TW490611B - Encryption and decryption memory and access control method - Google Patents

Abstract

This invention is an encryption and decryption memory and access control method. It constructs an encryption controller in the memory like DRAM, SDRAM and SRAM and uses pre-defined specific encryption and decryption startup procedure to start the encryption controller. Usage of the encryption and decryption memory is like general memory before startup. After startup, data will be encrypted and decrypted by the encryption and decryption memory, and it changes any section of the stored address to the register area for storing the encryption and the decryption data. It makes the data encrypted or decrypted for system or peripherals to proceed access for preventing the memory location data from invasion of hacker or even that all peripherals are stolen to increase security of computer system.

Description

490611 A7 Description of the invention (1) Summary of the invention: The present invention relates to a kind of encryption and decryption memory and its access control party. It mainly constructs an encryption controller in the memory and encrypts or decrypts the data by reading and writing in the memory. Design of information. Printed by the Intellectual Property Bureau of the French Ministry of Economic Affairs and Consumer Cooperatives. Technical background: Today, more and more networks and systems are connected to the Internet. Anyone can access the office through an intranet or the Internet. The required data is stored in the hard disk drive, or it can be accessed twice. This makes the Internet link increasingly dangerous.: ,,, anyone can easily retrieve private data, including personal data, == data, E-letters and correspondence, etc., are formed-the beginning of non-privacy ends. For enterprises #, the threat to the security of their computer systems often comes from the employees they employ, without any further expertise, as long as they know how to use them. The lion unloaded and took away _, who in this county was purely reincarnated. The purpose of the Denizaki computer crime is often to steal the storage where it may be terminated. Therefore, the best solution is to encrypt the data of the disc, so that outsiders (1 ^ 〇1 ^ 1〇 take it away from the hard disk) Data, text). When it is clPer, the situation may also occur on other peripheral hard disks. The same, + + is forced to be installed, such as the network interface card (such as W〇rklnterfacecard; NIC), printer (buckle card order # 本The paper size applies the Ningguan Family Standard (CNS) A4 rule ^ Page 490611 A7 __B7 _ _ V. Description of the invention (>) Therefore, no matter what type of computer crime these devices are, it is the most difficult to defend. Hard disk data For access, as shown in the first figure, suppose c P U10 (Central Processing Unit) requests a data X from the hard disk 21. The data X will not be directly transferred from the hard disk 21 to the CPU 10, but will be written to the memory first. In the body 30 (illustrated by DRAM below) (such as route A), and then CPU 10 reads data X from DRAM 30 (such as route B). Similarly, as shown in the second figure, after CPU 10 processes data X, it also first The processed data is written into the DRAM 30C (such as route C), and then the hard disk 21 reads back the data X (such as route D) from the DRAM 30. Therefore, it can be known from the above that the DRAM 30 is a necessary path for any data flow between the peripheral device 20 (including the hard disk 21, etc.) and the system core 40. In other words, it can be a detection point. Therefore, we can imagine that the DRAM 30 can perform the following technical points: 1. After the data is transmitted from the peripheral device 20 to the system core 40, the data read by the system core 40 will be decrypted. 2. Before the data is transmitted from the system core 40 to the peripheral device 20, the data will be encrypted to protect against illegal hackers. Because of this, the main purpose of the present invention is to provide an encryption / decryption memory and an access control method thereof, which are mainly constructed in a memory (DRAM, SDRAM, SR AM net), and use a preset The special encryption and decryption startup program starts the encryption controller. Before the startup, the encryption and decryption memory is used like ordinary memory. After starting, the data will be interpreted. _ ^ _ Page 3 of 100__ The Zhang scale is applicable to China National Standard (CNS) A4 specifications (21 × 297 mm) '^ (Please read the precautions on the back before filling (This page) Order Printed by the Intellectual Property Bureau of the Ministry of Economic Affairs Employee Cooperatives 490611 A7 B7

