Business processing methods, and apparatuses

Abstract

Business processing methods, and apparatuses, which relate to the technical field of security, and can meet the information security requirement of a functional safety operating system, thus improving the security of business processing, and being easy to implement. The methods can migrate a functional safety operating system (a first safety operating system) having high functional safety and high information security requirements to a secure world, such that high-security and highly-trusted businesses can be processed in the secure world; a functional safety operating system (a second safety operating system) deployed in a non-secure world can access a TEEOS to execute businesses by means of a secure TEE proxy technology, or access a local security service to execute businesses.

Description

Business processing method and device

[0001] This application claims priority to the Chinese patent application filed with the State Intellectual Property Office on August 28, 2023, with application number 202311095309.9 and application name “Business Processing Method and Device”, the entire contents of which are incorporated by reference into this application. Technical Field

[0002] The present application relates to the field of security technology, and in particular to a business processing method and device. Background Art

[0003] In related technologies, the same hardware platform can support the hosting of heterogeneous operating systems to achieve the integration of computing units and the sharing of computing power. Different operating systems have different functional safety and information security requirements. Some functional safety operating systems (safetyOS) need to possess both functional safety and information security attributes. Among current heterogeneous operating systems, functional safety operating systems cannot independently access the trusted execution environment operating system, making it difficult to meet the information security requirements of functional safety operating systems.

[0004] Summary of the Invention

[0005] The present application provides a business processing method and device that can meet the information security requirements of a functional safety operating system, improve the security of business processing, and is easy to implement.

[0006] In order to achieve the above objectives, the embodiments of the present application provide the following technical solutions:

[0007] In the first aspect, the present application provides a business processing method, which is applied to a secure and trusted device, wherein the secure and trusted device includes a first secure operating system migrated from a non-secure world to a secure world, and the first secure operating system is isolated from the trusted execution environment operating system in the secure world. The method includes: obtaining a request to execute a high-security and high-trust business; the request to execute the high-security and high-trust business includes a cryptographic request for the high-security and high-trust business; the cryptographic request includes at least one of an encryption request, a decryption request, a key derivation request, and a key generation request; executing the cryptographic request through a local trusted application; the trusted application sends the execution result of the cryptographic request to the high-security and high-trust application; the high-security and high-trust application executes the high-security and high-trust business according to the execution result of the cryptographic request.

[0008] The first secure operating system is migrated to the secure world. The first secure operating system can be the intelligent driving domain operating system. The intelligent driving domain operating system includes trusted applications and high-security and high-trust applications. The high-security and high-trust application in the intelligent driving domain operating system issues a request to execute a high-security and high-trust service. This request includes a cryptographic request for the high-security and high-trust service, such as an encryption request. The encryption request is executed by the local trusted application, encrypting the high-security and high-trust service data. The trusted application sends the encrypted high-security and high-trust service data to the high-security and high-trust application, which then executes the high-security and high-trust service. The high-security and high-trust application ensures the trusted security of the service through the trusted services provided by the trusted application. Furthermore, the high-security and high-trust application and the trusted application are located in the same system. The high-security and high-trust application can directly send cryptographic requests to the trusted application for execution and obtain the execution results, ensuring the functional safety of the service. This meets the information security requirements of the functional safety operating system. The isolation of the intelligent driving domain operating system from the trusted execution environment operating system in the secure world prevents data leakage between systems, further improving the security of this method. Furthermore, this method migrates the first secure operating system to the secure world, has a high development cost and small resource usage, can evolve over a long period of time, and is easy to implement.

[0009] In one possible implementation, the high-security and high-trust services include autonomous driving safety services.

[0010] Optionally, the intelligent driving domain operating system includes autonomous driving safety services, such as automatic braking services, automatic cruise control services, automatic steering services, and automatic parking services.

[0011] On the second aspect, the present application provides a business processing method, which is applied to a secure and trusted device, wherein the secure and trusted device includes a trusted execution environment operating system of a secure world and a third operating system and a second secure operating system of a non-secure world. The method includes: obtaining a request to execute a business; sending the business request to the trusted execution environment operating system or the local security service based on the trust requirements and performance requirements of the business request, and the business request is used to trigger the trusted execution environment operating system that receives the business request, or the local security service to execute the business.

[0012] Optionally, the second secure operating system may be an instrument domain operating system, which includes secure and trusted applications, a security service scheduling module, and a local security service module. The secure and trusted application may send a service execution request to the security service scheduling module. Upon receiving the service execution request, the security service scheduling module may forward the service request to the trusted execution environment operating system or the local security service based on the trust and performance requirements of the service request. The trusted execution environment operating system or the local security service may then execute the service.

[0013] Optionally, the meter domain operating system may further include a cross-domain communication component for forwarding service requests.

[0014] In this way, business requests with different requirements are sent to different operating systems for execution, which can improve the security of business performance and improve efficiency. The security service scheduling module sends business requests to the trusted execution environment operating system or local security service according to the trust requirements and performance requirements of the business requests, which has little interference with users, optimizes the overall system architecture, and provides better services and user experience.

[0015] In one possible implementation, based on the trust requirements and performance requirements of the business request, the business request is sent to the trusted execution environment operating system, or the business request is sent to the local security service, including: if the trust requirements of the business are greater than the performance requirements, the business request is encrypted and the encrypted business request is sent to the trusted execution environment operating system; if the performance requirements of the business request are greater than the trust requirements, the business request is sent to the local security service.

[0016] In this way, requests for services requiring high trustworthiness are encrypted and sent to the trusted execution environment operating system, which then executes the service. This prevents data leakage, improves the security of service transmission, and ensures the trustworthiness and security of the service. Requests for services requiring high performance and security are sent to the local security service, which then executes the service. This improves service execution efficiency and performance.

[0017] For example, a service request with a greater trust requirement than a performance requirement may be a trusted service request for a real-time traffic and navigation display service. The encrypted trusted service request for the real-time traffic and navigation display service is sent to the trusted execution environment operating system. The trusted execution environment operating system executes the real-time traffic and navigation display service.

[0018] The service request with a performance requirement greater than a trust requirement may be a request for an audio and multimedia control service, which is sent to a local software algorithm that executes the audio and multimedia control service.

[0019] In a possible implementation, the service includes a trusted and secure security instrument display service.

[0020] For example, the trusted and secure safety instrument display service may include audio and multimedia control services, real-time traffic conditions and navigation display services, and the like.

[0021] On the third aspect, the present application provides a business processing method, which is applied to a secure and trusted device, wherein the secure and trusted device includes a trusted execution environment operating system of a secure world and a third operating system and a second secure operating system of a non-secure world. The method includes: a proxy client application of the third operating system receives a first request from the second secure operating system, where the first request is an encrypted request; the proxy client application of the third operating system sends the first request to the trusted execution environment operating system; the proxy client application is isolated from other applications and / or components of the third operating system.

[0022] Among them, the first request is an encrypted request, which can ensure the security of the request, and the proxy client application is isolated from other applications and / or components of the third operating system, preventing the first request data of the proxy client application from being leaked, further improving the security of the first request.

[0023] Optionally, the third operating system may be an entertainment domain operating system, which further includes a cross-domain notification component configured to receive the first request from the second secure operating system and send the first request to the proxy client application. The proxy client application may invoke the trusted zone driver module to send the first request to the trusted execution environment operating system.

[0024] Exemplarily, the first request may be a trusted service request for real-time traffic conditions and navigation display services.

[0025] In a possible implementation, the first request includes a request to execute a trusted and secure security instrument display service.

[0026] Illustratively, the safety instrument display service includes real-time traffic condition and navigation display service, user behavior analysis service, etc.

[0027] In the fourth aspect, the present application provides a business processing method, which is applied to a secure and trusted device, wherein the secure and trusted device includes a trusted execution environment operating system of a secure world and a third operating system and a second secure operating system of a non-secure world. The method includes: the trusted execution environment operating system receives a first request from the second secure operating system, and the first request is an encrypted request; the first request includes a request to execute a first business; the first request is decrypted, and the first business is executed to obtain the execution result of the first business; the execution result of the first business is encrypted and returned to the second secure operating system.

