Chip, data processing method and device, electronic equipment and storage medium

Abstract

The invention provides a chip, a data processing method and device, electronic equipment, a chip and a storage medium, and relates to the technical field of data processing.The chip comprises a first execution environment and a hardware engine which communicate with each other, and the hardware engine is used for obtaining a packaging root key and derived components associated with all services from the first execution environment and sending the derived components to the first execution environment; performing key derivation according to the encapsulation root key and the derived component associated with each service to obtain an encapsulation service key of each service; wherein the packaging root key is obtained by packaging a device root key of the electronic device running the chip; and the first execution environment is used for acquiring the encapsulated service key from the hardware engine so as to execute encryption and decryption operation on the service data associated with each service based on the encapsulated service key. Therefore, the security of the secret key (the device root secret key and the service use secret key) can be improved, and the use of the secret key in a plaintext form is avoided, so that the secret key is prevented from being illegally stolen by an attacker, and the overall security of the service data is further improved.

Description

Technical Field

[0001] The present application relates to the field of data processing technology, and in particular to a chip, a data processing method, a device, an electronic device and a storage medium. Background Art

[0002] In the field of information security technology, especially in the process of transmitting, storing and processing sensitive data, the security of the key used to encrypt and decrypt sensitive data is of great importance. The key management method in the related technology is to store the key directly in the device memory.

[0003] Although this key management method is simple and convenient, it has serious security risks. Once the device is attacked, the attacker can easily steal the key stored in the device memory, resulting in the leakage of sensitive data. Summary of the invention

[0004] The present application aims to solve one of the technical problems in the related art at least to some extent.

[0005] To this end, the present application proposes a chip, a data processing method, an apparatus, an electronic device and a storage medium to improve the security of keys, avoid using keys in plain text, thereby preventing keys from being illegally stolen by attackers, and thereby improving the overall security of business data.

[0006] In one aspect, an embodiment of the present application provides a chip, a first execution environment and a hardware engine communicating with each other, wherein:

[0007] The hardware engine is used to obtain an encapsulation root key and at least one derived component associated with a service from the first execution environment, and perform key derivation according to the encapsulation root key and the derived components associated with each service to obtain an encapsulation service key for each service; wherein the encapsulation root key is obtained by encapsulating a device root key of an electronic device running the chip;

[0008] The first execution environment is used to obtain the encapsulation service key from the hardware engine, so as to perform encryption and decryption operations on the service data associated with each of the services based on the encapsulation service key.

[0009] Another aspect of the present application is to provide a data processing method, which is applied to a hardware engine and includes:

[0010] Acquire an encapsulation root key and at least one service-associated derived component from a first execution environment; wherein the encapsulation root key is obtained by encapsulating a device root key of an electronic device running the chip;

[0011] Key derivation is performed according to the encapsulation root key and the derived components associated with each of the services to obtain an encapsulation service key for each of the services; wherein the encapsulation service key is used to perform encryption and decryption operations on the service data associated with the service.

[0012] In another aspect, an embodiment of the present application provides a data processing device, which is applied to a hardware engine, including:

[0013] An acquisition module, configured to acquire an encapsulation root key and at least one service-associated derived component from a first execution environment; wherein the encapsulation root key is obtained by encapsulating a device root key of an electronic device running the chip;

[0014] The derivation module is used to derive a key according to the encapsulation root key and the derived components associated with each of the services to obtain an encapsulation service key for each of the services; wherein the encapsulation service key is used to perform encryption and decryption operations on the service data associated with the service.

[0015] In another aspect, an embodiment of the present application provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the data processing method as described in the aforementioned another aspect is implemented.

[0016] In yet another aspect of the present application, an embodiment provides a non-temporary computer-readable storage medium having computer program instructions stored thereon, wherein the computer program instructions, when executed by a processor, implement the data processing method as described in the aforementioned another aspect.

[0017] In yet another aspect of the present application, a computer program product is provided, on which a computer program is stored, and when the program is executed by a processor, the data processing method as described in the aforementioned another aspect is implemented.

[0018] The chip, data processing method, apparatus, electronic device and storage medium proposed in the present application encapsulate the device root key to obtain the encapsulated root key, and derive keys based on the encapsulated root key and derived components associated with different businesses to obtain encapsulated business keys for different businesses (i.e., encapsulated business keys). By using the encapsulated business keys of different businesses, business data associated with different businesses are encrypted and decrypted, which can improve the security of keys (device root keys and business usage keys), avoid using keys in plain text, thereby preventing the keys from being illegally stolen by attackers, and further improving the overall security of business data. Moreover, using only one hardware engine to derive encapsulation business keys for different businesses in batches based on the encapsulation root key and derived components associated with different businesses has at least the following multiple advantages: 1. Avoiding key reuse: ensuring that different business scenarios use different keys to prevent key leakage of one business from affecting the security of other businesses; 2. Reducing deployment costs: using a single hardware engine for key derivation reduces the demand for hardware resources, thereby reducing the deployment and maintenance costs of the chip; 3. Improving key security: using the hardware engine for key derivation can significantly improve the key security of the first execution environment (such as the low security domain) to a higher security level; 4. The encapsulation business keys of different businesses are in non-plaintext form for the first execution environment, which can improve the security of different businesses.

[0019] Additional aspects and advantages of the present application will be given in part in the description below, and in part will become apparent from the description below, or will be learned through the practice of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] The above and / or additional aspects and advantages of the present application will become apparent and easily understood from the following description of the embodiments in conjunction with the accompanying drawings, in which:

[0021] Figure 1 A schematic diagram of the structure of the first chip provided in the embodiment of the present application;

[0022] Figure 2 A schematic diagram of the structure of the second chip provided in the embodiment of the present application;

[0023] Figure 3 A schematic diagram of the structure of the third chip and the key derivation process provided in the embodiment of the present application;

[0024] Figure 4 A schematic diagram of the structure and encryption and decryption process of the fourth chip provided in the embodiment of the present application;

[0025] Figure 5 A flowchart of a data processing method provided in an embodiment of the present application;

[0026] Figure 6 A schematic diagram of the structure of a data processing device provided in an embodiment of the present application;

[0027] Figure 7 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0028] The embodiments of the present application are described in detail below, and examples of the embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are intended to be used to explain the present application, and should not be construed as limiting the present application.

