Original data non-memory resident embedded biosignal security processing method and system

Abstract

The application provides an original data non-memory resident embedded biological signal security processing method and system, relates to the biological signal privacy protection technical field, and the method comprises the following steps: according to the arrival of subsequent sampling points, covering the current sampling point value in the general register, so that there is no any copy of the original biological signal sampling point in all memory spaces that can be addressed by user-level code at any time; wherein, in the whole process from the peripheral data register to the general register and performing the calculation operation in the general register, the original biological signal sampling point is not written into any memory space that can be addressed by user-level code. The application eliminates the possibility that the original data resides in the form of plaintext in the memory space that can be addressed by user-level code.

Description

Technical Field

[0001] This application relates to the field of biosignal privacy protection technology, and in particular to embedded biosignal security processing methods and systems where the raw data is not stored in memory. Background Technology

[0002] In existing embedded biosignal processing systems, bioelectrical signals such as EEG, ECG, and EMG are acquired by electrodes, amplified and filtered by an analog front end, and then converted into digital sampling points by an analog-to-digital converter at a fixed sampling rate. These sampling points follow the standard embedded design paradigm of first storing and then processing: the sampling points are first written into variables or buffers in the system's main memory, and then the processor or third-party algorithm reads the sampling points from the main memory through the load instruction and performs calculations such as feature extraction, threshold judgment, and pattern recognition.

[0003] This architecture has a drawback: the original biosignal sampling points must reside completely in main memory in plaintext before they can be read and computed by the processor. Specifically, from the moment a sampling point is written into the main memory address space until that address is explicitly cleared or overwritten by subsequent data, the original sampling point persists in main memory and can be repeatedly read, referenced, and copied by any code with access to that address space. In an open algorithm ecosystem, third-party algorithm code, malicious programs, or DMA attacks can directly read the original sampling values ​​within this memory exposure window, thereby obtaining complete biosignal waveform data. Even with protection measures such as storage encryption or trusted execution environments, the fundamental architectural premise that the original data must be decrypted or exposed in memory before it can be computed remains unchanged. When facing biosignal privacy protection issues, those skilled in the art typically seek solutions along the lines of "protecting data already stored in memory," such as increasing encryption strength, introducing trusted execution environments, or strengthening access control policies. The common premise of these solutions is that the original sampling data must first be written into main memory. Therefore, although the principle of minimizing the exposure of sensitive data is widely accepted in the field of information security, its application in embedded biosignal processing has never been pushed to the point of challenging the fundamental architectural paradigm of memory-resident processing. With the popularization of wearable medical devices and brain-computer interface technology, this memory-resident mode constitutes a fundamental bottleneck for the protection of biosignal privacy. Summary of the Invention

[0004] This application provides a method and system for secure processing of embedded biosignals where raw data resides in non-memory locations, eliminating the possibility that raw data resides in plaintext in a memory space addressable by user-level code.

[0005] To address the problem that existing technologies, which focus on protecting stored data, cannot fundamentally eliminate the memory exposure window, this application proposes a technical solution that involves architectural restructuring at the data's existing form level, as follows: A first aspect is a method for securely processing embedded biosignals where the raw data is not memory-resident, the method comprising: Based on the sampling action of the analog-to-digital converter on the biological signal, the original biological signal sampling points are obtained and latched in the peripheral data register; Based on the original biological signal sampling points in the peripheral data register, the load instruction is used to directly read them into the processor's general-purpose register, thus obtaining the operand to be calculated in the general-purpose register. Based on the operands to be calculated, perform the calculation operation in the general-purpose register to obtain the scalar calculation result; Based on the scalar calculation results, they are written to the output area using the store instruction, and no copy of the original biological signal sampling points is retained in the general-purpose register; Based on the arrival of subsequent sampling points, the current sampling point value in the general-purpose register is overwritten, so that at any given time, there are no copies of the original biological signal sampling points in any memory space that can be addressed by user-level code; Throughout the entire process, from the peripheral data register to the general-purpose register, and the computational operations performed within the general-purpose register, the original biosignal sampling points are not written to any memory space that can be addressed by user-level code.

[0006] Secondly, embedded biosignal security processing systems where raw data is not resident in memory include: An analog-to-digital converter is used to perform sampling on biological signals and obtain the original biological signal sampling points latched in the peripheral data register. The data loading control module is used to directly read the original biological signal sampling points in the peripheral data register into the processor's general-purpose register using the load instruction, thereby obtaining the operand to be calculated in the general-purpose register. The calculation execution module is used to perform calculation operations in a general-purpose register according to the operands to be calculated, and obtain scalar calculation results; The result writing module is used to write the scalar calculation result into the output area using the store instruction, and does not retain a copy of the original biosignal sampling point in the general-purpose register. The data lifecycle management module is used to overwrite the current sampling point value in the general-purpose register based on the arrival of subsequent sampling points, so that at any time there are no copies of the original biosignal sampling points in any memory space that can be addressed by user-level code; The data loading control module and the computation execution module are configured such that, throughout the entire process from the peripheral data register to the general-purpose register and the computation operation performed within the general-purpose register, the original biosignal sampling points are not written to any memory space that can be addressed by user-level code.

[0007] Through the above-described architectural restructuring, this application includes at least the following beneficial effects: Based on the sampling action of the analog-to-digital converter on the biological signal, the original biological signal sampling points are obtained and latched in the peripheral data register. The load instruction is used to directly read them into the processor's general-purpose register for calculation. This eliminates the intermediate step of writing the original sampling points into the main memory, thus eliminating the possibility that the original data resides in plaintext in the memory space that can be addressed by user-level code, and cutting off the memory exposure window.

[0008] Based on the constraint that only the scalar calculation result is written to the output area after the calculation operation is performed in the general-purpose register, the general-purpose register does not retain a copy of the original biosignal sampling point. This means that after the calculation is completed, the original sampling point no longer exists in the system in an accessible form, and third-party code cannot obtain the original data that has been calculated by reading the memory address.

[0009] Based on the mechanism that the arrival of subsequent sampling points automatically overwrites the current sampling point value in the general-purpose register, the existence time of the original sampling point in the general-purpose register is strictly limited to a single interrupt handling cycle. After being overwritten, it disappears completely from the system. At any given time, there is no copy of the original sampling point in any memory space that can be addressed by user-level code, thereby eliminating the possibility of data being copied in batches and leaked on a large scale.

[0010] By limiting the entire process from peripheral data registers to general-purpose registers and performing computational operations within those registers to not writing to any memory space addressable by user-level code, this application achieves a secure processing architecture that allows algorithms to perform computations using raw data but cannot acquire or retain the complete raw waveform, without altering the computational logic itself, simply by changing the physical location and lifespan of the data. This approach requires no large-scale modifications to existing algorithms and is suitable for resource-constrained wearable medical devices. Attached Figure Description

[0011] Figure 1 This is a flowchart illustrating an embedded biosignal security processing method for raw data that is not resident in memory, provided in an embodiment of this application.

[0012] Figure 2 This is a schematic diagram of an embedded biosignal security processing system where raw data resides outside of memory, provided in an embodiment of this application.

[0013] Figure 3 This is a schematic diagram illustrating the progressive relationship of the data transmission path provided in the embodiments of this application. Detailed Implementation

[0014] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. It should be understood that the described embodiments are only some, not all, of the embodiments of this application. All other embodiments obtained by those skilled in the art based on the embodiments of this application without creative effort are within the scope of protection of this application.

[0015] It should be understood that, in the various embodiments of this application, the execution order of the steps should not be limited to the fixed order shown in the accompanying drawings. Where there is no contradiction, the execution order of some steps can be adjusted according to actual operational needs, or some steps can be executed in parallel.

[0016] This embodiment provides a method for secure processing of embedded biosignals where raw data is not resident in memory. This method is applied to an embedded biosignal processing system. The system can be deployed in wearable medical devices or brain-computer interface devices to process bioelectrical signals such as electroencephalograms (EEGs), electrocardiograms (ECGs), and electromyograms (EMGs). The system hardware includes electrodes, an analog front-end, an analog-to-digital converter (ADC), a processor, a memory protection unit, a DMA controller, and various types of memory such as SRAM, DRAM, Flash, and TCM. The method of this embodiment will be described in detail below with reference to the accompanying drawings.

[0017] Figure 1 This embodiment illustrates a flowchart of the embedded biosignal security processing method where the raw data is not resident in memory. Figure 2 This illustration shows a schematic diagram of an embedded biosignal security processing system where raw data resides outside of memory, as provided in this embodiment. Figure 3 A schematic diagram illustrating the progressive relationship of the data transmission path provided in this embodiment is shown.

[0018] In this embodiment, the embedded biosignal security processing method for non-memory-resident raw data includes the following steps: Step 1: Based on the sampling action of the analog-to-digital converter on the biological signal, the original biological signal sampling points are obtained and latched in the peripheral data register.

[0019] Specifically, after the bioelectric signal is acquired by electrodes, it is amplified and filtered by an analog front-end, and then sent to an analog-to-digital converter (ADC). The ADC discretely samples the continuous analog biosignal at a preset fixed sampling rate, which can be set to 256Hz, 512Hz, or 1000Hz, depending on the specific application requirements. After each sampling conversion, the ADC automatically latches the converted digital value into its peripheral data register.

