159 results about "Trusted application" patented technology

A method prevents fraudulent use by cloning of a trusted application (TA) executable in a secure execution environment (SEE) of a host device (HD). According to the method, the trusted application (TA) starts (310; 406) in a locked mode in which access to protected functionality and data of the trusted application (TA) is prohibited (312). The trusted application performs a handshake procedure (320; 400) with a computerized backend resource (BE) to verify that a current execution state of the trusted application (TA) has not already been occupied by another instance of the trusted application (TA). Only upon successful verification by the handshake procedure (320; 400) will the trusted application (TA) switch (330; 432) to an unlocked mode in which access to the protected functionality and data is permitted (332).

The invention provides a lightweight confidential container construction method based on a hardware trusted environment, which belongs to the technical field of confidential containers, and comprises a shared security memory module, a shared security storage module and a system call distribution module, according to the method, a lightweight confidential container is realized by utilizing an existing open source trusted execution environment operating system (OP-TEE) on end side embedded equipment supporting an ARM TrustZone technology; through the design based on the unique identifier of the confidential container, a plurality of confidential containers are realized in the TEE, and a plurality of trusted applications in the same confidential container have fine-grained secure memory and secure storage condition sharing, so that the communication overhead among the trusted applications in the confidential containers is reduced; the secure memory and the secure storage of the confidential container are strongly isolated from the untrusted world; according to the method, the development and deployment difficulty of the security sensitive application is reduced, and the resource utilization efficiency and the system expandability are remarkably improved while the confidentiality and integrity of hardware-level data are guaranteed.

The invention discloses a data security protection method and system for large model training. The core of the method is that a data safe box trusted application (TA application) is deployed in a trusted execution environment (TEE) and cooperatively works with a user-defined virtual file system driver at a host machine side, so that an end-to-end secret state data access control link is constructed. Before encryption protection of sensitive data, a measurement value (including code hash, configuration parameters and a runtime state) of a current TEE instance is submitted to a remote verification service through a data safe box TA application, and the verification service only sends the measurement value (including code hash, configuration parameters and a runtime state) of the current TEE instance to the remote verification service after confirming that the TEE environment meets a preset security policy (such as a kernel version, a software version and configuration parameter compliance). And generating a secret key encrypted by a custom virtual file system on a host machine side through derivation. And malicious copying of a system memory and a storage medium is prevented, so that the traditional attack defense capability is effectively improved.

The invention discloses a data migration method, device and equipment based on a trusted execution environment, a storage medium and a product. The method comprises the following steps: sending a remote attestation request to a second trusted application program in a second trusted execution environment, so that the second trusted application program generates and feeds back a remote authentication report based on the remote attestation request; performing security and credibility verification on the remote authentication report, and after the verification is passed, sending a data key acquisition request to a second credible application program, so that the second credible application program generates and feeds back a data key communication ciphertext according to the data key acquisition request; sending an encrypted data acquisition request to a second trusted application, so that the second trusted application generates and feeds back encrypted data according to the encrypted data acquisition request; and storing the data key communication ciphertext and the encrypted data. According to the technical scheme, data security migration of trusted application program data is achieved, and seamless access and use of the data in new and old environments are achieved.

The embodiment of the invention provides a near field communication (NFC) device and method, the near field communication (NFC) device part comprises an NFC controller and middleware, the middleware is used for identity authentication and encryption transmission with a TSM, and processing transmission logic between the NFC controller and an application program, and the application program is communicated with the TSM. In some embodiments, the NFC device is deployed with a trusted execution environment (TEE), and the middleware is a trusted application (TA) deployed for the TEE. According to the embodiment of the invention, the hardware cost and development cost of the NFC equipment can be reduced.

According to one embodiment, an electronic device may include: a first processor operating in a generally non-secure environment; a second processor operating in a secure environment; a first memory allocated to a generally non-secure environment; a second memory allocated to the secure environment; and a third memory shared between the generally non-secure environment and the secure environment. The second processor may be configured to encrypt at least a portion of secure data to generate an encrypted portion, where the secure data is generated by a trusted application running in a secure environment; storing the encrypted portion in a third memory; and storing, in a second memory, first information for encrypting at least a portion of the secure data and second information generated when encrypting at least a portion of the secure data. The first processor may be configured to store the encrypted portion stored in the third memory in the first memory.

