Communication method and device for software base and trusted firmware simulator, equipment and medium

Abstract

The invention relates to a communication method and device for a software base and a trusted firmware simulator, equipment and a medium. In the scheme, a software base receives a first command which is sent by a client and carries target data, and stores the target data into a shared memory; a second command is sent to the trusted firmware simulator through the netlink, so that the trusted firmware simulator obtains the target data from the shared memory, and an operation result of the target data is stored in the shared memory; receiving a netlink interrupt signal sent by the trusted firmware simulator; and obtaining an operation result from the shared memory according to the interrupt signal and sending the operation result to the client. Visibly, according to the scheme, communication between the software base and the trusted firmware simulator is realized through the netlink, frequent switching between a kernel mode and a user mode can be avoided, the system overhead is reduced, and the system performance is improved; through the shared memory, data copying and transmission processes can be avoided, so that the data transmission speed is remarkably improved.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to a communication method, device, equipment and medium between a software base and a trusted firmware simulator. Background Art

[0002] With the continuous development of computer technology, system security has become an increasingly important issue. Trusted firmware includes TPM (Trusted Platform Module), Secure Enclave (Secure Processing Unit), etc. As a security module, it plays an important role in protecting key system data and performing secure boot. In a trusted computing environment, the trusted firmware simulator usually runs in user mode, while the software base runs in kernel mode. At present, the communication between the trusted firmware simulator and the software base mostly relies on traditional system calls, message queues, etc. However, the use of system calls requires frequent switching between kernel mode and user mode, which affects system performance. The use of message queues to transmit data has low transmission efficiency.

[0003] Therefore, how to improve the efficiency of data transmission and improve system performance when the software base communicates with the trusted firmware simulator is a problem that needs to be solved by those skilled in the art. Summary of the invention

[0004] The present application provides a communication method, apparatus, device and medium between a software base and a trusted firmware simulator, so as to improve the efficiency of data transmission and improve system performance when the trusted firmware simulator communicates with the software base.

[0005] In a first aspect, the present application provides a communication method between a software base and a trusted firmware simulator, the communication method being applied to the software base, the communication method comprising:

[0006] Receive a first command sent by a client; the first command carries target data;

[0007] storing the target data into a shared memory;

[0008] Sending a second command to the trusted firmware simulator through netlink; the second command includes data storage information, so that the trusted firmware simulator obtains the target data from the shared memory through the data storage information, and stores the operation result of the target data in the shared memory;

[0009] Receiving a netlink interrupt signal sent by the trusted firmware simulator;

[0010] The operation result is obtained from the shared memory according to the interrupt signal, and the operation result is sent to the client.

[0011] Optionally, storing the target data in a shared memory includes:

[0012] Calculate the signature value of the target data by a cryptographic algorithm;

[0013] Encapsulating the target data and the signature value to obtain encapsulated target data;

[0014] The encapsulated target data is stored in a shared memory.

[0015] Optionally, after receiving the first command sent by the client, the method further includes:

[0016] Request data storage information from the shared memory; the data storage information includes the target data storage address information and the reply data storage address information.

[0017] Optionally, after sending the second command to the trusted firmware simulator through netlink, the method further includes:

[0018] Detecting whether the trusted firmware simulator successfully receives the target data;

[0019] If yes, then add the relevant information of the target process to the process linked list, and set the target process to sleep state;

[0020] Among them, the relevant information includes: a serial number, the data storage information and a process identification number of the target process; the target process is used to execute the following steps: receive a first command sent by the client, store the target data in a shared memory, and send a second command to a trusted firmware simulator via netlink.

[0021] Optionally, after receiving the netlink interrupt signal sent by the trusted firmware simulator, the method further includes:

[0022] Using the sequence number carried by the netlink interrupt signal, searching for the corresponding process identification number from the process linked list;

[0023] Wake up the corresponding target process according to the found process identification number.

[0024] Optionally, acquiring the operation result from the shared memory according to the interrupt signal, and sending the operation result to the client includes:

[0025] The corresponding operation result is obtained from the shared memory through the awakened target process and the sequence number carried by the netlink interrupt signal, and the operation result is sent to the client.

[0026] Optionally, detecting whether the trusted firmware simulator successfully receives the target data includes:

[0027] Obtaining a value of a flag bit of a target data segment in a shared memory; wherein the target data segment is a data segment storing the target data;

[0028] Determining whether the value of the flag bit is a predetermined value;

[0029] If yes, it is determined that the trusted firmware simulator successfully receives the target data; if no, it is determined that the trusted firmware simulator fails to successfully receive the target data.

