CN115296795A - A hybrid encryption information processing and communication on-chip system and method - Google Patents

Abstract

A system and a method for processing mixed encryption information and a communication chip are designed based on a hardware mixed encryption idea, adopt an SM2/SM3/SM4 encryption and decryption calculation method which accords with the national encryption standard, and have the characteristics of high encryption and decryption operation speed, no increase of the task burden of a processor, difficulty in being broken by violence and the like compared with the traditional information encryption method based on software. The method solves the problems that the task load of a processor is increased, the processor is easy to be attacked and cracked by hardware violence and the like in the traditional software-based information encryption method, is suitable for being applied to intelligent control systems in key fields of aerospace, intelligent power grids, high-speed rail ships and the like, and can also be popularized and applied to the commercial information security fields of intelligent gateways, intelligent door locks and the like.

Description

System and method on a hybrid encryption information processing and communication chip

technical field

The invention relates to a hybrid encrypted information processing and communication on-chip system and method, belonging to the technical field of information security.

Background technique

The development trend of modern control system networking, informatization, and intelligence has brought new security risks to information security. Whether it is an onboard control system, a smart grid control system, or a high-speed railway control system, once the information system is illegal Molecular attacks, destruction or even takeover will seriously threaten the safe operation of the entire system and even cause huge physical damage. Therefore, it is necessary to add encrypted information identification mechanism and file verification mechanism in the information system to enhance the information security protection ability of the control system.

The traditional software-based information encryption method has the characteristics of flexible design and low cost, but there are also disadvantages such as increased processor task load and easy hardware brute force attack and cracking. The invention proposes an information security-oriented on-chip system and method based on a hardware hybrid encryption algorithm, which has the characteristics of fast encryption and decryption operation speed, no increase in processor task burden, and difficult to be broken by violence.

Contents of the invention

The technical problem solved by the present invention is: to overcome the deficiencies of the prior art, to provide a mixed encryption information processing and communication on-chip system and method, which has the characteristics of fast encryption and decryption operation speed, no increase of processor task burden, and difficult to be broken by violence. . Further, the present invention solves the problems of the traditional software-based information encryption method, such as heavy processor task load, easy to be attacked and cracked by hardware violence, and the like.

The technical solution of the present invention is: a mixed encrypted information processing and communication system-on-chip, including a heterogeneous multi-core processor, a memory controller, a communication system, an encryption and decryption coprocessor, and a system bus;

The heterogeneous multi-core processor implements the process control and task scheduling of the mixed encryption information processing and communication of the system by executing the software of predetermined design steps;

The memory controller is used to store sent or received data and file information;

The communication system is used for sending or receiving encrypted data and file information between different modules;

The encryption and decryption coprocessor includes a true random number generator and an encryption and decryption module; the true random number generator is used to randomly generate an initial communication key, and the encryption and decryption module is used for encryption and decryption in compliance with commercial ciphers in information processing Normative calculations;

The system bus is used for data and file information transfer between modules.

Further, the true random number generator generates the initial key by means of physical thermal noise.

Further, there are several encryption and decryption modules, all of which are implemented by independent hardware logic that conforms to the national commercial encryption algorithm standard.

Further, the system bus adopts an implementation mechanism that supports internal security access methods of the system.

According to the identity authentication and data encryption communication method realized by the mixed encryption information processing and communication system-on-chip, it includes:

The sending node uses a true random number generator to randomly generate the communication key KEY1;

Prepare identity authentication information, use the first encryption and decryption algorithm to encrypt the communication data ID1 using the communication key KEY1, and obtain the encrypted identity authentication information ID2;

Using the second encryption and decryption algorithm to encrypt the communication key KEY1 to obtain KEY2;

Send the encrypted identity ID2 and key KEY2 to the receiving node through the communication system;

After receiving the identity authentication information, the receiving node uses the second encryption and decryption algorithm to decrypt KEY2 to obtain the communication key KEY1;

Using the first encryption and decryption algorithm to decrypt the encrypted identity ID2 using the communication key KEY1 to obtain the communication data ID1;

Judging that ID1 is a valid identity, add it to the communication network node.

Further, the first encryption and decryption algorithm is the SM4 algorithm, and the second encryption and decryption algorithm is the SM2 algorithm.

