CN104392188B - A kind of secure data store method and system - Google Patents

Abstract

The present invention proposes a secure data storage method and system, suitable for processors supporting ARM TrustZone technology, and using eMMC supporting RPMB partitions as a storage medium, wherein the method includes: a trusted application program, a secure storage service program and its generated The secure data object is protected by the trusted execution environment; the secure storage service program provides the trusted application with the establishment and access of the secure data object, and calls the encryption and decryption module to encrypt and decrypt the secure data object; the encrypted secure data object passes through The shared memory page is shared with the eMMC RPMB driver in the non-trusted execution environment; the eMMC RPMB driver in the non-trusted execution environment completes the access and storage of the eMMC RPMB partition. The invention can ensure reliable storage of safe data objects.

Description

A secure data storage method and system

technical field

The present invention relates to the technical field of data storage, in particular to a safe data storage method and system.

Background technique

Embedded devices, including mobile phones, TVs, tablet computers, etc., have a need for secure storage of sensitive data, such as saving user account information, authorized keys, and various multimedia copyright information on non-volatile storage media and licenses etc.

The existing secure data storage methods generally perform encryption processing in a non-trusted execution environment, such as a common operating system. Encryption and decryption programs and calculation processes, as well as plaintext data and encryption and decryption keys, are all in an untrusted environment; data storage methods generally use the file system interface provided by the operating system to save encrypted data objects to non-volatile storage media, such as an embedded multimedia card (eMMC, embedded Multi Media Card) or a flash memory (Flash).

Figure 1 is a brief block diagram of an existing secure data storage system, which mainly includes four functional entities: application program, encryption and decryption module, common operating system, and Flash storage medium. The usual process is: the application program calls the encryption and decryption module to encrypt the secure data object, calls the common operating system file system interface, and stores the encrypted data object on the eMMC partition; when the application program needs to access the data object, call the operation The system file system interface reads the data object from the eMMC partition and calls the encryption and decryption module for decryption. On the non-volatile storage medium, data objects are stored in an encrypted form, thus ensuring basic data security.

The storage method for security data in the prior art is generally to save it on a non-volatile storage medium, such as eMMC or Flash, through a common file system interface. However, the data content stored in the Flash partition may be tampered with by hackers, or even forcibly erased by physical block. As an improvement, the eMMC specification provides an authorized write protection mechanism for the Replay Protect Memory Block (RPMB, Replay Protect Memory Block) partition, using a preset key to hash the data object in the RPMB packet format to obtain its message authentication code (MAC ), the eMMC card is recalculated and compared to resist illegal writing. However, the RPMB driver needs to obtain the preset key first and store it in a normal memory page, so there is also a risk of being intercepted. Once the preset key is leaked, it can be cheated by regenerating the MAC with the replacement data. Checking of the MAC through a read operation.

In the prior art, the process of encrypting and decrypting security data is generally carried out in an untrusted common operating system environment. The calculation process may be intercepted by hackers. The Key used for encryption and decryption, or the plaintext data used for calculation, May be read and replaced. An improved method in the prior art is that, for devices supporting the ARM Trust Zone (TrustZone) of ARM, the key and the encryption and decryption process can be placed in a trusted execution environment, and then the encrypted data can be passed through the shared memory Returned to a non-trusted execution environment. This calculation process can use the TEE API standardized by the Global Platform organization to realize communication and trusted interaction process, but the subsequent storage of encrypted data still needs to be completed through the file system interface of the common operating system, so there is still a replacement Or bypass the risk.

Contents of the invention

The invention provides a safe data storage method, which can ensure reliable storage of safe data objects.

The invention also provides a safe data storage system, which can ensure reliable storage of safe data objects.

Technical scheme of the present invention is realized like this:

A safe data storage method, applicable to processors supporting ARM TrustZone technology, and using eMMC supporting RPMB partitions as a storage medium, said method comprising:

Trusted applications, secure storage service programs and their generated secure data objects are protected by the trusted execution environment;

The secure storage service program provides trusted applications with the establishment and access of secure data objects, and calls the encryption and decryption module to encrypt and decrypt secure data objects;

The encrypted secure data object is shared with the eMMC RPMB driver in the non-trusted execution environment through the shared memory page;

The eMMC RPMB driver in the non-trusted execution environment completes the access and storage of the eMMC RPMB partition.

