Data transmission method and related equipment

Abstract

The invention provides a data transmission method and related equipment, which are used for improving the efficiency of data transmission. The method is applied to a first computing device and a second computing device, the first computing device comprises a first trusted execution environment TEE, the second computing device comprises a second TEE, the first TEE determines a confidentiality protection key communicating with the second TEE, the first TEE obtains first data in a memory of the first computing device, and the first data is encrypted according to the confidentiality protection key. And the first TEE directly carries the first data in the first message, and the first TEE sends the first message to the second TEE.

Description

Technical Field

[0001] This application relates to the field of computers, and more particularly to a data transmission method and related equipment. Background Technology

[0002] Confidential computing is a secure computing technology that protects programs during computation. It isolates high-security data processing within a trusted execution environment (TEE), thus preventing security threats from other programs sharing a physical host. Within a confidential computing environment, sensitive financial transaction-related computations, privacy-preserving data computations, multi-party privacy data sharing, and confidential AI can be performed. Therefore, confidential computing is widely used in high-security scenarios in cloud computing and on mobile devices.

[0003] In cloud computing, confidential computing provides a secure, trusted environment for processing sensitive data, assuming the host operating system and hypervisor are untrusted. However, traditional confidential computing is typically single-machine, with limited communication requirements, and is generally used for highly sensitive computations with relatively low computational loads, such as key processing and key-based computations. After processing, the results are returned from the TEE environment to a rich execution environment (REE). The TEE environment cannot communicate directly with the outside world, resulting in low communication efficiency. However, with the development of technologies such as large-scale model inference, the amount of sensitive data to be processed is enormous, potentially requiring collaborative processing across multiple TEE environments on different hosts to complete a large computational task. This leads to significant communication demands between TEEs, and in scenarios like large-scale model inference, high latency and bandwidth requirements necessitate high-performance TEE interoperability technologies.

[0004] Currently, during data transmission between TEEs, data needs to undergo multiple encryption and decryption processes, which greatly limits communication efficiency. Summary of the Invention

[0005] This application provides a data transmission method and related equipment for improving data transmission efficiency.

[0006] This application provides a data transmission method applied to a first computing device and a second computing device, wherein the first computing device includes a first Trusted Execution Environment (TEE), and the second computing device includes a second TEE.

[0007] The first TEE determines a confidentiality protection key for communication with the second TEE. The first TEE retrieves first data from the memory of the first computing device and encrypts the first data according to the confidentiality protection key. The first TEE directly carries the first data in a first message and sends the first message to the second TEE.

[0008] In this application, when TEEs communicate, after retrieving the encrypted data from memory, they do not need to decrypt it and then re-encrypt it. Instead, they directly carry it in the message and send it to the other end. Furthermore, there is no need to perform integrity protection on the message, which improves the efficiency of data transmission.

[0009] In one possible implementation, the method also includes:

[0010] The first TEE allocates a communication memory in the memory, and the data in the communication memory is encrypted according to the confidentiality protection key. The first TEE then retrieves the first data from the communication memory.

[0011] In this application, the first TEE allocates a dedicated communication memory in memory and encrypts the data in the communication memory according to the confidentiality protection key. During data transmission, the data is directly retrieved from the communication memory, which improves the isolation and security of the data.

[0012] In one possible implementation, the first TEE and the second TEE negotiate a session key, and the first TEE and the second TEE determine a confidentiality protection key based on the session key.

[0013] In this application, the key is determined through negotiation, thereby ensuring the security of the key.

[0014] In one possible implementation, the first TEE generates a confidentiality protection key or receives a confidentiality protection key from the second TEE. The confidentiality protection key from the second TEE is encrypted with a communication key, which is negotiated between the first TEE and the second TEE.

[0015] In this application, the first TEE generates its own key or receives a key encrypted with the communication key from the peer, thereby ensuring the security of the key. In one possible implementation, the method further includes:

[0016] The first TEE receives a second message from the second TEE. The second message carries second data, which is encrypted using a confidentiality protection key. The first TEE then directly saves the second data into its memory.

[0017] In this application, after the first TEE receives the data, it does not need to decrypt and then encrypt the data. Instead, it directly saves the encrypted data into memory, thereby improving the efficiency of data transmission.

[0018] A second aspect of this application provides a data transmission method applied to a first computing device and a second computing device, wherein the first computing device includes a first trusted execution environment (TEE), and the second computing device includes a second TEE.

[0019] The first TEE determines the confidentiality protection key and the integrity protection key for communication with the second TEE. The first TEE retrieves first data from the memory of the first computing device and encrypts the first data according to the confidentiality protection key. The first TEE directly carries the first data in the first message. The first TEE performs integrity protection on the first message according to the integrity protection key and sends the integrity-protected first message to the second TEE.

[0020] In this application, when TEEs communicate, after retrieving the encrypted data from memory, they do not need to decrypt it and then re-encrypt it. Instead, they directly carry it in the message and send it to the other end, while protecting the integrity of the message, which improves the efficiency of data transmission and prevents tampering.

[0021] In one possible implementation, the method also includes:

[0022] The first TEE allocates a communication memory in the memory, and the data in the communication memory is encrypted according to the confidentiality protection key. The first TEE then retrieves the first data from the communication memory.

[0023] In one possible implementation, the first TEE and the second TEE negotiate a session key, and the first TEE and the second TEE determine a confidentiality protection key and an integrity protection key based on the session key.

[0024] In one possible implementation, the first TEE generates a confidentiality protection key and an integrity protection key or receives a confidentiality protection key and an integrity protection key from the second TEE. The confidentiality protection key and integrity protection key from the second TEE are encrypted with a communication key, which is negotiated between the first TEE and the second TEE.

[0025] In this application, after the first TEE receives the message, it does not need to decrypt and then encrypt the data. Instead, it performs integrity verification on the message and directly saves the encrypted data to memory, thereby improving the efficiency of data transmission and preventing tampering.

[0026] In one possible implementation, the method also includes:

[0027] The first TEE receives a second message from the second TEE. The second message carries second data, which is encrypted using a confidentiality protection key. The second message is also protected for integrity using an integrity protection key. The first TEE performs an integrity check on the second message using the integrity protection key. If the integrity check passes, the first TEE directly saves the second data to memory.

[0028] A third aspect of this application provides a data transmission method applied to a first computing device and a second computing device, wherein the first computing device includes a first Trusted Execution Environment (TEE), and the second computing device includes a second TEE.

[0029] The first TEE determines the integrity protection key for communication with the second TEE. The first TEE retrieves first data from the memory of the first computing device; the first data is unencrypted. The first TEE directly carries the first data in the first message. The first TEE performs integrity protection on the first message according to the integrity protection key, and then sends the integrity-protected first message to the second TEE.

[0030] In this application, when TEEs communicate, the data obtained in memory is not encrypted. Instead, the message is sent to the other end only after integrity protection, which improves the efficiency of data transmission.

[0031] In one possible implementation, the first TEE and the second TEE negotiate a session key, and the first TEE and the second TEE determine an integrity protection key based on the session key.

[0032] In one possible implementation, the first TEE generates an integrity protection key or receives an integrity protection key from the second TEE. The integrity protection key from the second TEE is encrypted with a communication key, which is negotiated between the first TEE and the second TEE.

[0033] In one possible implementation, the method also includes:

[0034] The first TEE receives a second message from the second TEE. The second message carries second data, which is not encrypted. The second message is encrypted according to the integrity protection key. The integrity of the second message is verified according to the integrity protection key. If the integrity verification passes, the first TEE directly saves the second data to memory.

[0035] In this application, after the first TEE receives the data, since the data is not encrypted, it directly saves the data into memory, thereby improving the efficiency of data transmission.

