Patent Description:
Mobile payment (Mobile Payment) is a service mode in which a user is allowed to use a mobile terminal, for example, a mobile phone, a tablet computer, or a wearable apparatus, to pay for purchased goods or services. Currently, a mobile terminal implements mobile payment in three solutions: a secure digital (Secure Digital, SD) card solution, a subscriber identity module (Subscriber Identity Module, SIM) solution, and an all-terminal solution of combining near field communication (Near Field Communication, NFC) and a secure element (Secure Element, SE). Currently, the all-terminal solution of combining near field communication and a secure element is becoming a mainstream solution for implementing mobile payment.

With development of mobile application scenarios, more types of application software are run by the secure element, and system service requirements are also increasing. For example, there are more concurrent applications, to be specific, multi-channel application processing is supported at the same time. More platform functions result in an increasing large system image (OS image). Consequently, a requirement for a memory space used for running corresponding application software or an operating system in the secure element is also increasing. However, the secure element can be run only in an internal RAM, and cannot directly access a larger external storage. As a result, a current service growth requirement cannot be met. For this disadvantage, dynamic loading may be implemented by using a memory management unit (Memory Management Unit, MMU) or a dedicated address mapping module. A basic procedure is as follows:.

<CIT> discloses a method relating generally to loading a boot image. In such a method, a header of a boot image file is read by boot code executed by a system-on-chip. It is determined whether the header read has an authentication certificate. If the header has the authentication certificate, authenticity of the header is verified with the first authentication certificate. It is determined whether the header is encrypted. If the header is encrypted, the header is decrypted.

<CIT> disclose a mobile payment apparatus and method. The mobile payment apparatus includes a communication unit configured to exchange payment information with a communication peer end using a radio link, a memory configured to store mobile payment software, a SE, including a first storage module and a processor, and at least one CPU configured to execute general operating system software.

The foregoing uses the dynamic loading technology to resolve a problem that a memory is insufficient because a quantity of services in the secure element increases. However, how to effectively ensure security of a program that is dynamically loaded to a secure element is an urgent problem to be resolved.

Embodiments of the present invention provide a secure element and a related device, to ensure that a secure operating system run by the secure element is run securely when the secure operating system is dynamically loaded to a memory of the secure element.

The present invention is as defined in the appended independent claims. Further embodiments are provided by the dependent claims. Embodiments in the description not covered by the claims are provided for explanatory purpose only.

According to a first aspect, an embodiment of the present invention provides a secure element. The secure element may include a processor and a memory. The processor and the memory are integrated into a semiconductor chip. The memory is configured to provide a storage space for the processor to load and run a secure program. The secure program includes an image of a secure operating system. The image of the secure operating system includes a system image resident segment and a system image dynamic loading segment. The system image resident segment resides in the memory when the processor runs the secure operating system. The processor is configured to: divide the system image dynamic loading segment into a plurality of pages, where each of the plurality of pages includes some content of the system image dynamic loading segment; perform security processing on each of the plurality of pages; and migrate each security-processed page to an external storage for the secure element.

According to the technical solution provided in the first aspect, the processor of the secure element can divide a dynamic loading part of the secure operating system into a plurality of pages, perform security processing on each of the plurality of pages, and then store each security-processed page into the external storage for the secure element, so as to ensure that the dynamic loading part is run securely when the dynamic loading part is loaded from the external storage to the memory of the secure element.

According to a second aspect, an embodiment of the present invention provides a secure element. The secure element may include a processor and a memory. The processor and the memory are integrated into a semiconductor chip. The memory is configured to provide a storage space for the processor to load and run a secure program. The secure program includes an image of a secure operating system. The image of the secure operating system includes a system image resident segment and a system image dynamic loading segment. The system image resident segment resides in the memory when the processor runs the secure operating system. The system image dynamic loading segment is divided into a plurality of pages, and security processing has been performed on content on each of the plurality of pages. The processor is configured to: when running the secure operating system, load at least one of the plurality of pages to the memory, and perform security verification on the at least one page. The security verification is an inverse operation of the security processing.

According to the technical solution provided in the second aspect, the processor of the secure element can perform security verification on the security-processed plurality of pages of the system image dynamic loading segment, to ensure that the dynamic loading part is run securely when the dynamic loading part is loaded from an external storage to the memory of the secure element.

According to a third aspect, an embodiment of the present invention provides a secure element. The secure element may include a processor and a memory. The processor and the memory are integrated into a semiconductor chip. The processor is configured to: obtain a system image resident segment from an external storage; perform security verification on the system image resident segment; and migrate the security-verified system image resident segment to the memory. The system image resident segment resides in the memory when the processor runs the secure operating system. The memory is configured to provide the storage space for the processor to run a secure program. The secure program includes an image of the secure operating system. The image of the secure operating system includes the system image resident segment and a system image dynamic loading segment, the system image dynamic loading segment is divided into a plurality of pages, and each of the plurality of pages includes some content of the system image dynamic loading segment. The processor is further configured to: obtain the plurality of pages from the external storage; perform security verification on each of the plurality of pages; migrate each security-verified page to the memory; and run the secure program by using the storage space provided by the memory.

According to the technical solution provided in the third aspect, the processor of the secure element can perform security verification on the security-processed plurality of pages of the system image dynamic loading segment, to ensure that the dynamic loading part is run securely when the dynamic loading part is loaded from the external storage to the memory of the secure element.

With reference to the first aspect, the second aspect, or the third aspect, in a possible implementation, the security processing includes performing encryption and generating a message authentication code MAC. An encryption key for each page is associated with a virtual address of the page, and encryption keys for different pages are different. In this implementation, encryption and MAC generation are performed on each of the plurality of pages obtained by dividing the system image dynamic loading segment, to ensure privacy and validity of each page. In addition, because an encryption key for each page is associated with a virtual address of the page, it is ensured that the encryption keys for all the pages are different. This can ensure privacy more effectively; can further ensure that each key is traceable, to avoid an error caused by a key loss; and can further avoid an error caused by a data address confusion.

With reference to the first aspect, the second aspect, or the third aspect, in a possible implementation, the security processing further includes: encrypting a plurality of MACs for the plurality of pages as a whole; or encrypting a MAC for each of the plurality of pages, where encryption keys for different MACs are different. This implementation can ensure privacy of a MAC corresponding to each of the plurality of pages of the system image dynamic loading segment. In addition, when the MACs corresponding to the plurality of pages are encrypted as a whole, the MACs may be stored in the external storage for the secure element as a whole. Alternatively, when each page is separately encrypted by using an unused key, the pages may be separately stored in the external storage for the secure element.

With reference to the first aspect, the second aspect, or the third aspect, in a possible implementation, the secure element further includes a one-time programmable OTP; and an encryption key for each of the plurality of pages is associated with a count value of the OTP; and/or a MAC for each of the plurality of pages is associated with a count value of the OTP of the secure element. This implementation can prevent a network attacker from performing replacement by using a historical version of an encryption key for each page or a historical version of a MAC corresponding to each page, to prevent a rollback.

With reference to the first aspect, the second aspect, or the third aspect, in a possible implementation, the image of the secure operating system further includes a first signature for the system image resident segment, and a second signature for the system image resident segment, the first signature, and the system image dynamic loading segment. The processor is further configured to: verify the second signature, and after verification on the second signature succeeds, encrypt the system image resident segment and the first signature as a whole, and migrate content obtained by encrypting the system image resident segment and the first signature as a whole to the external storage for the secure element. In this implementation, a server side signs and encrypts the image of the secure operating system for a second time, to separately protect validity of the system image resident segment and the system image dynamic loading segment that are obtained through division on the server side, so that separate validity verification can be performed on the secure element. In this way, because the system image resident segment is signed one more time, security of the system image resident segment is better ensured. In addition, when loading and storing the system image resident segment for the first time, the secure element does not need to sign the system image resident segment again, thereby reducing a secure processing operation of the processor of the secure element.