[0028] The first request is encrypted, ensuring its security. Furthermore, the first service originates from the second secure operating system, ensuring its functional safety. The trusted execution environment operating system executes the first service, ensuring its trusted security. This satisfies the information security requirements of the functional safety operating system.

[0029] Exemplarily, the trusted execution environment operating system can be a secure domain operating system. The secure domain operating system receives a trusted service request (first request) for real-time traffic conditions and navigation display services. After decrypting the request, the secure domain operating system executes the real-time traffic conditions and navigation display services, obtains the execution result, and returns it to the instrument domain operating system (second secure operating system) after encryption.

[0030] In a possible implementation, the trusted execution environment operating system receives a first request from the second secure operating system, including: the trusted execution environment operating system receives the first request from the second secure operating system through a third operating system.

[0031] In a possible implementation, the first service includes a trusted and secure security instrument display service.

[0032] Illustratively, the safety instrument display service includes real-time traffic condition and navigation display service, user behavior analysis service, etc.

[0033] In the fifth aspect, the present application provides a business processing device, which is applied to a secure and trusted device, and the secure and trusted device includes a first secure operating system migrated from a non-secure world to a secure world, and the first secure operating system is isolated from the trusted execution environment operating system in the secure world; the first secure operating system is used to obtain a request to execute a high-security and high-trustworthiness business; the first secure operating system is also used to encrypt the request for the high-security and high-trustworthiness business through a local trusted application; the first secure operating system is also used to send the encrypted request to the high-security and high-trustworthiness application through the trusted application; the first secure operating system is also used to execute the high-security and high-trustworthiness business through the high-security and high-trustworthiness application in response to the encrypted request.

[0034] In one possible implementation, the high-security and high-trust services include autonomous driving safety services.

[0035] In the sixth aspect, the present application provides a business processing device, which is applied to a secure and trusted device. The secure and trusted device includes a trusted execution environment operating system of the secure world and a third operating system and a second secure operating system of the non-secure world. The device includes: a second secure operating system, which is used to obtain a request to execute a business; the second secure operating system is also used to send the business request to the trusted execution environment operating system or the local security service based on the trust requirements and performance requirements of the business request. The business request is used to trigger the trusted execution environment operating system or the local security service to execute the business after receiving the business request.

[0036] In one possible implementation, the second secure operating system is also used to: encrypt the business if the trust requirement of the business request is greater than the performance requirement, and send the encrypted business request to the trusted execution environment operating system for execution; if the performance requirement of the business request is greater than the trust requirement, send the business request to the local security service for execution.

[0037] In a possible implementation, the service includes a trusted and secure security instrument display service.

[0038] In the seventh aspect, the present application provides a business processing device, which is applied to a secure and trusted device. The secure and trusted device includes a trusted execution environment operating system of the secure world and a third operating system and a second secure operating system of the non-secure world. The device includes: the third operating system is used to receive business requests from the second secure operating system, and the first request is an encrypted request; wherein the application that receives the business request is a proxy client application of the third operating system; the third operating system is also used to send the business request to the trusted execution environment operating system; the proxy client application is isolated from other applications and / or components of the third operating system.

[0039] In a possible implementation, the first request includes a request to execute a trusted and secure security instrument display service.

[0040] In the eighth aspect, the present application provides a business processing device, which is applied to a secure and trusted device. The secure and trusted device includes a trusted execution environment operating system of the secure world and a third operating system and a second secure operating system of the non-secure world. The device is also used for: the trusted execution environment operating system is used to receive a first request from the second secure operating system, and the first request is an encrypted request; the first request includes a request to execute a first business; the trusted execution environment operating system is also used to decrypt the first request, execute the first business, and obtain the execution result of the first business; the trusted execution environment operating system is also used to encrypt the execution result of the first business and return it to the second secure operating system.

[0041] In a possible implementation, the trusted execution environment operating system is further configured to receive the first request from the second secure operating system through a third operating system.

[0042] In a possible implementation, the first service includes a trusted and secure security instrument display service.

[0043] In the ninth aspect, the present application provides an electronic device for business processing, including a first secure operating system, a second secure operating system, a third operating system, and a trusted execution environment operating system; the electronic device executes any one of the methods described in the first to fourth aspects above.

[0044] In the tenth aspect, the present application provides a business processing system, comprising: a processor coupled to a memory; the processor is used to execute a computer program stored in the memory so that the electronic device health assessment system performs the methods described in the first to fourth aspects.

[0045] In the eleventh aspect, the present application provides a computer-readable storage medium, which includes a computer program or instructions. When the computer program or instructions are run on a business processing device, the business processing device executes the methods described in the first to fourth aspects.

[0046] In the twelfth aspect, the present application provides a chip system comprising at least one processor and at least one interface circuit, wherein the at least one interface circuit is used to perform transceiver functions and send instructions to the at least one processor. When the at least one processor executes the instructions, the at least one processor executes the method as described in any one of the first to fourth aspects above.

[0047] In a thirteenth aspect, the present application also provides a computer program product comprising instructions, which, when executed on a computer, enables the computer to execute the method as described in any one of the first to fourth aspects.

[0048] In a fourteenth aspect, an embodiment of the present application provides a circuit system, the circuit system including a processing circuit, and the processing circuit is configured to execute the method of any one of the implementation methods in the first aspect or the first to fourth aspects.

[0049] The technical effects corresponding to the fifth to eighth aspects and any one of the implementation methods of the fifth to eighth aspects can be referred to the technical effects corresponding to the above-mentioned first to fourth aspects and any one of the implementation methods of the first to fourth aspects; the technical effects corresponding to the ninth to fourteenth aspects and any one of the implementation methods of the ninth to fourteenth aspects can be referred to the technical effects corresponding to the above-mentioned first to fourth aspects and any one of the implementation methods of the first to fourth aspects, and will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] FIG1 is a schematic diagram of the architecture of an operating system provided in an embodiment of the present application;

[0051] FIG2 is a schematic diagram of the architecture of another operating system provided in an embodiment of the present application;

[0052] FIG3 is a schematic diagram of the architecture of another operating system provided in an embodiment of the present application;

[0053] FIG4 is a schematic diagram of the architecture of another operating system provided in an embodiment of the present application;

[0054] FIG5 is a schematic diagram of the architecture of another operating system provided in an embodiment of the present application;

[0055] FIG6 is a flow chart of a business processing method provided in an embodiment of the present application

[0056] FIG7 is a schematic diagram of a process flow of a service scheduling provided in an embodiment of the present application;

[0057] FIG8 is a flow chart of a service processing method provided in an embodiment of the present application;

[0058] FIG9 is a schematic diagram of a flow chart of an encryption method provided in an embodiment of the present application;

[0059] FIG10 is a flow chart of another service processing method provided in an embodiment of the present application;

[0060] FIG11 is a schematic structural diagram of an electronic device provided in an embodiment of the present application;

[0061] FIG12 is a schematic structural diagram of a chip system provided in an embodiment of the present application. DETAILED DESCRIPTION

[0062] The terms "including," "having," and any variations thereof mentioned in the description of the embodiments of the present application are intended to cover non-exclusive inclusions. For example, a process, method, system, product, or apparatus comprising a series of steps or units is not limited to the listed steps or units, but may optionally include other steps or units not listed, or may optionally include other steps or units inherent to the process, method, product, or apparatus.

[0063] It should be noted that in the embodiments of this application, words such as "exemplary" or "for example" are used to indicate examples, illustrations, or descriptions. Any embodiment or design described as "exemplary" or "for example" in the embodiments of this application should not be interpreted as being more preferred or advantageous over other embodiments or designs. Rather, the use of words such as "exemplary" or "for example" is intended to present the relevant concepts in a concrete manner.

[0064] In the description of the embodiments of this application, unless otherwise specified, "plurality" means two or more. "And / or" in this document is merely a description of the association relationship between associated objects, indicating that three relationships can exist. For example, "A and / or B" can mean: A exists alone, A and B exist simultaneously, or B exists alone.