[0020] In this embodiment, the existence of the original biosignal sampling points in the peripheral data register is automatically completed by the hardware sampling action, without any software intervention. The peripheral data register is a hardware register inside the analog-to-digital converter peripheral, mapped to the peripheral address region in the processor address space. Its physical location is independent of the system main memory and does not occupy the main memory address space such as SRAM, DRAM, Flash, or TCM. At this time, the original biosignal sampling points only exist in the peripheral hardware register and have not yet entered any memory space that can be addressed by user-level code. This is different from the practice in the prior art where sampling points are first written into variables or buffers in the main memory. In the prior art, once the sampling points enter the main memory, they are exposed and can be accessed by user-level code. However, this step isolates them in the hardware register from the source of data generation, setting up a physical barrier for user-level code. This design ensures that the original sampling points are outside the view of user-level code from the moment they are generated.

[0021] Step 2: Based on the original biosignal sampling points in the peripheral data register, the load instruction is used to directly read them into the processor's general-purpose register, obtaining the operand to be calculated in the general-purpose register. After performing the calculation operation in the general-purpose register, only the scalar calculation result is written to the output area, so that at any time there is no copy of the original biosignal sampling points in any memory space that can be addressed by user-level code.

[0022] This step further includes the following sub-steps: Step 2.1: Based on the original biosignal sampling points in the peripheral data register, the data is directly read into the processor's general-purpose register using the load instruction to obtain the operand to be calculated in the general-purpose register.

[0023] Specifically, after completing one sampling, the analog-to-digital converter (ADC) notifies the processor via an interrupt signal. Upon responding to the interrupt, the processor enters the interrupt service routine. Within the interrupt service routine, the processor executes a load instruction. The source operand of this instruction is the address of a peripheral data register, and the destination operand is a general-purpose register within the processor. For example, in the ARM architecture, this instruction is the LDR instruction, which loads the sampled value from the peripheral data register into the general-purpose register R0; in the RISC-V architecture, this instruction is the LW instruction, which loads the sampled value from the peripheral data register into the general-purpose register. When the load instruction is executed, data is transferred directly from the peripheral data register to the general-purpose register via the processor's internal data bus, without passing through any main memory address space.

[0024] In this embodiment, a single load instruction directly jumps the original sample point from the peripheral data register to the processor's general-purpose register, without any intermediate transfer through main memory. In the existing store-before-process paradigm, the sample point typically needs to be written to a variable or buffer in main memory first, and then the processor reads the sample point from main memory using a load instruction to perform calculations. This means that the original sample point needs to reside in main memory for at least one complete data processing cycle, during which any code with access to that address space can repeatedly read, reference, and copy the original sample value. However, the solution in this application directly reads data from the peripheral data register into the general-purpose register using a load instruction, eliminating the intermediate step of writing the original sample point to main memory at the architectural level, and eliminating the possibility of the original data entering the main memory space addressable by user-level code from the physical transmission path. General-purpose registers are storage units inside the processor core and are part of the processor's data path. They do not have memory addresses and cannot be addressed by user-level code using memory access instructions via the address bus. Therefore, they do not belong to the memory space that can be addressed by user-level code. The original sampling point exists only in the general-purpose registers. User-level code cannot obtain the sampling point through memory access instructions, thus largely eliminating the memory exposure window.

[0025] Step 2.2: Perform the calculation operation in the general-purpose register according to the operand to be calculated, and obtain the scalar calculation result.

[0026] Specifically, the processor performs computational operations on the operands obtained in step 2.1 within general-purpose registers. The type of computational operation is determined according to specific application requirements, including but not limited to digital filtering, threshold comparison, peak detection, mean calculation, variance calculation, feature extraction, and pattern classification. During the computation, all operands originate from general-purpose registers, and all intermediate results also end in general-purpose registers; the computational operations do not involve reading or writing to any main memory address. After the computational operation is completed, the resulting scalar computation result is stored in a general-purpose register; this scalar computation result can be a filtered signal value, a Boolean value indicating whether a threshold is exceeded, or the encoded value of the classification result, etc., and its form is a single scalar value, rather than the original sampling point itself.

[0027] In this embodiment, the entire calculation process is completed in a closed loop within general-purpose registers. Operands originate from general-purpose registers, and intermediate and final results are written to general-purpose registers. The calculation process does not involve read or write operations to main memory. This means that the original sampled point values ​​never leave the general-purpose register set throughout the entire calculation process and never enter any memory space addressable by user-level code. In existing technologies, the calculation process typically requires repeatedly reading sampled point data from main memory and writing intermediate results back to main memory. This results in the original data being continuously exposed to main memory during the calculation process, and intermediate results may retain characteristic information of the original data, posing a risk of leakage. The solution proposed in this application confines the calculation process within a general-purpose register, ensuring that the entire process from the original sampling point being read to the completion of the calculation only flows within the processor, as if the processing is completed in a closed and secure room, making it difficult for outsiders to observe. This design not only protects the original sampling point itself but also protects the intermediate results during the calculation process. Furthermore, since the general-purpose register is a relatively fast storage level in the processor, performing calculations directly within the general-purpose register also improves the processing efficiency of biosignal sampling points, reduces the occupation of system bus bandwidth, and reduces power consumption, which is of practical significance for resource-constrained wearable medical devices.

[0028] Step 2.3: Based on the scalar calculation results, write them to the output area using the store instruction. Do not retain a copy of the original biosignal sampling points in the general-purpose register.

[0029] Specifically, after the calculation operation is completed, the processor executes the `store` instruction, writing the scalar calculation result from the general-purpose register to the specified output area. This output area can be an output buffer in main memory or a data register of a peripheral communication interface, such as the data register of an SPI interface, the transmit register of a UART interface, or the data register of an I2C interface, used to send the processing result to an external device or upper-level system. After the `store` instruction is executed, the general-purpose register stores the scalar calculation result, not the original biosignal sampling point. In a preferred implementation, after the `store` instruction is executed, the interrupt service routine can immediately clear the general-purpose register storing the original sampling point value or intermediate calculation result to ensure that no copy of the original biosignal sampling point is retained in the general-purpose register.

[0030] In this embodiment, the `store` instruction only writes the scalar calculation result to the output area, while no copy of the original sampling point is retained in the general-purpose register. This ensures that the original sampling point no longer exists in the system in an accessible form after the calculation is completed. In existing technologies, the original sampling point remains intact in the main memory buffer after the calculation is completed. Even after the calculation is finished, the original data can still be read and copied, allowing attackers to retrospectively obtain the original waveform data. However, in the solution of this application, after the original sampling point completes its calculation mission, its value only exists briefly in the general-purpose register. What is written to the output area is the scalar result after calculation and transformation, not the original sampling point itself. The output area stores the desensitized processing result. Even if an attacker gains access to the output area, they can only obtain the scalar calculation result and cannot recover the original biological signal waveform from it. This design extends data security from the calculation process to the output stage, forming a secure closed loop from data reading, calculation to output.

[0031] Step 2.4: Based on the arrival of subsequent sampling points, overwrite the current sampling point value in the general-purpose register, so that at any time there is no copy of the original biosignal sampling point in any memory space that can be addressed by user-level code.

[0032] Specifically, the analog-to-digital converter operates continuously at a fixed sampling rate, triggering an interrupt after each sampling. During the next interrupt service routine execution, the new sampled value is loaded into the same general-purpose register, naturally overwriting any residual values ​​from the previous sampling point. Furthermore, when the interrupt service routine executes the interrupt return instruction, the processor hardware automatically restores the context saved before the interrupt. In typical embedded processor architectures, when an interrupt occurs, the processor hardware automatically pushes some or all of the values ​​of the general-purpose registers onto the stack for storage, and pops them from the stack upon interrupt return. Therefore, after the interrupt return instruction is executed, the original sampled value written to the general-purpose register during the interrupt is restored to its pre-interrupt value, and the original sampled value is overwritten from the general-purpose register.

[0033] In this embodiment, through the mechanism of automatically overwriting the current sample point value in the general-purpose register when subsequent sample points arrive, and the mechanism of automatically restoring the hardware context upon interrupt return, the existence time of the original sample point in the general-purpose register is strictly limited to a single interrupt processing cycle. This double overwriting mechanism ensures that the lifespan of the original sample point value is relatively short. In the prior art, after a sample point is written to main memory, its lifespan is managed by software and may last for several milliseconds, several seconds, or even longer until the memory address is explicitly cleared or overwritten by subsequent data. During this period, attackers have a long time window to scan memory and copy data; however, in the solution of this application, the lifespan of the original sample point is limited by the hardware mechanism to a single interrupt processing cycle, typically only tens to hundreds of processor clock cycles, and disappears from the system after being overwritten; after interrupt return, the interrupt service routine does not maintain variables across interrupt cycles to save historical sample data, and there is no accessible historical sample data in the system. This short lifespan significantly increases the difficulty for attackers to capture and copy the original sample point within such a short time window. At any given time, there is no copy of the original sampling point in any memory space addressable by user-level code, thus eliminating the possibility of data being copied in bulk and leaked on a large scale.

