Chips, data processing methods, devices, electronic devices and storage media

Abstract

This application discloses a chip, a data processing method, an apparatus, an electronic device, and a storage medium, relating to the field of data processing technology. The chip includes a first execution environment and a hardware engine that communicate with each other. The hardware engine is used to obtain an encapsulation root key and derived components associated with each service from the first execution environment, and to derive keys based on the encapsulation root key and the derived components associated with each service to obtain encapsulated service keys for each service. The encapsulation root key is obtained by encapsulating the device root key of the electronic device running the chip. The first execution environment is used to obtain the encapsulated service keys from the hardware engine and to perform encryption and decryption operations on service data associated with each service based on the encapsulated service keys. This improves the security of the keys (device root key and service usage key), avoids the use of plaintext keys, prevents keys from being illegally stolen by attackers, and thus improves the overall security of service data.

Description

Technical Field

[0001] This application relates to the field of data processing technology, and in particular to a chip, a data processing method, an apparatus, an electronic device, and a storage medium. Background Technology

[0002] In the field of information security technology, especially in the transmission, storage, and processing of sensitive data, the security of the keys used for encrypting and decrypting sensitive data is crucial. A common key management method in related technologies is to store the keys directly in the device's memory.

[0003] While this key management method is simple and convenient, it poses serious security risks. Once the device is compromised, attackers could easily steal the keys stored in the device's memory, leading to the leakage of sensitive data. Summary of the Invention

[0004] This application aims to at least partially address one of the technical problems in the related art.

[0005] To this end, this application proposes a chip, a data processing method, an apparatus, an electronic device, and a storage medium to enhance the security of keys, avoid using keys in plaintext form, thereby preventing keys from being illegally stolen by attackers and thus improving the overall security of business data.

[0006] One embodiment of this application proposes a chip, a first execution environment, and a hardware engine that communicate with each other, wherein...

[0007] The hardware engine is configured to obtain a packaging root key and at least one derived component of a service association from a first execution environment, and perform key derivation based on the packaging root key and the derived components of each service association to obtain a packaging service key for each service; wherein, the packaging root key is obtained by packaging the device root key of the electronic device running the chip.

[0008] The first execution environment is used to obtain the encapsulated service key from the hardware engine, and to perform encryption and decryption operations on the service data associated with each of the services based on the encapsulated service key.

[0009] Another embodiment of this application proposes a data processing method applied to a hardware engine, including:

[0010] Obtain the encapsulation root key and at least one derived component of the service association from the first execution environment; wherein, the encapsulation root key is obtained by encapsulating the device root key of the electronic device running the chip;

[0011] Based on the encapsulation root key and the derived components associated with each of the services, a key derivation is performed to obtain the encapsulation service key for each of the services; wherein, the encapsulation service key is used to perform encryption and decryption operations on the service data associated with the services.

[0012] Another aspect of this application provides a data processing apparatus applied to a hardware engine, comprising:

[0013] An acquisition module is configured to acquire an encapsulation root key and at least one derived component of a service association from a first execution environment; wherein the encapsulation root key is obtained by encapsulating the device root key of the electronic device running the chip;

[0014] The derivation module is used to derive keys based on the encapsulation root key and the derivation components associated with each of the services to obtain the encapsulation service keys for each of the services; wherein the encapsulation service keys are used to perform encryption and decryption operations on the service data associated with the services.

[0015] In another aspect, this application provides an electronic device including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the program, it implements the data processing method described in the other aspect above.

[0016] In another aspect of this application, a non-transitory computer-readable storage medium is provided, on which computer program instructions are stored, which, when executed by a processor, implement the data processing method as described in the other aspect above.

[0017] Another aspect of this application provides a computer program product having a computer program stored thereon, which, when executed by a processor, implements the data processing method as described in the other aspect above.

[0018] The chip, data processing method, apparatus, electronic device, and storage medium proposed in this application encapsulate the device root key to obtain an encapsulated root key. Based on the encapsulated root key and derived components associated with different services, key derivation is performed to obtain encapsulated service keys (i.e., encapsulated service usage keys) for different services. By using these encapsulated service keys to encrypt and decrypt service data associated with different services, the security of the keys (device root key and service usage keys) can be improved. This avoids using keys in plaintext form, thereby preventing keys from being illegally stolen by attackers and ultimately enhancing the overall security of the service data. Furthermore, using only a single hardware engine to derive encapsulated business keys for different services in batches based on the encapsulated root key and the derived components associated with different services has at least the following multiple advantages: 1. Avoiding key reuse: Ensuring that different business scenarios use different keys, preventing the leakage of a key in one business from affecting the security of other businesses; 2. Reducing deployment costs: Using a single hardware engine for key derivation reduces the demand for hardware resources, thereby reducing the deployment and maintenance costs of the chip; 3. Enhancing key security: Key derivation through a hardware engine can significantly improve the key security of the first execution environment (such as a low-security domain), enabling it to reach a higher security level; 4. The encapsulated business keys for different services are in non-plaintext form to the first execution environment, which can improve the security of different services.

[0019] Additional aspects and advantages of this application will be set forth in part in the description which follows, and in part will be obvious from the description, or may be learned by practice of this application. Attached Figure Description

[0020] The above and / or additional aspects and advantages of this application will become apparent and readily understood from the following description of the embodiments taken in conjunction with the accompanying drawings, wherein:

[0021] Figure 1 This is a schematic diagram of the structure of the first type of chip provided in the embodiments of this application;

[0022] Figure 2 This is a schematic diagram of the structure of the second type of chip provided in the embodiments of this application;

[0023] Figure 3 This is a schematic diagram illustrating the structure of the third type of chip and the key derivation process provided in the embodiments of this application;

[0024] Figure 4 This is a schematic diagram illustrating the structure and encryption / decryption process of the fourth type of chip provided in an embodiment of this application;

[0025] Figure 5 This is a schematic flowchart illustrating a data processing method provided in an embodiment of this application.

[0026] Figure 6 This is a schematic diagram of the structure of a data processing apparatus provided in an embodiment of this application;

[0027] Figure 7 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0028] The embodiments of this application are described in detail below. Examples of these embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and intended to explain this application, and should not be construed as limiting this application.

[0029] In fields such as information security, cryptography, and high-security environments, especially in the transmission, storage, and processing of sensitive data, the security of keys used for encryption and decryption is paramount. Traditional key management methods typically store keys directly in the device's memory. While simple and convenient, this approach harbors serious security vulnerabilities. If the device is compromised, attackers can easily steal the keys stored in memory, leading to the leakage of sensitive data.