[0029] In the fields of information security technology, cryptography technology, high-security environment technology, etc., especially in the transmission, storage and processing of sensitive data, the security of the keys used to encrypt and decrypt sensitive data is of vital importance. The traditional key management method usually stores the keys directly in the device memory. Although this method is simple and convenient, it has serious security risks. Once the device is attacked, the attacker can easily steal the keys stored in the device memory, resulting in the leakage of sensitive data.

[0030] In the field of cryptography, a common solution is to use an encryption algorithm to encapsulate the key, so that even if the device is attacked, the attacker cannot directly obtain the real key, thereby protecting the security of sensitive data. However, in actual applications, this method often needs to be performed in a high-security execution environment, which to some extent limits its scope of application.

[0031] In the related technology, the following steps can be adopted to ensure that the key plaintext does not leave the hardware at all and achieve hardware-level security:

[0032] 1. Read the root key from the analog output (AO) register through the first hardware engine deployed in the Trusted Execution Environment (TEE) or the Secure Element Environment (SEE), and encrypt the key plaintext with the root key to obtain the key ciphertext;

[0033] 2. Through the second hardware engine deployed in the Rich Execution Environment (REE), the root key is read from the AO register, and the key ciphertext is obtained from the first hardware engine. The root key is used to decrypt the key ciphertext to obtain the key plaintext, and the key plaintext is used to encrypt and decrypt sensitive data.

[0034] Among them, the security of REE is lower than that of TEE, and the security of TEE is lower than that of SEE.

[0035] Among them, the AO register is hard-wired to the first hardware engine and the second hardware engine, and the AO register is not readable by software. The root key is written only once when the system is initialized, which can increase the difficulty of cracking the key ciphertext. In addition, the decrypted key plaintext can be used in REE to encrypt and decrypt sensitive data of the application without switching the operating environment, which can improve the data encryption and decryption performance.

[0036] However, the above solution has at least the following problems:

[0037] 1) High deployment cost: When using AO registers as a shared key method for high security domains or low security domains, two hardware engines must be deployed, which results in high deployment cost;

[0038] 2) Business use is not flexible enough: the protected key plaintext is only used for data encryption and decryption. If a new key plaintext needs to be generated, it needs to be processed by the first hardware engine with higher security, which has low performance and flexibility.

[0039] In response to at least one problem existing in the above-mentioned related technologies, the present application further proposes a chip, a data processing method, a device, an electronic device and a storage medium.

[0040] The following describes the chip, data processing method, device, electronic device and storage medium of the embodiments of the present application with reference to the accompanying drawings.

[0041] Figure 1 A schematic diagram of the structure of the first chip provided in an embodiment of the present application.

[0042] In any embodiment of the present application, Figure 1 The chip 10 can be integrated into electronic devices such as mobile terminals, tablet computers, personal computers, and Internet of Things (IoT) devices.

[0043] The mobile terminal includes, for example, vehicle-mounted equipment, mobile phones, watches, wearable devices, personal digital assistants and other hardware devices with various operating systems.

[0044] like Figure 1 As shown, the chip 10 includes a first execution environment 101 and a hardware engine 102 that communicate with each other.

[0045] The hardware engine 102 is used to obtain an encapsulation root key and at least one service-related derived component from the first execution environment 101, and perform key derivation according to the encapsulation root key and the derived components associated with each service to obtain an encapsulation service key for each service.

[0046] The encapsulation root key is obtained by encapsulating the device root key (rootkey, abbreviated as rk) associated with the electronic device running the chip.

[0047] The services include but are not limited to: file encryption and decryption services, video encryption and decryption services, etc.

[0048] Among them, the derived components (DeriveData) associated with different businesses are different, and the derived components should contain sufficient information to distinguish different business scenarios. Exemplarily, the derived components associated with each business include but are not limited to: the business identifier, user identifier, random number, process identifier, etc. of the business, wherein the process identifier is used to indicate the process that triggers the encryption and decryption operations.

[0049] It should be noted that when one operating system is running in an electronic device, the user identifiers (such as user IDs) in the derived components associated with multiple services may be the same, while when multiple operating systems are running in the electronic device (i.e., a multi-user scenario), the user identifiers in the derived components associated with multiple services may be different.

[0050] Among them, the first execution environment 101 can be a low-security execution environment (or called a low security domain), or the first execution environment 101 can also be a high-security execution environment (or called a high security domain), and the embodiments of the present application do not limit this.

[0051] Exemplarily, when the first execution environment 101 is a high security domain, the encapsulation root key may be obtained by encapsulating the device root key through the first execution environment 101 .

[0052] Exemplarily, when the first execution environment 101 is a low security domain, the encapsulation root key may be obtained by encapsulating the device root key in other high security execution environments to improve the security of the device root key.

[0053] In an embodiment of the present application, the hardware engine 102 can obtain an encapsulation root key and a derived component associated with at least one business from the first execution environment 101, and use a key derivation function (KDF) to derive a key based on the encapsulation root key and the derived components associated with each business to obtain an encapsulation business key for each business (i.e., a business usage key after encapsulation).

[0054] The first execution environment 101 is used to obtain the encapsulation service key from the hardware engine 102, so as to perform encryption and decryption operations on the service data associated with each service based on the encapsulation service key.

[0055] In the embodiment of the present application, the first execution environment 101 may obtain the encapsulation service key of each service from the hardware engine 102 to perform encryption and decryption operations on the service data associated with each service based on the encapsulation service key of each service.

[0056] Exemplarily, when the business data associated with a certain business is plaintext data, the encapsulation business key of the business can be used to perform encryption operations on the business data associated with the business; and when the business data associated with the business is ciphertext data, the encapsulation business key of the business can be used to perform decryption operations on the business data associated with the business.

[0057] In the chip 10 of the embodiment of the present application, the device root key is encapsulated to obtain the encapsulated root key, and the key is derived based on the encapsulated root key and the derived components associated with different services to obtain the encapsulated business keys of different services (i.e., the encapsulated business keys). By using the encapsulated business keys of different services, the business data associated with different businesses are encrypted and decrypted, which can improve the security of the keys (device root keys and business usage keys), avoid the use of keys in plain text, thereby preventing the keys from being illegally stolen by attackers, and further improving the overall security of business data. Moreover, only one hardware engine 102 is used to derive encapsulation business keys for different businesses in batches according to the encapsulation root key and derived components associated with different businesses, which has at least the following multiple advantages: 1. Avoiding key reuse: ensuring that different business scenarios use different keys to prevent the key leakage of one business from affecting the security of other businesses; 2. Reducing deployment costs: using a single hardware engine for key derivation reduces the demand for hardware resources, thereby reducing the deployment and maintenance costs of the chip; 3. Improving key security: using the hardware engine 102 for key derivation can significantly improve the key security of the first execution environment (such as a low security domain) to achieve a higher security level; 4. The encapsulation business keys of different businesses are in non-plaintext form for the first execution environment, which can improve the security of different businesses.

