# US 2019/0172047 A1 · System on chip and processing device > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2019/0172047 A1 - Document ID: US20190172047A1 - Status: Published application - Kind: A1 - Application number: 16/268,294 - Filed: 2019-02-05 - Published: 2019-06-06 - Earliest claimed: 2016-08-09 - Assignees: Huawei Technologies Co., Ltd. - Applicants: Huawei Technologies Co.,Ltd. - Inventors: Zhufeng Tan; Jiayin Lu; Yu Liu; Shaojie Sun - Web page: https://patentgrep.com/patent/US20190172047A1 ## CPC - G06Q 20/3227: {using secure elements embedded in M-devices} - G06F 21/32: using biometric data, e.g. fingerprints, iris scans or voiceprints - G06F 21/575: {Secure boot} - G06F 21/602: {Providing cryptographic facilities or services} - G06F 21/74: operating in dual or compartmented mode, i.e. at least one secure mode - G06Q 20/3263: {characterised by activation or deactivation of payment capabilities} - G06Q 20/3278: {RFID or NFC payments by means of M-devices} - G06Q 20/3563: {Software being resident on card} - G06Q 20/40145: {Biometric identity checks} - H04B 5/20: characterised by the transmission technique; characterised by the transmission medium - H04L 9/0869: {involving random numbers or seeds} - H04L 63/0861: {using biometrical features, e.g. fingerprint, retina-scan (cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231)} - H04W 4/80: Services using short range communication, e.g. near-field communication [NFC], radio-frequency identification [RFID] or low energy communication - H04W 12/06: Authentication - G06F 2221/2149: Restricted operating environment - G06Q 2220/00: Business processing using cryptography - G06V 40/10: Human or animal bodies, e.g. vehicle occupants or pedestrians; Body parts, e.g. hands - G06V 40/12: Fingerprints or palmprints - G06V 40/16: Human faces, e.g. facial parts, sketches or expressions - G06V 40/18: Eye characteristics, e.g. of the iris - H04B 5/24: Inductive coupling - G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04B: TRANSMISSION - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) - G06V: IMAGE OR VIDEO RECOGNITION OR UNDERSTANDING ## Abstract A system on chip is integrated on a first semiconductor chip, and includes: a system bus, at least one processor coupled to the system bus, and a security processor system coupled to the system bus. The security processor system includes a security processor, a first memory, multiple interfaces, and a security bus, where the security processor, the first memory, and the multiple interfaces are coupled to the security bus, and the security bus is coupled to the system bus. The security processor is configured to execute security operating system software and at least one security software application based on the security operating system software, where the at least one security software application includes mobile payment software used to implement mobile payment. The multiple interfaces include a near field communication (NFC) interface and a biometric recognition input interface. ## Claims ### Claim 1 A system on chip (SoC), wherein the SoC is integrated on a first semiconductor chip, and comprises: a system bus; a security processor system coupled to the system bus; at least one processor coupled to the system bus wherein the at least one processor comprises at least one central processing unit that is configured to execute general-purpose operating system software and to communicate with the security processor system through the system bus under the action of the general-purpose operating system software, wherein: the security processor system comprises a security processor, a first memory, multiple interfaces, and a security bus, and the security processor, the first memory, and the multiple interfaces are coupled to the security bus, and the security bus is coupled to the system bus, and security isolation exists between the security processor system and the at least one processor; and the security processor is configured to execute security operating system software and at least one security software application based on the security operating system software, wherein the at least one security software application comprises mobile payment software used to implement mobile payment; the first memory is configured to provide storage space used by the security processor to execute the security operating system software and the at least one security software application; the multiple interfaces comprise a near field communication NFC interface and a biometric recognition input interface, the NFC interface is configured to exchange NFC information related to the mobile payment with an NFC peer through an NFC processor; and the biometric recognition input interface is configured to receive biometric recognition data from a biometric recognition sensor, wherein the biometric recognition data is used for user authentication based on biometric recognition in the mobile payment. ### Claim 2 (depends on 1) The SoC according to claim 1, wherein the multiple interfaces further comprise a security input interface, configured to receive user information that is input by a user and that is related to the mobile payment. ### Claim 3 (depends on 1) The SoC according to claim 1, wherein the multiple interfaces further comprise a peripheral interface, configured to indicate, by using a peripheral device, to the user that the mobile payment is performed. ### Claim 4 (depends on 1) The SoC according to claim 1, wherein the security processor system further comprises a nonvolatile second memory that is coupled to the security bus and that is configured to