With reference to the first aspect, the second aspect, or the third aspect, in a possible implementation, the processor is further configured to configure at least one page frame in the storage space provided by the memory. Each of the at least one page frame is used to store at least one of the plurality of pages, and a quantity of pages included in the at least one page frame is less than a quantity of pages included in the plurality of pages. In this implementation, a comparatively small virtual address space is reserved in the memory of the secure element, to reserve a flexible running space for the dynamic system image loading part of the secure operating system. This can not only reduce a space occupied in the memory when the secure operating system is run, but also flexibly load a page in the system image dynamic loading segment that needs to be run.

With reference to the first aspect, the second aspect, or the third aspect, in a possible implementation, the processor is further configured to configure the at least one page frame to allow read and write when the processor is in a privileged mode. In this implementation, because a function of the page frame is to perform page-based loading on the dynamic loading segment of the secure operating system, the page frame may be frequently read, written, and replaced, and consequently, a possibility of attacking the page frame by a network attacker is greatly increased. However, if an attribute of the page frame is configured to allow read and write only in a privileged mode, in the privileged mode, a possibility of attacking or reading and writing (stealing or tamping with) the page frame is greatly reduced due to attribute settings. Therefore, loading and running security of the system image dynamic loading segment can be further ensured.

With reference to the first aspect, the second aspect, or the third aspect, in a possible implementation, the processor is further configured to: when running the secure operating system, load the at least one security-processed page to the memory, and perform security verification on the at least one page. The security verification is an inverse operation of the security processing. In this implementation, when the processor of the secure element needs to read any one of the plurality of pages of the system image dynamic loading segment, the processor needs to read the page from the external storage, and perform security verification. Effective physical address mapping can be performed on only data corresponding to a page on which security verification succeeds. In this way, the processor can effectively read the data corresponding to the page.

With reference to the first aspect, the second aspect, or the third aspect, in a possible implementation, when the security processing includes encryption and MAC generation, the security verification includes decryption and MAC verification. In this implementation, when installing or upgrading the secure operating system, the secure element may perform page-based encryption on the system image dynamic loading segment and generate the MAC; and when any page in the system image dynamic loading segment is started, the secure element needs to perform corresponding decryption and MAC verification, to ensure security of the secure operating system that is loaded and run in the secure element.

With reference to the first aspect, the second aspect, or the third aspect, in a possible implementation, the secure program further includes a secure application program, and the secure application program includes an application program resident segment and an application program dynamic loading segment. The application program resident segment resides in the memory when the processor runs the secure application program. The processor is further configured to: divide the application program dynamic loading segment into a plurality of pages, where each of the plurality of pages includes some content of the application program dynamic loading segment; perform the security processing on each of the plurality of pages; and migrate each security-processed page to the external storage for the secure element. In this implementation, page security processing and page security verification on the dynamic loading segment of the secure operating system in any one of the first aspect or the implementations of the first aspect may also be applied to a secure application program that has a security requirement or that needs to be run in the secure element. To be specific, page security processing is performed on the resident segment and the dynamic loading segment in the dynamic loading segment that are obtained by dividing the secure application program. For related security processing, and an implementation and a beneficial effect of subsequent security verification, refer to related descriptions of any one of the first aspect or the implementations of the first aspect.

With reference to the first aspect, the second aspect, or the third aspect, in a possible implementation, the secure program further includes a secure application program. The processor is further configured to: divide the secure application program into a plurality of pages, where each of the plurality of pages includes some content of the secure application program; perform the security processing on each of the plurality of pages; and migrate each security-processed page to the external storage for the secure element. In this implementation, page security processing and page security verification on the dynamic loading segment of the secure operating system in any one of the first aspect or the implementations of the first aspect may also be applied to a secure application program that has a security requirement or that needs to be run in the secure element. To be specific, the entire secure application program is divided into only the dynamic loading segment for security processing. For related security processing, and an implementation and a beneficial effect of subsequent security verification, refer to related descriptions of any one of the first aspect or the implementations of the first aspect.

According to a fourth aspect, an embodiment of the present invention provides a computing device. The computing device may include a processor and a memory. The memory is configured to provide a storage space for running of the processor. The processor is configured to: divide an image of a secure operating system into a system image resident segment and a system image dynamic loading segment; generate a first signature for the system image resident segment; and generate a second signature for the system image resident segment, the first signature, and the system image dynamic loading segment. The secure operating system is an operating system run by a secure element disposed in a terminal device.

According to the technical solution provided in the fourth aspect, the processor of the computer device can divide the image of the secure operating system, and perform two times of signature and encryption on the system image resident segment and dynamic image loading segment, to ensure security of the image of the secure operating system.

In a possible implementation, the processor is further configured to control the computing device to send the system image resident segment, the first signature, the system image dynamic loading segment, and the second signature to the terminal device. In this implementation, the computer device may securely transmit the image of the secure operating system to the terminal device side.

According to a fifth aspect, an embodiment of the present invention provides a security processing method. The method may include:
dividing, by a terminal device, a system image dynamic loading segment into a plurality of pages, where each of the plurality of pages includes some content of the system image dynamic loading segment, the system image dynamic loading segment is a partial image of a secure operating system included in a secure program, an image of the secure operating system includes the system image resident segment and the system image dynamic loading segment, and the system image resident segment resides in the memory in the secure element when a processor of the secure element of the terminal device runs the secure operating system; performing, by the terminal device, security processing on each of the plurality of pages; migrating, by the terminal device, each security-processed page to an external storage for the secure element; and when running the secure operating system, loading, by the terminal device, the at least one security-processed page to the memory, and performing security verification on the at least one page, where the security verification is an inverse operation of the security processing.

According to a sixth aspect, an embodiment of the present invention provides a security processing method. The method may include:.

According to a seventh aspect, an embodiment of the present invention provides a security processing method. The method may include:
receiving, by a terminal device, a secure program sent by a server, where the terminal device includes a secure element, the secure element includes a processor and a memory, the processor and the memory are integrated into a semiconductor chip, the memory is configured to provide a storage space for the processor to load and run the secure program, the secure program includes an image of a secure operating system, and the image of the secure operating system includes a system image resident segment and a system image dynamic loading segment, where the system image resident segment resides in the memory when the processor runs the secure operating system; dividing, by the terminal device, the system image dynamic loading segment into a plurality of pages by using the processor, where each of the plurality of pages includes some content of the system image dynamic loading segment; performing, by the terminal device, security processing on each of the plurality of pages by using the processor; migrating, by the terminal device, each security-processed page to an external storage for the secure element by using the processor; and when running the secure operating system, loading, by the terminal device, the at least one security-processed page to the memory by using the processor, and performing security verification on the at least one page by using the processor, where the security verification is an inverse operation of the security processing.

According to the technical solution provided in the seventh aspect, the processor of the secure element of the terminal device can divide a dynamic loading part of the secure operating system into a plurality of pages, perform security processing on each of the plurality of pages, and then store each security-processed page into the external storage for the secure element, so as to ensure that the dynamic loading part is run securely on the terminal device.

With reference to the fifth aspect, the sixth aspect, or the seventh aspect, in a possible implementation, the security processing includes performing encryption and generating a message authentication code MAC. An encryption key for each page is associated with a virtual address of the page, and encryption keys for different pages are different.

With reference to the fifth aspect, the sixth aspect, or the seventh aspect, in a possible implementation, the security processing further includes: encrypting a plurality of MACs for the plurality of pages as a whole; or encrypting a MAC for each of the plurality of pages, where encryption keys for different MACs are different.

With reference to the fifth aspect, the sixth aspect, or the seventh aspect, in a possible implementation, the secure element further includes a one-time programmable OTP; and an encryption key for each of the plurality of pages is associated with a count value of the OTP; and/or a MAC for each of the plurality of pages is associated with a count value of the OTP of the secure element.

