching module, and the platform switching module is used to determine whether the information access instruction is safe.

[0065] The information security service request sending module is used to:

[0066] Control the kernel layer to send the information access instruction to the platform switching module, and perform a security judgment on the information access instruction based on the platform switching module to obtain a security judgment result;

[0067] Based on the security judgment result, the information access instruction is transmitted to the information access system, and the information access system performs handle matching processing on the information access instruction to obtain the information security function handle of the information access instruction;

[0068] Generate the information security service request based on the information security function handle;

[0069] Based on the inter-core communication method, the information access system is controlled to send the information security service request to the information security processing platform.

[0070] In a possible implementation, the information access system stores an information security function handle registry, where the information security function handle registry is constructed based on a preset access instruction and a security function handle corresponding to the preset access instruction.

[0071] The information security service request sending module is also used to:

[0072] If the security determination result indicates that the information access instruction satisfies a preset security access condition, transmitting the information access instruction to the information access system;

[0073] Querying the information security function handle registry based on the information access instruction to obtain a security function handle corresponding to a preset access instruction matched by the information access instruction;

[0074] Determine a security function handle corresponding to a preset access instruction that matches the information access instruction, which is the information security function handle of the information access instruction.

[0075] In a possible implementation, the preset access instruction includes a first access instruction, a second access instruction, a third access instruction and a fourth access instruction, the first access instruction represents an encryption and decryption function, the second access instruction represents an information summary function, the third access instruction represents a random number generation function, and the fourth access instruction represents a key generation function, the device includes a registry construction module,

[0076] The registry building module is used to:

[0077] Determine that the security function handle corresponding to the first access instruction is a first function handle, where the first function handle is used to mark a first function module of the information security processing platform, and the first function module is used to implement encryption and decryption processing;

[0078] Determine that the security function handle corresponding to the second access instruction is a second function handle, where the second function handle is used to mark a second function module of the information security processing platform, and the second function module is used to implement information digest processing;

[0079] Determine that the security function handle corresponding to the third access instruction is a third function handle, the third function handle is used to mark a third function module of the information security processing platform, and the third function module is used to implement random number generation processing;

[0080] Determine that the security function handle corresponding to the fourth access instruction is a fourth function handle, the fourth function handle is used to mark a fourth function module of the information security processing platform, and the fourth function module is used to implement key generation processing;

[0081] Based on the correspondence between the first access instruction and the first function handle, the correspondence between the second access instruction and the second function handle, the correspondence between the third access instruction and the third function handle, and the correspondence between the fourth access instruction and the fourth function handle, the information security function handle registry is constructed.

[0082] In a possible implementation, the information security service request sending module is further used to:

[0083] If the information access instruction matches the first access instruction, determining that the first function handle is the information security function handle;

[0084] If the information access instruction matches the second access instruction, determining that the second function handle is the information security function handle;

[0085] If the information access instruction matches the third access instruction, determining that the third function handle is the information security function handle;

[0086] If the information access instruction matches the fourth access instruction, the fourth function handle is determined to be the information security function handle.

[0087] In a possible implementation, the information access module is used to:

[0088] Based on the information security function handle corresponding to the information security service request, determining a function module of the information security processing platform corresponding to the information security service request;

[0089] In a case where the information security function handle is the first function handle, determining that the function module of the information security processing platform corresponding to the information security service request is the first function module;

[0090] In a case where the information security function handle is the second function handle, determining that the function module of the information security processing platform corresponding to the information security service request is the second function module;

[0091] In a case where the information security function handle is the third function handle, determining that the function module of the information security processing platform corresponding to the information security service request is the third function module;

[0092] In a case where the information security function handle is the fourth function handle, determining that the function module of the information security processing platform corresponding to the information security service request is the fourth function module;

[0093] Based on the functional module of the information security processing platform corresponding to the information security service request, information access is performed on the information security service request to obtain the information access result.

[0094] In a possible implementation, the information access module is used to:

[0095] When the functional module of the information security processing platform corresponding to the information security service request is the first functional module, encryption and decryption processing is performed on the information security service request based on the first functional module to obtain an encryption and decryption processing result, and the encryption and decryption processing result is determined as the information access result;

[0096] When the function module of the information security processing platform corresponding to the information security service request is the second function module, performing information digest processing on the information security service request based on the second function module to obtain an information digest processing result, and determining the information digest processing result as the information access result;

[0097] When the function module of the information security processing platform corresponding to the information security service request is the third function module, performing random number generation processing on the information security service request based on the third function module to obtain a random number generation result, and determining the random number generation result as the information processing result;

[0098] The functional module of the information security processing platform corresponding to the information security service request is the fourth functional module, and key generation processing is performed on the information security service request based on the fourth functional module to obtain a key generation result, and the key generation result is determined to be the information processing result.

[0099] In a possible implementation manner, the device further includes a prompt information feedback module, and the prompt information feedback module is used to:

[0100] If the security judgment result indicates that the information access instruction does not meet the preset security access condition, generating prompt information;

[0101] Feedback the prompt information to the business program.

[0102] On the other hand, an electronic device is provided, including a processor and a memory, wherein the memory stores at least one instruction or at least one program, and the at least one instruction or the at least one program is loaded and executed by the processor to implement the information access method of the domain control platform of any of the above aspects.

[0103] On the other hand, a computer-readable storage medium is provided, in which at least one instruction or at least one program is stored. The at least one instruction or the at least one program is loaded and executed by a processor to implement the information access method of a domain control platform as described in any of the above aspects.

[0104] On the other hand, a computer program product or a computer program is provided, the computer program product or the computer program includes computer instructions, the computer instructions are stored in a computer-readable storage medium. A processor of an electronic device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the electronic device executes the information access method of the domain control platform of any aspect above.