store the security operating system software and the at least one security software application; and the security processor is configured to: read the security operating system software and the at least one security software application from the second memory, and load the security operating system software and the at least one security software application to the first memory to execute the security operating system software and the at least one security software application. ### Claim 5 (depends on 1) The SoC according to claim 1, wherein the security processor system further comprises a security isolation device that is coupled to the security bus and that is configured to implement the security isolation, and the at least one processor communicates with the security processor system through the system bus and the security isolation device. ### Claim 6 (depends on 5) The SoC according to claim 5, wherein the security isolation device comprises at least one of an isolation memory or a bus bridge; and the isolation memory or the bus bridge is configured to exchange data or instruction between the at least one processor and the security processor system. ### Claim 7 (depends on 1) The SoC according to claim 1, wherein the security processor system further comprises a secure boot memory that is coupled to the security bus and that is configured to store a boot program instruction for initialization of the security processor; and before executing the security operating system software and the at least one security software application, the security processor obtains the boot program instruction from the secure boot memory to initialize the security processor. ### Claim 8 (depends on 7) The SoC according to claim 7, wherein the boot program instruction is an encrypted boot program instruction; and when the security processor obtains the boot program instruction from the secure boot memory, the boot program instruction is decrypted by a decryption logic circuit to obtain a decrypted boot program instruction, wherein the decrypted boot program instruction is used to initialize the security processor. ### Claim 9 (depends on 1) The SoC according to claim 1, wherein the security processor system further comprises a one-time programmable memory that is coupled to the security bus and that is configured to store a security parameter of the security processor system, wherein the security parameter comprises at least one of a root key, a calibration parameter, a configuration parameter, or an enable parameter. ### Claim 10 (depends on 9) The SoC according to claim 9, wherein the one-time programmable memory is further configured to store a patch program instruction of the boot program instruction for the initialization of the security processor. ### Claim 11 (depends on 1) The SoC according to claim 1, wherein the security processor system further comprises an anti-attack sensor, configured to: detect an exception of an operating parameter of the security processor system, and trigger at least one of the following operations when the exception occurs: the security processor system performs an alarm, the security processor resets, or the first memory or at least one register in the security processor system is reset or emptied, wherein the operating parameter comprises at least one of a voltage, a current, a clock frequency, a temperature, or a laser intensity. ### Claim 12 (depends on 1) The SoC according to claim 1, wherein the security processor system further comprises an anti-attack metal layer, wherein the anti-attack metal layer is located at one or more topmost layers of the first semiconductor chip, and covers at least one part of the security processor system in a layout; and the anti-attack metal layer is configured to: detect an external physical detection or attack, and generate an electrical signal when the physical detection or attack is detected, wherein the electrical signal is used to trigger at least one of the following operations: the security processor system performs an alarm, the security processor resets, or the first memory or the at least one register in the security processor system is reset or emptied. ### Claim 13 (depends on 1) The SoC according to claim 1, wherein the security processor system further comprises a direct memory access DMA controller that is coupled to the security bus and that is configured to: read data from the first memory and output the data to the security bus, or write data to the first memory by using the security bus. ### Claim 14 (depends on 1) The SoC according to claim 1, wherein the security processor system further comprises a cipher system coupled to the security bus, wherein the cipher system comprises at least one of the following: an encryption and decryption device, configured to perform encryption and decryption processing on at least one type of data in the security processor system; an authentication device, configured to authenticate at least one type of data in the security processor system; a random number generator, configured to generate a random number, wherein the random number is used as a seed for generating a key or a unique chip identifier; or a key manager, configured to generate, distribute, or destruct, in the security processor system, a key for performing the encryption and decryption processing or the authentication. ### Claim 15 (depends on 14) The SoC according to claim 14, wherein the at least one processor further comprises: a communication processor, configured to: send first communication data to a wireless access point or receive second communication data from the wireless