CN115017520A - Security protection system, method, electronic device and storage medium - Google Patents

Abstract

The application provides a safety protection system, a safety protection method, electronic equipment and a storage medium. The safety protection system provided by the application comprises a processor, a memory module and a safety protection module. When the safety protection system is adopted to read data in the memory, a specific initial secret key is generated in the safety protection module according to the equipment information in the processor, and then the plaintext to be read can be obtained after the ciphertext to be read in the memory is decrypted according to the initial secret key in the safety protection module, so that the ciphertext to be read cannot be successfully decrypted if the initial secret keys are not matched, data stealing through a Joint Test Action Group (Joint Test Action Group) interface can be effectively prevented, and meanwhile, the data cannot be directly obtained when the data in the memory is read due to the fact that the ciphertext to be read is stored in the memory.

Description

Security protection system, method, electronic device and storage medium

technical field

The present application relates to the field of encryption and decryption, and in particular to a security protection system, method, electronic device and storage medium.

Background technique

In embedded systems, most of the program executable codes and important parameters are stored in memory, which are generally stored in the standard plaintext format of the supporting compiler. Since these are important intellectual property rights of the system, once the program or important parameters are stolen, the intellectual property rights cannot be guaranteed, causing heavy losses to the owner of the program.

In the prior art, the cryptographic function integrated by some compilers can realize protection under certain conditions, but this method can only prevent the real-time memory from being read by software, and cannot prevent others from passing the Joint TestAction Group (Joint TestAction Group, below). JTAG for short) reads the memory to obtain the data in the memory, and it cannot prevent others from directly reading the data from the memory, and the protection effect is poor.

SUMMARY OF THE INVENTION

The present application provides a security protection system, method, electronic device and storage medium, aiming at solving the problem that the existing security protection method cannot prevent others from reading data in memory through JTAG (Joint Test Action Group, hereinafter referred to as JTAG), nor can To prevent the direct reading of data from FLASH, the protection effect is poor.

In a first aspect, the present application provides a safety protection system, the safety protection system includes:

the processor, configured to send a read command to the security protection module;

the memory module for storing the ciphertext to be read;

The security protection module is configured to generate and decrypt the ciphertext to be read according to an initial key to obtain the plaintext to be read, wherein the initial key is generated according to device information of the processor;

The processor is further configured to acquire the plaintext to be read from the security protection module.

In a possible implementation manner of the present application, the security protection module includes a key generation module, an encryption/decryption module, an external cache module and a command control module, the key generation module, the encryption/decryption module, the command The control module and the external cache are sequentially connected in communication, the command control module is respectively connected in communication with the memory module and the processor, and the security protection module further includes:

a key generation module for acquiring the device information and generating the initial key when powered on;

an encryption and decryption module, configured to obtain the ciphertext to be read, and perform decryption processing on the ciphertext to be read according to the initial key to obtain the plaintext to be read;

an external cache module for storing the plaintext to be read;

The command control module is configured to obtain the read command, and read and return the to-be-read plaintext in the external cache module to the processor according to the read command.

In a possible implementation manner of the present application, the security protection module further includes an internal cache module, and the internal cache module is respectively connected in communication with the memory module and the encryption/decryption module;

The internal cache module is used to obtain and store the ciphertext to be read from the memory module, and when the encryption and decryption module receives the initial key, input the ciphertext to be read into the ciphertext to be read. in the encryption and decryption module.

In a possible implementation manner of the present application, the security protection module further includes an interface module, and the interface module is respectively connected in communication with the processor, the memory module and the command control module, and the read command Carrying processor timing information, the read command is input to the interface module by the processor;

The interface module is configured to generate a read operation request according to the processor timing information, wherein the read operation request is used to request to read the plaintext to be read in the external cache module.

In a possible implementation manner of the present application, the encryption and decryption module is also used for:

Perform iterative calculation on the initial key to obtain and save the iterative key;

Decrypt the ciphertext to be read according to the iteration key to obtain the plaintext to be read.

In a possible implementation manner of the present application, the processor is further configured to send a write command to the security protection module, where the write command carries the plaintext to be written:

The command control module is further configured to obtain the write command;

The external cache module is further configured to store the to-be-written plaintext carried by the to-be-written command;

The encryption and decryption module is further configured to perform encryption processing on the plaintext to be written according to the initial key to obtain the ciphertext to be written;

The memory module is also used for storing the to-be-written ciphertext.

In a second aspect, the present application provides a security protection method, the security protection method comprising:

Obtain an initial key according to the device information of the processor;

Decrypt the ciphertext to be read according to the initial key to obtain the plaintext to be read, wherein the ciphertext to be read is stored in the memory module;

Return the plaintext to be read to the processor.

In a possible implementation manner of the present application, the security protection method further includes:

acquiring the plaintext to be written inputted by the processor, and encrypting the plaintext to be written according to the initial key to obtain the ciphertext to be written;

The to-be-written ciphertext is stored in the memory module.

In a third aspect, the present application further provides an electronic device, including a security protection system, the security protection method according to any one of claims 7 to 8 is executed when the security protection system invokes the computer program in the memory.

In a fourth aspect, the present application further provides a computer-readable storage medium on which a computer program is stored, and the computer program is loaded by a processor to execute the steps in the security protection method.