[0105] An embodiment of the present application provides an information access method for a domain control platform, wherein the domain control platform includes a first operating platform, a second operating platform and an information security processing platform, wherein the first operating platform runs a business operating system, the second operating platform runs an information access system, and the information security processing platform is used to process business related to information security; by responding to business instructions, the business operating system is controlled to run the business program corresponding to the business instruction; if the business program runs to the information security service stage, an information access instruction is generated; based on the information access instruction, the information access system is controlled to send an information security service request to the information security processing platform; based on the information security processing platform, information access is performed on the information security service request to obtain an information access result; the information access result is transmitted back to the business operating system through the information access system, so that the business program completes the information security service stage according to the information access result. By dividing the software operating environment into a first operating platform and a second operating platform, only providing an information access interface for information security services in the first operating platform, performing information security service operations in the second operating platform, and exchanging information with the information security processing platform through the second operating platform to obtain processing results of the information security services, which are then fed back to the first operating platform through the second operating platform. Through a multi-level security architecture, the security and confidentiality of data and operations can be effectively guaranteed to cope with potential attacks, thereby solving the problem of how to improve the security and confidentiality of data and operations in the process of information interaction. BRIEF DESCRIPTION OF THE DRAWINGS

[0106] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0107] Figure 1 It is a flowchart of an information access method of a domain control platform provided in an embodiment of the present application;

[0108] Figure 2 It is a block diagram of a framework of a domain control platform provided in an embodiment of the present application;

[0109] Figure 3 is a flowchart of an information access method for a first access instruction provided in an embodiment of the present application;

[0110] Figure 4 is a flowchart of an information access method for a second access instruction provided in an embodiment of the present application;

[0111] Figure 5is a flowchart of an information access method of a third access instruction provided in an embodiment of the present application;

[0112] Figure 6 is a flowchart of an information access method of a fourth access instruction provided in an embodiment of the present application;

[0113] Figure 7 It is a structural block diagram of an information access device of a domain control platform provided in an embodiment of the present application. DETAILED DESCRIPTION

[0114] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of this application.

[0115] This application aims to provide a distributed encrypted access, hardware security, and high real-time information security technology solution for L2 level and above autonomous driving fields.

[0116] In the early days of automotive software design, because cars rarely connected to external media, there was not much consideration for the safety of the automotive system design. With the continuous development of automotive systems, a large amount of software control has replaced traditional mechanical control, and brought us new functions such as OTA (Over-the-Air Download Technology) and ADAS (Advanced Driver Assistance System). Cars are no longer isolated islands, ushering in the era of the Internet of Everything. However, things generally have two sides. While software and the Internet bring us convenience, they also bring potential information security risks.

[0117] The amount of data generated and transmitted by vehicles has increased significantly. This data usually contains sensitive information such as location, speed, and driving route, which is at risk of leakage. With the rapid development of cross-end interconnection between people, vehicles, roads, and clouds, autonomous vehicles can communicate information through multiple channels (such as vehicles and vehicles, vehicles and infrastructure, and vehicles and clouds). It is crucial to ensure the security and integrity of these communications. However, hacker attacks are becoming more and more diverse, and the domain control system of autonomous vehicles has become a potential target. The adoption of necessary information encryption strategies can greatly reduce the risk of data tampering or theft and enhance network security.

[0118] As a protection mechanism, information security encryption not only protects data, but also ensures the intelligence integrity of information systems, making autonomous driving and Internet of Vehicles systems more reliable. In the era of autonomous driving and Internet of Vehicles, it is not only a key means of information security, but also a basic guarantee for technological development.

[0119] The embodiment of the present application provides an information access method for a domain control platform, wherein the domain control platform includes a first operating platform, a second operating platform and an information security processing platform, wherein the first operating platform runs a business operating system, the second operating platform runs an information access system, and the information security processing platform is used to process services related to information security. By dividing the software operating environment into a first operating platform and a second operating platform, only an information access interface for information security services is provided in the first operating platform, and information security services are operated in the second operating platform, the security and confidentiality of data and operations are effectively guaranteed through a multi-level security architecture. Figure 1 The information access method of the domain control platform includes steps S101 to S109.

[0120] In step S101, in response to a service instruction, the service operating system is controlled to run a service program corresponding to the service instruction.

[0121] In a possible implementation, the business instruction is generated based on a manual or machine-generated business execution operation issued to the domain control platform of the vehicle. The business includes a system upgrade task, a driving mode switching task, an automatic parking task, an entertainment audio and video task, and the like.

[0122] In a possible implementation manner, the business program is a program for implementing the business corresponding to the business instruction.

[0123] In a possible implementation, the domain control platform is the domain controller (Domain Control Unit, DCU) of the car, which is the core of each functional domain of the car and mainly consists of three parts: a domain master processor, an operating system, and application software and algorithms.

[0124] In one possible implementation, the domain control platform is based on TrustZone technology combined with a mainstream autonomous driving high-performance computing platform design architecture.

[0125] In one possible implementation, TrustZone technology is a hardware-based security technology, such as Figure 2 As shown, if the domain control platform is built based on the Cortex-A55 processor and the Cortex-R5 processor.

[0126] In one possible implementation, Figure 2 As shown, the operating environment of the Cortex-A55 processor is divided into two independent areas: a secure world (Secure World) and a non-secure world (Normal World), the non-secure world is the first operating platform, and the secure world is the second operating platform.

[0127] In one possible implementation, Figure 2 As shown, the Cortex-R5 processor is the information security processing platform, which is used to process services related to information security. Specifically, the services related to information security can be functions such as generating and storing customer keys, generating hardware random numbers, and supporting symmetric and asymmetric key management algorithms.

