Data processing method and related device

Abstract

The application discloses a data processing method and related equipment. The data processing method comprises the following steps: a program module running in a rich execution environment calls an encryption and decryption module running in a trusted execution environment for first data, the first data being any one of plaintext data to be written into a storage device and ciphertext data read from the storage device; the encryption and decryption module acquires the first data and performs a security processing operation on the first data in response to the call of the program module, and returns second data acquired by the security processing operation to the program module, the security processing operation being an encryption operation or a decryption operation. The technical scheme of the embodiment of the application can improve the security of data.

Description

Technical Field

[0001] The present invention relates to the field of data processing, and in particular to a data processing method and related equipment. Background Technology

[0002] Important system data generally refers to critical configuration data during the operating system's operation, such as the environment variables (ENV) of the boot loader (uboot), system user data, hardware configuration, and parameters. This critical system data is crucial for stable system operation and the security of private data.

[0003] In recent years, with the industry's increasing emphasis on information security, some security solutions for critical system data have emerged. However, these solutions all run in rich execution environments, resulting in relatively low security. Summary of the Invention

[0004] The problem solved by the embodiments of the present invention is to provide a data processing method and related equipment that can improve data security.

[0005] To address the above problems, embodiments of the present invention provide a data processing method, comprising:

[0006] The program module running in a rich execution environment calls the encryption / decryption module running in a trusted execution environment for the first data, where the first data is either plaintext data to be written to the storage device or ciphertext data read from the storage device.

[0007] The encryption / decryption module responds to the call of the program module by acquiring the first data, performing a security processing operation on the first data, and returning the second data acquired by the security processing operation to the program module. The security processing operation is either an encryption operation or a decryption operation.

[0008] Optionally, the step of using a program module running in an enriched execution environment to call an encryption / decryption module running in a trusted execution environment for the first data includes: using a program module running in an enriched execution environment to call an encryption / decryption module running in a trusted execution environment for the first data via a secure call interface;

[0009] Returning the second data obtained from the security processing operation to the program module using the encryption / decryption module includes: using the encryption / decryption module to return the second data obtained from the security processing operation to the program module via a secure call interface.

[0010] Optionally, the encryption / decryption module includes a shared data buffer and an encryption / decryption interface;

[0011] The step of using the encryption / decryption module in response to a call from the program module to obtain the first data, perform a security processing operation on the first data, and return the second data obtained by the security processing operation to the program module includes: using the encryption / decryption interface in response to a call from the program module to obtain the first data and store it in the shared data buffer; using the encryption / decryption interface to perform a security processing operation on the first data obtained from the shared data buffer and write the second data obtained by the security processing operation into the shared data buffer; and using the encryption / decryption interface to return the second data to the program module.

[0012] Optionally, the program module includes a kernel driver module or a bootloader;

[0013] When the program module is a kernel driver module, before calling the encryption / decryption module running in the trusted execution environment for the first data, the program module running in the rich execution environment uses the program module for the first data, and further includes: using the kernel driver module to obtain the first data transmitted by the application running in the rich execution environment, wherein the first data is either plaintext data to be written to the storage device by the application or ciphertext data read from the storage device by the application.

[0014] After the encryption / decryption module responds to the call of the program module, obtains the first data, performs a security processing operation on the first data, and returns the second data obtained by the security processing operation to the program module, the method further includes: using the kernel driver module to return the second data to the application.

[0015] Optionally, the application runs in user mode, and the kernel driver module runs in kernel mode;

[0016] The step of using the kernel driver module to obtain the first data transmitted by the application running in the rich execution environment includes: using the file node of the kernel driver module to obtain the first data transmitted by the application through system calls;

[0017] The step of using the kernel driver module to return the second data to the application includes: using the file node of the kernel driver module to transfer the second data to the application via a system call.

[0018] Optionally, performing security processing on the first data includes: generating an encryption / decryption key using a symmetric encryption algorithm, and performing security processing on the first data using the encryption / decryption key.

[0019] Optionally, the encryption / decryption module is located on the SOC chip, and the program module is stored in the memory of the SOC chip and executed by the processor of the SOC chip;

[0020] The step of generating encryption and decryption keys using a symmetric encryption algorithm includes: generating encryption and decryption keys using a symmetric encryption algorithm based on the identification information of the SOC chip.

[0021] Optionally, the identification information of the SOC chip includes at least one of the following: a unique identifier of the SOC chip, a production identifier stored in the OTP device of the SOC chip, and a manufacturer identifier.