The present application provides a security protection system including a processor, a memory module and a security protection module. When using the security protection system to read data in the memory, a specific initial key is first generated in the security protection module according to the device information in the processor, and then the security protection module is based on the initial key to be read in the memory. The plaintext to be read can only be obtained after the ciphertext is decrypted. Therefore, when the initial key does not match, the ciphertext to be read cannot be successfully decrypted, which can effectively prevent data from being stolen through the JTAG interface. At the same time, the memory stores the ciphertext to be read. , the data cannot be obtained directly when reading data from the memory.

Description of drawings

In order to illustrate the technical solutions in the embodiments of the present application more clearly, the following briefly introduces the drawings that are used in the description of the embodiments. Obviously, the drawings in the following description are only some embodiments of the present application. For those skilled in the art, other drawings can also be obtained from these drawings without creative effort.

1 is a schematic diagram of a safety protection system provided in an embodiment of the present application;

2 is a schematic diagram of a security protection module provided in an embodiment of the present application;

3 is a schematic diagram of a security protection module provided in an embodiment of the present application;

4 is a schematic flowchart of a security protection method provided in an embodiment of the present application;

5 is a schematic flowchart of a security protection method provided in an embodiment of the present application;

FIG. 6 is a schematic structural diagram of an embodiment of the electronic device provided in the embodiment of the present application.

Detailed ways

The technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, but not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative work fall within the protection scope of the present application.

In the description of the embodiments of the present application, it should be understood that the terms "first" and "second" are only used for description purposes, and should not be interpreted as indicating or implying relative importance or implicitly indicating the indicated technical features quantity. Thus, features defined as "first", "second" may expressly or implicitly include one or more of said features. In the description of the embodiments of the present application, "plurality" means two or more, unless otherwise expressly and specifically defined.

The following description is presented to enable any person skilled in the art to make and use the present application. In the following description, details are set forth for the purpose of explanation. It is to be understood that one of ordinary skill in the art can realize that the present application may be practiced without the use of these specific details. In other instances, well-known procedures have not been described in detail in order to avoid obscuring the description of the embodiments of the present application with unnecessary detail. Thus, the present application is not intended to be limited to the embodiments shown but is to be accorded the widest scope consistent with the principles and features disclosed in the embodiments of this application.

Embodiments of the present application provide a security protection system, method, electronic device, and storage medium. Wherein, the security protection system may be integrated in an electronic device, and the electronic device may be a server or a terminal or other device.

First, before introducing the embodiments of the present application, the relevant content of the embodiments of the present application regarding the application background is first introduced.

In embedded systems, most of the program executable codes and important parameters are stored in memory, which are generally stored in the standard plaintext format of the supporting compiler. Since these are important information of the system, once the program or important parameters are stolen, the information cannot be guaranteed, causing heavy losses to the owner of the program.

At present, there are mainly two ways to steal important information of the system. One is to directly read the executable program in the memory, and then decompile to obtain the assembly source code. For example, a burner can be used to read the executable program in the memory, and then decompile it. Another way is to load the program through the processor chip, read the program in the processor chip through the JTAG interface, and then decompile to obtain the assembly source code.

In the prior art, the cryptographic function integrated by some compilers can realize protection under certain conditions, for example, when running a program, software with an encryption function can be used to encrypt the processor chip. However, this method can only prevent the real-time memory from being read by software, and cannot prevent others from reading the memory through JTAG to obtain the data in the memory, nor can it prevent others from directly reading the data from the memory, and the protection effect is poor.

Based on the above-mentioned defects in the existing related technologies, the embodiments of the present application provide a security protection system, method, electronic device, and storage medium, which overcome the defects in the existing related technologies at least to a certain extent.

It should be noted that, in the security protection system provided by the embodiments of the present application, the modules are generally connected by a bus. Among them, the bus is divided into a chip bus (Chip Bus, C-Bus), an internal bus (Internal Bus, I-Bus) and an external bus (External Bus, E-Bus). In this embodiment of the present application, a chip bus such as an I2C bus or an SCI bus is generally used for connection between the processor, the security protection module, and the memory module. On the contrary, the connection within the security protection module generally adopts an internal bus such as a PCI bus for connection. It should be clarified that the above bus is only an example, and does not constitute a restriction on the safety protection system, and the bus type can be adjusted according to actual needs.

Next, the security protection system provided by the embodiments of the present application will be introduced with reference to the accompanying drawings.

Although the connection relationship between the modules in the drawings, the connection relationship between the modules in the embodiment of the present application is only a schematic illustration, and does not constitute a limitation on the safety protection system. Each module may adopt different connection manners in the embodiments of the present application, or a combination of multiple connection manners.

1 , the security protection system includes a processor 10 , a security protection module 20 and a memory module 30 , the processor 10 is connected in communication with the security protection module 20 , and the security protection module 20 is in communication with the memory module 30 connected, the security protection module 20 is connected to the memory module 30 in communication.

The processor 10 is configured to send a read command to the security protection module 20 . Specifically, the read command refers to a machine instruction for reading the ciphertext to be read in the memory module 30 , including the storage location of the ciphertext to be read in the memory module 30 , that is, address information.

Meanwhile, the processor 10 contains device information, and the device information may include the serial number of the processor 10, and each processor 10 has a unique serial number. For example, the serial number of processor A is BFEBFBFF000206D6, then the serial number corresponds to and only corresponds to processor A.

The processor 10 can be represented in various forms, for example, the processor 10 may be: a digital signal processor 10 (Digital Signal Processor, hereinafter referred to as DSP) and a central processing unit (central processing unit, hereinafter referred to as CPU). Further, the DSP and the CPU can also be combined as the processor at the same time.