[0128] In step S103, if the business program runs to the information security service stage, an information access instruction is generated.

[0129] In a possible implementation, the business operating system includes a user layer, an information security service interface, and a kernel layer, wherein the user layer is used to run business programs, the kernel layer is used to manage the first operating platform, and the user layer communicates with the kernel layer through the information security service interface.

[0130] If the business program runs to the information security service stage, generating an information access instruction includes:

[0131] When the business program at the user layer runs to the information security service stage, the information access instruction is generated;

[0132] The information access instruction is transmitted to the kernel layer through the information security service interface.

[0133] In one possible implementation, Figure 2 As shown, the business operating system OS includes a user layer, an information security service interface and a kernel layer.

[0134] In one possible implementation, Figure 2 As shown, the user layer is used to run business programs, which can be an APP (Application) that implements business functions.

[0135] In one possible implementation, Figure 2 As shown, the information security service interface is an interface encapsulated in the security world, embodied by Service / Lib (server library), and used to link programs and functions (or subprocesses). Specifically, information is exchanged with the kernel layer through Service / Lib.

[0136] In one possible implementation, Figure 2 As shown, the kernel layer (Kernel OS) is used to manage the first operating platform, and the user layer communicates with the kernel layer through the information security service interface.

[0137] In a possible implementation, the business program at the user layer runs to the information security service stage and generates the information access instruction. Specifically, the information security service stage indicates that the business program currently has information security service tasks, such as identity authentication service, password modification service, login service, etc.

[0138] In a possible implementation, an information access instruction is generated according to the information security service task that needs to be performed in the information security service stage, and the information access instruction represents the task information of the information security service.

[0139] In this implementation, the business program at the user layer runs to the information security service stage, generates the information access instruction, transmits the information access instruction to the kernel layer through the information security service interface, and transfers the information access at the security service stage from the non-secure world to the secure world through the information security service interface, thereby improving the security of information interaction.

[0140] In step S105, based on the information access instruction, the information access system is controlled to send an information security service request to the information security processing platform.

[0141] In a possible implementation, the domain control platform further includes a platform switching module, and the platform switching module is used to determine whether the information access instruction is safe.

[0142] The controlling the information access system to send an information security service request to the information security processing platform based on the information access instruction includes:

[0143] Control the kernel layer to send the information access instruction to the platform switching module, and perform a security judgment on the information access instruction based on the platform switching module to obtain a security judgment result;

[0144] Based on the security judgment result, the information access instruction is transmitted to the information access system, and the information access system performs handle matching processing on the information access instruction to obtain the information security function handle of the information access instruction;

[0145] Generate the information security service request based on the information security function handle;

[0146] Based on the inter-core communication method, the information access system is controlled to send the information security service request to the information security processing platform.

[0147] In one possible implementation, Figure 2As shown, the domain control platform also includes a platform switching module (Secure Monitor). Secure Monitor is a software component running in secure mode (Secure Mode), which is responsible for managing the dual system switching process, that is, the information interaction process between the first operating platform and the second operating platform.

[0148] In one possible implementation, Figure 2 As shown, the Secure monitor provides interfaces between the Secure World and the Non-secure World, which can trigger the mechanism for the processor to switch from a non-secure environment to a secure environment.

[0149] In a possible implementation, the platform switching module may perform a security judgment on the information access instruction to obtain a security judgment result. Specifically, the platform switching module determines whether the information access instruction is an executable instruction according to the source of the information access instruction.

[0150] In one possible implementation, Figure 2 As shown, the second operating platform, namely the secure world, implements a trusted Trusted OS through opteeos and registers the information security function handles required by the business. Specifically, OP-TEE (Open Portable Trusted Execution Environment) provides a secure execution environment for isolating between ordinary operating systems (such as Linux) and secure operating systems. optee_os is part of the OP-TEE project and is responsible for implementing the Trusted OS on the security side.

[0151] In a possible implementation, the information security function handle of the information access instruction represents the calling interface information of the module or function required for implementing the task of the information access instruction.

[0152] In a possible implementation, the information security service request includes call information and return information corresponding to the information security function handle.

[0153] In this implementation, based on the security judgment result, the information access instruction is transmitted to the information access system for handle matching processing, the information security function handle of the information access instruction is obtained, the information security service request is generated based on the information security function handle, and the information access system is controlled to send the information security service request to the information security processing platform. By exchanging information in a hierarchical and progressive manner, information is accessed in the secure world, so that all information security-related businesses are run in the secure world, fundamentally guaranteeing the high-level requirements of user information security access.

[0154] In a possible implementation, the information access system stores an information security function handle registry, where the information security function handle registry is constructed based on a preset access instruction and a security function handle corresponding to the preset access instruction.

[0155] The method of transmitting the information access instruction to the information access system based on the security judgment result, and performing handle matching processing on the information access instruction based on the information access system to obtain the information security function handle of the information access instruction includes:

[0156] If the security determination result indicates that the information access instruction satisfies a preset security access condition, transmitting the information access instruction to the information access system;

[0157] Querying the information security function handle registry based on the information access instruction to obtain a security function handle corresponding to a preset access instruction matched by the information access instruction;

[0158] The security function handle corresponding to the preset access instruction matched by the information access instruction is determined as the information security function handle of the information access instruction. In a possible implementation, when it is determined that the source of the information access instruction is secure, the information access instruction is transmitted to the information access system.

[0159] In a possible implementation, the method further includes:

[0160] If the security judgment result indicates that the information access instruction does not meet the preset security access condition, generating prompt information;

[0161] Feedback the prompt information to the business program.

