Patent Description:
With rapid development of Internet technologies and smart terminals, an increasing quantity of applications operate on a smart terminal. The applications usually relate to various fields, such as an electronic payment application, a biometric recognition application, and an instant messaging application. Because the applications are about interests of a user, an increasingly high requirement is imposed on security of an operating environment of the smart terminal. To ensure security of the operating environment of the smart terminal, in a conventional technology, execution environments of the smart terminal are generally divided into independent execution environments: a rich execution environment (REE) and a trusted execution environment (TEE). A general operating system (for example, an Android system) usually operates in the REE, and an operating system with a high security level usually operates in the TEE. A client application (CA) with a low security requirement operates in the REE, and a trusted application (TA) with a high security requirement operates in the TEE, and provides a security service for a CA deployed in a general operating system. The security service provided by the TEE usually controls CA access in the REE by setting access permission. In a related technology, the REE and the TEE are usually supported by common hardware. In other words, when the REE operates, the TEE cannot operate, and consequently an operating status of the REE cannot be monitored. When the operating REE is attacked and the access permission is obtained, the TEE usually cannot detect the attack. In this way, the CA operating in the REE can arbitrarily invoke the security service provided by the TEE. When a TEE vulnerability occurs, important data such as biometric recognition data (fingerprint data and face image data) and keys is leaked, threatening interests of a user. Therefore, how to perform security protection during operating of the REE/TEE and even an entire working system becomes a problem that needs to be resolved.

<CIT> discloses a user equipment, UE. The UE comprises a memory module, wherein the memory module is one of a subscriber identity module, SIM, a universal integrated circuit card, UICC, a universal subscriber identity module USIM, or a removable user identity module R-UIM, wherein clock signals from a second clock component are input to the memory module. The memory module comprises an application stored in a trusted security zone in the second non-transitory memory, that when executed by the second processor in the trusted security zone, wherein the second operating system accesses the second processor to implement instructions for applications in the second operating system, wherein the trusted security zone provides hardware assisted trust, compares a first mobile equipment identifier MEID stored in the first non-transitory memory with a second MEID stored in the memory module.

<CIT> discloses a method for monitoring a host system, comprising the steps of: establishing a monitoring system, said monitoring system including: at least one monitor unit for monitoring the integrity of at least one monitored structure of at least one host system and operating independently of the processor and an operating system of said at least one host system, and at least one administrative system; coupling said at least one administrative system to said at least one monitor unit through a communication link independent of said at least one host system; calculating a hash value of said at least one monitored structure by said at least one monitor unit; and transmitting a report to said at least one administrative system by said at least one monitor unit via said communication link on said hash value of said at least one monitored structure.

<CIT> discloses a security control method and a computer system. A first domain and a second domain are deployed on the computer system, the security of the second domain is higher than that of the first domain, a program is deployed in the first domain, and a control flow management module and an auditing module are deployed in the second domain. The security of the second domain is higher than that of the first domain. The control flow management module acquires control flow information by means of a tracker during the execution of a program located in the first domain; the auditing module performs, according to auditing rules, auditing on information to be audited, determines that the auditing is passed when the information, to be audited, matches the auditing rules, and then allows the first domain to execute a subsequent operation, such as accessing a security program of the second domain. Data flows of the program may also be audited while the control flow information is audited. <CIT> discloses a system on chip which is integrated in a first semiconductor chip, and includes a secure element and at least one central processing unit that is coupled to the secure element. Security isolation exists between the secure element and the at least one central processing unit. The at least one central processing unit is configured to communicate with the secure element. The secure element includes a secure processor and a first memory that is coupled to the secure processor. The secure processor can suspend running first secure operating system software and further start second secure operating system software, to implement switching between multiple pieces of secure operating system software. Running data of running secure operating system software is stored in the first memory, and running data of secure operating system software that is not run is stored in a second memory outside the system on chip.

This application provides an electronic apparatus. The electronic apparatus is monitored in real time by using a security protection apparatus in an operating process of the electronic apparatus, to improve security of the electronic apparatus. To achieve the foregoing objective, this application uses the following technical solutions.

According to a first aspect, an embodiment of this application provides an electronic apparatus. The electronic apparatus includes a security protection apparatus and a first processor. Security isolation exists between the security protection apparatus and the first processor. The first processor is configured to operate when driven by software, and the software includes an operating system and an application. The security protection apparatus is configured to: perform security detection on the software, and when detecting that the software is tampered with, perform a security protection operation on the electronic apparatus. The security protection apparatus may be disposed to perform: when the electronic apparatus is powered on, when the electronic apparatus is woken up, and when the first processor operates, security detection on the software operating on the first processor, so that the electronic apparatus may be protected during power-on and operating, to reduce a risk that security data such as key data and face image data is stolen or modified, and improve security performance of the electronic apparatus.

The operating system includes a rich execution environment REE and a trusted execution environment TEE. The security protection apparatus is specifically configured to: when an operating environment of the first processor is switched from the REE to the TEE, periodically perform the security detection on software that is used to drive the operating environment of the first processor to be switched and software that operates in the TEE; and stop performing the security detection when the operating environment of the first processor is switched from the TEE to the REE.

In a possible design, the security isolation in this application includes at least one of the following: working system isolation, power supply isolation, or clock signal isolation.

Working system isolation between the security protection apparatus and the first processor can prevent a hacker from accessing or tampering with, by changing an operating program loaded in a memory of the first processor, an operating program of the security protection apparatus or data generated in an operating process of the program, to improve security of the security protection apparatus. Power supply isolation between the security protection apparatus and the first processor can prevent the security protection apparatus from being maliciously powered off when the first processor is attacked. The security protection apparatus is powered off only when all electronic apparatuses are powered off (for example, a terminal device is powered off). Clock signal isolation between the security protection apparatus and the first processor can prevent a clock cycle of the security protection apparatus from being maliciously tampered with when the first processor is attacked. Therefore, when the first processor operates, the security protection apparatus may monitor an operating system, an application, and data of the first processor in real time or periodically, thereby ensuring security of the electronic apparatus and further ensuring data security.

In a possible design, the security protection operation in this application includes at least one of the following: triggering an alarm, resetting the electronic apparatus, rejecting a service requested by the software, instructing the first processor to stop operating, instructing the first processor to stop operating the software, disabling at least a part offunctions of the software, or preventing the software from accessing data stored in the electronic apparatus.

In a possible design, the security detection in this application includes: detecting whether at least one of an instruction or data of the software is preset information.

The preset information herein may include a pre-stored instruction or data of the software, or may include a hash reference value obtained by performing hash calculation on the instruction or data of the software.