[0030] In the field of cryptography, a common solution is to encapsulate the key using an encryption algorithm. This way, even if the device is compromised, the attacker cannot directly obtain the real key, thus protecting the security of sensitive data. However, in practical applications, this method often requires a highly secure execution environment, which limits its application scope to some extent.

[0031] In related technologies, the following steps can be used to ensure that the plaintext key never leaves the hardware, thus achieving hardware-level security:

[0032] 1. The root key is read from the Analog Output (AO) register by the first hardware engine deployed in the Trusted Execution Environment (TEE) or Secure Element Environment (SEE), and the root key is used to encrypt the key plaintext to obtain the key ciphertext.

[0033] 2. The root key is read from the AO register by the second hardware engine deployed in the Rich Execution Environment (REE), and the key ciphertext is obtained from the first hardware engine. The root key is used to decrypt the key ciphertext to obtain the key plaintext, and the key plaintext is used to encrypt and decrypt sensitive data.

[0034] Among them, the security of REE is lower than that of TEE, and the security of TEE is lower than that of SEE.

[0035] The AO register is hardwired to the first and second hardware engines. The AO register is not readable by software and is only written with the root key once during system initialization, which increases the difficulty of cracking the key ciphertext. In addition, the decrypted key plaintext can be used in the REE to encrypt and decrypt sensitive data of the application without switching the runtime environment, which can improve the data encryption and decryption performance.

[0036] However, the above solution has at least the following problems:

[0037] 1) High deployment cost: Using AO registers as a shared key method for high-security or low-security domains requires the deployment of two hardware engines, resulting in high deployment costs;

[0038] 2) Inflexible business usage: The protected key plaintext is only used for data encryption and decryption. If it is necessary to generate new key plaintext, it needs to be processed by the first hardware engine with higher security, resulting in low performance and flexibility.

[0039] In view of at least one of the problems existing in the above-mentioned related technologies, this application further proposes a chip, a data processing method, an apparatus, an electronic device, and a storage medium.

[0040] The following description, with reference to the accompanying drawings, describes chips, data processing methods, apparatuses, electronic devices, and storage media according to embodiments of this application.

[0041] Figure 1 This is a schematic diagram of the structure of the first type of chip provided in the embodiments of this application.

[0042] In any embodiment of this application, Figure 1 The chip 10 can be integrated into electronic devices such as mobile terminals, tablets, personal computers, and Internet of Things (IoT) devices.

[0043] Mobile terminals include, for example, in-vehicle devices, mobile phones, watches, wearable devices, personal digital assistants, and other hardware devices with various operating systems.

[0044] like Figure 1 As shown, the chip 10 includes a first execution environment 101 and a hardware engine 102 that communicate with each other. Among them,

[0045] Hardware engine 102 is used to obtain the encapsulation root key and at least one service-related derived component from the first execution environment 101, and to perform key derivation based on the encapsulation root key and the derived component of each service to obtain the encapsulation service key of each service.

[0046] The encapsulated root key is obtained by encapsulating the device root key (rk) associated with the electronic device running the chip.

[0047] The services include, but are not limited to: file encryption / decryption services, video encryption / decryption services, etc.

[0048] The derived components (DeriveData) associated with different services are different. Each derived component should contain enough information to distinguish different service scenarios. For example, each derived component associated with a service includes, but is not limited to: the service identifier, user identifier, random number, process identifier, etc., where the process identifier is used to indicate the process that triggers the encryption and decryption operation.

[0049] It should be noted that when an electronic device is running a single operating system, the user identifiers (such as user IDs) in multiple business-related derived components can be the same. However, when an electronic device is running multiple operating systems (i.e., in a multi-user scenario), the user identifiers in multiple business-related derived components can be different.

[0050] The first execution environment 101 may be a low-security execution environment (or a low-security domain), or it may be a high-security execution environment (or a high-security domain). This application embodiment does not limit this.

[0051] For example, when the first execution environment 101 is a high-security domain, the encapsulated root key can be obtained by encapsulating the device root key through the first execution environment 101.

[0052] For example, when the first execution environment 101 is a low-security domain, the encapsulated root key can be obtained by encapsulating the device root key through other high-security execution environments to improve the security of the device root key.

[0053] In this embodiment of the application, the hardware engine 102 can obtain the encapsulation root key and the derived component associated with at least one service from the first execution environment 101, and use the key derivation function (KDF) to derive the key based on the encapsulation root key and the derived component associated with each service to obtain the encapsulation service key (i.e. the encapsulated service use key) for each service.

[0054] The first execution environment 101 is used to obtain the encapsulation service key from the hardware engine 102, and to perform encryption and decryption operations on the service data associated with each service based on the encapsulation service key.

[0055] In this embodiment of the application, the first execution environment 101 can obtain the encapsulation service key of each service from the hardware engine 102, and perform encryption and decryption operations on the service data associated with each service based on the encapsulation service key of each service.

[0056] For example, if the business data associated with a certain business is plaintext data, the encapsulation business key of that business can be used to perform encryption operation on the business data associated with that business; and if the business data associated with that business is ciphertext data, the encapsulation business key of that business can be used to perform decryption operation on the business data associated with that business.

[0057] In the chip 10 of this application embodiment, the device root key is encapsulated to obtain an encapsulated root key, and key derivation is performed based on the encapsulated root key and the derived components associated with different services to obtain encapsulated service keys (i.e., encapsulated service usage keys) for different services. By using the encapsulated service keys for different services, encryption and decryption operations can be performed on the service data associated with different services, which can improve the security of the keys (device root key and service usage keys), avoid using keys in plaintext form, thereby preventing the keys from being illegally stolen by attackers, and thus improving the overall security of service data. Furthermore, using only one hardware engine 102 to derive encapsulated business keys for different services in batches based on the encapsulated root key and the derived components associated with different services has at least the following multiple advantages: 1. Avoiding key reuse: Ensuring that different business scenarios use different keys, preventing the leakage of a key for one business from affecting the security of other businesses; 2. Reducing deployment costs: Using a single hardware engine for key derivation reduces the demand for hardware resources, thereby reducing the deployment and maintenance costs of the chip; 3. Enhancing key security: Key derivation through the hardware engine 102 can significantly improve the key security of the first execution environment (such as a low-security domain), enabling it to reach a higher security level; 4. The encapsulated business keys for different services are in non-plaintext form for the first execution environment, which can improve the security of different services.