[0162] In a possible implementation manner, when it is determined that the information access instruction is issued by a program that has passed security verification, the information access instruction is transmitted to the information access system.

[0163] In a possible implementation, when it is determined that the information access instruction is issued by a program with risks, prompt information is generated based on the risks involved; and the prompt information is fed back to the business program.

[0164] In one possible implementation, Figure 2 As shown, the second operating platform, namely the secure world, implements a trusted Trusted OS through opteeos, namely the information access system, and the information access system registers different information security function handles required by different businesses.

[0165] In a possible implementation, the second operating platform also runs a Trusted Application for supporting the tasks that need to be completed by the information security service request.

[0166] In this implementation method, based on the security judgment result, the information access instruction is transmitted to the information access system, and the information access instruction is handle matched based on the information access system to obtain the information security function handle of the information access instruction, thereby preparing for the subsequent determination of the corresponding security service module based on the information security function handle, thereby improving the efficiency of information interaction.

[0167] In a possible implementation, the preset access instruction includes a first access instruction, a second access instruction, a third access instruction and a fourth access instruction, wherein the first access instruction represents an encryption and decryption function, the second access instruction represents an information summary function, the third access instruction represents a random number generation function, and the fourth access instruction represents a key generation function.

[0168] The method for constructing the information security function handle registry comprises:

[0169] Determine that the security function handle corresponding to the first access instruction is a first function handle, where the first function handle is used to mark a first function module of the information security processing platform, and the first function module is used to implement encryption and decryption processing;

[0170] Determine that the security function handle corresponding to the second access instruction is a second function handle, where the second function handle is used to mark a second function module of the information security processing platform, and the second function module is used to implement information digest processing;

[0171] Determine that the security function handle corresponding to the third access instruction is a third function handle, the third function handle is used to mark a third function module of the information security processing platform, and the third function module is used to implement random number generation processing;

[0172] Determine that the security function handle corresponding to the fourth access instruction is a fourth function handle, the fourth function handle is used to mark a fourth function module of the information security processing platform, and the fourth function module is used to implement key generation processing;

[0173] Based on the correspondence between the first access instruction and the first function handle, the correspondence between the second access instruction and the second function handle, the correspondence between the third access instruction and the third function handle, and the correspondence between the fourth access instruction and the fourth function handle, the information security function handle registry is constructed.

[0174] In a possible implementation, the preset access instruction is an access instruction that can be generated by the user terminal, including a first access instruction, a second access instruction, a third access instruction and a fourth access instruction, the first access instruction represents the function of encryption and decryption, the second access instruction represents the function of information summary, the third access instruction represents the function of random number generation, and the fourth access instruction represents the function of key generation.

[0175] In one possible implementation, the functional module corresponding to the preset access instruction is implemented based on OpenSSL (OpenSecure Sockets Layer), which is an open source software library package that applications can use to communicate securely, avoid eavesdropping, and confirm the identity of the other end of the connection.

[0176] In one possible implementation, Figure 3 As shown, if the user end needs to implement the encryption and decryption function, the instruction information that needs to implement the encryption and decryption function is set as the first access instruction, and the module that the first access instruction needs to access is the first functional module, then the security function handle corresponding to the first access instruction is the first functional handle. Specifically, the first functional module of the R5 (Cortex-R5 processor) end can be determined by the first functional handle, the encryption and decryption function is completed based on the first functional module, and the encryption and decryption processing result is returned to the user end, and the first functional module includes the OpenSSL encryption and decryption library function.

[0177] In one possible implementation, Figure 4As shown, if the user end needs to implement the function of information digest, the instruction information that needs to implement the function of information digest is set as the second access instruction, and the module that the second access instruction needs to access is the second functional module, then the security function handle corresponding to the second access instruction is the second functional handle. Specifically, the second functional module of the R5 (Cortex-R5 processor) end can be determined by the second functional handle, the function of information digest is completed based on the second functional module, and the processing result of information digest processing is returned to the user end, and the second functional module includes the OpenSSL digest library function.

[0178] In one possible implementation, Figure 5 As shown, if the user end needs to implement the function of random number generation, the instruction information that needs to implement the function of random number generation is set as the third access instruction, and the module that the third access instruction needs to access is the third functional module, then the security function handle corresponding to the third access instruction is the third functional handle. Specifically, the third functional module of the R5 (Cortex-R5 processor) end can be determined by the third functional handle, the function of random number generation is completed based on the third functional module, and the result of random number generation is returned to the user end, and the third functional module includes OpenSSL pseudo-random library functions and hardware random number generation functions.

[0179] In one possible implementation, Figure 6 As shown, if the user end needs to implement the function of key generation, the instruction information that needs to implement the key generation function is set as the fourth access instruction, and the module that the fourth access instruction needs to access is the fourth functional module, then the security function handle corresponding to the fourth access instruction is the fourth functional handle. Specifically, the fourth functional module of the R5 (Cortex-R5 processor) end can be determined through the fourth functional handle, the key generation function is completed based on the fourth functional module, and the result of the key generation is returned to the user end, and the fourth functional module includes a security library function.

[0180] In one possible implementation, the preset access instruction also includes a fifth access instruction, which represents a customized function. The security function handle corresponding to the fifth access instruction is determined to be the fifth function handle. The fifth function handle is used to mark the fifth function module of the information security processing platform, and the fifth function module is used to implement a customized security information service function.

[0181] In this implementation, an information security function handle registry is constructed based on the correspondence between preset access instructions and function handles corresponding to the preset access instructions, which facilitates obtaining the function handle corresponding to the information access instruction through query, thereby improving the calculation speed.