In a possible design, the first processor includes an on-chip tracking unit. The on-chip tracking unit is configured to: when the first processor rewrites data, store an instruction sequence used for data rewriting in a dedicated memory. In a possible design, the security detection includes: detecting whether the instruction sequence stored in the dedicated memory is a reference instruction sequence.

Generally, the data in the software includes variable data and invariable data. A change of the variable data is generally triggered based on an instruction in a process of executing the instruction sequence. Because the instruction sequence is usually generated by the electronic apparatus through compilation based on a program compiled by a developer, the instruction sequence usually does not change. When the electronic apparatus detects a change of the data in the software or receives an interrupt, sent by the first processor, for rewriting data, the electronic apparatus may determine whether the instruction sequence stored in the dedicated memory is the reference instruction sequence. When it is determined that the instruction sequence stored in the dedicated memory is not the reference instruction sequence, it is considered that the data is tampered with.

In a possible design, the electronic apparatus includes a memory. The memory is configured to store the instruction and data of the software. The dedicated memory is storage space that is disposed in the memory and that is specially used by the on-chip tracking unit and the security protection apparatus to perform reading and writing.

In a possible design, the security protection apparatus includes a second processor. The second processor is configured to: perform periodic security detection on the software based on a time period set by a timer, or perform security detection on the software based on an interrupt event sent by the first processor.

In a possible design, the security protection apparatus further includes a hash accelerator. The hash accelerator is coupled to the second processor. When performing the security detection on the software, the second processor is configured to: control the hash accelerator to obtain the software and perform a hash operation on the obtained software to obtain a reference value; and compare the reference value with a pre-stored hash reference value, and determine, based on a comparison result, whether the software is tampered with.

In a possible design, the security protection apparatus further includes a watchdog. The electronic apparatus further includes a reset unit. The watchdog is coupled to the second processor and the reset unit. The second processor is further configured to periodically send a heartbeat instruction to the watchdog. The watchdog is configured to: when the heartbeat instruction sent by the second processor is not received within a predetermined time period, reset the electronic apparatus by using the reset unit.

The watchdog may be disposed to prevent another processor from being attacked in an operating process when the security protection apparatus stops responding.

According to a second aspect, an embodiment of this application provides a security protection method, applied to an electronic apparatus. The security protection method includes: A first processor in the electronic apparatus operates when driven by software. The software includes an operating system and an application. A security protection apparatus in the electronic apparatus performs security detection on the software. Security isolation exists between the security protection apparatus and the first processor. When detecting that the software is tampered with, the security protection apparatus performs a security protection operation on the electronic apparatus. The operating system comprises a rich execution environment, REE, and a trusted execution environment, TEE. The performing security detection on the software comprises: when an operating environment of the first processor is switched from the REE to the TEE, periodically perform the security detection on software that is used to drive the operating environment of the first processor to be switched and software that operates in the TEE; and astop performing the security detection when the operating environment of the first processor is switched from the TEE to the REE.

To describe the technical solutions in embodiments of this application more clearly, the following briefly introduces the accompanying drawings for describing embodiments of this application. It is clear that the accompanying drawings in the following description show merely some embodiments of this application, and persons of ordinary skill in the art may still derive other drawings from these accompanying drawings without creative efforts.

The following clearly and completely describes the technical solutions in embodiments of this application with reference to the accompanying drawings in embodiments of this application. It is clear that the described embodiments are some but not all of embodiments of this application. All other embodiments obtained by persons of ordinary skill in the art based on embodiments of this application without creative efforts shall fall within the protection scope of this application.

"First", "second", or the like mentioned in this specification does not indicate any order, quantity, or importance, but is used only for distinguishing between different components. Likewise, "a/an", "one", or the like is not intended to indicate a quantity limitation either, but is intended to indicate at least one. "Connection", "link" or the like is not limited to a physical or mechanical connection, but may include an electrical connection, whether directly or indirectly. It is equivalent to coupling or a connection in a broad sense.

In addition, in embodiments of this application, the word "example" or "for example" is used to represent giving an example, an illustration, or a description. Any embodiment or design scheme described as an "example" or "for example" in embodiments of this application should not be explained as being more preferred or having more advantages than another embodiment or design scheme. Exactly, use of the word "example" or "for example" or the like is intended to present a relative concept in a specific manner. In the descriptions of embodiments of this application, unless otherwise stated, "a plurality of" means two or more than two. For example, a plurality of processing units mean two or more processing units.

To make the objectives, technical solutions, and advantages of this application clearer, the following clearly and completely describes the technical solutions in this application with reference to the accompanying drawings in this application. Obviously, the described embodiments are some but not all of embodiments of this application. All other embodiments obtained by persons of ordinary skill in the art based on embodiments of this application without creative efforts shall fall within the protection scope of this application.

<FIG> is a schematic diagram of a hardware architecture of an electronic apparatus according to an embodiment of this application. The electronic apparatus <NUM> may be located in a terminal. The terminal may be user equipment (UE), for example, various types of portable terminal devices such as a mobile phone, a tablet computer, or a wearable device (such as a smartwatch). The electronic apparatus <NUM> may be specifically a chip or a chipset, or a circuit board with a chip or a chipset. The chip, the chipset, or the circuit board with the chip or the chipset may work when driven by necessary software.

The electronic apparatus <NUM> shown in <FIG> includes a processor <NUM>. The processor <NUM> includes at least one central processing unit. Generally, rich execution environment REE software and trusted execution environment TEE software may operate on the processor <NUM>, as shown in <FIG>. The REE software or the TEE software includes but is not limited to operating system software, compilation software, application software, or the like. The software herein may include but is not limited to an instruction and data. Specifically, an operating system software based on a rich execution environment REE may also be referred to as general operating system software. A general operating system is, for example, an Android operating system, a Windows operating system, or an iOS operating system. These operating systems may be used to support common non-security application software. Some of the common non-security application software may invoke security application software TA in a trusted execution environment TEE, and this type of software may also be referred to as a CA. The CA is usually a third-party application (for example, a video application or a shopping application). Operating system software based on the trusted execution environment TEE may also be referred to as trusted application system software. A trusted application system is used to support security application software. The security application software may also be referred to as a TA, for example, an application that performs a security service such as signature, encryption/decryption calculation, or face comparison. The TEE software has higher security than the REE software. Therefore, the TA has a higher security level than the CA. The TEE is strictly restricted and cannot be accessed by a common CA. Therefore, security isolation exists between the TEE software and the REE software, to ensure security of the TA software and the CA software.