With reference to the fifth aspect, the sixth aspect, or the seventh aspect, in a possible implementation, the image of the secure operating system further includes a first signature for the system image resident segment, and a second signature for the system image resident segment, the first signature, and the system image dynamic loading segment. The method further includes: verifying, by the terminal device, the second signature; and after verification on the second signature succeeds, encrypting the system image resident segment and the first signature as a whole, and migrating content obtained by encrypting the system image resident segment and the first signature as a whole to the external storage for the secure element.

With reference to the fifth aspect, the sixth aspect, or the seventh aspect, in a possible implementation, the method further includes: configuring, by the terminal device, at least one page frame in the storage space provided by the memory, where each of the at least one page frame is used to store at least one of the plurality of pages, and a quantity of pages included in the at least one page frame is less than a quantity of pages included in the plurality of pages.

With reference to the fifth aspect, the sixth aspect, or the seventh aspect, in a possible implementation, the method further includes: configuring, by the terminal device, the at least one page frame to allow read and write when the processor is in a privileged mode.

With reference to the fifth aspect, the sixth aspect, or the seventh aspect, in a possible implementation, the method further includes: when running the secure operating system, loading the at least one security-processed page to the memory, and performing security verification on the at least one page. The security verification is an inverse operation of the security processing.

With reference to the fifth aspect, the sixth aspect, or the seventh aspect, in a possible implementation, when the security processing includes encryption and MAC generation, the security verification includes decryption and MAC verification.

With reference to the fifth aspect, the sixth aspect, or the seventh aspect, in a possible implementation, the secure program further includes a secure application program, and the secure application program includes an application program resident segment and an application program dynamic loading segment. The application program resident segment resides in the memory when the processor runs the secure application program.

The method further includes: dividing, by the terminal device, the application program dynamic loading segment into a plurality of pages, where each of the plurality of pages includes some content of the application program dynamic loading segment; performing the security processing on each of the plurality of pages; and migrating each security-processed page to the external storage for the secure element.

With reference to the fifth aspect, the sixth aspect, or the seventh aspect, in a possible implementation, the secure program further includes a secure application program. The method further includes: dividing, by the terminal device, the secure application program into a plurality of pages, where each of the plurality of pages includes some content of the secure application program; performing the security processing on each of the plurality of pages; and migrating each security-processed page to the external storage for the secure element.

According to an eighth aspect, this application provides a semiconductor chip. The semiconductor chip may include:
the secure element provided in any one of the first aspect, the second aspect, the third aspect, and the implementations of the foregoing three aspects, and a central processing unit that is coupled to the secure element and an external storage for the secure element.

According to a ninth aspect, this application provides a semiconductor chip. The semiconductor chip may include:
the secure element provided in any one of the first aspect, the second aspect, the third aspect, and the implementations of the foregoing three aspects.

According to a tenth aspect, this application provides a system on chip SoC chip. The SoC chip includes the secure element provided in any one of the first aspect, the second aspect, the third aspect, and the implementations of the foregoing three aspects, and a central processing unit that is coupled to the secure element and an external storage for the secure element. The chip system may include a chip, or may include a chip and another discrete device.

According to an eleventh aspect, this application provides a chip system. The chip system includes the chip including the secure element provided in any one of the first aspect, the second aspect, the third aspect, and the implementations of the foregoing three aspects, and a second chip including a central processing unit that is coupled to the secure element and an external storage for the secure element. The chip system may include a chip, or may include a chip and another discrete device.

According to a twelfth aspect, this application provides a chip system. The chip system includes the secure element provided in any one of the first aspect, the second aspect, the third aspect, and the implementations of the foregoing three aspects, a third chip coupled to the central processing unit of the secure element, and a fourth chip including the external storage for the secure element. The chip system may include a chip, or may include a chip and another discrete device.

According to a thirteenth aspect, this application provides a terminal device. The terminal device includes a secure element, a central processing unit coupled to the secure element, and an external storage for the secure element. The secure element includes a processor and a memory, and the processor and the memory are integrated into a semiconductor chip. The memory is configured to provide a storage space for the processor to load and run a secure program. The secure program includes an image of a secure operating system. The image of the secure operating system includes a system image resident segment and a system image dynamic loading segment. The system image resident segment resides in the memory when the processor runs the secure operating system. The processor is configured to: divide the system image dynamic loading segment into a plurality of pages, where each of the plurality of pages includes some content of the system image dynamic loading segment; perform security processing on each of the plurality of pages; and migrate each security-processed page to an external storage for the secure element.

According to a fourteenth aspect, this application provides a terminal device. The terminal device includes a secure element, a central processing unit coupled to the secure element, and an external storage for the secure element. The secure element may include a processor and a memory. The processor and the memory are integrated into a semiconductor chip. The memory is configured to provide a storage space for the processor to load and run a secure program. The secure program includes an image of a secure operating system. The image of the secure operating system includes a system image resident segment and a system image dynamic loading segment. The system image resident segment resides in the memory when the processor runs the secure operating system. The system image dynamic loading segment is divided into a plurality of pages, and security processing has been performed on content on each of the plurality of pages. The processor is configured to: when running the secure operating system, load at least one of the plurality of pages to the memory, and perform security verification on the at least one page. The security verification is an inverse operation of the security processing.

According to a fifteenth aspect, this application provides a terminal device. The terminal device includes the secure element provided in any one of the first aspect, the second aspect, the third aspect, and the implementations of the foregoing three aspects, and the external storage for the secure element. The secure element and the external storage for the secure element are disposed in different semiconductor chips.

According to a sixteenth aspect, this application provides a terminal device. The terminal device includes the secure element provided in any one of the first aspect, the second aspect, the third aspect, and the implementations of the foregoing three aspects, the external storage for the secure element, and a central processing unit coupled to the secure element. The external storage is configured to store a secure program and another necessary program instruction and data. The central processing unit is configured to run a general-purpose operating system necessary for the terminal device, and is configured to be coupled to the secure element to install and run the secure operating system in the secure element. The terminal device may further include a communications interface. The communications interface is used by the terminal device to communicate with another device or a communications network.

According to a seventeenth aspect, this application provides a computer storage medium, configured to store a computer software instruction used by the terminal device provided in the thirteenth aspect to the sixteenth aspect. The computer software instruction includes a program designed for performing the foregoing aspects.

According to an eighteenth aspect, an embodiment of the present invention provides a computer program. The computer program includes an instruction. When the computer program is executed by a computer, the computer is enabled to perform the procedure performed by the processor and the memory in the secure element provided in any one of the first aspect, the second aspect, the third aspect, and the implementations of the foregoing three aspects, or perform the procedure of the security processing method provided in any one of the fifth aspect to the seventh aspect and the implementations of the fifth aspect to the seventh aspect.

In the specification, claims, and accompanying drawings of this application, terms such as "first", "second", "third", and "fourth" are intended to distinguish between different objects but do not indicate a particular order. In addition, terms "including", "having", and any other variant thereof, are intended to cover a non-exclusive inclusion. For example, a process, a method, a system, a product, or a device including a series of steps or units is not limited to the listed steps or units, but optionally further includes an unlisted step or unit, or optionally further includes another step or unit inherent in the process, the method, the product, or the device.

The "embodiment" in this specification means that a particular characteristic, structure, or feature described with reference to the embodiment may be included in at least one embodiment of this application. The phrase shown in various locations in the specification may not necessarily refer to a same embodiment, and is not an independent or optional embodiment exclusive from another embodiment. It is explicitly and implicitly understood by a person skilled in the art that the embodiments described in this specification may be combined with another embodiment.