According to the described hybrid encryption information processing and communication system-on-chip implementation of data file validity communication and verification method, comprising:

Use a true random number generator to randomly generate the communication key KEY1;

Prepare the communication file FILE, and use the third encryption and decryption algorithm to generate the hash value HASH1 of the FILE;

Using the first encryption and decryption algorithm to encrypt the hash value HASH1 using the communication key KEY1 to obtain the encrypted hash value HASH2;

Using the second encryption and decryption algorithm to encrypt the communication key KEY1 to obtain KEY2;

Send the communication file FILE, encrypted hash value HASH2 and key HASH2 to the receiving node through the communication system;

After receiving the communication file, the receiving node uses the second encryption and decryption algorithm to decrypt KEY2 to obtain the communication key KEY1;

Using the first encryption and decryption algorithm to decrypt the encrypted hash value HASH2 using the communication key KEY1 to obtain the hash value HASH1;

The third encryption and decryption algorithm is used to check the received communication file FILE and the hash value HASH1. If they are consistent, the communication file is judged to be valid and can be used. If not, the communication file is invalid and cannot be used.

Further, the first encryption and decryption algorithm is the SM4 algorithm, the second encryption and decryption algorithm is the SM2 algorithm, and the third encryption and decryption algorithm is the SM3 algorithm.

A computer-readable storage medium, the computer-readable storage medium stores a computer program, and is characterized in that, when the computer program is executed by a processor, the identity authentication and data encryption communication method or the validity of the data file are realized The steps of the communication and verification method.

A hybrid encrypted information processing and communication device, comprising a memory, a processor, and a computer program stored in the memory and operable on the processor, characterized in that: the processor executes the computer program The step of implementing the identity authentication and data encryption communication method or the data file validity communication and verification method.

The advantage of the present invention compared with prior art is:

(1) The present invention integrates the hardware hybrid encryption and decryption coprocessor on the system-on-chip architecture. The encryption and decryption coprocessor includes a true random number generator, which ensures the true randomness of key generation. The unique SM2/SM3/SM4 encryption and decryption calculation method also ensures the versatility of the product;

(2) In the implementation method of information security in the present invention, the true random number generator and the SM2/SM3/SM4 encryption and decryption algorithm that meet the national secret standard are scheduled in an orderly manner, and identity authentication, data encryption communication and data file validity verification are realized. testing and other tasks.

Description of drawings

Fig. 1 is a schematic diagram of the principle of a hybrid encryption information processing and communication system-on-chip and method of the present invention;

Fig. 2 is a kind of hybrid encrypted information processing and communication on-chip system and method identity authentication and data encryption communication task flowchart of the present invention;

Fig. 3 is a flow chart of a hybrid encrypted information processing and communication system-on-a-chip and a method for verifying the validity of data files according to the present invention.

Detailed ways

In order to better understand the above technical solutions, the technical solutions of the present application will be described in detail below through the accompanying drawings and specific examples. It should be understood that the embodiments of the present application and the specific features in the examples are detailed descriptions of the technical solutions of the present application, and It is not a limitation to the technical solutions of the present application, and the embodiments of the present application and the technical features in the embodiments can be combined without conflict.

A hybrid encrypted information processing and communication on-chip system and method provided by the embodiment of the present application will be further described in detail below in conjunction with the accompanying drawings. The specific implementation methods may include (as shown in Figures 1-3): heterogeneous multi-core processors , memory controller, communication system, encryption and decryption coprocessor and system bus;

The heterogeneous multi-core processor realizes the process control and task scheduling of mixed encrypted information processing and communication of the system by executing the software of predetermined design steps; the memory controller is used to store the data and file information sent or received; the The communication system is used for sending or receiving encrypted data and file information between different modules; the encryption and decryption coprocessor includes a true random number generator and an encryption and decryption module; the true random number generator is used for randomly generating The initial communication key, the encryption and decryption module is used for calculation in accordance with commercial encryption and decryption specifications in information processing; the system bus is used for data and file information transfer between modules.

Further, in a possible implementation manner, the true random number generator implements an initial key satisfying independence and randomness by using a method of physical thermal noise.

Optionally, in a possible implementation manner, there are several encryption and decryption modules, all of which are implemented by independent hardware logic that conforms to the national commercial encryption algorithm standard.

Further, in a possible implementation manner, the system bus adopts an implementation mechanism that supports a secure access manner within the system.