[0065] First, some technical terms involved in the embodiments of this application are introduced:

[0066] 1. Virtual machine (VM) technology: This technology uses hypervisor virtualization technology to create independent virtual computers, often referred to as VMs. Multiple VMs can be isolated from each other. Operating systems can be installed within VMs, and applications can run within these operating systems.

[0067] 2. TrustZone technology:

[0068] TrustZone technology allows computer systems to be physically isolated into a secure and non-secure world, protecting data security and integrity and shielding it from malicious attacks. TrustZone-based electronic devices (such as mobile phones, tablets, and in-vehicle devices) isolate system resources into two worlds: the normal world and the secure world. The normal world runs a rich execution environment (REE), while the secure world runs a trusted execution environment (TEE).

[0069] REE, also known as common execution environment, includes a rich execution environment operating system (REE OS) and a client application (CA) running on a general-purpose processor.

[0070] It should be noted that REE does not mean that the operating system or software running in it is malicious, but rather that REE is less secure than TEE. Generally, the business of the operating system in REE can call the TA service in TEE to ensure the trustworthiness and security of the business.

[0071] TEE, also known as a secure execution environment, can run a trusted execution environment operating system (TEE OS) and provide CAs with reliable trusted security services (such as fingerprint matching services, password verification services, and face matching services). These trusted security services can run on TEE OS in the form of trusted applications (TA).

[0072] TEEs can be used for one or more of the following purposes: 1. Content protection: Preventing high-definition movies and music from being used by others. 2. Mobile financial services: Mobile payments. 3. Authentication: Fingerprint and facial recognition. 4. Protecting confidential information for businesses or governments.

[0073] As a possible implementation, the Trustzone mechanism can configure the Trustzone address space control (TZASC) register and the Trustzone memory adapter (TZMA) register to set security-sensitive memory as secure memory, so that REEs cannot access this memory.

[0074] Optionally, in the non-secure world, there can be three operating modes: Exception Level 0 (EL0), Exception Level 1 (EL1), and Exception Level 2 (EL2). EL0 is used to run user programs, EL1 is used to run the operating system kernel, and EL2 is used to run the virtual machine monitor. EL1 has a higher exception level than EL0, and EL2 has a higher exception level than EL1.

[0075] Optionally, there are three operating modes in the secure world: secure state exception level 2 (SEL2) mode, secure state exception level 1 (SEL1) mode, and secure state exception level 0 (SEL0) mode. SEL0 mode is used to run user programs, SEL1 mode is used to run the kernel of the operating system, and SEL2 mode is used to run the virtual machine monitor. The SEL1 mode has a higher security state exception level than the SEL0 mode, and the SEL2 mode has a higher security state exception level than the SEL1 mode.

[0076] 3. Automotive safety integrity level (ASIL):

[0077] The vehicle functional safety standard ISO26262 defines vehicle safety integrity levels (ASILs), which are categorized as ASIL-A, ASIL-B, ASIL-C, and ASIL-D, from low to high. The greater the security risk of the operating system, the higher the corresponding functional safety requirement level, requiring more stringent safety measures.

[0078] The following describes in detail a service processing method and device provided in an embodiment of the present application with reference to the accompanying drawings.

[0079] In one embodiment, heterogeneous operating systems can be supported on the same hardware platform in scenarios such as in-vehicle scene virtualization, in-vehicle scene containerization, and on mobile devices. Taking in-vehicle scene virtualization as an example, in intelligent driving scenarios, it is necessary to deploy SafetyOS for real-time and safe autonomous driving services and a general-purpose OS for intelligent vehicle control services. In intelligent cockpit scenarios, it is necessary to deploy SafetyOS for safety instrument displays and a general-purpose OS for entertainment applications.

[0080] Figure 1 shows the deployment of operating systems for the intelligent driving and intelligent cockpit scenarios in an in-vehicle scenario. The functional safety level requirement for the intelligent driving domain can be ASIL-D. The intelligent driving scenario includes a trusted execution environment (TEE) operating system, a secure operating system (SO), and a general-purpose operating system (OS). The TEE OS ensures the trusted security of applications and services within it, and trusted applications are deployed within it. The secure OS ensures the functional safety of applications and services within it, and high-security and high-trust applications related to autonomous driving are deployed within it. These high-security and high-trust applications can invoke confidential services provided by trusted applications within the TEE to achieve trustworthiness.

[0081] Among them, trusted security refers to the integrity, confidentiality and availability of applications, services, data, etc. in the operating system, preventing unauthorized access, data leakage, malicious attacks and other security threats, and ensuring the stable operation and reliability of the operating system.

[0082] Functional safety means that an operating system can maintain safe operation in the event of a fault or error, and avoid unacceptable risks to people, the environment, or property. Operating systems include functional safety features such as fault detection, fault tolerance, self-diagnosis, and correction to ensure they maintain a safe state in the event of a fault.

[0083] Optionally, the functional safety level of the safety operating system can be ASIL-B. General-purpose operating systems do not have functional safety and trusted safety requirements, and they deploy applications such as software upgrades, data downloads, and data uploads.

[0084] The smart cockpit scenario includes trusted execution environment operating systems, secure operating systems, and general-purpose operating systems. The general-purpose operating systems in the smart cockpit scenario can be the same or different types as those in the smart driving scenario.

[0085] Optionally, a trusted execution environment (TEE) can ensure the trusted security of applications and services within the operating system, where trusted applications are deployed. A secure operating system (SO) can ensure the functional security of applications and services within the operating system, where secure and trusted instrument applications, such as automotive instrument display applications and navigation applications, are deployed.

[0086] Optionally, the functional safety level of the safety operating system of the smart cockpit scenario and the functional safety level of the smart cockpit scenario can both be ASIL-B.

[0087] Optional general-purpose operating systems for smart cockpit scenarios and smart driving scenarios do not have functional safety and trusted safety requirements. Entertainment-related applications, such as music applications, are deployed in general-purpose operating systems for smart cockpit scenarios.

[0088] Optionally, the hardware devices in the secure operating system of the smart cockpit scenario, the general operating system of the smart cockpit scenario, the secure operating system of the smart driving scenario, and the general operating system of the smart driving scenario can all be managed uniformly using a virtual machine monitor (VMM) (also called a hypervisor), and the hardware devices can be shared or exclusively used by a virtual machine in a shared or direct manner.

[0089] Optionally, ARM TrustZone Firmware (ATF) runs on the TrustZone in the architecture to manage communication and resource access between the secure world (trusted execution environment operating system) and the non-secure world (secure operating system and general operating system Android) in the intelligent driving scenario and the intelligent cockpit scenario.

[0090] In the deployment method of the operating systems for the above-mentioned intelligent driving scenarios and intelligent cockpit scenarios, the functional safety operating system cannot directly access TEEOS to complete information security service calls, so it is difficult to meet the information security requirements of the functional safety operating system.

[0091] In related technologies, technicians can use TEE proxy technology to enable functional safety operating systems to access TEEOS, thereby meeting the information security requirements of functional safety operating systems. As shown in Figure 2, a general-purpose operating system can directly access TEEOS through the hypervisor and ATF, calling the TA in TEEOS to complete information security services. The functional safety operating system sends the request to access TEEOS to the general-purpose operating system through the communication channel between the functional safety operating system and the general-purpose operating system. The general-purpose operating system then proxies the secure operating system to access TEEOS and call the TA in TEEOS to complete information security services. However, in in-vehicle scenarios where CPU and memory resources are relatively limited, if all operating system TEE requests are proxied for execution, the overhead is high. The proxy channel is also vulnerable to external attacks, resulting in data leaks.