Terms such as "component", "module", and "system" used in this specification are used to indicate a computer-related entity, hardware, firmware, a combination of hardware and software, software, or software that is being executed. For example, the component may be, but is not limited to, a process that is run on a processor, a processor, an object, an executable file, a thread of execution, a program, and/or a computer. As shown in figures, both a computing device and an application that is run on a computing device may be components. One or more components may reside in a process and/or a thread of execution, and the components may be located on one computer and/or distributed between two or more computers. In addition, these components may be executed from various computer-readable media that store various data structures. For example, the components may communicate with each other, for example, by using a local and/or remote process based on a signal having one or more data packets (for example, data from two components that interact with another component in a local system, a distributed system, and/or a network, for example, an internet that interacts with another system by using a signal).

Some terms in this application are first described, to help a person skilled in the art have a better understanding.

From the foregoing descriptions of the symmetric-key algorithm and the asymmetric-key algorithm, it can be learned that a same key is used for symmetric key encryption and decryption, or a decryption key can be easily derived from an encryption key. The symmetric-key algorithm is characterized by simple encryption processing, fast encryption and decryption, a short key, a long development history, and the like. The asymmetric-key algorithm is characterized by slow encryption and decryption, a large key size, a short development history, and the like.

For ease of understanding the embodiments of the present invention, the embodiments of the present invention provide a system architecture for description. <FIG> is an architectural diagram of a system for installing and upgrading a secure program according to an embodiment of the present invention. Referring to <FIG>, the system architecture may include a terminal device <NUM> and a server <NUM>. The terminal device <NUM> obtains a secure program by using the server <NUM>, to install, run, or upgrade the secure program. The terminal device <NUM> may include a secure element <NUM>, and optionally, may further include a mobile communications unit/wireless communications unit <NUM> and a central processing unit <NUM>. Optionally, as shown in <FIG>, the secure element <NUM>, the central processing unit <NUM>, and the mobile communications unit/wireless communications unit <NUM> may be located on a substrate of an integrated circuit, that is, becoming a master chip <NUM>. The secure element <NUM> specifically communicates with the central processing unit <NUM> on the master chip <NUM> through a serial peripheral interface (Serial Peripheral Interface, SPI).

The secure element <NUM>, namely, the secure element in this application, may be a component coupled to the independent central processing unit (Central Processing Unit, CPU) <NUM>; and is configured to: implement various functions related to running of a security service, for example, running a secure program (including a secure operating system and a secure application program), and store data such as a key and a certificate that are related to running of the secure program.

The mobile communications unit/wireless communications unit <NUM> is configured for the central processing unit <NUM> to: obtain a secure program from the server <NUM> by using a radio access network (Radio Access Network, RAN) <NUM> and a mobile communications network, or obtain a secure program from the server by using a wireless network <NUM>. The internet is connected to the server <NUM> in the Internet. In this case, the mobile communications unit <NUM> may be a unit that runs a wireless cellular communications protocol, and is configured to connect the mobile terminal device <NUM> to the internet by using a wireless cellular communications link <NUM>. Alternatively, the wireless communications unit <NUM> is a unit that runs a wireless network communications protocol, and is configured to connect the mobile terminal device <NUM> to the internet by using a wireless network communications link <NUM>. The mobile communications unit <NUM> may specifically run a wireless cellular communications protocol such as a global system for mobile communications (Global System for Mobile, GSM), a universal mobile telecommunications system (Universal Mobile Telecommunications System, UMTS), worldwide interoperability for microwave access (Worldwide Interoperability for Microwave Access, WiMAX), or long term evolution (Long Term Evolution, LTE), to implement a mobile internet function of the mobile terminal device <NUM>. Alternatively, the wireless communications unit <NUM> may specifically run a Bluetooth communication protocol, an infrared communication protocol, and a wireless fidelity (Wireless Fidelity, WiFi) protocol to implement a wireless internet function of the mobile terminal device <NUM>.

The central processing unit <NUM> is configured to obtain the secure program from a side of the server <NUM>, and runs operating system software <NUM>, for example, system software such as Android (Android) and iOS. The central processing unit <NUM> is configured to be coupled to and cooperate with the secure element <NUM> to perform a related secure service, for example, controlling to enable or disable the secure element <NUM> or transmitting the secure program to the secure element for installation, running, or upgrade.

In addition, the terminal device <NUM> may further include an input unit <NUM>. The input unit <NUM> may be a touchscreen, and is configured to exchange a message with a user by using a user interface (User Interface, UI), so that the user may enter an operation instruction on the input unit <NUM> by using the UI, to instruct the operating system software <NUM> and related application software to perform a related operation, such as downloading, update, or upgrade of a secure operating system/secure application.

The server <NUM> may be configured to perform security processing on an image of the secure operating system including a system image resident segment and a system image dynamic loading segment, or on a secure application program including an application program resident segment and an application program dynamic loading segment, and store the security-processed image or secure application program.

As a refinement of some content in <FIG>, <FIG> is a schematic structural diagram of a simplified terminal device including a secure element and a central processing unit according to an embodiment of the present invention. The secure element and the central processing unit may be located in one terminal device <NUM>. The terminal device <NUM> may be user equipment (User Equipment, UE), for example, any type of portable terminal device such as a mobile phone or a tablet computer. The terminal device <NUM> includes a first semiconductor chip IC <NUM> and a second semiconductor chip IC <NUM>. The first semiconductor chip IC <NUM> includes a secure element <NUM> and one or more general-purpose central processing units <NUM> coupled to the secure element <NUM>. The secure element <NUM> includes a processor <NUM> and a memory <NUM>, and optionally further includes a DMA (direct memory access) controller <NUM> and a security processing unit <NUM>.

The processor <NUM> is configured to: install or run secure operating system software and a secure application program that is based on the secure operating system software, and perform security processing and security verification on a secure operating system.

The memory <NUM> is configured to temporarily store secure temporary data generated when the secure operating system software and the secure application program are run; and may be understood as a RAM in the secure element, to be specific, the memory <NUM> provides, for the processor <NUM>, a memory space required for running the secure operating system or the secure application program. The memory <NUM> may be a volatile memory (Random Access Memory, RAM).

Optionally, as shown in <FIG>, the secure element <NUM> further includes a DMA (direct memory access) controller <NUM>, configured to control data migration between the memory <NUM> and an external storage <NUM>/<NUM>. The DMA controller <NUM> is a component independent of the processor <NUM>, and is exclusively configured to migrate temporary data in the secure element <NUM> to another external device or interface. The processor <NUM> does not need to be responsible for a corresponding data migration function. In this case, the processor <NUM> only needs to run and process a secure program, and the DMA controller <NUM> migrates data. Further, the secure element <NUM> may further include the security processing unit <NUM> that has a security function of performing security operation processing such as encryption/decryption, MAC generation, and MAC verification. A difference from the foregoing implementation in which the processor <NUM> directly performs security processing and security verification lies in that the security processing unit <NUM> in this implementation is a unit independent of the processor <NUM>, and is dedicated to security operations such as encryption/decryption, MAC generation, and MAC verification, so that performance is better. Optionally, the processor <NUM>, the DMA controller <NUM>, and the security processing unit <NUM> in the secure element <NUM> may be considered as a whole, that is, the processor <NUM> having processing and operation functions, and the memory <NUM> is used as a memory of the processor.

The central processing unit <NUM> may be, for example, an ARM processor configured to run general-purpose operating system software, for example, an Android system, and is driven by the general-purpose operating system software to communicate with the secure element <NUM>. Further, referring to <FIG>, the first semiconductor chip IC <NUM> may further include a storage controller <NUM> and a random access memory <NUM>. The central processing unit <NUM>, the random access memory <NUM>, and the storage controller <NUM> may be included in a general-purpose processor system <NUM>. The general-purpose processor system <NUM> can be run based on general-purpose operating system software and common application software, and may selectively work in a TEE environment. Because the general-purpose processor system <NUM> cannot directly access or directly read data in the secure element <NUM>, the general-purpose processor system <NUM> exchanges data with the secure element <NUM> by using the random access memory <NUM>, and conforms to an IPC protocol.