The electronic apparatus <NUM> shown in <FIG> further includes a security protection apparatus <NUM>. The security protection apparatus <NUM> includes a processor <NUM>. The processor <NUM> is configured to operate security system software. The security system software herein may include but is not limited to a system or an application. The system or the application separately includes an instruction and data that are required in an operating process. The processor <NUM> may perform, driven by the security system software, when the electronic apparatus <NUM> is powered on, when the electronic apparatus <NUM> is woken up, or when the processor <NUM> operates, security detection on software operating on the processor <NUM>, to ensure that the software operating on the processor <NUM> is normal. For example, security detection is performed on an instruction loaded by the processor <NUM>, data obtained by the processor <NUM>, and the like, to ensure that an instruction loaded by the processor <NUM>, data obtained by the processor <NUM>, and the like are not rewritten or are normally rewritten, that is, to prevent related data from being tampered with. The normal rewriting herein means that rewriting of some variable information in the electronic apparatus <NUM> is performed by the processor based on a preset program invoking path. When detecting that the software operating on the processor <NUM> is tampered with, the processor <NUM> may perform a security protection operation on the electronic apparatus. The security protection operation herein may include but is not limited to: triggering an alarm, resetting the electronic apparatus <NUM>, rejecting a service requested by the software (for example, a biometric recognition service, a password unlocking service, or a key obtaining service), instructing the processor <NUM> to stop operating, instructing the processor <NUM> to stop operating the software, disabling at least a part offunctions of the software operating on the processor <NUM>, or preventing the software from accessing data stored in the electronic apparatus <NUM>.

In addition, when ensuring that the software operating on the processor <NUM> is normal, the processor <NUM> may further communicate with the processor <NUM> through a bus. The communication includes but is not limited to: sending, by the processor <NUM>, an interrupt request to the processor <NUM> based on the operating CA or TA. The processor <NUM> may obtain, based on the interrupt request of the processor <NUM>, the instruction and data of the CA or TA that are loaded by the processor <NUM>, and perform security detection on the instruction and data of the CA or TA, to ensure secure operating of the CA or TA and prevent the CA or TA from being attacked. For example, in a scenario of this embodiment, in response to an unlock instruction sent by a user, the processor <NUM> sends, to the processor <NUM>, interrupt information indicating the processor <NUM> to execute an unlock event, and then the processor <NUM> continues to execute the unlock event. The processor <NUM> responds to an interrupt, and in a process in which the processor <NUM> executes the unlock event, performs security protection on an instruction of the CA operating on the processor <NUM>, an instruction of the TA operating on the processor <NUM>, data obtained or generated when the processor <NUM> operates, and the like, to prevent key data, fingerprint data, and/or face image data related to face unlock from being tampered with or stolen. It should be noted herein that the processor <NUM> does not change operating logic of the processor <NUM> in a process of performing the security protection.

In this embodiment, security isolation exists between the security protection apparatus <NUM> and the processor <NUM>. In other words, a hardware design of the security protection apparatus <NUM> ensures that the software operating on the processor <NUM> cannot interfere with operating of the security protection apparatus <NUM>. Specifically, the security isolation herein may include but is not limited to: working system isolation, power supply isolation, or clock signal isolation. Working system isolation specifically means that the processor <NUM> cannot access the security protection apparatus <NUM> by using the operating software. Herein, that the processor <NUM> cannot access the security protection apparatus <NUM> means that the processor <NUM> cannot access an operating program (including an instruction and data) of the processor <NUM>, data obtained or generated when the processor <NUM> operates, or the like. Power supply isolation means that the processor <NUM> cannot control power-on or power-off of one or more components (for example, the processor <NUM>) in the security protection apparatus <NUM>. To be specific, each component (for example, the processor <NUM>) in the security protection apparatus <NUM> may be directly powered by an external power supply (for example, a battery or a power adapter), and the processor <NUM> cannot control each component in the security protection apparatus <NUM> to start, shut down, enter or exit a low power consumption state, or the like. When the electronic apparatus <NUM> is powered by the external power supply, both the processor <NUM> and the processor <NUM> are separately started, or the processor <NUM> may be first started. When the electronic apparatus <NUM> is powered off, both the processor <NUM> and the processor <NUM> are separately shut down. Clock signal isolation means that the processor <NUM> cannot control a clock cycle of one or more components (for example, the processor <NUM>) in the security protection apparatus <NUM>. To be specific, the clock cycle of each component (for example, the processor <NUM>) in the security protection apparatus <NUM> during working may be directly provided by an external clock signal source, and the processor <NUM> cannot change the clock cycle of each component in the security protection apparatus <NUM>.

Working system isolation between the security protection apparatus <NUM> and at least one processor <NUM> can prevent a hacker from accessing or tampering with, by changing an operating program loaded in a memory of the processor <NUM>, an operating program of the processor <NUM> or data generated in an operating process of the program, to improve security of the security protection apparatus. Power supply isolation between the security protection apparatus <NUM> and at least one processor <NUM> can prevent the security protection apparatus <NUM> from being maliciously powered off when the processor <NUM> is attacked. The security protection apparatus <NUM> is powered off only when all electronic apparatuses <NUM> are powered off (for example, a terminal device is powered off). Clock signal isolation between the security protection apparatus <NUM> and at least one processor <NUM> can prevent the clock cycle of the security protection apparatus <NUM> from being maliciously tampered with when the processor <NUM> is attacked. Therefore, when the processor <NUM> operates, the security protection apparatus <NUM> may monitor an operating system of the processor <NUM>, an application operating on the processor <NUM>, and data in real time or periodically, thereby ensuring security of the electronic apparatus <NUM> and further ensuring data security.

In this embodiment, as shown in <FIG>, the electronic apparatus <NUM> further includes a storage device <NUM>. The storage device <NUM> is a memory of the electronic apparatus <NUM>, and may include but is not limited to a random access memory RAM and a read-only memory ROM.

The storage device <NUM> may store an instruction and data. The processor <NUM> or the processor <NUM> performs various function applications and data processing of the electronic device by loading an instruction and obtaining data. Specifically, the read-only memory may store startup key data that needs to be loaded when the processor <NUM> or the processor <NUM> is started. The random access memory may store instruction code such as an operating system or an application that needs to operate on the processor <NUM> or the processor <NUM>, and data required for operating, and may further include various intermediate operation results, data, configuration data, or the like generated by operating a process. The random access memory may include a volatile memory (such as an SRAM, a DRAM, or an SDRAM) and a non-volatile memory.