V. Description of the invention (3) The secrets printed by the Consumer Cooperatives of the Intellectual Property Bureau of the Ministry of Economic Affairs = encryption and decryption of the memory body, and set the arbitrary-segment storage address of the money body to a temporary storage area to store the encryption and decryption data. Reading and writing makes the encrypted data encrypted or decrypted for access by the system or peripheral devices to prevent illegal intruders from cracking these memory location data, or even stealing the entire peripheral device to improve the security of the computer system. According to the foregoing, the DRAM architecture of the present invention includes a flash memory and an encryption controller. The flash memory system is used to store the encryption key and the addressing information after the encryption / decryption area is set. . The encryption controller is started by a special encryption and decryption startup program to perform the data stream encryption / decryption operation. According to the foregoing, this special startup program continuously repeats the read and write actions for any one of the same addresses in the memory for a period of time, and starts the encryption / decryption program. Because it only performs character stream encryption (Streajn Cipher), the encryption and decryption does not affect The delay caused by the timing can be regarded as a Real Time Operation, which can be read immediately after writing. The structure design and technical principle of the present invention will be described in detail below, and the features of the present invention will be further understood by referring to the attached drawings, wherein: Schematic diagram of the operation of reading data from the hard disk; The second picture shows the operation of storing data on the central processing unit by the central processor. 4 alfalfa, a total of 15 hundred paper sizes are applicable to the Chinese National Standard (CNS) A4 specification (210X297 mm) ) ΓΙ .------- Φ—— (Please read the notes on the back before filling in this page) Order AW. Bamboo U611 A7 V. Description of the invention (\ 10) Intent; The internal diagram of the decrypted memory. The fourth diagram is a schematic diagram of the operation of accessing data between the central processing unit and the hard disk of the present invention. The fifth diagram is a flowchart of the method of the present invention. Schematic drawing number description: cpu 20 peripheral devices 21 hard disk 30 memory (DRAM) system core 50 encryption and decryption memory (DRAM) 51 flash memory 52 encryption controller 53 control logic 54 interface register 55 memory Block 56 Encryption Register '丨 I: ------- ^ —— (Please read the precautions on the back before filling out this page} Nailed by the Intellectual Property Bureau of the Ministry of Economic Affairs, the Consumer Cooperatives printed i 5 alfalfa, Fang Bai Details: The present invention uses hardware and software technology to develop a special DRAM architecture. Using additional functional blocks combined with operating system (QS) or software control, the system can detect one or more of the DRAMs. In these areas, hard disk data will be accessible in these areas, and the encryption or decryption process in this area is executed by special startup. The number of encryption / decryption areas in these DRAMs depends on system design requirements. The encryption and decryption memory 50 (The following takes DRAM as an example) The architecture is as the third paper standard applicable to the Chinese National Standard (CNS) A4 specification (210 X297 mm) 490611 A7 B7 V. Description of the invention (jade) As shown in the figure, in this DRAM50 internal architecture The hair Compared with the ordinary DRAM30, two functional blocks of flash memory 5l (flash memory) and encryption controller 52 (encryption controller) are added. Among them, the flash memory 51 is used to store the following two important messages: 1. Unique encryption Encryption key. 2. After the encryption / decryption area is set (as described later), the addressing information generated by the system. The encryption controller 52 can be a stream cypher or a virtual random number generator (pSUd). 〇random generator) 'Perform the encryption / decryption operation according to the encryption / decryption area set by the software to provide the decrypted data for processing by the CPU 10, or store the encrypted data in the hard disk 21. In the encryption / decryption memory 50 of the present invention, The other components, as shown in the figure, are the control logic 53 for data flow access and flow direction control, the interface register 54 connected to the bus, and the memory block 55 for storing data, which are the same as the conventional DRAM 30, and will not be repeated here. The encryption / decryption area and the start of encryption / decryption execution are performed by the operating system or additional software programs to help determine the following key points: L Perform DRA The setting of the encryption / decryption area in M50. 2. After setting the encryption / decryption area, it must be determined that the area in this DRAM50 is not an address frequently accessed by the system, and then the result of the set encryption / decryption area (including Start and stop addresses) Write this paper to apply-(Please read the notes on the back before filling out this page)-Order printed by the Intellectual Property Bureau Employee Consumption Cooperative of the Ministry of Economy 490611 Print A7 B7 V. Description of the invention ($) blank areas, so that the encryption controller 52 can know the memory address area of the encryption / decryption. 3. Be responsible for the start and end control of the encryption / decryption program. 4. Direct the help data into the correct encryption / decryption area. According to the foregoing key points, the procedure for setting the DRAM memory address encryption / decryption and area is as follows. (The following examples are explained with the hard disk as an example.) The hard disk 21 we want to protect and related to the hard disk All data will only access the 4 areas of the memory address. The setting procedure of each area is as follows: 1. Decide which area (area 1, area 2, area 3, or area 4). 〇2. Select Enable ) Or disable (disable) area; if the system requires all 4 areas to remain activated, the software's operating system will be able to dynamically detect, otherwise some areas will be stopped. 3. Decide the starting address of the encryption / decryption area. 4. Decide on the size of the encryption / decryption area. 5. Choose to perform an encryption or decryption action. When the operating system or software program completes the above tasks, it will find a memory address in the memory address that is not frequently accessed by the system and change it to an encryption register 56. The system must also decide which encryption / decryption operation to use Rules (such as RSA, ECC), and then the set result and the determined algorithm are stored in the encryption register 56. __Blue_7 alfalfa, 萁 忾 100 paper sizes are applicable to China National Standard (CNS) A4 specifications (210X297 mm) ^-, ---- * Order ------ 0— (Please read the back first Please note this page to fill in this page) Bamboo U611 A7 V. Description of the invention (VII) In addition, the present invention sets a bit in the encryption register 56 as the terininate setting of the encryption / decryption program. Please read the notes on the back of the% before filling in this page. Because DRAM50 is a volatile memory, the data temporarily stored in the DRAM will disappear when the system is powered off, and the above settings of the present invention will be stored in the above-mentioned additional DRAM50. It is set in the cache memory 51, so when the power is turned on again, it is not necessary to perform the above setting steps again. 0 The present invention provides a special encryption or decryption startup method, which uses a preset special encryption and decryption startup program to control startup. If this special encryption or decryption startup method is not started, the DRAM 50 will have no encryption or decryption action. While maintaining the use function of general memory, the use of encryption and decryption memory is just like ordinary memory access, and no encryption and decryption action will occur. For example, the startup mode of this program will be activated in the following types: # L Only when the operating system or software program command system continuously repeats "read, read, write" to any one of the same addresses in the memory Encryption / decryption is activated multiple times (such as 256 times or replaced by another large value). 2. Continuously read and write a specific content type to the address. If the content of the address is 10101010, the encryption / decryption process is started. 3. In both cases, the encryption and decryption function is activated. When the special encryption / decryption function is activated, the encryption controller 52 instructs the encryption controller 52 to store the previously set memory T family standard (cns) A4 specification (490611 V. Description of the invention (/,? Bit, All data is encrypted or decrypted. It is worthy of note. It is controlled by the hardware Lrj system or software program. 'Long 1 — dye itself. In addition, the encryption controller 52 is only a character encryption and decryption does not affect the timing. The delay can be regarded as an instant = Operation). Immediately after writing, the data can be matched to the DRAM50 according to the example shown in the fourth figure. Area (as shown in the first and third decryption areas KM, A3), that is to say, data !, it is encrypted when it is sent out, but it will be completed before it arrives at coffee 0, and it is waiting for the system to read Conversely, when the system wants to write data into DRAM50, the software or software program will first point the data to the encrypted area (as shown in the figure, and the 4th and 4th encrypted areas A2 and A4). The system verified that k is not encrypted However, the hard disk storage has been completed before reaching the intestine M50. Danda printed back to the Intellectual Property Bureau of the Ministry of Economic Affairs, Employee Consumer Cooperative printed this invention, giving the rider the right to decide to end encryption or decryption by issuing an order to the operating system or software program The encryption is temporarily preset to control the bit setting of the encryption / decryption program (dis ^ l °, and then the general memory usage function is changed. 6 The method of the present invention can be summarized as follows (as shown in the fifth figure a · work The system or software program determines the memory address area, and β 〇 becomes the encryption register 56; χ, ', ^, and