Further referring to <FIG>, a related storage device is located in the second semiconductor chip IC <NUM>, and the storage device may store a general-purpose operating system run by the at least one central processing unit <NUM>, a secure operating system run by the secure element <NUM>, or intermediate data or temporary data generated when the operating system is run. Therefore, an external storage device may be an external storage <NUM> (an external non-volatile memory NVM), for example, may be a replay protected memory block (Replay Protected Memory Block, RPMB) memory. Further, the storage device may further include an external storage <NUM> (a volatile storage device), may be an external DDR, for example, a random access memory such as an SRAM (static random access memory), a DRAM (dynamic random access memory), or an SDRAM (synchronous dynamic random access memory), and preferably, is a DDR SDRAM.

It should be noted that, when the memory <NUM> in the secure element <NUM> exchanges related secure data with the external storage <NUM>/<NUM> disposed on the second semiconductor chip IC <NUM>, for example, the system image resident segment and the system image dynamic loading segment of the secure operating system and the like described in this embodiment of the present invention are migrated, the data migration needs to pass through the random access memory <NUM>. Specifically, the processor <NUM> or the DMA controller <NUM> is configured to read data of a secure program from the memory <NUM> and write the data into the random access memory <NUM>. The storage controller <NUM> may be a DMA controller. The DMA controller may be configured to write temporary data of the random access memory <NUM> into the external storage <NUM>/<NUM> in a TEE environment, to migrate the temporary data from the secure element <NUM> to the external storage <NUM>/<NUM>. After being migrated, the temporary data may be deleted from the memory <NUM> by the processor <NUM>, the DMA controller <NUM>, or the storage controller <NUM>. Alternatively, the central processing unit <NUM> may replace the storage controller <NUM> to implement a function of writing related data into a secure storage area of the external storage <NUM>/<NUM>. Therefore, that the processor <NUM> or the DMA controller <NUM> in this embodiment of the present invention migrates data to the external storage <NUM>/<NUM> not only includes directly migrating the data to the external storage <NUM>/<NUM>, but also includes performing control by using an interrupt instruction or an IPC protocol instruction, to implement bidirectional data migration between the memory <NUM> and the external storage <NUM>/<NUM> by using a third-party random access memory.

Optionally, in <FIG>, the random access memory <NUM> is located in the general-purpose processor system <NUM>. Actually, the random access memory <NUM> may alternatively be located in the secure element <NUM>. A location of the random access memory <NUM> is not limited in this embodiment.

It should be further noted that, in this application, security isolation exists between the secure element <NUM> and the general-purpose operating system software that is run by the general-purpose central processing unit <NUM>. In this disclosure, the security isolation means limiting access to the secure element <NUM>. Therefore, the security isolation may be understood as a means of controlling permission of access between systems. That security isolation exists between the secure element <NUM> and the general-purpose operating system software that is run by the general-purpose central processing unit <NUM> means limiting access, to the secure element <NUM> or the memory <NUM> in the secure element <NUM>, of the general-purpose operating system software that is run by the general-purpose central processing unit <NUM> or common application software that is based on the general-purpose operating system software. In other words, due to impact of the security isolation, the general-purpose operating system software or the common application software cannot access the secure element <NUM> or the memory <NUM>. If there are a plurality of pieces of common application software based on the general-purpose operating system software, access of at least some of the pieces of common application software to the secure element <NUM> is limited. For example, the general-purpose operating system software that is run by the general-purpose central processing unit <NUM> or at least one piece of common application software based on the general-purpose operating system software can neither read or change data that is being executed by the secure element <NUM> or data temporarily stored in the memory <NUM>, nor write data into the memory <NUM>, to achieve security.

It may be understood that the system architecture specifically used in this embodiment of the present invention includes but is not limited to an installation and upgrade system architecture based on the secure program in <FIG>, provided that any architecture in which the secure element in this application can be used to perform related processing of the secure program falls within the protection scope and coverage of this application.

The following further describes functions of the processor <NUM> and the memory <NUM> in the secure element <NUM> with reference to the structures of the terminal device and the secure element that are corresponding to <FIG> and <FIG>. It may be understood that, based on the structure of the secure element <NUM> in <FIG>, some functions performed or completed by the processor <NUM> or the memory <NUM> may alternatively be completed by the direct memory access controller <NUM> or the security processing unit <NUM> in the secure element <NUM>. Details are not described subsequently.

In this application, the secure operating system that needs to be loaded and run by the secure element is a secure operating system provided by a computing device (for example, a service provider device, such as a server or a cloud server, that provides a secure operating system for a secure element of a mobile phone) for a terminal device on which no secure operating system is installed. In addition, in a subsequent use process of the terminal device, for operations such as upgrade and update of the secure operating system (that is, first installation or system upgrade), the server needs to provide a corresponding secure operating system.

For ease of description, this embodiment provides a flowchart of a security processing method shown in <FIG>. In a related procedure, a secure program is transmitted between a server and a terminal device, and then the terminal device performs security processing on the received secure program by using a processor of an internal secure element. Brief steps of the security processing procedure may include the following.

The terminal device receives the secure program sent by the server.

The terminal device includes the secure element, the secure element includes the processor and a memory, the processor and the memory are integrated into a semiconductor chip, the memory is configured to provide a storage space for the processor to load and run the secure program, the secure program includes an image of a secure operating system, and the image of the secure operating system includes a system image resident segment and a system image dynamic loading segment. The system image resident segment resides in the memory when the processor runs the secure operating system.

The terminal device divides the system image dynamic loading segment into a plurality of pages by using the processor, where each of the plurality of pages includes some content of the system image dynamic loading segment.

The terminal device performs security processing on each of the plurality of pages by using the processor.

The terminal device migrates each security-processed page to an external storage for the secure element by using the processor.

When running the secure operating system, the terminal device loads the at least one security-processed page to the memory by using the processor, and performs security verification on the at least one page, where the security verification is an inverse operation of the security processing.

Based on the foregoing method procedure, the following describes functions that are corresponding to execution bodies: the terminal device (the secure element) and the server in the foregoing method procedure. It should be noted that a computer device provided in this application may be the foregoing server.

In this application, the server (one type of computer device in this application) may include a processor and a memory. The memory is configured to provide a storage space for running of the processor. The processor is configured to: divide an image of a secure operating system into a system image resident segment and a system image dynamic loading segment; generate a first signature for the system image resident segment; and generate a second signature for the system image resident segment, the first signature, and the system image dynamic loading segment. The secure operating system is an operating system run by the secure element disposed in the terminal device.

In a possible implementation, the processor is further configured to control the computing device to send the system image resident segment, the first signature, the system image dynamic loading segment, and the second signature to the terminal device.

For example, in this application, the server may separately divide an RO data segment and a text segment in an image file of the secure operating system into a system image resident segment and a system image dynamic loading segment; and a data segment is not divided, that is, only the system image resident segments are subsequently directly loaded to a RAM of the secure element, and corresponding partial data in the system image dynamic loading segments is loaded to the RAM of the secure element only when a corresponding function needs to be performed. A specific division standard may be based on a function in the operating system. For example, a code and data that are corresponding to functions that are mandatory after the system is started are in resident segments, and a function that may be used is in a system image dynamic loading segment. This not only reduces a RAM size occupied by an OS in a loading process, but also can place, as the image becomes larger, an added function part in the system image dynamic loading segment as much as possible; in this way, a resident part can remain unchanged, so that a size of the system image area in the RAM tends to be fixed.

