Nothing Special   »   [go: up one dir, main page]

WO2021109655A1 - 安全任务处理方法、装置、电子设备及存储介质 - Google Patents

安全任务处理方法、装置、电子设备及存储介质 Download PDF

Info

Publication number
WO2021109655A1
WO2021109655A1 PCT/CN2020/113477 CN2020113477W WO2021109655A1 WO 2021109655 A1 WO2021109655 A1 WO 2021109655A1 CN 2020113477 W CN2020113477 W CN 2020113477W WO 2021109655 A1 WO2021109655 A1 WO 2021109655A1
Authority
WO
WIPO (PCT)
Prior art keywords
security
micro
architecture
operating system
task processing
Prior art date
Application number
PCT/CN2020/113477
Other languages
English (en)
French (fr)
Inventor
朱丙营
辛知
孟飞
郑建旭
Original Assignee
支付宝(杭州)信息技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 支付宝(杭州)信息技术有限公司 filed Critical 支付宝(杭州)信息技术有限公司
Publication of WO2021109655A1 publication Critical patent/WO2021109655A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/57—Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities

Definitions

  • This application relates to the field of computer communication, and in particular to a security task processing method, device, electronic equipment, and storage medium.
  • the electronic devices may include a secure operating system and a basic operating system.
  • the processor used to process security tasks on electronic devices runs the basic operating system by default.
  • the operating system can be switched from the basic operating system to the secure operating system. Security tasks are performed in the system environment of the operating system.
  • the present application provides a security task processing method, device, electronic equipment, and storage medium.
  • a security task processing method is provided, the method is applied to a processor in an electronic device, and the processor is equipped with a security operating system; wherein, the security operating system includes a micro security architecture , The micro security architecture includes at least one security application service; the method includes:
  • the micro security architecture is a general micro security architecture compatible with security operating systems that support multiple processors of different specifications.
  • the method further includes:
  • a micro-security architecture is created based on the configuration file of the pre-configured micro-security architecture.
  • the method before the operation of the micro-security architecture and the determination of a target security application service matching the security task processing request among multiple security application services included in the micro-security architecture, the method further include:
  • the micro security architecture includes Super TA.
  • a security task processing device is provided, the device is applied to a processor in an electronic device, and the processor is equipped with a security operating system; wherein, the security operating system includes a micro security architecture , The micro security architecture includes at least one security application service; the device includes:
  • the switching unit is configured to switch the operating system running on the processor to the security operating system in response to the monitored security task processing request;
  • the determining unit is configured to run the micro security architecture in the system environment of the security operating system, and determine a target security application matching the security task processing request among multiple security application services included in the micro security architecture service;
  • the calling unit is used to call the target security application service to complete the security task corresponding to the security task processing request.
  • the micro security architecture is a general micro security architecture compatible with security operating systems that support multiple processors of different specifications.
  • the device further includes:
  • the creation unit is used to create a micro-security architecture based on the configuration file of the pre-configured micro-security architecture during the initialization phase of the security operating system.
  • the device further includes:
  • the detection unit is configured to determine whether the target security application service requested by the security task processing request is a security application service included in the micro security architecture;
  • the determining unit is configured to, if yes, run the micro security architecture, and determine a target security application service matching the security task processing request among multiple security application services included in the micro security architecture.
  • the micro security architecture includes Super TA.
  • an electronic device including:
  • a memory for storing processor executable instructions
  • the processor implements the above safety task processing method by running the executable instruction.
  • a machine-readable storage medium having computer instructions stored thereon, which when executed by a processor implements the above-mentioned security task processing method.
  • this application proposes a micro-security architecture, which includes at least one secure application service.
  • the micro security architecture can be deployed in a security operating system carried by the processor.
  • the micro-security architecture provided by this application can isolate the security application service from the security operating system of each processor, and facilitate the upgrade, maintenance, and transplantation of the security application service.
  • micro-security architecture provided by this application has strong compatibility and can be compatible with security operating systems that support multiple processors of different specifications. Developers only need to develop a micro-security architecture to realize the simultaneous deployment of secure application services in the secure operating systems of multiple processors, greatly improving the deployment efficiency of secure application services.
  • Fig. 1 is a schematic diagram of an electronic device shown in an exemplary embodiment of this specification
  • Fig. 2 is a flowchart of a security task processing method shown in an exemplary embodiment of the present application
  • Fig. 3 is a schematic diagram of an ARMv8 architecture shown in an exemplary embodiment of the present application.
  • Fig. 4 is a block diagram of a security task processing device shown in an exemplary embodiment of the present application.
  • first, second, third, etc. may be used in this specification to describe various information, the information should not be limited to these terms. These terms are only used to distinguish the same type of information from each other.
  • first information may also be referred to as second information, and similarly, the second information may also be referred to as first information.
  • word “if” as used herein can be interpreted as "when” or “when” or "in response to determination”.
  • this application proposes a micro security architecture, which includes at least one security application service.
  • the micro security architecture can be deployed in a security operating system carried by the processor.
  • the micro-security architecture provided by this application can isolate the security application service from the security operating system of each processor, and facilitate the upgrade, maintenance, and transplantation of the security application service.
  • micro-security architecture provided by this application has strong compatibility and can be compatible with security operating systems that support multiple processors of different specifications. Developers only need to develop a micro-security architecture to realize the simultaneous deployment of secure application services in the secure operating systems of multiple processors, greatly improving the deployment efficiency of secure application services.
  • this application also provides a method for processing security tasks based on a micro security architecture.
  • the processor may switch the operating system running by the processor to the safety operating system in response to the monitored safety task processing request.
  • the micro-security architecture In the system environment of the secure operating system, run the micro-security architecture, and among the multiple security application services included in the micro-security architecture, determine the target security application service that matches the security task processing request, and call all security application services.
  • the target safety application service is used to complete the safety task corresponding to the safety task processing request.
  • this application also provides a method for creating a micro-security architecture. In the initial process of a secure operating system, the creation of the micro-security architecture is completed.
  • Fig. 1 is a schematic diagram of an electronic device according to an exemplary embodiment of this specification.
  • the electronic device includes at least one processor, a network interface, a storage medium, and a bus.
  • the electronic device may also include other hardware, such as logic chips, input/output interfaces, and so on.
  • the hardware of the electronic device is only exemplarily described, and it is not specifically limited.
  • the processor, network interface, and storage medium can communicate with each other through the bus.
  • the above-mentioned processor may be an ARM (Advanced RISC Machines, advanced RISC processor chip) chip (such as ARMv8), or an Intel x86 (Intel x86) chip, etc.
  • ARM Advanced RISC Machines, advanced RISC processor chip
  • Intel x86 Intel x86
  • Each processor in the electronic device independently runs its own operating system, and performs its own tasks under the operating system it runs.
  • the operating system that the processor runs may include a basic operating system and a security operating system.
  • the processor runs a basic operating system by default, and when it needs to process a security task, the processor switches its running basic operating system to a secure operating system.
  • the security task is executed in the system environment of the security operating system. After the execution of the security task is completed, the operating system is switched from the security operating system to the basic operating system.
  • the aforementioned storage medium may be any electronic, magnetic, optical, or other physical storage device, and may contain storage information, such as executable instructions, data reading and writing, and so on.
  • the processor readable and writable storage medium may be: a volatile memory, a non-volatile memory, or a similar storage medium.
  • electronic devices may include: mobile terminal devices (such as mobile phones, IPAD, etc.), PCs, portable computers, and so on.
  • the electronic device is only exemplified here, and it is not specifically limited.
  • the micro-security architecture is a newly proposed architecture in this application. It is a micro-architecture with strong compatibility.
  • the micro-security architecture can be compatible with security operating systems that support multiple processors of different specifications.
  • the micro security architecture can be compatible with the security operating system of the Inter X86 processor and the security operating system of the ARM processor.
  • the micro security architecture has the authority to call the basic functions of the operating system. Such as: interrupt registration, process creation, process cancellation, memory management, file system management, Timer registration and other functions.
  • interrupt registration process creation, process cancellation, memory management, file system management, Timer registration and other functions.