Storage space that is in the storage device <NUM> and that stores operating software of the REE is first storage space. Storage space that is in the storage device <NUM> and that stores operating software of the TEE is second storage space. Storage space that is in the storage device <NUM> and that stores operating software of the processor <NUM> is third storage space. The first storage space, the second storage space, and the third storage space correspond to corresponding physical addresses in various memories. Therefore, during operating, each system accesses a corresponding memory based on a physical address of each memory, to obtain operating software such as instruction code or data. It should be noted herein that, during operating of the REE, the processor <NUM> may access only the operating software stored in the first storage space; during operating of the TEE, the processor <NUM> may access the operating software stored in the first storage space and the operating software stored in the second storage space; and the processor <NUM> may access, driven by a security system operating on the processor <NUM>, the operating software stored in the first storage space, in the second storage space, and in the third storage space. Therefore, when the electronic apparatus <NUM> is powered on, when the system <NUM> is woken up, and when the processor <NUM> operates, the processor <NUM> may determine, by accessing the operating software stored in the first storage space and the operating software stored in the second storage space, whether operating software such as instruction code or data of the REE and the TEE is tampered with, to protect an operating environment of the processor <NUM>. It should be noted that, in this embodiment, the limitation on the storage space that can be accessed by each processor during operating may be implemented by using a hardware design, which is a current general technology.

Optionally, a shared memory is further disposed in the storage device <NUM>. When sending the interrupt request to the processor <NUM> based on the operating CA or TA, the processor <NUM> may write, into the shared memory, indication information indicating an event to be executed by the processor <NUM>. After receiving the interrupt request, the processor <NUM> may obtain the indication information from the shared memory, and perform, based on the indication information, security detection on a CA instruction, a TA instruction, and related data (for example, configuration information) that are used to operate the event, to ensure secure operating of the CA or the TA. In some implementations, after acquiring the indication information from the shared memory, the processor <NUM> may further clear the shared memory, so that the processor <NUM> continues to write indication information into the shared memory. In this embodiment, the processor <NUM> may control the storage device <NUM> based on the software operating on the processor <NUM>. The specific control may include but is not limited to: controlling starting, controlling shut-down, and controlling entering or exiting the low power consumption state. The processor <NUM> may also control the storage device <NUM> based on software operating on the processor <NUM>. The specific control may include but is not limited to: controlling shut-down, controlling resetting, or the like. Generally, the processor <NUM> controls the storage device <NUM> to start, shut down, enter or exit the low power consumption state. When detecting that an instruction or data for operating the processor <NUM> is abnormal, the processor <NUM> may control the storage device <NUM> to be shut down or reset. Therefore, leakage of important data caused by an attack on the electronic apparatus <NUM> may be avoided.

In this embodiment, the electronic apparatus <NUM> may include various types of registers. The registers include but are not limited to: an address register configured to store an instruction address, a reset register configured to store a reset instruction of an electronic apparatus, a data register configured to store data required in an operating process, or an instruction register configured to store an instruction that needs to be executed. In addition, a configuration register configured to store system configuration information is further included. For example, the configuration register may store resource configuration information based on a TrustZone in the processor <NUM>. For example, the resource configuration information may be used to configure which memories in the storage device may be accessed when the processor <NUM> operates the REE and which memories may be accessed only when the processor <NUM> operates the TEE. The processor <NUM> shown in this embodiment may access some or all registers in the electronic apparatus <NUM>, and may further rewrite instructions in some or all registers. Specifically, the processor <NUM> may access the register in the electronic apparatus <NUM> when the electronic apparatus <NUM> is powered on, when the system <NUM> is woken up, and when the processor <NUM> operates, to determine whether information (for example, configuration information in a configuration information register) stored in the register is changed. Generally, data stored in some registers dynamically changes, and these registers may also be referred to as dynamic registers. For example, the resource configuration information stored in the configuration register may be different in different processes. In a same process, the resource configuration information may also be different as an instruction is executed. A change of data in the dynamic register is generally triggered based on an instruction in a process of executing an instruction sequence. Because the instruction sequence is usually generated by the electronic apparatus <NUM> through compilation based on a program compiled by a developer, the instruction sequence usually does not change. However, an instruction sequence written by the hacker when rewriting the data in the dynamic register is usually different from a reference instruction sequence. Therefore, further, after detecting the change of the data in the dynamic register, the processor <NUM> may determine whether the instruction sequence for operating the processor <NUM> is the reference instruction sequence. When it is determined that the sequence is the reference instruction sequence, it indicates that a change of the dynamic register is a normal change. In this case, the processor <NUM> may change a reference sequence of the dynamic register. When it is determined that the instruction sequence for operating the processor <NUM> is not the reference instruction sequence, it is considered that the dynamic register is tampered with, and a reset instruction may be written into the reset register in the processor <NUM>, to reset the electronic apparatus <NUM>.

In addition, when the processor <NUM> operates, important configuration data may also be dynamically changed. The important configuration data is generally stored in the DRAM, for example, may include but is not limited to: page table entry data, process PID/UID information, or important system security permission configuration data. When the processor <NUM> detects a change of the important configuration data, the foregoing method for comparing reference instruction sequences may also be used to verify whether the change is a normal change, and details are not described herein again.

Optionally, the electronic apparatus <NUM> further includes an on-chip tracking unit, as shown in <FIG>. The on-chip tracking unit may be a coresight system, is usually disposed inside the processor <NUM> and coupled to a core of the processor <NUM>, and is configured to obtain an instruction sequence of the processor <NUM> in an operating process of the processor <NUM>.

Optionally, a dedicated memory is further disposed in the storage device <NUM>, as shown in <FIG>. The dedicated memory may be disposed in the RAM in the storage device <NUM>, and is specially used as storage space for reading data and writing data by the on-chip tracking unit and the security protection apparatus <NUM> (for example, the processor <NUM> or a hash accelerator <NUM> in the security protection apparatus <NUM>). <FIG> schematically shows that a physical address of the dedicated memory in the storage device <NUM> is (0x10xxxx, 0x11xxxx), and the physical address of the dedicated memory is also schematically set based on a requirement of a scenario.

In <FIG>, when rewriting data in the dynamic register based on an instruction, the processor <NUM> may invoke a coresight to obtain the instruction sequence of the processor <NUM>, and the coresight may store the obtained instruction sequence in the dedicated memory. After the coresight stores the instruction sequence in the dedicated memory, the processor <NUM> may send, to the processor <NUM>, an interrupt indicating data rewriting. After receiving the interrupt indicating data rewriting sent by the processor <NUM> or when detecting the change of the data in the dynamic register, the processor <NUM> may obtain the instruction sequence stored in the dedicated memory, and check the instruction sequence. When it is determined that the instruction sequence is the reference instruction sequence, it may be determined that rewriting of the data in the dynamic register is normal rewriting. When it is determined that the instruction sequence is not the reference instruction sequence or the dedicated memory does not store the instruction sequence, it may be determined that the data in the dynamic register is tampered with. In this case, the reset instruction may be written into the system reset register. The coresight system is an on-chip tracking and debugging system in the conventional technology, and details are not described herein. In addition, after obtaining the instruction sequence from the dedicated memory, the processor <NUM> may further clear the dedicated memory, so that when the dynamic register is rewritten next time, the coresight continues to write the instruction sequence into the dedicated memory. In this embodiment, the electronic apparatus <NUM> may store preset information of an instruction and data of the software operating on the processor <NUM>. The preset information may be an original instruction and original data, or may be a hash reference value obtained by performing a HASH operation on an original instruction, original data, or the like. After obtaining instruction code or data from the storage device <NUM> or obtaining instruction code or data from the register, the processor <NUM> may compare the instruction code or data with the preset information to determine whether the software operating on the processor <NUM> is tampered with.