The memory module 30 is used to store the ciphertext to be read. Specifically, the ciphertext to be read refers to encrypted data pre-stored in the memory.

In some embodiments, the memory module 30 may also be used for ciphertext to be written. The ciphertext to be written is the information obtained by encrypting the plaintext to be written carried by the write command.

Further, a flash memory (Flash) may be used as the memory module 30 . Flash has the performance of electronically erasable and programmable (EEPROM), which can quickly read data without losing data when power is turned off. The flash memory includes NAND Flash and NOR Flash. When designing a security protection system, a suitable flash memory can be selected as the memory module 30 by comprehensively considering factors such as cost and capacity.

The security protection module 20 is configured to generate and decrypt the ciphertext to be read according to the initial key to obtain the plaintext to be read. The initial key refers to a parameter used to decrypt the ciphertext to be read, which can be generated in the security protection module 20 according to the device information of the processor 10, and can be a matrix or a binary string. Since each processor 10 has unique device information, a unique initial key is generated for each processor 10.

The embodiments of the present application provide a security protection system including a processor, a memory module and a security protection module. It mainly decrypts the ciphertext to be read by adding a new security protection module, uses the memory module to store the ciphertext to be read, and sends a reading instruction through the processor.

When using the security protection system to read data in the memory, first generate a specific initial key according to the device information in the processor, and decrypt the ciphertext to be read in the memory according to the initial key to obtain the plaintext to be read. Therefore, if the initial keys do not match, the ciphertext to be read cannot be successfully decrypted, which can effectively prevent data theft through the JTAG interface. At the same time, since the ciphertext to be read is stored in the memory, it is not possible to directly read data from the memory. get data. Hereinafter, the working process of the security protection system will be described in detail, taking the processor as the CPU in the computer and the memory module as the Flash in the computer as an example:

(1) After power-on, the security protection module obtains the device information of the CPU and generates an initial key.

(2) The security protection module reads the ciphertext to be read in the Flash, decrypts the ciphertext to be read according to the initial key, obtains the plaintext to be read and stores it. The power-on initialization process is complete.

(3) The CPU sends a read command to the security protection module, and the security protection module returns the plaintext to be read to the CPU according to the read command.

The plaintext to be read refers to unencrypted data obtained by decrypting the ciphertext to be read.

Further, in order to reduce the cost and speed up the operation, the security protection module 20 can be integrated on a Field Programmable Gate Array (Field Programmable Gate Array, hereinafter referred to as FPGA).

In some embodiments, the decryption algorithm used when decrypting the ciphertext to be read may be a symmetric algorithm. Symmetric encryption algorithm means that for a certain data, the key used for encryption and decryption is the same key, so the initial key can not only encrypt the plaintext to be read to generate the ciphertext to be read, but also can be decrypted to generate the ciphertext to be read. When the plaintext is to be read, that is, when the data is encrypted and written into the memory module 30, the initial key is also used to encrypt the data. For example, when using the DES algorithm as the decryption algorithm to read the data in the memory, if the initial key is 123456789 and the ciphertext to be read is -60fd73ff69e3352e5e2e976c55e6ed92, the plaintext to be read "helloWorld" can be obtained. Conversely, when the plaintext to be read is encrypted and written into the memory module 30, the initial key 123456789 can also be used to encrypt the plaintext to be read helloWorld to obtain the ciphertext to be read -60fd73ff69e3352e5e2e976c55e6ed92.

In some embodiments, the decryption algorithm used in decrypting the ciphertext to be read may also be a hybrid algorithm, that is, a symmetric algorithm and an asymmetric algorithm are used at the same time to further improve the security of the data. At this time, the ciphertext to be read is based on The plaintext to be read and the key obtained by encrypting the initial key with a preset public key (hereinafter referred to as the second initial key) are generated, specifically encrypting the plaintext to be read with the second initial key to obtain the key to be read. arts. Specifically, the second initial key can be decrypted according to the preset private key matching the preset public key to obtain the initial key, and then the ciphertext to be read can be decrypted according to the initial key to obtain the plaintext to be read.

Further, the initial key can also be stored in the security protection system. For example, the initial key may be stored in the memory module 30 . At this time, the read command sent by the processor 10 includes the address where the initial key is stored. Therefore, through the read command, the ciphertext to be read and the initial key can be obtained at the same time.

After the security protection module 20 completes the decryption of the ciphertext to be read and obtains the plaintext to be read, the processor 10 is further configured to obtain the plaintext to be read to complete the process of reading information from the memory module 30 .

Therefore, using the above security protection system, when reading data in the memory through the JTAG interface, first generate a specific initial key in the security protection module according to the device information in the processor 10, and then in the security protection module according to the initial The plaintext to be read can only be obtained after the key decrypts the ciphertext to be read in the memory. Therefore, if the initial key does not match, the ciphertext to be read cannot be successfully decrypted. The ciphertext to be read is stored, so the plaintext data cannot be obtained by directly reading the memory.

Please refer to FIG. 2 . Next, FIG. 2 is used to describe an embodiment of a security protection module in a security protection system. For some security protection systems, the security protection module 20 may include a key generation module 210, an encryption and decryption module 220, an external cache module 230 and a command control module 240. The key generation module 210, the encryption and decryption module 220, The command control module 240 and the external cache module 230 are sequentially connected in communication, and the command control module 240 is respectively connected in communication with the memory module 30 and the processor 10 .