[0022] Optionally, the first data includes at least one of the following: environment variables of the bootloader, system user data, and system hardware configuration parameters.

[0023] Accordingly, embodiments of the present invention also provide a data processing apparatus, including:

[0024] One or more processors;

[0025] A memory stores a program module; wherein the program module is configured to be run by the one or more processors in an enriched execution environment to perform an operation of calling an encryption / decryption module running in a trusted execution environment for first data, the first data being either plaintext data to be written to the storage device or ciphertext data read from the storage device;

[0026] The encryption / decryption module runs in a trusted execution environment and is configured to respond to the call of the program module, obtain the first data, perform a security processing operation on the first data, and return the second data obtained by the security processing operation to the program module. The security processing operation is an encryption operation or a decryption operation.

[0027] Accordingly, embodiments of the present invention also provide a data processing system, including the data processing apparatus and storage device as described above.

[0028] Optionally, the storage device includes any one of eMMC, NAND flash memory, NOR flash memory, and hard disk drive.

[0029] Accordingly, embodiments of the present invention also provide a computer program product, including a computer program / instructions, which, when executed by a processor, are used to implement the data processing method as described in any of the preceding claims.

[0030] Accordingly, embodiments of the present invention also provide a storage medium storing one or more computer instructions for implementing the data processing method as described in any of the preceding claims.

[0031] Compared with the prior art, the technical solution of the embodiments of the present invention has the following advantages:

[0032] The data processing method provided in this embodiment of the invention includes: using a program module running in an enriched execution environment to call an encryption / decryption module running in a trusted execution environment for first data, wherein the first data is either plaintext data to be written to a storage device or ciphertext data read from the storage device; the encryption / decryption module responds to the call of the program module by obtaining the first data, performing a security processing operation on the first data, and returning the second data obtained by the security processing operation to the program module, wherein the security processing operation is an encryption operation or a decryption operation.

[0033] The data processing method provided in this embodiment of the invention employs an encryption / decryption module running in a trusted execution environment in response to a program module running in an enriched execution environment. In the trusted execution environment, the first data is subjected to corresponding encryption or decryption operations. The trusted execution environment is a secure environment isolated from the hardware environment, which makes the first data less susceptible to attacks by malicious software and helps to improve the security of the first data. Attached Figure Description

[0034] Figure 1 This is a schematic diagram of the framework structure of an embodiment of the data processing system provided by the technical solution of the present invention;

[0035] Figure 2 This is a flowchart illustrating an embodiment of the data processing method provided by the technical solution of the present invention. Detailed Implementation

[0036] As can be seen from the background technology, current security solutions for important system data all run in rich execution environments, which have the problem of low security.

[0037] To address the aforementioned technical problems, the data processing method provided in this embodiment of the invention includes: using a program module running in an enriched execution environment to call an encryption / decryption module running in a trusted execution environment for first data, wherein the first data is either plaintext data to be written to a storage device or ciphertext data read from the storage device; the encryption / decryption module responding to the call of the program module to obtain the first data, perform a security processing operation on the first data, and return the second data obtained by the security processing operation to the program module, wherein the security processing operation is an encryption operation or a decryption operation.

[0038] The data processing method provided in this embodiment of the invention employs an encryption / decryption module running in a trusted execution environment in response to a program module running in an enriched execution environment. In the trusted execution environment, the first data is subjected to corresponding encryption or decryption operations. The trusted execution environment is a secure environment isolated from the hardware environment, which makes the first data less susceptible to attacks by malicious software and helps to improve the security of the first data.

[0039] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings.

[0040] Figure 1 A schematic diagram of the data processing system provided by the present invention is shown. Figure 2 A schematic flowchart of an embodiment of the data processing method provided by the present invention is shown. (Refer to the reference.) Figure 1 and Figure 2 A data processing method may specifically include the following steps:

[0041] Step S210: Using a program module running in an enriched execution environment, the encryption / decryption module running in a trusted execution environment is invoked for the first data, wherein the first data is either plaintext data to be written to the storage device or ciphertext data read from the storage device.

[0042] Step S220: The encryption / decryption module responds to the call of the program module by obtaining the first data, performing a security processing operation on the first data, and returning the second data obtained by the security processing operation to the program module. The security processing operation is an encryption operation or a decryption operation.

[0043] Please continue to refer to the reference. Figure 1 In step S210, a program module running in an enriched execution environment is used to call an encryption / decryption module running in a trusted execution environment for the first data. The first data is either plaintext data to be written to the storage device or ciphertext data read from the storage device.