Specifically, when the preset information is the hash reference value obtained by performing the HASH operation, the HASH operation may be further performed on the obtained instruction code, data, or the like. In this way, a HASH value such as instruction code or data is obtained. The processor <NUM> may compare the HASH value obtained through calculation with a corresponding hash reference value, to determine whether an instruction, data, or the like is tampered with. Further, the reference instruction sequence may also be a reference value obtained by performing a HASH operation. After obtaining the instruction sequence, the processor <NUM> may also perform a HASH operation on the instruction sequence, and then compare a HASH value obtained through calculation with the reference value, to determine whether the instruction sequence is tampered with.

Optionally, the HASH operation performed on the obtained instruction or data is implemented by using an arithmetic logic unit. Specifically, the security protection apparatus <NUM> further includes a hash accelerator <NUM>, as shown in <FIG>. The hash accelerator <NUM> is coupled to the processor <NUM>. The processor <NUM> controls, driven by the operating software, the hash accelerator <NUM> to obtain a to-be-detected instruction, to-be-detected data, or a to-be-detected instruction sequence from the storage device <NUM>. Then, the hash accelerator <NUM> performs a HASH operation on the to-be-detected data, the to-be-detected instruction, or the to-be-detected instruction sequence, so that the processor <NUM> determines, based on a hash reference value and a HASH value of the to-be-detected data, the to-be-detected instruction, or the to-be-detected instruction sequence, whether the to-be-detected data, the to-be-detected instruction, or the to-be-detected instruction sequence is rewritten. The hash accelerator <NUM> and the processor <NUM> may be coupled in a same processor, or may be separate processors. The hash accelerator <NUM> herein may be, for example, an SHA256 algorithm device. The hash accelerator <NUM> may be a Hash Accelerator IP, or may be a crypto engine hash.

In this embodiment, the security protection apparatus <NUM> further includes a timer <NUM>, as shown in <FIG>. The timer <NUM> is coupled to the processor <NUM>. Under control of the processor <NUM>, the timer <NUM> sets a timing duration based on a clock cycle provided by a clock source. Optionally, a watchdog <NUM> is further disposed in the security protection apparatus <NUM>, as shown in <FIG>. The watchdog <NUM> may be connected to a hardware reset unit in the electronic apparatus <NUM>. When the security protection apparatus <NUM> stops working due to its own reason, software operating on another processor in the electronic apparatus <NUM> continues to operate in a case in which monitoring cannot be performed. The watchdog <NUM> may be disposed to prevent another processor from being attacked in an operating process when the security protection apparatus <NUM> stops responding. When the security protection apparatus <NUM> normally operates, the processor <NUM> may periodically send a heartbeat instruction to the watchdog <NUM>. When the watchdog <NUM> does not receive, within a predetermined time period set by the timer <NUM>, the heartbeat instruction sent by the processor <NUM>, the watchdog <NUM> may reset the electronic apparatus <NUM> by using the hardware reset unit in the electronic apparatus <NUM>.

Optionally, the security protection apparatus <NUM> further includes a random access memory RAM. The RAM herein may be an SRAM. The RAM is coupled to the processor <NUM>, and is configured to store an instruction that drives the processor <NUM> to operate. Generally, after being powered on, the processor <NUM> first accesses the third storage space in the storage device <NUM>, and loads and operates an executable program stored in the storage device <NUM>. When the storage device <NUM> cannot access the processor <NUM> due to an exception, the exception may be caused by an external attack on the electronic apparatus <NUM>. To prevent the electronic apparatus <NUM> from continuously suffering from an external attack, the processor <NUM> accesses the RAM in this case and operates the instruction stored in the RAM. The instruction stored in the RAM instructs to perform a reset operation on the electronic apparatus <NUM>.

Optionally, the security protection apparatus <NUM> further includes a read-only memory ROM and a one-time programmable (OTP) memory. The OTP may be an Efuse memory. The ROM stores startup program code of the security protection apparatus <NUM>. After the processor <NUM> is powered on, the startup program code may be loaded from the ROM, so that the security protection apparatus <NUM> is started. An Efuse can store startup key data. After loading a startup program, the processor <NUM> may further obtain the startup key data from the Efuse and use the startup key data to check the startup program, so that the security protection apparatus <NUM> is securely started.

In a possible implementation, the security protection apparatus <NUM> and the at least one processor <NUM> are integrated into a first semiconductor chip in the electronic apparatus <NUM>, to form a system on chip (SOC), as shown in <FIG>. In addition, a power supply management unit and a clock signal source may be further disposed in the security protection apparatus <NUM>. The power supply management unit may be coupled to an external power supply (for example, a battery or a power adapter). The power supply management unit may provide electric energy provided by the external power supply to the processor <NUM>, so that the processor <NUM> is powered on. An input end of a clock signal management unit is coupled to an external clock source. A clock signal input end of the processor <NUM> may be coupled to the clock signal management unit. The clock signal management unit may provide, to the processor <NUM>, a clock signal that is input by the external clock source, so that the processor <NUM> works in a clock cycle provided by the clock signal.

It should be noted that the power supply management unit, the clock signal management unit, the hardware reset unit, the power supply, the clock source, and the like are not controlled by the processor <NUM>, and another hardware circuit controls power-on/off, resetting, entering/exiting a sleep mode, and the like. In this way, power supplies and time sequences of the processor <NUM> and the security protection apparatus <NUM> may be separated, and power-on/power-off, resetting, clock cycle modification, and the like of the security protection apparatus <NUM> are not controlled by a system program operating on the processor <NUM>, to improve security of the security protection apparatus <NUM>. Optionally, the storage device <NUM> may be integrated into the first semiconductor chip SOC, or may be integrated into a second semiconductor chip that is in the electronic apparatus <NUM> and that is different from the first semiconductor chip SOC. In this embodiment, the electronic apparatus <NUM> may further include a communication unit <NUM>. As shown in <FIG>, the communication unit <NUM> includes but is not limited to a near field communication unit and a mobile communication unit. The near field communication unit exchanges, by operating a short-distance wireless communication protocol, information with a terminal that is located outside a mobile terminal and that is used to access the Internet. The short-distance wireless communication protocol may include but is not limited to: various protocols supported by a radio frequency identification technology, a Bluetooth communication technology protocol, an infrared communication protocol, and the like. The mobile communication unit accesses the Internet by operating a cellular wireless communication protocol and a radio access network, to implement information exchange between the mobile communication unit and a server that is on the Internet and that supports various applications. The communication unit <NUM> may be integrated into the foregoing first semiconductor chip. In addition, the electronic apparatus <NUM> further includes a bus, an input/output port I/O, a storage controller <NUM>, and the like. The storage controller <NUM> is configured to control the storage device <NUM>. The bus, the input/output port I/O, the storage controller <NUM>, and the like may be integrated in the first semiconductor chip with the security protection apparatus <NUM>, the processor <NUM>, and the like. It should be understood that, in actual application, the electronic apparatus <NUM> may include more or fewer components than those shown in <FIG>. This is not limited in this embodiment of this application.