The key generation module 210 is configured to acquire the device information and generate the initial key when powered on. Specifically, after the security protection system is powered on, the key generation module 210 acquires the device information in the processor 10 , generates an initial key according to the device information, and sends it to the encryption and decryption module 220 .

The encryption and decryption module 220 is configured to obtain the ciphertext to be read, and decrypt the ciphertext to be read according to the initial key to obtain the plaintext to be read. Specifically, after obtaining the initial key, the encryption and decryption module 220 obtains the ciphertext to be read from the memory module 30, and then decrypts the ciphertext to be read according to the initial key to obtain the plaintext to be read and sends it to the command control module 240 in.

In some embodiments, the encryption and decryption module 220 may use a symmetric algorithm to decrypt the ciphertext to be read. At this time, the key generated by the key generation module 210 is a symmetric key generated according to the device information.

In some embodiments, the encryption/decryption module 220 may use a hybrid algorithm to decrypt the ciphertext to be read. In this case, the key generated by the key generation module 210 includes a private key and an initial key.

Further, according to the decryption algorithm adopted in the encryption and decryption module 220, the data bit widths of the plaintext to be read obtained after decryption are different. For example, if the AES algorithm is adopted, the data bit width can be 256 bits, and if the DES algorithm is adopted, the data bit width is 128 bits.

In some embodiments, the encryption/decryption module 220 may also store the initial key, and automatically initialize after power-off to delete the stored initial key, which saves the need to generate the initial key multiple times and avoids the need for two power-ups. The key is repeatedly read and written.

The external cache module 230 is used for storing the plaintext to be read. Specifically, after the encryption/decryption module 220 sends the plaintext to be read to the command control module 240 , the external cache module 230 acquires and stores the plaintext to be read sent by the command control module 240 .

Further, the external cache module 230 may include a static random-access memory (Static Random-Access Memory, hereinafter referred to as Sram). When the external cache module 230 is a Sram, the external cache module 230 can also solve the problem of the processor 10 and the security protection module 20. The problem that the frequency of the storage bus and the operating clock frequency of the security protection module 20 are different is avoided, so as to avoid data loss caused by this problem.

The command control module 240 is configured to obtain the read command, and read and return the plaintext to be read in the external cache module 230 to the processor 10 according to the read command. Specifically, after the command control module 240 obtains the read command, it converts the read command into a read request to the external cache module, and obtains from the external cache module 230 the address information corresponding to the address information according to the address information in the read request. Read the ciphertext.

Further, when the power is turned on, the command control module 240 can also be used to convert the plaintext to be read obtained after decrypting the ciphertext to be read by the encryption and decryption module 220 into a write request to the external cache module 230, specifically, to write The request also includes the target address written in the external cache module 230 .

Further, the command control module 240 is also used to parse and process the read command sent by the processor 10, and convert the format of the read command into a format suitable for the external cache module 230 or the memory module 30, and the format may include an encoding format and a grammar. Format.

Below, take as an example that the processor of the security protection system is the CPU in the computer, the memory module is the Flash in the computer, and the security protection module is a newly added module in the computer, the working process of the security protection system in the embodiment of the application is specifically described:

(1) When powered on, after the security protection system is powered on, the key generation module 210 in the security protection module 20 first obtains the device information of the CPU, and then generates an initial key according to the device information.

(2) The encryption and decryption module obtains the ciphertext to be read in the Flash, and decrypts the ciphertext to be read according to the initial key to obtain the plaintext to be read. The power-on initialization process is complete.

(3) The CPU sends the read command to the command control module, and the command control module converts the read command into a read request for Sram, and returns the plaintext to be read to the CPU according to the read request.

Wherein, the security protection module 20 may further include a data conversion module. Specifically, the data conversion module is configured to convert the plaintext to be read into plaintext with a specific data bit width, where the specific data bit width is consistent with the storage bit width of the external cache module 230 . For example, when the external cache module 230 includes SRAM, the storage bit width of the external cache module 230 is 16 bits, so the specific data bit width is 16 bits. If the encryption and decryption module 220 adopts the AES-128 algorithm as the decryption algorithm, and the bit width of the decrypted plaintext is 128 bits, the data conversion module can convert the 128-bit plaintext to be written into 16-bit data, and then transmit the converted data to the command in the control module 240.

In some embodiments, the key generation module 210 may first obtain the key when powered on. Then, according to the address information of the read command, the encryption and decryption module 220 decrypts the ciphertext to be read corresponding to the address information in the memory module 30, and stores the decrypted plaintext to be read in the external cache module 230, Finally, the command control module 240 returns the plaintext to be read in the external cache module 230 to the processor 10 .

In some embodiments, the security protection module 20 may first decrypt all the ciphertexts to be read in the memory module 30 according to the initial key in the encryption/decryption module 220 when powered on, and then decrypt the decrypted ciphertexts to be read. The plaintext is stored in the external cache module 230 . When the processor 10 sends the read command, the plaintext to be read corresponding to the address information is returned from the external cache to the processor 10 according to the address information of the read command. In this reading method, the ciphertext to be read can be decrypted when the power is turned on, and the decrypted plaintext to be read can be stored in the external cache module 230, thereby reducing the reading time.