[0058] The present application embodiment provides another chip, Figure 2 A schematic diagram of the structure of the second chip provided in an embodiment of the present application.

[0059] like Figure 2 As shown, the chip 10 includes a first execution environment 101, a hardware engine 102 and a second execution environment 103 that communicate with each other.

[0060] The second execution environment 103 is used to generate a packaging key, and use the packaging key to package the device root key of the electronic device running the chip to obtain the packaging root key, and store the packaging key in the hardware engine 102.

[0061] The second execution environment 103 and the first execution environment 101 are two different execution environments. Exemplarily, in order to improve the security of the key, the security of the second execution environment 103 can be higher than the set security threshold, and the security of the first execution environment 101 can be lower than the set security threshold, that is, the second execution environment 103 can be a high security domain, and the first execution environment 101 can be a low security domain.

[0062] In an embodiment of the present application, when the electronic device is powered on and initialized, the second execution environment 103 can use a random number to generate a wrapping key (wrapping_key), and use the wrapping key (wrapping_key) to wrap the device root key (rootkey) associated with the electronic device running the chip to obtain the wrapped device root key, which is referred to as the wrapping root key (wrapped_rootkey, abbreviated as wrapped_rk) in this application.

[0063] Furthermore, the second execution environment 103 may also store the encapsulation key in the hardware engine 103. As a possible implementation, in order to improve the security of the encapsulation key and prevent the encapsulation key from being illegally stolen by an attacker, which may cause the encapsulation root key to be cracked by the attacker, the second execution environment 103 may write the encapsulation key into a target register in the hardware engine 102; wherein the first execution environment 101 does not have access rights to the target register.

[0064] Exemplarily, the target register may be a class A register.

[0065] The first execution environment 101 is used to obtain an encapsulation root key from the second execution environment 103 , and transmit the encapsulation root key and at least one service-related derived component to the hardware engine 102 .

[0066] It should be noted that the explanations of different services and derived components in the aforementioned embodiments are also applicable to this embodiment and will not be elaborated herein.

[0067] In any embodiment of the present application, in order to improve the security and reliability of transmitted data, the first execution environment 101 can obtain the encapsulation root key from the second execution environment 103 through channels such as inter-process communication (IPC), and obtain the derived components associated with each business, and pass the encapsulation root key and the derived components associated with each business to the hardware engine 102.

[0068] The hardware engine 102 is used to derive a key according to the encapsulation root key and the derived components associated with each service, so as to obtain an encapsulation service key of each service.

[0069] It should be noted that the explanation of the hardware engine 102 in the aforementioned embodiment is also applicable to this embodiment and will not be repeated here.

[0070] In any embodiment of the present application, the hardware engine 102 can read the encapsulation key. For example, the hardware engine 102 can read the encapsulation key from the target register and use the encapsulation key to decapsulate the encapsulation root key to obtain the device root key, thereby combining the device root key, the derived components associated with each business, and the encapsulation key to generate the encapsulation business key of each business.

[0071] As an example, the hardware engine 102 can use a key derivation function (KDF) to derive keys based on the device root key and the derived components associated with each business to obtain the business usage key of each business, and use an encapsulation key to encapsulate the business usage key of each business to obtain the encapsulated business key of each business.

[0072] In any embodiment of the present application, the hardware engine 102 can be deployed in the first execution environment 101. For example, when the first execution environment 101 is a low security domain, key derivation can be implemented in the low security domain, that is, business usage keys of multiple different services are derived in the low security domain, and the business usage keys of multiple different services are encapsulated to obtain encapsulated business keys of multiple different services, without having to jump to the high security domain every time to generate and encapsulate keys for different services as in the related technology, and obtain encapsulated business keys for multiple different services, which can improve the flexibility of business use. In addition, the hardware engine 102 only needs to be deployed in the first execution environment 101 (such as a low security domain), and the deployment cost is low.

[0073] The first execution environment 101 is further used to obtain the encapsulation service key from the hardware engine 102, so as to perform encryption and decryption operations on the service data associated with each service based on the encapsulation service key.

[0074] It should be noted that the explanation of the first execution environment 101 in the aforementioned embodiment is also applicable to this embodiment and will not be repeated here.

[0075] In any embodiment of the present application, after obtaining the encapsulation service key of each service from the hardware engine 102, the first execution environment 101 can trigger the encryption and decryption process of the service data associated with each service based on the encapsulation service key of each service.

[0076] As a possible implementation method, after obtaining the business data associated with the target business in each business, the first execution engine 101 can send the encapsulation business key of the target business and the business data associated with the target business to the hardware engine 102. Accordingly, after receiving the encapsulation business key of the target business and the business data associated with the target business, the hardware engine 102 can perform encryption and decryption operations on the business data associated with the target business based on the encapsulation business key of the target business, obtain the target data, and send the target data to the first execution environment 101. Accordingly, the first execution environment 101 can receive the target data returned by the hardware engine 102.

[0077] Exemplarily, when the business data associated with the target business is in plain text form, the hardware engine 102 can perform an encryption operation on the business data associated with the target business based on the encapsulation business key of the target business to obtain the target data; and when the business data associated with the target business is in non-plain text form, the hardware engine 102 can perform a decryption operation on the business data associated with the target business based on the encapsulation business key of the target business to obtain the target data.

[0078] As an example, the encryption and decryption process of business data is as follows: the hardware engine 102 can read the encapsulation key, for example, the hardware engine 102 can read the encapsulation key from the target register, and use the encapsulation key to decapsulate the encapsulated business key of the target business to obtain the business usage key of the target business. After that, based on the business usage key of the target business, encryption and decryption operations can be performed on the business data associated with the target business to obtain the target data.

[0079] Exemplarily, when the business data associated with the target business is in plain text form, the hardware engine 102 can perform an encryption operation on the business data associated with the target business based on the business usage key of the target business to obtain the target data; and when the business data associated with the target business is in non-plain text form, the hardware engine 102 can perform a decryption operation on the business data associated with the target business based on the business usage key of the target business to obtain the target data.