Based on a hardware structure of the electronic apparatus <NUM> shown in <FIG>, the security protection apparatus <NUM> provided in this embodiment of this application may perform, when the electronic apparatus <NUM> is powered on, when the electronic apparatus <NUM> is woken up, and when the processor <NUM> operates, security detection on the software operating on the processor <NUM>, so that the electronic apparatus <NUM> can be protected during power-on and operating. Compared with that in the related technology, the REE or the TEE cannot be better monitored during operating of the REE or the TEE, in this embodiment, sufficient security monitoring can be performed on the REE or the TEE regardless of operating of the REE or the TEE, to reduce a risk that security data such as key data or face image data is stolen or modified, and improve security performance of the electronic apparatus <NUM>.

As shown in <FIG>, the electronic apparatus <NUM> may further include a media unit <NUM>, an artificial intelligence (AI) unit <NUM>, and the like. The media unit <NUM> may further include a dedicated processor such as a graphics processing unit GPU or a digital signal processor (DSP). The AI unit <NUM> may further include a dedicated processor such as a neural-network processing unit (NPU). The security protection apparatus <NUM> may further perform real-time security protection on software operating on various dedicated processors and related registers included in the media unit <NUM> and the AI unit <NUM>, stored data, and the like. For security protection performed by the security protection apparatus <NUM> on other units, refer to a security protection method performed by the security protection apparatus <NUM> on the software operating on the processor <NUM> and the related data stored in the processor <NUM>.

The security protection apparatus <NUM> shown in this embodiment of this application may perform, based on a preset polling period, security protection on software and the like operating on each processor in each electronic apparatus <NUM>. When receiving an external interrupt, the security protection apparatus <NUM> may further perform, based on an event indicated by the interrupt, security protection on software that executes the event. The following describes, by using embodiments shown in <FIG>, a security protection method applied to the processor <NUM> in the security protection apparatus <NUM>.

<FIG> is a flowchart of a security protection method. The method is performed by a processor <NUM>, and includes the following steps.

<NUM>: Respond to external interrupt information. The external interrupt information herein is sent by another component that communicates with the processor <NUM>. The external interrupt information may be sent by a processor <NUM>, may be sent by an external power supply, or may be sent by an external input/output device (for example, a keyboard, a mouse, or a display screen). The processor <NUM> herein may include but is not limited to a CPU, an NPU, a GPU, and the like. The external interrupt information carries identification information, and different identification information indicates different events. The processor <NUM> may determine, based on the identification information, an event indicated by the external interrupt information. The event indicated by the external interrupt information may include but is not limited to: rewriting variable data by the processor <NUM>, switching an electronic apparatus from a power-off mode to a power-on mode, switching an electronic apparatus from a sleep mode to a wake-up mode, and establishing, by the processor <NUM>, a process to execute an event. The event may include but is not limited to: a face recognition event, a fingerprint recognition event, an unlock event, a payment event, or an event of switching an operating environment of the processor <NUM> from an REE to a TEE. Specifically, the processor <NUM> is connected to a power supply management unit of an electronic apparatus <NUM> or an external power supply. When the power supply management unit or the external power supply starts to supply power, the power supply management unit or the external power supply may send, to the processor <NUM>, information instructing the processor <NUM> to be powered on. The processor <NUM> may be further coupled to an external input/output device (for example, a keyboard, a mouse, or a display screen). When a user wakes up the screen by performing an action such as clicking the mouse, tapping the keyboard, or touching the screen, the external input/output device may send, to the processor <NUM>, information instructing the processor <NUM> to switch from the sleep mode to the wake-up mode.

<NUM>: Determine whether the event indicated by the external interrupt information is a data rewriting event. In this embodiment, executable code (a system program, an application program, or the like) of software used to drive the electronic apparatus to operate, data or instructions stored in some registers, security data (for example, a startup key, fingerprint data, or face template data), one-time security configuration information (for example, used to configure system resources that may be separately accessed by the processor <NUM> during operating of the REE and the TEE), or the like cannot be changed in an operating process of the processor <NUM>. This type of program, instruction, or data is usually the same as corresponding preset information pre-stored in the security protection apparatus <NUM>. Alternatively, a HASH value obtained by performing a HASH operation on this type of program, instruction, or data is the same as a HASH reference value of a corresponding program, a corresponding instruction, or corresponding data pre-stored in the processor <NUM>. Some data may be rewritten in an operating process of the electronic apparatus, for example, data stored in some variable registers, a page table of the electronic apparatus, and some configuration information. This type of data may be different from corresponding preset information pre-stored in a security protection apparatus <NUM>. Alternatively, a HASH value obtained by performing a HASH operation on this type of data may be different from a pre-stored HASH reference value of the software. Data rewriting is usually implemented by the processor <NUM> based on an operating instruction sequence.

After the data is rewritten, a corresponding HASH reference value also changes. Therefore, security protection of the security protection apparatus <NUM> for the data rewriting event is different from a security protection procedure for another event. After responding to the external interrupt information, the processor <NUM> may first determine whether the event indicated by the external interrupt information is the data rewriting event. When it is determined that the event indicated by the external interrupt information is the data rewriting event, a related procedure of a security protection method corresponding to the data rewriting event is performed. Step <NUM> to step <NUM> show the related procedure of the security protection method corresponding to the data rewriting event. When determining that the event indicated by the external interrupt information is not the data rewriting event, the processor <NUM> performs step <NUM>.

<NUM>: Detect, based on the event indicated by the external interrupt and a preset detection rule corresponding to the event, software used to drive the processor <NUM> to operate. The software used to drive the electronic apparatus to operate may include but is not limited to an operating system or an application. The software is, for example, a system program for operating the REE, a system program for operating the TEE, and configuration information of the electronic apparatus. The configuration information is, for example, used to configure a resource that may be accessed by the processor <NUM> in different software environments. The resource herein may include data (such as audio data, image data, and text data) or an instruction stored in a storage device, and may further include configuration information, an operand, or an instruction stored in a register.