In some practical scenarios, in order to improve the decryption speed, the security protection module 20 further includes an internal cache module 250, and the internal cache module 250 is connected in communication with the memory module 30 and the encryption and decryption module 220, respectively, and is used for obtaining data from all The memory module 30 acquires and stores the ciphertext to be read, and when the encryption/decryption module 220 receives the initial key, inputs the ciphertext to be read into the encryption/decryption module 220 .

The internal cache module 250 may be a Fifo memory (First Input First Output, hereinafter referred to as Fifo). When powered on, in the process of generating the initial key by the key generation module 210, the data conversion module first sends an internal read request to store the ciphertext to be read in the memory module 30 into the Fifo. After the initial key is generated, The ciphertext to be read is sent from the Fifo to the encryption and decryption module 220, and then the encryption and decryption module 220 implements the decryption of the ciphertext to be read.

By adding the internal cache module 250, the ciphertext to be read can be read out in advance in the process of generating the initial key, and the ciphertext to be read can be decrypted directly after the initial key is generated, which reduces the power-on initialization time. Increased efficiency.

By setting the internal cache module 250, when a read operation or a write operation is performed on the external cache module 230, the read command after parsing or the processed write command can be temporarily stored in the internal cache module 250 in advance, and the After the read operation or write operation performed by the external cache module 230 is completed, the next read operation or write operation can be performed immediately to improve the efficiency of the operation.

Below, take the processor as the CPU in the computer, the memory module as the Flash in the computer, the external cache module as the Sram, and the internal cache module as the Fifo as an example to specifically describe the working process of the security protection system in the application embodiment:

(1) After the security protection system is powered on, the key generation module 210 in the security protection module 20 first obtains the device information of the CPU, and then performs a key generation operation according to the device information.

(2) While the key generation module 210 performs the key generation operation, the data conversion module saves the ciphertext to be read in the Flash in the Fifo. When the key generation operation is completed and the encryption/decryption module 220 obtains the initial key, the data conversion module sends the ciphertext to be read in the Fifo to the encryption/decryption module 220 .

(3) The encryption and decryption module 220 decrypts the ciphertext to be read according to the initial key, and obtains the plaintext to be read. After the plaintext to be read is converted into a write operation request to the Sram after being processed by the command control module 240, it is stored in the Sram . The power-on initialization process is complete.

(4) The CPU issues a read command, and the command control module converts the read command into a read request to the Sram, and returns the plaintext to be read in the Sram to the CPU according to the read request.

In some practical scenarios, in order to make the security protection system applicable to various processors 10, the security protection module 20 further includes an interface module 260, the interface module 260 is respectively connected with the processor 10, the memory module 30 and all the The command control module 240 is communicatively connected.

The following describes the structure of the safety protection system in the embodiment of the application with reference to FIG. 3 .

In some embodiments, the interface module 260 is configured to convert the read command into the read operation request according to the timing information. Specifically, the interface module 260 may perform timing sampling and analysis on the read command sent by the processor 10 to obtain timing information therein. Then, according to the timing information, a read operation request is generated, and the read operation request includes a read request for the plaintext to be read in the external cache module.

In some embodiments, the interface module 260 is further configured to convert the read request generated after the command control module converts the read command into a write sequence to the external cache module, wherein the write sequence is used to convert the plaintext to be read. Write into the external cache module 230 .

Further, the interface module 260 can also be used to solve the problem of speed matching between modules. Specifically, when the operation speed of the output module is lower than the operation speed of the input module, the interface module 260 can cache the data generated after the operation of the input module is completed through the data register set therein, and obtain the cached data after the operation of the output module is completed. Perform the operation again to avoid the loss of the data input by the input module because it exceeds the data processing capability of the output module.

The interface module 260 may exist in various forms, for example, including a programmable interface chip. In this case, by adjusting the program parameters in the interface module 260, the interface module 260 can be used to connect different types of processors 10 . The input read and write commands are converted into read and write operation requests, or the read and write operation requests can be converted into read and write sequences that can be recognized by different memory modules 30 .

Below, take the processor as the CPU in the computer, the memory module as the Flash in the computer, the external cache module as the Sram, and the internal cache module as the Fifo as an example to specifically describe the working process of the security protection system in the application embodiment:

(1) After the security protection system is powered on, the key generation module 210 in the security protection module 20 first obtains the device information of the CPU, and then performs a key generation operation according to the device information.

(2) While the key generation module 210 performs the key generation operation, the data conversion module saves the ciphertext to be read in the Flash in the Fifo. When the key generation operation is completed and the encryption/decryption module 220 obtains the initial key, the data conversion module sends the ciphertext to be read in the Fifo to the encryption/decryption module 220 .

(3) The encryption and decryption module 220 decrypts the ciphertext to be read according to the initial key to obtain the plaintext to be read. The plaintext to be read is processed by the command control module 240 and converted into a write operation request to Sram.

(4) The interface module converts the write operation request into a write sequence, and stores the plaintext to be written in Sram. The power-on initialization process is complete.

(5) The CPU issues a read command, the interface module 260 performs time sequence analysis on the read command, generates a read operation request, and then the command control module converts the read operation request into a read request for Sram, and returns according to the read request The plaintext to be read in Sram is sent to the CPU.

In some practical scenarios, in order to enhance the security of the initial key, the initial key can also be iterated to obtain the iterative key, and then the ciphertext to be read is decrypted according to the iterative key. Specifically, the key iteration method in the prior art can be used to iterate the initial key. For example, the key iteration method in the AES algorithm can be used to perform byte substitution, row shift, and column mixing on the initial key. And round key addition and other operations, and finally get the iteration key. Further, the number of rounds for iterating on the initial key can be adjusted according to actual scene needs. For example, when using the AES-128 algorithm, 10 rounds of iterations are usually performed on the initial key. For another example, when the AES-256 algorithm is used, 14 rounds of iterations are usually performed on the initial key.