[0058] This application provides another chip. Figure 2 This is a schematic diagram of the structure of the second type of chip provided in the embodiments of this application.

[0059] like Figure 2 As shown, the chip 10 includes a first execution environment 101, a hardware engine 102, and a second execution environment 103 that communicate with each other. Among them,

[0060] The second execution environment 103 is used to generate a packaging key, and to encapsulate the device root key of the electronic device running the chip with the packaging key to obtain a packaging root key, and to store the packaging key in the hardware engine 102.

[0061] The second execution environment 103 and the first execution environment 101 are two different execution environments. For example, in order to improve key security, the security of the second execution environment 103 can be higher than a set security threshold, and the security of the first execution environment 101 can be lower than the set security threshold. That is, the second execution environment 103 can be a high-security domain, and the first execution environment 101 can be a low-security domain.

[0062] In this embodiment of the application, when the electronic device is powered on and initialized, the second execution environment 103 can use random numbers to generate a wrapping key and use the wrapping key to encapsulate the device root key associated with the electronic device running the chip, thereby obtaining the encapsulated device root key, which is referred to as the wrapped root key (wrapped_rootkey, or simply wrapped_rk) in this application.

[0063] Furthermore, the second execution environment 103 can also store the encapsulation key in the hardware engine 103. As a possible implementation, in order to improve the security of the encapsulation key and prevent it from being illegally stolen by an attacker, thus causing the root encapsulation key to be cracked by the attacker, the second execution environment 103 can write the encapsulation key into the target register in the hardware engine 102; wherein, the first execution environment 101 does not have access to the target register.

[0064] For example, the target register may be a class A register.

[0065] The first execution environment 101 is used to obtain the encapsulation root key from the second execution environment 103 and pass the encapsulation root key and at least one business-related derived component to the hardware engine 102.

[0066] It should be noted that the explanations of different services and derived components in the foregoing embodiments also apply to this embodiment, and will not be repeated here.

[0067] In any embodiment of this application, in order to improve the security and reliability of transmitted data, the first execution environment 101 can obtain the encapsulation root key from the second execution environment 103 through channels such as inter-process communication (IPC), and obtain the derived components associated with each service, and transmit the encapsulation root key and the derived components associated with each service to the hardware engine 102.

[0068] Hardware engine 102 is used to derive keys based on the encapsulation root key and the derived components associated with each service, so as to obtain the encapsulation service key for each service.

[0069] It should be noted that the explanation of the hardware engine 102 in the foregoing embodiments also applies to this embodiment, and will not be repeated here.

[0070] In any embodiment of this application, the hardware engine 102 can read the encapsulation key. For example, the hardware engine 102 can read the encapsulation key from the target register and use the encapsulation key to decapsulate the encapsulation root key to obtain the device root key. In this way, the device root key, the derived components associated with each service, and the encapsulation key can be combined to generate the encapsulation service key for each service.

[0071] As an example, the hardware engine 102 can use a key derivation function (KDF) to derive keys based on the device root key and the derived components associated with each service, thereby obtaining the service usage keys for each service. Then, it can use an encapsulation key to encapsulate the service usage keys for each service, thereby obtaining the encapsulated service key for each service.

[0072] In any embodiment of this application, the hardware engine 102 can be deployed in the first execution environment 101. For example, when the first execution environment 101 is a low-security domain, key derivation can be performed in the low-security domain. That is, multiple service usage keys for different services can be derived in the low-security domain, and these keys can be encapsulated to obtain multiple encapsulated service keys for different services. This eliminates the need to jump to a high-security domain each time to generate and encapsulate keys for different services, as is done in related technologies, thus improving the flexibility of service usage. Furthermore, since the hardware engine 102 only needs to be deployed in the first execution environment 101 (e.g., a low-security domain), the deployment cost is low.

[0073] The first execution environment 101 is also used to obtain the encapsulation service key from the hardware engine 102, so as to perform encryption and decryption operations on the service data associated with each service based on the encapsulation service key.

[0074] It should be noted that the explanations of the first execution environment 101 in the foregoing embodiments also apply to this embodiment, and will not be repeated here.

[0075] In any embodiment of this application, after the first execution environment 101 obtains the encapsulation service key of each service from the hardware engine 102, it can trigger the encryption and decryption process of the service data associated with each service based on the encapsulation service key of each service.

[0076] As one possible implementation, after obtaining the business data associated with the target business in each business, the first execution engine 101 can send the encapsulation business key of the target business and the business data associated with the target business to the hardware engine 102. Correspondingly, after receiving the encapsulation business key of the target business and the business data associated with the target business, the hardware engine 102 can perform encryption and decryption operations on the business data associated with the target business based on the encapsulation business key of the target business to obtain the target data, and send the target data to the first execution environment 101. Correspondingly, the first execution environment 101 can receive the target data returned by the hardware engine 102.

[0077] For example, when the business data associated with the target business is in plaintext, the hardware engine 102 can perform encryption on the business data associated with the target business based on the encapsulation business key of the target business to obtain the target data; while when the business data associated with the target business is in non-plaintext, the hardware engine 102 can perform decryption on the business data associated with the target business based on the encapsulation business key of the target business to obtain the target data.

[0078] As an example, the encryption and decryption process of business data is as follows: the hardware engine 102 can read the encapsulation key. For example, the hardware engine 102 can read the encapsulation key from the target register and use the encapsulation key to decapsulate the encapsulation key of the target business to obtain the business usage key of the target business. Then, based on the business usage key of the target business, encryption and decryption operations can be performed on the business data associated with the target business to obtain the target data.

[0079] For example, when the business data associated with the target business is in plaintext, the hardware engine 102 can perform an encryption operation on the business data associated with the target business based on the business usage key of the target business to obtain the target data; while when the business data associated with the target business is in non-plaintext, the hardware engine 102 can perform a decryption operation on the business data associated with the target business based on the business usage key of the target business to obtain the target data.

[0080] In any embodiment of this application, in order to isolate risks and reduce the attack surface, different services may employ different encryption and decryption algorithms in addition to using different service usage keys, thereby increasing the difficulty for attackers to crack the code. Specifically, in this application, when the hardware engine 102 performs encryption and decryption operations on service data associated with a target service, it can select a target encryption and decryption algorithm adapted to the target service from at least one candidate encryption and decryption algorithm, and use the target encryption and decryption algorithm to perform encryption and decryption operations on the service data of the target service based on the service usage key of the target service, thereby obtaining the target data.