An electronic device, a trusted application calling method and apparatus, a device, and a medium are disclosed. Because a trusted application development platform is linked with native trusted applications respectively corresponding to multiple trusted execution environment operating systems (TEE OS), based on the trusted application development platform, a bytecode trusted application can be applicable to any TEE OS, and for different TEE OS hardware platforms, only one corresponding bytecode trusted application needs to be developed for one application. Moreover, the trusted application development platform and the byte code trusted application can be applied to electronic devices (terminals) of different TEE OSs.

The invention provides an SoC chip pin layout intelligent optimization method based on a matrix module, and relates to the technical field of layout optimization, and the method comprises the steps: carrying out the application scene mining of an SoC chip, and carrying out the external module relation sorting of D trusted application scenes and the chip pin layout information of the SoC chip; matrix module layout compensation is carried out on the chip pin layout information according to the chip pin external relation graph network; performing D-dimensional scene search optimization on the first chip pin layout adjustment space according to the D trusted application scenes; guiding the first chip pin layout adjustment space to carry out D-round differential variation breeding expansion; and according to the layout risk analysis model and the layout improper calculation condition, carrying out progressive optimization on the second chip pin layout adjustment space to obtain a chip layout optimization result. According to the invention, the technical problem that the SoC chip pin layout stability is poor in the prior art can be solved, and the technical effect of improving the layout stability is achieved.

Methods for attestation of a vehicle feature associated with a vehicle control unit are provided and include: detecting, using a trusted application, whether a configurable feature has been activated based on one or more detection models; periodically detecting during runtime, using each of the one or more detection models, whether the configurable feature is activated; generating a report of attestation results indicating that the configurable feature is one of: activated and unauthorized; activated and authorized; un-activated and authorized; and un-activated and unauthorized; determining whether an activated feature is unauthorized, wherein the activated feature is the configurable feature that has been detected as being activated; and activating a response mechanism and restoring the configurable feature of the vehicle to an inactive state in response to the activated feature being unauthorized.

The invention provides an end-side large model parameter protection method and system based on a trusted execution environment, and the method comprises the steps: enabling a large model client application program to receive the input of a user, and transmitting the input of the user to a trusted application, namely, a large model security application; the REE OS kernel forwards the request of the user mode to the trusted application, proxy I / O and NPU of the trusted application and continuous memory allocation requests are achieved, and trusted application thread scheduling is achieved; the security monitor is used for forwarding a request of the REE OS kernel to the TEE OS kernel; the TEE OS kernel is responsible for carrying out security configuration related to the TrustZone with high privilege and realizing address space isolation between security applications; and the large model security application realizes pipeline recovery accelerated reasoning, dynamic memory capacity expansion and NPU device calling by an NPU driver to perform calculation acceleration. According to the method, the hardware acceleration capability of the reasoning task is guaranteed, meanwhile, the scale of a TEE trusted computing base (TCB) is controlled, and the overall safety and the performance expandability of the system are improved.

A resource allocation method and device are used for limiting hardware resources in a trusted execution environment used by a trusted application in hardware resources applied by tenants corresponding to the trusted application when a plurality of tenants share a rich execution environment and the trusted execution environment. In the application, the method is adapted to a resource allocation device comprising a rich execution environment and a trusted execution environment, and the method comprises the following steps: the rich execution environment obtains a trusted application request in a process of running a client application according to a file of the client application; in response to the trusted application request, the rich execution environment sends resource information and files of the trusted application to the trusted execution environment, the resource information indicating hardware resources in the resource allocation device that can be used by the trusted application. The trusted execution environment runs the trusted application according to the file and resource information of the trusted application, and hardware resources used when the trusted application runs are contained in hardware resources indicated by the resource information.

The invention relates to an integrity verification and quality evaluation method before agricultural Internet of Things data uploading, and belongs to the technical field of artificial intelligence and block chains. The method comprises the following steps: collecting agricultural Internet of Things data and constructing a data set; constructing a complete feature vector by adopting a double-branch filling network; generating a quality label for each sample; an integrity verification and quality evaluation model based on a deep neural network is constructed, and sample-level overall quality scoring, sensor-level abnormal confidence and data fingerprint generation are realized; performing verification and evaluation by setting thresholds of three prediction results; performing supervised training on the model through a composite loss function; and performing integrity verification and quality evaluation on to-be-evaluated agricultural Internet of Things data by adopting the trained model, and realizing reliable chaining, secure storage and trusted application of the agricultural Internet of Things data to a block chain for data samples which pass the integrity verification and have the overall quality score reaching the standard. The prediction precision can be improved.

