Data processing method and apparatus

Patent metadata

Field	Value
Publication number	US-10243933-B2
Application number	US-201715701148-A
Country	US
Kind code	B2
Filing date	Sep 11, 2017
Priority date	Jul 25, 2014
Publication date	Mar 26, 2019
Grant date	Mar 26, 2019

Abstract

A data processing method and apparatus, where the method includes acquiring a first network data packet that is sent by a target application that runs in an untrusted execution domain, where the first network data packet includes a first identifier; acquiring, in a trusted execution domain, first data corresponding to the first identifier; generating, in the trusted execution domain, a second network data packet according to the first data and the first network data packet; performing, in the trusted execution domain, encryption on the second network data packet by using a first session key to acquire an encrypted second network data packet; and sending the encrypted second network data packet to the target server. The data processing method and apparatus in the embodiments of the present invention can effectively prevent an attacker from stealing data.

First claim

What is claimed is:

1. A data processing method for a data processing apparatus in communication with a target server, comprising:
acquiring, by the data processing apparatus, an encrypted first network data packet that is encrypted by using a second session key;
decrypting, by the data processing apparatus, in a trusted execution domain operated on a processor of the data processing apparatus, the encrypted first network data packet by using the second session key into a decrypted first network data packet comprising a first identifier;
acquiring, by the data processing apparatus, in the trusted execution domain, first data corresponding to the first identifier, wherein the first data is data necessary for requesting, by a target application, the service from a target server;
generating, by the data processing apparatus, in the trusted execution domain, a second network data packet according to the first data and the decrypted first network data packet;
performing, by the data processing apparatus, in the trusted execution domain, encryption on the second network data packet by using a first session key that is determined by pre-negotiation with the target server, to acquire an encrypted second network data packet;
sending by the data processing apparatus, the encrypted second network data packet to the target server;
receiving an encrypted third network data packet that is sent by the target server and is encrypted using the first session key;
decrypting, in the trusted execution domain, the encrypted third network data packet using the first session key to generate a decrypted third network data packet;
generating a fourth network data packet according to the third network data packet and the first identifier that corresponds to the first data when it is determined that the decrypted third network data packet comprises the first data, wherein the fourth network data packet does not comprise the first data; and
sending the fourth network data packet to the target application that runs in a untrusted execution domain.

2. The method according to claim 1 , wherein the sending the encrypted second network data packet to the target server comprises:
transferring the encrypted second network data packet to the untrusted execution domain by using a shared memory; and
sending, in the untrusted execution domain, the encrypted second network data packet to the target server.

3. The method according to claim 1 , further comprising:
sending a request data packet to the target server;
receiving a first certificate and verifying the first certificate by using a first root certificate that is pre-stored in the trusted execution domain, wherein the first certificate is used to certify an identity of the target server; and
determining a first session key when the verification succeeds.

4. The method according to claim 1 , further comprising:
generating, in the trusted execution domain, a second certificate according to a second root certificate, wherein the second certificate has a same universal name as the first certificate, and the second root certificate is pre-stored in the trusted execution domain and the untrusted execution domain; and
determining a second session key according to the second certificate and the second root certificate, wherein the second session key is a session key between the trusted execution domain and the untrusted execution domain.

5. A data processing apparatus, comprising:
a processor; and
a non-transitory media readable by the processor, the non-transitory media storing instructions that when executed by the processor, cause the processor to:
acquire an encrypted first network data packet that is encrypted by using a second session key;
decrypt, in a trusted execution domain, the encrypted first network data packet by using the second session key into a decrypted first network data packet comprising a first identifier;
acquire, in the trusted execution domain, first data corresponding to the first identifier, wherein the first data is data necessary for requesting, by a target application, a service from a target server;
generate, in the trusted execution domain, a second network data packet according to the first data and the decrypted first network data packet;
perform, in the trusted execution domain, encryption on the second network data packet by using a first session key that is determined by pre-negotiation with the target server, to acquire an encrypted second network data packet;
send the encrypted second network data packet to the target server;
receive an encrypted third network data packet that is sent by the target server and is encrypted using the first session key;
decrypt, in the trusted execution domain, the encrypted third network data packet using the first session key to generate a decrypted third network data packet;
generate a fourth network data packet according to the third network data packet and the first identifier that corresponds to the first data when it is determined that the decrypted third network data packet comprises the first data, wherein the fourth network data packet does not comprise the first data; and
send the fourth network data packet to the target application that runs in a untrusted execution domain.

6. The apparatus according to claim 5 , wherein the instructions for directing the processor to:
transfer the encrypted second network data packet to the untrusted execution domain by using a shared memory; and
send, in the untrusted execution domain, the encrypted second network data packet to the target server.

7. The apparatus according to claim 5 , wherein the instructions for directing the processor to:
send a request data packet to the target server;
receive a first certificate and verify the first certificate by using a first root certificate that is pre-stored in the trusted execution domain, wherein the first certificate is used to certify an identity of the target server; and
determine a first session key when the verification succeeds.

8. The apparatus according to claim 5 , wherein the instructions for directing the processor to:
generate, in the trusted execution domain, a second certificate according to a second root certificate, wherein the second certificate has a same universal name as the first certificate, and the second root certificate is pre-stored in the trusted execution domain and the untrusted execution domain; and
determine a second session key according to the second certificate and the second root certificate, wherein the second session key is a session key between the trusted execution domain and the untrusted execution domain.

Assignees

• Huawei Tech Co Ltd

Inventors

• Hua Zhichao
• Xia Yubin
• Chen Haibo

Classifications

• H04L63/0485

  Networking architectures for enhanced packet encryption processing, e.g. offloading of IPsec packet processing or efficient security association look-up · CPC title

• G06F2221/2113

  Multi-level security, e.g. mandatory access control · CPC title

• H04L9/3265

  using certificate chains, trees or paths; Hierarchical trust model · CPC title

• G06F21/42

  using separate channels for security data · CPC title

• G06F21/335

  for accessing specific resources, e.g. using Kerberos tickets · CPC title