A kind of safe data storage system, runs on the processor that supports ARM Trust Zone (TrustZone) technology, and uses the embedded multimedia card (eMMC) of Playback Protection Memory Block (RPMB) partition as storage medium, and described system includes trustworthy Application program, encryption and decryption module, secure storage service program, communication module, non-trusted operating system and eMMCRPMB driver;

The trusted application program runs in the trusted execution environment, and the user program authenticated by the secure environment accesses the secure data object;

The encryption and decryption module runs in a trusted execution environment, and uses a driving hardware engine or a software algorithm to realize the encryption and decryption functions;

The secure storage service program runs in a trusted execution environment, and provides trusted applications with functions of creating, reading, modifying, deleting or storing secure data objects;

The eMMC RPMB driver runs in a non-trusted execution environment to complete reading and writing of the eMMC RPMB partition.

It can be seen that the secure data storage method and system proposed by the present invention control the generation and access of plaintext secure data objects through the ARM TrustZone trusted execution environment to prevent reading or tampering by untrusted programs; the encryption and decryption process and its use The key is isolated in the trusted execution environment and cannot be obtained by the untrusted execution environment; the encrypted security data object is passed to the eMMC RPMB driver in the untrusted execution environment through shared memory, and the eMMC RPMB driver completes the verification The access and storage of the eMMC RPMB partition ensures the security of data objects.

Description of drawings

Fig. 1 is a block diagram of an existing secure data storage system and method;

Fig. 2 is a block diagram of a secure data storage system according to an embodiment of the present invention;

FIG. 3 is a flow chart of secure data object storage in Embodiment 2 of the present invention;

FIG. 4 is a flow chart of reading a secure data object in Embodiment 2 of the present invention.

detailed description

The embodiment of the present invention discloses a secure data storage method and system based on ARM TrustZone, which is suitable for embedded devices with ARM TrustZone processors and eMMCs containing RPMB partitions as storage media, including but not limited to smartphones, tablet computers, Smart TV, digital set-top box, network video player, etc. The system includes a trusted execution environment and a non-trusted execution environment.

Wherein, the trusted execution environment includes a communication module, a trusted application program, a secure storage service program and an encryption and decryption module. The trusted execution environment shares processor time with the untrusted execution environment, and its operating instructions and data are placed in a secure memory space, which is isolated and protected by TrustZone IP to avoid malicious attacks by untrusted execution environment programs.

Wherein, the non-trusted execution environment includes a non-trusted operating system, a non-trusted application program, and an eMMCRPMB driver. Untrusted execution environments are vulnerable to various attacks, including illegal operations performed by privileged users with root privileges, such as modifying instructions and reading user program memory pages.

Preferably, the communication module runs in the privileged mode of the trusted execution environment, accepts requests and message transfers from the untrusted execution environment, and completes context switching between the untrusted execution environment and the trusted execution environment, and simultaneously passes Mapping of shared memory pages supports data sharing between untrusted execution environments and trusted execution environments.

Furthermore, the communication module can also complete the interrupt forwarding between the untrusted execution environment and the trusted execution environment, so as to avoid the impact of interrupt response delay on the respective operating environments.

Preferably, the trusted application program, including executable ELF files and digital signature information, can be sent from the non-trusted execution environment to the trusted execution environment through the shared memory, and the trusted execution environment performs signature check on it, verifies After passing, load and execute.

Preferably, the secure storage service program runs in a user mode or a privileged mode in a trusted execution environment.

Preferably, when the secure storage service program receives a request for creating a data object from a trusted application, the specific working steps include:

1) Create a plaintext security data object and save it in a trusted execution environment.

2) Call the encryption and decryption module to encrypt the secure data object using symmetric encryption.

3) Use the software interrupt method to notify the eMMC RPMB driver in the non-trusted execution environment, and read the block address and write count value of the currently available eMMC RPMB partition.