  • process creation process creation
  • process cancellation memory management
  • file system management file system management
  • Timer registration timer registration and other functions.
  • function of the micro-security architecture is only exemplified, and the function of the micro-security architecture is not specifically limited.
  • the micro security architecture may include at least one security application service.
  • the micro security architecture may include: unlocking services, signature services in the payment process, and so on.
  • the security application service of the micro security architecture is only exemplified, and it is not specifically limited.
  • the micro security architecture can isolate the security application service from the security operating system of each processor, facilitating the upgrade, maintenance and transplantation of the security application service.
  • the micro-security architecture can be compatible with security operating systems that support a variety of processors with different specifications, developers only need to develop the micro-security architecture to deploy security application services in the security operating systems of multiple processors at the same time. Improved the deployment efficiency of security application services.
  • the micro-security architecture may be a Super TA (Advanced Authority Security Application Management) architecture.
  • the micro-security architecture may also be other architectures.
  • the micro-security architecture is only exemplified and not specifically limited.
  • the security task processing method provided in this application will be described in detail below from two aspects of security task processing based on micro security architecture and creation of micro security architecture.
  • FIG. 2 is a flowchart of a security task processing method shown in an exemplary embodiment of the present application.
  • the method can be applied to any processor in the electronic device shown in FIG. 1.
  • the processor is equipped with a secure operating system.
  • the secure operating system includes a micro-security architecture.
  • the micro security architecture includes at least one security application service.
  • the safety task processing method may include the following steps.
  • Step 202 In response to the monitored security task processing request, the processor switches the operating system running on the processor to the security operating system.
  • safety tasks refer to tasks with high safety requirements.
  • users complete tasks related to bill or order payment through security applications (such as payment apps, etc.).
  • security applications such as payment apps, etc.
  • users perform user information authentication tasks through security applications.
  • Another example is the screen unlocking task triggered when the user turns on the screen.
  • the safety task is only exemplified here, and it is not specifically limited.
  • Safety application service is a program used to complete safety tasks. Each safety task corresponds to a safety application service.
  • the security application service that handles the security task is a screen unlocking service.
  • the screen unlocking service can match the screen unlocking password entered by the user with the unlocking password preset by the user. If the match is successful, the screen will be unlocked. If the match fails, the prompt message of the wrong password will be displayed.
  • the safety task and safety application service are only exemplified here, and they are not specifically limited.
  • the driver of the security application client when the driver of the security application client (such as Alipay, etc.) detects that the user triggers the security task on the security application client, the driver of the security application client may initiate a security task processing request.
  • the processor When the processor monitors the safety task processing request, it can respond to the safety task processing request and switch the operating system running on the processor from the basic operating system to the safety operating system.
  • the processor may call the switching logic recorded in the switching firmware in the storage medium, and switch the operating system of the processor from a basic operating system to a secure operating system.
  • Secure monitor firmware is stored in the storage medium of the electronic device.
  • the processor can call the switching logic in the Secure monitor firmware to switch the operating system running on the processor from the basic operating system to the secure operating system.
  • the operating system switching mode is only exemplarily described, and it is not specifically limited.
  • Step 204 The processor runs the micro-security architecture in the system environment of the security operating system, and determines a target security application that matches the security task processing request among multiple security application services included in the micro-security architecture service.
  • the micro security architecture includes security application services for handling all security tasks supported by electronic devices.
  • the aforementioned security task processing request carries the service identifier of the requested target security application service.
  • the processor runs the micro security architecture in the system environment of the security operating system, and determines the target security application service indicated by the service identifier among multiple security application services included in the micro security architecture.
  • the micro security architecture includes security application services for processing part of the security tasks supported by electronic devices
  • the security operating system includes security application services for processing part of the security tasks supported by electronic devices. Security application service.
  • the processor may determine whether the target security application service requested by the security task processing request is a security application service included in the micro security architecture.
  • the target security application service requested by the security task processing request is a security application service included in the micro security architecture, run the micro security architecture, and determine among the multiple security application services included in the micro security architecture The target security application service matching the security task processing request.
  • the target security application service requested by the security task processing request is not a security application service included in the micro security architecture, in the security application services configured in the security operating system, search for a target security application that matches the security task processing request service.
  • Method 1 The security task processing request carries the service identifier of the requested target security application service.
  • the storage medium of the electronic device maintains a list of service identities of all security application services included in the micro security architecture.
  • the processor may call the list of service identifications, and search the list of service identifications for whether there is a service identification carried in the security task processing request. If the service identifier carried in the security task processing request exists in the service identifier list, it is determined that the security application service requested by the security task processing request is the security application service included in the micro security architecture. If the service identifier carried by the security task processing request does not exist in the list of service identifiers, it is determined that the security application service requested by the security task processing request is not a security application service included in the micro security architecture.
  • the service identification list of the security application service included in the micro security architecture includes: security application service 1, security application service 2, and security application service 3.
  • the security task processing request carries the service identifier of the requested security application service as security application service 1.
  • the processor can determine that the security application service requested by the security task processing request is a security application service included in the micro security architecture.
  • the security task processing request carries the service identifier of the requested target security application service.
  • the service identifier may indicate whether the target security application service is a security application service of a security operating system or a security application service included in the micro security architecture.
  • a certain designated bit in the service identifier can be designated to indicate the location of the target security application service.
  • the processor may obtain the service identifier of the target security application service carried in the security task processing request, and if the value of the designated bit of the service identifier is the first preset value (for example, 1), it is determined that the target security application service is micro security Security application services included in the architecture. If the value of the designated bit of the service identifier is the second preset value (for example, 0), it is determined that the target secure application service is the secure application service included in the secure operating system.
  • determining whether the target security application service requested by the security task processing request is a security application service included in the micro security architecture is only exemplified here, and it is not specifically limited.
  • the micro security architecture is run, and among multiple security application services included in the micro security architecture , To determine the target security application service indicated by the service identifier.
  • the target security application service requested by the security task processing request is not a security application service included in the micro-security architecture, in the security application service configured in the security operating system, search for the location corresponding to the service identification carried in the security task processing request.
  • the indicated target security application service is not a security application service included in the micro-security architecture, in the security application service configured in the security operating system, search for the location corresponding to the service identification carried in the security task processing request. The indicated target security application service.
  • Step 206 The processor invokes the target security application service to complete the security task corresponding to the security task processing request.
  • the processor may first obtain the safety task corresponding to the safety task processing request.
  • the safety task processing request carries the safety task
  • the processor may parse the safety task processing request to obtain the safety task carried in the safety task processing request.
  • the safety task processing request carries the identifier of the safety task.
  • the safety task can be recorded in the cache.
  • the processor may parse the safety task processing request, obtain the safety task identifier carried in the safety task processing request, and read the safety task in the cache based on the safety task identifier.