In the solution provided by the embodiment of the present application, as shown in Figure 1, a schematic diagram of the principle of a mixed encryption information processing and communication system-on-chip and method of the present invention, the method of the present invention integrates a true random number generator inside the system-on-chip, conforming to the national Encryption standard SM2/SM3/SM4 encryption and decryption modules can complete the information security tasks of identity authentication, data encryption communication and data file validity verification. Below in conjunction with accompanying drawing, the method of the present invention is described in detail, as shown in Figure 2, the identity authentication and data encryption communication tasks of the present invention include the following steps:

Step 1. The sending node uses a true random number generator to randomly generate the communication key KEY1;

Step 2, preparing identity authentication information (data encryption communication process is the same), using SM4 algorithm to encrypt communication data ID1 using communication key KEY1, to obtain encrypted identity authentication information ID2;

Step 3, using the SM2 algorithm to encrypt the communication key KEY1 to obtain KEY2;

Step 4. Send the encrypted identity ID2 and key KEY2 to the receiving node through the communication system;

Step 5. After receiving the identity authentication information, the receiving node uses the SM2 algorithm to decrypt KEY2 to obtain the communication key KEY1;

Step 6, using the SM4 algorithm to decrypt the encrypted identity ID2 using the communication key KEY1 to obtain the communication data ID1;

Step 7, judging that ID1 is a valid identity, and adding it to the communication network node.

As shown in Figure 3, the data file validity verification task of the present invention comprises the following steps:

Step 1. Use a true random number generator to randomly generate the communication key KEY1;

Step 2, prepare the communication file FILE (communication instructions, data, images, files, etc., collectively referred to as files), and use the SM3 hash algorithm to generate the hash value HASH1 of the FILE;

Step 3. Use the SM4 algorithm to encrypt the hash value HASH1 using the communication key KEY1 to obtain the encrypted hash value HASH2;

Step 4, using the SM2 algorithm to encrypt the communication key KEY1 to obtain KEY2;

Step 5. Send the communication file FILE, the encrypted hash value HASH2 and the key HASH2 to the receiving node through the communication system;

Step 6. After receiving the communication file, the receiving node uses the SM2 algorithm to decrypt KEY2 to obtain the communication key KEY1;

Step 7. Use the SM4 algorithm to decrypt the encrypted hash value HASH2 using the communication key KEY1 to obtain the hash value HASH1;

Step 8: Check the received communication file FILE and the hash value HASH1 using the SM3 algorithm. If they are consistent, it is determined that the communication file is valid and can be used. If not, the communication file is invalid and cannot be used.

A mixed encryption information processing and communication on-chip system and method proposed by the present invention adopts the SM2/SM3/SM4 encryption and decryption calculation method that conforms to the national secret standard, and can not only be applied to key fields such as aerospace, smart grids, and high-speed rail ships. The control system can also be extended and applied to commercial information security fields such as smart gateways and smart door locks.

The present application provides a computer-readable storage medium, the computer-readable storage medium stores computer instructions, and when the computer instructions are run on a computer, the computer is made to execute the method described in FIG. 1 .

Those skilled in the art should understand that the embodiments of the present application may be provided as methods, systems, or computer program products. Accordingly, the present application may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present application may take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage and optical storage, etc.) having computer-usable program code embodied therein.

The present application is described with reference to flowcharts and/or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the present application. It should be understood that each procedure and/or block in the flowchart and/or block diagram, and a combination of procedures and/or blocks in the flowchart and/or block diagram can be realized by computer program instructions. These computer program instructions may be provided to a general purpose computer, special purpose computer, embedded processor, or processor of other programmable data processing equipment to produce a machine such that the instructions executed by the processor of the computer or other programmable data processing equipment produce a An apparatus for realizing the functions specified in one or more procedures of the flowchart and/or one or more blocks of the block diagram.

These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing apparatus to operate in a specific manner, such that the instructions stored in the computer-readable memory produce an article of manufacture comprising instruction means, the instructions The device realizes the function specified in one or more procedures of the flowchart and/or one or more blocks of the block diagram.

These computer program instructions can also be loaded onto a computer or other programmable data processing device, causing a series of operational steps to be performed on the computer or other programmable device to produce a computer-implemented process, thereby The instructions provide steps for implementing the functions specified in the flow chart or blocks of the flowchart and/or the block or blocks of the block diagrams.

It should be noted that in this article, relational terms such as first and second are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply that there is a relationship between these entities or operations. any such actual relationship or order exists between them. Furthermore, the term "comprises", "comprises" or any other variation thereof is intended to cover a non-exclusive inclusion such that a process, method, article, or apparatus comprising a set of elements includes not only those elements, but also includes elements not expressly listed. other elements of or also include elements inherent in such a process, method, article, or device.