The following describes a reason that only the RO data segment and the text segment in the image file are separately divided into a resident segment and a dynamic loading segment. In the prior art, an executable program includes a block started by symbol segment (Block Started by Symbol segment, BSS segment), a data segment, and a code segment (which is also referred to as a text segment). Therefore, a common image mainly includes a data segment, a read-only data segment, and a program execution instruction segment. <FIG> is a schematic structural diagram of a common image according to an embodiment of the present invention.

(<NUM>) Data segment: includes a read-write data segment (Read-Write Data segment, RW Data segment) and a BSS segment.

RW Data is also referred to as initialized data. The RW data segment represents a data area in which read and write can be performed, and is usually used to store an initialized global variable and an initialized local static variable. In addition, the RW Data segment occupies a quite small space.

BSS is also referred to as uninitialized data. The BSS segment is a memory area used to store an uninitialized global variable and an uninitialized static variable in a program. The BSS segment is readable and writable, and is automatically cleared before the program is executed. In addition, the BSS segment occupies a quite small space.

For example, static char b[<NUM>] = {"ABCDEFG"} is defined in a function. A characteristic of the data read/write area is that the data read/write area needs to be initialized in a program. If there is only a definition and no initial value, the data read/write area is not generated, and an uninitialized data area (BSS) is defined instead.

(<NUM>) Read-only data segment (Read-only Data segment, RO Data segment): A characteristic of the RO Data segment is that the RO data segment does not need to be changed during running. The RO data segment includes a read-only global variable and a read-only local variable, and a constant or the like used in a program is usually placed in a read-only data area during compilation.

(<NUM>) Program execution instruction segment: is referred to as code segment (Text/Code segment), the code segment is generated by each function, and each statement of the function is finally compiled and assembled to generate binary machine code (generated machine code of a specific architectural structure is determined by a compiler). The code segment occupies a quite large space, can only be read, cannot be changed, and usually includes some string constants.

The foregoing is content included in the common image file. Based on the foregoing, because the entire data segment occupies a comparatively small space and is a readable and writable area, corresponding data may change in a program running process. Therefore, this part is not further divided into a system image resident segment or a system image dynamic loading segment in this application, but is directly read to the RAM after being loaded, to avoid low running efficiency caused by frequent I/O reading. Because both the RO data segment and the text segment are read-only, and the RO data segment and the text segment occupy comparatively large spaces, the parts are separately divided into a system image resident segment and a system image dynamic loading segment. Certainly, it may be understood that a dynamic loading method in this application may alternatively be used for the foregoing data segment. For a specific implementation, refer to related descriptions of a dynamic system image loading manner.

In conclusion, in this application, after an operating system image (Operating System, OS image) is initialized, an operating system image (Operating System, OS image) area occupied in the RAM may include the data segment, the system image dynamic loading segment of the RO data, the system image resident segment of the RO data, the system image dynamic loading segment of the text, and the system image resident segment of the text. Specifically, the data segment, the system image resident segment of the RO data, and the system image resident segment of the text may be fixedly mapped to physical memory after the OS is started, and occupy an actual physical space. For example, a function for handling an exception interrupt of an address needs to reside in a memory area, and a hotspot function and a hotspot read-only data segment also need to reside in the memory area, so as to avoid affecting real-time performance because data needs to be continually loaded from outside when a function having a high performance requirement is executed. For another example, in the OS, there are usually some main modules (or components) of a kernel, for example, storage management, process management, a file system, device management and drive, network communication, system initialization (boot), and a system call. All of these main modules (or components) can be used as the system image resident segment in the system image file.

The system image dynamic loading segment of the RO data and the system image dynamic loading segment of the text may not be loaded to the memory during initialization, that is, may not be loaded to the physical space. For example, the system image dynamic loading segment in the operating system image file may include a corresponding system program or corresponding system data for managing a microphone, a camera, audio, a calculator, Bluetooth, or the like. The processor loads the system image dynamic loading segment of the RO data and/or the system image dynamic loading segment of the text from the external storage to the RAM of the secure element only when the processor needs to execute the corresponding system image dynamic loading segment of the RO data and/or the corresponding system image dynamic loading segment of the text. It can be understood that, in this case, a fixed quantity of pages (where the quantity of pages is fixed and comparatively small) need to be reserved in advance in the RAM of the secure element for these dynamically loaded RO data segments and/or text segments, that is, only the fixed quantity of page spaces are reserved in the RAM.

Further, after dividing the image of the secure operating system into the system image resident segment and the system image dynamic loading segment, the server side further needs to perform security processing on the image of the secure operating system, that is, ensure security of a source of the secure operating system. The server can perform and complete the following functions when creating the image of the secure operating system:.

Optionally, the image of the secure operating system further includes a first signature for the system image resident segment, and a second signature for the system image resident segment, the first signature, and the system image dynamic loading segment. That is, the server needs to create two signatures for the image of the secure operating system. <FIG> is a schematic diagram of two times of signature for a system image according to an embodiment of the present invention. First, image signature (image <NUM> signature) is performed once on an image <NUM> (including a system image resident segment and a fixed mapping-area filling value). Then, signature (image <NUM> signature) is performed for a second time by using the image <NUM>, the image <NUM> signature, and the dynamic loading segment as an image <NUM>. Then, the image <NUM> and the signature <NUM> (that is, the entire image + signature <NUM> + signature <NUM>) are encrypted once (which may be encrypted by using a symmetric key). Asymmetric keys are used for both the signature <NUM> and the signature <NUM>. The server side holds a private key for signature, and the processor of the secure element holds a public key for verification.

As far, the server side completes a process of dividing the image of the secure operating system and encrypting the signatures. From a perspective of a use time sequence, for the terminal device side (a mobile phone is used as an example subsequently), processes such as installing the secure operating system, starting and running the secure operating system, and upgrading the secure operating system may be included.

For a process in which a secure element on the mobile phone side (the secure element) installs or upgrades the secure operating system, before the mobile phone side downloads the image file of the secure operating system from the server, verification needs to be performed by a processor of the secure element (validity of the system image can be determined only in this way). Therefore, the image file needs to be first loaded to a memory (optionally, using a RAM as an example) of the secure element, and then written to an external storage (optionally, using an NVM as an example) for the secure element. In this process, the secure element first needs to decrypt and verify the secure operating system loaded to the processor. The processor may perform or complete the following functions.

In a possible implementation, the image of the secure operating system further includes a first signature for the system image resident segment, and a second signature for the system image resident segment, the first signature, and the system image dynamic loading segment. The processor of the secure element is further configured to: verify the second signature, encrypt the system image resident segment and the first signature as a whole after verification on the second signature succeeds, and migrate content obtained by encrypting the system image resident segment and the first signature as a whole to the external storage for the secure element. Specifically, because the server side has divided the image file of the secure operating system into the resident segment and the system image dynamic loading segment, performs signature twice, and performs encryption once, further, after obtaining the image file of the secure operating system, the mobile phone side further needs to decrypt and verify the signed and encrypted secure operating system image to verify that the secure program obtained from the server is valid and complete. For example, the processor <NUM> in the secure element loads the entire signed and encrypted image file obtained by using the general-purpose processor system <NUM> to the RAM <NUM> in the secure element; and first decrypts the entire image file by using a symmetric key stored in the secure element, then verifies the second signature by using a public key held in advance (that is, known in advance and negotiated with the server in advance), to verify validity (including authenticity and integrity) of the image file.

Further, after decrypting and verifying the secure operating system loaded to the processor, the secure element still needs to internally ensure security of the image of the secure operating system on the mobile phone, including ensuring upgrade security of the operating system, loading and running security of the operating system, and the like. Therefore, when writing the secure operating system to the external storage for the secure element, the processor of the secure element needs to separately perform security processing on the system image resident segment and the system image dynamic loading segment again, to perform or complete the following functions.