[0080] In any embodiment of the present application, in order to isolate risks and reduce the attack surface, different services may use different encryption and decryption algorithms in addition to using different service usage keys to increase the difficulty of cracking by attackers. That is, in the present application, when the hardware engine 102 performs encryption and decryption operations on the service data associated with the target service, it may select a target encryption and decryption algorithm adapted to the target service from at least one candidate encryption and decryption algorithm, and use the target encryption and decryption algorithm to perform encryption and decryption operations on the service data of the target service based on the service usage key of the target service to obtain the target data.

[0081] Exemplarily, when the business data associated with the target business is in plain text form, the hardware engine 102 may select an encryption algorithm adapted to the target business, and adopt the encryption algorithm to perform encryption operations on the business data associated with the target business based on the business usage key of the target business, so as to obtain the target data; and when the business data associated with the target business is in non-plain text form, the hardware engine 102 selects a decryption algorithm adapted to the target business, and adopts the decryption algorithm to perform decryption operations on the business data associated with the target business based on the business usage key of the target business, so as to obtain the target data.

[0082] Therefore, using different keys and encryption and decryption algorithms for different businesses can significantly improve the security, flexibility and performance of the system. It can not only isolate risks and reduce the attack surface, but also better adapt to new threats and regulatory requirements.

[0083] In summary, in the chip 10 of the embodiment of the present application, the key register (referred to as the target register in the present application) in the first execution environment 101 (such as the low security domain) only allows the second execution environment 103 (such as the high security domain) to share the key in a configuration mode, and it is only necessary to deploy the hardware engine 102 in the first execution environment 101 (such as the low security domain), and the deployment cost is low. In addition, key derivation can be achieved in the first execution environment 101 (such as the low security domain), and different keys of multiple services do not need to jump to the second execution environment 103 (such as the high security domain) every time to generate and encapsulate, which can achieve while ensuring the security of the key, while improving the service performance and flexibility. That is, in the first execution environment 101 (such as the low security domain), the service use key that is still in the encapsulated state is derived based on the encapsulated device root key, and the entire process is invisible to the software, and there is no need to jump to the second execution environment 103 (such as the high security domain) for encapsulation, which enhances the application performance and flexibility.

[0084] As an example, the first execution environment is a low security domain and the second execution environment is a high security domain. In order to solve the technical problem of "high deployment cost" in the related technology, in this application, the key register of the low security domain can be used to share the key in a way that only the high security domain configuration is allowed. Only the hardware engine needs to be deployed in the low security domain, and the deployment cost is low. In the high security domain, the wrapping key (wrapping_key) readable by the central processing unit (CPU) is used to wrap the device root key, and then the wrapping_key is configured in the register that is not readable by the low security domain CPU.

[0085] In order to solve the technical problems of "lack of flexibility in business use and unoptimized performance" in related technologies, in this application, key derivation can be performed in the low security domain, and different business use keys of multiple businesses do not need to jump to the high security domain for encapsulation every time. In addition, the business use key that is still in the encapsulated state is derived in the low security domain based on the encapsulated device root key. The entire process is invisible to the software, and there is no need to jump to the high security domain for encapsulation, which enhances the application performance and flexibility.

[0086] The chip provided by the present application has at least the following advantages: improving the key security of the low security domain and protecting the user's sensitive data; encrypting and protecting the business data or sensitive data of different businesses in the low security domain and then storing or transmitting them can improve the security of the data; using different business usage keys in different business scenarios can avoid the leakage of the business usage key of one business affecting other businesses (contagiousness); different businesses have different security requirements, and the key usage scenarios can include: REE->TEE->SEE, etc. (security from low to high) under multiple operating systems (OperatingSystem, referred to as OS for short); improving the key security of the low security domain so that it can reach a higher security level.

[0087] As an example, the chip provided in this application mainly includes the following parts:

[0088] Part 1: Second execution environment (such as high security domain).

[0089] When the system is powered on and initialized, first, a wrapping key (wrapping_key) is generated using a random number, and then the device root key (rootkey) is wrapped using wrapping_key to obtain a wrapped root key (wrapped_rootkey, abbreviated as wrapped_rk). After that, wrapping_key is configured to the target register wrapping_key_reg that is unreadable by the first execution environment (such as the low security domain).

[0090] Part 2: The first execution environment (such as the low security domain).

[0091] 1. Obtain the wrapped root key (wrapped_rootkey, referred to as wrapped_rk) from the second execution environment (such as the high security domain) through channels such as IPC;

[0092] 2. Use the wrapping root key to derive the wrapping service key (wrapped_userkey, abbreviated as wrapped_uk) of each service;

[0093] Exemplarily, the key derivation process may be as follows: Figure 3As shown, it includes: the first execution environment (such as the low security domain) inputs the wrapped root key wrapped_rk and the derived components (DeriveData) associated with different services to the hardware engine, the hardware engine reads the wrapping key (wrapping_key) from the target register (such as a class A register, which is not readable by the CPU), uses the wrapping key to decapsulate the wrapped root key to obtain the device root key (rootkey), derives the key according to the device root key and the derived components (DeriveData) associated with different services, obtains the service usage keys (userkey) of different services, and uses the wrapping key to wrap the service usage keys of different services to obtain the wrapped service keys (wrapped_userkey, referred to as wrapped_uk) of different services. In the whole process, the first execution environment (such as the low security domain) sees the wrapped keys, which ensures the security of the keys.

[0094] 3. Enter the wrapped service key (wrapped_userkey) of each service, select the encryption and decryption algorithm, such as Advanced Encryption Standard-Cipher Block Chaining Mode (AES-CBC, a symmetric encryption algorithm), etc., and perform encryption and decryption operations on the service data associated with each service.

[0095] For example, the encryption and decryption process can be as follows: Figure 4 As shown, it includes: taking the encryption of the plaintext data of the target business as an example, the first execution environment (such as the low security domain) inputs the encapsulated business key (wrapped_uk) + plaintext data (PlainData) of the target business into the hardware engine, and the hardware engine reads the encapsulation key (wrapping_key) from the target register (such as a class A register, which is not readable by the CPU), and uses the encapsulation key to decapsulate the encapsulated business key of the target business to obtain the business usage key (userkey) of the target business, and uses the business usage key of the target business to encrypt the plaintext data (PlainData) to obtain the ciphertext data (CipherData). In the whole process, the first execution environment (such as the low security domain) sees the encapsulated key, which ensures the security of the key.