丄 ⑺ 一-亘 亘, go to PF This paper size applies the Chinese National Standard (CNS) A4 specification (2 × 297 × 297 mm) 490611 Printed by the Consumer Cooperatives of the Intellectual Property Bureau of the Ministry of Economic Affairs Β7 V. Description of invention (it) b · Set the selection area; c. Determine the start address and size of the area; d. Decide to perform the encryption or decryption operation; for example, in the second area, data is transmitted from the hard disk to the DRAM50, and then from the DRAM50 to the CPU10, then the second The area A2 will be decided to perform a decryption job. e. Store the result set in steps a to d to the encryption register, and select the algorithm (RSA, ECC). f. Detect whether a special encryption / decryption function program is started (such as continuously repeating read, read, and write actions for any same address in the memory 256 or more times, or if the content of the address is some specific Type is 10101010, or when both of the above situations occur) S. After step f is started, the data is encrypted or decrypted, and the data is temporarily stored in the previously set encryption or decryption area, and then the encrypted data is transmitted to The hard disk 21 stores or transmits the decrypted data to the CPU 10; 'h · issues a command to the bit of the encryption register 56 preset to control the encryption / decryption program to end the encryption / decryption action; 1. If step f is not started Or the termination setting of step h, DRAM50 will revert to normal function memory use. In summary, the advantages of the present invention are as follows: Since the data in the memory undergoes a process of encryption and decryption, illegal intruders cannot directly intrude, so that the illegal intruders must be forced through normal operations. I — ^ ------- 0 ------- 1Τ ------ ^ 9— (Please read the notes on the back before filling this page)