[0034] In this design, from the peripheral data register to the general-purpose register, and throughout the entire process of computation within the general-purpose register, the original biosignal sampling points are not written to any memory space addressable by user-level code. This constraint is the core architectural feature that distinguishes this application from the prior art's "store first, process later" paradigm. Memory spaces addressable by user-level code include, but are not limited to, SRAM, DRAM, Flash, and user-visible TCM; the processor's general-purpose register set does not belong to memory spaces addressable by user-level code because general-purpose registers do not have memory addresses, and user-level code cannot address or read / write general-purpose registers through memory access instructions. This architectural isolation allows this application to achieve a secure processing architecture where algorithms can use raw data for computation but it is difficult to obtain and retain the complete original waveform, without changing the computational logic of the third-party algorithm itself, simply by changing the physical location and lifecycle of the data. This eliminates the need for large-scale modifications to existing algorithms, reducing the implementation cost and migration difficulty of the security solution, and is suitable for wearable medical devices with limited resources and high security requirements.

[0035] Step 3: Construct a progressive relationship for the data transmission path, so that there is no intermediate step of writing the original biological signal sampling points into the main memory between the starting node and the ending node, and the output area written at the ending node is the scalar calculation result rather than the original biological signal sampling points themselves.

[0036] This step further includes the following sub-steps: Step 3.1: Obtain the starting node of the data path based on the sampled value latched in the peripheral data register after the analog-to-digital converter completes the sampling.

[0037] Specifically, the starting node is the peripheral data register of the analog-to-digital converter, which is the first location of the original biological signal sampling point in the digital system. It is automatically latched by hardware without the need for software intervention.

[0038] In this embodiment, the starting node is located in a peripheral hardware register, which is physically independent of the main memory and can be configured to be invisible to user-level code through subsequent memory protection unit configuration. Setting the starting point of the data path in the peripheral hardware register rather than the main memory avoids the original sampling point from entering the user-level addressable space from the source. In the prior art, the starting point of the data path is actually a buffer in the main memory. The data path only truly begins after the sampling point is written to the main memory from the peripheral register by DMA or software. This means that the original data is exposed to an insecure environment from the very beginning. The data path starting node design of this application moves the security boundary forward to the peripheral hardware level, bringing the security control scope under control from the very first station of data entering the digital system.

[0039] Step 3.2: Based on the starting node, the sampled value is transferred to the processor's general-purpose register using a single load instruction to obtain the intermediate node of the data path. The data at the intermediate node exists only in the general-purpose register.

[0040] Specifically, at this intermediate node, the data exists only in the processor's general-purpose registers; the execution of a single load instruction is atomic. During the execution cycle of this instruction, the data goes directly from the peripheral data register to the general-purpose register via the processor's internal data bus. The data transfer path does not pass through any main memory, and there is no intermediate step of temporarily storing the data in SRAM or DRAM.

[0041] In this embodiment, the intermediate node is located in the processor's general-purpose register. This is a location in the entire data path where data is in a computable state but cannot be addressed by user-level code. The atomicity of the load instruction ensures that data will not fall into the main memory window midway during transmission. The execution of a single instruction is indivisible; the processor's internal data bus directly transfers data from peripheral registers to general-purpose registers during instruction execution, without any intermediate storage. This design ensures that data will not linger or be intercepted at any intermediate node during transmission from the starting node to the intermediate node. In the prior art, the path from peripheral registers to the processor requires passing through the main memory as a relay station. The existence of this relay station itself is a potential source of security vulnerabilities. This application eliminates this relay station, changing the data path from intermittent to direct connection, thus eliminating the security risks of intermediate links.

[0042] Step 3.3: Based on the intermediate nodes, calculate in the general-purpose register to obtain the terminal node of the data path. Only the scalar calculation result is output at the terminal node.

[0043] Specifically, at this termination node, only the scalar calculation result is output; the calculation operation transforms, compresses or abstracts the original sampled values ​​in the general-purpose register, and the resulting scalar calculation result is no longer the original sampled point itself, but the statistical characteristics, judgment results or classification labels of the original sampled point after calculation.

[0044] In this embodiment, the output of the termination node is not the original sampling point, but a scalar result after computational transformation. This design creates a fundamental difference in the amount of information between the endpoint and the starting point of the data path. The original sampling point contains complete signal waveform information and can be used to reconstruct the original biological signal, while the scalar calculation result contains only limited feature information, losing the phase, timing, and details of the original waveform, making it difficult to restore the original signal. Even if an attacker controls the output area, they can only obtain the desensitized scalar result and cannot recover the original biological signal from it. This irreversible transformation from raw data to statistical features provides another layer of protection for data security at the endpoint of the data path. In existing technologies, the endpoint of the data path is often another memory buffer, which still stores copies of the original sampling points or intermediate results that have undergone simple processing but still retain the original waveform characteristics. Attackers can obtain the original signal from these buffers.

[0045] In this data transmission path, there are no intermediate steps between the starting and ending nodes where the original biosignal sampling points are written into main memory. At the ending node, what is written to the output area is the scalar calculation result, not the original biosignal sampling point itself. This data path design eliminates the possibility of the original sampling point entering the main memory space addressable by user-level code from a physical transmission perspective, thus largely eliminating the exposure window of the original data in memory. The entire data path acts like a secure tunnel. The original sampling point starts from the peripheral hardware register, passes through the processor's internal data bus, enters the general-purpose register, completes the calculation and transformation within the general-purpose register, and finally leaves the tunnel in the form of a scalar result to enter the output area. Throughout the entire process, the original sampling point does not leave this secure tunnel and is not exposed to the open space addressable by user-level code.

[0046] Step 4: Employ a data push mode to directly complete the entire process from data reading to computational output within the interrupt context; this step further includes the following sub-steps: Step 4.1: Based on the registration request submitted by the third-party algorithm through the privileged system call interface during the system initialization phase, obtain the callback function entry address stored in the callback vector table maintained at the privileged level.

[0047] Specifically, during the system initialization phase, third-party algorithms running at the user level submit registration requests to the system kernel or firmware through privileged system call interfaces. These registration requests include the entry address of the callback function and related parameter configuration information. Upon receiving the registration request, the privileged code stores the callback function's entry address in a callback vector table maintained by the privileged level. This callback vector table is located in a privileged-accessible memory area, which user-level code cannot directly read or modify.

[0048] In this embodiment, the decoupling of third-party algorithms from the system security mechanism is achieved through the system call interface and a callback vector table maintained at the privilege level. Third-party algorithms do not need to understand the implementation details of the underlying security mechanism; they only need to submit the callback function entry address according to the standard interface to complete registration. The callback vector table is maintained by privileged code and stored in a memory area inaccessible to user-level code, reducing the risk of malicious code tampering with the callback function entry address and thus hijacking the data processing flow. This design encapsulates the complexity of the security mechanism at the privilege level, providing a simple interface for user-level third-party algorithms, lowering the access barrier for algorithm developers, and ensuring that the security mechanism is not easily bypassed.

[0049] Step 4.2: Based on the interrupt signal triggered after the analog-to-digital converter completes one sampling, the execution trigger of the interrupt service routine is obtained.

[0050] Specifically, after the analog-to-digital converter completes one sampling conversion, it sends an interrupt request to the processor through the hardware interrupt signal line; the interrupt controller receives the interrupt request, determines the priority, and sends an interrupt signal to the processor core; the processor core responds to the interrupt, saves the current execution context, and jumps to the preset interrupt service routine entry address in the interrupt vector table to start executing the interrupt service routine.

[0051] In this embodiment, a hardware interrupt is used as the triggering mechanism for data processing, ensuring strict synchronization between data processing and sampling actions and eliminating the problems of missed or duplicated sampling points that may occur in polling mode. The interrupt triggering mechanism is automatically completed by hardware without software intervention, avoiding the latency uncertainty and power consumption overhead caused by software polling. The interrupt service routine runs in privileged processor mode and has full access to peripheral registers, while user-level third-party algorithms cannot directly trigger the interrupt service routine or modify the interrupt vector table, ensuring the security of the data processing entry point.

[0052] Step 4.3: Based on the execution trigger of the interrupt service routine, read the sampled value in the peripheral data register into the general-purpose register to obtain the register value of the current sampling point.

[0053] Specifically, the first task of the interrupt service routine is to read the raw biosignal sample value obtained from the current sampling from the peripheral data register. The interrupt service routine then executes a load instruction to load the sample value from the peripheral data register into a general-purpose register, thus obtaining the register value of the current sampling point. This step is consistent with step 2.1, ensuring that the sample value enters the general-purpose register directly without passing through the main memory.

[0054] In this embodiment, the interrupt service routine runs at the privileged level, while the execution of the load instruction is completed on the processor's internal data path, and the sampled value enters the general-purpose register directly from the peripheral data register. During this process, user-level third-party algorithms are suspended, unable to observe the transmission of the sampled value, and find it difficult to intercept the sampled value during transmission. As privileged code, the interrupt service routine is the only channel for the sampled value to enter the processor from the hardware. This channel is strictly controlled by the system firmware or kernel, forming a single entry point for reading the sampled value and eliminating the possibility of user-level code obtaining the sampled value through other paths.

[0055] Step 4.4: Based on the register value of the current sampling point and the entry address of the callback function, jump to the callback function for execution, and obtain the calculation process with the current sampling point value as the only input parameter.

[0056] Specifically, the interrupt service routine retrieves the pre-registered callback function entry address from the callback vector table, passes the register value of the current sampling point as the only input parameter to the callback function through a general-purpose register, and then jumps to the callback function for execution. The callback function is provided by a third-party algorithm, and the input it receives is only the value of the current single sampling point, rather than a pointer to a memory buffer. The callback function performs a calculation process, which takes only the value of the current single sampling point as input, and cannot access historical sampling data, nor can it save the current sampling point to user-accessible memory.