[0096] In summary, the key register of the first execution environment (such as the low security domain) only allows the second execution environment (such as the high security domain) to share the key in a configuration manner. It is only necessary to deploy the hardware engine in the first execution environment (such as the low security domain), and the deployment cost is relatively low. In the second execution environment (such as the high security domain), the device root key is encapsulated using the wrapping key (wrapping_key) readable by the CPU, and then the wrapping key (wrapping_key) is configured in the register that is not readable by the CPU of the first execution environment (such as the low security domain). In addition, in the first execution environment (such as the low security domain), the business use key that is still in the encapsulated state is derived based on the encapsulated key. The entire process is invisible to the software, and there is no need to jump to the second execution environment (such as the high security domain) for encapsulation, which enhances application performance and flexibility.

[0097] Figure 5 A flowchart of the first data processing method provided in an embodiment of the present application.

[0098] The data processing method of the embodiment of the present application can be applied to a hardware engine in a chip, wherein the chip can be run in any electronic device, or the chip can be integrated into any electronic device.

[0099] Among them, the electronic devices can be mobile terminals, Internet of Things (IoT) devices, etc. Mobile terminals are, for example, vehicle-mounted devices, mobile phones, watches, wearable devices, tablet computers, personal digital assistants and other hardware devices with various operating systems.

[0100] It should be noted that the data processing method can be executed alone, or it can be executed in combination with any embodiment of the present application or a possible implementation method in the embodiment, or it can be executed in combination with any technical solution in the relevant technology, and the embodiments of the present application are not limited to this.

[0101] like Figure 5 As shown, the data processing method may include the following steps S501 to S502:

[0102] Step S501: obtaining an encapsulation root key and at least one service-related derived component from a first execution environment; wherein the encapsulation root key is obtained by encapsulating a device root key of an electronic device running a chip.

[0103] Step S502: derive a key based on the encapsulation root key and the derived components associated with each service to obtain an encapsulation service key for each service; wherein the encapsulation service key is used to perform encryption and decryption operations on service data associated with the service.

[0104] In any embodiment of the present application, the encapsulation root key is obtained by the first execution environment from the second execution environment, and the encapsulation root key is generated by the second execution environment using the following method: generating an encapsulation key, and using the encapsulation key to encapsulate the device root key to obtain the encapsulation root key, and storing the encapsulation key in the hardware engine.

[0105] In any embodiment of the present application, the second execution environment may write the encapsulation key into a target register in the hardware engine; wherein the first execution environment does not have access rights to the target register.

[0106] In any embodiment of the present application, the security of the first execution environment is lower than a set security threshold, and the security of the second execution environment is higher than the set security threshold.

[0107] In any embodiment of the present application, the hardware engine executes a key derivation process, for example: reading an encapsulation key; decapsulating an encapsulation root key using the encapsulation key to obtain a device root key; and generating an encapsulation service key for each service based on the device root key, the derived components associated with each service, and the encapsulation key.

[0108] In any one of the embodiments of the present application, the hardware engine executes a key derivation process, for example: deriving keys based on a device root key and derived components associated with each service to obtain a service usage key for each service; and encapsulating the service usage key for each service using an encapsulation key to obtain an encapsulated service key for at least one service.

[0109] In any embodiment of the present application, the hardware engine may further perform the following steps: sending the encapsulation business key of each business to the first execution environment for storage; receiving the encapsulation business key and business data associated with the target business sent by the first execution environment; performing encryption and decryption operations on the business data associated with the target business based on the encapsulation business key of the target business to obtain the target data; and sending the target data to the first execution environment.

[0110] In any embodiment of the present application, the hardware engine performs encryption and decryption operations, for example: reading an encapsulation key; using the encapsulation key to decapsulate the encapsulation business key of the target business to obtain a business usage key of the target business; based on the business usage key of the target business, performing encryption and decryption operations on business data associated with the target business to obtain target data.

[0111] In any one of the embodiments of the present application, the hardware engine performs an encryption and decryption operation process, for example: selecting a target encryption and decryption algorithm adapted to the target business from at least one candidate encryption and decryption algorithm; using the target encryption and decryption algorithm, based on the business key of the target business, performing encryption and decryption operations on business data associated with the target business to obtain target data.

[0112] In any one of the embodiments of the present application, the hardware engine is deployed in a first execution environment.

[0113] It should be noted that the explanation of the chip, hardware engine, first execution environment and second execution environment in any of the foregoing embodiments is also applicable to the data processing method executed by the hardware engine in this embodiment, and the implementation principles are similar and will not be repeated here.

[0114] The data processing method of the embodiment of the present application encapsulates the device root key to obtain the encapsulated root key, and derives the key based on the encapsulated root key and the derived components associated with different businesses to obtain the encapsulated business keys of different businesses (i.e., the encapsulated business usage keys). By using the encapsulated business keys of different businesses, the business data associated with different businesses are encrypted and decrypted, which can improve the security of the keys (device root keys and business usage keys), avoid the use of keys in plain text, thereby preventing the keys from being illegally stolen by attackers, and further improving the overall security of business data. Moreover, using only one hardware engine to derive encapsulation business keys for different businesses in batches based on the encapsulation root key and derived components associated with different businesses has at least the following multiple advantages: 1. Avoiding key reuse: ensuring that different business scenarios use different keys to prevent key leakage of one business from affecting the security of other businesses; 2. Reducing deployment costs: using a single hardware engine for key derivation reduces the demand for hardware resources, thereby reducing the deployment and maintenance costs of the chip; 3. Improving key security: using the hardware engine for key derivation can significantly improve the key security of the first execution environment (such as the low security domain) to a higher security level; 4. The encapsulation business keys of different businesses are in non-plaintext form for the first execution environment, which can improve the security of different businesses.

[0115] In order to implement the above embodiment, the embodiment of the present application also proposes a data processing device.

[0116] Figure 6 A schematic diagram of the structure of a data processing device provided in an embodiment of the present application.

[0117] like Figure 6 As shown, the data processing device 600 can be applied to a hardware engine, and includes: an acquisition module 610 and a derivation module 620 .

[0118] The acquisition module 610 is used to obtain the encapsulation root key and at least one service-associated derived component from the first execution environment; wherein the encapsulation root key is obtained by encapsulating the device root key of the electronic device running the chip;

[0119] The derivation module 620 is used to derive a key according to the encapsulation root key and the derived components associated with each service, so as to obtain an encapsulation service key of each service; wherein the encapsulation service key is used to perform encryption and decryption operations on service data associated with the service.