[0030] In a second aspect, the present application provides a communication device between a software base and a trusted firmware simulator, the communication device being applied to the software base, the communication device comprising:

[0031] A first receiving module, configured to receive a first command sent by a client; the first command carries target data;

[0032] A storage module, used for storing the target data in a shared memory;

[0033] A first sending module is used to send a second command to the trusted firmware simulator through netlink; the second command includes data storage information, so that the trusted firmware simulator obtains the target data from the shared memory through the data storage information, and stores the operation result of the target data in the shared memory;

[0034] A second receiving module is used to receive a netlink interrupt signal sent by the trusted firmware simulator;

[0035] An acquisition module, used for acquiring the operation result from the shared memory according to the interrupt signal;

[0036] The second sending module is used to send the operation result to the client.

[0037] In a third aspect, the present application provides an electronic device, including:

[0038] A processor, a memory, and a computer program stored in the memory and executable on the processor, wherein the processor executes the steps of the above-mentioned communication method of the present application through the computer program.

[0039] In a fourth aspect, the present application further provides a computer storage medium, wherein the computer storage medium stores computer executable instructions, and the computer executable instructions are used to execute the steps of the above-mentioned communication method of the present application.

[0040] The above technical solution provided by the embodiment of the present application has the following advantages over the prior art: the present application provides a communication solution between a software base and a trusted firmware simulator, in which the software base receives a first command carrying target data sent by a client, and stores the target data in a shared memory; sends a second command to the trusted firmware simulator through netlink; the second command includes data storage information, so that the trusted firmware simulator obtains the target data from the shared memory through the data storage information, and stores the operation result of the target data in the shared memory; receives a netlink interrupt signal sent by the trusted firmware simulator; obtains the operation result from the shared memory according to the interrupt signal, and sends the operation result to the client. It can be seen that in the present solution, the communication between the software base and the trusted firmware simulator is realized through netlink, which can avoid frequent switching between kernel state and user state, reduce system overhead, and improve system performance; through shared memory, the data copying and transmission process can be avoided, thereby significantly improving the speed of data transmission. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the invention and, together with the description, serve to explain the principles of the invention.

[0042] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0043] One or more embodiments are exemplarily described by pictures in the corresponding drawings, and these exemplified descriptions do not constitute limitations on the embodiments. Elements with the same reference numerals in the drawings represent similar elements, and unless otherwise stated, the figures in the drawings do not constitute proportional limitations.

[0044] Figure 1 A flow chart of a communication method between a software base and a trusted firmware simulator provided in an embodiment of the present application;

[0045] Figure 2 A flow chart of another method for communicating between a software base and a trusted firmware simulator provided in an embodiment of the present application;

[0046] Figure 3 A schematic flow chart of an overall communication method between a software base and a trusted firmware simulator provided in an embodiment of the present application;

[0047] Figure 4 A schematic diagram of the structure of a communication device between a software base and a trusted firmware simulator provided in an embodiment of the present application;

[0048] Figure 5 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0049] When implementing communication between the trusted firmware simulator and the software base, the existing solutions use only one communication method, which has different degrees of deficiencies in real-time response, data transmission volume, and high concurrency processing performance. For example, system calls need to frequently switch between kernel state and user state, which affects performance, message queues have low data transmission efficiency, and shared memory may cause data inconsistency due to concurrent access. The communication between the software base and the trusted firmware simulator is characterized by high concurrent processing capabilities, massive data interaction, and frequent and efficient switching between kernel state and user state. This communication mode not only requires extremely high performance optimization, but also must achieve efficient interaction under the premise of ensuring data security and integrity.

[0050] Therefore, in this application, a communication method, device, equipment and medium between a software base and a trusted firmware simulator are disclosed, which provide a safe, efficient and reliable communication mechanism when the trusted firmware simulator communicates with the software base, improve the efficiency of data transmission, and improve system performance.

[0051] Before explaining this application, the relevant terms involved in this application are explained first:

[0052] The software base is a software layer located between the system software and the application software. It provides connection and communication services between the system software and the application software. The software base can simplify the development, deployment and maintenance process of the software system and improve the portability and scalability of the system.

[0053] Trusted firmware refers to a set of software components used to establish a trusted execution environment (TEE) or a safety and environment protection system (SPE) on the processor. It ensures the security of key codes and data during system startup, operation and management. The trusted firmware simulator is simulated by pure software;

[0054] Netlink (inter-process communication) provides a reliable, message-oriented communication method specifically used to transfer network-related information between the Linux (operating system) kernel and user space.

[0055] Shared memory refers to a memory area in a multi-processor computer system that is designed to be accessed by multiple CPUs (Central Processing Units) or processes at the same time. This memory area is usually used to achieve data sharing and communication between processes, and is an important means of multi-process communication in Unix (operating system) and Unix-like systems.