The invention discloses an Android SoftPOS (Point Of Sale) trusted application method and an Android SoftPOS trusted application system. The method comprises the following steps: an application end initiates an authentication request to an application proof server, and obtains verification data and a plurality of random numbers; carrying out equipment and application integrity verification, generating an integrity proof and a hardware authentication certificate, and submitting the integrity proof and the hardware authentication certificate to a server; after the server passes the verification, signing and issuing a specific safety communication certificate of the equipment to the application end; and the application end establishes a secure communication channel with the server according to the certificate. Through multi-stage verification and a random number mechanism, it is ensured that only trusted equipment and applications can complete authentication, end-to-end secure communication is achieved by combining dynamic certificate signing and issuing, the confidentiality and integrity of payment data are remarkably improved, and the security risk is reduced.

The invention provides a safe virtual machine sensitive data full life cycle protection method and system and a medium, and the method comprises the steps that a collaborative architecture of a safe virtual machine module and a trusted execution environment module is constructed, the safe virtual machine module runs in a common world Android system and comprises a protected virtual machine, and the trusted execution environment module runs in the protected virtual machine; an encryption and decryption demand is triggered through a callback function in the load; and the trusted execution environment module runs in the secure world, and key management and encryption and decryption operations are executed by a trusted application. The two modules are connected through a data interaction module. When the protected virtual machine is closed or dormant, the sensitive data is transmitted to the trusted execution environment module through the client application to be encrypted and then stored in the nonvolatile storage; and when the protected virtual machine is started or awakened, the encrypted data is read, decrypted by the trusted execution environment module and then returned to the protected virtual machine, so that full-flow hardware-level protection of the data from operation to storage is realized. The invention aims to realize the hardware-level security protection of the sensitive data in the full life cycle of the virtual machine.

A data processing system (DPS) uses platform protection technology (PPT) to protect some or all of the code and data belonging to certain software modules. The PPT may include a virtual machine monitor (VMM) to enable an untrusted application and a trusted application to run on top of a single operating system (OS), while preventing the untrusted application from accessing memory used by the trusted application. The VMM may use a first extended page table (EPT) to translate a guest physical address (GPA) into a first host physical address (HPA) for the untrusted application. The VMM may use a second EPT to translate the GPA into a second HPA for the trusted application. The first and second EPTs may map the same GPA to different HPAs. Other embodiments are described and claimed.

Apparatus and method for role-based register protection. For example, one embodiment of an apparatus comprises: one or more processor cores to execute instructions and process data, the one or more processor cores to execute one or more security instructions to protect a virtual machine or trusted application from a virtual machine monitor (VMM) or operating system (OS); an interconnect fabric to couple the one or more processor cores to a device; and security hardware logic to determine whether to allow a read or write transaction directed to a protected register to proceed over the interconnect fabric, the security hardware logic to evaluate one or more security attributes associated with an initiator of the transaction to make the determination.

The embodiment of the invention discloses a data interaction method, system and device based on a trusted execution environment, a medium and a program. The method comprises the steps that a trusted application generates an original request instruction according to request data and sends the original request instruction to a target TEE SE API; the target TEE SE API converts the original request instruction to obtain a conversion request instruction and sends the conversion request instruction to an SE protocol stack entry API; the SE protocol stack entry API carries out SE protocol stack data unification processing on the conversion request instruction to obtain a unified request instruction and sends the unified request instruction to an SE protocol stack; the SE protocol stack sends the unified request instruction to an SE hardware unit; and the SE hardware unit processes the unified request instruction to generate an original response instruction. According to the technical scheme, the adaptation cost, the maintenance cost and the memory computing space in the data interaction process based on the trusted execution environment can be reduced, and the efficiency and maintainability of data interaction based on the trusted execution environment are improved.