[0044] The program module running in an enriched execution environment calls the encryption / decryption module running in a trusted execution environment for the first data. This provides a basis for the subsequent use of the encryption / decryption module to respond to the program module's call, obtain the first data, perform security processing on the first data, and return the second data obtained by the security processing operation to the program module.

[0045] The data processing device is used to run the data processing method in the embodiments of the present invention.

[0046] The Rich Execution Environment (REE) provides an open environment for the data device, which is vulnerable to attacks by malicious software, such as the theft of sensitive data, abuse of digital rights, and misuse of mobile payments.

[0047] The Trusted Execution Environment (TEE) provides a trusted and secure environment for the data device, ensuring the security and privacy of sensitive data and preventing malicious software from obtaining or tampering with it.

[0048] In one exemplary embodiment, the data processing apparatus includes one or more processors (not shown), a memory (not shown), and the encryption / decryption module 200. The memory stores a program module 110 and an application program 105, and the program module 110 and the application program 105 can be run by the one or more processors in the rich execution environment.

[0049] The application 105 has the permission to modify sensitive system data, but because it runs in user mode, it does not have the ability to directly call the encryption / decryption module 200 running in the trusted execution environment through the secure call interface.

[0050] The program module 110 runs in kernel mode and has the ability to directly call the encryption / decryption interface 130 running in the trusted execution environment through a secure call interface, serving as a bridge between the application program 105 and the encryption / decryption module 200.

[0051] Specifically, when the application 105 needs to perform an encryption operation on the first data it generates and is to be written to the storage device 300, or needs to perform a decryption operation on the first data read from the storage device 300, the first data is first transmitted to the program module 110 through a system call, and then the program module 110 calls the encryption / decryption module 200 running in the trusted execution environment, so that the encryption / decryption module 200 performs an encryption operation or a decryption operation on the first data from the application.

[0052] In an exemplary embodiment, the program module 110 is a kernel driver module (not shown), and the data processing device is used to run a Linux operating system. Accordingly, before calling the encryption / decryption module 200 running in a trusted execution environment for the first data using the program module 110 running in the rich execution environment, the step of using the program module 110 to obtain the first data transmitted by the application 105 running in the rich execution environment includes: using the file node of the kernel driver module to obtain the first data transmitted by the application through a system call.

[0053] The file node is created by the kernel driver module and can be accessed by the application 105 through file operations. Accordingly, the application 105 initiates a system call via the system call interface to write the first data into the file node of the kernel driver module, thereby enabling the kernel driver module to obtain the first data.

[0054] Meanwhile, when the application 105 makes a system call, it specifies the type of security operation to be performed on the first data, i.e., whether it is an encryption operation or a decryption operation, through the corresponding call parameters, so that the kernel driver module can call the encryption / decryption module 200 through the secure call interface for the first data from the application 105.

[0055] In another exemplary embodiment, the program module can also be a bootloader (U-Boot).

[0056] In embedded operating systems, there is typically no firmware program like the Basic Input Output System (BIOS). Therefore, the entire system loading and booting task is handled entirely by the boot loader. Specifically, the boot loader runs before the operating system kernel and can be used to configure system and environment variables, support loading boot image files, provide an interactive command-line interface, and can be extended in terms of functionality.

[0057] Despite its short lifespan, the bootloader still has a need to access / modify important system data. Unlike application 105, the bootloader runs in kernel mode, and therefore can directly make secure calls to the encryption / decryption module 200 via a secure call interface.

[0058] By using a secure call interface to make secure calls to the encryption / decryption module 200, the rich execution environment and the trusted execution environment can be switched between each other. This enables communication and interaction between the program module 110 running in the rich execution environment (such as the kernel driver module and the bootloader) and the encryption / decryption module 200 running in the trusted execution environment. It also prevents data from being stolen or tampered with, which helps to improve the security and integrity of data transmission.

[0059] Please continue to refer to the reference. Figure 1 and Figure 2 In step S220, the encryption / decryption module responds to the call of the program module, obtains the first data, performs a security processing operation on the first data, and returns the second data obtained by the security processing operation to the program module. The security processing operation is an encryption operation or a decryption operation.

[0060] The encryption / decryption module 200 operates in a trusted execution environment. Using this module to encrypt and decrypt first data from an application or bootloader can prevent sensitive data from being stolen and attacked by malicious software, thus improving the security of the encryption and decryption operations on the first data. Furthermore, the encryption / decryption module 200 is a hardware module, which further improves the speed of the encryption and decryption operations on the first data.