[0081] For example, when the business data associated with the target business is in plaintext form, the hardware engine 102 can select an encryption algorithm adapted to the target business and use the encryption algorithm to perform an encryption operation on the business data associated with the target business based on the business usage key of the target business to obtain the target data; when the business data associated with the target business is not in plaintext form, the hardware engine 102 selects a decryption algorithm adapted to the target business and uses the decryption algorithm to perform a decryption operation on the business data associated with the target business based on the business usage key of the target business to obtain the target data.

[0082] Therefore, using different keys and encryption / decryption algorithms for different services can significantly improve the security, flexibility, and performance of the system. This not only isolates risks and reduces the attack surface, but also better adapts to new threats and regulatory requirements.

[0083] In summary, in the chip 10 of this application embodiment, the key register (referred to as the target register in this application) in the first execution environment 101 (e.g., the low-security domain) only allows the sharing of keys in the manner configured in the second execution environment 103 (e.g., the high-security domain). Only the hardware engine 102 needs to be deployed in the first execution environment 101 (e.g., the low-security domain), resulting in low deployment costs. Furthermore, key derivation can be performed in the first execution environment 101 (e.g., the low-security domain), eliminating the need to jump to the second execution environment 103 (e.g., the high-security domain) for generation and encapsulation of different keys for multiple services each time. This improves service performance and flexibility while ensuring key security. Specifically, the service usage key, still in an encapsulated state, is derived from the encapsulated device root key in the first execution environment 101 (e.g., the low-security domain). The entire process is invisible to the software and does not require jumping to the second execution environment 103 (e.g., the high-security domain) for encapsulation, enhancing application performance and flexibility.

[0084] As an example, this application illustrates the concept of a first execution environment as a low-security domain and a second execution environment as a high-security domain. To address the technical problem of high deployment costs in related technologies, this application proposes a method where the key register in the low-security domain only allows configuration in the high-security domain to share the key. This requires deploying the hardware engine only in the low-security domain, resulting in lower deployment costs. In the high-security domain, a wrapping key readable by the Central Processing Unit (CPU) is used to encapsulate the device root key. Then, the wrapping key is configured into a register in the low-security domain that is not readable by the CPU.

[0085] To address the technical issues of "insufficient flexibility in business usage and unoptimized performance" in related technologies, this application proposes a method where key derivation can be performed in a low-security domain. This eliminates the need to jump to a high-security domain for encapsulation of different business keys across multiple services each time. Furthermore, the derivation of encapsulated business keys from the already encapsulated device root key in the low-security domain is invisible to the software throughout the process, and eliminates the need to jump to a high-security domain for encapsulation, thus enhancing application performance and flexibility.

[0086] The chip provided in this application has at least the following advantages: it enhances the key security of the low-security domain, protecting users' sensitive data; it improves data security by encrypting and protecting business data or sensitive data of different services in the low-security domain before storing or transmitting them; it prevents the leakage of a business key from affecting other services (infectious impact) by using different business keys for different business scenarios; different services have different security requirements, and key usage scenarios can include: REE->TEE->SEE, etc. (security from low to high) under multiple operating systems (OS); and it enhances the key security of the low-security domain, enabling it to reach a higher security level.

[0087] As an example, the chip provided in this application mainly includes the following parts:

[0088] Part 1: Second execution environment (such as a high-security domain).

[0089] During system power-on initialization, firstly, a wrapping key (wrapping_key) is generated using a random number. Then, the device root key (rootkey) is encapsulated using the wrapping_key to obtain the wrapped root key (wrapped_rootkey, or simply wrapped_rk). After that, the wrapping_key is configured into the wrapping_key_reg target register, which is not readable by the first execution environment (such as the low security domain).

[0090] Part Two: The first execution environment (such as a low-security domain).

[0091] 1. Obtain the wrapping root key (wrapped_rootkey, or simply wrapped_rk) from the second execution environment (such as a high-security domain) through channels such as IPC;

[0092] 2. Use the encapsulation root key to derive the encapsulation service key (wrapped_userkey, abbreviated as wrapped_uk) for each service;

[0093] For example, the key derivation process can be as follows: Figure 3As shown, the process includes: the first execution environment (e.g., a low-security domain) inputs the wrapped root key `wrapped_rk` and the derived components (DeriveData) associated with different services to the hardware engine. The hardware engine reads the wrapping key (`wrapping_key`) from the target register (e.g., a Class A register, unreadable by the CPU), decapsulates the wrapped root key using the wrapping key to obtain the device root key (`rootkey`), derives the service usage key (`userkey`) for different services based on the device root key and the derived components (`DeriveData`) associated with different services, and then encapsulates the service usage key for different services using the wrapping key to obtain the wrapped service key (`wrapped_userkey`, abbreviated as `wrapped_uk`). Throughout the entire process, the first execution environment (e.g., the low-security domain) only sees the encapsulated key, ensuring key security.

[0094] 3. Enter the encapsulated service key (wrapped_userkey) for each service, select the encryption / decryption algorithm, such as Advanced Encryption Standard-Cipher Block Chaining Mode (AES-CBC, a symmetric encryption algorithm), and perform encryption / decryption operations on the service data associated with each service.

[0095] For example, the encryption and decryption process can be as follows: Figure 4 As shown, the process includes: taking the encryption of plaintext data of the target service as an example, the first execution environment (such as a low-security domain) inputs the encapsulated service key (wrapped_uk) of the target service plus the plaintext data (PlainData) into the hardware engine. The hardware engine reads the encapsulation key (wrapping_key) from the target register (such as a Class A register, which is not readable by the CPU), decapsulates the encapsulated service key of the target service using the encapsulation key, and obtains the service usage key (userkey) of the target service. The plaintext data (PlainData) is then encrypted using the service usage key to obtain the ciphertext data (CipherData). Throughout the entire process, the first execution environment (such as the low-security domain) only sees the encapsulated key, ensuring the security of the key.