To provide a method for improving embedded card reader security.SOLUTION: Provided is a method that includes temporally and / or spatially separating personal account number (PAN) data read from a payment instrument such as a credit card or debit card from personal identification number (PIN) data utilized to complete a payment transaction. Temporal separation includes removing the PAN data from a merchant device 102 before requesting the PIN data. Spatial separation includes utilizing trusted execution environments, separated embedded card reader (ECR) applications, intermediary applications, and / or trust routines of trust applications to enable different components of a merchant device and / or components of other devices and systems to handle the PAN data and the PIN data.SELECTED DRAWING: Figure 1A

The present application discloses a network detection method and related devices, electronic devices and storage media, wherein the network detection method includes: selecting an application that currently triggers a network service request as a target application; predicting the current network status based on the historical network information determined after the target application and the applications in the trusted application set each recently triggered a network service request; wherein the historical network information includes the historical network status and the historical moment when the historical network status was determined; based on the current network status, determining the timeout request duration of the target application; wherein the timeout request duration is positively correlated with the network quality represented by the current network status; and determining whether it is prompted that the network service request of the target application cannot be responded to based on whether the request feedback result of the target application is obtained within the timeout request duration. The above scheme can improve the judgment accuracy of the network status and the feedback speed of the application.

The application discloses a trusted application program starting method and device based on a trusted data space, equipment, medium and product. The method comprises the following steps: in response to a program starting request of a target trusted application program, performing integrity verification on the target trusted application program to obtain an integrity verification result; if the integrity verification result is that the verification is passed, creating a target anonymous pipe between the target trusted application program, and shielding other anonymous pipes; the other anonymous pipes are the anonymous pipes except the target anonymous pipe; starting the target trusted application program according to program starting parameters of the target trusted application program, so that the target trusted application program connects the target anonymous pipe and runs the application program itself. The technical scheme of the embodiment of the application can ensure the integrity and security in the process of installing, starting and running the trusted application program.

The invention relates to a trusted deep learning reasoning method for an ARM heterogeneous edge device. The method comprises the following steps: a deployment stage: storing a structure file and a weight of a model in a core stack of a TEE through a static trusted application PTA; in the reasoning stage, REE loads a structure model and a weight from TEE secure storage, initializes a reasoning model and creates a thread pool; dynamic trusted applications TA0 and TA1 are adopted for asynchronous cooperative verification, TA0 executes non-convolutional layer reasoning and convolutional layer verification, TA1 executes convolutional layer verification, and TA0 and TA1 are executed in a staggered mode; verifying a convolution layer reasoning result by using an FTC algorithm; the GPU is used for accelerating parallel reasoning of a convolution layer, multi-TA cooperative verification is executed through the multi-core CPU, and asynchronous parallelism of model credible reasoning and convolution credible verification is achieved. The method is low in time delay and high in reliability, the privacy and integrity of the deep learning model can be protected, the time overhead of credible reasoning is reduced, and the real-time performance of credible deep learning reasoning on the ARM heterogeneous edge device is improved.

The present disclosure provides systems and methods for non-intrusive automated trusted operator migration. According to an aspect, a method for executing code in a secure environment is provided. The method includes receiving code including an annotated portion and an unannotated portion. The annotation portion indicates a portion of the code for secure execution. The method may also include constructing a trusted application (TA) corresponding to the annotated portion in a trusted execution environment (TEE). The method may also include constructing a client application (CA) corresponding to the unannotated portion in a rich execution environment (REE).

The embodiment of the invention provides a communication method and a communication device. The method comprises the steps that a network data analysis function network element determines and discovers a trusted application function network element and an untrusted application function network element; the network data analysis function network element sends a first request and a second request to a network storage function network element, the first request is used for requesting information of a trusted application function network element, and the second request is used for requesting information of an untrusted application function network element; the network data analysis function network element receives a first response and a second response from the network storage function network element, the first response comprises the information of the trusted application function network element, and the second response comprises the information of the untrusted application function network element. Therefore, the network data analysis function network element can simultaneously obtain the information of the trusted application function network element and the information of the untrusted application function network element from the network storage function network element, and AI cooperation between the network data analysis function network element and the trusted application function network element and between the network data analysis function network element and the untrusted application function network element is satisfied.