  • the processor may create a micro-security architecture based on a pre-configured configuration file of the micro-security architecture during the initialization phase of the security operating system.
  • FIG. 3 is a schematic diagram of an ARMv8 architecture shown in an exemplary embodiment of the present application.
  • EL0 represents the execution level 0 of the ARMv8 architecture, and the application program (ie Application in FIG. 3) is executed at the EL0 level.
  • the EL1 represents the execution level 1 of the ARMv8 architecture, and the kernel operating system is executed at the EL1 level.
  • the kernel operating system may include: a secure operating system (ie, Secure OS in Figure 3), and a basic operating system (ie, Normal OS in Figure 3).
  • EL3 represents the execution level 3 of the ARMv8 architecture, and the Secure Monitor firmware is executed at the EL3 level.
  • BL1 refers to the first start-up phase of electronic equipment.
  • BL2 refers to the second start-up phase of electronic equipment.
  • BL31 refers to the third start-up phase of electronic equipment.
  • the electronic device can enter the BL1 stage.
  • the processor of the electronic device can use the verification method in the BL1 stage to verify the firmware of the BL2 stage. If the BL2 stage firmware check passes, the BL2 stage start is executed based on the BL2 stage firmware.
  • the processor can use the verification method in the BL2 stage to verify the legitimacy of the firmware in the BL31 stage, use the verification method in the BL2 stage to verify the legitimacy of the Bootloader firmware, and use the verification method in the BL2 stage to verify The legitimacy given by the secure operating system.
  • the processor uses the firmware in the BL31 stage to execute the startup of the BL31 stage, and initializes the secure operating system in the BL31 stage.
  • a micro-security architecture is created based on the pre-configured configuration file of the micro-security architecture.
  • the creation of the micro-security architecture described in this application includes the creation of the micro-security architecture and the security application services included in the micro-security architecture.
  • the processor can also execute the Bootloader in the BL31 stage, so that the Bootloader completes the initialization of the basic operating system. After the basic operating system is initialized, the processor can run the basic operating system.
  • the processor can also be other types of processors (such as Inter X86 processors).
  • processors such as Inter X86 processors.
  • this application proposes a micro-security architecture, which can be deployed in a secure operating system carried by a processor, and can include at least one secure application service.
  • the micro security architecture can isolate the security application service from the security operating system of each processor, facilitating the upgrade, maintenance and transplantation of the security application service.
  • micro-security architecture has strong compatibility and can be compatible with security operating systems that support multiple processors of different specifications. Developers only need to develop a micro-security architecture to implement the simultaneous deployment of secure application services in secure operating systems of multiple processors, which greatly facilitates the deployment of secure application services.
  • this application also provides a method for security task processing based on a micro security architecture.
  • the processor may switch the operating system running by the processor to the safety operating system in response to the monitored safety task processing request.
  • the micro-security architecture In the system environment of the secure operating system, run the micro-security architecture, and among the multiple security application services included in the micro-security architecture, determine the target security application service that matches the security task processing request, and call all security application services.
  • the target safety application service is used to complete the safety task corresponding to the safety task processing request.
  • this application also provides a method for creating a micro-security architecture. In the initial process of a secure operating system, the creation of the micro-security architecture is completed.
  • the present application also provides a safety task processing device corresponding to the above-mentioned safety task processing method.
  • Fig. 4 is a block diagram of a security task processing apparatus according to an exemplary embodiment of the present application.
  • the device is applied to a processor in an electronic device, and the processor is equipped with a secure operating system; wherein, the secure operating system includes a micro-security architecture, and the micro-security architecture includes at least one secure application service; the device includes The unit is shown below.
  • the switching unit 401 is configured to switch the operating system running on the processor to a secure operating system in response to the monitored security task processing request;
  • the determining unit 402 is configured to run the micro security architecture in the system environment of the security operating system, and determine the target security that matches the security task processing request among multiple security application services included in the micro security architecture Application service
  • the calling unit 403 is used to call the target security application service to complete the security task corresponding to the security task processing request.
  • the micro security architecture is a general micro security architecture compatible with security operating systems that support multiple processors of different specifications.
  • the device further includes:
  • the creation unit is used to create a micro-security architecture based on the configuration file of the pre-configured micro-security architecture during the initialization phase of the security operating system.
  • the device further includes:
  • the detection unit is configured to determine whether the target security application service requested by the security task processing request is a security application service included in the micro security architecture;
  • the determining unit 402 is configured to, if yes, run the micro security architecture, and determine a target security application service matching the security task processing request among multiple security application services included in the micro security architecture.
  • the micro security architecture includes Super TA.
  • this application also provides an electronic device, which includes: a processor;
  • a memory for storing executable instructions of the processor; wherein the processor executes by running the executable instructions in response to the monitored security task processing request, and switches the operating system running by the processor to a security operating system;
  • the micro security architecture is a general micro security architecture compatible with security operating systems that support multiple processors of different specifications.
  • the processor creates a micro-security architecture based on a pre-configured configuration file of the micro-security architecture in the initialization phase of the security operating system by running the executable instructions.
  • the processor runs the micro-security architecture by running the executable instruction, and determines the one that matches the security task processing request among multiple security application services included in the micro-security architecture.
  • execute Before the target security application service, execute to determine whether the target security application service requested by the security task processing request is a security application service included in the micro security architecture; if so, execute the operation of the micro security architecture, and Among the multiple security application services included in the micro security architecture, a step of determining a target security application service matching the security task processing request.
  • the micro security architecture includes Super TA.
  • the present application also provides a machine-readable storage medium on which computer instructions are stored.
  • the operating system that the processor runs is switched to in response to the monitored security task processing request.
  • the micro security architecture is a general micro security architecture compatible with security operating systems that support multiple processors of different specifications.
  • the instruction when executed by the processor, it is implemented in the initialization phase of the security operating system, and a micro security architecture is created based on a pre-configured configuration file of the micro security architecture.
  • the instruction when executed by the processor, it is implemented to determine whether the target security application service requested by the security task processing request is a security application service included in the micro security architecture; if so, execute and run the micro security architecture , And among the multiple security application services included in the micro security architecture, a target security application service that matches the security task processing request is determined.
  • the micro security architecture includes Super TA.
  • a typical implementation device is a computer.
  • the specific form of the computer can be a personal computer, a laptop computer, a cellular phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email receiving and sending device, and a game control A console, a tablet computer, a wearable device, or a combination of any of these devices.
  • the computer includes one or more processors (CPU), input/output interfaces, network interfaces, and memory.
  • processors CPU
  • input/output interfaces network interfaces
  • memory volatile and non-volatile memory
  • the memory may include non-permanent memory in computer readable media, random access memory (RAM) and/or non-volatile memory, such as read-only memory (ROM) or flash memory (flash RAM). Memory is an example of computer readable media.
  • RAM random access memory
  • ROM read-only memory
  • flash RAM flash memory
  • Computer-readable media include permanent and non-permanent, removable and non-removable media, and information storage can be realized by any method or technology.
  • the information can be computer-readable instructions, data structures, program modules, or other data.
  • Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, CD-ROM, digital versatile disc (DVD) or other optical storage, Magnetic cassettes, disk storage, quantum memory, graphene-based storage media or other magnetic storage devices, or any other non-transmission media, can be used to store information that can be accessed by computing devices.
  • computer-readable media does not include transitory media, such as modulated data signals and carrier waves.
  • first, second, third, etc. may be used to describe various information in one or more embodiments of this specification, the information should not be limited to these terms. These terms are only used to distinguish the same type of information from each other.
  • first information may also be referred to as second information, and similarly, the second information may also be referred to as first information.
  • word “if” as used herein can be interpreted as "when” or “when” or "in response to determination”.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Hardware Design (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Software Systems (AREA)
  • Theoretical Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Stored Programmes (AREA)