[0036] A fourth aspect of this application provides a data transmission method applied to a first computing device, the first computing device including a first trusted execution environment (TEE):

[0037] The first TEE determines the confidentiality protection key for communication with the computing unit. The first TEE retrieves first data from the memory of the first computing device and encrypts the first data according to the confidentiality protection key. The first TEE directly carries the first data in a first message and sends the first message to the computing unit.

[0038] In this application, when the TEE communicates with the computing unit, after obtaining the encrypted data from memory, it does not need to decrypt and then re-encrypt it. Instead, it is directly carried in the message and sent to the other end. Furthermore, there is no need to perform integrity protection on the message, which improves the efficiency of data transmission.

[0039] In one possible implementation, the method also includes:

[0040] The first TEE allocates a communication memory in the memory, and the data in the communication memory is encrypted according to the confidentiality protection key. The first TEE then retrieves the first data from the communication memory.

[0041] In one possible implementation, the first TEE negotiates a session key with the computing unit, and the first TEE and the computing unit determine a confidentiality protection key based on the session key.

[0042] In one possible implementation, the first TEE generates a confidentiality protection key or receives a confidentiality protection key from the computing unit. The confidentiality protection key from the computing unit is encrypted with a communication key, which is negotiated between the first TEE and the computing unit.

[0043] In one possible implementation, the first computing device includes a computing unit.

[0044] In one possible implementation, the method also includes:

[0045] The first TEE receives a second message from the computing unit. The second message carries second data, which is encrypted according to a confidentiality protection key. The first TEE then directly saves the second data to memory.

[0046] A fifth aspect of this application provides a data transmission method applied to a first computing device, the first computing device including a first trusted execution environment (TEE):

[0047] The first TEE determines the confidentiality protection key and integrity protection key for communication with the computing unit. The first TEE retrieves first data from the memory of the first computing device and encrypts the first data according to the confidentiality protection key. The first TEE directly carries the first data in the first message. The first TEE performs integrity protection on the first message according to the integrity protection key and sends the integrity-protected first message to the computing unit.

[0048] In this application, when the TEE and the computing unit communicate, after obtaining the encrypted data from memory, it does not need to decrypt and then re-encrypt it. Instead, it is directly carried in the message and sent to the other end, and the integrity of the message is protected, which improves the efficiency of data transmission and prevents tampering.

[0049] In one possible implementation, the method also includes:

[0050] The first TEE allocates a communication memory in the memory, and the data in the communication memory is encrypted according to the confidentiality protection key. The first TEE then retrieves the first data from the communication memory.

[0051] In one possible implementation, the first TEE negotiates a session key with the computing unit, and the first TEE and the computing unit determine a confidentiality protection key and an integrity protection key based on the session key.

[0052] In one possible implementation, the first TEE generates a confidentiality protection key and an integrity protection key or receives a confidentiality protection key and an integrity protection key from the computing unit. The confidentiality protection key and the integrity protection key from the computing unit are encrypted with a communication key, which is negotiated between the first TEE and the computing unit.

[0053] In one possible implementation, the first computing device includes a computing unit.

[0054] In one possible implementation, the method also includes:

[0055] The first TEE receives a second message from the computing unit. The second message carries second data, which is encrypted using a confidentiality protection key. The second message is also protected for integrity using an integrity protection key. The first TEE performs an integrity check on the second message using the integrity protection key. If the integrity check passes, the first TEE directly saves the second data to memory.

[0056] A sixth aspect of this application provides a data transmission application in a first computing device, the first computing device including a first trusted execution environment (TEE):

[0057] The first TEE determines the integrity protection key for communication with the computing unit. The first TEE retrieves first data from the memory of the first computing device; the first data is unencrypted. The first TEE directly carries the first data in the first message. The first TEE performs integrity protection on the first message according to the integrity protection key, and sends the integrity-protected first message to the computing unit.

[0058] In this application, when the TEE communicates with the computing unit, the data obtained in memory is not encrypted. Instead, the message is sent to the other end only after integrity protection, which improves the efficiency of data transmission.

[0059] In one possible implementation, the first TEE negotiates a session key with the computing unit, and the first TEE and the computing unit determine an integrity protection key based on the session key.

[0060] In one possible implementation, the first TEE generates a confidentiality protection key or receives an integrity protection key from the computing unit. The integrity protection key from the computing unit is encrypted with a communication key, which is negotiated between the first TEE and the computing unit.

[0061] In one possible implementation, the first computing device includes a computing unit.

[0062] In one possible implementation, the method also includes:

[0063] The first TEE receives a second message from the computing unit. The second message carries second data, which is not encrypted. The second message is encrypted using an integrity protection key. The first TEE performs an integrity check on the second message using the integrity protection key. If the integrity check passes, the first TEE directly saves the second data to memory.

[0064] A seventh aspect of this application provides a computing device including a processor and a memory, the processor being configured to execute instructions stored in the memory to cause the computing device to perform the methods of the foregoing aspects.

[0065] The eighth aspect of this application also provides a computer program product containing instructions that, when executed by a computer, cause the computer to perform the methods described in the foregoing aspects.

[0066] The ninth aspect of this application also provides a computer-readable storage medium including computer program instructions that, when executed by a computer, cause the computer to perform the methods described in the foregoing aspects. Attached Figure Description

[0067] Figure 1 This is a schematic diagram of the data transmission process in the prior art;

[0068] Figure 2 This is another schematic diagram of the data transmission process in the prior art;

[0069] Figure 3 This is a schematic diagram illustrating an application scenario of this application;

[0070] Figure 4 This is a flowchart illustrating the data transmission method of this application;

[0071] Figure 5 This is a schematic diagram of the negotiation key in this application;

[0072] Figure 6 This is another schematic diagram of the negotiation key in this application;

[0073] Figure 7 A schematic diagram illustrating the configuration of the key table in this application;

[0074] Figure 8a This is a schematic diagram of the data transmission method of this application;

[0075] Figure 8b This is a schematic diagram of the data transmission method of this application;

[0076] Figure 8c This is another flowchart illustrating the data transmission method of this application;

[0077] Figure 8d This is another flowchart illustrating the data transmission method of this application;

[0078] Figure 9 This is a schematic diagram illustrating an application scenario of this application;

[0079] Figure 10a This is a flowchart illustrating the data transmission method of this application;

[0080] Figure 10b This is a schematic diagram of the data transmission method of this application;

[0081] Figure 11 This is a flowchart illustrating the data transmission method of this application;

[0082] Figure 12 This is a flowchart illustrating the data transmission method of this application;

[0083] Figure 13 This is a schematic diagram of the computing device in this application. Detailed Implementation

[0084] The embodiments of this application are described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of them. As those skilled in the art will understand, with the development of technology and the emergence of new scenarios, the technical solutions provided by the embodiments of this application are also applicable to similar technical problems.

[0085] The terms "first," "second," etc., used in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments described herein can be implemented in a sequence other than that illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0086] To facilitate understanding of this application, the relevant concepts will be introduced below:

[0087] Virtual machine (VM): A virtual machine is a complete computer system simulated by software, possessing full hardware system functionality and running in a completely isolated environment. Any task that can be performed on a server can also be performed in a VM. Each VM has its own independent hard drive and operating system, and VM users can operate it just like they would a server.

[0088] PCIe devices: Devices that conform to the PCIe bus standard are called PCIe devices, also known as endpoints, external devices, or I / O devices. They are located at the end of the PCIe bus system topology and generally act as the initiator or terminator of bus operations. A PCIe bus architecture can contain multiple PCIe devices, such as graphics cards, network cards, sound cards, acceleration devices (such as graphics processing units (GPUs) and NPUs), and hard drives.