[0182] In a possible implementation, the step of determining that the security function handle corresponding to the preset access instruction that matches the information access instruction is the information security function handle of the information access instruction includes:

[0183] If the information access instruction matches the first access instruction, determining that the first function handle is the information security function handle;

[0184] If the information access instruction matches the second access instruction, determining that the second function handle is the information security function handle;

[0185] If the information access instruction matches the third access instruction, determining that the third function handle is the information security function handle;

[0186] If the information access instruction matches the fourth access instruction, the fourth function handle is determined to be the information security function handle.

[0187] In a possible implementation, a preset access instruction that matches the information access instruction is determined, and a security function handle corresponding to the matched preset access instruction is determined to be the information security function handle of the information access instruction.

[0188] In a possible implementation, the preset access instruction matched by the information access instruction may be a plurality of preset access instructions in the information security function handle registry, so as to implement multiple information security services and increase information interaction security.

[0189] In this implementation, the information security function handle is determined based on the matching relationship between the information access instruction and the preset access instruction, thereby improving the speed of implementing algorithms related to information security.

[0190] In step S107, information access is performed on the information security service request based on the information security processing platform to obtain an information access result.

[0191] In a possible implementation, the information accessing the information security service request based on the information security processing platform to obtain the information access result includes:

[0192] Based on the information security function handle corresponding to the information security service request, determining a function module of the information security processing platform corresponding to the information security service request;

[0193] In a case where the information security function handle is the first function handle, determining that the function module of the information security processing platform corresponding to the information security service request is the first function module;

[0194] In a case where the information security function handle is the second function handle, determining that the function module of the information security processing platform corresponding to the information security service request is the second function module;

[0195] In a case where the information security function handle is the third function handle, determining that the function module of the information security processing platform corresponding to the information security service request is the third function module;

[0196] In a case where the information security function handle is the fourth function handle, determining that the function module of the information security processing platform corresponding to the information security service request is the fourth function module;

[0197] Based on the functional module of the information security processing platform corresponding to the information security service request, information access is performed on the information security service request to obtain the information access result.

[0198] In a possible implementation, the function module of the information security processing platform corresponding to the information security service request performs information access on the information security service request to obtain the information access result, including:

[0199] When the functional module of the information security processing platform corresponding to the information security service request is the first functional module, encryption and decryption processing is performed on the information security service request based on the first functional module to obtain an encryption and decryption processing result, and the encryption and decryption processing result is determined as the information access result;

[0200] When the function module of the information security processing platform corresponding to the information security service request is the second function module, performing information digest processing on the information security service request based on the second function module to obtain an information digest processing result, and determining the information digest processing result as the information access result;

[0201] When the function module of the information security processing platform corresponding to the information security service request is the third function module, performing random number generation processing on the information security service request based on the third function module to obtain a random number generation result, and determining the random number generation result as the information processing result;

[0202] The functional module of the information security processing platform corresponding to the information security service request is the fourth functional module, and key generation processing is performed on the information security service request based on the fourth functional module to obtain a key generation result, and the key generation result is determined to be the information processing result.

[0203] In one possible implementation, based on the information security function handle corresponding to the information security service request, the corresponding functional module of the information security processing platform is accessed to obtain the processing result of the functional module of the information security processing platform as the information access result.

[0204] In one possible implementation, Figure 3 As shown, the functional module of the information security processing platform corresponding to the information security service request is the first functional module, the encryption and decryption functions are completed based on the first functional module, and the encryption and decryption processing results are returned to the user end, and the first functional module includes OpenSSL encryption and decryption library functions.

[0205] In one possible implementation, Figure 4 As shown, the functional module of the information security processing platform corresponding to the information security service request is the second functional module, the function of the information summary is completed based on the second functional module, and the processing result of the information summary processing is returned to the user end, and the second functional module includes the OpenSSL summary library function.

[0206] In one possible implementation, Figure 5 As shown, the functional module of the information security processing platform corresponding to the information security service request is the third functional module. The function of random number generation is completed based on the third functional module, and the result of random number generation is returned to the user end. The third functional module includes OpenSSL pseudo-random library function and hardware random number generation function.

[0207] In one possible implementation, Figure 6 As shown, the functional module of the information security processing platform corresponding to the information security service request is the fourth functional module. The key generation function is completed based on the fourth functional module, and the result of the key generation is returned to the user end. The fourth functional module includes a security library function.

[0208] In this implementation, information security-related algorithms are built into the information security processing platform, such as encryption and decryption, certificate generation and verification, etc., which can be customized by the user. The distributed deployment of encryption and decryption call strategies uses dedicated hardware chips to undertake complex data encryption algorithms, greatly reducing the algorithm delay of the business.

[0209] In step S109, the information access result is transmitted back to the business operating system through the information access system, so that the business program completes the information security service stage according to the information access result.

[0210] In a possible implementation, the information access result is transmitted back to the business operating system, ie, the user end, through the information access system to complete the information security service stage.

[0211] In this implementation, through hard isolation measures between the secure world and the non-secure world, the business runs in the non-secure world and information security management runs in the secure world, ensuring the high level requirements for user information security access and effectively preventing malicious attacks and data tampering incidents.