[0092] Alternatively, technicians can implement TEE virtualization technology based on secure state exception level 2 (SEL2) to enable functional safety operating systems to access TEEOS, thereby meeting the information security requirements of functional safety operating systems. As shown in Figure 3, the virtualization technology of the secure world can deploy multiple TEEOS in the secure world, with each operating system having a dedicated TEEOS. General-purpose operating systems can directly access TEEOS0 through the hypervisor and ATF, and functional safety operating systems can directly access TEEOS1 through the hypervisor and ATF. If a car includes multiple general-purpose operating systems and multiple functional safety operating systems, multiple TEEOS are required, which has high development costs and large resource consumption, making it difficult to implement and difficult to evolve over the long term.

[0093] Alternatively, technicians can implement mediator-based TEE virtualization technology to enable functionally safe operating systems to access TEEOS, meeting the information security requirements of functionally safe operating systems. As shown in Figure 4, multiple operating systems in the non-secure world communicate with a single TEEOS in the secure world via a mediator within the hypervisor. The mediator provides process-level isolation between these two operating systems, ensuring the normal operation of requested services. However, this requires simultaneous modification of the hypervisor and TEEOS, which requires high coupling between multiple components and is difficult to implement.

[0094] To solve the above problems, an embodiment of the present application provides a business processing method. This method can meet the information security requirements of the functional safety operating system. Migrate the functional safety operating system (first safety operating system) with high functional safety and high information security requirements in the non-safe world to the safe world. In this way, the functional safety operating system can directly call the local TA of the safe world to complete high functional safety and high information security services (high security and high trust services). For the functional safety operating system (second safety operating system) deployed in the non-safe world, TEEOS can be accessed through the secure TEE agent technology to meet the information security requirements of the functional safety operating system. Alternatively, the functional safety operating system deployed in the non-safe world can also access local security services to meet the information security requirements of the functional safety operating system. It can be seen that the technical solution of the embodiment of the present application can meet the information security requirements of the functional safety operating system and is easy to implement.

[0095] Optionally, the service processing method may also be a request processing method in a service, wherein the operating system may execute the service or respond to the request, and the embodiments of the present application do not impose any specific restrictions on this.

[0096] Optionally, this service processing method is applied in an in-vehicle scenario. The vehicle system includes an intelligent driving domain operating system, a security domain operating system, an entertainment domain operating system, and an instrument domain operating system. It should be understood that the vehicle may also include other operating systems, and this embodiment of the application does not specifically limit this.

[0097] The intelligent driving domain operating system is used to carry high-security and high-reliability services. For example, real-time autonomous driving services enable autonomous vehicle navigation, control, and operation, completing functions such as automatic braking, automatic steering, and automatic parking. High-precision mapping and positioning services provide detailed information such as vehicle location, road conditions, and traffic signs to support autonomous driving services. Driving behavior analysis services analyze and evaluate driver behavior in real time, such as detecting driver fatigue and concentration. It should be understood that the automotive intelligent driving domain operating system may also include other services, and this application does not impose specific restrictions on these.

[0098] The security domain operating system is used to carry highly reliable cryptography-related services. For example, encryption and decryption services ensure the security of sensitive data during transmission and storage by encrypting and decrypting sensitive data. Key management services provide secure key generation, storage and distribution mechanisms to ensure the confidentiality and integrity of keys. Security protocol implementation services implement various security protocols, such as the secure sockets layer (SSL) protocol to protect the security of network communications, and the internet protocol security (IPSec) protocol to protect the security of network layer data. These protocols rely on cryptographic algorithms and key management services, and are implemented and managed in the security domain operating system. It should be understood that the automotive safety domain operating system may also include other services, and this application does not impose specific restrictions on this.

[0099] The entertainment domain operating system is used to carry general-purpose, rich-ecosystem entertainment and multimedia services, and provides a secure service proxy channel for other operating systems in the non-secure world through secure TEE proxy technology. For example, the in-car audio service allows the driver to play music and radio. The entertainment media service allows the driver or passengers to watch movies, play videos, and play games. It should be understood that the automotive entertainment domain operating system may also include other services, and this application does not impose specific restrictions on these.

[0100] The instrument domain operating system is used to carry real-time safety instrument display related services with functional safety requirements. For example, the speed and rotation speed display service is used to display the current speed of the vehicle and the current speed of the engine. The temperature and pressure monitoring service is used to monitor the temperature and pressure conditions of the vehicle in real time and to alert the driver in abnormal situations. The real-time road condition and navigation display service, the vehicle dashboard can display road information and navigation instructions in real time, including real-time traffic conditions, navigation maps and turn instructions, etc., to help the driver choose the best route and navigate. Among them, the real-time road condition and navigation display service involves functions such as path planning algorithms and real-time user positioning. Audio and multimedia control services, for example, audio and multimedia control buttons or touch screens integrated on the vehicle dashboard are used to adjust the volume, switch radio stations, select music playlists, etc., to provide convenient and safe audio and entertainment operations. It should be understood that the automotive instrument domain operating system can also include other services, and this application does not impose specific restrictions on this.

[0101] Optionally, embodiments of the present application can use virtualization technology to virtualize multiple operating systems in a vehicle scenario, and then deploy operating systems with different security levels on different virtual devices. The hardware of the entire system is centrally managed by a virtual machine monitor (VMM) (also known as a hypervisor), and the hardware devices can be shared or exclusively used by a virtual machine (VM) in a shared or direct manner. In this solution, different operating systems are deployed in different virtual machines.

[0102] For example, the intelligent driving domain operating system is deployed in virtual machine 1 of the secure world; the security domain operating system is deployed in virtual machine 0 of the secure world; the entertainment domain operating system is deployed in virtual machine 1 of the non-secure world; and the instrument domain operating system is deployed in virtual machine 0 of the non-secure world.

[0103] Optionally, embodiments of the present application can deploy a secure hypervisor based on the SEL2 hardware feature to isolate multiple VMs in the secure world. Furthermore, a nonsecure hypervisor can be deployed to isolate multiple VMs in the non-secure world. Each VM is isolated, ensuring the security of data within the VM.

[0104] The method provided in the embodiments of the present application is described below with reference to the accompanying drawings.

[0105] Figure 5 shows a schematic diagram of the operating system architecture of an embodiment of the present application. The first secure operating system and the trusted execution environment operating system are located in the secure world, while the third operating system and the second secure operating system are located in the non-secure world. For other components within the operating system and the connections between them, see the architectures shown in Figures 7 and 8, and will not be further described.

[0106] Referring to Figure 5 , the first secure operating system (functionally safe operating system) deployed in the secure world invokes the local TA in the secure world to encrypt high-security and high-trust services. Optionally, the TA in the first secure operating system can also be used to decrypt high-security and high-trust services, perform key derivation and key generation, and so on. This application uses the example of trusted application encryption of high-security and high-trust services.

[0107] Optionally, the first secure operating system includes multiple high-security and high-trust applications (high functional safety and high information security applications), which can call the local TA encrypted high-security and high-trust services of the secure world. Exemplarily, the first secure operating system can be an intelligent driving domain operating system.

[0108] For example, the first secure operating system is the intelligent driving domain operating system, which is installed in VM1 in the secure world. The intelligent driving domain operating system has autonomous driving applications installed, and VM1 also has trusted applications installed.

[0109] As shown in FIG6 , the process of executing a high-security and high-trust service in the intelligent driving domain operating system may include the following steps S201 to S204:

[0110] S201: The high-security and high-trust application sends a request to a local trusted application to encrypt high-security and high-trust business data.

[0111] Optionally, a high-security, high-trust application in the intelligent driving domain operating system can initiate a request to encrypt high-security, high-trust service data to a trusted application. For example, an autonomous driving application in the intelligent driving domain operating system can initiate a request to encrypt automatic braking service data and send the encrypted service data request to the trusted application in the intelligent driving domain operating system.

[0112] S202: The local trusted application encrypts the high-security and high-trust business data to obtain the encrypted high-security and high-trust business data.

[0113] Optionally, after receiving the request to encrypt the high-security and high-trustworthiness business data, the local trusted application encrypts the high-security and high-trustworthiness business data in response to the request to obtain the encrypted high-security and high-trustworthiness business data.

[0114] Exemplarily, after the local trusted application receives a request to encrypt the automatic braking service data, the trusted application responds to the request and encrypts the automatic braking service data to obtain the encrypted automatic braking service data.