4) According to the RPMB packet format, fill the data content, random value and write count value, and use the preset key to calculate the message authentication code (MAC) through HMAC SHA256.

5) Fill the RPMB packet containing the encrypted security data object and MAC value into the shared memory, and use the software interrupt mode to notify the eMMC RPMB driver in the non-trusted execution environment.

Preferably, when the secure storage service program receives a request to modify a data object from a trusted application, the specific working steps include:

1) Find the plaintext security data object in the trusted execution environment and modify it.

2) Call the encryption and decryption module, and use the symmetric encryption method to encrypt the modified security data object.

3) Use the software interrupt method to notify the eMMC RPMB driver in the non-trusted execution environment, and read the block address and write count value of the currently available eMMC RPMB partition.

4) According to the RPMB packet format, fill the data content, random value and write count value, and use the preset key to calculate the message authentication code (MAC) through HMAC SHA256.

5) Fill the RPMB packet containing the encrypted security data object and MAC value into the shared memory, and use the software interrupt mode to notify the eMMC RPMB driver in the non-trusted execution environment.

Preferably, when the secure storage service program receives a request to delete a data object from a trusted application, the specific working steps include:

1) Find the plaintext security data object in the trusted execution environment, and find its block address in the eMMCRPMB partition according to its mark.

2) Use software interrupt mode to notify the eMMC RPMB driver in the non-trusted execution environment, and read the write count value of the eMMC RPMB partition.

3) According to the RPMB data packet format, fill in the empty data content, random value and write count value, and use the preset key to calculate the message authentication code through hash operation message authentication code (Hash-based Message Authentication Code, HMAC) SHA256 (MAC).

4) Fill the RPMB packet containing empty data and MAC value into the shared memory, and use the software interrupt mode to notify the eMMC RPMB driver in the non-trusted execution environment.

5) Delete the plaintext security data object in the trusted execution environment.

Preferably, when the secure storage service program receives a request for reading a data object from a trusted application, the specific working steps include:

1) Search for the plaintext security data object in the trusted execution environment, and if found, directly return the content of the data object.

2) If the content of the data object is empty, use the software interrupt method to notify the eMMC RPMB driver in the non-trusted execution environment to read the encrypted security data object in the eMMC RPMB partition block and the message authentication returned by the eMMC RPMB partition Code MAC, and fill in the shared memory.

3) According to the RPMB packet format, use the preset key, recalculate the message authentication code MAC through HMAC SHA256, and compare it with the MAC in the shared memory. If they are inconsistent, discard the data and return the error result to the trusted application.

4) If consistent, call the encryption and decryption module to symmetrically decrypt the secure data object in the shared memory.

5) The decrypted secure data object is added to the list of data objects in the trusted execution environment, and the content of the data object is returned to the trusted application.

Preferably, the safe storage service program can also notify the eMMC RPMB driver program in the non-trusted execution environment by software interrupt mode when the system starts, and read in the safety data object on the RPMB sub-block once, and After checking the MAC value of the message authentication code in the trusted execution environment, decrypt them one by one and add them to the data object list.

Preferably, in the above steps, searching for the plaintext security data object in the trusted execution environment may be carried out from cache or data memory page.

Preferably, the software interrupt mode in the above steps can be implemented by programming the general interrupt controller GIC. On a single-core or multi-core platform, the interrupt forwarding function of the communication module can be used to complete the operation system of the non-trusted execution environment. fast response to the interrupt.

Preferably, the encryption and decryption module can realize the encryption and decryption function by driving the encryption and decryption hardware engine, or using software algorithms. The encryption and decryption module runs in a trusted execution environment, and the keys, data caches, and memory pages used by it are all isolated and protected by the trusted execution environment, and cannot be accessed by non-trusted execution environments.

Preferably, before the embedded device leaves the factory, it needs to perform SHA 256 key programming injection into the eMMC RPMB; the key injection programming is valid for a single time, and cannot be modified later.

Preferably, the eMMC RPMB driver runs in a non-trusted execution environment, and its working steps include:

1) When a trusted execution environment software interrupt is received, check its request type.