Below, take the processor as the CPU in the computer, the memory module as the Flash in the computer, the external cache module as the Sram, and the internal cache module as the Fifo as an example to specifically describe the working process of the security protection system in the application embodiment:

(1) After the security protection system is powered on, the key generation module 210 in the security protection module 20 first obtains the device information of the CPU, and then generates an initial key according to the device information. The initial key is obtained by encryption and decryption, and the initial key is iteratively calculated to obtain the iterative key.

(2) While step (1) in the embodiment of the present application is performed, the data conversion module saves the ciphertext to be read in the Flash in the Fifo. After the iterative key is generated, the data conversion module sends the ciphertext to be read in the Fifo to the encryption and decryption module 220 .

(3) The encryption and decryption module 220 decrypts the ciphertext to be read according to the iterative key to obtain the plaintext to be read. The plaintext to be read is processed by the command control module 240 and converted into a write operation request to Sram.

(4) The interface module converts the write operation request into a write sequence, and stores the plaintext to be written in Sram. The power-on initialization process is complete.

(5) The CPU issues a read command, the interface module 260 performs time sequence analysis on the read command, generates a read operation request, and then the command control module converts the read operation request into a read request for Sram, and returns according to the read request The plaintext to be read in Sram is sent to the CPU.

The security protection module 20 in this embodiment of the present application may also be used for encryption of plaintext to be written.

In this case, the processor 10 will issue a write command carrying the plaintext to be written to the security protection module 20 . The write command refers to a machine instruction for writing plaintext to be written into the memory module 30 .

The command control module 240 is used in this case to obtain the write command.

In this case, the external cache module 230 is further configured to store the to-be-written plaintext carried by the to-be-written command.

In this case, the encryption/decryption module 220 is further configured to perform encryption processing on the plaintext to be written according to the initial key to obtain the ciphertext to be written.

In some embodiments, the encryption and decryption module 220 uses a symmetric algorithm to encrypt the plaintext to be written.

In some embodiments, the encryption and decryption module 220 uses a hybrid algorithm to encrypt the plaintext to be written.

In this case, the memory module 30 is also used for storing the ciphertext to be written.

In some embodiments, a key iteration module can also be used to iterate the initial key to generate an iteration key, and then encrypt the plaintext to be written according to the iteration key.

In some embodiments, the interface module 260 can also be used to process the write commands and read commands sent by the processor 10 as described above, so that the security protection system can be applied to various processors 10 .

In some embodiments, the data conversion module may also be used to perform bit width conversion on the plaintext to be written in the external cache module 230, so that the bit width of the data sent to the encryption/decryption module 220 matches the requirements of the encryption algorithm.

Below, take the processor as the CPU in the computer, the memory module as the Flash in the computer, the external cache module as the Sram, and the internal cache module as the Fifo as an example to specifically describe the working process of the security protection system in the application embodiment:

(1) The CPU sends a write command to the command control module 240, and the command control module 240 converts the write command into a write operation request, wherein the write operation request includes the information to be written in plaintext.

(2) Store the information to be written in plaintext in the Fifo.

(3) If the information stored in the Fifo meets the preset requirements, the information in the Fifo is stored in the Sram. For the situation in the embodiment of the present application, if the encryption and decryption module 220 adopts the SM4 algorithm as the encryption and decryption algorithm, when the information of 8 consecutive addresses is stored in the Fifo, the information in the Fifo is stored in the Sram.

(4) After the data conversion module converts the information in the Sram into data that meets the 220-bit width requirement of the encryption and decryption algorithm, the encryption and decryption module 220 encrypts the converted data according to the initial key to obtain the ciphertext to be written .

(5) The data conversion module processes the to-be-written ciphertext to obtain the to-be-written ciphertext whose data bit width meets the flash storage bit width requirement. The interface module 260 and the command control module 240 process the processed to-be-written ciphertext After that, store it in Flash.

Next, a security protection method implemented based on the security protection system in the present application is introduced.

The execution body of the security protection method in the embodiment of the present application may be the security protection system provided in the embodiment of the present application, or different types of electronic devices such as a server device, a physical host, or user equipment (User Equipment, UE) integrated with the security protection system. , wherein the security protection system may be implemented in hardware or software, and the UE may specifically be a terminal device such as a smart phone, tablet computer, notebook computer, palmtop computer, desktop computer, or personal digital assistant (Personal Digital Assistant, PDA).

The electronic device may use a working mode of independent operation, or may also use a working mode of device cluster. By applying the security protection method provided by the embodiment of the present application, when reading data in the memory through the JTAG interface, firstly according to the data in the processor The device information of the device generates a specific initial key. According to the initial key, the ciphertext to be read in the memory can be decrypted to obtain the plaintext to be read. Therefore, if the initial key does not match, the ciphertext to be read cannot be successfully decrypted. When reading data from the memory, since the ciphertext to be read is stored in the memory, the plaintext data cannot be obtained by directly reading the memory.

Referring to FIG. 4 , FIG. 4 is a schematic flowchart of a security protection method provided by an embodiment of the present application, where the security protection method is implemented based on a security protection system. It should be noted that although a logical order is shown in the flowcharts, in some cases, the steps shown or described may be performed in an order different from that herein. The security protection method includes steps S10-S30, wherein:

S10. Acquire an initial key according to the device information of the processor 10.