[0061] In one exemplary embodiment, the encryption / decryption module 200 includes a shared data buffer 210 and an encryption / decryption interface 220.

[0062] Accordingly, the steps of using the encryption / decryption module 200 to obtain the first data in response to the call of the program module 110, perform a security processing operation on the first data, and return the second data obtained by the security processing operation to the program module 110 include: using the encryption / decryption interface 220 in response to the call of the program module 110 to obtain the first data and store it in the shared data buffer 210; using the encryption / decryption interface 220 to perform a security processing operation on the first data obtained from the shared data buffer 210, and write the second data obtained by the security processing operation into the shared data buffer 210; and using the encryption / decryption interface 220 to return the second data to the program module 110 via a secure call interface.

[0063] The shared data buffer 210 serves as a temporary storage space for the first data and the second data obtained by performing security processing operations on the first data, and is used to provide a data interaction buffer between the trusted execution environment and the rich execution environment.

[0064] The encryption / decryption interface 220, as the actual execution unit for performing encryption or decryption operations, is used to obtain the first data from the shared data buffer 210, perform corresponding encryption or decryption operations on the obtained first data, and rewrite the second data obtained by the encryption or decryption operation into the shared data buffer 210.

[0065] When the program module 110 calls the encryption / decryption module 200, the corresponding call parameters indicate the size of the data block and the memory address of the first data, so that the encryption / decryption interface 220 reads the first data from the program module 110 through the secure call interface according to the size of the data block and the memory address of the first data, and stores the read first data in the shared buffer 210.

[0066] Meanwhile, when the program module 110 calls the encryption / decryption module 200, the corresponding call parameter also indicates the type of the security processing operation, so that the encryption / decryption interface 220 performs the corresponding encryption or decryption operation on the first data according to the type of security processing operation indicated by the call parameter.

[0067] In an exemplary embodiment, the step of performing a security processing operation on the first data using the encryption / decryption interface 220 includes: generating an encryption / decryption key using a symmetric encryption algorithm, and performing a security processing operation on the first data using the encryption / decryption key.

[0068] It should be noted that using a symmetric encryption algorithm to generate encryption and decryption keys, and using the encryption and decryption keys to perform security processing operations on the first data, means that the encryption and decryption keys are only generated when encryption or decryption operations are required on the first data, and the encryption and decryption keys are not stored in plaintext to avoid hacker attacks by decompiling code firmware, thus improving data security.

[0069] The encryption and decryption keys are generated using a symmetric cryptography algorithm, meaning that the same key is used for both encryption and decryption. This method is characterized by its fast processing speed, which helps to improve the speed of security processing operations.

[0070] As an example, the symmetric cryptographic algorithm is the Advanced Encryption Standard (AES) algorithm. AES is a symmetric cryptographic algorithm with advantages such as fast computation speed and high security level, which helps to improve the speed of secure processing operations in encryption and decryption interfaces and contributes to improved data security.

[0071] In one exemplary embodiment, the data processing apparatus and storage device 300 are located on a System-on-a-Chip (SoC). Accordingly, the encryption / decryption key is generated using a symmetric cryptographic algorithm based on the identification information of the SoC chip.

[0072] Based on the identification information of the SOC chip, the encryption and decryption key is generated using a symmetric cryptographic algorithm. The encryption and decryption key depends on the inherent characteristics of the SOC chip, and the encryption and decryption modules 200 on different SOC chips use different encryption and decryption keys. This can prevent the leakage of encryption and decryption keys, increase the difficulty of cracking encrypted data stored in the storage device 300, and further improve data security.

[0073] In one exemplary embodiment, the identification information of the SOC chip is a unique identifier for the SOC chip. In other embodiments, the identification information of the SOC chip may also be identification information such as a production identifier or manufacturer identifier stored in the one-time programmable (OTP) device of the SOC chip, used to uniquely identify the SOC chip. Those skilled in the art can select such information according to actual needs, and no limitation is made herein.

[0074] In an exemplary embodiment, after the encryption / decryption module 200 performs a security processing operation on the first data, the result of the security processing operation, namely the second data, is returned from the shared data buffer 210 to the program module 110 via a secure call interface, so that the program module 110 can perform subsequent operations.

[0075] Specifically, if the first data is plaintext data to be written to the storage device 200 by the application 105, and the second data is ciphertext data, then after the encryption / decryption module 200 returns the second data to the kernel driver module through a secure call interface, the kernel driver module transmits the second data to the application 105 through a system call, thereby enabling the application 105 to write the second data to the storage device 300.