2) When the security data object needs to be written, the RPMB data packet containing the encrypted security data object and the MAC value is read from the shared memory page, and written into the eMMC RPMB partition block address.

3) When the security data object needs to be read, the RPMB packet containing the encrypted security data object and the MAC value is read from the address of the eMMC PRMB partition, and written into the shared memory.

Wherein, the eMMC RPMB driver itself does not manage the key, nor can it obtain the injected key from the eMMC RPMB partition, nor can it obtain the same preset key from the trusted execution environment; therefore, the eMMC The RPMB driver cannot use the replacement data to generate a forged MAC value, which can avoid cheating the eMMC or trusted execution environment by man-in-the-middle attacks, and ensure the non-volatile safe storage of data objects.

Preferably, the non-trusted operating system and non-trusted application program run in a non-trusted execution environment, are subjected to the isolation effect of TrustZone IP, and cannot access execution instructions, data content or memory pages in any trusted execution environment , so it is impossible to access or modify the content of the plaintext security data object or any key information; and all the content of the security data object in the shared memory is encrypted and will not be exposed to malicious applications in untrusted execution environments The program ensures the safe isolation of data objects during operation.

The following will clearly and completely describe the technical solutions in the embodiments of the present invention with reference to the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only some, not all, embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by persons of ordinary skill in the art without creative efforts fall within the protection scope of the present invention.

Embodiment one:

This embodiment provides an ARM TrustZone-based secure data storage system. The system uses a processor that supports ARM TrustZone, and uses eMMC that supports RPMB as a memory, and is applicable to various consumer electronics embedded platforms such as mobile phones, tablet computers, and digital TVs. Referring to shown in Figure 2, the system software execution environment is isolated into a non-trusted execution environment and a trusted execution environment by ARMTrustZone technology; wherein, the non-trusted execution environment includes a non-trusted operating system (i.e. a common operating system) and eMMC RPMB driver; the trusted execution environment includes a communication module, a trusted application program, a secure storage service program and an encryption and decryption module, specifically including:

The common operating system in this embodiment is responsible for providing necessary system interface support to various application programs, and its kernel can handle various external device interrupts and software interrupts, and call registered drivers according to interrupt types. This embodiment is Linux, and may also be Android or other general-purpose operating systems.

The eMMC RPMB driver in the present embodiment runs in common operating system kernel space, and its function mainly includes:

1) Register the shared memory with the communication module in the trusted execution environment.

2) Register the software interrupt handler with the common operating system kernel in the non-trusted execution environment.

3) In the software interrupt handler, read or write processing is performed according to the requirements of the trusted execution environment.

4) Read the currently effective write count value from the eMMC RPMB partition, and notify the secure storage service program in the trusted execution environment.

5) Access the shared memory, read or write the RPMB packet data containing encrypted data objects and MAC values.

6) Complete the read and write operations of eMMC RPMB partition data, execute the RPMB command and response process defined in the eMMC specification, and complete various error handling, etc.

The trusted application program in this embodiment is a security-certified application program running in a trusted execution environment, including but not limited to digital rights management DRM services, user authorization certificate management and other functions. During operation, the trusted application uses the function of the secure storage service program to create, modify, delete and save various secure data objects used internally.

The secure storage service program in this embodiment runs in a trusted execution environment and provides a service interface to trusted applications. Its functions mainly include:

1) Manage the list of data objects and provide functions such as searching, inserting, and deleting specified data objects.

2) Accept the creation request of the trusted application program for the secure data object, and add it to the data object list.

3) Accept the modification request of the trusted application program for the secure data object, and update the data object list.

4) Accept the data deletion request of the trusted application program for the secure data object, and clear it from the data object list.

5) Call the encryption and decryption module to encrypt the data objects to be stored in the data object list.

6) According to the write count value read in from the eMMC RPMB, construct the RPMB data packet, and calculate the message authentication code MAC.

7) Fill the RPMB packet containing the encrypted security data object and the MAC value into the shared memory, and notify the non-trusted execution environment eMMC RPMB driver to store it by means of software interruption.