[0115] Optionally, local trusted applications can access the security engine when encrypting automatic braking business data, improving trusted application performance and confidentiality. Optional trusted applications can also access the security engine when performing trusted services such as decryption operations or key derivation, improving trusted application performance and confidentiality.

[0116] S203: The local trusted application returns the encrypted high-security and high-trust business data to the high-security and high-trust application.

[0117] For example, the local trusted application can return the encrypted automatic braking business data to the autonomous driving application.

[0118] S204: The high-security and high-trust application executes the high-security and high-trust service according to the encrypted high-security and high-trust service data.

[0119] Optionally, the local trusted application may return the encrypted high-security and high-trustworthiness service request data to the high-security and high-trustworthiness application, and the high-security and high-trustworthiness application executes the high-security and high-trustworthiness service according to the returned service request data.

[0120] Optionally, after receiving the encrypted request data of the high-security and high-trustworthiness service, the high-security and high-trustworthiness application may decrypt the request data of the high-security and high-trustworthiness service and execute the high-security and high-trustworthiness service according to the decrypted service request data.

[0121] Exemplarily, after receiving the encrypted request data for the automatic braking service, the automatic braking application may decrypt the request data for the automatic braking service and execute the automatic braking service according to the decrypted request data for the automatic braking service.

[0122] Still referring to FIG5 , for the second safety operating system (functional safety operating system) deployed in the non-safety world, services are distributed according to the performance requirements and trust requirements of the service requests.

[0123] Optionally, the second secure operating system may include secure and trusted applications, a security service scheduling module, a local security service module, etc.

[0124] The secure and trusted application may issue a security service request (or security service) and send the security service request to the security service scheduling module.

[0125] The Security Service Dispatching Module manages and dispatches security-related service requests (service requests). The Security Service Dispatching Module receives requests from security service requesters and dispatches them to appropriate security services based on the request's performance requirements, trustworthiness requirements, type, priority, and other relevant information. For example, requests may be sent to a local security service module or a trusted application in the secure world.

[0126] Among them, the local security service module is a module that provides security service functions in the local environment. The local security service module executes security services in a short time and has high performance.

[0127] Optionally, in an embodiment of the present application, a secure and trusted application may issue a security service request and send the security service request to the security service scheduling module. After receiving the security service request, the security service scheduling module may distribute the security service request based on the performance requirements, trust requirements, etc. of the security service request.

[0128] Optionally, the performance requirements for security service requests (service performance requirements) include time requirements (response time), throughput, and scalability. Services typically need to be executed within a specified timeframe. A high service performance requirement indicates a short service execution time, while a low service performance requirement indicates a long service execution time. Service throughput represents the volume of services processed by the operating system per unit time. Service scalability indicates the operating system's ability to increase or decrease service execution resources in response to service growth or decline.

[0129] Optionally, the performance requirement level of the service can be determined based on the length of time it takes to execute the service. The shorter the time it takes to execute the service, the higher the performance requirement level of the service. The higher the performance requirement level, the higher the corresponding performance requirement. For example, when the time it takes to execute the service is between [0, 0.02]s, the performance requirement level of the service is level 4; when the time it takes to execute the service is between (0, 0.05]s, the performance requirement level of the service is level 3; when the time it takes to execute the service is between (0, 05, 0.1]s, the performance requirement level of the service is level 2; when the time it takes to execute the service is between [0.1, 0.5]s, the performance requirement level of the service is level 1. It should be understood that the above division of service performance requirement levels is only an example, and the division of service performance requirement levels can also be in other ways, and the embodiments of the present application do not impose specific restrictions on this.

[0130] The trust requirements for security business requests (business trust requirements) include information security, authentication and authorization, security auditing and monitoring during the business execution process. The higher the business trust requirements, the higher the trust and security of the business. Information security during business execution includes the security of user data or data generated during business execution. A high business trust requirement indicates high information security requirements during the execution of the business, while a low business trust requirement indicates low information security requirements during the execution of the business. Business authentication and authorization means that the execution of the business requires identity authentication and access permission control. For example, only authorized users can access specific resources, and users need to be authenticated before access. Business security auditing and monitoring means that the business needs to have security auditing and monitoring mechanisms. For example, logging, anomaly detection, intrusion detection, and real-time monitoring are used to ensure the trust and security of the business.

[0131] Optionally, the trust requirements of the business can be divided into different levels.

[0132] For example, for some non-sensitive businesses, the requirements for information security are relatively low, and identity authentication and authorization are not required, and there is no security audit and monitoring, etc., then the trust requirement level of this business is level 1; for some more sensitive businesses, the requirements for information security are relatively high, and identity authentication and authorization, as well as security audit and monitoring, etc., may be required, then the trust requirement level of this business is level 2; for some sensitive businesses, there are more stringent information security requirements, further identity authentication and authorization, as well as continuous security audit and monitoring, etc., then the trust requirement level of this business is level 3; for some highly sensitive businesses, there are extremely high information security requirements, multiple identity authentication and authorization, as well as continuous and advanced security audit and monitoring, etc., then the trust requirement level of this business is level 4. It should be understood that the above-mentioned division of business trust requirement levels is only an example, and the division of business trust requirement levels can also be other ways, and the embodiments of the present application do not impose specific restrictions on this.

[0133] Optionally, the security service scheduling module distributes services according to the performance requirement level and the trust requirement level of the service requests.

[0134] Optionally, when the performance requirement level of the security service is higher than the trust requirement level, the security service scheduling module may send the request for the service to the local security service module for execution.

[0135] For example, if the time required to execute an audio and multimedia control service (such as clicking a music play button service) is between (0, 0.05]s, the performance requirement level of the audio and multimedia control service is level 3. The audio and multimedia control service is a non-sensitive service with low information security requirements. It does not require identity authentication and authorization, nor does it have security auditing and monitoring. Therefore, the trust requirement level of the audio and multimedia control service is level 1. The performance requirement level of the audio and multimedia control service is higher than the trust requirement level. The security service scheduling module can send the request for the audio and multimedia control service to the local security service module for execution.

[0136] Optionally, when the trust requirement level of the security service is higher than the performance requirement level, the security service scheduling module can forward the service request to the TA of the trusted execution environment operating system for execution through the secure TEE proxy technology.

[0137] For example, the time required to respond to a trusted request for a real-time traffic condition and navigation display service (such as a trusted request for a navigation display service) needs to be between (0, 0.5, 0.1]s, and the performance requirement level of the trusted request for the real-time traffic condition and navigation display service is level 2. Trusted requests for real-time traffic condition and navigation display services are sensitive service requests with strict information security requirements, requiring further identity authentication and authorization, as well as continuous security auditing and monitoring, etc., and the trusted requirement level of trusted requests for real-time traffic condition and navigation display services is level 3; the trusted requirement level of trusted requests for real-time traffic condition and navigation display services is higher than the performance requirement level, and the security service scheduling module forwards the trusted request for the real-time traffic condition and navigation display service to the TA response of the trusted execution environment operating system through the secure TEE proxy technology.

[0138] Optionally, when the trust requirement level and performance requirement level of a service are the same, the security service scheduling module can forward the service to the trusted execution environment operating system's TA for execution using secure TEE proxy technology. Alternatively, the security service scheduling module can send the service request to the local security service module. This embodiment of the present application does not impose specific limitations on this.

[0139] Alternatively, when the performance requirement level of a service is higher than or equal to the first threshold and the trust requirement level is lower than the second threshold, the security service scheduling module can send the service request to the local security service module. When the trust requirement level of a service is higher than or equal to the second threshold and the performance requirement level is lower than the first threshold, the security service scheduling module can forward the service request to the trusted execution environment operating system's TA for execution using secure TEE proxy technology.