[0096] In summary, the key register of the first execution environment (e.g., the low-security domain) only allows key sharing in the configuration manner of the second execution environment (e.g., the high-security domain). Only the hardware engine needs to be deployed in the first execution environment (e.g., the low-security domain), resulting in lower deployment costs. In the second execution environment (e.g., the high-security domain), a CPU-readable wrapping key is used to encapsulate the device root key, and then the wrapping key is configured into a register in the first execution environment (e.g., the low-security domain) that is not CPU-readable. Furthermore, the first execution environment (e.g., the low-security domain) derives the still-encapsulated business key based on the encapsulated key; the entire process is invisible to the software and does not require a jump to the second execution environment (e.g., the high-security domain) for encapsulation, enhancing application performance and flexibility.

[0097] Figure 5 This is a schematic flowchart of the first data processing method provided in the embodiments of this application.

[0098] The data processing method of this application embodiment can be applied to the hardware engine in a chip. The chip can run in any electronic device, or the chip can be integrated into any electronic device.

[0099] Among them, electronic devices can be mobile terminals, Internet of Things (IoT) devices, etc. Mobile terminals include, for example, in-vehicle devices, mobile phones, watches, wearable devices, tablets, personal digital assistants and other hardware devices with various operating systems.

[0100] It should be noted that this data processing method can be executed alone, or it can be executed together with any embodiment or possible implementation in the embodiments of this application, or it can be executed together with any technical solution in the related technology. The embodiments of this application do not limit this.

[0101] like Figure 5 As shown, the data processing method may include the following steps S501 to S502:

[0102] Step S501: Obtain the encapsulation root key and at least one derived component of the service association from the first execution environment; wherein, the encapsulation root key is obtained by encapsulating the device root key of the electronic device running the chip.

[0103] Step S502: Derivation of keys is performed based on the encapsulation root key and the derived components associated with each service to obtain the encapsulation service key for each service; wherein, the encapsulation service key is used to perform encryption and decryption operations on the service data associated with the service.

[0104] In any embodiment of this application, the encapsulation root key is obtained by the first execution environment from the second execution environment. The encapsulation root key is generated by the second execution environment using the following method: generating an encapsulation key, encapsulating the device root key using the encapsulation key to obtain the encapsulation root key, and storing the encapsulation key in the hardware engine.

[0105] In any embodiment of this application, the second execution environment can write the encapsulation key into the target register in the hardware engine; wherein the first execution environment does not have access to the target register.

[0106] In any embodiment of this application, the security of the first execution environment is lower than a set security threshold, and the security of the second execution environment is higher than the set security threshold.

[0107] In any embodiment of this application, the hardware engine performs a key derivation process, for example: reading the encapsulation key; decapsulating the encapsulation root key using the encapsulation key to obtain the device root key; and generating the encapsulation service key for each service based on the device root key, the derived components associated with each service, and the encapsulation key.

[0108] In any embodiment of this application, the hardware engine performs a key derivation process, for example: deriving a key based on the device root key and the derivation components associated with each service to obtain the service usage key for each service; and encapsulating the service usage key for each service using an encapsulation key to obtain an encapsulated service key for at least one service.

[0109] In any embodiment of this application, the hardware engine may further perform the following steps: sending the encapsulation service key of each service to the first execution environment for storage; receiving the encapsulation service key and service data associated with the target service sent by the first execution environment; performing encryption and decryption operations on the service data associated with the target service based on the encapsulation service key of the target service to obtain the target data; and sending the target data to the first execution environment.

[0110] In any embodiment of this application, the hardware engine performs encryption and decryption operations, for example: reading the encapsulation key; using the encapsulation key to decapsulate the encapsulation service key of the target service to obtain the service usage key of the target service; and based on the service usage key of the target service, performing encryption and decryption operations on the service data associated with the target service to obtain the target data.

[0111] In any embodiment of this application, the hardware engine performs the encryption and decryption operation process, for example: selecting a target encryption and decryption algorithm that is compatible with the target service from at least one candidate encryption and decryption algorithm; using the target encryption and decryption algorithm, based on the service key of the target service, performing encryption and decryption operations on the service data associated with the target service to obtain the target data.

[0112] In any embodiment of this application, the hardware engine is deployed in the first execution environment.

[0113] It should be noted that the explanations of the chip, hardware engine, first execution environment and second execution environment in any of the foregoing embodiments also apply to the data processing method executed by the hardware engine in this embodiment. The implementation principle is similar and will not be repeated here.

[0114] The data processing method of this application embodiment encapsulates the device root key to obtain an encapsulated root key, and performs key derivation based on the encapsulated root key and the derived components associated with different services to obtain encapsulated service keys for different services (i.e., encapsulated service usage keys). By using the encapsulated service keys for different services to perform encryption and decryption operations on service data associated with different services, the security of the keys (device root key and service usage keys) can be improved, the use of plaintext keys can be avoided, thereby preventing the keys from being illegally stolen by attackers and thus improving the overall security of service data. Furthermore, using only a single hardware engine to derive encapsulated business keys for different services in batches based on the encapsulated root key and the derived components associated with different services has at least the following multiple advantages: 1. Avoiding key reuse: Ensuring that different business scenarios use different keys, preventing the leakage of a key in one business from affecting the security of other businesses; 2. Reducing deployment costs: Using a single hardware engine for key derivation reduces the demand for hardware resources, thereby reducing the deployment and maintenance costs of the chip; 3. Enhancing key security: Key derivation through a hardware engine can significantly improve the key security of the first execution environment (such as a low-security domain), enabling it to reach a higher security level; 4. The encapsulated business keys for different services are in non-plaintext form to the first execution environment, which can improve the security of different services.

[0115] To implement the above embodiments, this application also proposes a data processing apparatus.

[0116] Figure 6 This is a schematic diagram of the structure of a data processing device provided in an embodiment of this application.

[0117] like Figure 6 As shown, the data processing device 600 can be applied to a hardware engine, including: an acquisition module 610 and a derived module 620.

[0118] The acquisition module 610 is used to acquire the encapsulation root key and at least one derived component of the service association from the first execution environment; wherein the encapsulation root key is obtained by encapsulating the device root key of the electronic device running the chip.

[0119] The derivation module 620 is used to derive keys based on the encapsulation root key and the derivation components associated with each service to obtain the encapsulation service key for each service; wherein, the encapsulation service key is used to perform encryption and decryption operations on the service data associated with the service.

[0120] Furthermore, in one implementation of this application embodiment, the encapsulation root key is obtained by the first execution environment from the second execution environment, and the encapsulation root key is generated by the second execution environment using the following modules:

[0121] The generation module is used to generate the encapsulation key;

[0122] The processing module is used to encapsulate the device root key using the encapsulation key, obtain the encapsulated root key, and store the encapsulation key in the hardware engine.