[0056] SM2 algorithm (elliptic curve public key cryptography algorithm) is an asymmetric encryption algorithm released by the China Institute of Cryptography (China National Cryptography Administration). It is based on the principle of elliptic curve cryptography (ECC) and provides an efficient and secure solution for key exchange, digital signature and public key encryption. The security of SM2 algorithm mainly depends on the difficulty of discrete logarithm problem of elliptic curve. Compared with traditional public key algorithms such as RSA (asymmetric encryption algorithm), it requires a shorter key length and higher computational efficiency to achieve the same security level. Secure communication uses SM2 signature verification algorithm and SM4 encryption and decryption algorithm to encrypt and transmit communication data.

[0057] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of this application.

[0058] The disclosure below provides many different embodiments or examples to implement different structures of the present invention. In order to simplify the disclosure of the present invention, the parts and settings of specific examples are described below. Of course, they are only examples, and the purpose is not to limit the present invention. In addition, the present invention can repeat reference numbers and / or letters in different examples. This repetition is for the purpose of simplification and clarity, and does not itself indicate the relationship between the various embodiments and / or settings discussed.

[0059] See also Figure 1 , is a flow chart of a communication method between a software base and a trusted firmware simulator provided in an embodiment of the present application, the communication method is applied to the software base, and the communication method includes:

[0060] S101, receiving a first command sent by a client; the first command carries target data;

[0061] In this application, the command received by the software base is referred to as the first command, and the first command carries the target data to be sent to the trusted firmware simulator. The client can be, for example, TSB (Trusted Software Base), TTM (Thread-level transactional memory), management center, etc.

[0062] S102, storing the target data into the shared memory;

[0063] It should be noted that the trusted firmware simulator and the software base need to transmit various policies and lists, which has extremely high requirements for data volume and real-time performance. As the amount of data increases, the time required for direct transmission will also increase significantly, which will not only affect the efficiency of data transmission, but may also cause the real-time performance of data transmission to fail to meet application requirements. In application scenarios with high real-time requirements, long transmission delays are unacceptable.

[0064] Therefore, in this application, the software base and the trusted firmware simulator transmit target data through shared memory. Shared memory is a memory area directly shared between processes or threads, which avoids the copying and transmission process of data, thereby significantly improving the speed of data transmission. Since there is no additional data copying and transmission overhead, shared memory can provide higher data transmission efficiency than other inter-process communication methods (such as message queues, pipelines, etc.). Since the data is stored directly in the memory, the access delay of the shared memory is very low, which can meet the application scenarios with high real-time requirements. By flexibly specifying the size of the shared memory and dividing the shared memory storage data type, it can ensure that system resources are reasonably utilized.

[0065] S103, sending a second command to the trusted firmware simulator through netlink; the second command includes data storage information, so that the trusted firmware simulator obtains the target data from the shared memory through the data storage information, and stores the operation result of the target data in the shared memory;

[0066] In a trusted computing environment, the trusted firmware simulator usually runs in user mode, while the software base runs in kernel mode. This design makes the interaction between the two complicated, especially when the interaction is frequent, involving a large number of switches between kernel mode and user mode, which correspond to different CPU privilege levels. The CPU privilege level needs to be changed during the switch, which usually involves the operation of the CPU control register, adding additional overhead. Since the kernel state has higher permissions, the system needs to perform a series of security checks when switching from user mode to kernel mode to ensure that the request is legal and safe. These security checks also consume resources. User mode and kernel mode may have different memory address spaces and page mappings. When switching, the page table may need to be changed, resulting in the failure of the TLB (Translation Lookaside Buffer) and the need to reload the page table information. In addition, the code and data in different states may occupy different caches, and the cache content may need to be reloaded during the switch, resulting in performance loss.

[0067] Therefore, in this application, in order to avoid frequent switching between kernel state and user state and reduce system overhead, netlink is used to implement data interaction between the software base and the trusted firmware simulator. Netlink is a communication mechanism between user space and kernel space provided by the Linux kernel. It allows user space programs to communicate with the kernel through a standard socket interface without frequent switching between kernel state and user state.

[0068] In the present application, after the software base stores the target data in the shared memory, it can send a second command to the trusted firmware simulator through netlink, and the second command includes data storage information, and the data storage information can be the target data storage address information and the reply data storage address information, or the address information of the information segment storing the target data storage address information and the reply data storage address information, which is not specifically limited here. Among them, the target data storage address information is the address information for storing the target data, and the target data storage address information includes: the physical address of the target data and the input data length, and the reply data storage address information is the address information for storing the operation result replied by the trusted firmware simulator, and the reply data storage address information includes: the physical address of the reply data and the maximum length limited by the reply data.

[0069] After receiving the second command, the trusted firmware simulator can obtain the target data from the shared memory through the target data storage address information in the data storage information, process the target data, and then store the operation result in the shared memory according to the reply data storage address information.