[0212] Beneficial effects of the present application: An embodiment of the present application provides an information access method for a domain control platform, wherein the domain control platform includes a first operating platform, a second operating platform and an information security processing platform, wherein the first operating platform runs a business operating system, the second operating platform runs an information access system, and the information security processing platform is used to process businesses related to information security; by responding to business instructions, the business operating system is controlled to run the business program corresponding to the business instruction; if the business program runs to the information security service stage, an information access instruction is generated; based on the information access instruction, the information access system is controlled to send an information security service request to the information security processing platform; based on the information security processing platform, information access is performed on the information security service request to obtain an information access result; the information access result is transmitted back to the business operating system through the information access system, so that the business program completes the information security service stage according to the information access result. By dividing the software operating environment into a first operating platform and a second operating platform, only providing an information access interface for information security services in the first operating platform, performing information security service operations in the second operating platform, and exchanging information with the information security processing platform through the second operating platform to obtain processing results of the information security services, which are then fed back to the first operating platform through the second operating platform. Through a multi-level security architecture, the security and confidentiality of data and operations can be effectively guaranteed to cope with potential attacks, thereby solving the problem of how to improve the security and confidentiality of data and operations in the process of information interaction.

[0213] Figure 7 The schematic diagram of the structure of an information access device 700 of a domain control platform provided in an embodiment of the present application is shown. The domain control platform includes a first operation platform, a second operation platform and an information security processing platform. The first operation platform runs a business operating system, the second operation platform runs an information access system, and the information security processing platform is used to process services related to information security. The device has the function of implementing the information access method of the domain control platform in the above method embodiment. The function can be implemented by hardware or by hardware executing corresponding software. Figure 7 As shown, the device may include:

[0214] The business program running module 701 is used to control the business operating system to run the business program corresponding to the business instruction in response to the business instruction;

[0215] An information access instruction generating module 702 is used to generate an information access instruction if the business program runs to the information security service stage;

[0216] An information security service request sending module 703, used to control the information access system to send an information security service request to the information security processing platform based on the information access instruction;

[0217] An information access module 704 is used to perform information access on the information security service request based on the information security processing platform to obtain an information access result;

[0218] The information access feedback module 705 is used to transmit the information access result back to the business operating system through the information access system, so that the business program completes the information security service stage according to the information access result.

[0219] In a possible implementation, the business operating system includes a user layer, an information security service interface, and a kernel layer, wherein the user layer is used to run business programs, the kernel layer is used to manage the first operating platform, and the user layer communicates with the kernel layer through the information security service interface.

[0220] The information access instruction generating module 702 is used to:

[0221] When the business program at the user layer runs to the information security service stage, the information access instruction is generated;

[0222] The information access instruction is transmitted to the kernel layer through the information security service interface.

[0223] In a possible implementation, the domain control platform further includes a platform switching module, and the platform switching module is used to determine whether the information access instruction is safe.

[0224] The information security service request sending module 703 is used to:

[0225] Control the kernel layer to send the information access instruction to the platform switching module, and perform a security judgment on the information access instruction based on the platform switching module to obtain a security judgment result;

[0226] Based on the security judgment result, the information access instruction is transmitted to the information access system, and the information access system performs handle matching processing on the information access instruction to obtain the information security function handle of the information access instruction;

[0227] Generate the information security service request based on the information security function handle;

[0228] Based on the inter-core communication method, the information access system is controlled to send the information security service request to the information security processing platform.

[0229] In a possible implementation, the information access system stores an information security function handle registry, where the information security function handle registry is constructed based on a preset access instruction and a security function handle corresponding to the preset access instruction.

[0230] The information security service request sending module 703 is also used to:

[0231] If the security determination result indicates that the information access instruction satisfies a preset security access condition, transmitting the information access instruction to the information access system;

[0232] Querying the information security function handle registry based on the information access instruction to obtain a security function handle corresponding to a preset access instruction matched by the information access instruction;

[0233] Determine a security function handle corresponding to a preset access instruction that matches the information access instruction, which is the information security function handle of the information access instruction.

[0234] In a possible implementation, the preset access instruction includes a first access instruction, a second access instruction, a third access instruction and a fourth access instruction, the first access instruction represents an encryption and decryption function, the second access instruction represents an information summary function, the third access instruction represents a random number generation function, and the fourth access instruction represents a key generation function, and the device includes a registry construction module 706,

[0235] The registry building module 706 is used to:

[0236] Determine that the security function handle corresponding to the first access instruction is a first function handle, where the first function handle is used to mark a first function module of the information security processing platform, and the first function module is used to implement encryption and decryption processing;

[0237] Determine that the security function handle corresponding to the second access instruction is a second function handle, where the second function handle is used to mark a second function module of the information security processing platform, and the second function module is used to implement information digest processing;

[0238] Determine that the security function handle corresponding to the third access instruction is a third function handle, the third function handle is used to mark a third function module of the information security processing platform, and the third function module is used to implement random number generation processing;

[0239] Determine that the security function handle corresponding to the fourth access instruction is a fourth function handle, the fourth function handle is used to mark a fourth function module of the information security processing platform, and the fourth function module is used to implement key generation processing;

[0240] Based on the correspondence between the first access instruction and the first function handle, the correspondence between the second access instruction and the second function handle, the correspondence between the third access instruction and the third function handle, and the correspondence between the fourth access instruction and the fourth function handle, the information security function handle registry is constructed.

[0241] In a possible implementation, the information security service request sending module 703 is further used to:

[0242] If the information access instruction matches the first access instruction, determining that the first function handle is the information security function handle;

[0243] If the information access instruction matches the second access instruction, determining that the second function handle is the information security function handle;

[0244] If the information access instruction matches the third access instruction, determining that the third function handle is the information security function handle;

[0245] If the information access instruction matches the fourth access instruction, the fourth function handle is determined to be the information security function handle.