[0057] In this embodiment, by limiting the input parameter of the callback function to the current single sample point value and passing it through a general-purpose register, the possibility of third-party algorithms obtaining historical or batch sample data is eliminated at the interface level. In the prior art, third-party algorithms typically receive a pointer to a memory buffer as a parameter, through which they can access a large number of historical sample points stored in the buffer, and even traverse the entire buffer to obtain complete waveform data. In the solution of this application, the callback function receives only one sample point value each time it is called, and this value is passed through a general-purpose register. It is difficult for the callback function to deduce the values ​​of other sample points from this value, and it is also difficult to save the received sample point value to user-accessible memory, because the callback function itself is restricted by the memory protection unit and cannot access the protected memory area. This interface design compresses the data access permissions of third-party algorithms to a smaller scope, following the principle of least privilege.

[0058] Step 4.5: After the calculation process is completed, obtain the processing result containing only the value of the current single sampling point.

[0059] Specifically, after the callback function completes its execution, it returns the processing result to the interrupt service routine. The interrupt service routine writes the processing result to the specified output area and then executes the interrupt return instruction. After the interrupt returns, the processor restores the context before the interrupt, the original sampled point values ​​in the general-purpose registers are overwritten, and the original sampled points disappear from the system.

[0060] In this embodiment, the entire data push process is completed within a single interrupt handling cycle, from reading the sampled value to calculating and outputting the result, all in one go, without any data lingering in between. After the processing result is written to the output area, the original sampled point value is automatically overwritten by the hardware upon interrupt return, leaving no trace. This atomic processing flow ensures that the processing of each sampled point is independent and isolated, and there is no data overlap between the processing of different sampled points. Even if an attacker obtains some information during an interrupt handling process through some means, it is difficult to correlate it with other sampled points to construct a complete waveform. The overall technical effect of the data push mode is that it puts the initiative for data processing in the hands of the system rather than a third-party algorithm. The system actively pushes the sampled points to the callback function for processing, while the third-party algorithm passively receives them and has no right to actively request or obtain sampled data, thereby changing the ownership of data access control.

[0061] Step 5: Define the data lifecycle of the original biosignal sampling points to satisfy the progressive constraint relationship; this step further includes the following sub-steps: Step 5.1: Based on the time when the original biosignal sampling point is read into the general-purpose register, obtain the survival start point of the sampling point in the general-purpose register.

[0062] Specifically, the survival start point corresponds to the clock cycle after the load instruction is completed. From this moment on, the original sampled value begins to exist in the general-purpose register.

[0063] In this embodiment, the starting point of the original sampling point's lifecycle is precisely defined at the clock cycle after the load instruction is executed. This time point is precisely controlled by the hardware instruction execution timing, eliminating any ambiguity in the time window. In existing technologies, the time when a sampling point is written to main memory depends on the completion time of DMA transfer or software write, which is affected by factors such as system load and bus arbitration, resulting in uncertainty. This application, through precise timing control at the instruction level, enables the precise tracking and auditing of the starting point of the sampling point's lifecycle, providing a deterministic time benchmark for security analysis.

[0064] Step 5.2: Based on the moment when the calculation operation is completed and the scalar calculation result is written to the output area, obtain the valid calculation termination point of the sampling point in the general-purpose register.

[0065] Specifically, the effective calculation termination point corresponds to the clock cycle in which the store instruction is completed. From this moment on, the calculation mission of the original sample point has been completed, and its value in the general-purpose register has lost its practical utility, even if it has not been overwritten.

[0066] In this embodiment, the effective lifespan of the original sampling point is precisely tied to the completion of the computation mission. Once the scalar computation result is written to the output area, the original sampling point loses its meaning. After the effective computation termination point, even if the original sampling point value has not yet been overwritten in the general-purpose register, the value is no longer used by any subsequent computation; its existence is merely a residual value waiting to be overwritten. This design ensures that the effective lifespan of the original sampling point is compressed to the minimum time required to complete the computation, and will not be extended due to delays or oversights in software logic. In the prior art, the existence time of the sampling point in the main memory is often much longer than the actual computation time required, because the software needs to explicitly clear or overwrite the memory area, and such clearing operations may be delayed, omitted, or bypassed.

[0067] Step 5.3: According to the operation of restoring the old value of the general-purpose register before the interrupt when the interrupt service routine executes the interrupt return instruction, the point where the value of the original biosignal sampling point in the general-purpose register is overwritten with the old value is obtained.

[0068] Specifically, this extinction point corresponds to the clock cycle in which the interrupt return instruction is completed. The processor hardware automatically restores the old values ​​of the general-purpose registers saved before the interrupt from the stack, overwriting the original sample point values ​​written during the interrupt. The original sample point values ​​are then cleared from the general-purpose registers.

[0069] In this embodiment, the deletion of the original sampling point is automatically completed by the processor hardware without explicit software clearing, eliminating the security risks that software clearing operations may be bypassed or delayed. The mechanism by which the processor hardware automatically restores the context upon interrupt return is an inherent feature of the processor architecture and cannot be modified or bypassed by software. This means that the deletion of the original sampling point is mandatory. Regardless of whether there are vulnerabilities in the implementation of the interrupt service routine, the hardware will automatically overwrite the value in the general-purpose register upon interrupt return. This mandatory hardware lifecycle termination mechanism provides a high level of protection for data security because it is difficult for attackers to prevent the hardware from restoring the context through software attacks.

[0070] Step 5.4: Based on the constraint that the interrupt service routine after the disappearance point does not maintain any cross-interrupt cycle variables to save historical sampling data, the final state of the original biological signal sampling point disappearing from the system is obtained.

[0071] Specifically, the lifecycle of each sampling point is strictly limited to a single interrupt handling cycle, from the start of the load instruction to the end of the interrupt return; after the interrupt returns, there is no accessible historical sampling data in the system, and the original sampling point disappears from the system.

[0072] In this embodiment, by restricting the interrupt service routine from maintaining historical data variables across interrupt cycles, the attack path of reconstructing the complete waveform by accumulating single sampling points is fundamentally eliminated. In the prior art, even if the processing of a single sampling point is secure, an attacker may still obtain the complete waveform by monitoring the historical data buffer in memory for a long time. In the solution of this application, each sampling point exists independently and disappears after processing. There is no accumulation of historical sampling data in the system, making it difficult for attackers to reconstruct the original signal through data aggregation in the time dimension. This design extends data security from the spatial dimension to the temporal dimension, achieving protection in both the spatiotemporal dimensions.

[0073] Step 6: For computational scenarios requiring local time windows, a hardware-managed sliding window processing step is adopted; this step further includes the following sub-steps: Step 6.1: Based on the new sampling points generated by the analog-to-digital converter, obtain the write trigger of the DMA controller's cyclic transfer mode.

[0074] Specifically, after the analog-to-digital converter completes sampling, in addition to generating an interrupt signal, it can also generate a DMA request signal. The DMA controller is pre-configured to a circular transfer mode, with its source address fixed to the peripheral data register address of the analog-to-digital converter, the destination address to the base address of the circular buffer, and the transfer length fixed to the size of the circular buffer. Each time the analog-to-digital converter generates a new sampling point, the DMA controller receives a write trigger.

[0075] In this embodiment, a DMA controller circular transfer mode is used for writing sample points. The transfer process of sample points from the peripheral data register to the circular buffer is completely managed automatically by the hardware without software intervention. This frees up the processor's computing resources, allowing the processor to focus on executing third-party algorithm computation tasks, thus improving the overall processing efficiency of the system. Furthermore, since DMA transfer is automatically triggered and executed by hardware, unaffected by software logic, it avoids the latency uncertainties caused by software polling or interrupt handling, ensuring the real-time performance and reliability of sample point writing. In addition, the automatic overwrite mechanism of the DMA controller in circular transfer mode ensures that the circular buffer always stores the N most recent sample points, with new data automatically overwriting the oldest data. This eliminates the need for software management of the buffer pointer, simplifying system design and reducing the possibility of software errors.

[0076] Step 6.2: Based on the write trigger, the new sampling point is automatically written to the address of the oldest data in the fixed-size circular buffer, so as to obtain the buffer state after the new data overwrites the oldest data.

[0077] Specifically, in response to a write trigger, the DMA controller transfers a new sample point from the peripheral data register to the address pointed to by the current write pointer in the circular buffer. The write pointer is automatically incremented after each transfer. When the write pointer reaches the end of the circular buffer, it automatically wraps back to the beginning address of the buffer, and the new data naturally overwrites the oldest data stored at that address. The circular buffer always maintains a complete record of the most recent N sample points, where N is the size of the circular buffer.

[0078] In this embodiment, the fixed size of the circular buffer and the mechanism of automatically overwriting the oldest data with new data inherently limit the number of historical sampling points that can be stored. The buffer capacity is determined and locked during the hardware design phase and cannot be modified by software, preventing attackers from obtaining more historical sampling data by expanding the buffer. The strategy of overwriting the oldest data with new data ensures that the data stored in the buffer is always the sampling points within the most recent time window, and old data is automatically cleared, preventing the infinite accumulation of historical data. This design, while meeting the requirements of windowed computing, limits the scope and duration of historical data storage, achieving a balance between functionality and security.