[0070] S104, receiving a netlink interrupt signal sent by the trusted firmware simulator;

[0071] In this application, the target data carries a command code, and the trusted firmware simulator performs the corresponding task operation on the target data according to the command code. After generating the operation result, the operation result is stored in the shared memory, and a netlink interrupt signal is sent to the software base.

[0072] S105. Obtain the operation result from the shared memory according to the interrupt signal, and send the operation result to the client.

[0073] In the present application, after receiving the interrupt signal, the software base can process the interrupt signal by thread polling, waking up the process, etc., which is not specifically limited here. When the interrupt signal is processed by thread polling, the operation result can be obtained from the shared memory according to the interrupt signal, and the operation result is sent to the client; when the interrupt signal is processed by waking up the process, the corresponding process can be woken up according to the interrupt signal, and the operation result can be obtained from the shared memory through the process, and the operation result is sent to the client.

[0074] In summary, in this solution, the communication between the software base and the trusted firmware simulator is realized through netlink, which can avoid frequent switching between kernel state and user state, reduce system overhead and improve system performance; through shared memory, the data copying and transmission process can be avoided, thereby significantly improving the speed of data transmission.

[0075] In another embodiment of the present application, after receiving the first command sent by the client, it also includes: applying for data storage information from the shared memory; the data storage information includes the target data storage address information and the reply data storage address information. Accordingly, when the present application stores the target data in the shared memory, it specifically includes: storing the target data in the target data segment; the target data segment is the data segment in the shared memory corresponding to the target data storage address information; and storing the sequence number and the data storage information in the target information segment of the shared memory.

[0076] In the present application, the shared memory includes a data space and a command space. After receiving the first command sent by the client, it is necessary to apply for an address from the shared memory based on the size of the target data and the size of the business demand. The applied address includes: the target data storage address information of the target data segment in the data space, the reply data storage address information for storing the reply data, and the address of the target information segment in the command space.

[0077] Among them, the target data segment is a data segment for storing target data; the target information segment is used to store the serial number and data storage information, and the data storage information includes the target data storage address information and the reply data storage address information; the serial number is a unique serial number assigned to the first command by the software base after receiving the first command, which is used to distinguish the commands sent by the client. Before receiving the first command, the present application needs to initialize the sequence number atomic quantity. The atomic quantity is a variable. The operations (addition and subtraction operations) of the sequence number atomic quantity are inseparable and will not be interrupted by other threads. The operation is either completed in full or not executed at all. The initial value of the atomic quantity initialized by the present application is 1. Each time the first command sent by the client is received, the atomic quantity will perform an addition operation to obtain the serial number of each first command. The serial number in the present application is an atomic quantity, which can ensure the uniqueness and traceability of the command.

[0078] In another embodiment of the present application, when storing the target data in the shared memory, it includes: calculating the signature value of the target data through a cryptographic algorithm; encapsulating the target data and the signature value to obtain encapsulated target data; and storing the encapsulated target data in the shared memory.

[0079] That is to say, in order to ensure the security of data, the present application can calculate the signature value of the target data through a cryptographic algorithm, and encapsulate it together with the target data and store it in the shared memory. Correspondingly, the target data obtained by the trusted firmware simulator from the shared memory is also the encapsulated target data. The trusted firmware simulator verifies the signature of the encapsulated target data. If the signature verification is successful, it means that the target data has not been modified, and performs the task operation on the target data to generate the operation result. When the trusted firmware simulator stores the operation result in the shared memory, it can also be signed through a cryptographic algorithm and then stored in the shared memory. The software base obtains the signed operation result from the shared memory, and after the signature verification is successful, it is sent to the client.

[0080] In the present application, the cryptographic algorithm used may be the SM2 algorithm. During the communication between the software base and the trusted firmware simulator, the SM2 algorithm is used to sign and verify the data, which can ensure the accuracy and integrity of the transmitted data.

[0081] See also Figure 2 , is a flow chart of another communication method between a software base and a trusted firmware simulator provided in an embodiment of the present application, the communication method is applied to the software base, and the communication method includes:

[0082] S201, receiving a first command sent by a client; the first command carries target data;

[0083] S202, storing the target data into the shared memory;

[0084] S203, sending a second command to the trusted firmware simulator through netlink; the second command includes data storage information, so that the trusted firmware simulator obtains the target data from the shared memory through the data storage information, and stores the operation result of the target data in the shared memory;

[0085] S204, detecting whether the trusted firmware simulator successfully receives the target data;

[0086] If yes, execute S205; if no, execute S204;

[0087] S205, adding relevant information of the target process to the process linked list, and setting the target process to a sleep state; wherein the relevant information includes: a serial number, data storage information, and a process identification number of the target process; the target process is used to execute the above S201-S203;

[0088] S206, receiving a netlink interrupt signal sent by the trusted firmware simulator;

[0089] S207, using the sequence number carried by the netlink interrupt signal, searching for the corresponding process identification number from the process list;

[0090] S208, waking up the corresponding target process according to the found process identification number;

[0091] S209, obtaining the corresponding operation result from the shared memory through the awakened target process and the sequence number carried by the netlink interrupt signal, and sending the operation result to the client.