[0140] For example, the first threshold is 3 and the second threshold is 2. The performance requirement level for executing the audio and multimedia control service is level 3, which is equal to the first threshold 3; the trust requirement level is level 1, which is less than the second threshold 2. The security service scheduling module can then send the audio and multimedia control service request to the local security service module. The trust requirement level for executing the real-time traffic and navigation display service is level 3, which is higher than the second threshold 3; the performance requirement level is level 2, which is less than the first threshold 3. The security service scheduling module forwards the real-time traffic and navigation display service trust request to the trusted execution environment operating system's TA for execution using secure TEE proxy technology.

[0141] Optionally, when the performance requirement level of a service exceeds a first threshold and the trust requirement level exceeds a second threshold, the security service scheduling module may forward the service to the trusted execution environment operating system's TA for execution using secure TEE proxy technology. Alternatively, the security service scheduling module may send the service request to a local security service module. This embodiment of the present application does not impose specific limitations on this.

[0142] This embodiment of the application uses the example of a security service scheduling module sending a service request to a local security service module when the service's performance requirement is higher than the trust requirement. When the service's trust requirement is higher than the performance requirement, the security service scheduling module forwards the service request to the trusted execution environment operating system's TA for execution using secure TEE proxy technology.

[0143] Optionally, as shown in FIG7 , the security service may come from the user state or the kernel state, and the embodiment of the present application does not impose any specific restrictions on this.

[0144] Optionally, for user-mode security service requests, the security service access cryptographic service issued by the secure and trusted application is then distributed by the security service scheduling module based on the performance requirements and trust requirements of the security service.

[0145] For kernel-mode security service requests, the security service access cryptography subsystem issued by the security trust module is then distributed by the security service scheduling module based on the performance and trust requirements of the security service.

[0146] In one embodiment, as shown in FIG7 , services with performance requirements higher than trust requirements are executed by local software algorithms.

[0147] Among them, local software algorithms can perform security services.

[0148] For example, if the performance requirements for audio and multimedia control services deployed in the instrument domain operating system in the non-secure world are higher than the trust requirements, these services are executed using local software algorithms. This allows for greater processing bandwidth and reduced processing latency, thus meeting the performance requirements of these services.

[0149] In another embodiment, requests for services with higher trust requirements than performance requirements are forwarded to the TA of the trusted execution environment operating system for execution through secure TEE proxy technology.

[0150] Optionally, taking the Trusted Execution Environment operating system as the security domain operating system as an example, as shown in Figure 8, when the trust requirement of the service request is higher than the performance requirement, the security service request is forwarded to the TA response of the TEE's security domain operating system through the secure TEE proxy technology.

[0151] For example, the trusted request for the real-time traffic and navigation display service deployed in the instrument domain operating system in the non-secure world has a higher trust requirement than the performance requirement. Therefore, the trusted service request for the real-time traffic and navigation display service needs to be forwarded to the TA of the secure domain operating system of the TEE for response. This satisfies the trusted request requirement for the real-time traffic and navigation display service.

[0152] Optionally, the security service scheduling module is also used to encrypt security services to ensure the security of the service proxy process.

[0153] Optionally, the security service dispatch module can use the Advanced Encryption Standard-Galois / Counter Mode (AES-GCM) symmetric encryption algorithm to encrypt commands and data in trusted requests for real-time traffic conditions and navigation display services. The symmetric key (proxy tunnel key, PTK) of the AES-GCM symmetric encryption algorithm is negotiated using a pre-set public key.

[0154] Optionally, as shown in Figure 9, the sender and receiver can pre-negotiate the receiver's pre-set public key, which the sender holds. The sender then invokes the kernel layer's true random number generator to generate a true random number, and then generates a symmetric key based on the true random number. The sender asymmetrically encrypts the symmetric key using the receiver's pre-set public key to generate a digital envelope. The sender transmits the digital envelope to the receiver via a data path. After receiving the digital envelope, the receiver asymmetrically decrypts it using the receiver's private key to obtain the symmetric key, which it then stores locally. When the receiver receives an encrypted security service request, it can use the symmetric key to decrypt the request and then respond to the security service request.

[0155] Optionally, after the sender generates the symmetric key, the sender and the receiver may mutually confirm the validity of the symmetric key to ensure that the generated symmetric key can be used for encryption and decryption requested in subsequent security services.

[0156] It should be understood that the encryption algorithm in the embodiment of the present application is illustrated using the AES-GCM algorithm as an example, but the embodiment of the present application can also adopt other encryption algorithms, such as the Advanced Encryption Standard based on CCM mode (AES-CMAC / Counter Mode, AES-CCM) algorithm, the Advanced Encryption Standard based on CBC mode (Advanced Encryption Standard-Cipher Block Chaining, AES-CBC) algorithm or the Triple Data Encryption Algorithm (Triple Data Encryption Algorithm, 3DES) algorithm, etc. The embodiment of the present application is not limited to this.

[0157] Specifically, the instrument domain operating system executes the secure TEE proxy technology through the proxy client application in the third operating system. The third operating system is an entertainment domain operating system as an example. As shown in Figure 10, the trusted service request of the real-time traffic condition and navigation display business of the instrument domain operating system is encrypted in the secure service scheduling module. The encrypted key data (data of the trusted service request of the real-time traffic condition and navigation display business) needs to be forwarded to the TA response of the secure domain operating system of the TEE through the entertainment domain operating system using the secure TEE proxy technology. It includes the following steps S301-S307:

[0158] S301. The instrument domain operating system encrypts the trusted service request for the real-time traffic condition and navigation display business.

[0159] Optionally, trusted service requests for real-time traffic conditions and navigation display services are symmetrically encrypted using the AES-GCM algorithm in the secure service scheduling module.

[0160] Optionally, the symmetric key for encrypting the trusted service request for the real-time traffic condition and navigation display business needs to be negotiated and determined by the instrument domain operating system of the sender of the request and the security domain operating system of the receiver.

[0161] For example, the instrument domain operating system can pre-negotiate with the secure domain operating system to determine the secure domain operating system's preset public key, which the instrument domain operating system then holds. The instrument domain operating system then generates a symmetric key based on a true random number. The instrument domain operating system asymmetrically encrypts the symmetric key using the secure domain operating system's preset public key to generate a digital envelope. The instrument domain operating system then sends the digital envelope to the secure domain operating system. Upon receiving the digital envelope, the secure domain operating system asymmetrically decrypts the digital envelope using the secure domain operating system's private key to obtain the symmetric key, which it then stores in the secure domain operating system.

[0162] Optionally, the instrument domain operating system can encrypt trusted service requests for real-time traffic conditions and navigation display services using a symmetric key.

[0163] Optionally, during the encryption process of the trusted service request, a nonce value based on a true random number is preset for anti-replay verification.

[0164] S302: The instrument domain operating system sends the encrypted trusted service request for the real-time traffic condition and navigation display service to the entertainment domain operating system.

[0165] Optionally, the instrument domain operating system can send the encrypted trusted service request for the real-time traffic and navigation display service to the entertainment domain operating system via a communication channel. This communication channel can be a physical network card switching channel, a virtual network card switching channel, or a kernel proxy channel. This embodiment of the present application does not impose specific limitations on this.

[0166] Specifically, the security service dispatch module in the instrument domain operating system sends the encrypted trusted service request for the real-time traffic and navigation display service to the cross-domain communication component in the kernel layer. After receiving the encrypted trusted service request, the cross-domain communication component in the instrument domain operating system sends the encrypted trusted service request to the cross-domain communication component in the kernel layer of the entertainment domain operating system via a communication channel.

[0167] Optionally, the cross-domain communication component of the entertainment domain operating system can send encrypted trusted service requests for real-time traffic conditions and navigation display services to the proxy client application, which then forwards the services.

[0168] The proxy client application can be deployed in the user state of the entertainment domain operating system. After receiving an encrypted trusted service request for real-time traffic conditions and navigation display services, the proxy client application can directly issue high-level requests to the entertainment domain operating system. The entertainment domain operating system provides the corresponding high-level interfaces and abstraction layer, allowing the proxy client application to directly proxy and forward services without directly operating the underlying hardware or making complex system calls, making implementation relatively simple.

