Alibaba Group Holding Limited

C-sky Microsystems Co., Ltd.

Xiaoxia Cui

Xuanle Ren

Li Chen

Chunqiang Li

Guangen Hou

Performing controlled access to data stored in a secure partition is described herein, including: associating a predetermined exception with an exception handling program in an operating system; restricting a user program to execution by a normal privilege user; and designating a secure partition and restricting the secure partition to be accessible by a highest privilege user; wherein, when executed in user space corresponding to the normal privilege user, the user program generates the predetermined exception, and wherein the predetermined exception triggers execution of the exception handling program in kernel space, and the exception handling program is configured to read data from the secure partition and deliver the data after processing to the user program.

Controlled access to data stored in a secure partition

Dynamic generation of device identifiers is disclosed, including: issuing an identifier configuration request in response to a user operation; after receiving the identifier configuration request, calling a true random number generator source to generate random information; and writing the random information or a data processing result from the random information as the identifier into a predetermined storage area.

Dynamic generation of device identifiers

A processing unit comprising: a processor; and a memory, coupled to the processor and adapted to provide a plurality of enclaves isolated from each other, where the plurality of enclaves include a plurality of application enclaves, each of the application enclaves is used for running a respective application program, and the plurality of enclaves further include at least one of the following: a runtime enclave adapted to provide a storage space required for an invokable program; and a crypto enclave adapted to provide a storage space required for a crypto related program, wherein the runtime enclave and the crypto enclave have read/write permission for the plurality of application enclaves, and each of the application enclaves has no read/write permission for the runtime enclave and the crypto enclave.

Processing unit, electronic device, and security control method

A processing apparatus, an embedded system, a system-on-chip, and a security control method are disclosed. The processing apparatus includes a processor, adapted to execute a program; and a memory, coupled to the processor and adapted to provide a plurality of enclaves isolated from each other. One of the plurality of enclaves is a source enclave, another one of the plurality of enclaves is a target enclave, and the source enclave and the target enclave each are used to provide a storage space required for running a corresponding program. The processing apparatus further comprises a storage access controller, adapted to transmit specified data stored in the source enclave to the target enclave. According to the processing apparatus, the embedded system, the system-on-chip, and the security control method provided in the embodiments of the present disclosure, a storage access controller can be used to implement a data transmission process from a source enclave to a target enclave, without requiring a processor for data transferring, thereby improving efficiency of inter-enclave data transmission while ensuring security.

Processing apparatus, embedded system, system-on-chip, and a security control method for inter-enclave data transmission

An embedded system and method, comprising a processor adapted to execute an instruction of an application program, where the instruction includes an access instruction for a hardware device; a memory adapted to store the instruction of the application program; and a physical memory protection apparatus coupled to the processor and the memory, where the access instruction accesses the hardware device through the physical memory protection apparatus.

Embedded system and method

The present disclosure provides trusted kernel-based anti-attack data processors. One exemplary processor comprises: a trusted kernel exception vector table configured to provide a handling entry for kernel switching; a trusted kernel stack pointer register storing a trusted kernel stack pointer that points to a trusted kernel stack space; and a trusted zone in the trusted kernel stack space, the trusted zone including a program status register storing a flag bit of a starting kernel for the kernel switching, a program pointer, and a general register. When the data processor performs kernel switching from a non-trusted kernel to a trusted kernel, the trusted kernel locates the handling entry for the kernel switching and performs the switching. An underlying software protection mechanism can be provided for switching entries of a trusted kernel. Therefore, security during switching processes between a trusted kernel and a non-trusted kernel can be improved.

Growing community of inventors

Hangzhou, China

Xiaoxia Cui