[0076] If the first data is encrypted data read by application 105 from storage device 300, and the second data is plaintext data, then after encryption / decryption module 200 returns the second data to kernel driver module through secure call interface, kernel driver module transmits the second data to application 105 through system call, so that application 105 obtains the second data and performs corresponding operations on the second data, such as modification.

[0077] If the first data is plaintext data of the bootloader, and the second data is correspondingly encrypted data, then after the encryption / decryption module 200 returns the second data to the bootloader through a secure call interface, the bootloader writes the second data into the storage device 300.

[0078] If the first data is encrypted data read by the bootloader from the storage device 300, and the second data is plaintext data, then after the encryption / decryption module 200 returns the second data to the bootloader through a secure call, the bootloader can perform corresponding operations on the second data.

[0079] The encryption / decryption module 200 encrypts plaintext data to be written to the storage device 300 and decrypts ciphertext data read from the storage device 300 without relying on the hardware encryption / decryption capabilities of the storage device 300 itself. Therefore, it can be applied to various types of storage devices, such as embedded multimedia cards (eMMC), NAND flash memory, NOR flash memory, and hard disk drives, and has wide applicability.

[0080] In summary, the data processing method provided by this embodiment of the invention transmits sensitive data to be written to or read from the storage device by the application or startup loader to a trusted execution environment for encryption or decryption. The trusted execution environment is a hardware-isolated operating environment with a high level of security, which can avoid attacks by malicious software and thus helps to improve data security.

[0081] Accordingly, embodiments of the present invention also provide a data processing apparatus. In some embodiments, the data processing apparatus includes one or more processors, a memory, and an encryption / decryption module, which can be specifically combined with... Figure 1 As shown, the data processing apparatus can be configured to execute the data processing method provided in the embodiments of this application. Alternatively, in other embodiments, other functional modules may be used to execute the aforementioned data processing method. For a detailed description of the data processing method in the foregoing section, it will not be repeated here.

[0082] Accordingly, embodiments of the present invention also provide a data processing system, which may include the data processing apparatus and storage device provided in the embodiments of the present invention. For details, please refer to... Figure 1 As shown, it will not be elaborated further here.

[0083] Accordingly, embodiments of the present invention also provide a computer program product, including a computer program / instructions, which, when executed by a processor, are used to implement the data processing method described in the embodiments of the present invention.

[0084] This invention also provides a storage medium storing one or more computer instructions for implementing the data processing method provided in the foregoing embodiments.

[0085] The embodiments of the present invention described above are combinations of elements and features of the present invention. Unless otherwise stated, elements or features may be considered optional. Individual elements or features may be practiced without combination with other elements or features. Furthermore, embodiments of the present invention may be constructed by combining some elements and / or features. The order of operations described in the embodiments of the present invention may be rearranged. Some constructions of any embodiment may be included in another embodiment and may be replaced by corresponding constructions of another embodiment. It will be apparent to those skilled in the art that claims in the appended claims that are not expressly referenced in each other may be combined to form embodiments of the present invention, or may be included as new claims in amendments made after the filing of this application.

[0086] Embodiments of the present invention can be implemented by various means, such as hardware, firmware, software, or combinations thereof. In a hardware configuration, the method according to an exemplary embodiment of the present invention can be implemented by one or more application-specific integrated circuits (ASICs), digital signal data processing devices (DSPs), digital signal data processing devices (DSPDs), programmable logic devices (PLDs), field-programmable gate arrays (FPGAs), data processing devices, controllers, microcontrollers, micro data processing devices, etc.

[0087] In firmware or software configuration, embodiments of the present invention can be implemented in the form of modules, processes, functions, etc. Software code can be stored in a memory unit and executed by a data processing device. The memory unit is located inside or outside the data processing device and can send data to and receive data from the data processing device via various known means.

[0088] The above description of the disclosed embodiments enables those skilled in the art to make or use the invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the invention. Therefore, the invention is not to be limited to the embodiments shown herein, but is accorded the widest scope consistent with the principles and novel features disclosed herein.

[0089] While the present invention has been disclosed above, it is not limited thereto. Any person skilled in the art can make various modifications and alterations without departing from the spirit and scope of the invention; therefore, the scope of protection of the present invention should be determined by the scope defined in the claims.