[0123] In one implementation of this application, the processing module is specifically used to: write the encapsulation key into a target register in the hardware engine; wherein the first execution environment does not have access to the target register.

[0124] In one implementation of this application, the security of the first execution environment is lower than a set security threshold, and the security of the second execution environment is higher than the set security threshold.

[0125] In one implementation of this application, the derivation module 620 is specifically used for: reading the encapsulation key; decapsulating the encapsulation root key using the encapsulation key to obtain the device root key; and generating the encapsulation service key for each service based on the device root key, the derivation components associated with each service, and the encapsulation key.

[0126] In one implementation of this application, the derivation module 620 is specifically used to: derive a key based on the device root key and the derivation components associated with each service to obtain the service usage key for each service; and encapsulate the service usage key for each service using an encapsulation key to obtain an encapsulated service key for at least one service.

[0127] In one implementation of this application embodiment, the data processing apparatus 600 may further include:

[0128] The sending module is used to send the encapsulated business keys of each service to the first execution environment for storage;

[0129] The receiving module is used to receive the encapsulated service key and service data associated with the target service sent by the first execution environment;

[0130] The execution module is used to encapsulate the business key based on the target business, perform encryption and decryption operations on the business data associated with the target business, and obtain the target data.

[0131] The sending module is also used to send target data to the first execution environment.

[0132] In one implementation of this application, the execution module is specifically used for: reading the encapsulation key; decapsulating the encapsulation key of the target service using the encapsulation key to obtain the service usage key of the target service; and performing encryption and decryption operations on the service data associated with the target service based on the service usage key of the target service to obtain the target data.

[0133] In one implementation of this application, the execution module is specifically used to: select a target encryption / decryption algorithm that is compatible with the target service from at least one candidate encryption / decryption algorithm; and use the target encryption / decryption algorithm to perform encryption / decryption operations on the service data associated with the target service based on the service key of the target service to obtain the target data.

[0134] In one implementation of this application, the hardware engine is deployed in a first execution environment.

[0135] It should be noted that the foregoing explanation of the data processing method embodiments also applies to the data processing apparatus of this embodiment, and will not be repeated here.

[0136] In the data processing apparatus of this application embodiment, the device root key is encapsulated to obtain an encapsulated root key, and key derivation is performed based on the encapsulated root key and the derived components associated with different services to obtain encapsulated service keys (i.e., encapsulated service usage keys) for different services. By using the encapsulated service keys for different services, encryption and decryption operations can be performed on service data associated with different services, which can improve the security of the keys (device root key and service usage keys), avoid using keys in plaintext form, thereby preventing the keys from being illegally stolen by attackers, and thus improving the overall security of service data. Furthermore, using only a single hardware engine to derive encapsulated business keys for different services in batches based on the encapsulated root key and the derived components associated with different services has at least the following multiple advantages: 1. Avoiding key reuse: Ensuring that different business scenarios use different keys, preventing the leakage of a key in one business from affecting the security of other businesses; 2. Reducing deployment costs: Using a single hardware engine for key derivation reduces the demand for hardware resources, thereby reducing the deployment and maintenance costs of the chip; 3. Enhancing key security: Key derivation through a hardware engine can significantly improve the key security of the first execution environment (such as a low-security domain), enabling it to reach a higher security level; 4. The encapsulated business keys for different services are in non-plaintext form to the first execution environment, which can improve the security of different services.

[0137] To implement the above embodiments, this application also proposes an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the program, it implements the data processing method as described in any of the foregoing embodiments.

[0138] Figure 7 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. For example, the electronic device 700 may be a vehicle, mobile phone, computer, digital broadcasting terminal, messaging device, game console, tablet device, medical device, fitness equipment, personal digital assistant, etc.

[0139] Reference Figure 7 The electronic device 700 may include one or more of the following components: processing component 702, memory 704, power component 706, multimedia component 708, audio component 710, input / output (I / O) interface 712, sensor component 714, and communication component 716.

[0140] Processing component 702 typically controls the overall operation of electronic device 700, such as operations associated with display, telephone calls, data communication, camera operation, and recording operations. Processing component 702 may include one or more processors 720 to execute instructions to complete all or part of the steps of the methods described above. Furthermore, processing component 702 may include one or more modules to facilitate interaction between processing component 702 and other components. For example, processing component 702 may include a multimedia module to facilitate interaction between multimedia component 708 and processing component 702.

[0141] Memory 704 is configured to store various types of data to support the operation of electronic device 700. Examples of this data include instructions for any application or method operating on electronic device 700, contact data, phonebook data, messages, pictures, videos, etc. Memory 704 can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as Static Random Access Memory (SRAM), Electrically Erasable Programmable Read-Only Memory (EEPROM), Erasable Programmable Read-Only Memory (EPROM), Programmable Read-Only Memory (PROM), Read-Only Memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk.

[0142] Power component 706 provides power to various components of electronic device 700. Power component 706 may include a power management system, one or more power supplies, and other components associated with generating, managing, and distributing power to electronic device 700.

[0143] Multimedia component 708 includes a screen that provides an output interface between the electronic device 700 and the user. In some embodiments, the screen may include a Liquid Crystal Display (LCD) and a Touch Panel (TP). If the screen includes a Touch Panel, the screen may be implemented as a touchscreen to receive input signals from the user. The Touch Panel includes one or more touch sensors to sense touches, swipes, and gestures on the Touch Panel. The touch sensors may sense not only the boundaries of the touch or swipe action but also the duration and pressure associated with the touch or swipe operation. In some embodiments, multimedia component 708 includes a front-facing camera and / or a rear-facing camera. When the electronic device 700 is in an operating mode, such as a shooting mode or a video mode, the front-facing camera and / or the rear-facing camera may receive external multimedia data. Each front-facing camera and rear-facing camera may be a fixed optical lens system or have focal length and optical zoom capabilities.

[0144] Audio component 710 is configured to output and / or input audio signals. For example, audio component 710 includes a microphone (MIC) configured to receive external audio signals when electronic device 700 is in an operating mode, such as call mode, recording mode, and voice recognition mode. The received audio signals may be further stored in memory 704 or transmitted via communication component 716. In some embodiments, audio component 710 also includes a speaker for outputting audio signals.

