# US 12,223,043 B2 · Electronic apparatus and security protection method > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,223,043 B2 - Document ID: US12223043B2 - Status: Granted - Kind: B2 - Application number: 17/902,220 - Filed: 2022-09-02 - Published: 2022-12-29 - Granted: 2025-02-11 - Earliest claimed: 2020-03-06 - Assignees: Huawei Technologies Co., Ltd. - Applicants: Huawei Technologies Co., Ltd. - Inventors: Shilin Pan - Web page: https://patentgrep.com/patent/US12223043B2 ## CPC - G06F 21/51: at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability - G06F 21/56: Computer malware detection or handling, e.g. anti-virus arrangements - G06F 21/52: during program execution, e.g. stack integrity {; Preventing unwanted data erasure; Buffer overflow} - G06F 21/53: by executing in a restricted environment, e.g. sandbox or secure virtual machine - G06F 21/554: {involving event detection and direct action} - G06F 21/57: Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities - G06F 21/62: Protecting access to data via a platform, e.g. using keys or access control rules - G06F 2221/033: Test or assess software - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract An electronic apparatus and a security protection method are disclosed. The electronic apparatus includes a security protection apparatus and a first processor. Security isolation exists between the security protection apparatus and the first processor. The first processor is configured to operate when driven by software, and the software includes an operating system and/or an application. The security protection apparatus is configured to: perform security detection on the software, and when detecting that the software is tampered with, perform a security protection operation on the electronic apparatus. In this way, the electronic apparatus may be monitored in real time during an operating process of the electronic apparatus, to avoid theft or modification of important data such as key data and improve security. ## Claims ### Claim 1 An electronic apparatus, wherein the electronic apparatus comprises security protection circuits and a first processor, and security isolation exists between the security protection circuits and the first processor; the first processor is configured to operate when driven by software, wherein the software comprises an operating system; and the security protection circuits are configured to: perform security detection on the software, and when detecting that the software is tampered with, perform a security protection operation on the electronic apparatus; wherein the security protection circuits are further configured to perform periodic security detection on the software based on a time period set by a timer, or perform security detection on the software based on an interrupt event sent by the first processor by: controlling a hash accelerator comprised in the security protection circuits to obtain the software and perform a hash operation on the software to obtain a reference value; and comparing the reference value with a pre-stored hash reference value, and determine, based on a comparison result, whether the software is tampered with. ### Claim 2 (depends on 1) The electronic apparatus according to claim 1, wherein the security protection operation comprises one or more selected from the following: triggering an alarm, resetting the electronic apparatus, rejecting a service requested by the software, instructing the first processor to stop operating, instructing the first processor to stop operating the software, disabling at least a part of functions of the software, or preventing the software from accessing data stored in the electronic apparatus. ### Claim 3 (depends on 1) The electronic apparatus according to claim 1, wherein the security isolation comprises at least one selected from the following: working system isolation, power supply isolation, or clock signal isolation. ### Claim 4 (depends on 1) The electronic apparatus according to claim 1, wherein the security detection comprises: detecting whether at least one of an instruction or data of the software comprises preset information. ### Claim 5 (depends on 1) The electronic apparatus according to claim 1, wherein the first processor comprises an on-chip tracking circuit; and the on-chip tracking circuit is configured to: when the first processor rewrites data, store an instruction sequence used for data rewriting in a dedicated memory. ### Claim 6 (depends on 5) The electronic apparatus according to claim 5, wherein the security detection comprises: detecting whether the instruction sequence stored in the dedicated memory is a reference instruction sequence. ### Claim 7 (depends on 5) The electronic apparatus according to claim 5, wherein the electronic apparatus comprises a memory, and the memory is configured to store an instruction and data of the software; and the dedicated memory is a storage space disposed in the memory for use by the on-chip tracking unit and the security protection circuits to perform reading and writing. ### Claim 8 (depends on 1) The electronic apparatus according to claim 1, wherein the security protection circuits further comprise a watchdog circuit, the electronic apparatus further comprises a reset circuit, and the watchdog circuit is coupled to the reset circuit; the security protection circuits are is-further configured to periodically send a heartbeat instruction to the watchdog circuit; and the watchdog circuit is configured to: when the heartbeat instruction is not received within a predetermined time period, reset the electronic apparatus by using the reset circuit. ### Claim 9 (depends on 1) The electronic apparatus according to claim 1, wherein the operating system comprises a rich execution environment (REE) and a trusted execution environment (TEE). ### Claim 10 (depends on 9) The electronic apparatus according to claim 9, wherein the security protection circuits are further configured to: when an operating environment of the first processor is switched from the REE to the TEE, periodically perform the security detection on software that is used to drive the operating environment of the first processor to be switched and software that operates in the TEE; and stop performing the security detection when the operating environment of the first processor is switched from the TEE to the REE. ### Claim 11 A security protection method, applied to an electronic apparatus, wherein the method comprises: operating the electronic apparatus, by a first processor in the electronic apparatus wherein the first processor is driven by software and the software comprises an operating system; performing, by security protection circuits in the electronic apparatus, security detection on the software, wherein security isolation exists between the security protection circuits and the first processor; and performing, by the security protection circuits, a security protection operation on the electronic apparatus when detecting that the software is tampered with; wherein the operating system comprises a rich execution environment (REE) and a trusted execution environment (TEE) and wherein the security protection operation comprises: when an operating environment of the first processor is switched from the REE to the TEE, periodically performing the security detection on software that is used to drive the operating environment of the first processor to be switched and software that operates in the TEE; and stopping performing the security detection when the operating environment of the first processor is switched from the TEE to the REE. ### Claim 12 (depends on 11) The security protection method of claim 11, wherein the security isolation comprises at least one selected from the following: working system isolation, power supply isolation, or clock signal isolation. ### Claim 13 (depends on 11) The security protection method of claim 11, wherein the security detection comprises: detecting whether at least one of an instruction or data of the software comprises preset information. ### Claim 14 (depends on 11) The security protection method of claim 11, wherein the security protection operation comprises one or more selected from the following: triggering an alarm, resetting the electronic apparatus, rejecting a service requested by the software, instructing the first processor to stop operating, instructing the first processor to stop operating the software, disabling at least a part of functions of the software, or preventing the software from accessing data stored in the electronic apparatus. ### Claim 15 (depends on 11) The security protection method of claim 11, wherein the first processor comprises an on-chip tracking circuit, and the on-chip tracking circuit is configured to: when the first processor rewrites data, store an instruction sequence used for data rewriting in a dedicated memory; and wherein the security detection comprises detecting whether the instruction sequence stored in the dedicated memory is a reference instruction sequence. ### Claim 16 (depends on 11) The security protection method of claim 11, wherein the first processor comprises an on-chip tracking circuit, and the on-chip tracking circuit is configured to: when the first processor rewrites data, store an instruction sequence used for data rewriting in a dedicated memory; and wherein the electronic apparatus comprises a memory, and the memory is configured to store an instruction and data of the software, and the dedicated memory is a storage space disposed in the memory for used by the on-chip tracking unit and the security protection circuits to perform reading and writing. ### Claim 17 (depends on 11) The security protection method of claim 11, wherein the security protection circuits comprise a second processing circuit, and the second processing circuit is configured to perform periodic security detection on the software based on a time period set by a timer or perform security detection on the software based on an interrupt event sent by the first processor.