[0089] Direct memory access (DMA) is an interface technology that allows external devices to exchange data directly with system memory without going through the processor (also known as the central processing unit, CPU). External devices can use DMA to transfer data in batches to memory and then send an interrupt to notify the processor to retrieve it. The transfer process does not involve the processor, thus reducing its workload.

[0090] Please see Figure 1 In existing technology, when TEEs transmit data, one TEE first retrieves the encrypted data from memory. Since the key used to encrypt the data in memory differs from the key used during transmission, the data needs to be decrypted first, and then encrypted again using the key used during transmission. The encrypted data is carried in a message, which is then protected for integrity before being sent to the other TEE. Upon receiving the message, the other TEE first verifies its integrity; if successful, it extracts the data from the message. Then, it decrypts the data using the key used during transmission, re-encrypts the data using the key used for encryption in memory, and finally saves the data back to memory.

[0091] Please see Figure 2 In another scenario using existing technology, when a TEE transmits data to an external device such as a GPU, FPGA, or DPU, similarly, the TEE retrieves the encrypted data from memory, decrypts it, and then encrypts it again using the key used during transmission. The encrypted data is carried in a message, which is then protected for integrity before being sent to the external device. Upon receiving the message, the external device first verifies its integrity; if successful, it extracts the data from the message.

[0092] It is easy to see that in both of the above situations, the data needs to be repeatedly encrypted and decrypted during transmission, which greatly limits the efficiency of communication.

[0093] This application can be applied to secure communication between TEEs, such as secure communication between a central processing unit (CPU) TEE and a CPU TEE, secure communication between a CPU TEE and a GPU TEE, or secure communication between a TEE and a device, which will be described below.

[0094] Please see Figure 3 In one scenario, this application can be applied to secure communication between a CPU TEE on a first computing device and a CPU TEE on a second computing device. Figure 3The computing device shown can be divided into a hardware layer and a software layer. The hardware layer includes a security processor, an input / output memory management unit (IOMMU), a controller, a CPU, a memory controller (MC), and memory. In the software layer, the hardware resources of the computing device are divided into TEEs and REEs. A TEE includes one or more trusted virtual machines (TVMs), and an REE includes one or more virtual machines (VMs). The software layer also includes a hypervisor, whose role is to implement compute virtualization, network virtualization, and storage virtualization of the virtual machines, and to manage the virtual machines. Compute virtualization refers to providing a portion of the CPU and memory of the computing device to the virtual machine; network virtualization refers to providing a portion of the network interface card's (NIC) functionality (such as bandwidth) to the virtual machine; and storage virtualization refers to providing a portion of the disk space to the virtual machine. It should be understood that the aforementioned first computing device and second computing device can refer to different physical hosts or different parts within the same system.

[0095] The aforementioned computing device also includes a memory encryption engine (MEE) and a transmission encryption engine. The MEE can be an encryption engine within a secure processor, while the transmission encryption engine can be a software encryption / decryption module executed by the CPU or a hardware encryption / decryption module. For example, it could be a hardware module that implements an integrity and data encryption protocol (IDE) or a confidentiality and integrity protocol (transmission encryption / decryption engine). The transmission encryption / decryption engine can be implemented, for example, by a controller.

[0096] Please see Figure 4 The following describes a flow of the data transmission method in this application. In this embodiment, the first computing device can be... Figure 3 The first computing device shown, the second computing device may be Figure 3 The second computing device in this application. The computing device in this application may refer to a PCIe device.

[0097] 401. The first TEE determines the confidentiality protection key and the integrity protection key for communication with the second TEE;

[0098] First, the first TEE on the first computing device and the second TEE on the second computing device need to determine a confidentiality protection key and an integrity protection key to provide confidentiality and integrity protection for the transmitted data. The first TEE and the second TEE can determine these keys in several ways, which are described below:

[0099] Method 1: Software-agreed key

[0100] Please see Figure 5 After the security management modules on the first TEE and the second TEE negotiate the authenticable key, verify and confirm the firmware measurement, and perform configuration measurement operations, they generate a session master key, and then calculate the confidentiality protection key and the integrity protection key based on the session master key.

[0101] Of course, the security management modules on the first and second TEEs can also negotiate the aforementioned key based on multiple Diffie-Hellman (DH) parameters and random numbers simultaneously. If the first and second computing devices are PCLe devices, then the aforementioned security management modules are the TEE security module (TSM) and the device security module (DSM). If the first and second computing devices are UB (Unified Bus) devices, then the aforementioned security management modules are the user trust manager (UTM) and the home trust manager (HTM).

[0102] Method 2: Generate and transmit the key

[0103] Please see Figure 6 In this method, the security management modules on the first TEE and the second TEE negotiate a communication key according to the aforementioned method. Then, the MEE of one computing device generates a confidentiality protection key and transmits it to the security management module of the other computing device. Optionally, the confidentiality protection key can be transmitted encrypted in a secure channel, and the encryption key is the communication key; the integrity protection key is determined through negotiation. Alternatively, the MEE of one computing device generates an integrity protection key and transmits it to the security management module of the other computing device. Optionally, the integrity protection key can be transmitted encrypted in a secure channel, and the encryption key is the communication key; the confidentiality protection key is determined through negotiation.

[0104] Alternatively, one of the computing devices' MEE generates a confidentiality protection key and an integrity protection key, and transmits the confidentiality protection key and integrity protection key to the security management module of another computing device. Optionally, the confidentiality protection key and integrity protection key can be transmitted encrypted in a secure channel, and the encryption key is a communication key.

[0105] Method 3: The manager uniformly distributes keys.

[0106] If the first computing device and the second computing device are UB devices, the first computing device and the second computing device are managed uniformly by a centralized manager. The manager can determine the confidentiality protection key and integrity protection key mentioned above in advance and allocate them to the security management modules of the first TEE and the second TEE.

[0107] After determining the aforementioned keys, both the first and second computing devices configure the confidentiality protection key into a confidentiality protection key memory accessible to the MEE, and configure the integrity protection key into an integrity protection key memory accessible to the transmission encryption / decryption engine. The confidentiality protection key memory can be on-chip memory within the security processor, and the confidentiality protection key can be stored in encrypted form within the confidentiality protection key memory, which the MEE can decrypt to obtain the key. The integrity protection key is configured in software-based memory or in hardware on-chip storage.

[0108] 402. The first TEE retrieves the first data from the memory of the first computing device, and the first data is encrypted according to the confidentiality protection key;

[0109] Please see Figure 7 After determining the confidentiality protection key and the integrity protection key, the secure memory management interface in the hypervisor of the first and second computing devices allocates dedicated communication memory in memory, such as DMA memory, which is memory specifically used for DMA access. The security processor also generates a corresponding key table and configures it in the MEE. The key table uses a key index (Key ID) and a key value to associate the key table. The security processor also configures the page tables of the TVM in memory through the MC, including the virtual address to physical address mapping page table of the communication memory, shadow page table, EPT page table, etc., and embeds the Key ID of the confidentiality protection key in the address of the DMA memory memory address table entry. This address can be a physical address or a virtual address. For example, 48 bits of a 64-bit array are used to describe the address, and the other N bits are used to describe the Key ID.

[0110] Please see Figure 8aAfter the above configuration is completed, when the CPU writes the data that needs to be communicated into the DMA memory, the MMU performs the mapping from virtual address to physical address. The MEE queries the confidentiality protection key in the key table according to the Key ID of the physical address corresponding to the data, and encrypts the data according to the key found. Finally, the MC saves the encrypted data to the DMA memory.