[0169] Alternatively, the proxy client application can be deployed in the kernel state of the entertainment domain operating system. Deploying a proxy client application in user state offers improved security and performance, isolating user state attacks. The proxy client application is also more secure when performing service proxy forwarding.

[0170] Optionally, the proxy client application can be isolated from other applications or components of the entertainment domain operating system through permission management mechanisms such as the Security Enhancement to Linux (SELinux). This prevents other applications or components of the entertainment domain operating system from obtaining information about the proxy client application, which could lead to information leakage and reduced security.

[0171] S303: The entertainment domain operating system receives the encrypted trusted service request for the real-time traffic condition and navigation display service, and sends the encrypted trusted service request for the real-time traffic condition and navigation display service to the security domain operating system through the proxy client application.

[0172] Optionally, as shown in FIG8 , the embodiment of the present application is introduced by taking the example of deploying the proxy client application in the kernel state of the entertainment domain operating system.

[0173] Optionally, the proxy client application may call a TrustZone driver (TZdriver) to send the encrypted trusted service request for the real-time traffic condition and navigation display service to the secure domain operating system.

[0174] The TZdriver is a driver for the secure domain operating system within the entertainment domain operating system's kernel, enabling communication between the entertainment domain operating system and the secure domain operating system. The TZdriver enables protected data transmission between the secure and non-secure worlds, while ensuring the confidentiality and integrity of trusted service requests for encrypted real-time traffic conditions and navigation display services.

[0175] Specifically, TzDriver can forward the encrypted trusted service request for real-time traffic conditions and navigation display services to the trusted application of the TEE's security domain operating system through the secure monitor call (SMC) instruction.

[0176] The SMC instruction is an instruction in the ARM architecture that is used to communicate and switch between the secure and non-secure worlds. It allows a proxy client application in the non-secure world to initiate requests and call trusted applications in the secure world.

[0177] S304: The security domain operating system decrypts the encrypted trusted service request for the real-time traffic condition and navigation display service.

[0178] Optionally, after receiving the encrypted trusted service request for the real-time traffic condition and navigation display service, the trusted application in the security domain operating system can parse out the nonce random number stored in the request and perform an anti-replay attack verification on the encrypted trusted service request for the real-time traffic condition and navigation display service. If the verification fails, the request is illegal and the next step is not performed. If the verification succeeds, the request is legal and the trusted application can use the stored symmetric key to decrypt the request and obtain the command and data plaintext in the trusted service request for the real-time traffic condition and navigation display service. The symmetric key is the symmetric key obtained from the instrument domain operating system in step 301.

[0179] S305: The trusted application in the security domain operating system responds to the trusted service request for the real-time traffic condition and navigation display business and obtains a response result.

[0180] Optionally, the trusted application calls an actual business trusted application to respond to the request through the TA-TA interface according to the type of the trusted service request for the real-time traffic condition and navigation display business.

[0181] The security domain operating system contains multiple TAs, each of which is an independent execution entity with its own secure execution environment and resources. TAs can provide various security functions and services, such as encryption and decryption, secure storage, and secure authentication. The TA-TA interface allows secure data transmission and calls between different TAs. Trusted applications use the TA-TA interface to call the corresponding TA to execute trusted service requests for the real-time traffic and navigation display service. The trusted application then receives a response, which is the return value of the trusted service request for the real-time traffic and navigation display service.

[0182] S306: The trusted application in the security domain operating system returns a response result to the entertainment domain operating system.

[0183] Optionally, the trusted application encrypts the response using the AES-GCM algorithm and returns it to the proxy client application in the entertainment domain operating system to prevent security data leakage. After receiving the encrypted response, the proxy client application returns it to the security service dispatch module in the instrument domain operating system. The security service dispatch module decrypts the encrypted response, obtains the response to the trusted service request for the real-time traffic and navigation display services, and returns it to the secure trusted application.

[0184] S307: The entertainment domain operating system returns the execution result to the instrument domain operating system.

[0185] Optionally, after receiving the encrypted response, the proxy client application of the entertainment domain operating system returns the encrypted response to the security service dispatch module of the instrument domain operating system. The security service dispatch module decrypts the encrypted response, obtains a response to the trusted service request for the real-time traffic and navigation display services, and returns it to the secure and trusted application.

[0186] The instrument domain operating system (IDOS) is a functional safety operating system. The secure domain operating system resides in the secure world. Trusted services provided by trusted applications within the secure domain OS ensure the trusted security of trusted service requests for real-time traffic conditions and navigation displays. This meets the information security requirements of functional safety operating systems. Trusted service requests for real-time traffic conditions and navigation displays are encrypted during forwarding to prevent data leakage, ensuring the functional safety of responding to trusted service requests for these services.

[0187] Figure 11 shows a schematic diagram of the structure of the electronic device involved in the above embodiment. It includes: a processing unit 1101, a storage unit 1102, a sending unit 1103, and a receiving unit 1104. The device can include a first secure operating system, a second secure operating system, a third operating system, a trusted execution environment operating system, or other devices.

[0188] Taking the device as an example of a device including a first secure operating system, the processing unit 1101 is used to support steps S201-S204 in Figure 6 and / or other processes for the technology described herein.

[0189] Taking the device as an example of a device including a second secure operating system, the processing unit 1101 is used to support step S301 in Figure 10 and / or other processes of the technology described in this document.

[0190] Taking the device as an example of a device including a trusted execution environment operating system, the processing unit 1101 is used to support steps S304 and S305 in Figure 10, and / or other processes used for the technology described herein.

[0191] The storage unit 1102 is configured to support the device in storing the results of the security check and / or other processes used in the technology described herein.

[0192] Taking the device as an example of a device including a second secure operating system, the sending unit 1103 is configured to support step S301 in FIG. 10 and / or other processes for the technology described herein. The receiving unit 1104 is configured to support step S307 in FIG. 10 and / or other processes for the technology described herein.

[0193] Taking the device as an example, in which the device includes a third operating system, the sending unit 1103 is configured to support step S303 in FIG. 10 and / or other processes for the technology described herein. The receiving unit 1104 is configured to support step S302 in FIG. 10 and / or other processes for the technology described herein.

[0194] Taking the device as an example of a device including a trusted execution environment operating system, the sending unit 1103 is configured to support step S306 in FIG. 10 and / or other processes for the technology described herein. The receiving unit 1104 is configured to support step S303 in FIG. 10 and / or other processes for the technology described herein.

[0195] Among them, all relevant contents of each step involved in the above method embodiment can be referred to the functional description of the corresponding functional unit, and will not be repeated here.

[0196] An embodiment of the present application also provides a chip system, as shown in Figure 12, which includes at least one processor 1201 and at least one interface circuit 1202. The processor 1201 and the interface circuit 1202 can be interconnected via lines. For example, the interface circuit 1202 can be used to receive signals from other devices. For another example, the interface circuit 1202 can be used to send signals to other devices (such as the processor 1201). Exemplarily, the interface circuit 1202 can read instructions stored in a memory and send the instructions to the processor 1201. When the instructions are executed by the processor 1201, the electronic device can execute the various steps of the method in the above embodiment. Of course, the chip system can also include other discrete devices, which is not specifically limited in the embodiment of the present application.

[0197] An embodiment of the present application further provides a computer-readable storage medium, in which computer instructions are stored. When the computer instructions are executed on an electronic device, the electronic device executes the above-mentioned related method steps to implement the method in the above-mentioned embodiment.

[0198] The embodiments of the present application also provide a computer program product. When the computer program product is run on a computer, the computer is caused to execute the above-mentioned related steps to implement the method in the above-mentioned embodiment.

[0199] In addition, an embodiment of the present application also provides a device, which can specifically be a component or module, and the device may include a connected processor and memory; wherein the memory is used to store computer-executable instructions, and when the device is running, the processor can execute the computer-executable instructions stored in the memory to enable the device to execute the methods in the above-mentioned method embodiments.

[0200] Among them, the electronic device, computer-readable storage medium, computer program product or chip provided in the embodiments of the present application are all used to execute the corresponding methods provided above. Therefore, the beneficial effects that can be achieved can refer to the beneficial effects in the corresponding methods provided above, and will not be repeated here.