For the system image resident segment:
After verification on the image <NUM> signature succeeds, for the image <NUM>, after the entire image file is decrypted, the decrypted file includes (plaintext image <NUM> + image <NUM> signature). If the decrypted file is directly written to the external NVM, although validity of the image <NUM> can be ensured, privacy of the image <NUM> cannot be ensured. Therefore, before the decrypted file is written to the NVM, the processor of the secure element needs to re-encrypt (plaintext image <NUM> + image <NUM> signature). (plaintext image <NUM> + mage <NUM> signature). Re-encryption can still use a symmetric key, and the symmetric key may be a local key stored inside the secure element. In this case, the processor of the secure element completes a process of writing and storing the image <NUM> into the NVM in a signature-then-encryption approach.

For the system image dynamic loading segment:
After verification on the image <NUM> signature succeeds, for an image <NUM>' (a part in the image <NUM> except the image <NUM> and the signature <NUM>), there is only the plaintext image <NUM>' after the image <NUM> is decrypted and the signature <NUM> is verified. Therefore, before writing the image <NUM>' to the NVM, the processor of the secure element also needs to perform encryption and signature processing on the plaintext image <NUM>', to ensure validity and privacy of the image <NUM>' stored in the NVM. However, a file in the image <NUM> is a memory resident area, and in a subsequent startup loading process, the file only needs to be directly loaded from the NVM to the RAM; and the image <NUM>' is a system image dynamic loading segment. Therefore, a difference from the image <NUM> that is directly signed and encrypted lies in that, a code segment or an RO-DATA segment in the area is flexibly and dynamically scheduled to the memory after being started and run. In this case, it is very likely that only a small segment or several small segments are selected each time. Therefore, to ensure security of the code segment or the RO-DATA of the system image dynamic loading segment, this application provides a page-based encryption manner, to divide all data in the system image dynamic loading segment, and separately perform security processing on and store the pages obtained through division. <FIG> is a schematic structural diagram of migrating a system image to an external storage according to an embodiment of the present invention.

In a possible implementation, the processor may be configured to divide the system image dynamic loading segment into a plurality of pages, where each of the plurality of pages includes some content of the system image dynamic loading segment. The processor further performs security processing on each of the plurality of pages, and migrates each security-processed page to the external storage for the secure element. Optionally, the security processing includes performing encryption and generating a message authentication code MAC. A function of the MAC is similar to that of the signature, but because a symmetric key is used, a calculation amount and calculation complexity are greatly reduced compared with those of asymmetric keys for the signature. Therefore, the MAC is applicable to page-based encryption in this application (because there are a larger quantity of times of encryption after paging).

After the secure element processor of the secure element performs page-based encryption on the image <NUM>', and performs MAC processing on the image <NUM>', encryption and MAC generation operations on the image <NUM>' are complete. In this case, the processor of the secure element writes the security-processed image <NUM>' to the NVM. Optionally, when the image <NUM>' is written to the NVM, a page-based encryption area and MAC data used for page-based encryption may be separately placed, that is, MACs for all pages may be stored in other areas different from the page-based encryption area. <FIG> is a schematic diagram of a mapping relationship between an external storage and a memory of a secure element according to an embodiment of the present invention. MACs in the <FIG> may be understood as being separately stored and separately obtained. In a possible implementation, the security processing further includes: encrypting all of a plurality of MACs for a plurality of pages; or encrypting a MAC for each of the plurality of pages. Encryption keys for different MACs are different. Specifically, the processor may perform privacy protection on the MAC, to further ensure security of the system image dynamic loading segment.

The following describes, by using an example, how to perform page-based encryption and page-based MAC generation on the system image dynamic loading segment in this application.

First, the processor of the secure element divides the image file <NUM>' in the system image dynamic loading segment based on each page (page) with <NUM> bytes (which may be understood as other bytes). For example, an image size of the system image dynamic loading segment is <NUM>, and in this case, the image can be divided into <NUM> pages.

Then a MAC is generated for each of the pages of the image <NUM>'. Optionally, a symmetric key, and an AES-CMAC algorithm or an SHA256 algorithm may be used. A MAC is generated for each page. For example, after a MAC is generated for a <NUM> plaintext, where the MAC includes <NUM> bytes/<NUM> bytes, the MAC is encrypted into a <NUM>-byte/<NUM>-byte ciphertext. Finally, for a <NUM> KB image, the MAC is about <NUM>/<NUM> bytes. Then, the <NUM> plaintext on each page is encrypted, for example, the <NUM> plaintext is encrypted into a <NUM> ciphertext. Optionally, the encryption key is a symmetric key, and is stored in the secure element. Optionally, the pages of the mirror <NUM>' need to be encrypted, the MACs corresponding to the pages also need to be encrypted, and a key for encrypting the pages may be the same as or different from a key for encrypting the MACs. If the keys are the same, the entire (plaintexts of the pages + MACs) can be directly encrypted. If the keys are different, the plaintexts of the pages are encrypted and then the calculated MACs are encrypted. For example, if the entire MAC area is comparatively small, the MAC area may be moved to a fixed location of the RAM of the secure element at a time during startup, and resides in the fixed location after verification succeeds, so as to avoid moving and verification during each missing page interrupt, thereby improving performance.

Further, an encryption key used for encrypting each page is associated with a virtual address of the page, and encryption keys for different pages are different.

This can prevent a decryption disorder caused by incorrect decryption between pages, thereby ensuring security. Examples are as follows:.

Further, in a process of performing page-based encryption and calculating the MAC, a technical function count value of a one-time programmable (One Time Programmable, OTP) image replay protected segment in the secure element needs to be used to prevent rollback.

In a possible implementation, the secure element further includes a one-time programmable chip OTP. An encryption key for each of a plurality of pages is associated with an OTP count value; and/or a MAC for each of a plurality of pages is associated with a count value of the OTP of the secure element. Paging data security processing: A method in which a MAC and an OTP count value participate in calculation is as follows:.

It should be noted that there are many manners of association with a count. For example, exclusive OR is performed on an OTP count and <NUM> page content, or a MAC algorithm such as SHA256 is used for calculation after other logic calculation. Alternatively, exclusive OR may be performed on an OTP count and a hash result of an SHA256 value of <NUM> page content.

As far, the processor of the secure element has encrypted (image <NUM> + image <NUM> signature) and has written all of a plurality of (image <NUM>' obtained after page-based encryption + MAC). To be specific, the mobile phone obtains the image of the secure operating system from the server side, performs security verification in the RAM of the secure element, and then writes the image of the secure operating system to the NVM. Therefore, the NVM stores the signed and encrypted image <NUM> and the image <NUM>' on which page-based encryption is performed and to which a MAC is added.

After the secure element on the mobile phone side installs or upgrades the secure operating system, when the secure operating system needs to be run, the operating system image stored in the external storage for the secure element is loaded to the memory of the secure element for running. However, to ensure security of the secure operating system, security processing has been performed before the operating system image is written into the external storage for the secure element. Therefore, when the secure operating system is started and run again, security verification needs to be performed on an image to be loaded to the memory. The following separately describes how to perform secure loading when operating system parts corresponding to the image <NUM> and the image <NUM>' need to be started. In this process, the secure element first needs to decrypt and verify the secure operating system loaded to the processor. The processor may perform or complete the following functions.

In a possible implementation, when the security processing includes encryption and MAC generation, the security verification includes decryption and MAC verification.

For example, when the secure operating system is started, the processor of the secure element directly loads the encrypted (image + image <NUM> signature) to the RAM in the secure element. However, a plurality of (image <NUM>' obtained after page-based encryption + MAC (encrypted))s are not loaded to the processor temporarily. This is because a size of the RAM in the secure element is limited, but a system image is increasingly large. Therefore, in this application, the operating system image file (except a data segment) is divided into the system image resident segment and the system image dynamic loading segment, the system image resident segment is in the image <NUM> and is directly loaded to the RAM of the secure element when the system is started, and the system image dynamic loading segment is in the image <NUM>', is not loaded to the RAM of the secure element temporarily but is loaded to the external volatile memory NVM when the operating system is started, and is loaded from the external volatile memory (for example, a DDR) to the internal RAM if necessary. Alternatively, the system image dynamic loading segment is in the image <NUM>', the dynamic loading segment is not loaded to the RAM of the secure element temporarily when the operating system is started, but is reserved in the external NVM, and is directly loaded from the external NVM to the RAM of the secure element if necessary. <FIG> is a mapping relationship diagram of migrating a system image from an external storage to a memory of a secure element according to an embodiment of the present invention.