Obviously, those skilled in the art can make various changes and modifications to the application without departing from the spirit and scope of the application. In this way, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalent technologies, the present application is also intended to include these modifications and variations.

The content that is not described in detail in the description of the present invention belongs to the well-known technology of those skilled in the art.

Claims (10)

1. A hybrid encryption information processing and communication system-on-a-chip, comprising: the system comprises a heterogeneous multi-core processor, a memory controller, a communication system, an encryption and decryption coprocessor and a system bus;

the heterogeneous multi-core processor realizes the process control and task scheduling of system hybrid encryption information processing and communication through software for executing a preset design step;

the memory controller is used for storing the transmitted or received data and file information;

the communication system is used for sending or receiving data and file information which are subjected to encryption processing among different modules;

the encryption and decryption coprocessor comprises a true random number generator and an encryption and decryption module; the true random number generator is used for randomly generating an initial communication key, and the encryption and decryption module is used for calculating the encryption and decryption specification of the commercial password in information processing;

and the system bus is used for transmitting data and file information among the modules.

2. The system-on-chip for hybrid cryptographic information processing and communication of claim 1, wherein: the true random number generator generates an initial key by adopting a physical thermal noise method.

3. The system-on-chip for hybrid cryptographic information processing and communication of claim 1, wherein: the encryption and decryption modules are provided with a plurality of modules and all are realized by adopting independent hardware logic which accords with the national commercial cryptographic algorithm standard.

4. The system-on-chip for hybrid cryptographic information processing and communication of claim 1, wherein: the system bus adopts an implementation mechanism supporting a system internal security access mode.

5. The method for hybrid encrypted information processing and communication system-on-a-chip identity authentication and data encryption communication according to claim 1, comprising:

the sending node randomly generates a communication KEY KEY1 by using a true random number generator;

preparing identity authentication information, and encrypting communication data ID1 by using a first encryption and decryption algorithm and a communication KEY KEY1 to obtain encrypted identity authentication information ID2;

encrypting the communication KEY KEY1 by adopting a second encryption and decryption algorithm to obtain KEY2;

sending the encrypted identity ID2 and the KEY KEY2 to a receiving node through a communication system;

after receiving the identity authentication information, the receiving node decrypts KEY2 by adopting a second encryption and decryption algorithm to obtain a communication KEY KEY1;

decrypting the encrypted identity ID2 by using a first encryption and decryption algorithm through a communication KEY KEY1 to obtain communication data ID1;

and judging that the ID1 is a valid identity, and adding the ID into the communication network node.

6. The method of claim 5, wherein: the first encryption and decryption algorithm is an SM4 algorithm, and the second encryption and decryption algorithm is an SM2 algorithm.

7. The method for communicating and verifying the validity of the data file, which is implemented by the hybrid encryption information processing and communication system on chip, according to claim 1, comprises:

randomly generating a communication KEY KEY1 by using a true random number generator;

preparing a communication FILE FILE, and generating a HASH value HASH1 of the FILE by adopting a third encryption and decryption algorithm;

encrypting the HASH value HASH1 by using a communication KEY KEY1 by adopting a first encryption and decryption algorithm to obtain an encrypted HASH value HASH2;

encrypting the communication KEY KEY1 by adopting a second encryption and decryption algorithm to obtain KEY2;

sending the communication FILE FILE, the encrypted HASH value HASH2 and the key HASH2 to a receiving node through a communication system;

after receiving the communication file, the receiving node decrypts the KEY2 by adopting a second encryption and decryption algorithm to obtain a communication KEY KEY1;

decrypting the encrypted HASH value HASH2 by adopting a first encryption and decryption algorithm by using a communication KEY KEY1 to obtain a HASH value HASH1;

and checking the received communication FILE FILE and the HASH value HASH1 by adopting a third encryption and decryption algorithm, if the received communication FILE FILE and the HASH value HASH1 are consistent, judging that the communication FILE is valid and can be adopted, and if the received communication FILE and the HASH value HASH are inconsistent, judging that the communication FILE is invalid and cannot be adopted.

8. The method of claim 7, wherein: the first encryption and decryption algorithm is an SM4 algorithm, the second encryption and decryption algorithm is an SM2 algorithm, and the third encryption and decryption algorithm is an SM3 algorithm.

9. A computer-readable storage medium, in which a computer program is stored which, when being executed by a processor, carries out the steps of the method according to any one of claims 5 to 8.

10. A hybrid encrypted information processing and communication device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: the processor, when executing the computer program, performs the steps of the method according to any one of claims 5 to 8.

Images