[0145] I / O interface 712 provides an interface between processing component 702 and peripheral interface modules, such as keyboards, click wheels, buttons, etc. These buttons may include, but are not limited to, home buttons, volume buttons, power buttons, and lock buttons.

[0146] Sensor assembly 714 includes one or more sensors for providing state assessments of various aspects of electronic device 700. For example, sensor assembly 714 can detect the on / off state of electronic device 700, the relative positioning of components such as the display and keypad of electronic device 700, changes in position of electronic device 700 or a component of electronic device 700, the presence or absence of user contact with electronic device 700, orientation or acceleration / deceleration of electronic device 700, and temperature changes of electronic device 700. Sensor assembly 714 may include a proximity sensor configured to detect the presence of nearby objects without any physical contact. Sensor assembly 714 may also include an optical sensor, such as a complementary metal-oxide-semiconductor (CMOS) or charge-coupled device (CCD) image sensor, for use in imaging applications. In some embodiments, sensor assembly 714 may also include an accelerometer, gyroscope, magnetometer, pressure sensor, or temperature sensor.

[0147] Communication component 716 is configured to facilitate wired or wireless communication between electronic device 700 and other devices. Electronic device 700 can access wireless networks based on communication standards, such as WiFi, 4G, or 5G, or combinations thereof. In one exemplary embodiment, communication component 716 receives broadcast signals or broadcast-related information from an external broadcast management system via a broadcast channel. In one exemplary embodiment, communication component 716 also includes a Near Field Communication (NFC) module to facilitate short-range communication. For example, the NFC module may be implemented based on Radio Frequency Identification (RFID), Infrared Data Association (IrDA), Ultra-Wideband (UWB), Bluetooth, and other technologies.

[0148] In an exemplary embodiment, the electronic device 700 may be implemented by one or more application-specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field-programmable gate arrays (FPGAs), controllers, microcontrollers, microprocessors, or other electronic components to perform the methods described above.

[0149] In an exemplary embodiment, a non-transitory computer-readable storage medium including instructions is also provided, such as a memory 704 including instructions, which can be executed by a processor 720 of an electronic device 700 to perform the above-described method. For example, the non-transitory computer-readable storage medium may be a read-only memory (ROM), a random access memory (RAM), a compact disc read-only memory (CD-ROM), magnetic tape, floppy disk, and optical data storage device, etc.

[0150] To implement the above embodiments, this application also proposes a non-transitory computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements the data processing method as described in any of the foregoing method embodiments.

[0151] To implement the above embodiments, this application also proposes a computer program product having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the data processing method as described in any of the foregoing method embodiments.

[0152] In the description of this specification, the references to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., refer to specific features, structures, materials, or characteristics described in connection with that embodiment or example, which are included in at least one embodiment or example of this application. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples. Moreover, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in this specification, as well as the features of different embodiments or examples.

[0153] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include at least one of that feature. In the description of this application, "multiple" means at least two, such as two, three, etc., unless otherwise explicitly specified.

[0154] Any process or method description in the flowchart or otherwise herein can be understood as representing a module, segment, or portion of code comprising one or more executable instructions for implementing custom logic functions or processes, and the scope of the preferred embodiments of this application includes additional implementations in which functions may be performed not in the order shown or discussed, including substantially simultaneously or in reverse order depending on the functions involved, as should be understood by those skilled in the art to which embodiments of this application pertain.

[0155] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as a ordered list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by, or in conjunction with, an instruction execution system, apparatus, or device (such as a computer-based system, a processor-including system, or other system that can fetch and execute instructions from, an instruction execution system, apparatus, or device). For the purposes of this specification, "computer-readable medium" can be any means that can contain, store, communicate, propagate, or transmit programs for use by, or in conjunction with, an instruction execution system, apparatus, or device. More specific examples of computer-readable media (a non-exhaustive list) include: electrical connections (electronic devices) having one or more wires, portable computer disk drives (magnetic devices), random access memory (RAM), read-only memory (ROM), erasable and editable read-only memory (EPROM or flash memory), fiber optic devices, and compact disc read-only memory (CDROM). Furthermore, computer-readable media can even be paper or other suitable media on which the program can be printed, because the program can be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, interpreting, or otherwise processing as necessary, and then stored in computer memory.

[0156] It should be understood that various parts of this application can be implemented using hardware, software, firmware, or a combination thereof. In the above embodiments, multiple steps or methods can be implemented using software or firmware stored in memory and executed by a suitable instruction execution system. For example, if implemented in hardware as in another embodiment, it can be implemented using any one or a combination of the following techniques known in the art: discrete logic circuits having logic gates for implementing logical functions on data signals, application-specific integrated circuits (ASICs) having suitable combinational logic gates, programmable gate arrays (PGAs), field-programmable gate arrays (FPGAs), etc.

[0157] Those skilled in the art will understand that all or part of the steps of the methods in the above embodiments can be implemented by a program instructing related hardware. The program can be stored in a computer-readable storage medium, and when executed, the program includes one or a combination of the steps of the method embodiments.

[0158] Furthermore, the functional units in the various embodiments of this application can be integrated into a processing module, or each unit can exist physically separately, or two or more units can be integrated into a module. The integrated module can be implemented in hardware or as a software functional module. If the integrated module is implemented as a software functional module and sold or used as an independent product, it can also be stored in a computer-readable storage medium.

[0159] The storage medium mentioned above can be a read-only memory, a disk, or an optical disk, etc. Although embodiments of this application have been shown and described above, it is understood that the above embodiments are exemplary and should not be construed as limiting this application. Those skilled in the art can make changes, modifications, substitutions, and variations to the above embodiments within the scope of this application.

Claims

1. A chip, characterized by The first execution environment and the hardware engine are in communication with each other, and The hardware engine is configured to obtain an encapsulation root key and at least one derived component associated with a service from the first execution environment, and perform key derivation based on the encapsulation root key and the derived component associated with each service to obtain an encapsulation service key of each service; the encapsulation root key is obtained by encapsulating a device root key of an electronic device running the chip. The first execution environment is configured to obtain the encapsulation service key from the hardware engine, and the encapsulation service key is used to perform encryption and decryption operations on service data associated with each service. The chip further comprises a second execution environment in communication with the first execution environment and the hardware engine, and the encapsulation root key is obtained by the first execution environment from the second execution environment, The second execution environment is configured to: generate an encapsulation key, and encapsulate the device root key using the encapsulation key to obtain the encapsulation root key; store the encapsulation key to the hardware engine; The hardware engine is specifically configured to: read the encapsulation key; decapsulate the encapsulation root key using the encapsulation key to obtain the device root key; generate the encapsulation service key of each service based on the device root key, the derived component associated with each service, and the encapsulation key.