S20. Decrypt the ciphertext to be read according to the initial key to obtain the plaintext to be read, wherein the ciphertext to be read is stored in the memory module 30.

S30 , returning the plaintext to be read to the processor 10 .

The following describes the entire process from power-on to the processor getting the plaintext to be read:

(1) After the security protection system is powered on, the key generation module 210 in the security protection module 20 first acquires the device information of the processor 10, and then performs a key generation operation according to the device information.

(2) While the key generation module 210 performs the key generation operation, the data conversion module saves the ciphertext to be read in the memory module 30 in the internal cache module 250 . When the key generation operation is completed and the encryption/decryption module 220 obtains the initial key, the data conversion module sends the ciphertext to be read in the internal cache module 250 to the encryption/decryption module 220 .

In some embodiments, after the encryption/decryption module 220 obtains the initial key, iterative calculation processing may be performed on the initial key to obtain and save the iterative key. When obtaining the iteration key, the data conversion module sends the ciphertext to be read in the internal cache module 250 to the encryption and decryption module 220 .

(3) The encryption and decryption module 220 decrypts the ciphertext to be read according to the initial key, and obtains the plaintext to be read. After the plaintext to be read is processed by the command control module 240 and the interface module 260, it is stored in the external cache module 230. The processing includes converting the plaintext to be read into a write request to the external cache module 230 and converting the write request into a cache timing command to the external cache module 230 .

In some embodiments, the encryption/decryption module 220 may also perform iterative processing on the initial key to obtain the iterative key, so the encryption/decryption module 220 may decrypt the ciphertext to be read according to the iteration key to obtain the plaintext to be read.

After steps A, B, and C, the power-on initialization process is completed, and the processor 10 can issue a read command or a write command.

(4) The processor 10 issues a read command, and the interface module 260 processes the read command to generate a read operation request, wherein the read command carries timing information, and the read operation request is used to request to read the external cache The plaintext to be read in the module.

(5) The command control module 240 returns the plaintext to be read stored in the external cache module 230 to the processor 10 according to the operation read instruction.

Referring to FIG. 5 , FIG. 5 is a schematic flowchart of a security protection method provided by an embodiment of the present application.

In some practical scenarios, the security protection system provided by the embodiments of the present application may also be used to encrypt data written into the memory by the processor 10. In this case, the security protection method includes steps S40-S50:

S40: Acquire the plaintext to be written inputted by the processor 10, and encrypt the plaintext to be written according to the initial key to obtain the ciphertext to be written.

S50 , burning the to-be-written ciphertext into the memory module 30 .

The following describes the entire writing process in detail:

(1) The processor 10 issues a write command carrying the plaintext to be written and the timing information of the processor 10. The interface module 260 converts the write command into a write request to the external cache module according to the timing information of the processor 10, and writes the write command to the external cache module. The information in the incoming request is stored in the internal cache module 250 . Specifically, the information in the write request includes plaintext to be written.

(2) If the information stored in the internal cache module 250 meets the preset requirements, the information in the internal cache module 250 is stored in the external cache module 230 . For example, the internal cache module 250 is Fifo, the external cache module 230 is SRAM, and the encryption algorithm in the encryption and decryption module 220 is the SM4 algorithm. When the information of 8 consecutive addresses is stored in the Fifo, the information in the Fifo is stored in the Sram.

(3) After the data conversion module converts the information in the external cache module 230 into data that meets the bit width requirements of the encryption and decryption algorithm, the data obtained after conversion is encrypted in the encryption and decryption module 220 according to the initial key to obtain the data to be written ciphertext.

In some embodiments, an iterative calculation process may also be performed on the initial key to obtain an iterative key. Then, the converted data is encrypted according to the iterative key to obtain the ciphertext to be written.

(4) The data conversion module processes the to-be-written ciphertext to obtain the to-be-written ciphertext whose data bit width meets the storage bit width requirement of the memory module 30. The interface module 260 and the command control module 240 process the processed to-be-written ciphertext After format conversion, it is stored in the memory module 30 .

It should be noted that, for the specific working processes of S10-S30 and S40-S50 in this application, reference may be made to the description of any of the above embodiments, and details are not repeated here.

The description of the embodiment of the security protection method and the description of the embodiment of the security protection system in the embodiments of the present application have their own emphasis, and the contents of each part in the security protection method and the security protection system can be referred to each other. For example, for the specific implementation and specific working process of each functional module in the security protection system involved in the security protection method embodiment, reference may be made to the above detailed description of the security protection system embodiment.

In addition, in order to better implement the security protection method in the embodiment of the present application, on the basis of the security protection method, the embodiment of the present application further provides an electronic device. Referring to FIG. 6 , FIG. 6 shows the electronic device of the embodiment of the present application. A schematic diagram of the structure. Specifically, the electronic device provided by the embodiment of the present application includes a security protection system 601, and the security protection system 601 is used to implement each step of the security protection method in any of the embodiments corresponding to FIG. 4 to FIG. 5 .

Exemplarily, the computer program may be divided into one or more modules/units, and one or more modules/units are executed by the security protection system 601 to complete the embodiments of the present application. One or more modules/units may be a series of computer program processor instruction segments capable of performing a specified function, and the processor instruction segments are used to describe the execution of the computer program in a computer apparatus.