[0092] It is understandable that the software base needs to support multiple clients accessing the trusted firmware at the same time, so high concurrency is particularly important, which requires the software base to be able to efficiently manage resources to ensure that all requests can be responded to in a timely manner while maintaining the stability and security of communication. In this application, the use of the process sleep wake-up mechanism combined with the efficient linked list management mechanism can greatly optimize the allocation and utilization of system resources and greatly improve the system's concurrent processing capability and response speed.

[0093] Among them, in the operating system, the process sleep wake-up mechanism is an important scheduling means used to control the execution order and timing of the process. When a process needs to wait for a certain condition (such as the completion of I / O (Input / Output) operation, resource release, etc.), it will enter the sleep state, release CPU resources, and wake up and continue to execute until the condition is met. The sleep state of the process can be divided into interruptible sleep and uninterruptible sleep: interruptible sleep means that the process can be awakened by a signal while waiting for the condition to be met. In this state, if the process receives a signal, it will first process the signal, and then decide whether to continue sleeping based on whether the condition is met. Uninterruptible sleep means that the process will not respond to any signal while waiting for the condition to be met, and can only be awakened by a specific wake-up operation (such as resource release). A linked list is a data structure that stores data through links between nodes, which is flexible and efficient. In high-concurrency communications, linked lists are often used to manage waiting queues, message queues, etc. to achieve fast message delivery and fairness in processing. When processing high-concurrency communications, the combination of the process sleep wake-up mechanism and the linked list can achieve efficient process scheduling and message processing.

[0094] In some embodiments of the present application, the process of detecting whether the trusted firmware simulator successfully receives the target data specifically includes the following steps:

[0095] Obtain the value of the flag bit of the target data segment in the shared memory; wherein the target data segment is the data segment storing the target data; determine whether the value of the flag bit is a predetermined value; if so, determine that the trusted firmware simulator successfully receives the target data; if not, determine that the trusted firmware simulator does not successfully receive the target data.

[0096] In the present application, after the trusted firmware simulator successfully obtains the target data, it will set the command reception flag of the data segment storing the target data to a predetermined value. In the present application, the predetermined value can be set to 1. Therefore, the software base can confirm whether the firmware simulator has successfully received the target data by obtaining the value of the flag. If the value is 1, it means that the firmware simulator has successfully received the target data. If it is not 1, it means that the firmware simulator has not successfully received the target data. If the trusted firmware simulator still fails to successfully obtain the target data after exceeding the predetermined time, it means that the trusted firmware simulator may have a problem and cannot obtain the target data for processing. At this time, a timeout error code can be returned to the client.

[0097] If the trusted firmware simulator successfully receives the target data, the software base can add the relevant information of the target process to the process list and set the target process to a sleep state. The relevant information includes: a serial number, data storage information, and a process identification number of the target process; the target process is used to execute the above S201-S203. In addition, the present application can set the sleep state to be interruptible and wakeable, and set the sleep timeout of the current process.

[0098] In this application, after the trusted firmware simulator writes the operation result into the data space of the shared memory, it sends an interrupt signal to the software base through netlink, and the interrupt signal may include: a serial number, and may also include reply data storage address information. After the software base receives the netlink interrupt signal, it triggers a callback function, and through the callback function, according to the serial number of the interrupt signal, it traverses the process list and wakes up the sleeping process corresponding to the serial number. After the process is woken up, it obtains the operation result written by the trusted firmware simulator from the shared memory data and sends it to the client.

[0099] See also Figure 3 , is a flow chart of an overall communication method between a software base and a trusted firmware simulator provided in an embodiment of the present application, the flow mainly includes the following steps:

[0100] 1. Initialization process:

[0101] In the software base, it is necessary to initialize netlink, initialize the process list, initialize shared memory, and initialize the atomic command sequence number. When initializing netlink, it is necessary to create a new netlink protocol type in the kernel space, bind the protocol number, and receive the interrupt callback function. When initializing shared memory, it is necessary to initialize the shared memory according to business needs and divide the shared memory into a command interval and a data interval. When initializing the process list, the list items include: sequence number, physical address of command interaction, and process key data (task_struct), etc. The physical address of command interaction includes: target data storage address information and reply data storage address information. The process key data may include the process identification number.