[0111] When the CPU needs to read data from DMA memory, MEE finds the physical address where the data is located, extracts the key ID from the physical address, looks up the corresponding confidentiality protection key in the key table based on the key ID, decrypts the data using the key, and then sends the data to the CPU.

[0112] If the TVM of the second computing device sends a DMA read request to the TVM of the first computing device, the transmission encryption / decryption engine of the second computing device first performs integrity protection on the DMA read request according to the integrity protection key. Optionally, the transmission encryption / decryption engine of the second computing device can also perform confidentiality protection on the read request. After the TVM of the first computing device receives the DMA read request, the transmission encryption / decryption engine on the controller performs the corresponding decryption and integrity verification. After the DMA read request passes the permission check of the IOMMU, the MC directly reads the data that has been encrypted by the confidentiality protection key from the DMA memory.

[0113] 403. The first TEE carries the first data directly in the first message;

[0114] The MEE of the first computing device will not decrypt the data again, but will directly carry it in the message.

[0115] 404. The first TEE performs integrity protection on the first message according to the integrity protection key;

[0116] The transmission encryption / decryption engine of the first computing device performs integrity protection on the message based on the integrity protection key. For example, it uses the integrity protection key as the key of a hash function with a key, takes the data to be protected in the message as input, and calculates the hash value as the integrity protection check code.

[0117] 40 5. The first TEE sends the first message, which has been protected by integrity, to the second TEE.

[0118] After completing the above operations, the TVM of the first computing device sends the message to the TVM of the second computing device. Upon receiving the message, the TVM of the second computing device performs an integrity check on the message using its transmission encryption / decryption engine. If the integrity check passes, the TVM of the second computing device extracts the data from the message and saves the data directly into memory without decryption.

[0119] Similarly, when the TVM of the first computing device sends a DMA read request to the TVM of the second computing device, the transmission encryption / decryption engine of the first computing device performs integrity protection on the DMA read request according to the integrity protection key. Optionally, the transmission encryption / decryption engine of the first computing device can also perform confidentiality protection on the read request. After receiving the DMA read request, the transmission encryption / decryption engine on the controller of the second computing device performs corresponding decryption and integrity verification. After the DMA read request passes the permission check of the IOMMU, the MC directly reads the data encrypted with the confidentiality protection key from the DMA memory. The MEE of the second computing device will not decrypt the data again, but will directly carry it in the message. The transmission encryption / decryption engine of the second computing device performs integrity protection on the message according to the integrity protection key, and then sends it to the TVM of the first computing device. After receiving the message, the transmission encryption / decryption engine of the first computing device performs integrity verification on the message. After the integrity verification is successful, the TVM of the first computing device extracts the data from the message and saves the data directly into memory without decryption.

[0120] In another possible implementation, the operations performed by the aforementioned transmission encryption / decryption module can also be performed by MEE, that is, both the confidentiality protection key and the integrity protection key can be configured in a confidentiality protection key memory that MEE can access.

[0121] Please see Figure 8b In this application, when TEEs transmit data, one TEE directly retrieves the encrypted data from memory, includes it in the message, and sends the message to the other TEE after ensuring its integrity. Upon receiving the message, the other TEE verifies its integrity; if successful, it retrieves the data and saves it directly into memory.

[0122] In this application, when TEEs communicate, after retrieving the encrypted data from memory, they do not need to decrypt it and then re-encrypt it. Instead, they directly carry it in the message and send it to the other end, while protecting the integrity of the message, which improves the efficiency of data transmission and prevents tampering.

[0123] In another possible implementation, communication between TEEs can be protected only by confidentiality, without the need for integrity protection. Please refer to [link to relevant documentation]. Figure 8c The following is an introduction:

[0124] 501. The first TEE determines the confidentiality protection key for communication with the second TEE;

[0125] First, a confidentiality protection key needs to be determined between the first TEE on the first computing device and the second TEE on the second computing device to provide confidentiality protection for the transmitted data. The first TEE and the second TEE can determine this key in several ways, which are described below:

[0126] Method 1: Software-agreed key

[0127] After the security management modules on the first TEE and the second TEE negotiate the authenticable key, verify and validate the firmware measurement, and perform configuration measurement operations, they generate a session master key and then calculate the confidentiality protection key based on the session master key.

[0128] Of course, the security management modules on the first TEE and the second TEE can also negotiate the above key based on multiple DH (diffie-hellman) parameters and random numbers at the same time.

[0129] Method 2: Generate and transmit the key

[0130] In this method, the MEE of one computing device generates a confidentiality protection key and transmits it to the security management module of another computing device. Optionally, the confidentiality protection key can be encrypted using a negotiated communication key during transmission.

[0131] Method 3: The manager uniformly distributes keys.

[0132] If the first computing device and the second computing device are UB devices, the first computing device and the second computing device are managed uniformly by a centralized manager. This manager can determine the aforementioned confidentiality protection key in advance and distribute it to the security management modules of the first TEE and the second TEE.

[0133] After determining the aforementioned key, both the first computing device and the second computing device configure the confidentiality protection key into a confidentiality protection key storage that can be accessed by the MEE.

[0134] 502. The first TEE retrieves the first data from the memory of the first computing device, and the first data is encrypted according to the confidentiality protection key;

[0135] After determining the confidentiality protection key, the secure memory management interface in the hypervisor of the first and second computing devices allocates dedicated communication memory in memory, such as DMA memory, which is memory specifically used for DMA access. The security processor also generates a corresponding key table and configures it in the MEE. The key table uses a key index (Key ID) and a key value to associate the key table. The security processor also configures the page tables of the TVM in memory through the MC, including the virtual address to physical address mapping page table of the communication memory, shadow page table, EPT page table, etc., and embeds the Key ID of the confidentiality protection key in the address of the DMA memory memory address table entry. This address can be a physical address or a virtual address. For example, 48 bits of a 64-bit array are used to describe the address, and the other N bits are used to describe the Key ID.

[0136] After the above configuration is completed, when the CPU writes the data that needs to be communicated into the DMA memory, the MMU performs the mapping from virtual address to physical address. The MEE queries the confidentiality protection key in the key table according to the Key ID of the physical address corresponding to the data, and encrypts the data according to the key found. Finally, the MC saves the encrypted data to the DMA memory.

[0137] When the CPU needs to read data from DMA memory, MEE finds the physical address where the data is located, extracts the key ID from the physical address, looks up the corresponding confidentiality protection key in the key table based on the key ID, decrypts the data using the key, and then sends the data to the CPU.

[0138] If the TVM of the second computing device sends a DMA read request to the TVM of the first computing device, the transmission encryption / decryption engine of the second computing device first performs integrity protection on the DMA read request according to the integrity protection key. Optionally, the transmission encryption / decryption engine of the second computing device can also perform confidentiality protection on the read request. After the TVM of the first computing device receives the DMA read request, the transmission encryption / decryption engine on the controller performs the corresponding decryption and integrity verification. After the DMA read request passes the permission check of the IOMMU, the MC directly reads the data that has been encrypted by the confidentiality protection key from the DMA memory.

[0139] 503. The first TEE carries the first data directly in the first message;

[0140] This step is similar to step 403 mentioned above, and will not be described in detail here.

[0141] 504. The first TEE sends the first message to the second TEE.

[0142] After completing the above operations, the TVM of the first computing device sends the message to the TVM of the second computing device. Upon receiving the message, the TVM of the second computing device extracts the data from the message and saves the data directly into memory without decryption.