[0120] Further, in an implementation of the embodiment of the present application, the encapsulation root key is obtained by the first execution environment from the second execution environment, and the encapsulation root key is generated by the second execution environment using the following modules:

[0121] A generation module, used for generating a wrapping key;

[0122] The processing module is used to use the encapsulation key to encapsulate the device root key, obtain the encapsulation root key, and store the encapsulation key in the hardware engine.

[0123] In one implementation of the embodiment of the present application, the processing module is specifically used to: write the encapsulation key into a target register in the hardware engine; wherein the first execution environment does not have access rights to the target register.

[0124] In one implementation of the embodiment of the present application, the security of the first execution environment is lower than a set security threshold, and the security of the second execution environment is higher than the set security threshold.

[0125] In one implementation of an embodiment of the present application, the derivation module 620 is specifically used to: read the encapsulation key; use the encapsulation key to decapsulate the encapsulation root key to obtain the device root key; generate the encapsulation business key of each business according to the device root key, the derived components associated with each business and the encapsulation key.

[0126] In one implementation of an embodiment of the present application, the derivation module 620 is specifically used to: derive keys based on the device root key and the derived components associated with each service to obtain a service usage key for each service; and use an encapsulation key to encapsulate the service usage key for each service to obtain an encapsulated service key for at least one service.

[0127] In an implementation of the embodiment of the present application, the data processing device 600 may further include:

[0128] A sending module, used to send the encapsulated service key of each service to the first execution environment for storage;

[0129] A receiving module, used for receiving an encapsulated service key and service data associated with a target service sent by the first execution environment;

[0130] An execution module, used to perform encryption and decryption operations on business data associated with the target business based on the encapsulation business key of the target business to obtain target data;

[0131] The sending module is also used to send target data to the first execution environment.

[0132] In one implementation of an embodiment of the present application, the execution module is specifically used to: read the encapsulation key; use the encapsulation key to decapsulate the encapsulation business key of the target business to obtain the business usage key of the target business; based on the business usage key of the target business, perform encryption and decryption operations on the business data associated with the target business to obtain the target data.

[0133] In one implementation of an embodiment of the present application, the execution module is specifically used to: select a target encryption and decryption algorithm adapted to the target business from at least one candidate encryption and decryption algorithm; use the target encryption and decryption algorithm to perform encryption and decryption operations on business data associated with the target business based on the business key of the target business to obtain target data.

[0134] In one implementation of the embodiment of the present application, the hardware engine is deployed in a first execution environment.

[0135] It should be noted that the above explanation of the data processing method embodiment is also applicable to the data processing device of this embodiment, and will not be repeated here.

[0136] In the data processing device of the embodiment of the present application, the device root key is encapsulated to obtain the encapsulated root key, and key derivation is performed based on the encapsulated root key and the derived components associated with different services to obtain the encapsulated business keys of different services (i.e., the encapsulated business usage keys). By using the encapsulated business keys of different services, the business data associated with different businesses are encrypted and decrypted, which can improve the security of the keys (device root keys and business usage keys), avoid the use of keys in plain text, thereby preventing the keys from being illegally stolen by attackers, and further improving the overall security of business data. Moreover, using only one hardware engine to derive encapsulation business keys for different businesses in batches based on the encapsulation root key and derived components associated with different businesses has at least the following multiple advantages: 1. Avoiding key reuse: ensuring that different business scenarios use different keys to prevent key leakage of one business from affecting the security of other businesses; 2. Reducing deployment costs: using a single hardware engine for key derivation reduces the demand for hardware resources, thereby reducing the deployment and maintenance costs of the chip; 3. Improving key security: using the hardware engine for key derivation can significantly improve the key security of the first execution environment (such as the low security domain) to a higher security level; 4. The encapsulation business keys of different businesses are in non-plaintext form for the first execution environment, which can improve the security of different businesses.

[0137] In order to implement the above embodiments, the present application also proposes an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the data processing method as described in any of the above embodiments is implemented.

[0138] Figure 7 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application. For example, the electronic device 700 may be a vehicle, a mobile phone, a computer, a digital broadcast terminal, a message transceiver device, a game console, a tablet device, a medical device, a fitness device, a personal digital assistant, etc.

[0139] Reference Figure 7 The electronic device 700 may include one or more of the following components: a processing component 702 , a memory 704 , a power component 706 , a multimedia component 708 , an audio component 710 , an input / output (I / O) interface 712 , a sensor component 714 , and a communication component 716 .

[0140] The processing component 702 generally controls the overall operation of the electronic device 700, such as operations associated with display, phone calls, data communications, camera operations, and recording operations. The processing component 702 may include one or more processors 720 to execute instructions to complete all or part of the steps of the above-mentioned method. In addition, the processing component 702 may include one or more modules to facilitate the interaction between the processing component 702 and other components. For example, the processing component 702 may include a multimedia module to facilitate the interaction between the multimedia component 708 and the processing component 702.

[0141] The memory 704 is configured to store various types of data to support operations on the electronic device 700. Examples of such data include instructions for any application or method operating on the electronic device 700, contact data, phone book data, messages, pictures, videos, etc. The memory 704 can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk or optical disk.

[0142] The power component 706 provides power to the various components of the electronic device 700. The power component 706 may include a power management system, one or more power supplies, and other components associated with generating, managing, and distributing power for the electronic device 700.

[0143] The multimedia component 708 includes a screen that provides an output interface between the electronic device 700 and the user. In some embodiments, the screen may include a liquid crystal display (LCD) and a touch panel (TP). If the screen includes a touch panel, the screen may be implemented as a touch screen to receive input signals from the user. The touch panel includes one or more touch sensors to sense touch, slide, and gestures on the touch panel. The touch sensor may not only sense the boundaries of the touch or slide action, but also detect the duration and pressure associated with the touch or slide operation. In some embodiments, the multimedia component 708 includes a front camera and / or a rear camera. When the electronic device 700 is in an operating mode, such as a shooting mode or a video mode, the front camera and / or the rear camera may receive external multimedia data. Each front camera and the rear camera may be a fixed optical lens system or have a focal length and optical zoom capability.

[0144] The audio component 710 is configured to output and / or input audio signals. For example, the audio component 710 includes a microphone (MIC), and when the electronic device 700 is in an operating mode, such as a call mode, a recording mode, and a voice recognition mode, the microphone is configured to receive an external audio signal. The received audio signal can be further stored in the memory 704 or sent via the communication component 716. In some embodiments, the audio component 710 also includes a speaker for outputting audio signals.