[0102] In the trusted firmware simulator, netlink needs to be initialized. When initializing netlink, a netlink raw socket needs to be created in user space, the socket needs to be bound to the specified multicast group, and a thread needs to be created to loop and receive data from this multicast group.

[0103] 2. Software-based data processing process:

[0104] The software base receives the first command sent by the client, which carries the target data, uses the SM2 algorithm signature to calculate the signature value of the target data, and encapsulates the target data. Then, according to the business demand size and other information, apply for a segment of address from the shared memory, write the encapsulated data to the shared memory, write the data into the data segment of the shared memory data space, and write the command length, sequence number, and data storage information into the information segment of the shared memory command space. The data storage information includes: target data storage address information and reply data storage address information. Add the task information to the process linked list, and the task information includes the sequence number, target data storage address information and reply data storage address information; the software base sends the second command to the agreed multicast group through netlink, and the second command includes: sequence number, target data storage address information and reply data storage address information, or only sends the sequence number and the physical address of the information segment.

[0105] After the software base sends the second command, it polls the command receiving flag of the data segment in the shared memory. If the value of the command receiving flag is 1, it confirms that the trusted firmware simulator has successfully received the target data and puts the task process into a sleep state. If the command reception timeouts, a timeout error code is returned to the client; if the reception is successful, the process information is added to the process list, and the process information includes the process identification number; the current process sleep state is set to interruptible wakeup, the current process sleep timeout is set, and the current process is set to enter a sleep state.

[0106] 3. Data processing process of the trusted firmware simulator:

[0107] The trusted firmware simulator receives the second command through the netlink socket, creates a task processing thread, and the task processing thread obtains data from the shared memory according to the target data storage address information in the second command; the obtained data is signed using the SM2 algorithm; the receiving flag position of the data segment in the shared memory is set to 1; the trusted firmware simulator obtains the command code from the target data, processes the target data according to the command code, and obtains the operation result data after business processing; the trusted firmware simulator signs the operation result data using the SM2 algorithm, and writes the signed data into the data space of the shared memory; the trusted firmware simulator sends information to the software base through netlink, the information includes: a serial number, and may also include reply data storage address information.

[0108] 4. Software-based processing of sending data:

[0109] The software base receives the netlink interrupt signal and triggers the callback function; the software base verifies the serial number in the interrupt signal, traverses the process list according to the serial number, wakes up the sleeping process corresponding to the serial number, and the awakened process obtains the operation result data returned by the shared memory data space. The task process uses the SM2 algorithm to verify the signature of the data. After the signature verification is successful, the task process returns the task data to the client, and the task data is the operation result data.

[0110] In summary, this application can greatly optimize the allocation and utilization of system resources by combining the process sleep wake-up strategy with an efficient linked list management mechanism, and greatly improve the concurrent processing capability and response speed of the system. This strategy effectively reduces the unnecessary occupation of CPU resources and improves the overall efficiency and response speed of the system by putting processes waiting for resources into a sleep state and quickly waking them up when resources are available. At the same time, the linked list is used as an efficient data structure to efficiently manage the state of the process. When a process does not have the corresponding resources, a corresponding event is generated and added to the linked list. Subsequently, the system can wake up those processes waiting for resources by traversing the linked list and notify them that the resources are ready. This sleep and wake-up mechanism based on the linked list allows the system to quickly respond to and process a large number of requests in the face of high concurrency scenarios, while maintaining low latency and high throughput, providing users with a better user experience.

[0111] This application uses the netlink mechanism as a bridge for data interaction between user state and kernel state, greatly improving the management efficiency of system resources and the efficiency of data transmission. Through netlink, an efficient communication mechanism built into the Linux kernel, unnecessary context switching and copying operations are reduced, thereby reducing system overhead and improving the throughput and response speed of data processing. User-state applications can quickly send requests to kernel state through netlink, and the kernel module can also process and feedback the results immediately after receiving the request. This seamless connection greatly improves the overall efficiency of communication. In addition, the netlink mechanism also provides a powerful filtering function, which enables this application to accurately control the sending and receiving of messages according to actual needs, avoids the interference of invalid data, and further enhances the stability and scalability of the system.

[0112] The present invention realizes data transmission efficiency and security through shared memory technology and SM2 signature verification algorithm. The transmission data is encrypted, signed and verified through the SM2 algorithm to ensure the integrity, confidentiality and non-repudiation of the data. Through the use of shared memory, the overall response speed and data processing capability of the system are greatly improved.