[0143] Similarly, when the TVM of the first computing device sends a DMA read request to the TVM of the second computing device, the transmission encryption / decryption engine of the first computing device performs integrity protection on the DMA read request according to the integrity protection key. Optionally, the transmission encryption / decryption engine of the first computing device can also perform confidentiality protection on the read request. After receiving the DMA read request, the transmission encryption / decryption engine on the controller performs corresponding decryption and integrity verification. After the DMA read request passes the IOMMU's permission check, the MC directly reads the data encrypted with the confidentiality protection key from the DMA memory. The MEE of the second computing device will not decrypt the data again, but will directly carry it in the message and send it to the TVM of the first computing device. After receiving the message, the TVM of the first computing device extracts the data from the message and saves the data directly into memory without decryption.

[0144] In this application, when TEEs communicate, after retrieving the encrypted data from memory, they do not need to decrypt it and then re-encrypt it. Instead, they directly carry it in the message and send it to the other end. Furthermore, there is no need to perform integrity protection on the message, which improves the efficiency of data transmission.

[0145] In another possible implementation, communication between TEEs can also be protected only for integrity, without the need for confidentiality protection. Please refer to [link to relevant documentation]. Figure 8d The following is an introduction:

[0146] 601. The first TEE determines the integrity protection key for communication with the second TEE;

[0147] First, an integrity protection key needs to be determined between the first TEE on the first computing device and the second TEE on the second computing device to provide integrity protection for the transmitted data. The first TEE and the second TEE can determine this key in several ways, which are described below:

[0148] Method 1: Software-agreed key

[0149] After the security management modules on the first TEE and the second TEE negotiate the authenticable key, verify and validate the firmware measurement, and perform configuration measurement operations, they generate a session master key and then calculate the integrity protection key based on the session master key.

[0150] Of course, the security management modules on the first TEE and the second TEE can also negotiate the above key based on multiple DH (diffie-hellman) parameters and random numbers at the same time.

[0151] Method 2: Generate and transmit the key

[0152] In this method, the MEE of one computing device generates an integrity protection key and transmits it to the security management module of another computing device. Optionally, the integrity protection key can be encrypted during transmission using a negotiated communication key.

[0153] Method 3: The manager uniformly distributes keys.

[0154] If the first computing device and the second computing device are UB devices, the first computing device and the second computing device are managed uniformly by a centralized manager. This manager can determine the above-mentioned integrity protection key in advance and distribute it to the security management modules of the first TEE and the second TEE.

[0155] After determining the aforementioned key, both the first computing device and the second computing device configure the integrity protection key into an integrity protection key memory accessible to the transmission encryption and decryption engine.

[0156] 602. The first TEE retrieves the first data from the memory of the first computing device. The first data is not encrypted.

[0157] After the integrity protection key is determined, the secure memory management interface in the hypervisor of the first and second computing devices allocates dedicated communication memory in memory for communication, such as DMA memory, which is memory specifically used for DMA access.

[0158] When the CPU writes data that needs to be communicated into DMA memory, there is no need to encrypt the data.

[0159] When the CPU needs to read data from DMA memory, since the data is unencrypted, there is no need to decrypt it.

[0160] If the TVM of the second computing device sends a DMA read request to the TVM of the first computing device, the transmission encryption / decryption engine of the second computing device first performs integrity protection on the DMA read request according to the integrity protection key. Optionally, the transmission encryption / decryption engine of the second computing device can also perform confidentiality protection on the read request. After the TVM of the first computing device receives the DMA read request, the transmission encryption / decryption engine on the controller performs the corresponding decryption and integrity verification. After the DMA read request passes the permission check of the IOMMU, the MC directly reads the unencrypted data from the DMA memory.

[0161] 603. The first TEE carries the first data directly in the first message;

[0162] The MEE of the first computing device will not process the data again, but will instead include it directly in the message.

[0163] 604. The first TEE performs integrity protection on the first message according to the integrity protection key;

[0164] The transmission encryption / decryption engine of the first computing device performs integrity protection on the message based on the integrity protection key. For example, it uses the integrity protection key as the key of a hash function with a key, takes the data to be protected in the message as input, and calculates the hash value as the integrity protection check code.

[0165] 60 5. The first TEE sends the first message, which has been protected by integrity, to the second TEE.

[0166] After completing the above operations, the TVM of the first computing device sends the message to the TVM of the second computing device. Upon receiving the message, the TVM of the second computing device performs an integrity verification on the message using the integrity protection key through its transmission encryption / decryption engine. If the integrity verification passes, the TVM of the second computing device extracts the data from the message and saves it directly to memory without encryption.

[0167] Similarly, when the TVM of the first computing device sends a DMA read request to the TVM of the second computing device, the transmission encryption / decryption engine of the first computing device performs integrity protection on the DMA read request according to the integrity protection key. Optionally, the transmission encryption / decryption engine of the first computing device can also perform confidentiality protection on the read request. After receiving the DMA read request, the transmission encryption / decryption engine on the controller of the second computing device performs corresponding decryption and integrity verification. After the DMA read request passes the permission check of the IOMMU, the MC directly reads the unencrypted data from the DMA memory. The MEE of the second computing device will not process the data again, but will directly carry it in the message. The transmission encryption / decryption engine of the second computing device performs integrity protection on the message according to the integrity protection key, and then sends it to the TVM of the first computing device. After receiving the message, the transmission encryption / decryption engine of the first computing device performs integrity verification on the message according to the integrity protection key. After the integrity verification is successful, the TVM of the first computing device extracts the data from the message and saves it directly to memory without encryption.

[0168] In another possible implementation, the operations performed by the aforementioned transmission encryption / decryption module can also be performed by the MEE, that is, the integrity protection key can be configured into a confidentiality protection key memory that the MEE can access.

[0169] In this application, when TEEs communicate, the data obtained in memory is not encrypted. Instead, the message is sent to the other end only after integrity protection, which improves the efficiency of data transmission.

[0170] Please see Figure 9 In another scenario, this application can also be applied to secure communication between the TEE and the computing unit on a first computing device. Figure 9 The first computing device shown is the same as the one described above. Figure 3 Similar to those described above, details will not be repeated here. The computing unit can be, for example, a GPU, FPGA, or DPU. The computing unit includes a controller that implements the transmission encryption / decryption engine. The computing unit may also include a TEE, such as a virtual function (VF), in which case the TEE on the first computing device communicates securely with the TEE of the computing unit. Alternatively, the computing unit may not include a TEE, in which case the TEE on the first computing device communicates securely directly with the computing unit. In one possible implementation, the aforementioned computing unit may be located within the first computing device.

[0171] Please see Figure 10a The following describes a flow of the data transmission method in this application. In this embodiment, the first computing device can be... Figure 9 The first computing device shown may have a computing unit that is Figure 9 The computational unit in the process.

[0172] 901. The first TEE determines the confidentiality protection key and the integrity protection key for communication with the computing unit;

[0173] First, the first TEE on the first computing device and the computing unit need to determine a confidentiality protection key and an integrity protection key to provide confidentiality and integrity protection for the transmitted data. The first TEE and the computing unit can determine these keys in several ways, which are described below:

[0174] Method 1: Software-agreed key

[0175] After the security management module and computing unit on the first TEE negotiate the authenticable key, verify and validate the firmware measurement, and perform configuration measurement operations, they generate the session master key, and then calculate the confidentiality protection key and the integrity protection key based on the session master key.

[0176] Of course, the security management module and computing unit on the first TEE can also negotiate the above key based on multiple DH (diffie-hellman) parameters and random numbers.