[0145] I / O interface 712 provides an interface between processing component 702 and peripheral interface modules, such as keyboards, click wheels, buttons, etc. These buttons may include but are not limited to: a home button, a volume button, a start button, and a lock button.

[0146] The sensor assembly 714 includes one or more sensors for providing various aspects of status assessment for the electronic device 700. For example, the sensor assembly 714 can detect the open / closed state of the electronic device 700, the relative positioning of the components, such as the display and keypad of the electronic device 700, and the sensor assembly 714 can also detect the position change of the electronic device 700 or a component of the electronic device 700, the presence or absence of contact between the user and the electronic device 700, the orientation or acceleration / deceleration of the electronic device 700, and the temperature change of the electronic device 700. The sensor assembly 714 may include a proximity sensor configured to detect the presence of nearby objects without any physical contact. The sensor assembly 714 may also include an optical sensor, such as a complementary metal oxide semiconductor (CMOS) or a charge coupled device (CCD) image sensor, for use in imaging applications. In some embodiments, the sensor assembly 714 may also include an acceleration sensor, a gyroscope sensor, a magnetic sensor, a pressure sensor, or a temperature sensor.

[0147] The communication component 716 is configured to facilitate wired or wireless communication between the electronic device 700 and other devices. The electronic device 700 can access a wireless network based on a communication standard, such as WiFi, 4G or 5G, or a combination thereof. In an exemplary embodiment, the communication component 716 receives a broadcast signal or broadcast-related information from an external broadcast management system via a broadcast channel. In an exemplary embodiment, the communication component 716 also includes a near field communication (NFC) module to facilitate short-range communication. For example, the NFC module can be based on radio frequency identification (RFID) technology, infrared data association (IrDA) technology, ultra-wideband (UWB) technology, Bluetooth (BT) technology and other technologies.

[0148] In an exemplary embodiment, the electronic device 700 may be implemented by one or more application-specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field-programmable gate arrays (FPGAs), controllers, microcontrollers, microprocessors or other electronic components to execute the above method.

[0149] In an exemplary embodiment, a non-transitory computer-readable storage medium including instructions is also provided, such as a memory 704 including instructions, and the instructions can be executed by a processor 720 of an electronic device 700 to complete the above method. For example, the non-transitory computer-readable storage medium can be a read-only memory (ROM), a random access memory (RAM), a compact disc (CD-ROM), a magnetic tape, a floppy disk, an optical data storage device, etc.

[0150] In order to implement the above embodiments, the present application also proposes a non-temporary computer-readable storage medium on which a computer program is stored. When the program is executed by a processor, the data processing method described in any of the above method embodiments is implemented.

[0151] In order to implement the above embodiments, the present application also proposes a computer program product, on which a computer program is stored. When the computer program is executed by a processor, the data processing method as described in any of the above method embodiments is implemented.

[0152] In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" etc. means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present application. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner. In addition, those skilled in the art may combine and combine the different embodiments or examples described in this specification and the features of the different embodiments or examples, without contradiction.

[0153] In addition, the terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Therefore, the features defined as "first" and "second" may explicitly or implicitly include at least one of the features. In the description of this application, the meaning of "plurality" is at least two, such as two, three, etc., unless otherwise clearly and specifically defined.

[0154] Any process or method description in a flowchart or otherwise described herein may be understood to represent a module, fragment or portion of code comprising one or more executable instructions for implementing the steps of a custom logical function or process, and the scope of the preferred embodiments of the present application includes alternative implementations in which functions may not be performed in the order shown or discussed, including performing functions in a substantially simultaneous manner or in the reverse order depending on the functions involved, which should be understood by technicians in the technical field to which the embodiments of the present application belong.

[0155] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as an ordered list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by an instruction execution system, device or apparatus (such as a computer-based system, a system including a processor, or other system that can fetch instructions from an instruction execution system, device or apparatus and execute instructions), or in conjunction with such instruction execution systems, devices or apparatuses. For the purposes of this specification, "computer-readable medium" can be any device that can contain, store, communicate, propagate or transmit a program for use by an instruction execution system, device or apparatus, or in conjunction with such instruction execution systems, devices or apparatuses. More specific examples of computer-readable media (a non-exhaustive list) include the following: an electrical connection with one or more wirings (electronic devices), a portable computer disk case (magnetic device), a random access memory (RAM), a read-only memory (ROM), an erasable and editable read-only memory (EPROM or flash memory), an optical fiber device, and a portable compact disc read-only memory (CDROM). In addition, the computer-readable medium may even be a paper or other suitable medium on which the program is printed, since the program may be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, deciphering or, if necessary, processing in another suitable manner, and then stored in a computer memory.

[0156] It should be understood that the various parts of the present application can be implemented by hardware, software, firmware or a combination thereof. In the above-mentioned embodiments, a plurality of steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented by hardware, as in another embodiment, it can be implemented by any one of the following technologies known in the art or their combination: a discrete logic circuit having a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA for short), a field programmable gate array (FPGA for short), etc.

[0157] A person skilled in the art may understand that all or part of the steps in the method for implementing the above-mentioned embodiment may be completed by instructing related hardware through a program, and the program may be stored in a computer-readable storage medium, which, when executed, includes one or a combination of the steps of the method embodiment.

[0158] In addition, each functional unit in each embodiment of the present application may be integrated into a processing module, or each unit may exist physically separately, or two or more units may be integrated into one module. The above-mentioned integrated module may be implemented in the form of hardware or in the form of a software functional module. If the integrated module is implemented in the form of a software functional module and sold or used as an independent product, it may also be stored in a computer-readable storage medium.

[0159] The storage medium mentioned above may be a read-only memory, a magnetic disk or an optical disk, etc. Although the embodiments of the present application have been shown and described above, it can be understood that the above embodiments are exemplary and cannot be understood as limiting the present application. A person of ordinary skill in the art may change, modify, replace and modify the above embodiments within the scope of the present application.

Claims

1. A chip, characterized in that: comprising a first execution environment and a hardware engine communicating with each other, wherein: The hardware engine is used to obtain an encapsulation root key and at least one derived component associated with a service from the first execution environment, and perform key derivation according to the encapsulation root key and the derived components associated with each service to obtain an encapsulation service key for each service; wherein the encapsulation root key is obtained by encapsulating a device root key of an electronic device running the chip; The first execution environment is used to obtain the encapsulation service key from the hardware engine, so as to perform encryption and decryption operations on the service data associated with each of the services based on the encapsulation service key.