Specifically, when the secure operating system is started, for the image <NUM>,
in a possible implementation, the processor of the secure element is configured to directly load the entire encrypted (image + image <NUM> signature) from the external NVM to the internal RAM. The entire encrypted (image + image <NUM> signature) actually occupies an internal RAM space. Then, a symmetric key stored in the secure element is used to decrypt the encrypted (image + image <NUM> signature), and then a public key corresponding to the signature <NUM> is used for verification. After both decryption and verification succeed, synchronous configuration is performed on an MMU page table in the RAM, and all virtual addresses of a code segment and an RO-DATA segment that are loaded to the image <NUM> in the RAM are mapped to valid physical pages in the secure element. As far, the processor of the secure element can normally run the code segment and the RO-DATA segment that are corresponding to the image <NUM>.

Then, when the secure operating system is started, for the image <NUM>',
in a possible implementation, the processor is configured to configure at least one page frame in the storage space provided by the memory. Each of the at least one page frame is used to store at least one of the plurality of pages, and a quantity of pages included in the at least one page frame is less than a quantity of pages included in the plurality of pages. Further, the processor is further configured to: when running the secure operating system, load the at least one security-processed page to the memory, and perform security verification on the at least one page. The security verification is an inverse operation of the security processing. Specifically, when loading a page in the dynamic loading segment and determining that the virtual address is not effectively mapped in the memory, the processor obtains data in the page from the external storage, loads the data in the page to a specified physical page frame in the memory, and loads the corresponding MAC to the memory; and performs decryption and MAC verification, and maps a virtual address of the page to a physical address corresponding to the specified physical page frame after MAC matching succeeds.

It is assumed that the processor of the secure element directly loads all of the plurality of (image <NUM>' obtained after page-based encryption + MAC (encrypted))s from the external NVM to an external DDR. In this case, no verification or decryption processing needs to be performed. This is because all of encryption, decryption, signature, and verification in this application are performed only by the processor in the secure element.

It is assumed that the plurality of (image <NUM>' obtained after page-based encryption + MAC (encrypted))s continue to be stored in the external NVM without any processing, and are directly loaded from the NVM to the internal RAM only when the plurality of (page-based encryption of the image <NUM>' + MAC (encryption))s need to be loaded.

When the processor of the secure element runs the system image dynamic loading segment, a hardware halt or a page fault occurs (error reporting manners are different based on an MMU design of the secure element or an address mapping design) because an address is not effectively mapped after a program in the processor executes a dynamic code segment or obtains a dynamic RO-DATA segment. The MMU in the processor of the secure element invokes an interrupt processing function to determine an address to which a missing page is mapped. In this case, the processor learns a virtual address of the corresponding missing page based on an ARM mechanism; finds, from the DDR or the NVM, data corresponding to the page; then moves the target page from the DDR or the NVM to a fixed page area of the RAM of the secure element; and finally, loads a MAC corresponding to the target page or all MACs to a specified physical space in the RAM of the secure element, decrypts the page, and calculates the MAC. After decryption and verification succeed, the target page is valid and is put in fixed pages; an MMU list is configured; a virtual address of the target page is mapped to the physical page, that is, a fixed page area; and mapping between the virtual address and the physical page is finally completed. Finally, the processor of the secure element returns to exceptionally interrupted context, and the program runs normally.

Optionally, when the secure operating system is upgraded, the entire image file may be first written to the external storage, and decryption and verification are not performed at this time. When the system needs to be started, the entire image file is loaded to the memory. Next, the image file is decrypted, and verification on a signature <NUM> is performed. After verification succeeds, the image <NUM> signature needs to be verified again. In addition, in this case, after the image <NUM> (the system image resident segment) can be run normally, page-based encryption and MAC generation are performed on the system image dynamic loading segment of the image <NUM> on which decryption and verification are performed, and then the system image dynamic loading segment of the image <NUM> is stored in the external NVM or DDR, to release a space of the RAM. When the system image dynamic loading segment of the image <NUM> needs to be loaded, the system image dynamic loading segment of the image <NUM> is loaded, decrypted, and verified again, and then is run normally.

It should be noted that system upgrade in this application is upgrading a system image corresponding to the entire secure operating system. For a patch-based update, a patch that needs to be updated may also be divided by the server side into a system image resident segment and a system image dynamic loading segment. In this way, during the update, reference may be made to operations such as dynamic loading and security processing performed by the foregoing secure element.

As far, the processor of the secure element has completed operations such as installation, startup, and running of the secure operating system.

For any one of the foregoing implementations, in a possible implementation, the processor usually includes a user mode and a privileged mode (privileged mode). To ensure system security, the at least one page frame (fixed page) is optional, or memory attributes of all page frames may be configured to be readable and writable in the privileged mode. An address mapping table is a page table segment of the MMU, and a register of the MMU is also configured to be accessible only in the privileged mode. In the present invention, a system kernel is also required to process an MMU page table configuration, and all other programs are in the user mode.

For any one of the foregoing implementations, the system image dynamic loading segment further includes a system image dynamic loading segment of a code and a system image dynamic loading segment of read-only data; and/or the system image resident segment includes a system image resident segment of a code and a system image resident segment of read-only data. That is, the system image resident segment and the system image dynamic loading segment are further separately subdivided into a code segment and a read-only data segment, so as to more effectively hit a code segment or read-only data that needs to be loaded, thereby improving read and loading efficiency.

It may be understood that, when the secure program further includes a secure application program, in a possible implementation, the secure application program includes an application program resident segment and an application program dynamic loading segment. The application program resident segment resides in the memory when the processor runs the secure application program. The processor is further configured to: divide the application program dynamic loading segment into a plurality of pages, where each of the plurality of pages includes some content of the application program dynamic loading segment; perform the security processing on each of the plurality of pages; and migrate each security-processed page to an external storage for the secure element. To be specific, for division, security processing, and verification of the resident segment and the dynamic loading segment of the secure application program, refer to related processing of the system image resident segment and the dynamic loading segment in the foregoing secure element.

In another possible implementation, the secure program further includes a secure application program, and the processor is further configured to:
divide the secure application program into a plurality of pages, where each of the plurality of pages includes some content of the secure application program; perform the security processing on each of the plurality of pages; and migrate each security-processed page to the external storage for the secure element. To be specific, for the divided dynamic loading segment, security processing, and verification of the secure application program, refer to related processing of the system image dynamic loading segment in the foregoing secure element.

Claim 1:
A secure element (<NUM>), comprising:
a processor (<NUM>) and a memory (<NUM>), wherein the processor (<NUM>) and the memory (<NUM>) are integrated into a semiconductor chip;
the memory (<NUM>) is configured to provide a storage space for the processor (<NUM>) to load and run a secure program, wherein the secure program comprises an image of a secure operating system, the image of the secure operating system comprises a system image resident segment and a system image dynamic loading segment, and the system image resident segment resides in the memory (<NUM>) when the processor (<NUM>) runs the secure operating system; and
the processor (<NUM>) is configured to:
divide the system image dynamic loading segment into a plurality of pages, wherein each of the plurality of pages comprises some content of the system image dynamic loading segment;
perform security processing on each of the plurality of pages; and
migrate each security-processed page to an external storage (<NUM>, <NUM>) for the secure element.