If the events indicated by the external interrupts are different, programs (instructions and data) that drive the electronic apparatus to operate are different, and the corresponding detection rules are also different. The security protection apparatus <NUM> may prestore a detection rule corresponding to each event. The detection rule herein may include but is not limited to: a detection cycle (for example, cyclic detection or one-time detection based on a time period set by a timer, where the time period set by the timer may be, for example, <NUM> or <NUM>), to-be-detected content (for example, detecting one or more of a system program, an application program, configuration information, a system list, and security data), and a corresponding security protection operation method when software is tampered with. The to-be-detected content generally includes memory address information and register address information that are used to store a to-be-detected program (an instruction and data). Generally, a plurality of pieces of content (for example, when a face unlock event is executed, four pieces of content need to be detected: a face recognition program (corresponding to physical addresses 0x05xxxx to 0x06xxxx of a RAM), an unlock program (corresponding to physical addresses 0x07xxxx to 0x08xxxx of the RAM), configuration information (corresponding to a register number c1), and security data (corresponding to physical addresses 0x10xxxx to 0x11xxxx of the RAM)) need to be detected for one event. Each piece of content corresponds to one or more pieces of address information. The processor <NUM> detects each piece of content based on the memory address information and the register address information.

Specifically, the foregoing to-be-detected content may further store a hash reference value corresponding to each piece of content. The processor <NUM> may control an operator (for example, the hash accelerator <NUM> shown in <FIG>) to perform a HASH operation on each piece of content, compare a measured value obtained through the HASH operation with a pre-stored hash reference value of corresponding content, and determine whether the measured value of each piece of content is the same as a corresponding hash reference value, to determine whether the software that drives the processor <NUM> to operate is tampered with.

<NUM>: Determine, based on a detection result, whether the software that drives the electronic apparatus to operate is tampered with. In this embodiment, when the processor <NUM> determines, based on a comparison result between the measured value of each piece of content and the corresponding hash reference value, that a measured value of one piece of content is different from a corresponding hash reference value, it indicates that the content is tampered with, that is, the software that drives the electronic apparatus to operate is tampered with. In this case, the electronic apparatus <NUM> has a security risk. Therefore, the processor <NUM> may perform a security protection operation on the electronic apparatus <NUM> based on a security protection operation method corresponding to the event indicated by the external interrupt. The security protection operation performed herein may include but is not limited to: triggering an alarm, resetting the electronic apparatus <NUM>, rejecting a service requested by the software, instructing the processor <NUM> to stop operating, instructing the processor <NUM> to stop operating the software, disabling at least a part of functions of the software, or preventing the software from accessing data stored in the electronic apparatus. Specifically, the processor <NUM> may write a system reset instruction into a reset register having a system reset function. In this case, hardware (for example, the processor <NUM>, a memory, and a register) in the electronic apparatus <NUM> performs a reset operation driven by the reset instruction. For example, rejecting the service requested by the software may include but is not limited to: rejecting unlocking, rejecting access, rejecting providing a key, a biometric recognition failure, or the like.

When determining, based on the comparison result, that measured values of all the content are the same as corresponding hash reference values, the processor <NUM> ends the event detection based on the detection cycle in the foregoing detection rule, or performs detection steps shown in the step <NUM> to the step <NUM> until the time period set by the timer ends, to end the event detection.

In this embodiment, the processor <NUM> rewrites the data based on an instruction sequence for data rewriting. The instruction sequence is registered in advance and does not change when the electronic apparatus is operating. After receiving an external interrupt used to indicate the data rewriting event, the processor <NUM> may determine, by detecting whether the instruction sequence for performing data rewriting is changed, whether the software operating on the processor <NUM> is tampered with.

In a possible implementation, a shared memory may be disposed in the memory. Both the processor <NUM> and the processor <NUM> may write information into the shared memory, or read information from the shared memory. After the processor <NUM> rewrites the data, the processor <NUM> may write the modified part into the shared memory, and send external interrupt information to the processor <NUM>. The external interrupt information herein indicates a location (for example, a point at which a message is sent to the processor <NUM> after the processor <NUM> executes <NUM> instructions and before the processor <NUM> executes a 71st instruction) in the instruction sequence to which the processor <NUM> opeartes, and data rewriting is performed. After receiving the external interrupt message, the processor <NUM> may determine, based on whether the location in the instruction sequence to which the processor <NUM> currently executes the instructions is a preset location, whether the instruction sequence executed by the processor <NUM> is a reference instruction sequence. When it is determined that the instruction sequence executed by the processor <NUM> is the reference instruction sequence, modification information in the shared memory may be queried, and a corresponding reference value is updated based on the modification information. When the processor <NUM> determines, based on the external interrupt information sent by the processor <NUM>, that the location in the instruction sequence to which the processor <NUM> executes the instructions is not the preset location, or the modification information of the modified data is not found in the shared memory, the processor <NUM> performs the security protection operation on the electronic apparatus <NUM>. The security protection operation herein may be, for example, writing a reset instruction into a reset register having a reset function.

In another possible implementation, security protection performed on the data rewriting event may be further determined by using a method for obtaining an instruction sequence by an on-chip tracking unit. In this implementation, a dedicated memory shown in <FIG> is usually disposed in the storage device <NUM>, and the dedicated memory is specially used by the on-chip tracking unit and the processor <NUM> to write data or perform an access query. The on-chip tracking unit may be a coresight. The optional implementation is shown in <FIG>. Details are as follows:.

If the HASH value and the pre-stored hash reference value are different, it may be determined that the instruction sequence obtained from the dedicated memory is not the preset instruction sequence, and it indicates that the data is tampered with. In this case, the processor <NUM> may perform a security protection operation on the electronic apparatus <NUM>, for example, writing a reset instruction into the reset register. If the HASH value and the pre-stored hash reference value are the same, it may be determined that the instruction sequence obtained from the dedicated memory is the preset instruction sequence. In this case, the processor <NUM> updates a reference value of the rewritten data, so that comparison is performed by using an updated reference value when data detection is performed next time. In addition, the processor <NUM> may further clear the instruction sequence stored in the dedicated memory, so that the processor <NUM> continues to write an instruction sequence into the dedicated memory by using the on-chip tracking unit during data rewriting.