2. The chip according to claim 1, characterized in that: The chip further includes a second execution environment communicating with the first execution environment and the hardware engine, the encapsulation root key is obtained by the first execution environment from the second execution environment, The second execution environment is used for: Generate a wrapping key, and use the wrapping key to wrap the device root key to obtain the wrapping root key; The wrapping key is stored in the hardware engine.

3. The chip according to claim 2, characterized in that: The second execution environment is specifically used for: The encapsulation key is written into a target register in the hardware engine; wherein the first execution environment does not have access rights to the target register.

4. The chip according to claim 2 or 3, characterized in that: The security of the first execution environment is lower than a set security threshold, and the security of the second execution environment is higher than the set security threshold.

5. The chip according to claim 2, characterized in that: The hardware engine is specifically used for: Reading the encapsulation key; Decapsulating the encapsulation root key using the encapsulation key to obtain the device root key; An encapsulation service key for each of the services is generated according to the device root key, the derived component associated with each of the services and the encapsulation key.

6. The chip according to claim 5, characterized in that: The hardware engine is specifically used for: Derivation of a key is performed according to the device root key and the derived components associated with each of the services to obtain a service usage key for each of the services; The encapsulation key is used to encapsulate the service usage key of each of the services to obtain the encapsulation service key of the at least one service.

7. The chip according to claim 1, characterized in that: The first execution environment is specifically used for: Acquire business data associated with a target business among the at least one business; Sending the encapsulated service key and service data associated with the target service to the hardware engine; Receiving target data returned by the hardware engine; The hardware engine is further used to: perform encryption and decryption operations on the business data associated with the target business based on the encapsulation business key of the target business, obtain the target data, and send the target data to the first execution environment.

8. The chip according to claim 7, characterized in that: The hardware engine is specifically used for: Reading the encapsulation key, and using the encapsulation key to decapsulate the encapsulated service key of the target service to obtain a service usage key of the target service; Based on the business usage key of the target business, encryption and decryption operations are performed on the business data associated with the target business to obtain the target data.

9. The chip according to claim 8, characterized in that: The hardware engine is specifically used for: Selecting a target encryption / decryption algorithm adapted to the target service from at least one candidate encryption / decryption algorithm; The target encryption and decryption algorithm is adopted, and based on the business usage key of the target business, encryption and decryption operations are performed on the business data associated with the target business to obtain the target data.

10. The chip according to claim 1, characterized in that: The hardware engine is deployed in the first execution environment.

11. A data processing method, characterized in that: Applied to a hardware engine, the method comprises: Acquire an encapsulation root key and at least one service-associated derived component from a first execution environment; wherein the encapsulation root key is obtained by encapsulating a device root key of an electronic device running the chip; Key derivation is performed according to the encapsulation root key and the derived components associated with each of the services to obtain an encapsulation service key for each of the services; wherein the encapsulation service key is used to perform encryption and decryption operations on the service data associated with the service.

12. The method according to claim 11, characterized in that The encapsulation root key is obtained by the first execution environment from the second execution environment, and the encapsulation root key is generated by the second execution environment using the following steps: Generate wrapping key; The device root key is encapsulated using the encapsulation key to obtain the encapsulation root key, and the encapsulation key is stored in the hardware engine.

13. The method according to claim 12, characterized in that The storing the encapsulation key to the hardware engine comprises: The encapsulation key is written into a target register in the hardware engine; wherein the first execution environment does not have access rights to the target register.

14. The method according to claim 12 or 13, characterized in that The security of the first execution environment is lower than a set security threshold, and the security of the second execution environment is higher than the set security threshold.

15. The method according to claim 12, characterized in that The step of performing key derivation according to the encapsulation root key and the derived components associated with each of the services to obtain an encapsulation service key for each of the services includes: Reading the encapsulation key; Decapsulating the encapsulation root key using the encapsulation key to obtain the device root key; An encapsulation service key for each of the services is generated according to the device root key, the derived component associated with each of the services and the encapsulation key.

16. The method according to claim 15, characterized in that The generating, according to the device root key, the derived components associated with each of the services and the encapsulation key, an encapsulation service key of each of the services comprises: Derivation of a key is performed according to the device root key and the derived components associated with each of the services to obtain a service usage key for each of the services; The encapsulation key is used to encapsulate the service usage key of each of the services to obtain the encapsulation service key of the at least one service.

17. The method according to claim 11, characterized in that The method further comprises: Sending the encapsulated service key of each of the services to the first execution environment for storage; Receiving an encapsulated service key and service data associated with a target service sent by the first execution environment; Based on the encapsulation service key of the target service, performing encryption and decryption operations on the service data associated with the target service to obtain the target data; The target data is sent to the first execution environment.

18. The method according to claim 17, characterized in that The encapsulation service key of the target service is used to perform encryption and decryption operations on the service data associated with the target service to obtain the target data, including: Read the wrapping key; Decapsulating the encapsulated service key of the target service using the encapsulation key to obtain a service usage key of the target service; Based on the business usage key of the target business, encryption and decryption operations are performed on the business data associated with the target business to obtain the target data.

19. The method according to claim 18, characterized in that The business use key based on the target business performs encryption and decryption operations on the business data associated with the target business to obtain the target data, including: Selecting a target encryption / decryption algorithm adapted to the target service from at least one candidate encryption / decryption algorithm; The target encryption and decryption algorithm is adopted, and based on the business key of the target business, encryption and decryption operations are performed on the business data associated with the target business to obtain the target data.

20. The method according to claim 11, characterized in that The hardware engine is deployed in the first execution environment.

21. A data processing device, characterized in that: Applied to hardware engines, including: An acquisition module, configured to acquire an encapsulation root key and at least one service-associated derived component from a first execution environment; wherein the encapsulation root key is obtained by encapsulating a device root key of an electronic device running the chip; The derivation module is used to derive a key according to the encapsulation root key and the derived components associated with each of the services to obtain an encapsulation service key for each of the services; wherein the encapsulation service key is used to perform encryption and decryption operations on the service data associated with the service.

22. An electronic device, characterized in that: The method comprises a memory, a processor and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the steps of the method according to any one of claims 11 to 20 are implemented.

23. A non-transitory computer-readable storage medium having computer program instructions stored thereon, characterized in that: When the program instructions are executed by a processor, the steps of the method described in any one of claims 11 to 20 are implemented.

24. A computer program product, characterized in that The invention comprises a computer program, which, when executed by a processor, implements the steps of the method according to any one of claims 11 to 20.

Images