TrustZone-based data encryption and decryption methods and apparatuses, and terminal device

Abstract

The invention discloses TrustZone-based data encryption and decryption methods and apparatuses, and a terminal device. The encryption method comprises the steps of sending a data encryption request to a trusted application in a trusted execution environment through a client interface between a general execution environment and the trusted execution environment, wherein the data encryption request comprises a class key and to-be-encrypted data; decrypting the class key according to a main key pre-stored in the trusted execution environment by the trusted application; encrypting the to-be-encrypted data according to the decrypted class key by the trusted application; and returning the encrypted to-be-encrypted data to the general execution environment through the client interface by the trusted application. The encryption method has high security performance and expandability.

Description

technical field [0001] The present invention relates to the technical field of mobile terminal equipment security, in particular, to a TrustZone-based data encryption and decryption method, device and terminal equipment. Background technique [0002] With the popularization of mobile terminal devices (such as smart phones, tablet computers, etc.), various application programs for mobile terminal devices have been born. In various applications, there are usually a large number of small pieces of sensitive data that need proper persistent protection, and encryption is the most common means of data protection. [0003] Common encryption schemes used in mobile terminal equipment are as follows: 1) Encrypt data through external components, such as TF (Trans-Flash) encryption cards, etc., which have high security, but low performance, and basically No scalability; 2) Encrypt data through the built-in encryption engine, which is generally integrated in SoC (System on Chip, system ...

AI Technical Summary

Problems solved by technology

[0003] Common encryption schemes used in mobile terminal equipment are as follows: 1) Encrypt data through external components, such as TF (Trans-Flash) encryption cards, etc., which have high security, but low performance, and basically No scalability; 2) Encrypt data through the built-in encryption engine, which is generally integrated in SoC (System on Chip, system on chip), its security depends on the access control mechanism of the system, and its performance is high, but using There are many details that need to be understood, and there is basically no scalability; 3) The data is encrypted through a soft encryption library, which is based on a general-purpose CPU for calculation, with a friendly interface and high computing performance. mostly in user space, so the system kernel is usually not available

Images