[0113] See also Figure 4 , Figure 4A schematic diagram of a communication device structure between a software base and a trusted firmware simulator provided in an embodiment of the present application, wherein the communication device is applied to the software base and includes:

[0114] The first receiving module 11 is used to receive a first command sent by a client; the first command carries target data;

[0115] A storage module 12, used for storing the target data in a shared memory;

[0116] The first sending module 13 is used to send a second command to the trusted firmware simulator through netlink; the second command includes data storage information, so that the trusted firmware simulator obtains the target data from the shared memory through the data storage information, and stores the operation result of the target data in the shared memory;

[0117] A second receiving module 14 is used to receive a netlink interrupt signal sent by the trusted firmware simulator;

[0118] An acquisition module 15, configured to acquire the operation result from a shared memory according to the interrupt signal;

[0119] The second sending module 16 is used to send the operation result to the client.

[0120] As an optional embodiment, the storage module includes:

[0121] A calculation unit, used for calculating the signature value of the target data through a cryptographic algorithm;

[0122] An encapsulation unit, used to encapsulate the target data and the signature value to obtain encapsulated target data;

[0123] The storage unit is used to store the encapsulated target data into a shared memory.

[0124] As an optional embodiment, the device further includes:

[0125] The application module is used to apply for data storage information from the shared memory; the data storage information includes the target data storage address information and the reply data storage address information.

[0126] As an optional embodiment, the device further includes:

[0127] A detection module, used to detect whether the trusted firmware simulator successfully receives the target data; if so, triggering a setting module;

[0128] A setting module, used for adding relevant information of the target process to the process linked list, and setting the target process to a sleep state;

[0129] Among them, the relevant information includes: a serial number, the data storage information and a process identification number of the target process; the target process is used to execute the following steps: receive a first command sent by the client, store the target data in a shared memory, and send a second command to a trusted firmware simulator via netlink.

[0130] As an optional embodiment, the device further includes:

[0131] A search module, used to use the sequence number carried by the netlink interrupt signal to search for a corresponding process identification number from the process linked list;

[0132] The wake-up module is used to wake up the corresponding target process according to the found process identification number.

[0133] As an optional embodiment, the acquisition module is specifically used to: obtain the corresponding operation result from the shared memory through the awakened target process and the sequence number carried by the netlink interrupt signal.

[0134] As an optional embodiment, the detection module includes:

[0135] An acquisition unit, used for acquiring a value of a flag bit of a target data segment in a shared memory; wherein the target data segment is a data segment storing the target data;

[0136] The judging unit is used to judge whether the value of the flag bit is a predetermined value; if so, it is judged that the trusted firmware simulator successfully receives the target data; if not, it is judged that the trusted firmware simulator does not successfully receive the target data.

[0137] Regarding the device in the above embodiment, the specific manner in which each module performs operations has been described in detail in the embodiment of the method, and will not be elaborated here.

[0138] See also Figure 5 , Figure 5 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application, the electronic device specifically includes:

[0139] The processor 21, the memory 22 and the computer program stored in the memory 22 and executable on the processor 21, the processor 21 executes the steps of the communication method described in any of the above method embodiments through the computer program.

[0140] Among them, the processor 21 may include one or more processing cores, such as a 4-core processor, an 8-core processor, etc. The processor 21 may be implemented in at least one hardware form of DSP (Digital Signal Processing), FPGA (Field-Programmable Gate Array), and PLA (Programmable Logic Array). The processor 21 may also include a main processor and a coprocessor. The main processor is a processor for processing data in the awake state, also known as a CPU (Central Processing Unit); the coprocessor is a low-power processor for processing data in the standby state. In some embodiments, the processor 21 may be integrated with a GPU (Graphics Processing Unit), which is responsible for rendering and drawing the content to be displayed on the display screen. In some embodiments, the processor 21 may also include an AI (Artificial Intelligence) processor, which is used to process computing operations related to machine learning.

[0141] The memory 22 may include one or more computer-readable storage media, which may be non-transitory. The memory 22 may also include a high-speed random access memory, and a non-volatile memory, such as one or more disk storage devices, flash memory storage devices. In this embodiment, the memory 22 is at least used to store the following computer program 221, wherein, after the computer program is loaded and executed by the processor 21, it can implement the relevant steps in the communication method disclosed in any of the aforementioned embodiments. In addition, the resources stored in the memory 22 may also include an operating system 222 and data 223, etc., and the storage method may be temporary storage or permanent storage. Among them, the operating system 222 may include Windows, Unix, Linux, etc.

[0142] In some embodiments, the electronic device may further include a display screen 23 , an input / output interface 24 , a communication interface 25 , a sensor 26 , a power source 27 , and a communication bus 28 .

[0143] certainly, Figure 5 The structure of the electronic device shown does not constitute a limitation on the electronic device in the embodiments of the present application. In actual applications, the electronic device may include Figure 5 More or fewer components than shown, or combinations of certain components.

[0144] In another exemplary embodiment, a computer storage medium is also provided, and when the program instructions are executed by a processor, the steps of the communication method described in any of the above method embodiments are implemented. The storage medium may include: a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and other media that can store program codes.