access point; and a speech signal processor, configured to: process a speech signal from the user to generate the first communication data sent by the communication processor, or process the second communication data received by the communication processor to obtain a speech signal needed by the user, wherein the encryption and decryption device is further configured to perform encryption processing on the first communication data or perform decryption processing on the second communication data. ### Claim 16 (depends on 14) The SoC according to claim 14, wherein the at least one processor further comprises: a communication processor, wherein the encryption and decryption device is further configured to perform encryption processing on the biometric recognition data to obtain encrypted biometric recognition data; and the communication processor is configured to send, through a wireless access point, the encrypted biometric recognition data to a server configured to perform the user authentication. ### Claim 17 (depends on 1) The SoC according to claim 1, wherein the security processor is further configured to perform the user authentication by using the biometric recognition data. ### Claim 18 (depends on 1) The SoC according to claim 1, wherein the security processor system further comprises: a biometric recognition authenticator, configured to perform the user authentication by using the biometric recognition data. ### Claim 19 (depends on 1) The SoC according to claim 1, wherein under the security isolation, the at least one processor is unable to directly access the first memory or the at least one register in the security processor system. ### Claim 20 (depends on 1) The SoC according to claim 1, wherein the multiple interfaces further comprise a storage interface, configured to be coupled to a third memory, wherein the third memory is configured to store the security operating system software and the at least one security software application; and the security processor is configured to: read the security operating system software and the at least one security software application from the third memory by using the storage interface, and load the security operating system software and the at least one security software application to the first memory to execute the security operating system software and the at least one security software application. ### Claim 21 An integrated circuit system on chip (SoC), comprising: a system bus; at least one processor configured to execute computer instructions stored in memory; a security processor system, wherein the security processor system comprises a security processor, a first memory, multiple interfaces, and a security bus, and the security processor, the first memory, and the multiple interfaces are coupled to communicate through a communications interface and wherein security isolation exists between the security processor system and the at least one processor; the security processor is configured to execute security operating system software and at least one security software application based on the security operating system software, wherein the at least one security software application comprises mobile payment software used to implement mobile payment; multiple interfaces that comprise a near field communication NFC interface and a biometric recognition input interface wherein the NFC interface is configured to exchange NFC information related to the mobile payment with an NFC peer through an NFC processor and the biometric recognition input interface is configured to receive biometric recognition data from a biometric recognition sensor, wherein the biometric recognition data is used for user authentication based on biometric recognition in the mobile payment. ### Claim 22 (depends on 21) The SoC according to claim 21, wherein the multiple interfaces further comprise a security input interface, configured to receive user information that is input by a user and that is related to the mobile payment. ### Claim 23 (depends on 21) The SoC according to claim 21, wherein the multiple interfaces further comprise a peripheral interface, configured to indicate, by using a peripheral device, to the user that the mobile payment is performed. ### Claim 24 (depends on 21) The SoC according to claim 21, wherein the security processor system further comprises a nonvolatile second memory that is coupled to the security bus and that is configured to store the security operating system software and the at least one security software application; and the security processor is configured to: read the security operating system software and the at least one security software application from the second memory, and load the security operating system software and the at least one security software application to the first memory to execute the security operating system software and the at least one security software application. ### Claim 25 (depends on 21) The SoC according to claim 21, wherein the security processor system further comprises a security isolation device that is coupled to the security bus and that is configured to implement the security isolation, and the at least one processor communicates with the security processor system through the system bus and the security isolation device. ### Claim 26 (depends on 25) The SoC according to claim 25, wherein the security isolation device comprises at least one of an isolation memory or a bus bridge; and the isolation memory or the bus bridge is configured to exchange data or instruction between the at least one processor and the security processor system.