[0079] Step 6.3: Based on the buffer state, configure the physical address space of the ring buffer to be invisible to user-level code through the memory protection unit, thereby obtaining an isolation state in which there is no ring buffer mapping in the user-level address space.

[0080] Specifically, the memory protection unit is configured to set the physical address region occupied by the circular buffer to be accessible only to privileged users; in the address space view of user-level code, there is no valid address mapping for this physical address region; when user-level code attempts to access this address region, the memory protection unit hardware directly triggers an access violation exception to prevent access.

[0081] In this embodiment, although the circular buffer physically exists in main memory, it is completely invisible and inaccessible to user-level code through the isolation configuration of the memory protection unit. This isolation mechanism is enforced by the hardware memory protection unit, which performs permission checks on every memory access, making it impossible for software to bypass. Even if a user-level third-party algorithm knows the physical address of the circular buffer, it cannot read the data within it through any memory access instruction, because the memory protection unit directly intercepts the access and triggers an exception during the address translation stage. This hardware-level isolation provides the circular buffer with security protection similar to that of general-purpose registers, making it equivalent to privileged private storage in terms of access permissions, even though the circular buffer physically belongs to main memory. This design incorporates a portion of the main memory into the security domain through a hardware protection mechanism, expanding the boundaries of secure storage while also being compatible with the needs of windowed computing.

[0082] Step 6.4: Based on the isolation status, submit the relative index parameter through the API interface to obtain the sampled value of the corresponding position returned by the API interface.

[0083] Specifically, when a third-party algorithm needs to read a historical sample value within a window, it submits a relative index parameter to the privileged code via an API interface. This relative index parameter represents the offset relative to the latest sample point; for example, an offset of 0 represents the current sample point, and an offset of 3 represents the third sample point counting backwards. The API interface executes within the privileged code, calculates the actual physical address in the circular buffer based on the relative index parameter, reads the sample value from that address, and returns the sample value to the caller via a general-purpose register. After obtaining this sample value, the third-party algorithm directly uses it for calculations within the general-purpose register and must not write this value to user-addressable memory.

[0084] In this embodiment, a controlled data access method is provided through the API interface. Third-party algorithms cannot directly traverse or scan the circular buffer; they can only obtain sampled values ​​within the window point by point by specifying relative indices, and can only obtain one sampled point at a time. The API interface runs at the privileged level, where access control policies can be implemented, such as limiting the API call frequency, recording access logs, and detecting abnormal access patterns. Sampled values ​​are returned through general-purpose registers, continuing the security constraint that data does not enter the user-level addressable memory space. This design, while meeting the requirements of windowed computation, maintains the principle of least privilege for data access. Third-party algorithms can only obtain the specific sampled points required for computation, and cannot obtain other sampled points within the window, let alone the complete historical data sequence. The API interface becomes the only legitimate channel for data access in the circular buffer, and the system can deploy security monitoring and auditing mechanisms on this channel to achieve comprehensive control over data access.

[0085] Step 7: Apply safety constraints to the circular buffer to satisfy the progressive relationship; this step further includes the following sub-steps: Step 7.1: Based on the buffer size parameters determined by register configuration during the hardware design phase, obtain the fixed configuration values ​​for writing to the one-time programmable memory area.

[0086] Specifically, during the chip or device hardware design phase, the size parameter of the circular buffer is determined by the configuration register. This size parameter is written into a one-time programmable storage area, such as eFuse or OTP memory. Once written, the one-time programmable storage area cannot be modified, ensuring that the buffer size parameter remains unchanged throughout the entire life cycle of the device.

[0087] In this embodiment, the buffer size parameter is fixed in a one-time programmable storage area, physically eliminating the possibility of software modification of the buffer size. The physical characteristics of one-time programmable memory determine that its storage units cannot be erased or reprogrammed after programming. Any attempt to modify this parameter is physically impossible. This hardware-level fixation provides a high level of integrity protection for the buffer size. Attackers cannot obtain more sampling data by increasing the buffer size, nor can they disrupt the normal operation of the system by decreasing the buffer size. The immutability of the buffer size also provides a reliable basis for subsequent boundary checks, because the source of the size parameter relied upon by the boundary checks is trustworthy and tamper-proof.

[0088] Step 7.2: Based on the fixed configuration values, obtain the hardware lock state where the size of the circular buffer cannot be modified by any software after the device leaves the factory.

[0089] Specifically, because the buffer size parameter is stored in a one-time programmable storage area, no software, including privileged firmware and operating system kernels, can modify this parameter after the device leaves the factory. The size of the circular buffer is hardware-locked, creating an irreversible hardware-locked state.

[0090] In this embodiment, the hardware lock state ensures that even if an attacker gains the highest system privileges, the size of the circular buffer cannot be modified. This protection mechanism does not rely on software integrity but is rooted in the physical characteristics of the hardware. In embedded systems, attackers may exploit vulnerabilities to gain privileged code execution rights, thereby bypassing software-level security mechanisms; however, with hardware lock, even code with the highest privileges cannot modify parameters stored in a one-time programmable storage area because this storage area physically does not support write operations. This design achieves defense-in-depth, meaning that even if the upper-layer security mechanisms are breached, hardware lock still provides a line of defense for data security.

[0091] Step 7.3: Based on the hardware lock status, the hardware DMA controller automatically performs a boundary check during each data transfer, and returns an error or a zero value as a rejection response for address access requests that exceed the buffer size.

[0092] Specifically, the DMA controller integrates boundary check hardware logic. During each DMA transfer, the hardware automatically compares the target address with the legal address range of the ring buffer. The legal address range is determined by the buffer base address and the buffer size. If the target address exceeds the legal range, it indicates that the DMA controller configuration may have been tampered with. The hardware directly returns an error response or a transfer zero value and refuses to execute the out-of-bounds transfer.

[0093] In this embodiment, boundary checks are automatically performed by the DMA controller hardware, independent of software, and difficult to bypass. Boundary checks are triggered with every DMA transfer, with the check frequency matching the data transfer frequency, eliminating blind spots. The hardware boundary check response time is on the nanosecond level, having no perceptible impact on data transfer performance. When out-of-bounds access is detected, the hardware directly rejects the transfer and returns an error or zero value, preventing data from being written to unauthorized areas. This hardware-level boundary check effectively prevents attackers from copying the contents of the circular buffer to user-accessible memory areas by tampering with the DMA controller configuration. Even if an attacker successfully modifies the DMA controller's target address register, the boundary check hardware will intercept the data transfer.

[0094] Step 7.4: Based on the rejection response, obtain the safe state where the complete contents of the circular buffer cannot be copied via pointer arithmetic or DMA.

[0095] Specifically, based on the aforementioned boundary checking mechanism and the isolated configuration of the memory protection unit, attackers cannot access the ring buffer through pointer operations in user-level code, nor can they copy the contents of the ring buffer in batches to user-accessible memory areas by reconfiguring the DMA controller; although the ring buffer physically exists in main memory, its contents are protected by multiple hardware-level safeguards and cannot be exported in batches.

[0096] In this embodiment, the contents of the circular buffer are effectively locked within the secure domain through dual protection of memory protection unit isolation and DMA boundary checks. The memory protection unit prevents direct access by user-level code, and the DMA boundary checks prevent indirect data export via DMA, thus blocking both attack paths. Even if an attacker controls both the user-level code and the DMA controller configuration, it is difficult to breach these two layers of hardware protection. This multi-layered protection mechanism achieves defense in depth; the failure of any single protective measure will not lead to the collapse of the overall security state. Although the circular buffer physically belongs to main memory, its security attributes reach a protection level similar to that of general-purpose registers, effectively ensuring the security of raw data in windowed computing scenarios.

[0097] Step 8: Perform a feature-level desensitization output step to convert the output values ​​into statistical features, eliminating the risk of leakage of original signal features; this step further includes the following sub-steps: Step 8.1: Based on the calculation process completed in the general-purpose register or the circular buffer window, obtain the original calculation result to be output.

[0098] Specifically, after the third-party algorithm completes the calculation process in the general-purpose register or with the help of the sampled values ​​provided by the circular buffer window, it obtains the original calculation result to be output. Although the original calculation result has been processed, it may still contain some characteristic information of the original signal, such as signal amplitude and trend, which requires further desensitization processing.

[0099] In this embodiment, the output stage of the computation process is identified as a potential data leakage risk point. Although the computation process is completed within a general-purpose register, if the computation result is directly output, it may still carry information sufficient to infer the characteristics of the original signal. For example, if a simple filtered output value is output in the form of its original amplitude, an attacker can approximately reconstruct the original signal waveform by collecting consecutive filtered output values. Therefore, adding a desensitization process before output is a necessary supplement to the security of the computation process, forming a full-chain security protection from data reading, computation to output.

[0100] Step 8.2: Based on the original calculation results to be output, convert them into statistical features through the output API to obtain output values ​​that meet the desensitization conditions.