[0145] Optionally, the specific examples in this embodiment may refer to the examples described in the above embodiments, and this embodiment will not be described in detail here.

[0146] It should be understood that the terms used herein are only for the purpose of describing specific example embodiments and are not intended to be limiting. Unless the context clearly indicates otherwise, the singular forms "one", "an" and "said" as used herein may also be meant to include plural forms. The terms "include", "comprise", "contain", and "have" are inclusive, and therefore specify the existence of stated features, steps, operations, elements and / or parts, but do not exclude the existence or addition of one or more other features, steps, operations, elements, parts, and / or combinations thereof. The method steps, processes, and operations described herein are not interpreted as necessarily requiring them to be performed in the specific order described or illustrated, unless the execution order is clearly indicated. It should also be understood that additional or alternative steps may be used.

[0147] The foregoing is merely a specific embodiment of the present invention, which enables those skilled in the art to understand or implement the present invention. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention will not be limited to the embodiments shown herein, but rather to the widest scope consistent with the principles and novel features claimed herein.

Claims

1. A communication method between a software base and a trusted firmware simulator, characterized in that: The communication method is applied to a software base, and the communication method comprises: Receive a first command sent by a client; the first command carries target data; storing the target data into a shared memory; Sending a second command to the trusted firmware simulator through netlink; the second command includes data storage information, so that the trusted firmware simulator obtains the target data from the shared memory through the data storage information, and stores the operation result of the target data in the shared memory; Receiving a netlink interrupt signal sent by the trusted firmware simulator; The operation result is obtained from the shared memory according to the interrupt signal, and the operation result is sent to the client.

2. The communication method according to claim 1, characterized in that: Storing the target data in a shared memory includes: Calculate the signature value of the target data by a cryptographic algorithm; Encapsulating the target data and the signature value to obtain encapsulated target data; The encapsulated target data is stored in a shared memory.

3. The communication method according to claim 1, characterized in that: After receiving the first command sent by the client, the method further includes: Request data storage information from the shared memory; the data storage information includes the target data storage address information and the reply data storage address information.

4. The communication method according to any one of claims 1 to 3, characterized in that: After sending the second command to the trusted firmware emulator via netlink, it also includes: Detecting whether the trusted firmware simulator successfully receives the target data; If yes, then add the relevant information of the target process to the process linked list, and set the target process to sleep state; Among them, the relevant information includes: a serial number, the data storage information and a process identification number of the target process; the target process is used to execute the following steps: receive a first command sent by the client, store the target data in a shared memory, and send a second command to a trusted firmware simulator via netlink.

5. The communication method according to claim 4, characterized in that: After receiving the netlink interrupt signal sent by the trusted firmware simulator, the method further includes: Using the sequence number carried by the netlink interrupt signal, searching the corresponding process identification number from the process linked list; Wake up the corresponding target process according to the found process identification number.

6. The communication method according to claim 5, characterized in that: Acquiring the operation result from the shared memory according to the interrupt signal, and sending the operation result to the client, comprising: The corresponding operation result is obtained from the shared memory through the awakened target process and the sequence number carried by the netlink interrupt signal, and the operation result is sent to the client.

7. The communication method according to claim 4, characterized in that: Detecting whether the trusted firmware simulator successfully receives the target data includes: Obtaining a value of a flag bit of a target data segment in a shared memory; wherein the target data segment is a data segment storing the target data; Determining whether the value of the flag bit is a predetermined value; If yes, it is determined that the trusted firmware simulator successfully receives the target data; if no, it is determined that the trusted firmware simulator fails to successfully receive the target data.

8. A communication device between a software base and a trusted firmware simulator, characterized in that: The communication device is applied to a software base, and the communication device comprises: A first receiving module, configured to receive a first command sent by a client; the first command carries target data; A storage module, used for storing the target data in a shared memory; A first sending module is used to send a second command to the trusted firmware simulator through netlink; the second command includes data storage information, so that the trusted firmware simulator obtains the target data from the shared memory through the data storage information, and stores the operation result of the target data in the shared memory; A second receiving module is used to receive a netlink interrupt signal sent by the trusted firmware simulator; An acquisition module, used for acquiring the operation result from the shared memory according to the interrupt signal; The second sending module is used to send the operation result to the client.

9. An electronic device, characterized in that: include: A processor, a memory, and a computer program stored in the memory and executable on the processor, wherein the processor executes the steps of the communication method described in any one of claims 1 to 7 of the present application through the computer program.

10. A computer storage medium, characterized in that: The computer storage medium stores computer executable instructions, and the computer executable instructions are used to execute the steps of the communication method described in any one of claims 1 to 7 of the present application.

Images