[0246] In a possible implementation, the information access module 704 is used to:

[0247] Based on the information security function handle corresponding to the information security service request, determining a function module of the information security processing platform corresponding to the information security service request;

[0248] In a case where the information security function handle is the first function handle, determining that the function module of the information security processing platform corresponding to the information security service request is the first function module;

[0249] In a case where the information security function handle is the second function handle, determining that the function module of the information security processing platform corresponding to the information security service request is the second function module;

[0250] In a case where the information security function handle is the third function handle, determining that the function module of the information security processing platform corresponding to the information security service request is the third function module;

[0251] In a case where the information security function handle is the fourth function handle, determining that the function module of the information security processing platform corresponding to the information security service request is the fourth function module;

[0252] Based on the functional module of the information security processing platform corresponding to the information security service request, information access is performed on the information security service request to obtain the information access result.

[0253] In a possible implementation, the information access module 704 is used to:

[0254] When the functional module of the information security processing platform corresponding to the information security service request is the first functional module, encryption and decryption processing is performed on the information security service request based on the first functional module to obtain an encryption and decryption processing result, and the encryption and decryption processing result is determined as the information access result;

[0255] When the function module of the information security processing platform corresponding to the information security service request is the second function module, performing information digest processing on the information security service request based on the second function module to obtain an information digest processing result, and determining the information digest processing result as the information access result;

[0256] When the function module of the information security processing platform corresponding to the information security service request is the third function module, performing random number generation processing on the information security service request based on the third function module to obtain a random number generation result, and determining the random number generation result as the information processing result;

[0257] The functional module of the information security processing platform corresponding to the information security service request is the fourth functional module, and key generation processing is performed on the information security service request based on the fourth functional module to obtain a key generation result, and the key generation result is determined to be the information processing result.

[0258] In a possible implementation, the device further includes a prompt information feedback module 707, and the prompt information feedback module 707 is used to:

[0259] If the security judgment result indicates that the information access instruction does not meet the preset security access condition, generating prompt information;

[0260] Feedback the prompt information to the business program.

[0261] It should be noted that the device provided in the above embodiment, when implementing its functions, is only illustrated by the division of the above functional modules. In actual applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device is divided into different functional modules to complete all or part of the functions described above. In addition, the device and method embodiments provided in the above embodiment belong to the same concept, and the specific implementation process is detailed in the method embodiment, which will not be repeated here.

[0262] An embodiment of the present application provides an electronic device, which includes a processor and a memory, wherein the memory stores at least one instruction or at least one program, and the at least one instruction or the at least one program is loaded and executed by the processor to implement any one of the information access methods of a domain control platform provided in the above method embodiments.

[0263] The memory can be used to store software programs and modules. The processor executes various functional applications and data processing by running the software programs and modules stored in the memory. The memory can mainly include a program storage area and a data storage area, wherein the program storage area can store an operating system, application programs required for functions, etc.; the data storage area can store data created according to the use of the device, etc. In addition, the memory can include a high-speed random access memory and can also include a non-volatile memory, such as at least one disk storage device, a flash memory device, or other volatile solid-state storage devices. Accordingly, the memory can also include a memory controller to provide the processor with access to the memory.

[0264] An embodiment of the present application also provides a computer-readable storage medium, which can be set in an electronic device to store at least one instruction or at least one program related to implementing an information access method for a domain control platform. The at least one instruction or the at least one program is loaded and executed by the processor to implement any one of the information access methods for a domain control platform provided in the above method embodiments.

[0265] Optionally, in this embodiment, the above-mentioned storage medium may include but is not limited to: a USB flash drive, a read-only memory (ROM), a random access memory (RAM), a mobile hard disk, a magnetic disk or an optical disk, and other media that can store program codes.

[0266] It should be noted that the above-mentioned sequence of the embodiments of the present application is for description only and does not represent the advantages and disadvantages of the embodiments. The above-mentioned specific embodiments of this specification are described. Other embodiments are within the scope of the attached claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the embodiments and still achieve the desired results. In addition, the processes depicted in the drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0267] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0268] A person skilled in the art will understand that all or part of the steps to implement the above embodiments may be accomplished by hardware or by instructing related hardware through a program, and the program may be stored in a computer-readable storage medium, and the above-mentioned storage medium may be a read-only memory, a disk or an optical disk, etc.

[0269] The above description is only a preferred embodiment of the present application and is not intended to limit the present application. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application should be included in the protection scope of the present application.

Claims

1. A method for accessing information of a domain control platform, characterized in that: The domain control platform includes a first operation platform, a second operation platform and an information security processing platform, the first operation platform runs a business operating system, the second operation platform runs an information access system, and the information security processing platform is used to process services related to information security. The method includes: In response to the service instruction, controlling the service operating system to run the service program corresponding to the service instruction; If the business program runs to the information security service stage, an information access instruction is generated; Based on the information access instruction, controlling the information access system to send an information security service request to the information security processing platform; Performing information access on the information security service request based on the information security processing platform to obtain an information access result; The information access result is transmitted back to the business operating system through the information access system, so that the business program completes the information security service stage according to the information access result.

2. The information access method of the domain control platform according to claim 1, characterized in that: The business operating system includes a user layer, an information security service interface and a kernel layer, wherein the user layer is used to run business programs, the kernel layer is used to manage the first operating platform, and the user layer communicates with the kernel layer through the information security service interface. If the business program runs to the information security service stage, generating an information access instruction includes: When the business program at the user layer runs to the information security service stage, the information access instruction is generated; The information access instruction is transmitted to the kernel layer through the information security service interface.

3. The information access method of the domain control platform according to claim 2, characterized in that: The domain control platform also includes a platform switching module, which is used to determine whether the information access instruction is safe. The controlling the information access system to send an information security service request to the information security processing platform based on the information access instruction includes: Control the kernel layer to send the information access instruction to the platform switching module, and perform a security judgment on the information access instruction based on the platform switching module to obtain a security judgment result; Based on the security judgment result, the information access instruction is transmitted to the information access system, and the information access system performs handle matching processing on the information access instruction to obtain the information security function handle of the information access instruction; Generate the information security service request based on the information security function handle; Based on the inter-core communication method, the information access system is controlled to send the information security service request to the information security processing platform.