[0101] Specifically, the output API performs anonymization on the original calculation results to be output, converting them into statistical feature values. The anonymization conditions must meet at least one of the following: First, the result is a relative value or ratio rather than the absolute amplitude of the original sampling point; for example, the ratio of the current ECG signal amplitude to the average amplitude of the previous minute, rather than the absolute value of the current amplitude. Second, the result is a statistical quantity that loses the phase and temporal details of the original waveform; for example, the output includes statistical quantities such as mean, variance, kurtosis, or skewness within a time window, which cannot be used to reconstruct the original waveform. Third, the result is a classification result or probability value; for example, the output includes a classification code for the type of arrhythmia or a probability value indicating a normal state.

[0102] In this embodiment, by constraining the desensitization conditions, the output value is transformed from a calculation result that may contain features of the original signal into an irreversible statistical feature. Relative values ​​or ratios lose the absolute amplitude information of the original signal; even if an attacker obtains the ratio sequence, it is difficult to know the actual voltage value of the original signal because of the lack of an absolute reference. Statistics lose the phase and timing details of the original waveform; it is difficult for an attacker to reconstruct the shape and timing relationship of the original waveform from the mean and variance. Classification results or probability values ​​further compress the information into discrete category labels or probabilities; the amount of information is compressed, making it difficult to recover the original signal. These desensitization conditions ensure that the amount of information in the output value is much smaller than that in the original sampling points, and that reverse deduction from the output value to the original sampling points is mathematically or computationally infeasible, achieving a one-way irreversible conversion of information.

[0103] Step 8.3: Based on the output value that meets the de-identification conditions, write it to an independent storage area isolated from the original data buffer through the output API to obtain the final de-identified output.

[0104] Specifically, the output API writes the anonymized output values ​​to a separate storage area. This separate storage area is physically separated from the circular buffer and has independent memory protection unit access control attributes. Its access permissions and lifecycle are strictly isolated from the original data buffer. Even if an attacker gains access to this separate storage area, they can only obtain the anonymized statistical feature values ​​and will find it difficult to recover the original biological signal waveform.

[0105] In this embodiment, by storing the anonymized output in a separate storage area physically isolated from the original data buffer, the storage space of the original data and the output data is separated. This physical isolation ensures that even if an attacker successfully gains access to the output area, it is difficult to trace back to the original data buffer through the output area, because the two are not adjacent or related in terms of physical address. Independent memory protection unit access control attributes allow the system to set different access policies for the output area and the original data buffer. For example, the output area can be configured to be readable by user-level code, while the original data buffer remains invisible to the user level. This satisfies data output requirements without reducing the security protection level of the original data. This storage isolation design embodies the idea of ​​security domain division, isolating data of different security levels in different storage domains to prevent data access in low-security-level domains from being used to attack high-security-level domains.

[0106] Step 9: Perform verification and monitoring on the de-identified output to form a multi-layered protection mechanism; this step further includes the following sub-steps: Step 9.1: Based on the output value received from the output API, perform a value range check to obtain a judgment result on whether the output value is within the preset clinical significance range.

[0107] Specifically, after receiving the output value, the output API first performs a value range check. The system presets reasonable ranges for various output indicators in a clinical sense. For example, the reasonable range for heart rate is approximately 20 to 250 beats per minute; output values ​​outside this range are physiologically unlikely to occur. The output API compares the output value with this preset range to determine whether the output value is within a reasonable range.

[0108] In this embodiment, the value range verification utilizes prior knowledge of the clinical significance of biological signals, providing the first semantic-based verification barrier for the output value. Biological signals have clear physiological boundaries; output values ​​exceeding these boundaries may indicate an anomaly in the data processing process or the injection of abnormal data by an attacker. This semantic-based verification differs from simple format verification; it can detect anomalies in data content, even if the abnormal data is formatted correctly. By pre-setting a clinically meaningful range, the system can quickly identify and intercept abnormal outputs, preventing abnormal data from entering downstream systems. It can also serve as a monitoring indicator of system operation status, promptly detecting potential attacks.

[0109] Step 9.2: Based on the judgment result that it is out of range, intercept the output value and prevent it from being written.

[0110] Specifically, if the value range verification result is that the output value exceeds the preset clinical significance range, the output API directly intercepts the output value and prevents it from being written to the output area. At the same time, a security alarm event can be generated to notify the system security monitoring module.

[0111] In this embodiment, the interception action is performed before the output value is written to the output area, achieving real-time blocking and preventing abnormal data from being consumed by downstream systems after entering the output area. The interception action is immediate and unbypassable because the output API is the only legitimate channel for writing to the output area, and all output values ​​must undergo value range validation. Generating a security alarm event enables the system security monitoring module to promptly detect abnormal situations and trigger further investigation and response measures, such as increasing audit log records, temporarily freezing the output channel, and notifying the system administrator. This mechanism of immediate interception and alarm not only prevents current security threats but also provides information support for subsequent security analysis and response.

[0112] Step 9.3: Based on the cumulative number of calls to the output API within a unit of time, perform output frequency monitoring to obtain the monitoring results of whether the call frequency exceeds the preset upper limit.

[0113] Specifically, the output API maintains a call counter for a unit of time. The system presets an upper limit for the output frequency, for example, a maximum of 10 output calls per second. Each time the output API is called, it checks the cumulative number of calls within the current unit of time to obtain a monitoring result indicating whether the call frequency exceeds the preset upper limit.

[0114] In this embodiment, output frequency monitoring targets attacks where attackers use high-frequency output to acquire a large number of data points, thus approximating the original signal waveform. Even if each output value is anonymized, if the output frequency is high enough, attackers can still infer the characteristics of the original signal by collecting a large number of output values. Setting an upper limit on the output frequency restricts the number of data points an attacker can acquire per unit time, thereby limiting their ability to aggregate data over time. The unit time window and frequency upper limit can be configured according to the security requirements of specific application scenarios, flexibly adjusting between data availability and security. Output frequency monitoring controls the risk of data leakage in the time dimension, complementing the value range verification's control in the numerical dimension.

[0115] Step 9.4: Based on the monitoring result that the upper limit has been exceeded, a rate limiting action is taken to prevent subsequent output.

[0116] Specifically, if the output frequency monitoring result shows that the call frequency exceeds the preset limit, the output API will trigger a rate limiting action, blocking the current and subsequent output requests until the counter is reset at the start of the next time window.

[0117] In this embodiment, the rate limiting action takes effect immediately when the output frequency exceeds the upper limit, blocking subsequent output requests and controlling the amount of output data per unit time within a safe range. The duration of the rate limiting action is a complete time window, during which all output requests are rejected, ensuring strict enforcement of the output frequency upper limit. The counter automatically resets at the end of the time window, resuming normal output and avoiding the impact of permanent blocking on system functionality. This rate limiting mechanism, which combines a time window and automatic reset, ensures the effectiveness of safety constraints without affecting the long-term normal operation of the system, achieving a balance between security and availability.

[0118] Step 9.5: Based on the continuous output sequence in application scenarios with high security requirements, perform an information entropy check to obtain the identification result of whether the output sequence presents the statistical characteristics of the original sampled data.

[0119] Specifically, in applications with high security requirements, such as those involving medical privacy data or military applications, the output API performs an information entropy check on the continuous output sequence. The information entropy check calculates the information entropy value of the output sequence and compares it with known characteristic values ​​of the information entropy of the original sampled data. If the information entropy of the output sequence is close to the entropy value of the original signal, it indicates that the output sequence may retain the statistical characteristics of the original data, posing a risk of original data leakage.

[0120] In this embodiment, information entropy checking is a deep detection method based on information theory, capable of detecting whether the output sequence is similar to the original sampled data at the statistical feature level. Even if the output value meets the requirements in terms of numerical range and frequency, if the information entropy feature of the output sequence is highly similar to the original signal, it may still mean that the desensitization process is insufficient, and a large amount of original signal information remains in the output value. Information entropy checking does not rely on specific numerical ranges or frequency thresholds, but rather evaluates the similarity between the output sequence and the original signal from the perspective of information content, enabling the detection of more hidden data leakage risks. This check is suitable for scenarios with high security requirements, providing the system with configurable security protection depth, and users can decide whether to enable this check based on their own security needs.

[0121] Step 9.6: Based on the recognition result, which presents the characteristics of the original sampled data, the second protection action is to identify the output as the original sampled data stream and intercept and replace it with the preset default value.

[0122] Specifically, if the information entropy check indicates that the output sequence exhibits characteristics of raw sampled data, the output API identifies the output sequence as a suspected raw sampled data stream, triggering a second layer of protection. This second layer of protection includes: intercepting the output sequence to prevent further output; and replacing the output value with a preset default value, such as outputting a fixed safe value or a null value.

[0123] In this embodiment, the second layer of protection is triggered after the information entropy check identifies a risk. This complements the value range verification and output frequency monitoring, forming a defense-in-depth system. The interception action prevents the output sequence suspected of leaking original data from continuing to output, and the replacement with a preset default value ensures that the output interface is not interrupted by the interception. Downstream systems can still receive output values, but the received content is the safe and harmless default value, thus maintaining the normal operation of the system while ensuring security. The three protection mechanisms—value range verification, output frequency monitoring, and information entropy check—verify and monitor the output data from three dimensions: numerical rationality, time frequency, and information statistical characteristics, forming a multi-dimensional, multi-layered defense-in-depth system. Any single-dimensional attack method will find it difficult to bypass all three layers of protection simultaneously.