Abstract

本说明书提供一种安全任务处理方法、装置、电子设备及存储介质，所述方法应用于电子设备中的处理器，所述处理器搭载了安全操作系统；其中，所述安全操作系统包括微安全架构，所述微安全架构包含至少一个安全应用服务；所述方法包括：响应于监听到的安全任务处理请求，将所述处理器运行的操作系统切换为安全操作系统；在安全操作系统的系统环境中，运行所述微安全架构，并在所述微安全架构包含的多个安全应用服务中，确定与所述安全任务处理请求匹配的目标安全应用服务；调用所述目标安全应用服务，以完成与所述安全任务处理请求所对应的安全任务。

Description

安全任务处理方法、装置、电子设备及存储介质 技术领域
本申请涉及计算机通信领域，尤其涉及一种安全任务处理方法、装置、电子设备及存储介质。
背景技术
为了满足用户采用电子设备进行支付等安全需求，电子设备可包括安全操作系统和基础操作系统。通常，电子设备上用于处理安全任务的处理器默认运行的是基础操作系统，当该处理器检测到用户触发的安全任务时，可将操作系统由基础操作系统切换为安全操作系统，在安全操作系统的系统环境中执行安全任务。
发明内容
有鉴于此，本申请提供一种安全任务处理方法、装置、电子设备及存储介质。
具体地，本申请是通过如下技术方案实现的：
根据本申请的第一方面，提供一种安全任务的处理方法，所述方法应用于电子设备中的处理器，所述处理器搭载了安全操作系统；其中，所述安全操作系统包括微安全架构，所述微安全架构包含至少一个安全应用服务；所述方法包括：
响应于监听到的安全任务处理请求，将所述处理器运行的操作系统切换为安全操作系统；
在安全操作系统的系统环境中，运行所述微安全架构，并在所述微安全架构包含的多个安全应用服务中，确定与所述安全任务处理请求匹配的目标安全应用服务；
调用所述目标安全应用服务，以完成与所述安全任务处理请求所对应的安全任务。
可选的，所述微安全架构为兼容支持多种不同规格的处理器的安全操作系统的通用微安全架构。
可选的，所述方法还包括：
在安全操作系统的初始化阶段，基于预配置的微安全架构的配置文件，创建微安全架构。
可选的，在所述运行所述微安全架构，并在所述微安全架构包含的多个安全应用服务中，确定与所述安全任务处理请求匹配的目标安全应用服务之前，所述方法还包括：
确定所述安全任务处理请求所请求的目标安全应用服务是否为所述微安全架构所包含的安全应用服务；
若是，则执行所述运行所述微安全架构，并在所述微安全架构包含的多个安全应用服务中，确定与所述安全任务处理请求匹配的目标安全应用服务的步骤。
可选的，所述微安全架构包括Super TA。
根据本申请的第二方面，提供一种安全任务的处理装置，所述装置应用于电子设备中的处理器，所述处理器搭载了安全操作系统；其中，所述安全操作系统包括微安全架构，所述微安全架构包含至少一个安全应用服务；所述装置包括：
切换单元，用于响应于监听到的安全任务处理请求，将所述处理器运行的操作系统切换为安全操作系统；
确定单元，用于在安全操作系统的系统环境中，运行所述微安全架构，并在所述微安全架构包含的多个安全应用服务中，确定与所述安全任务处理请求匹配的目标安全应用服务；
调用单元，用于调用所述目标安全应用服务，以完成与所述安全任务处理请求所对应的安全任务。
可选的，所述微安全架构为兼容支持多种不同规格的处理器的安全操作系统的通用微安全架构。
可选的，所述装置还包括：
创建单元，用于在安全操作系统的初始化阶段，基于预配置的微安全架构的配置文件，创建微安全架构。
可选的，所述装置还包括：
检测单元，用于确定所述安全任务处理请求所请求的目标安全应用服务是否为所述微安全架构所包含的安全应用服务；
所述确定单元，用于若是，则运行所述微安全架构，并在所述微安全架构包含的多个安全应用服务中，确定与所述安全任务处理请求匹配的目标安全应用服务。
可选的，所述微安全架构包括Super TA。
根据本申请的第三方面，提供一种电子设备，包括：
处理器；
用于存储处理器可执行指令的存储器；
其中，所述处理器通过运行所述可执行指令以实现上述安全任务处理方法。
根据本申请的第四方面，提供一种机器可读存储介质，其上存储有计算机指令，该指令被处理器执行时实现上述安全任务处理方法。
由上述描述可知，本申请提出了一种微安全架构，该微安全架构包括至少一个安全应用服务。该微安全架构可以部署在处理器搭载的安全操作系统中。
本申请提供的微安全架构可以使得安全应用服务与各处理器的安全操作系统隔离开，便于安全应用服务的升级、维护和移植。
本申请提供的微安全架构具有很强的兼容性，可以兼容支持多种不同规格的处理器的安全操作系统。开发人员只需开发微安全架构，就可实现在多种处理器的安全操作系统中同时部署安全应用服务，大大提高安全应用服务的部署效率。
附图说明
图1是本说明书一示例性实施例示出的一种电子设备的示意图；
图2是本申请一示例性实施例示出的一种安全任务处理方法的流程图；
图3是本申请一示例性实施例示出的一种ARMv8架构的示意图；
图4是本申请一示例性实施例示出的一种安全任务处理装置的框图。
具体实施方式
这里将详细地对示例性实施例进行说明，其示例表示在附图中。下面的描述涉及附图时，除非另有表示，不同附图中的相同数字表示相同或相似的要素。以下示例性实施例中所描述的实施方式并不代表与本说明书相一致的所有实施方式。相反，它们仅是与如所附权利要求书中所详述的、本说明书的一些方面相一致的装置和方法的例子。
在本说明书使用的术语是仅仅出于描述特定实施例的目的，而非旨在限制本说明 书。在本说明书和所附权利要求书中所使用的单数形式的“一种”、“所述”和“该”也旨在包括多数形式，除非上下文清楚地表示其他含义。还应当理解，本文中使用的术语“和/或”是指并包含一个或多个相关联的列出项目的任何或所有可能组合。
应当理解，尽管在本说明书可能采用术语第一、第二、第三等来描述各种信息，但这些信息不应限于这些术语。这些术语仅用来将同一类型的信息彼此区分开。例如，在不脱离本说明书范围的情况下，第一信息也可以被称为第二信息，类似地，第二信息也可以被称为第一信息。取决于语境，如在此所使用的词语“如果”可以被解释成为“在……时”或“当……时”或“响应于确定”。
本申请旨在提出一种安全任务处理方法，一方面，本申请提出了一种微安全架构，该微安全架构包括至少一个安全应用服务。该微安全架构可以部署在处理器搭载的安全操作系统中。
本申请提供的微安全架构可以使得安全应用服务与各处理器的安全操作系统隔离开，便于安全应用服务的升级、维护和移植。
本申请提供的微安全架构具有很强的兼容性，可以兼容支持多种不同规格的处理器的安全操作系统。开发人员只需开发微安全架构，就可实现在多种处理器的安全操作系统中同时部署安全应用服务，大大提高安全应用服务的部署效率。
另一方面，本申请还提供了一种基于微安全架构进行安全任务处理的方法。在处理安全任务时，处理器可以响应于监听到的安全任务处理请求，将所述处理器运行的操作系统切换为安全操作系统。在安全操作系统的系统环境中，运行所述微安全架构，并在所述微安全架构包含的多个安全应用服务中，确定与所述安全任务处理请求匹配的目标安全应用服务，并调用所述目标安全应用服务，以完成与所述安全任务处理请求所对应的安全任务。
第三方面，本申请还提供了微安全架构的创建方法，在安全操作系统的初始过程中，完成微安全架构的创建。
参见图1，图1是本说明书一示例性实施例示出的一种电子设备的示意图。
该电子设备包括至少一个处理器、网络接口、存储介质和总线。当然，在实际应用中，该电子设备还可包括其他硬件，比如逻辑芯片、输入/输出接口等。这里只是对电子设备的硬件进行示例性地说明，不对其进行具体地限定。
其中，处理器、网络接口、存储介质可通过总线完成相互间的通信。
上述处理器可以是ARM(Advanced RISC Machines，先进RISC处理器芯片)芯片(比如ARMv8)，也可以是Intel x86(英特尔x86)芯片等。这里只是对处理器的型号进行示例性地说明，不对该处理器型号进行具体地限定。
电子设备中的每个处理器独立运行各自的操作系统，并在其运行的操作系统下执行各自的任务。
例如，处理器运行的操作系统可包括基础操作系统和安全操作系统。处理器默认运行基础操作系统，当需要处理安全任务时，处理器才将自身运行的基础操作系统切换为安全操作系统。在安全操作系统的系统环境中执行安全任务，在安全任务执行完成后，再将自身的操作系统由安全操作系统切换为基础操作系统。
上述存储介质可以是任何电子、磁性、光学或其它物理存储装置，可以包含存储信息，如可执行指令、数据读写，等等。例如，处理器可读写存储介质可以是：易失存储器、非易失性存储器或者类似的存储介质。
需要说明的是，电子设备可包括：移动终端设备(如手机、IPAD等)、PC机、便携式计算机等。这里只是对电子设备进行示例性地说明，不对其进行具体地限定。
在介绍本申请提供的安全任务处理方法之前，先介绍下本申请提供的微安全架构。
微安全架构是本申请新提出的一种架构，是一种具有很强兼容能力的微架构，该微安全架构可以兼容支持多种不同规格的处理器的安全操作系统。
比如，该微安全架构可以兼容Inter X86处理器的安全操作系统，可以兼容ARM处理器的安全操作系统等。