In some optional implementations, before performing the steps shown in <FIG>, the processor <NUM> may further detect configuration information of the dedicated memory. The configuration information of the dedicated memory is used to configure which processors or systems can access the dedicated memory, or which processors or systems can write data into the memory. Generally, the configuration information of the dedicated memory is stored in a configuration information register of the processor <NUM>. The processor <NUM> may find the configuration information of the dedicated memory from the configuration information register, and perform a HASH operation on the configuration information. Then, a HASH value obtained through the HASH operation is compared with a pre-stored HASH reference value of the configuration information of the dedicated memory, to determine whether the HASH value and the pre-stored HASH reference value are the same. When the HASH value and the pre-stored HASH reference value are the same, it is determined that the configuration information of the dedicated memory is not rewritten, that is, the data of the dedicated memory is written by the on-chip tracking unit. When the HASH value and the pre-stored HASH reference value are different, it indicates that the configuration information of the dedicated memory has been changed, and the processor <NUM> cannot determine whether the data in the dedicated memory is written by the on-chip tracking unit. To ensure data security of the electronic apparatus <NUM>, in this case, the processor <NUM> may write a reset instruction into the reset register, to reset the electronic apparatus <NUM>.

The following describes in detail the embodiment shown in <FIG> by using a specific scenario. In this embodiment, when the external interrupt information instructs to switch from a power-off mode to a power-on mode or instructs to switch from a sleep mode to a wake-up mode, after the processor <NUM> is powered on or woken up, the processor <NUM> may periodically detect whether software used to drive the processor <NUM> to operate is rewritten. Herein, the detection cycle may be set by using the timer. When detecting that the software used to drive the processor <NUM> to operate is written, the processor <NUM> performs a security protection operation on the electronic apparatus <NUM>. Herein, the software that performs periodic detection through setting of the timer may include but is not limited to: an instruction and data of a system program, configuration information used to perform system configuration, and security data.

As shown in <FIG> shows a schematic diagram of detecting, by the processor <NUM>, the software that drives the electronic apparatus to operate when the electronic apparatus exits the sleep mode.

<NUM>: The processor <NUM> responds to external interrupt information for exiting the sleep mode, and obtains a system program (the system program herein includes a mirror system program of each processor, and includes but is not limited to: a program for operating the TEE and a program for operating the REE) that drives the electronic apparatus to operate, page table data, data stored in a register corresponding to the processor <NUM>, and data stored in a register corresponding to a memory management unit.

<NUM>: The processor <NUM> separately performs hash calculation on the four entries: the system program that drives the processor <NUM> to operate, the page table data, the data stored in the register corresponding to the processor <NUM>, and the data stored in the register corresponding to the memory management unit.

<NUM>: The processor <NUM> compares a reference value of each entry obtained through the hash operation with a pre-stored hash reference value of the corresponding entry, and determines whether the hash values of the four entries obtained through the hash operation are the same as the hash reference values of the corresponding entries.

<NUM>: When the processor <NUM> detects that there is at least one entry whose reference value is different from the corresponding hash reference value, the processor <NUM> may perform global reset on the electronic apparatus.

As shown in <FIG> is a schematic diagram of detecting, by the processor <NUM>, the software operating on the processor <NUM> when an operating environment of the processor <NUM> is switched from the REE to the TEE.

It is assumed that a program used to switch the operating environment from the REE to the TEE is stored in a physical address range 0x05xxxx to 0x06xxxx in the storage device <NUM>. When the processor <NUM> triggers, based on an instruction, the operating environment to switch from the REE to the TEE, the processor <NUM> sends external interrupt information to the processor <NUM>. The external interrupt information instructs the operating environment of the processor <NUM> to switch from the REE to the TEE. The processor <NUM> responds to the external interrupt information, and performs, based on a pre-stored detection rule that corresponds to a case in which the operating environment of the processor <NUM> is switched from the REE to the TEE, a detection step shown in <FIG>: performing a hash operation on the program used to drive the operating environment of the processor <NUM> to switch from the REE to the TEE; comparing a value obtained through the hash operation with a hash reference value corresponding to the program to determine whether the value and the hash reference value are the same; and when the value and the hash reference value are different, writing a reset instruction into the reset register of the electronic apparatus <NUM>, to reset the electronic apparatus <NUM> based on the reset instruction. In this application scenario, when the value obtained through the hash operation is the same as the hash reference value corresponding to the program, the foregoing detection step continues to be performed until the processor <NUM> detects that the operating environment of the processor <NUM> is switched from the TEE to the REE.

As shown in <FIG> is a schematic diagram of detecting, by the processor <NUM>, the software operating on the processor <NUM> when the processor <NUM> executes the face unlock event.

It is assumed that an application program of a face recognition application is stored in a physical address range 0x08xxxx to 0x09xxxx in the storage device <NUM>. When the electronic apparatus triggers operating of the face unlock event based on an instruction, the external input/output device (for example, a screen) or the processor <NUM> sends external interrupt information to the processor <NUM>. The external interrupt information instructs the electronic apparatus to execute the face unlock event. The processor <NUM> responds to the external interrupt information, and performs, based on a pre-stored detection rule corresponding to the face unlock event, a detection step shown in <FIG>: performing a hash operation on an application program that drives the electronic apparatus to execute the face recognition event; comparing a value obtained through the hash operation with a reference value of the application program to determine whether the value and the reference value are the same; and when the value and the reference value are different, rejecting unlocking; or when the value and the reference value are the same, providing a key used to obtain a face template to the processor <NUM>, so that the processor may obtain the face template based on key data for face comparison. It can be seen from <FIG> and <FIG> that, based on different events executed by the processor <NUM>, the processor <NUM> has different detection cycles and different manners of performing the security protection operation on the electronic device <NUM> after detecting that the application program is tampered with. A targeted processing manner is used based on the event executed by the processor <NUM>, so that detection accuracy can be improved, to ensure secure operating of the electronic apparatus <NUM>.

Claim 1:
An electronic apparatus (<NUM>), wherein the electronic apparatus (<NUM>) comprises a security protection apparatus (<NUM>) and a first processor (<NUM>), and security isolation exists between the security protection apparatus (<NUM>) and the first processor (<NUM>);
the first processor (<NUM>) is configured to operate when driven by software, wherein the software comprises an operating system and an application; and
the security protection apparatus (<NUM>) is configured to: perform security detection on the software, and when detecting that the software is tampered with, perform a security protection operation on the electronic apparatus (<NUM>),
wherein the operating system comprises a rich execution environment, REE, and a trusted execution environment, TEE, wherein the security protection apparatus (<NUM>) is specifically configured to:
when an operating environment of the first processor (<NUM>) is switched from the REE to the TEE, periodically perform the security detection on software that is used to drive the operating environment of the first processor (<NUM>) to be switched and software that operates in the TEE; and
stop performing the security detection when the operating environment of the first processor (<NUM>) is switched from the TEE to the REE.