[0124] Step 10: Perform privileged-level security isolation procedures, which further include the following sub-steps: Step 10.1: According to the configuration instructions of the memory protection unit, configure all peripheral register addresses of the analog-to-digital converter to be accessible only to privileged level, thereby achieving an isolation state in which user-level code cannot directly access the physical address of the peripheral data register.

[0125] Specifically, during the system initialization phase, privileged code configures the address range of all peripheral registers of the analog-to-digital converter, including the control register, status register, and data register, to be accessible only to privileged users through the configuration instructions of the memory protection unit. The memory protection unit checks the current processor's operating mode during each memory access. If it is in user mode and the access address falls within the address range of the peripheral registers, the memory protection unit hardware directly triggers an access violation exception to prevent the access.

[0126] In this embodiment, a memory protection unit isolates the peripheral register address space from the view of user-level code, cutting off the possibility of user-level code directly accessing the hardware interface of the raw sampled data at the source. The memory protection unit performs permission checks during the address translation phase. These checks are completed at the hardware level with a response time on the nanosecond scale, minimizing the impact on system performance. Access violation exceptions are triggered instantly and cannot be bypassed. User-level code cannot easily bypass the memory protection unit's checks through any tricks, as the memory protection unit is an essential step in the processor's address translation path. This isolation mechanism brings the hardware source of the raw sampled data under privileged protection, ensuring that only authorized privileged code can access the peripheral data registers, thus setting up a hardware barrier for user-level code.

[0127] Step 10.2: Based on the isolation state, the operation of reading the sampled value from the peripheral data register is performed only in the privileged interrupt service routine, resulting in a safety constraint that the sampled value can only be read by privileged code.

[0128] Specifically, because the peripheral data register is configured to be accessible only to privileged level users, the operation of reading sampled values ​​from the peripheral data register can only be performed in a privileged level interrupt service routine. The interrupt service routine runs in privileged level processor mode and has full access to the peripheral register. User-level code cannot bypass the interrupt service routine to directly read sampled values ​​from the peripheral data register, and the operation of reading sampled values ​​is strictly limited to privileged level code.

[0129] In this embodiment, the sampling value reading operation is confined to the privileged interrupt service routine, establishing a single trusted channel for sampling value reading. User-level code cannot directly access peripheral data registers, nor can it create or inject interrupt service routines. Therefore, it is difficult to directly obtain the original sampling value in any way. This single trusted channel design simplifies the complexity of security auditing. Security auditing only needs to focus on the sampling value reading and processing logic in the privileged interrupt service routine, without worrying about hidden data acquisition paths that may exist in user-level code. The centralization of sampling value reading operations also facilitates the implementation of access control and audit log recording, providing a clear operation trajectory for data traceability.

[0130] Step 10.3: Based on security constraints, the third-party algorithm runs at the user level and interacts with the privileged level through the system call interface to obtain the restriction status that the third-party algorithm cannot access the control register or data register of the analog-to-digital converter.

[0131] Specifically, the third-party algorithm code runs in user-level processor mode, and all its memory accesses are constrained by the memory protection unit. The third-party algorithm interacts with the privileged code through system call interfaces such as the SVC instruction or ECALL instruction to request sampled values ​​or submit processing results. Since the implementation of the system call interface is controlled by the privileged code, the third-party algorithm cannot indirectly access the control register or data register of the analog-to-digital converter through the system call interface, nor can it modify the configuration of the memory protection unit or the DMA controller.

[0132] In this embodiment, fine-grained control over the capabilities of third-party algorithms is achieved by restricting their operation to the user level and controlling the system call interface as the sole channel for interaction with the privileged level. The third-party algorithm runs at the user level, and its operations are fully constrained by the memory protection unit, preventing it from accessing any protected memory regions or peripheral registers. The system call interface, as the sole communication channel between the user level and the privileged level, is strictly controlled by the privileged code. This privileged code can implement security policies such as parameter validation, permission checks, and frequency limits at the system call interface, ensuring that the third-party algorithm cannot indirectly obtain data it should not access or perform operations it should not perform through the system call interface. This design supports the openness of the third-party algorithm ecosystem while ensuring that the system security boundary is not breached, achieving a balance between openness and security.

[0133] Step 10.4: Based on the constraint state, obtain the definition of the memory space that can be addressed by user-level code, including SRAM, DRAM, Flash, and TCM visible to the user level.

[0134] Specifically, in embedded systems, the memory spaces addressable by user-level code are defined, including Static Random Access Memory (SRAM), Dynamic Random Access Memory (DRAM), Flash memory, and User-visible Tightly Coupled Memory (TCM). User-level code can read and write to any location within these memory spaces using load and store instructions. If the original sampling point appears anywhere within these memory spaces, the user-level code can acquire and copy that original sampling point.

[0135] In this embodiment, by clearly defining the range of memory space addressable by user-level code, a clear spatial boundary is provided for security analysis. Security analysis only needs to focus on whether the original sampling point appears at any location within the aforementioned memory space. If it does not appear in these spaces, user-level code cannot obtain the original sampling point through memory access instructions. This clear definition transforms the vague security concept into a verifiable binary judgment: whether the data exists in the memory space addressable by user-level code. This binary judgment can be transformed into specific checks in system design and security auditing, making the verification of security attributes operable and testable.

[0136] Step 10.5: Based on the determination results, the processor's general-purpose register set is finally determined to not belong to the memory space that can be addressed by user-level code.

[0137] Specifically, the processor's general-purpose register set is a memory unit within the processor core and is part of the processor's data path. General-purpose registers are directly referenced in instruction encoding via register numbers; they do not have memory addresses and cannot be addressed via the address bus. User-level code cannot access general-purpose registers by address using load or store instructions; therefore, the general-purpose register set is not part of the memory space addressable by user-level code. User-level code refers to any code running in the processor's non-privileged mode, including operating system user-mode processes, third-party applications, and callback functions submitted through system call interfaces. Their common characteristic is that they do not have the permission to directly access the physical addresses of peripheral registers.

[0138] In this embodiment, by ultimately determining that the general-purpose register set does not belong to the memory space addressable by user-level code, a solid theoretical foundation is provided for the entire security architecture. This determination is based on the fundamental principles of processor architecture, has universal applicability, and is not dependent on a specific processor model or architecture. The fact that general-purpose registers do not have memory addresses and that user-level code cannot address them through memory access instructions is deterministic and immutable at the processor architecture level. Therefore, the original sampling point exists in the general-purpose register and does not constitute the original data residing in the memory space addressable by user-level code. This final determination gives the security architecture of this application architectural-level reliability, independent of the correctness of software implementation or specific hardware security extensions, and is instead an architectural security scheme rooted in the basic working principles of the processor.

[0139] This embodiment fully implements an embedded biosignal security processing method that ensures raw data is not resident in memory, through the steps described above. In the existing storage-before-processing paradigm, raw biosignal sampling points typically need to reside completely in main memory in plaintext form. From the moment the sampling point is written into the main memory address space until that address is explicitly cleared or overwritten by subsequent data, the raw sampling point persists in main memory and can be repeatedly read, referenced, and copied by any code with access to that address space. In an open algorithm ecosystem, third-party algorithm code, malicious programs, or DMA attacks can directly read the raw sampling values ​​within this memory exposure window, thereby obtaining complete biosignal waveform data. Even with protection measures such as storage encryption or trusted execution environments, it is difficult to change the architectural premise that raw data needs to be decrypted or exposed in memory before it can be computed. With the popularization of wearable medical devices and brain-computer interface technology, this memory-resident mode constitutes a fundamental bottleneck for biosignal privacy protection.

[0140] In this embodiment, based on the sampling action of the analog-to-digital converter on the biological signal, the original biological signal sampling points latched in the peripheral data register are obtained. These points are then directly read into the processor's general-purpose register for calculation using the load instruction. This eliminates the intermediate step of writing the original sampling points to main memory, effectively eliminating the possibility of the original data residing in plaintext in memory space addressable by user-level code, and reducing the memory exposure window. Due to the constraint that only the scalar calculation result is written to the output area after the calculation operation in the general-purpose register, no copy of the original biological signal sampling points is retained in the general-purpose register. This ensures that the original sampling points no longer exist in the system in an accessible form after the calculation is completed, making it difficult for third-party code to obtain the calculated original data by reading the memory address. Based on the mechanism that the arrival of subsequent sampling points automatically overwrites the current sampling point value in the general-purpose register, the existence time of the original sampling points in the general-purpose register is strictly limited to a single interrupt handling cycle. After being overwritten, they disappear from the system. At any given time, no copy of the original sampling points exists in any memory space addressable by user-level code, thus eliminating the possibility of batch copying and large-scale data leakage. By limiting the entire process from peripheral data registers to general-purpose registers and performing computational operations within those registers to not writing to any memory space addressable by user-level code, this application achieves a secure processing architecture that allows algorithms to perform computations using raw data but struggles to acquire and retain complete raw waveforms, without altering the computational logic itself, simply by changing the physical location and lifespan of the data. This approach eliminates the need for large-scale modifications to existing algorithms and is suitable for resource-constrained wearable medical devices.