The invention relates to a data processing method and device, electronic equipment and a medium. The data processing method comprises the following steps: acquiring calling data from a client application; setting the state of the core of the processor as an activated state in an operating system of the trusted execution environment; according to the calling data, a corresponding trusted application is called for data processing, processing result data is obtained, and the trusted application runs in an operating system of the trusted execution environment; wherein the number of the cores in the activated state is related to the number of the client applications calling the trusted application, and the cores in the activated state are used for running the trusted application. As the core in the activated state can be scheduled in the trusted execution environment, the corresponding trusted application does not need to be bound, so that the utilization rate of the processor is improved, and resources are fully utilized.

The invention provides a communication method and equipment among trusted applications in multiple trusted execution environments, which are applied to electronic equipment comprising a first trusted execution environment and a second trusted execution environment, and the first trusted execution environment comprises a first trusted application and a second trusted application. The second trusted execution environment comprises a third trusted application, a fourth trusted application and a second agent module. In response to the operation of starting the first service, a third trusted application of the electronic equipment calls the second agent module, and the first trusted application is called through a first link created by the second agent module to execute the first service; and in response to the operation of starting the second service, a fourth trusted application of the electronic equipment calls the second agent module, and calls the second trusted application through the first link to execute the second service. The first link can be reused by each trusted application of the first trusted execution environment, so that the system load can be reduced, and the communication quality among the trusted applications in the multiple trusted execution environments is improved.

The invention relates to the technical field of firmware burning, and discloses a Matter certificate burning method and device, equipment and a medium. The method comprises the steps of loading a client application and a trusted application in response to a received burning request; calling a client application to receive a certificate file and a file key sent by the external equipment, and encrypting and transmitting the certificate file and the file key to a trusted application in the trusted execution environment; and calling the trusted application to decrypt the certificate file based on the file key to obtain the Matter certificate, and writing the Matter certificate into the secure storage area of the trusted execution environment. According to the embodiment of the invention, the security of Matter certificate burning can be improved.

The present disclosure relates to a system for secure processing and storing of sensitive data and non-sensitive data for a tenant in an execution environment of a cloud service. In the system according to the present disclosure, the sensitive data includes a plaintext sensitive data element. In contrast, the non-sensitive data does not include a plaintext sensitive data element. The execution environment of the system comprises a general execution area, wherein the general execution area allows full access by the cloud service provider, and a general application service running in the general execution area, wherein the general application service does not have access to the sensitive data, and wherein the general application service only processes the non-sensitive data. Furthermore, the execution environment of the system comprises a trusted execution area, and a trusted application service running in the trusted execution area.

Embodiments of the present disclosure provide a key management method, a mobile device for a digital currency transaction, an apparatus, a system, and a storage medium. The mobile device serves as an acceptance terminal, and comprises a digital currency acquirer application executable in a first execution environment and a digital currency trusted application executable in a second execution environment, and the second execution environment is securely isolated from the first execution environment. The digital currency acquirer application is configured to send a key application request to a digital currency background system, receive core key data by means of a secure channel between the digital currency background system and the mobile device, and when it is detected that the mobile device has the second execution environment and the executable digital currency trusted application is installed in the second execution environment, send the core key data to the digital currency trusted application. The digital currency trusted application is configured to receive the core key data sent by the digital currency acquirer application and store the core key data in the second execution environment.

Embodiments are directed to protection of communications between a trusted execution environment and a hardware accelerator utilizing enhanced end-to-end encryption and inter-context security. An embodiment of an apparatus includes one or more processors having one or more trusted execution environments (TEEs) including a first TEE to include a first trusted application; an interface with a hardware accelerator, the hardware accelerator including trusted embedded software or firmware; and a computer memory to store an untrusted kernel mode driver for the hardware accelerator, the one or more processors to establish an encrypted tunnel between the first trusted application in the first TEE and the trusted software or firmware, generate a call for a first command from the first trusted application, generate an integrity tag for the first command, and transfer command parameters for the first command and the integrity tag to the kernel mode driver to generate the first command.

A zero trust application enables access to a protected resource from a client device associated with a user. The client device has a browser, and an agent running locally and accessible via a local loopback interface. During an authentication flow, a browser-based script executes in the browser to deliver a challenge to the agent, and to collect a response to that challenge from the agent using a graphics file-based encoding scheme, and to deliver that information to the application for verifying the client device and its security posture. Depending on that security posture, the authentication flow may be permitted to complete. If a failure of the security posture is identified, the user may be permitted during the on-going authentication flow to address that failure and request a re-check of the posture.