Claims

1. A data processing method, characterized in that, include: The program module running in a rich execution environment calls the encryption / decryption module running in a trusted execution environment for the first data, where the first data is either plaintext data to be written to the storage device or ciphertext data read from the storage device. The encryption / decryption module responds to the call of the program module by acquiring the first data, performing a security processing operation on the first data, and returning the second data acquired by the security processing operation to the program module. The security processing operation is either an encryption operation or a decryption operation.

2. The data processing method as described in claim 1, characterized in that, The program module runs in kernel mode; The step of using a program module running in an enriched execution environment to call an encryption / decryption module running in a trusted execution environment for the first data includes: using a program module running in an enriched execution environment to call an encryption / decryption module running in a trusted execution environment for the first data via a secure call interface; Returning the second data obtained from the security processing operation to the program module using the encryption / decryption module includes: using the encryption / decryption module to return the second data obtained from the security processing operation to the program module via the security call interface.

3. The data processing method as described in claim 1, characterized in that, The encryption / decryption module includes a shared data buffer and an encryption / decryption interface; The step of using the encryption / decryption module in response to a call from the program module to obtain the first data, perform a security processing operation on the first data, and return the second data obtained by the security processing operation to the program module includes: using the encryption / decryption interface in response to a call from the program module to obtain the first data and store it in the shared data buffer; using the encryption / decryption interface to perform a security processing operation on the first data obtained from the shared data buffer and write the second data obtained by the security processing operation into the shared data buffer; and using the encryption / decryption interface to return the second data to the program module.

4. The data processing method according to any one of claims 1 to 3, characterized in that, The program module includes a kernel driver module or a bootloader; When the program module is a kernel driver module, before calling the encryption / decryption module running in the trusted execution environment for the first data, the program module running in the rich execution environment uses the program module for the first data, and further includes: using the kernel driver module to obtain the first data transmitted by the application running in the rich execution environment, wherein the first data is either plaintext data to be written to the storage device by the application or ciphertext data read from the storage device by the application. After the encryption / decryption module responds to the call of the program module, obtains the first data, performs a security processing operation on the first data, and returns the second data obtained by the security processing operation to the program module, the method further includes: using the kernel driver module to return the second data to the application.

5. The data processing method as described in claim 4, characterized in that, The application runs in user mode, while the kernel driver module runs in kernel mode. The step of using the kernel driver module to obtain the first data transmitted by the application running in the rich execution environment includes: using the file node of the kernel driver module to obtain the first data transmitted by the application through system calls; The step of using the kernel driver module to return the second data to the application includes: using the file node of the kernel driver module to transfer the second data to the application via a system call.

6. The data processing method as described in claim 1, characterized in that, The security processing operation on the first data includes: generating an encryption / decryption key using a symmetric encryption algorithm, and performing a security processing operation on the first data using the encryption / decryption key.

7. The data processing method as described in claim 6, characterized in that, The encryption / decryption module is located on the SOC chip, and the program module is stored in the memory of the SOC chip and is run by the processor of the SOC chip. The step of generating encryption and decryption keys using a symmetric encryption algorithm includes: generating encryption and decryption keys using a symmetric encryption algorithm based on the identification information of the SOC chip.

8. The data processing method as described in claim 7, characterized in that, The identification information of the SOC chip includes at least one of the following: the unique identifier of the SOC chip, the production identifier stored in the OTP device of the SOC chip, and the manufacturer identifier.

9. The data processing method as described in claim 1, characterized in that, The first data includes at least one of the following: environment variables of the bootloader, system user data, and system hardware configuration parameters.

10. A data processing apparatus, characterized in that, include: One or more processors; A memory stores a program module; wherein the program module is configured to be run by the one or more processors in an enriched execution environment to perform an operation of calling an encryption / decryption module running in a trusted execution environment for first data, the first data being either plaintext data to be written to the storage device or ciphertext data read from the storage device; The encryption / decryption module runs in a trusted execution environment and is configured to respond to the call of the program module, obtain the first data, perform a security processing operation on the first data, and return the second data obtained by the security processing operation to the program module. The security processing operation is an encryption operation or a decryption operation.

11. A data processing system, characterized in that, Includes the data processing apparatus and storage device as described in claim 10.

12. The data processing system as described in claim 11, characterized in that, The storage device includes any one of eMMC, NAND flash memory, NOR flash memory, and hard disk drive.

13. A computer program product comprising a computer program / instructions, characterized in that, When the computer program / instructions are executed by the processor, they are used to implement the data processing method as described in any one of claims 1 to 9.

14. A storage medium, characterized in that, The storage medium stores one or more computer instructions, which are used to implement the data processing method as described in any one of claims 1 to 9.

Images