8) Read the encrypted data object and MAC in the eMMC RPMB partition from the shared memory, and recalculate and check whether the MAC is valid according to the RPMB packet format.

9) Decrypt the encrypted security data object and add it to the data object list.

The encryption and decryption module in this embodiment is the hardware encryption and decryption engine of the system on chip and its driver, which supports symmetric encryption and decryption functions such as AES ECB/CTR/CBC, and supports HMAC_SHA256 to calculate the message authentication code. The actual system can also be a software algorithm module.

The communication module in this implementation, its operating environment is a trusted privileged mode, and its functions mainly include:

1) Receive requests from non-trusted execution environments, and parse various command parameters passed by general-purpose registers.

2) Remapping the non-trusted execution environment shared memory page to the trusted execution environment to share data.

3) Forward various hardware or software interrupts in the trusted execution environment and non-trusted execution environment, and switch to the execution environment corresponding to the interrupt for interrupt processing.

Embodiment two

This embodiment provides a method for secure data storage based on ARM TrustZone.

Fig. 3 is the flowchart of creation and storage of security data objects in this example, and the steps include:

Step 301: In the trusted execution environment, the trusted application sends a request for creating, modifying, deleting, etc. a secure data object.

Step 302: The secure storage service program performs response processing according to the request type of the trusted application program, specifically including:

For the creation request, find the security data object, if it does not exist, then create a new security data object, otherwise return failure;

For the modification request, find the security data object, if it exists, then modify the corresponding security data object, otherwise return failure;

For the delete request, find the security data object, if it exists, delete the corresponding security data object, otherwise return failure;

Update the list of data objects and return the result to the trusted application.

Step 303: Periodically, the secure storage service program uses the AES key to symmetrically encrypt the changed secure data object, and can select different block modes such as CBC/CTR/ECB as required, and sends a software interrupt to the non-secure data object after completion. Letter execution environment eMMC RPMB driver.

Step 304: The software interrupt is forwarded by the communication module to the untrusted operating system kernel in the untrusted execution environment, thereby calling the eMMC RPMB driver, reading the RPMB write count value, and filling it into the shared memory.

Step 305: The secure storage service program calculates a message authentication code (MAC) through HMAC SHA256 for the encrypted secure data object, random value, and write count value according to the RPMB packet format, and uses a preset key.

Step 306: The secure storage service program fills the complete data packet into the shared memory according to the RPMB data packet format, and sends a software interrupt to the eMMC RPMB driver in the non-trusted execution environment.

Step 307: The eMMC RPMB driver reads the RPMB data packet from the shared memory, which contains the encrypted security data object and MAC value, and then writes it into the RPMB partition.

Fig. 4 is the flow chart that reads security data object, described step comprises:

Step 401: In the trusted execution environment, the trusted application sends a read request of the secure data object.

Step 402: The secure storage service program searches for the secure data object, and returns the secure data object directly if it exists.

Step 403: If it does not exist, then the secure storage service program sends a software interrupt to the eMMC RPMB driver in the non-trusted execution environment.

Step 404: The eMMC RPMB driver program reads the data packet from the eMMC RPMB partition, which contains the encrypted data object content and the message authentication code MAC, and fills it into the shared memory.

Step 405: The secure storage service program uses the preset key to recalculate the message authentication code MAC for the encrypted data object content, and checks whether it matches. If not, it means that the data is abnormal, and returns the error result to the trusted application.

Step 406: After the MAC check and matching pass, the secure storage service program needs to parse the RPMB data packet, decrypt the encrypted data object in it using the AES key, and update to the data object list.

Step 407: The secure storage service program returns the decrypted plaintext secure data object to the trusted application program.

For the RPMB packet format and the specific process of calculating the message authentication code, please refer to the description of eMMC RPMB in the eMMC specification.