4. The information access method of the domain control platform according to claim 3, characterized in that: The information access system stores an information security function handle registry, which is constructed based on a preset access instruction and a security function handle corresponding to the preset access instruction. The method of transmitting the information access instruction to the information access system based on the security judgment result, and performing handle matching processing on the information access instruction based on the information access system to obtain the information security function handle of the information access instruction includes: If the security determination result indicates that the information access instruction satisfies a preset security access condition, transmitting the information access instruction to the information access system; Querying the information security function handle registry based on the information access instruction to obtain a security function handle corresponding to a preset access instruction matched by the information access instruction; Determine a security function handle corresponding to a preset access instruction that matches the information access instruction, which is the information security function handle of the information access instruction.

5. The information access method of the domain control platform according to claim 4, characterized in that: The preset access instruction includes a first access instruction, a second access instruction, a third access instruction and a fourth access instruction, wherein the first access instruction represents the function of encryption and decryption, the second access instruction represents the function of information summary, the third access instruction represents the function of random number generation, and the fourth access instruction represents the function of key generation. The method for constructing the information security function handle registry comprises: Determine that the security function handle corresponding to the first access instruction is a first function handle, where the first function handle is used to mark a first function module of the information security processing platform, and the first function module is used to implement encryption and decryption processing; Determine that the security function handle corresponding to the second access instruction is a second function handle, where the second function handle is used to mark a second function module of the information security processing platform, and the second function module is used to implement information digest processing; Determine that the security function handle corresponding to the third access instruction is a third function handle, the third function handle is used to mark a third function module of the information security processing platform, and the third function module is used to implement random number generation processing; Determine that the security function handle corresponding to the fourth access instruction is a fourth function handle, the fourth function handle is used to mark a fourth function module of the information security processing platform, and the fourth function module is used to implement key generation processing; Based on the correspondence between the first access instruction and the first function handle, the correspondence between the second access instruction and the second function handle, the correspondence between the third access instruction and the third function handle, and the correspondence between the fourth access instruction and the fourth function handle, the information security function handle registry is constructed.

6. The information access method of the domain control platform according to claim 5, characterized in that: The step of determining the security function handle corresponding to the preset access instruction that matches the information access instruction is the information security function handle of the information access instruction, including: If the information access instruction matches the first access instruction, determining that the first function handle is the information security function handle; If the information access instruction matches the second access instruction, determining that the second function handle is the information security function handle; If the information access instruction matches the third access instruction, determining that the third function handle is the information security function handle; If the information access instruction matches the fourth access instruction, the fourth function handle is determined to be the information security function handle.

7. The information access method of the domain control platform according to claim 6, characterized in that: The information security processing platform is used to perform information access on the information security service request to obtain an information access result, including: Based on the information security function handle corresponding to the information security service request, determining a function module of the information security processing platform corresponding to the information security service request; In a case where the information security function handle is the first function handle, determining that the function module of the information security processing platform corresponding to the information security service request is the first function module; In a case where the information security function handle is the second function handle, determining that the function module of the information security processing platform corresponding to the information security service request is the second function module; In a case where the information security function handle is the third function handle, determining that the function module of the information security processing platform corresponding to the information security service request is the third function module; In a case where the information security function handle is the fourth function handle, determining that the function module of the information security processing platform corresponding to the information security service request is the fourth function module; Based on the functional module of the information security processing platform corresponding to the information security service request, information access is performed on the information security service request to obtain the information access result.

8. The information access method of the domain control platform according to claim 7, characterized in that: The function module based on the information security processing platform corresponding to the information security service request performs information access on the information security service request to obtain the information access result, including: When the functional module of the information security processing platform corresponding to the information security service request is the first functional module, encryption and decryption processing is performed on the information security service request based on the first functional module to obtain an encryption and decryption processing result, and the encryption and decryption processing result is determined as the information access result; When the function module of the information security processing platform corresponding to the information security service request is the second function module, performing information digest processing on the information security service request based on the second function module to obtain an information digest processing result, and determining the information digest processing result as the information access result; When the function module of the information security processing platform corresponding to the information security service request is the third function module, performing random number generation processing on the information security service request based on the third function module to obtain a random number generation result, and determining the random number generation result as the information processing result; The functional module of the information security processing platform corresponding to the information security service request is the fourth functional module, and key generation processing is performed on the information security service request based on the fourth functional module to obtain a key generation result, and the key generation result is determined to be the information processing result.

9. The information access method of the domain control platform according to claim 3, characterized in that: The method further comprises: If the security judgment result indicates that the information access instruction does not meet the preset security access condition, generating prompt information; Feedback the prompt information to the business program.

10. An information access device for a domain control platform, characterized in that: The domain control platform includes a first operation platform, a second operation platform and an information security processing platform, the first operation platform runs a business operating system, the second operation platform runs an information access system, the information security processing platform is used to process services related to information security, and the device includes: A business program running module, used to control the business operating system to run the business program corresponding to the business instruction in response to the business instruction; An information access instruction generation module, used to generate an information access instruction if the business program runs to the information security service stage; An information security service request sending module, used to control the information access system to send an information security service request to the information security processing platform based on the information access instruction; An information access module, used to perform information access on the information security service request based on the information security processing platform to obtain an information access result; The information access feedback module is used to transmit the information access result back to the business operating system through the information access system, so that the business program completes the information security service stage according to the information access result.

Images