[0177] Method 2: Generate and transmit the key

[0178] In this method, the security management module and computing unit on the first TEE negotiate a communication key using a method similar to that described above. Then, the MEE or computing unit of the first computing device generates a confidentiality protection key and transmits it to the other party. Optionally, the confidentiality protection key can be transmitted encrypted over a secure channel, with the encryption key being the communication key. The integrity protection key is determined through negotiation. Alternatively, the MEE or computing unit of the computing device generates an integrity protection key and transmits it to the other party. Optionally, the integrity protection key can be transmitted encrypted over a secure channel, with the encryption key being the communication key. The confidentiality protection key is determined through negotiation.

[0179] Alternatively, the MEE or computing unit of the first computing device generates a confidentiality protection key and an integrity protection key, and transmits these keys to the other party. Optionally, the confidentiality protection key and integrity protection key can be transmitted encrypted over a secure channel, using a communication key for encryption.

[0180] After determining the aforementioned keys, the first computing device configures the confidentiality protection key into a confidentiality protection key memory accessible by the MEE, and configures the integrity protection key into an integrity protection key memory accessible by the transmission encryption / decryption engine. Since the computing unit has no memory or MEE but only a transmission encryption / decryption engine, it configures the aforementioned keys into an integrity protection key memory accessible by the transmission encryption / decryption engine.

[0181] 902. The first TEE retrieves the first data from the memory of the first computing device, and the first data is encrypted according to the confidentiality protection key;

[0182] After determining the confidentiality protection key and the integrity protection key, the secure memory management interface in the hypervisor of the first computing device allocates dedicated communication memory in memory, such as DMA memory. The security processor also generates a corresponding key table and configures it in the MEE. The key table uses a key index (Key ID) and a key value to associate the key table. The security processor also configures the page tables of the TVM in memory through the MC, including the virtual address to physical address mapping page table of the communication memory, shadow page table, EPT page table, etc., and embeds the Key ID of the confidentiality protection key in the address of the DMA memory memory address table entry. This address can be a physical address or a virtual address. For example, 48 bits of a 64-bit system are used to describe the address, and the other N bits are used to describe the Key ID.

[0183] After the above configuration is completed, when the CPU writes the data that needs to be communicated into the DMA memory, the MMU performs the mapping from virtual address to physical address. The MEE queries the confidentiality protection key in the key table according to the Key ID of the physical address corresponding to the data, and encrypts the data according to the key found. Finally, the MC saves the encrypted data to the DMA memory.

[0184] When the CPU needs to read data from DMA memory, MEE finds the physical address where the data is located, extracts the key ID from the physical address, looks up the corresponding confidentiality protection key in the key table based on the key ID, decrypts the data using the key, and then sends the data to the CPU.

[0185] If the computing unit sends a DMA read request to the TVM of the first computing device, the computing unit's transmission encryption / decryption engine first performs integrity protection on the DMA read request based on the integrity protection key. Optionally, the computing unit's transmission encryption / decryption engine can also perform confidentiality protection on the read request. After the TVM of the first computing device receives the DMA read request, the transmission encryption / decryption engine on the controller performs the corresponding decryption and integrity verification. After the DMA read request passes the IOMMU's permission check, the MC directly reads the data that has been encrypted with the confidentiality protection key from the DMA memory.

[0186] 903. The first TEE carries the first data directly in the first message;

[0187] The MEE of the first computing device will not decrypt the data again, but will directly carry it in the message.

[0188] 904. The first TEE performs integrity protection on the first message based on the integrity protection key;

[0189] The transmission encryption / decryption engine of the first computing device performs integrity protection on the message based on the integrity protection key. For example, it uses the integrity protection key as the key of a hash function with a key, takes the data to be protected in the message as input, and calculates the hash value as the integrity protection check code.

[0190] 90 5. The first TEE sends the first message with integrity protection to the computing unit.

[0191] After completing the above operations, the TVM of the first computing device sends the message to the computing unit. Upon receiving the message, the computing unit performs an integrity check on the message using its transmission encryption / decryption engine. If the integrity check passes, the computing unit extracts the data from the message and decrypts it using the confidentiality protection key.

[0192] When the computing unit sends data to the TVM of the first computing device, the computing unit encrypts the data using a confidentiality protection key and includes the encrypted data in the message. Then, it performs integrity protection on the message using an integrity protection key before finally sending the message to the TVM of the first computing device. Upon receiving the message, the TVM of the first computing device performs integrity verification using its transmission encryption / decryption engine. If the integrity verification passes, the TVM of the first computing device extracts the data from the message and saves it directly into memory without decryption.

[0193] In another possible implementation, the operations performed by the aforementioned transmission encryption / decryption module can also be performed by MEE, that is, both the confidentiality protection key and the integrity protection key can be configured in a confidentiality protection key memory that MEE can access.

[0194] Please see Figure 10b In this application, when transmitting data between the TEE and the computing unit, one party's TEE directly retrieves the encrypted data from memory, carries it in the message, and sends the message to the computing unit after performing integrity protection on the message. Upon receiving the message, the computing unit performs integrity verification on the message; if successful, it retrieves the data and decrypts it to obtain the data.

[0195] In this application, when the TEE and the computing unit communicate, after obtaining the encrypted data from memory, it does not need to decrypt and then re-encrypt it. Instead, it is directly carried in the message and sent to the other end, and the integrity of the message is protected, which improves the efficiency of data transmission and prevents tampering.

[0196] In another possible implementation, the communication between the TEE and the computing unit can be protected only for confidentiality, without requiring integrity protection. Please refer to [link to relevant documentation]. Figure 11 The following is an introduction:

[0197] 1001. The first TEE determines the confidentiality protection key for communication with the computing unit;

[0198] First, the first TEE on the first computing device and the computing unit need to determine a confidentiality protection key to provide confidentiality protection for the transmitted data. The first TEE and the computing unit can determine this key in several ways, which are described below:

[0199] Method 1: Software-agreed key

[0200] After the security management module and computing unit on the first TEE negotiate the authenticable key, verify and validate the firmware measurement, and perform configuration measurement operations, they generate a session master key and then calculate the confidentiality protection key based on the session master key.

[0201] Of course, the security management module and computing unit on the first TEE can also negotiate the above key based on multiple DH (diffie-hellman) parameters and random numbers.

[0202] Method 2: Generate and transmit the key

[0203] The MEE of the first computing device generates a confidentiality protection key and transmits it to the computing unit; or the computing unit generates a confidentiality protection key and transmits it to the security management module of the first computing device. Optionally, the confidentiality protection key may be transmitted encrypted in a secure channel, and the encryption key is a negotiated communication key.

[0204] After determining the aforementioned key, the first computing device configures the confidentiality protection key into a confidentiality protection key memory accessible by the MEE. Since the computing unit has no memory or MEE but only a transmission encryption / decryption engine, the computing unit configures the aforementioned key into an integrity protection key memory accessible by the transmission encryption / decryption engine.

[0205] 1002. The first TEE retrieves the first data from the memory of the first computing device, and the first data is encrypted according to the confidentiality protection key;

[0206] This step is similar to step 902 mentioned above, and will not be described in detail here.

[0207] 1003. The first TEE carries the first data directly in the first message;

[0208] This step is similar to step 903 mentioned above, and will not be described in detail here.

[0209] 1004. The first TEE sends the first message to the computing unit.

[0210] After completing the above operations, the TVM of the first computing device sends the message to the computing unit. Upon receiving the message, the computing unit extracts the data from the message and decrypts it using the confidentiality protection key.

[0211] When the computing unit sends data to the TVM of the first computing device, the computing unit encrypts the data according to the confidentiality protection key, carries the encrypted data in a message, and finally sends the message to the TVM of the first computing device. After receiving the message, the TVM of the first computing device extracts the data from the message and saves the data directly into memory without decryption.