该微安全架构具有调用操作系统基础功能的权限。如：中断注册，进程创建，进程注销，内存管理，文件系统管理，Timer注册等功能。这里只是对微安全架构的功能进行示例性地说明，不对该微安全架构的功能进行具体地限定。
该微安全架构可包括至少一个安全应用服务。比如，该微安全架构可包括：解锁服务、支付过程中的签名服务等等。这里只是对微安全架构的安全应用服务进行示例性地说明，不对其进行具体地限定。
微安全架构可以使得安全应用服务与各处理器的安全操作系统隔离开，便于安全应用服务的升级、维护和移植。此外，由于微安全架构可以兼容支持多种不同规格的处理器的安全操作系统，开发人员只需开发微安全架构，就可实现在多种处理器的安全操 作系统中同时部署安全应用服务，大大提高了安全应用服务的部署效率。
其中，该微安全架构可以是Super TA(高级权限安全应用管理)架构，当然，该微安全架构也可以是其他架构，这里只是对微安全架构进行示例性地说明，不对其进行具体地限定。
下面从基于微安全架构进行安全任务处理、以及微安全架构创建两方面对本申请提供的安全任务处理方法进行详细地说明。
1、基于微安全架构进行安全任务处理
参见图2，图2是本申请一示例性实施例示出的一种安全任务处理方法的流程图，该方法可应用在图1所示的电子设备中的任一处理器。该处理器搭载了安全操作系统。安全操作系统包括微安全架构。微安全架构包含至少一个安全应用服务。该安全任务处理方法可包括如下所示步骤。
步骤202：处理器响应于监听到的安全任务处理请求，将所述处理器运行的操作系统切换为安全操作系统。
其中，安全任务是指安全性要求高的任务。比如，用户通过安全应用(比如支付类的APP等)完成账单或者订单支付相关的任务。再比如，用户通过安全应用进行用户信息认证的任务等。再比如，用户打开屏幕时触发的屏幕解锁任务等。这里只是对安全任务进行示例性地说明，不对其进行具体地限定。
安全应用服务，是用于完成安全任务的程序。每种安全任务对应有安全应用服务。
比如，安全任务为屏幕解锁任务，则处理该安全任务的安全应用服务是屏幕解锁服务。该屏幕解锁服务可对用户输入的屏幕解锁密码与用户预先设置的解锁密码进行匹配。若匹配成功，则完成屏幕的解锁，若匹配失败，则显示密码错误的提示信息。
这里只是对安全任务和安全应用服务进行示例性地说明，不对其进行具体地限定。
在本说明书实施例中，当安全应用客户端(比如支付宝等)的驱动监测到用户触发安全应用客户端上的安全任务时，安全应用客户端的驱动可发起安全任务处理请求。
处理器在监听到该安全任务处理请求时，可以响应该安全任务处理请求，将该处理器运行的操作系统由基础操作系统切换为安全操作系统。
在进行操作系统切换时，处理器可以调取存储介质中的切换固件中记录的切换逻辑，将该处理器的操作系统由基础操作系统切换为安全操作系统。
例如，当该处理器为ARMv8处理器时，该电子设备的存储介质中存储有Secure monitor(安全监控器)固件。处理器可以调用Secure monitor固件中的切换逻辑，将该处理器运行的操作系统由基础操作系统切换为安全操作系统。
这里只是对操作系统切换方式进行示例性地说明，不对其进行具体地限定。
步骤204：处理器在安全操作系统的系统环境中，运行所述微安全架构，并在所述微安全架构包含的多个安全应用服务中，确定与所述安全任务处理请求匹配的目标安全应用服务。
在一种可选的实现方式中，微安全架构包含了用于处理电子设备所支持的所有安全任务的安全应用服务。
上述安全任务处理请求中携带有所请求的目标安全应用服务的服务标识。
处理器在安全操作系统的系统环境中，运行微安全架构，并在微安全架构包含的多个安全应用服务中，确定该服务标识所指示的目标安全应用服务。
在另一种可选的实现方式中，微安全架构包含了用于处理电子设备所支持的部分安全任务的安全应用服务，安全操作系统中包括了用于处理电子设备所支持的部分安全任务的安全应用服务。
在实现时，处理器可确定安全任务处理请求所请求的目标安全应用服务是否为所述微安全架构所包含的安全应用服务。
若安全任务处理请求所请求的目标安全应用服务是所述微安全架构所包含的安全应用服务，则运行所述微安全架构，并在所述微安全架构包含的多个安全应用服务中，确定与所述安全任务处理请求匹配的目标安全应用服务。
若安全任务处理请求所请求的目标安全应用服务不是所述微安全架构所包含的安全应用服务，则在安全操作系统中配置的安全应用服务中，查找与该安全任务处理请求匹配的目标安全应用服务。
下面介绍下“确定安全任务处理请求所请求的目标安全应用服务是否为所述微安全架构所包含的安全应用服务”的方法。
方法一：安全任务处理请求携带了所请求的目标安全应用服务的服务标识。
电子设备的存储介质中维护了微安全架构所包含的所有安全应用服务的服务标识名单。
处理器可调用该服务标识名单，在该服务标识名单中查找是否存在该安全任务处理请求所携带的服务标识。若该服务标识名单中存在该安全任务处理请求所携带的服务标识，则确定安全任务处理请求所请求的安全应用服务为微安全架构所包含的安全应用服务。若该服务标识名单中不存在该安全任务处理请求所携带的服务标识，则确定安全任务处理请求所请求的安全应用服务不是微安全架构所包含的安全应用服务。
例如，微安全架构所包含的安全应用服务的服务标识名单包括：安全应用服务1、安全应用服务2和安全应用服务3。
该安全任务处理请求携带了所请求的安全应用服务的服务标识为安全应用服务1。
由于安全任务处理请求携带的安全应用服务1包含在该服务标识名单中，所以处理器可确定该安全任务处理请求所请求的安全应用服务为微安全架构所包含的安全应用服务。
方式二：安全任务处理请求携带了所请求的目标安全应用服务的服务标识。该服务标识可以指示出目标安全应用服务为安全操作系统的安全应用服务还是微安全架构所包含的安全应用服务。
比如可以指定该服务标识中的某一指定位来指示目标安全应用服务所在位置。处理器可以获取该安全任务处理请求携带的目标安全应用服务的服务标识，若该服务标识的指定位的取值为第一预设值(比如1)，则确定该目标安全应用服务为微安全架构所包含的安全应用服务。若该服务标识的指定位的取值为第二预设值(比如0)，则确定目标安全应用服务为安全操作系统所包含的安全应用服务。
当然，这里只是对“确定安全任务处理请求所请求的目标安全应用服务是否为所述微安全架构所包含的安全应用服务”进行示例性地说明，不对其进行具体地限定。
在本申请实施例中，若安全任务处理请求所请求的目标安全应用服务是所述微安全架构所包含的安全应用服务，运行微安全架构，并在微安全架构包含的多个安全应用服务中，确定该服务标识所指示的目标安全应用服务。
若安全任务处理请求所请求的目标安全应用服务不是所述微安全架构所包含的安全应用服务，则在安全操作系统中配置的安全应用服务中，查找与该安全任务处理请求携带的服务标识所指示的目标安全应用服务。
步骤206：处理器调用所述目标安全应用服务，以完成与所述安全任务处理请求所对应的安全任务。
在实现，处理器可先获取安全任务处理请求所对应的安全任务。
在一种可选的获取方式中，该安全任务处理请求中携带了安全任务，处理器可以对该安全任务处理请求进行解析，获取该安全任务处理请求中携带的安全任务。
在另一种可选的获取方式中，该安全任务处理请求携带了安全任务的标识。当用户触发该安全任务后，该安全任务可以记录在缓存中。处理器可以对该安全任务处理请求进行解析，获取该安全任务处理请求携带的安全任务的标识，并基于该安全任务的标识在缓存中读取该安全任务。
这里只是对“获取安全任务处理请求所对应的安全任务”进行示例性地说明，不对其进行具体地限定。
2、微安全架构创建
在本申请实施例中，处理器可在安全操作系统的初始化阶段，基于预配置的微安全架构的配置文件，创建微安全架构。
下面以处理器为ARMv8处理器为例，对该创建过程进行说明。
参见图3，图3是本申请一示例性实施例示出的一种ARMv8架构的示意图。
先对图3中所涉及的概念进行解释。
1)EL0、EL1和EL3
EL0表示ARMv8架构的执行等级0，应用程序(即图3中的Application)在EL0等级下执行。
EL1表示ARMv8架构的执行等级1，内核操作系统在EL1等级下执行。其中内核操作系统可包括：安全操作系统(即图3中的Secure OS)，基础操作系统(如图3中的Normal OS)。
EL3表示ARMv8架构的执行等级3，Secure Monitor(安全监测器)固件在EL3等级下执行。
2)BL1、BL2和BL31
BL1是指电子设备的第一个启动阶段。
BL2是指电子设备第二个启动阶段。
BL31是指电子设备第三个启动阶段。
如图3所示，在电子设备上电后，电子设备可进入BL1阶段。电子设备的处理器可采用BL1阶段中的校验方法校验BL2阶段的固件。若BL2阶段的固件检验通过，则基于BL2阶段的固件执行BL2阶段的启动。
然后，处理器可采用BL2阶段中的校验方法校验BL31阶段中的固件的合法性，采用BL2阶段中的校验方法校验Bootloader固件的合法性，采用BL2阶段中的校验方法校验安全操作系统给的合法性。