[0141] An embedded biosignal security processing system that does not store raw data in memory includes: An analog-to-digital converter is used to perform sampling on biological signals and obtain the original biological signal sampling points latched in the peripheral data register. The data loading control module is used to directly read the original biological signal sampling points in the peripheral data register into the processor's general-purpose register using the load instruction, thereby obtaining the operand to be calculated in the general-purpose register. The calculation execution module is used to perform calculation operations in a general-purpose register according to the operands to be calculated, and obtain scalar calculation results; The result writing module is used to write the scalar calculation result into the output area using the store instruction, and does not retain a copy of the original biosignal sampling point in the general-purpose register. The data lifecycle management module is used to overwrite the current sampling point value in the general-purpose register based on the arrival of subsequent sampling points, so that at any time there are no copies of the original biosignal sampling points in any memory space that can be addressed by user-level code; The data loading control module and the computation execution module are configured such that, throughout the entire process from the peripheral data register to the general-purpose register and the computation operation performed within the general-purpose register, the original biosignal sampling points are not written to any memory space that can be addressed by user-level code.

[0142] It should be noted that this system is a system corresponding to the above method. All implementation methods in the above method embodiments are applicable to this embodiment and can achieve the same technical effect.

[0143] The above description is the preferred embodiment of this application. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principles described in this application, and these improvements and modifications should also be considered within the scope of protection of this application.

Claims

1. A method for securely processing embedded biosignals where raw data is not resident in memory, characterized in that: The method includes: Based on the sampling action of the analog-to-digital converter on the biological signal, the original biological signal sampling points are obtained and latched in the peripheral data register; Based on the original biological signal sampling points in the peripheral data register, the load instruction is used to directly read them into the processor's general-purpose register, thus obtaining the operand to be calculated in the general-purpose register. Based on the operands to be calculated, perform the calculation operation in the general-purpose register to obtain the scalar calculation result; Based on the scalar calculation results, they are written to the output area using the store instruction, and no copy of the original biological signal sampling points is retained in the general-purpose register; Based on the arrival of subsequent sampling points, the current sampling point value in the general-purpose register is overwritten, so that at any given time, there are no copies of the original biological signal sampling points in any memory space that can be addressed by user-level code; Throughout the entire process, from the peripheral data register to the general-purpose register, and the computational operations performed within the general-purpose register, the original biosignal sampling points are not written to any memory space that can be addressed by user-level code.

2. The method according to claim 1, characterized in that, In the method described above, the progressive relationship of the data is as follows: The starting node of the data path is obtained based on the sampled value latched in the peripheral data register after the analog-to-digital converter completes the sampling. Based on the starting node, the sampled value is transferred to the processor's general-purpose register through a single load instruction, thus obtaining the intermediate node of the data path. The data at the intermediate node exists only in the general-purpose register. Based on the intermediate nodes, the calculation is performed in the general-purpose register to obtain the terminal node of the data path. Only the scalar calculation result is output at the terminal node. There is no intermediate step of writing the original biological signal sampling points into the main memory between the starting node and the ending node; what is written into the output area at the ending node is the scalar calculation result rather than the original biological signal sampling points themselves.

3. The method according to claim 2, characterized in that, The method employs a data push mode and includes the following progressive steps: Based on the registration request submitted by the third-party algorithm through the privileged system call interface during the system initialization phase, the entry address of the callback function stored in the callback vector table maintained at the privilege level is obtained; The interrupt service routine execution trigger is obtained based on the interrupt signal triggered after the analog-to-digital converter completes one sampling. Based on the execution trigger of the interrupt service routine, the sampled value in the peripheral data register is read into the general-purpose register to obtain the register value of the current sample point; Based on the register value of the current sampling point and the entry address of the callback function, the execution jumps to the callback function to obtain the calculation process with the current sampling point value as the only input parameter; Once the calculation process is complete, the result is obtained, which contains only the value of the current single sampling point.

4. The method according to claim 3, characterized in that, The data lifetime of the original biosignal sampling points satisfies the following progressive constraints: Based on the moment when the original biological signal sampling point is read into the general-purpose register, the survival start point of the sampling point in the general-purpose register is obtained; Based on the moment when the calculation operation is completed and the scalar calculation result is written to the output area, the valid calculation termination point of the sampling point in the general-purpose register is obtained; Based on the operation of restoring the old value of the general-purpose register before the interrupt when the interrupt service routine executes the interrupt return instruction, the point where the value of the original biological signal sampling point in the general-purpose register is overwritten with the old value is obtained; Based on the constraint that the interrupt service routine after the extinction point does not maintain any cross-interrupt cycle variables to save historical sampling data, the final state of the original biological signal sampling point completely disappearing from the system is obtained.

5. The method according to claim 4, characterized in that, For calculations requiring local time windows, the method further includes a hardware-managed sliding window processing step, the progression of which is as follows: The write trigger of the DMA controller's cyclic transfer mode is obtained based on the new sampling points generated by the analog-to-digital converter; Based on the write trigger, the new sampling point is automatically written to the address of the oldest data in the fixed-size circular buffer, so as to obtain the buffer state after the new data overwrites the oldest data; Based on the buffer state, the physical address space of the ring buffer is configured to be invisible to user-level code through the memory protection unit, resulting in an isolation state where there is no ring buffer mapping in the user-level address space; Based on the isolation status, submit the relative index parameter through the API interface to obtain the sampled value of the corresponding position returned by the API interface.

6. The method according to claim 5, characterized in that, The security constraints of the circular buffer satisfy the following progressive relationship: Based on the buffer size parameters determined by register configuration during the hardware design phase, a fixed configuration value for writing to the one-time programmable memory area is obtained; Based on the fixed configuration values, the hardware lock state is obtained, which means that no software can modify the size of the circular buffer after the device leaves the factory; Based on the hardware lock status, the hardware DMA controller automatically performs boundary checks during each data transfer, and returns an error or a zero value directly for address access requests that exceed the buffer size. Based on the rejection response, a safe state is obtained where the complete contents of the circular buffer cannot be copied via pointer arithmetic or DMA.

7. The method according to claim 6, characterized in that, The method further includes a feature-level desensitization output step, the progression of which is as follows: Based on the calculation process completed within the general-purpose register or the circular buffer window, the original calculation result to be output is obtained; Based on the original calculation results to be output, they are converted into statistical features through the output API to obtain output values ​​that meet the desensitization conditions; The desensitization condition is that at least one of the following is met: the result is a relative value or ratio rather than the absolute amplitude of the original sampling point; The result is a statistical measure and loses the phase and timing details of the original waveform; the result is a classification result or a probability value. Based on the output values ​​that meet the de-identification conditions, they are written to an independent storage area isolated from the original data buffer through the output API to obtain the final de-identified output.

8. The method according to claim 7, characterized in that, The verification and monitoring of the desensitized outputs satisfy the following progressive relationship: Based on the output value received from the output API, a value range check is performed to determine whether the output value is within the preset clinical significance range. Based on the judgment result that it is out of range, an interception action is taken to intercept the output value and prevent it from being written. Based on the cumulative number of calls to the output API within a unit of time, output frequency monitoring is performed to obtain monitoring results on whether the call frequency exceeds the preset upper limit; Based on the monitoring results showing that the limit has been exceeded, a rate-limiting action is taken to prevent subsequent output. Based on the continuous output sequence in application scenarios with high security requirements, perform information entropy checks to obtain the identification results of whether the output sequence presents the statistical characteristics of the original sampled data; Based on the identification results, which present the characteristics of the original sampled data, a second protective action is taken: the output is identified as the original sampled data stream and intercepted and replaced with a preset default value.

9. The method according to claim 8, characterized in that, The method also includes a privileged-level security isolation step, the progression of which is as follows: According to the configuration instructions of the memory protection unit, all peripheral register addresses of the analog-to-digital converter are configured to be accessible only to privileged level, resulting in an isolation state in which user-level code cannot directly access the physical address of the peripheral data register; Based on the isolation state, the operation of reading the sampled value from the peripheral data register is only performed in the privileged interrupt service routine, resulting in the safety constraint that the sampled value can only be read by privileged code. According to security constraints, third-party algorithms run at the user level and interact with privileged levels through system call interfaces, resulting in a restriction state that third-party algorithms cannot access the control registers or data registers of the analog-to-digital converter. Based on the constraint status, the memory space that can be addressed by user-level code is defined, including SRAM, DRAM, Flash, and TCM visible to the user level. Based on the determination results, it is finally determined that the processor's general-purpose register set does not belong to the memory space that can be addressed by user-level code.

10. An embedded biosignal security processing system for raw data not residing in memory, the system being used to perform the method as described in any one of claims 1 to 9, characterized in that, include: An analog-to-digital converter is used to perform sampling on biological signals and obtain the original biological signal sampling points latched in the peripheral data register. The data loading control module is used to directly read the original biological signal sampling points in the peripheral data register into the processor's general-purpose register using the load instruction, thereby obtaining the operand to be calculated in the general-purpose register. The calculation execution module is used to perform calculation operations in a general-purpose register according to the operands to be calculated, and obtain scalar calculation results; The result writing module is used to write the scalar calculation result into the output area using the store instruction, and does not retain a copy of the original biosignal sampling point in the general-purpose register. The data lifecycle management module is used to overwrite the current sampling point value in the general-purpose register based on the arrival of subsequent sampling points, so that at any time there are no copies of the original biosignal sampling points in any memory space that can be addressed by user-level code; The data loading control module and the computation execution module are configured such that, throughout the entire process from the peripheral data register to the general-purpose register and the computation operation performed within the general-purpose register, the original biosignal sampling points are not written to any memory space that can be addressed by user-level code.

Images