[0212] In this application, when the TEE communicates with the computing unit, after obtaining the encrypted data from memory, it does not need to decrypt and then re-encrypt it. Instead, it is directly carried in the message and sent to the other end. Furthermore, there is no need to perform integrity protection on the message, which improves the efficiency of data transmission.

[0213] In another possible implementation, the communication between the TEE and the computing unit can also be protected only for integrity, without the need for confidentiality protection. Please refer to [link to relevant documentation]. Figure 12 The following is an introduction:

[0214] 1101. The first TEE determines the integrity protection key for communication with the computing unit;

[0215] First, the first TEE on the first computing device and the computing unit need to determine an integrity protection key to provide confidentiality protection for the transmitted data. The first TEE and the computing unit can determine the key in various ways, similar to the method for determining the confidentiality protection key in step 1001 above, which will not be elaborated here.

[0216] 1102. The first TEE retrieves the first data from the memory of the first computing device. The first data is not encrypted.

[0217] After the integrity protection key is determined, the secure memory management interface in the hypervisor of the first computing device allocates dedicated communication memory in memory for communication, such as DMA memory, which is memory specifically used for DMA access.

[0218] When the CPU writes data that needs to be communicated into DMA memory, there is no need to encrypt the data.

[0219] When the CPU needs to read data from DMA memory, since the data is unencrypted, there is no need to decrypt it.

[0220] If the computing unit sends a DMA read request to the TVM of the first computing device, the computing unit first performs integrity protection on the DMA read request according to the integrity protection key. Optionally, the computing unit can also perform confidentiality protection on the read request. After the TVM of the first computing device receives the DMA read request, the transmission encryption and decryption engine on the controller performs the corresponding decryption and integrity verification. After the DMA read request passes the permission check of the IOMMU, the MC directly reads the unencrypted data from the DMA memory.

[0221] 1103. The first TEE carries the first data in the first message;

[0222] The MEE of the first computing device will not process the data again, but will instead include it directly in the message.

[0223] 1104. The first TEE performs integrity protection on the first message according to the integrity protection key;

[0224] This step is similar to the one described in step 604 above, and will not be repeated here.

[0225] 1105. The first TEE sends the first message protected by integrity to the computing unit.

[0226] After completing the above operations, the TVM of the first computing device sends the message to the computing unit. Upon receiving the message, the computing unit's transmission encryption / decryption engine performs an integrity verification on the message based on the integrity protection key. If the integrity verification passes, the computing unit extracts the data from the message.

[0227] When the computing unit sends data to the TVM of the first computing device, the computing unit carries unencrypted data in the message, performs integrity protection on the message according to the integrity protection key, and finally sends the message to the TVM of the first computing device. After receiving the message, the TVM of the first computing device performs integrity verification on the message according to the integrity protection key. After the integrity verification is successful, the data is extracted from the message and directly saved to memory without encryption.

[0228] In another possible implementation, the operations performed by the aforementioned transmission encryption / decryption module can also be performed by the MEE, that is, the integrity protection key can be configured into a confidentiality protection key memory that the MEE can access.

[0229] In this application, when the TEE communicates with the computing unit, the data obtained in memory is not encrypted. Instead, the message is sent to the other end only after integrity protection, which improves the efficiency of data transmission.

[0230] The method in this application has been described above; the device in this application is described below:

[0231] In one instance, the computing device in this application includes a processing unit and a transceiver unit, which is used to perform the operations performed by the first computing device in steps 501 to 504.

[0232] A processing unit is used to determine the confidentiality protection key for communication with the second TEE;

[0233] The processing unit is also configured to retrieve first data from the memory of the first computing device, wherein the first data is encrypted according to a confidentiality protection key;

[0234] The processing unit is also used to directly carry the first data in the first message;

[0235] The transceiver unit is used to send the first message to the second TEE.

[0236] In one instance, the computing device in this application includes a processing unit and a transceiver unit, which is used to perform the operations performed by the first computing device in steps 401 to 405.

[0237] The processing unit is used to determine the confidentiality protection key and the integrity protection key for communication with the second TEE;

[0238] The processing unit is also configured to retrieve first data from the memory of the first computing device, the first data being encrypted according to a confidentiality protection key.

[0239] The processing unit is also used to directly carry the first data in the first message;

[0240] The processing unit is also used to perform integrity protection on the first message according to the integrity protection key;

[0241] The transceiver unit is used to send the first message, which has been protected by integrity, to the second TEE.

[0242] In one instance, the computing device in this application includes a processing unit and a transceiver unit, which is used to perform the operations performed by the first computing device in steps 601 to 605.

[0243] Processing unit, used to determine the integrity protection key for communication with the second TEE;

[0244] The processing unit is also configured to retrieve first data from the memory of the first computing device, the first data being unencrypted;

[0245] The processing unit is also used to directly carry the first data in the first message;

[0246] The processing unit is also used to perform integrity protection on the first message according to the integrity protection key;

[0247] The transceiver unit is also used to send the first message, which has been protected by integrity, to the second TEE.

[0248] In one instance, the computing device in this application includes a processing unit and a transceiver unit, which is used to perform the operations performed by the first computing device in steps 1001 to 1004.

[0249] The processing unit is used to determine the confidentiality protection key for communication with the computing unit;

[0250] The processing unit is also configured to retrieve first data from the memory of the first computing device, the first data being encrypted according to a confidentiality protection key.

[0251] The processing unit is also used for the first TEE to directly carry the first data in the first message;

[0252] The transceiver unit is used to send the first message from the first TEE to the computing unit.

[0253] In one instance, the computing device in this application includes a processing unit and a transceiver unit, which is used to perform the operations performed by the first computing device in steps 901 to 905.

[0254] The processing unit is used to determine the confidentiality protection key and the integrity protection key for communication with the computing unit;

[0255] The processing unit is also configured to retrieve first data from the memory of the first computing device, wherein the first data is encrypted according to a confidentiality protection key;

[0256] The processing unit is also used to directly carry the first data in the first message;

[0257] The processing unit is also used to perform integrity protection on the first message according to the integrity protection key;

[0258] The transceiver unit is also used to send the first message, which has been protected by integrity, to the computing unit.

[0259] In one instance, the computing device in this application includes a processing unit and a transceiver unit, which is used to perform the operations performed by the first computing device in steps 1101 to 1105.

[0260] The processing unit is used to determine the integrity protection key for communication with the computing unit;

[0261] The processing unit is also used to retrieve first data from the memory of the first computing device, the first data being unencrypted.

[0262] The processing unit is also used to directly carry the first data in the first message;

[0263] The processing unit is also used to perform integrity protection on the first message according to the integrity protection key;

[0264] The transceiver unit is also used to send the first message, which has been protected by integrity, to the computing unit.

[0265] This application also provides a computer program product containing instructions. The computer program product may be a software or program product containing instructions, capable of running on a computing device or stored on any usable medium. When the computer program product is run on at least one computer, it causes the at least one computer to perform the methods described in the foregoing embodiments.

[0266] This application also provides a computer-readable storage medium. The computer-readable storage medium can be any available medium capable of being stored by a computing device, or a data storage device such as a data center containing one or more available media. The available medium can be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium (e.g., solid-state drive). The computer-readable storage medium includes instructions that instruct a computer to perform the methods described in the foregoing embodiments.

[0267] This application also provides a chip, including a processing circuit coupled to a storage circuit. The storage circuit stores instructions, and when the instructions are executed by the processing circuit, the chip performs the methods described in the foregoing embodiments.

[0268] Figure 13 This is a schematic diagram of the structure of a computing device provided in an embodiment of this application. The computing device 1300 may include one or more central processing units (CPUs) 1301 and a memory 1305, in which one or more applications or data are stored.