Compared with the prior art, the beneficial effect of the present invention is: by using the ARM TrustZone technology to separate the trusted and non-trusted execution environments, the encryption and decryption calculation process of the secure data object is isolated in the trusted execution environment, and the encryption and decryption The key and plaintext data content used by the process are protected in trusted memory pages, avoiding the risk of being illegally stolen by an untrusted execution environment during runtime. At the same time, when the secure data object needs to be stored, the secure storage service program uses the preset key in the trusted execution environment to calculate and provide the eMMC RPMB message authentication code MAC to ensure the legal writing of the eMMC RPMB partition; When a data object is detected, the secure storage service program recalculates and compares the message authentication code MAC of the eMMC RPMB to prevent the data from being illegally replaced.

The above descriptions are only preferred embodiments of the present invention, and are not intended to limit the protection scope of the present invention. In this paper, specific examples have been used to describe the principle and implementation of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core idea; meanwhile, for those of ordinary skill in the art, according to the present invention The idea of the invention will have changes in the specific implementation and scope of application. In summary, the contents of this specification should not be construed as limiting the present invention. Any modification, equivalent replacement, improvement, etc. made within the spirit and principles of the present invention are included in the protection scope of the present invention.

Claims (27)

1. a kind of secure data store method, it is characterised in that the place suitable for supporting ARM trust region TrustZone technologies Device is managed, and uses the embedded multi-media card eMMC for supporting replay protection memory block RPMB subregions as storage medium, the side Method includes：

The secured data objects of trusted application program, safe storage service program and its generation are protected by trusted execution environments Shield；

Safe storage service program provides the foundation and access of secured data objects to trusted application program, and calls encryption and decryption Module secured data objects is encrypted and decrypted processing；

Secured data objects after encryption appoint the eMMC RPMB in performing environment to drive journey by the shared drive page and untrusted Sequence is shared；

Untrusted appoints the eMMC RPMB drivers in performing environment to complete access and storage to eMMC RPMB subregions.

2. according to the method described in claim 1, it is characterised in that the trusted application program and safe storage service program Operationally protected by trusted execution environments, its execute instruction can not be appointed the untrusted in performing environment to appoint application by untrusted Program reads or changed.

3. according to the method described in claim 1, it is characterised in that the secured data objects are operationally performed by trusted Environmental protection is in the memory pages of security isolation, and its clear data content can not be appointed the untrusted in performing environment by untrusted Application program is appointed to read or change.

4. according to the method described in claim 1, it is characterised in that the safe storage service program is to trusted application program The mode of foundation and access for providing secured data objects is：

Trusted application program calls the interface of safe storage service program, the safe number of dynamic creation in trusted execution environments According to object, modification or deleting history secured data objects.

5. according to the method described in claim 1, it is characterised in that the safe storage service routine call encryption/decryption module pair The mode that secured data objects are encrypted is：

Safe storage service program to secure data content carry out object encapsulation, using by trusted execution environments protect it is close Key, and call encryption/decryption module to be encrypted.

6. method according to claim 5, it is characterised in that the mode of the encryption is symmetric cryptography mode.

7. method according to claim 6, it is characterised in that the key that the symmetric cryptography is used should for the trusted It is privately owned close that the key or equipment used with the unsolicited key of program, the safe storage service program inside solidifies Key.

8. according to the method described in claim 1, it is characterised in that the safe storage service program passes through software interrupt mode Untrusted is notified to appoint the eMMC RPMB drivers in performing environment to read and currently write count value.

9. according to the method described in claim 1, it is characterised in that the safe storage service program is right the safety after encryption Image data and count value is write according to RPMB packets fields forms, using preset key, and pass through Hash operation message authentication code HMAC SHA256 algorithms calculate its message authentication code MAC, and construct complete RPMB packets.

10. method according to claim 9, it is characterised in that the preset key is stored in trusted execution environments Safe storage service program inside, it is impossible to by untrusted appoint performing environment obtain.

11. method according to claim 9, it is characterised in that the safe storage service program is complete RPMB numbers Shared drive is inserted according to bag, and notifies untrusted to appoint the untrusted in performing environment to appoint operating system by software interrupt.