[0201] Through the description of the above embodiments, those skilled in the art will clearly understand that for the sake of convenience and brevity, only the division of the above functional modules is used as an example. In actual applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above. The specific working processes of the above-described systems, devices, and units can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0202] In the several embodiments provided in this application, it should be understood that the disclosed methods can be implemented in other ways. For example, the electronic device embodiments described above are merely illustrative. For example, the division of the modules or units is merely a logical function division. In actual implementation, there may be other division methods, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of modules or units, which can be electrical, mechanical or other forms.

[0203] The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of these units may be selected to achieve the purpose of this embodiment according to actual needs.

[0204] In addition, the functional units in the various embodiments of the present application may be integrated into a single processing unit, or each unit may exist physically separately, or two or more units may be integrated into a single unit. The aforementioned integrated units may be implemented in the form of hardware or software functional units.

[0205] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for enabling a computer device (which can be a personal computer, server, or network device, etc.) or a processor to execute all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program instructions, such as flash memory, mobile hard disk, read-only memory, random access memory, magnetic disk or optical disk.

[0206] The above is only a specific embodiment of the present application, but the scope of protection of this application is not limited to this. Any changes or substitutions within the technical scope disclosed in this application should be included in the scope of protection of this application. Therefore, the scope of protection of this application should be based on the scope of protection of the claims.

Claims

1. A business processing method, characterized in that: Applied to a secure and trusted device, the secure and trusted device includes a first secure operating system migrated from a non-secure world to a secure world, the first secure operating system is isolated from a trusted execution environment operating system in the secure world, the method includes: Obtaining a request for executing a high-security and high-trust service; the request for executing the high-security and high-trust service includes a cryptographic request for the high-security and high-trust service; the cryptographic request includes at least one of an encryption request, a decryption request, a key derivation request, and a key generation request; Executing the cryptographic request through a local trusted application; The trusted application sends a cryptographic request execution result to the high-security and high-trust application; The high-security and high-trust application executes the high-security and high-trust service according to the cryptographic request execution result.

2. The method according to claim 1, characterized in that The high-security and high-trust services include autonomous driving safety services.

3. A business processing method, characterized in that: Applied to a secure and trusted device, the secure and trusted device includes a trusted execution environment operating system of a secure world and a third operating system and a second secure operating system of a non-secure world, the method includes: Obtain a request to execute a business; According to the trust requirements and performance requirements of the business request, the business request is sent to the trusted execution environment operating system or the local security service, and the business request is used to trigger the trusted execution environment operating system or the local security service that receives the business request to execute the business.

4. The method according to claim 3, characterized in that According to the trust requirements and performance requirements of the service request, sending the service request to a trusted execution environment operating system or a local security service includes: If the trust requirement of the service request is greater than the performance requirement, encrypting the service request and sending the encrypted service request to the trusted execution environment operating system; If the performance requirement of the service request is greater than the trust requirement, the service request is sent to the local security service.

5. The method according to claim 4, characterized in that The services include reliable and secure security instrument display services.

6. A business processing method, characterized in that: Applied to a secure and trusted device, the secure and trusted device includes a trusted execution environment operating system of a secure world and a third operating system and a second secure operating system of a non-secure world, the method includes: The proxy client application of the third operating system receives a first request from the second secure operating system, where the first request is an encrypted request; the proxy client application of the third operating system sends the first request to the trusted execution environment operating system; the proxy client application is isolated from other applications and / or components of the third operating system.

7. The method according to claim 6, characterized in that The first request includes a request to execute a trusted and secure safety instrument display service.

8. A business processing method, characterized in that: Applied to a secure and trusted device, the secure and trusted device includes a trusted execution environment operating system of a secure world and a third operating system and a second secure operating system of a non-secure world, the method includes: The trusted execution environment operating system receives a first request from the second secure operating system, where the first request is an encrypted request; the first request includes a request to execute a first service; decrypting the first request, executing the first service, and obtaining an execution result of the first service; The execution result of the first service is encrypted and returned to the second secure operating system.

9. The method according to claim 8, characterized in that The trusted execution environment operating system receives a first request from a second secure operating system, including: The trusted execution environment operating system receives the first request from the second secure operating system through a third operating system.

10. The method according to claim 8 or 9, characterized in that: The first service includes a reliable and secure security instrument display service.

11. A service processing device, characterized in that: Applied to a secure and trusted device, the secure and trusted device comprising a first secure operating system migrated from a non-secure world to a secure world, the first secure operating system being isolated from a trusted execution environment operating system in the secure world; The first security operating system is used to obtain a request for executing a high-security and high-trust business; the request for executing a high-security and high-trust business includes a cryptographic request for the high-security and high-trust business; the cryptographic request includes an encryption request, a decryption request, a key derivation request, At least one of a request for receiving a key and a request for generating a key; The first secure operating system is further used to execute the cryptographic request through a local trusted application; The first secure operating system is further used to send a cryptographic request execution result to the high-security and high-trust application through the trusted application; The first secure operating system is further used to execute the high-security and high-trustworthiness service through the high-security and high-trustworthiness application according to the execution result of the cryptographic request.

12. The device according to claim 11, characterized in that The high-security and high-trust services include autonomous driving safety services.

13. A service processing device, characterized in that: Applied to a secure and trusted device, the secure and trusted device includes a trusted execution environment operating system of a secure world and a third operating system and a second secure operating system of a non-secure world, the device includes: The second secure operating system is used to obtain a request for executing a service; The second secure operating system is also used to send the service request to a trusted execution environment operating system or a local security service based on the trust requirements and performance requirements of the service request, and the service request is used to trigger the reception of the service request, and the trusted execution environment operating system or the local security service executes the service.

14. The device according to claim 13, characterized in that The second secure operating system is further used for: If the trust requirement of the service request is greater than the performance requirement, encrypting the service request and sending the encrypted service request to the trusted execution environment operating system; If the performance requirement of the service request is greater than the trust requirement, the service request is sent to the local security service.

15. The device according to claim 14, characterized in that The services include reliable and secure security instrument display services.

16. A service processing device, characterized in that: Applied to a secure and trusted device, the secure and trusted device includes a trusted execution environment operating system of a secure world and a third operating system and a second secure operating system of a non-secure world, the device includes: The third operating system is used to receive a service request from the second secure operating system, wherein the first request is an encrypted request; wherein the application receiving the service request is a proxy client application of the third operating system; The third operating system is further used to send the service request to the trusted execution environment operating system; the proxy client application is isolated from other applications and / or components of the third operating system.

17. The device according to claim 16, characterized in that The first request includes a request to execute a trusted and secure safety instrument display service.

18. A service processing device, characterized in that: The invention is applied to a secure and trusted device, wherein the secure and trusted device includes a trusted execution environment operating system of a secure world and a third operating system and a second secure operating system of a non-secure world, and the device is further used for: The trusted execution environment operating system is used to receive a first request from a second secure operating system, wherein the first request is an encrypted request; the first request includes a request to execute a first service; The trusted execution environment operating system is further used to decrypt the first request, execute the first service, and obtain an execution result of the first service; The trusted execution environment operating system is further used to encrypt the execution result of the first service and return it to the second secure operating system.

19. The device according to claim 18, characterized in that The trusted execution environment operating system is further used to receive the first request from the second secure operating system through a third operating system.

20. The device according to claim 18 or 19, characterized in that The first service includes a reliable and secure security instrument display service.

21. A computer-readable storage medium, characterized in that: The method comprises computer instructions, which, when executed on an electronic device, cause the electronic device to execute the method as claimed in claim 1 or 2, or execute the method as claimed in any one of claims 3-5, or execute the method as claimed in claim 6 or 7, or execute the method as claimed in any one of claims 8-10.

22. A computer program product, characterized in that When the computer program product runs on a computer, the computer is enabled to execute the method according to claim 1 or 2, or the method according to any one of claims 3-5, or the method according to claim 6 or 7, or the method according to any one of claims 8-10.

Images