The electronic device may include, but is not limited to, the security guard system 601 . Those skilled in the art can understand that the illustration is only an example of an electronic device, and does not constitute a limitation on the electronic device. It may include more components than the illustration, or combine some components, or different components. For example, the electronic device may also Including input and output devices, network access devices, buses, etc., the security protection system 601, input and output devices, and network access devices are connected through the bus.

Those skilled in the art can clearly understand that, for the convenience and brevity of the description, the specific working process of the electronic equipment and its corresponding units described above may refer to the description of the security protection method in any embodiment corresponding to FIG. 4 to FIG. 5 . , and details are not repeated here.

Those of ordinary skill in the art can understand that all or part of the steps in the various methods of the above embodiments can be completed by processor instructions, or by controlling relevant hardware by processor instructions, and the processor instructions can be stored in a computer. readable storage medium, and loaded and executed by a processor.

To this end, an embodiment of the present application provides a computer-readable storage medium, in which a plurality of instructions are stored, and the instructions can be loaded by a security protection system to execute the security protection in any of the embodiments corresponding to FIG. 4 to FIG. 5 of the present application. For the steps and specific operations in the method, reference may be made to the description of the security protection method in any of the embodiments corresponding to FIG. 4 to FIG. 5 , and details are not repeated here.

Since the instructions stored in the computer-readable storage medium can execute the steps in the security protection method in any of the embodiments corresponding to FIG. 4 to FIG. 5 of the present application, any implementation corresponding to FIG. 4 to FIG. 5 of the present application can be implemented. For the beneficial effects that can be achieved by the security protection method in the example, see the foregoing description for details, and will not be repeated here.

A security protection system, method, electronic device, and storage medium provided by the embodiments of the present application have been described in detail above. The principles and implementations of the present application are described with specific examples. The descriptions of the above embodiments are only It is used to help understand the method and the core idea of the present application; meanwhile, for those skilled in the art, according to the idea of the present application, there will be changes in the specific embodiments and application scope. In summary, this specification The content should not be construed as a limitation on this application.

Claims (10)

1. A safety protection system is characterized by comprising a processor, a safety protection module and a memory module, wherein the processor is in communication connection with the safety protection module;

the processor is used for sending a reading command to the safety protection module;

the memory module is used for storing a ciphertext to be read;

the security protection module is used for generating and decrypting the ciphertext to be read according to an initial key to obtain a plaintext to be read, wherein the initial key is generated according to the equipment information of the processor;

the processor is further configured to obtain the plaintext to be read from the security protection module.

2. The security protection system according to claim 1, wherein the security protection module comprises a key generation module, an encryption/decryption module, an external cache module and a command control module, the key generation module, the encryption/decryption module, the command control module and the external cache are sequentially connected in a communication manner, and the command control module is respectively connected in a communication manner with the memory module and the processor;

the key generation module is used for acquiring the equipment information and generating the initial key when the equipment is powered on;

the encryption and decryption module is used for acquiring the ciphertext to be read and decrypting the ciphertext to be read according to the initial key to obtain the plaintext to be read;

the external cache module is used for storing the plaintext to be read;

and the command control module is used for acquiring the reading command, reading and returning the plaintext to be read in the external cache module to the processor according to the reading command.

3. The security protection system of claim 2, wherein the security protection module further comprises an internal cache module, and the internal cache module is in communication connection with the memory module and the encryption and decryption module respectively;

the internal cache module is used for acquiring and storing the ciphertext to be read from the memory module, and inputting the ciphertext to be read into the encryption and decryption module when the encryption and decryption module receives the initial key.

4. The safety protection system according to claim 2, wherein the safety protection module further comprises an interface module, the interface module is respectively in communication connection with the processor, the memory module and the command control module, the read command carries processor timing information, and the read command is input to the interface module by the processor;

the interface module is used for generating a reading operation request according to the processor time sequence information, wherein the reading operation request is used for requesting to read a plaintext to be read in the external cache module.

5. The security protection system of claim 2, wherein the encryption and decryption module is further configured to:

performing iterative computation on the initial key to obtain and store an iterative key;

and decrypting the ciphertext to be read according to the iteration key to obtain the plaintext to be read.

6. The security system of claim 2, wherein the processor is further configured to send a write command to the security module, the write command carrying a plaintext to be written;

the command control module is further used for acquiring the write command;

the external cache module is also used for storing a plaintext to be written carried by the command to be written;

the encryption and decryption module is further used for encrypting the plaintext to be written according to the initial key to obtain a ciphertext to be written;

the memory module is also used for storing the ciphertext to be written.

7. A security protection method is applied to a security protection system, wherein the security protection system comprises a memory module and a processor, and the method comprises the following steps:

acquiring an initial key according to the equipment information of the processor;

decrypting the ciphertext to be read according to the initial key to obtain the plaintext to be read, wherein the ciphertext to be read is stored in the memory module;

and sending the plaintext to be read to the processor.

8. The method of safeguarding according to claim 7, further comprising:

acquiring a plaintext to be written input by the processor, and encrypting the plaintext to be written according to the initial key to obtain a ciphertext to be written;

and storing the cipher text to be written into the memory module.

9. An electronic device comprising a security system that performs the security method of any of claims 7 to 8 when it calls a computer program in the memory.

10. A computer-readable storage medium, having stored thereon a computer program which is loaded by a processor for performing the steps of the security method of any of claims 7 to 8.

Images