12. method according to claim 11, it is characterised in that the untrusted appoints the untrusted in performing environment to appoint behaviour Make after systems inspection software interrupt, call eMMC RPMB drivers, and copy the RPMB packets in shared drive, will RPMB packets write eMMC RPMB subregions.

13. method according to claim 12, it is characterised in that the eMMC RPMB drivers do not allow to know use To produce MAC preset key.

14. method according to claim 13, it is characterised in that eMMC equipment needs to complete preset key when dispatching from the factory Injection, it is described to be injected to single effectively, it can not subsequently rewrite.

15. method according to claim 4, it is characterised in that trusted application program is carried in trusted execution environments For secured data objects mark, the interface of safe storage service program is called, the secured data objects produced are accessed.

16. method according to claim 15, it is characterised in that the safe storage service program is according to secure data pair As the local data object list caching in mark retrieval trusted execution environments, and subsequent treatment is carried out according to result.

17. method according to claim 16, it is characterised in that safe storage service program is in local data object list The corresponding secured data objects of secured data objects mark are retrieved in caching, and the secured data objects are not invalid numbers According to when, return to the data content required for trusted application program.

18. method according to claim 16, it is characterised in that safe storage service program is retrieved not in local cache Corresponding secured data objects are marked to the secured data objects；Or can retrieve corresponding to secured data objects mark Secured data objects, but its state is when being invalid data, notifies untrusted is appointed non-in performing environment by traps mode Trusted operating system.

19. method according to claim 18, it is characterised in that the untrusted appoints the untrusted in performing environment to appoint behaviour Received as system after traps, call eMMC RPMB drivers, from eMMCRPMB subregions read encryption after data object with And the MAC value that eMMC RPMB subregions are returned, insert shared drive.

20. method according to claim 16, it is characterised in that safe storage service program is read from shared drive to be added Close data object, and call encryption/decryption module that processing is decrypted, the plaintext secure data object after decryption is stored in credible Appoint the memory pages in performing environment.

21. method according to claim 16, it is characterised in that safe storage service program returns to trusted application journey The plaintext secure data object that sequence needs, and trusted application program is necessary to ensure that the plaintext secure data object content will not Being exposed to untrusted appoints the untrusted in performing environment to appoint operating system or untrusted to appoint application program.

22. a kind of secure data storage system, it is characterised in that the system operation is supporting ARM trust regions TrustZone On the processor of technology, and the embedded multi-media card eMMC of replay protection memory block RPMB subregions is used to be situated between as storage Matter, the system includes trusted application program, and encryption/decryption module, safe storage service program, communication module, untrusted appoints behaviour Make system and eMMC RPMB drivers；

The trusted application program is operated in trusted execution environments, by the user program of security context certification, is accessed Secured data objects；

The encryption/decryption module is operated in trusted execution environments, is realized using driving hardware engine or software algorithm plus solution Close function；

The safe storage service program is operated in trusted execution environments, and secure data pair is provided to trusted application program The establishment of elephant, reading, modification, the function of deleting or store；

The eMMC RPMB drivers operate in untrusted and appointed in performing environment, complete the read-write to eMMC RPMB subregions.

23. system according to claim 22, it is characterised in that the communication module, completes trusted execution environments and arrives Untrusted appoints the switching of performing environment, context to preserve and recover, and handles the mapping of the shared drive page, and interrupt it is non-can Trust the forwarding between performing environment and trusted execution environments.

24. system according to claim 22, it is characterised in that the safe storage service program maintenance trusted is performed There is provided the quick-searching function to secured data objects for environment local security data object list caching.

25. system according to claim 22, it is characterised in that the safe storage service program is responsible for calling encryption and decryption Module, completes the function to the encrypted data objects decryption in shared drive, and be saved in local in trusted execution environments Secured data objects list.

26. system according to claim 22, it is characterised in that the safe storage service program is responsible for calling encryption and decryption Module, completes the function to the clear data object encryption of trusted execution environments memory pages, and insert in shared drive.

27. system according to claim 22, it is characterised in that the untrusted appoints operating system to appoint in untrusted There is provided the basic running environment that untrusted appoints application program in performing environment, the interruption that safe storage service program is produced is responded Processing.