2. The chip according to claim 1, characterized in that The second execution environment is specifically configured to: write the encapsulation key to a target register in the hardware engine; and the first execution environment does not have access to the target register.

3. The chip according to claim 1 or 2, characterized in that The security of the first execution environment is lower than a set security threshold, and the security of the second execution environment is higher than the set security threshold.

4. The chip of claim 3, wherein The hardware engine is specifically configured to: perform key derivation based on the device root key and the derived component associated with each service to obtain a service usage key of each service; encapsulate the service usage key of each service using the encapsulation key to obtain the encapsulation service key of the at least one service.

5. The chip of claim 1, wherein The first execution environment is specifically configured to: obtain service data associated with a target service in the at least one service; send the encapsulation service key associated with the target service and the service data to the hardware engine; receive target data returned by the hardware engine; The hardware engine is further configured to perform encryption and decryption operations on the service data associated with the target service based on the encapsulation service key of the target service to obtain the target data, and send the target data to the first execution environment.

6. The chip of claim 5, wherein, The hardware engine is specifically configured to: read the encapsulation key, and decapsulate the encapsulation service key of the target service using the encapsulation key to obtain a service usage key of the target service; perform encryption and decryption operations on the service data associated with the target service based on the service usage key of the target service to obtain the target data.

7. The chip of claim 6, wherein The hardware engine is specifically configured to: select a target encryption and decryption algorithm suitable for the target service from at least one candidate encryption and decryption algorithm; The target data is obtained by performing encryption and decryption on the target service-associated service data based on a service usage key of the target service and by using the target encryption and decryption algorithm.

8. The chip of claim 1, wherein, The hardware engine is deployed in the first execution environment.

9. A data processing method, characterized by, The method is applied to a hardware engine, and the method comprises the following steps: obtaining an encapsulation root key and at least one service-associated derived component from a first execution environment; wherein the encapsulation root key is obtained by encapsulating a device root key of an electronic device running a chip comprising the hardware engine; deriving a key based on the encapsulation root key and each service-associated derived component to obtain an encapsulation service key of each service; wherein the encapsulation service key is used to perform encryption and decryption on the service-associated service data; the encapsulation root key is obtained by the first execution environment from a second execution environment, and the encapsulation root key is generated by the second execution environment by using the following steps: generating an encapsulation key; encapsulating the device root key by using the encapsulation key to obtain the encapsulation root key, and storing the encapsulation key to the hardware engine; the step of deriving a key based on the encapsulation root key and each service-associated derived component to obtain an encapsulation service key of each service comprises the following steps: reading the encapsulation key; decapsulating the encapsulation root key by using the encapsulation key to obtain the device root key; generating an encapsulation service key of each service based on the device root key, each service-associated derived component and the encapsulation key.

10. The method of claim 9, wherein, the step of storing the encapsulation key to the hardware engine comprises the following steps: writing the encapsulation key to a target register in the hardware engine; wherein the first execution environment does not have access to the target register.

11. The method according to claim 9 or 10, characterized in that, the security of the first execution environment is lower than a set security threshold, and the security of the second execution environment is higher than the set security threshold.

12. The method of claim 9, wherein, the step of generating an encapsulation service key of each service based on the device root key, each service-associated derived component and the encapsulation key comprises the following steps: deriving a key based on the device root key and each service-associated derived component to obtain a service usage key of each service; encapsulating the service usage key of each service by using the encapsulation key to obtain the encapsulation service key of the at least one service.

13. The method of claim 9, wherein, the method further comprises the following steps: sending the encapsulation service key of each service to the first execution environment for storage; receiving the encapsulation service key and service data of a target service sent by the first execution environment; performing encryption and decryption on the target service-associated service data based on the encapsulation service key of the target service to obtain target data; sending the target data to the first execution environment.

14. The method of claim 13, wherein, the step of performing encryption and decryption on the target service-associated service data based on the encapsulation service key of the target service to obtain target data comprises the following steps: reading the encapsulation key; decapsulating the encapsulation service key of the target service by using the encapsulation key to obtain the service usage key of the target service; Performing encryption and decryption operations on the service data associated with the target service based on the service usage key of the target service, to obtain the target data.

15. The method of claim 14, wherein, The performing encryption and decryption operations on the service data associated with the target service based on the service usage key of the target service comprises: Selecting a target encryption and decryption algorithm adapted to the target service from at least one candidate encryption and decryption algorithm; Performing encryption and decryption operations on the service data associated with the target service based on the service key of the target service by using the target encryption and decryption algorithm, to obtain the target data.

16. The method of claim 9, wherein, The hardware engine is deployed in the first execution environment.

17. A data processing apparatus, characterized by The application applied to the hardware engine comprises: An obtaining module, configured to obtain an encapsulation root key and at least one service-associated derived component from a first execution environment; wherein the encapsulation root key is obtained by encapsulating a device root key of an electronic device running a chip comprising the hardware engine; A deriving module, configured to derive a service key of each service according to the encapsulation root key and the service-associated derived component, wherein the service key is used to perform encryption and decryption operations on service data associated with the service; The encapsulation root key is obtained by the first execution environment from a second execution environment, and the encapsulation root key is generated by the second execution environment using the following modules: A generating module, configured to generate an encapsulation key; A processing module, configured to encapsulate the device root key by using the encapsulation key to obtain the encapsulation root key, and store the encapsulation key to the hardware engine; The deriving module is specifically configured to read the encapsulation key; The encapsulation root key is unencapsulated by using the encapsulation key to obtain the device root key; The service key of each service is generated according to the device root key, the service-associated derived component and the encapsulation key.

18. An electronic device, comprising: The computer program is stored in the memory and can be run on the processor, and the processor performs the program to realize the steps of the method in any one of claims 9 to 16.

19. A non-transitory computer-readable storage medium having stored thereon computer program instructions, wherein, The program instructions are executed by the processor to realize the steps of the method in any one of claims 9 to 16.

20. A computer program product, characterised in that, The computer program is executed by the processor to realize the steps of the method in any one of claims 9 to 16.

Images