[0269] The memory 1305 can be volatile or persistent storage. The program stored in the memory 1305 can include one or more modules, each module including a series of instruction operations. Furthermore, the central processing unit 1301 can be configured to communicate with the memory 1305 and execute the series of instruction operations stored in the memory 1305 on the computing device 1300.

[0270] The computing device 1300 may also include one or more power supplies 1302, one or more wired or wireless network interfaces 1303, one or more input / output interfaces 1304, and / or one or more operating systems. The central processing unit 1301 can perform the operations of the foregoing embodiments, the details of which will not be elaborated here.

[0271] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0272] In the several embodiments provided in this application, it should be understood that the disclosed systems, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection between apparatuses or units through some interfaces, and may be electrical, mechanical, or other forms.

[0273] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0274] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0275] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

Claims

1. A data transmission method applied to a first computing device and a second computing device, the first computing device comprising a first trusted execution environment (TEE) and the second computing device comprising a second TEE, the method comprising: The method comprises: ​ The first TEE determines a confidentiality protection key for communication with the second TEE; The first TEE obtains first data in the memory of the first computing device, the first data being encrypted according to the confidentiality protection key; The first TEE directly carries the first data in a first message; The first TEE sends the first message to the second TEE.

2. The method of claim 1, wherein, The method further comprises: The first TEE divides a communication memory in the memory, data in the communication memory being encrypted according to the confidentiality protection key; The first TEE obtaining first data in the memory of the first computing device comprises: The first TEE obtains the first data in the communication memory.

3. The method according to claim 1 or 2, characterized in that, The first TEE determining a confidentiality protection key for communication with the second TEE comprises: The first TEE negotiates a session key with the second TEE; The first TEE determines the confidentiality protection key according to negotiation of the session key with the second TEE.

4. The method according to claim 1 or 2, characterized in that, The first TEE determining a confidentiality protection key for communication with the second TEE comprises: The first TEE generates the confidentiality protection key or receives the confidentiality protection key from the second TEE, the confidentiality protection key from the second TEE being encrypted by a communication key, the communication key being negotiated by the first TEE and the second TEE.

5. The method according to any one of claims 1 to 4, characterized in that, The method further comprises: The first TEE receives a second message from the second TEE, the second message carrying second data, the second data being encrypted according to the confidentiality protection key; The first TEE directly saves the second data to the memory. 6.A data transmission method applied to a first computing device and a second computing device, the first computing device comprising a first trusted execution environment (TEE), and the second computing device comprising a second TEE, characterized in that, The method comprises: The first TEE determines a confidentiality protection key and an integrity protection key for communication with the second TEE; The first TEE obtains first data in the memory of the first computing device, the first data being encrypted according to the confidentiality protection key; The first TEE directly carries the first data in a first message; The first TEE performs integrity protection on the first message according to the integrity protection key; The first TEE sends the first message subjected to integrity protection to the second TEE.

7. The method of claim 6, wherein, The method further comprises: The first TEE divides a communication memory in the memory, data in the communication memory being encrypted according to the confidentiality protection key; The first TEE obtaining first data in the memory of the first computing device comprises: The first TEE obtains the first data in the communication memory.

8. The method according to claim 6 or 7, characterized in that, The first TEE determining a confidentiality protection key and an integrity protection key for communication with the second TEE comprises: The first TEE negotiates a session key with the second TEE; The first TEE determines the confidentiality protection key and the integrity protection key according to negotiation of the session key with the second TEE.

9. The method according to claim 6 or 7, characterized in that, The first TEE determining a confidentiality protection key and an integrity protection key for communication with the second TEE comprises: The first TEE generates the confidentiality protection key and the integrity protection key or receives the confidentiality protection key and the integrity protection key from the second TEE, the confidentiality protection key and the integrity protection key from the second TEE being encrypted by a communication key, the communication key being negotiated by the first TEE and the second TEE. The first TEE generates the confidentiality protection key and the integrity protection key or receives the confidentiality protection key and the integrity protection key from the second TEE, the confidentiality protection key and the integrity protection key from the second TEE being encrypted by a communication key negotiated by the first TEE and the second TEE.

10. The method according to any one of claims 6 to 9, characterized in that, The method further comprises: The first TEE receives a second message from the second TEE, the second message carrying second data, the second data being encrypted according to the confidentiality protection key, the second message being integrity protected according to the integrity protection key; The first TEE performs integrity verification on the second message according to the integrity protection key; If the integrity verification is passed, the first TEE directly saves the second data to the memory.

11. A data transmission method applied to a first computing device and a second computing device, the first computing device comprising a first trusted execution environment (TEE) and the second computing device comprising a second TEE, characterized in that, Comprise: The first TEE determines an integrity protection key for communication with the second TEE; The first TEE obtains first data in a memory of the first computing device, the first data being unencrypted; The first TEE directly carries the first data in a first message; The first TEE integrity protects the first message according to the integrity protection key; The first TEE sends the integrity protected first message to the second TEE.

12. The method of claim 11, wherein, The first TEE determines an integrity protection key for communication with the second TEE comprises: The first TEE negotiates a session key with the second TEE; The first TEE and the second TEE determine the integrity protection key according to the session key negotiation.

13. The method of claim 11, wherein, The first TEE determines an integrity protection key for communication with the second TEE comprises: The first TEE generates the integrity protection key or receives the integrity protection key from the second TEE, the integrity protection key from the second TEE being encrypted by a communication key negotiated by the first TEE and the second TEE.

14. The method according to any one of claims 11 to 13, characterized in that, The method further comprises: The first TEE receives a second message from the second TEE, the second message carrying second data, the second data being unencrypted, the second message being encrypted according to the integrity protection key; The first TEE performs integrity verification on the second message according to the integrity protection key; If the integrity verification is passed, the first TEE directly saves the second data to the memory.

15. A data transmission method applied to a first computing device, the first computing device comprising a first trusted execution environment TEE, characterized in that, Comprise: The first TEE determines a confidentiality protection key for communication with a computing unit; The first TEE obtains first data in a memory of the first computing device, the first data being encrypted according to the confidentiality protection key; The first TEE directly carries the first data in a first message; The first TEE sends the first message to the computing unit.

16. The method of claim 15, wherein, The method further comprises: The first TEE divides a communication memory in the memory, data in the communication memory being encrypted according to the confidentiality protection key; The first TEE obtains the first data in a memory of the first computing device includes: The first TEE obtains the first data in the communication memory.

17. The method according to claim 15 or 16, characterized in that The first TEE determines a confidentiality protection key with a computing unit includes: The first TEE negotiates a session key with the computing unit; The first TEE determines the confidentiality protection key with the computing unit according to the session key negotiation.

18. The method of claim 15 or 16, wherein, The first TEE determines a confidentiality protection key with a computing unit includes: The first TEE generates the confidentiality protection key or receives the confidentiality protection key from the computing unit, which is encrypted by a communication key negotiated by the first TEE and the computing unit.

19. The method according to any one of claims 15 to 18, characterized in that, The first computing device includes the computing unit.

20. The method of claim 19, wherein, The method further includes: The first TEE receives a second packet from the computing unit, which carries second data encrypted according to the confidentiality protection key; The first TEE directly saves the second data to the memory.

21. A computing device, comprising: A computing device including a processor and a memory, the processor configured to execute instructions stored in the memory to cause the computing device to perform the method of any one of claims 1-20.

22. A computer program product containing instructions which, when executed by a computer, cause the computer to carry out the method of any one of claims 1-20.

23. A computer-readable storage medium comprising computer program instructions which, when executed by a computer, cause the computer to carry out the method of any one of claims 1-20.

Images