若BL31阶段中的固件合法、以及安全操作系统合法，处理器则采用BL31阶段中的固件执行BL31阶段的启动，并在BL31阶段初始化安全操作系统。在安全操作系统初始化过程中，基于预配置的微安全架构的配置文件，创建微安全架构。
需要说明的是，本申请所述的创建微安全架构包括创建微安全架构以及该微安全架构所包含的安全应用服务。
此外，若Bootloader合法，处理器还可在BL31阶段执行Bootloader，以使得Bootloader完成基础操作系统的初始化。在基础操作系统初始化完成后，处理器可运行基础操作系统。
上述只是示例性地说明了处理器架构为ARMv8架构下的微安全架构的创建过程。当然，该处理器也可以是其他类型的处理器(比如Inter X86处理器)。在创建微安全架构时，只要微安全架构在安全操作系统初始化阶段完成即可，而各安全操作系统的初始化过程可与该处理器架构相关，这里不再赘述。
由上述描述可知，一方面，本申请提出了一种微安全架构，该微安全架构可以部署在处理器搭载的安全操作系统中，可包括至少一个安全应用服务。微安全架构可以使得安全应用服务与各处理器的安全操作系统隔离开，便于安全应用服务的升级、维护和移植。
此外，微安全架构具有很强的兼容性，可以兼容支持多种不同规格的处理器的安全操作系统。开发人员只需开发微安全架构，就可实现在多种处理器的安全操作系统中同时部署安全应用服务，大大便捷了安全应用服务的部署。
另一方面，本申请还提供了一种基于微安全架构进行安全任务处理的方法。在处理安全任务时，处理器可以响应于监听到的安全任务处理请求，将所述处理器运行的操作系统切换为安全操作系统。在安全操作系统的系统环境中，运行所述微安全架构，并在所述微安全架构包含的多个安全应用服务中，确定与所述安全任务处理请求匹配的目 标安全应用服务，并调用所述目标安全应用服务，以完成与所述安全任务处理请求所对应的安全任务。
第三方面，本申请还提供了微安全架构的创建方法，在安全操作系统的初始过程中，完成微安全架构的创建。
此外，本申请还提供了与上述安全任务处理方法对应的安全任务处理装置。
参见图4，图4是本申请一示例性实施例示出的一种安全任务处理装置的框图。所述装置应用于电子设备中的处理器，所述处理器搭载了安全操作系统；其中，所述安全操作系统包括微安全架构，所述微安全架构包含至少一个安全应用服务；所述装置包括如下所示单元。
切换单元401，用于响应于监听到的安全任务处理请求，将所述处理器运行的操作系统切换为安全操作系统；
确定单元402，用于在安全操作系统的系统环境中，运行所述微安全架构，并在所述微安全架构包含的多个安全应用服务中，确定与所述安全任务处理请求匹配的目标安全应用服务；
调用单元403，用于调用所述目标安全应用服务，以完成与所述安全任务处理请求所对应的安全任务。
可选的，所述微安全架构为兼容支持多种不同规格的处理器的安全操作系统的通用微安全架构。
可选的，所述装置还包括：
创建单元，用于在安全操作系统的初始化阶段，基于预配置的微安全架构的配置文件，创建微安全架构。
可选的，所述装置还包括：
检测单元，用于确定所述安全任务处理请求所请求的目标安全应用服务是否为所述微安全架构所包含的安全应用服务；
所述确定单元402，用于若是，则运行所述微安全架构，并在所述微安全架构包含的多个安全应用服务中，确定与所述安全任务处理请求匹配的目标安全应用服务。
可选的，所述微安全架构包括Super TA。
此外，本申请还提供了一种电子设备，该电子设备包括：处理器；
用于存储处理器可执行指令的存储器；其中，所述处理器通过运行所述可执行指令执行响应于监听到的安全任务处理请求，将所述处理器运行的操作系统切换为安全操作系统；
在安全操作系统的系统环境中，运行所述微安全架构，并在所述微安全架构包含的多个安全应用服务中，确定与所述安全任务处理请求匹配的目标安全应用服务；
调用所述目标安全应用服务，以完成与所述安全任务处理请求所对应的安全任务。
可选的，所述微安全架构为兼容支持多种不同规格的处理器的安全操作系统的通用微安全架构。
所述处理器通过运行所述可执行指令执行在安全操作系统的初始化阶段，基于预配置的微安全架构的配置文件，创建微安全架构。
可选的，所述处理器通过运行所述可执行指令，在运行所述微安全架构，并在所述微安全架构包含的多个安全应用服务中，确定与所述安全任务处理请求匹配的目标安全应用服务之前，执行确定所述安全任务处理请求所请求的目标安全应用服务是否为所述微安全架构所包含的安全应用服务；若是，则执行所述运行所述微安全架构，并在所述微安全架构包含的多个安全应用服务中，确定与所述安全任务处理请求匹配的目标安全应用服务的步骤。
可选的，所述微安全架构包括Super TA。
此外，本申请还提供一种机器可读存储介质，其上存储有计算机指令，该指令被处理器执行时实现响应于监听到的安全任务处理请求，将所述处理器运行的操作系统切换为安全操作系统；
在安全操作系统的系统环境中，运行所述微安全架构，并在所述微安全架构包含的多个安全应用服务中，确定与所述安全任务处理请求匹配的目标安全应用服务；
调用所述目标安全应用服务，以完成与所述安全任务处理请求所对应的安全任务。
可选的，所述微安全架构为兼容支持多种不同规格的处理器的安全操作系统的通用微安全架构。
可选的，该指令被处理器执行时实现在安全操作系统的初始化阶段，基于预配置的微安全架构的配置文件，创建微安全架构。
可选的，该指令被处理器执行时实现确定所述安全任务处理请求所请求的目标安全应用服务是否为所述微安全架构所包含的安全应用服务；若是，则执行运行所述微安全架构，并在所述微安全架构包含的多个安全应用服务中，确定与所述安全任务处理请求匹配的目标安全应用服务。
可选的，所述微安全架构包括Super TA。
上述实施例阐明的系统、装置、模块或单元，具体可以由计算机芯片或实体实现，或者由具有某种功能的产品来实现。一种典型的实现设备为计算机，计算机的具体形式可以是个人计算机、膝上型计算机、蜂窝电话、相机电话、智能电话、个人数字助理、媒体播放器、导航设备、电子邮件收发设备、游戏控制台、平板计算机、可穿戴设备或者这些设备中的任意几种设备的组合。
在一个典型的配置中，计算机包括一个或多个处理器(CPU)、输入/输出接口、网络接口和内存。
内存可能包括计算机可读介质中的非永久性存储器，随机存取存储器(RAM)和/或非易失性内存等形式，如只读存储器(ROM)或闪存(flash RAM)。内存是计算机可读介质的示例。
计算机可读介质包括永久性和非永久性、可移动和非可移动媒体可以由任何方法或技术来实现信息存储。信息可以是计算机可读指令、数据结构、程序的模块或其他数据。计算机的存储介质的例子包括，但不限于相变内存(PRAM)、静态随机存取存储器(SRAM)、动态随机存取存储器(DRAM)、其他类型的随机存取存储器(RAM)、只读存储器(ROM)、电可擦除可编程只读存储器(EEPROM)、快闪记忆体或其他内存技术、只读光盘只读存储器(CD-ROM)、数字多功能光盘(DVD)或其他光学存储、磁盒式磁带、磁盘存储、量子存储器、基于石墨烯的存储介质或其他磁性存储设备或任何其他非传输介质，可用于存储可以被计算设备访问的信息。按照本文中的界定，计算机可读介质不包括暂存电脑可读媒体(transitory media)，如调制的数据信号和载波。
还需要说明的是，术语“包括”、“包含”或者其任何其他变体意在涵盖非排他性的包含，从而使得包括一系列要素的过程、方法、商品或者设备不仅包括那些要素，而且还包括没有明确列出的其他要素，或者是还包括为这种过程、方法、商品或者设备所固有的要素。在没有更多限制的情况下，由语句“包括一个……”限定的要素，并不 排除在包括所述要素的过程、方法、商品或者设备中还存在另外的相同要素。
上述对本说明书特定实施例进行了描述。其它实施例在所附权利要求书的范围内。在一些情况下，在权利要求书中记载的动作或步骤可以按照不同于实施例中的顺序来执行并且仍然可以实现期望的结果。另外，在附图中描绘的过程不一定要求示出的特定顺序或者连续顺序才能实现期望的结果。在某些实施方式中，多任务处理和并行处理也是可以的或者可能是有利的。
在本说明书一个或多个实施例使用的术语是仅仅出于描述特定实施例的目的，而非旨在限制本说明书一个或多个实施例。在本说明书一个或多个实施例和所附权利要求书中所使用的单数形式的“一种”、“所述”和“该”也旨在包括多数形式，除非上下文清楚地表示其他含义。还应当理解，本文中使用的术语“和/或”是指并包含一个或多个相关联的列出项目的任何或所有可能组合。
应当理解，尽管在本说明书一个或多个实施例可能采用术语第一、第二、第三等来描述各种信息，但这些信息不应限于这些术语。这些术语仅用来将同一类型的信息彼此区分开。例如，在不脱离本说明书一个或多个实施例范围的情况下，第一信息也可以被称为第二信息，类似地，第二信息也可以被称为第一信息。取决于语境，如在此所使用的词语“如果”可以被解释成为“在……时”或“当……时”或“响应于确定”。
以上所述仅为本说明书一个或多个实施例的较佳实施例而已，并不用以限制本说明书一个或多个实施例，凡在本说明书一个或多个实施例的精神和原则之内，所做的任何修改、等同替换、改进等，均应包含在本说明书一个或多个实施例保护的范围之内。