I _ A7 V. Description of the invention (ten) System (OS) program to retrieve data, and the existing security technology through the normal operating program is extremely easy to detect, so the invention can indeed protect the memory data from being destroyed . 2. The security memory is completely the same as the general memory pins, and can be directly inserted into the slot of the motherboard. It can increase the security capability of the existing computer without replacing any equipment. In summary, the encryption and decryption memory and the access method provided by the present invention can form data to be encrypted or decrypted by reading and writing in the memory, preventing illegal intruders from cracking these memory location data, and even Stealing the entire peripheral device to improve computing security; propose effective solutions and countermeasures for the lack of stolen data of traditional systems that can be easily dismantled by the device. It has indeed met the requirements for the creation of patent applications. Thanks to the patents for the benefit of people's livelihood ^, it really feels good. Only the techniques, illustrations, programs, or control methods described on Xinwei Γ are just the best practices recorded in this publication. They are all examples. All technical details according to the scope of the present patent are mixed. Fan Buyue b, which is still covered by the patent right of the present invention, defines the scope of implementation of the present invention accordingly. This paper size applies the Chinese National Standard (CNS) A4 specification (2 × 297 mm) 丨-(Please read the precautions on the back before filling this page)

Hu

Claims (1)

^ 0611 A8 B8 C8 D8, patent application scope, patent application scope: 1. A kind of encryption and decryption memory, which contains an encryption, and the second: the security controller system "system or extraneous ^" to the memory out of the encrypted area, decryption Area and control the start and stop of fee increase / decryption operations. The flash memory system stores unique encryption keys and addressing information generated after the encryption / decryption domain is set; the aforementioned encrypted memory system is encrypted / ^ Launched by the startup program to enable the encrypted data sent by the peripheral device: before reaching the 5th memory, it will complete the decryption and wait for the system to read and use the unencrypted data written to the memory by the system. Fancheng will send it back to the peripheral device for storage to prevent the important data from being exposed when the peripheral device is stolen or the system is invaded. 2. The encryption and decryption memory described in item 1 of the scope of patent application, the encryption control in 1 It is a character stream encryptor or a virtual random number generator for data encryption or decryption. 3. The encryption / decryption memory according to item 1 of the patent scope, wherein the ^ 狯 / decryption startup program is The operating system or software program command ^ continuously read, write, repeat, predicate, write 256 or more times for any of the same address in memory, then start the encryption / decryption sequence ... 4 · Τ Declaring the encryption and decryption memory described in item 1 of the patent scope, wherein the 2 ^ i decryption startup program is in the operating system or software program command system, and the content of any address is continuously read / written as some Specific paper sizes are applicable in --------, quasi (CNS) Α4 specifications (5 pages in Ghergong Township, 2 counties ---------- m — ^ i 1 · ----- 1 ϋϋ m I d '(Please read the notes, IT, I d. 0 --------------- v ^ VJl v ^ VJl When the consumer cooperative of the Intellectual Property Bureau of the Ministry of Economic Affairs prints A8 B8 C8 D8 when applying for a patent application (such as 10101010), the encryption / decryption process is started. 5. If = please ask for the encryption / decryption memory described in item 1 of the patent scope, The encryption / decryption activation program starts the encryption / decryption program when the aforementioned items 3 and 4 are issued. X, 6. · Please refer to the encryption and decryption memory described in item 1 of the patent scope. Among them, the register is provided with a bit as the termination setting of the encryption / decryption program. 7. The encryption and decryption memory as described in the first item of Shenyan's patent scope, in which the memory system is DRAM, SDRAM, SRAM, etc. ~ 8: If the encryption / decryption memory described in item 1 of the patent scope is requested, the encryption / decryption program is used as a functional memory before starting or stopping. 9. A kind of encryption / decryption memory A control method, wherein the operating system 戋 software program setting of the encrypted memory includes the following steps: 〆a • determine the memory address section in the memory and convert it into an encrypted register;. B. Setting the selection area ; C. Determine the starting address and size of the area; d, determine the encryption and decryption operations in each area according to the data transmission path; ^ the results set in steps a to d have been stored in the encryption register, and the algorithm is selected . " f · Detect whether the special encryption / decryption function is enabled; This paper is SJ home standard (CNS) (public _ (Please read the precautions on the back before filling this page) Scope of patent application g • After step f is started, the encrypted data stored in the aforementioned settings is decrypted; the data is accessed by peripheral devices. —In the solution area, for the system or 10 · As in Item 9 of the scope of the patent application 1 ^ where the setting ㈣e refers to the operation of encryption and decryption, the control element is preset to control the encryption / decryption program. Order to end the encryption / decryption order) Λ4ΛΤ2ΪΙ Χ29 你 厘,)]