Claims (12)

  1. 一种安全任务的处理方法，所述方法应用于电子设备中的处理器，所述处理器搭载了安全操作系统；其中，所述安全操作系统包括微安全架构，所述微安全架构包含至少一个安全应用服务；所述方法包括：
    响应于监听到的安全任务处理请求，将所述处理器运行的操作系统切换为安全操作系统；
    在安全操作系统的系统环境中，运行所述微安全架构，并在所述微安全架构包含的多个安全应用服务中，确定与所述安全任务处理请求匹配的目标安全应用服务；
    调用所述目标安全应用服务，以完成与所述安全任务处理请求所对应的安全任务。
  2. 根据权利要求1所述的方法，所述微安全架构为兼容支持多种不同规格的处理器的安全操作系统的通用微安全架构。
  3. 根据权利要求1所述的方法，所述方法还包括：
    在安全操作系统的初始化阶段，基于预配置的微安全架构的配置文件，创建微安全架构。
  4. 根据权利要求1所述的方法，在所述运行所述微安全架构，并在所述微安全架构包含的多个安全应用服务中，确定与所述安全任务处理请求匹配的目标安全应用服务之前，所述方法还包括：
    确定所述安全任务处理请求所请求的目标安全应用服务是否为所述微安全架构所包含的安全应用服务；
    若是，则执行所述运行所述微安全架构，并在所述微安全架构包含的多个安全应用服务中，确定与所述安全任务处理请求匹配的目标安全应用服务的步骤。
  5. 根据权利要求1-4中任一所述的方法，所述微安全架构包括Super TA。
  6. 一种安全任务的处理装置，所述装置应用于电子设备中的处理器，所述处理器搭载了安全操作系统；其中，所述安全操作系统包括微安全架构，所述微安全架构包含至少一个安全应用服务；所述装置包括：
    切换单元，用于响应于监听到的安全任务处理请求，将所述处理器运行的操作系统切换为安全操作系统；
    确定单元，用于在安全操作系统的系统环境中，运行所述微安全架构，并在所述微安全架构包含的多个安全应用服务中，确定与所述安全任务处理请求匹配的目标安全应用服务；
    调用单元，用于调用所述目标安全应用服务，以完成与所述安全任务处理请求所对 应的安全任务。
  7. 根据权利要求6所述的装置，所述微安全架构为兼容支持多种不同规格的处理器的安全操作系统的通用微安全架构。
  8. 根据权利要求6所述的装置，所述装置还包括：
    创建单元，用于在安全操作系统的初始化阶段，基于预配置的微安全架构的配置文件，创建微安全架构。
  9. 根据权利要求6所述的装置，所述装置还包括：
    检测单元，用于确定所述安全任务处理请求所请求的目标安全应用服务是否为所述微安全架构所包含的安全应用服务；
    所述确定单元，用于若是，则运行所述微安全架构，并在所述微安全架构包含的多个安全应用服务中，确定与所述安全任务处理请求匹配的目标安全应用服务。
  10. 根据权利要求6至9中任一所述的装置，所述微安全架构包括Super TA。
  11. 一种电子设备，包括：
    处理器；
    用于存储处理器可执行指令的存储器；
    其中，所述处理器通过运行所述可执行指令以实现如权利要求1-5中任一项所述的方法。
  12. 一种机器可读存储介质，其上存储有计算机指令，该指令被处理器执行时实现如权利要求1-5中任一项所述方法的步骤。
PCT/CN2020/113477 2019-12-03 2020-09-04 安全任务处理方法、装置、电子设备及存储介质 WO2021109655A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201911220041.0 2019-12-03
CN201911220041.0A CN111125711B (zh) 2019-12-03 2019-12-03 安全任务处理方法、装置、电子设备及存储介质

Publications (1)

Publication Number Publication Date
WO2021109655A1 true WO2021109655A1 (zh) 2021-06-10

Family

ID=70497200

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2020/113477 WO2021109655A1 (zh) 2019-12-03 2020-09-04 安全任务处理方法、装置、电子设备及存储介质

Country Status (3)

Country Link
CN (1) CN111125711B (zh)
TW (1) TWI716320B (zh)
WO (1) WO2021109655A1 (zh)

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111125711B (zh) * 2019-12-03 2021-05-07 支付宝(杭州)信息技术有限公司 安全任务处理方法、装置、电子设备及存储介质

Citations (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20070118558A1 (en) * 2005-11-21 2007-05-24 Research In Motion Limited System and method for application program operation on a wireless device
US20140298026A1 (en) * 2013-03-26 2014-10-02 Kabushiki Kaisha Toshiba Information processing device and computer program product
CN104143065A (zh) * 2014-08-28 2014-11-12 北京握奇智能科技有限公司 安全智能终端设备、及信息处理方法
CN104216761A (zh) * 2013-06-04 2014-12-17 中国银联股份有限公司 一种在能够运行两种操作系统的装置中使用共享设备的方法
CN104252388A (zh) * 2013-06-27 2014-12-31 中国银联股份有限公司 移动设备中的非可信环境与可信环境之间的切换
CN109886662A (zh) * 2019-02-18 2019-06-14 北京正合链通科技有限公司 区块链钱包应用方法及系统、终端和计算机可读存储介质
CN111125711A (zh) * 2019-12-03 2020-05-08 支付宝(杭州)信息技术有限公司 安全任务处理方法、装置、电子设备及存储介质

Family Cites Families (10)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101226577A (zh) * 2008-01-28 2008-07-23 南京大学 基于可信硬件与虚拟机的微内核操作系统完整性保护方法
US8806620B2 (en) * 2009-12-26 2014-08-12 Intel Corporation Method and device for managing security events
CN103714459A (zh) * 2013-12-26 2014-04-09 电子科技大学 一种智能终端安全支付系统及方法
CN104102876A (zh) * 2014-07-17 2014-10-15 北京握奇智能科技有限公司 保障客户端运行安全的装置
EP3210153A4 (en) * 2014-10-25 2018-05-30 McAfee, Inc. Computing platform security methods and apparatus
GB2539436B (en) * 2015-06-16 2019-02-06 Advanced Risc Mach Ltd Secure initialisation
US10320786B2 (en) * 2015-09-14 2019-06-11 Samsung Electronics Co., Ltd. Electronic apparatus and method for controlling the same
CN105405186B (zh) * 2015-10-30 2017-08-11 罗周 一种安防管理方法及装置
CN106330575A (zh) * 2016-11-08 2017-01-11 上海有云信息技术有限公司 一种安全服务平台及安全服务部署方法
CN107392055A (zh) * 2017-07-20 2017-11-24 深圳市金立通信设备有限公司 一种双系统安全芯片控制方法、终端、计算机可读存储介质及基于安全芯片的双系统架构

Patent Citations (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20070118558A1 (en) * 2005-11-21 2007-05-24 Research In Motion Limited System and method for application program operation on a wireless device
US20140298026A1 (en) * 2013-03-26 2014-10-02 Kabushiki Kaisha Toshiba Information processing device and computer program product
CN104216761A (zh) * 2013-06-04 2014-12-17 中国银联股份有限公司 一种在能够运行两种操作系统的装置中使用共享设备的方法
CN104252388A (zh) * 2013-06-27 2014-12-31 中国银联股份有限公司 移动设备中的非可信环境与可信环境之间的切换
CN104143065A (zh) * 2014-08-28 2014-11-12 北京握奇智能科技有限公司 安全智能终端设备、及信息处理方法
CN109886662A (zh) * 2019-02-18 2019-06-14 北京正合链通科技有限公司 区块链钱包应用方法及系统、终端和计算机可读存储介质
CN111125711A (zh) * 2019-12-03 2020-05-08 支付宝(杭州)信息技术有限公司 安全任务处理方法、装置、电子设备及存储介质

Also Published As

Publication number Publication date
TW202123663A (zh) 2021-06-16
CN111125711B (zh) 2021-05-07
TWI716320B (zh) 2021-01-11
CN111125711A (zh) 2020-05-08

Similar Documents

Publication Publication Date Title
US11003780B2 (en) Method and apparatus for validating BIOS firmware using a baseboard management controller
US11385903B2 (en) Firmware update patch
CN105308612B (zh) 用于安全代码启动的动态加载测量环境
US10417427B2 (en) Method for authenticating firmware volume and system therefor
US20200250300A1 (en) Systems and methods of protecting data from injected malware
JP6319609B2 (ja) 信頼できるカーネル起動方法および装置
US9992024B2 (en) Establishing a chain of trust within a virtual machine
US9507604B2 (en) Boot method and boot system
US10146657B2 (en) Initialization trace of a computing device
US9325506B2 (en) Cryptographically enforcing strict separation of environments
EP3120238B1 (en) Access isolation for multi-operating system devices
US20090064274A1 (en) Dual non-volatile memories for a trusted hypervisor
US9697035B2 (en) Selecting a virtual basic input output system based on information about a software stack
US9734311B1 (en) Secure authentication of firmware configuration updates
US11379588B2 (en) System validation by hardware root of trust (HRoT) device and system management mode (SMM)
US20210344719A1 (en) Secure invocation of network security entities
US20170300692A1 (en) Hardware Hardened Advanced Threat Protection
WO2021109655A1 (zh) 安全任务处理方法、装置、电子设备及存储介质
US10366016B2 (en) Access to persistent memory regions of computing devices
CN112784276B (zh) 可信度量的实现方法及装置
US12136092B1 (en) Secure management of execution of an application
US11989304B2 (en) Secure multi-BIOS-image system
US11960372B2 (en) Verified callback chain for bios security in an information handling system
US11809550B2 (en) Electronic device and control method therefor

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 20895985

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 20895985

Country of ref document: EP

Kind code of ref document: A1