WO2017143744A1 - 一种总线分级加密系统 - Google Patents

一种总线分级加密系统 Download PDF

Info

Publication number
WO2017143744A1
WO2017143744A1 PCT/CN2016/096288 CN2016096288W WO2017143744A1 WO 2017143744 A1 WO2017143744 A1 WO 2017143744A1 CN 2016096288 W CN2016096288 W CN 2016096288W WO 2017143744 A1 WO2017143744 A1 WO 2017143744A1
Authority
WO
WIPO (PCT)
Prior art keywords
bus
encryption
decryption
ciphertext
algorithm
Prior art date
Application number
PCT/CN2016/096288
Other languages
English (en)
French (fr)
Inventor
胡翠
檀珠峰
孙少杰
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Publication of WO2017143744A1 publication Critical patent/WO2017143744A1/zh
Priority to US16/111,228 priority Critical patent/US10943020B2/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/06—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols the encryption apparatus using shift registers or memories for block-wise or stream coding, e.g. DES systems or RC4; Hash functions; Pseudorandom sequence generators
    • H04L9/065—Encryption by serially and continuously modifying data stream elements, e.g. stream cipher systems, RC4, SEAL or A5/3
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/606—Protecting data by securing the transmission between two devices or processes
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/30—Payment architectures, schemes or protocols characterised by the use of specific devices or networks
    • G06Q20/32—Payment architectures, schemes or protocols characterised by the use of specific devices or networks using wireless devices
    • G06Q20/322—Aspects of commerce using mobile devices [M-devices]
    • G06Q20/3227—Aspects of commerce using mobile devices [M-devices] using secure elements embedded in M-devices
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/602—Providing cryptographic facilities or services
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/70—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer
    • G06F21/82—Protecting input, output or interconnection devices
    • G06F21/85—Protecting input, output or interconnection devices interconnection devices, e.g. bus-connected or in-line devices
    • G—PHYSICS
    • G07—CHECKING-DEVICES
    • G07F—COIN-FREED OR LIKE APPARATUS
    • G07F7/00—Mechanisms actuated by objects other than coins to free or to actuate vending, hiring, coin or paper currency dispensing or refunding apparatus
    • G07F7/08—Mechanisms actuated by objects other than coins to free or to actuate vending, hiring, coin or paper currency dispensing or refunding apparatus by coded identity card or credit card or other personal identification means
    • G07F7/0806—Details of the card
    • G07F7/0833—Card having specific functional components
    • G07F7/084—Additional components relating to data transfer and storing, e.g. error detection, self-diagnosis
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/06—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols the encryption apparatus using shift registers or memories for block-wise or stream coding, e.g. DES systems or RC4; Hash functions; Pseudorandom sequence generators
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/06—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols the encryption apparatus using shift registers or memories for block-wise or stream coding, e.g. DES systems or RC4; Hash functions; Pseudorandom sequence generators
    • H04L9/065—Encryption by serially and continuously modifying data stream elements, e.g. stream cipher systems, RC4, SEAL or A5/3
    • H04L9/0656—Pseudorandom key sequence combined element-for-element with data sequence, e.g. one-time-pad [OTP] or Vernam's cipher
    • H04L9/0662—Pseudorandom key sequence combined element-for-element with data sequence, e.g. one-time-pad [OTP] or Vernam's cipher with particular pseudorandom sequence generator
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0861—Generation of secret information including derivation or calculation of cryptographic keys or passwords
    • H04L9/0869—Generation of secret information including derivation or calculation of cryptographic keys or passwords involving random numbers or seeds
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/12—Transmitting and receiving encryption devices synchronised or initially set up in a particular manner
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q2220/00—Business processing using cryptography

Definitions

  • the present invention relates to the field of system security technologies, and in particular, to a bus hierarchical encryption system.
  • the existing solution 1 is shown in FIG. 1 , and all modules are hung on the same high-performance bus (AHB) bus.
  • These modules include security modules, such as cryptographic algorithm units and storage units. Etc., and common modules, such as interface units, watchdog units, and so on.
  • the security module is not physically isolated from the normal module in data transmission.
  • the secret data therein can be obtained by an attacker, and the security is not high. Specifically, when an attacker uses a probe to attack, the data transmitted on the AHB bus can be acquired, and the key is obtained according to the acquired data. If the transmission data on the bus is encrypted, the non-confidential data of the normal module will also be encrypted together, which will affect the performance of the product.
  • the existing scheme 2 proposes a two-level bus scheme to fully utilize the bus system provided by the central processing unit.
  • the secondary bus is used, which is an AHB bus and an Advanced Peripheral Bus (APB) bus, and the modules are classified and classified.
  • AHB Advanced Peripheral Bus
  • the modules are classified and classified.
  • APB Advanced Peripheral Bus
  • the secondary bus scheme is adopted, and if the transmission data is not cryptographically protected, the attacker may use the analysis to derive the key. If the transmission data on the bus is encrypted, the non-confidential data of the normal module will also be encrypted together, which affects the performance of the product. Similarly, the security module is not physically isolated from the normal module data transmission, but only differentiates the data transmission rate requirements, and does not fully utilize the bus according to the security of each module.
  • the purpose of the embodiments of the present invention is to provide a bus hierarchical encryption system to solve the problem that the security module is not physically isolated from the data transmission of the ordinary module, and the bus is not fully utilized according to the security of each module.
  • a bus hierarchical encryption system includes: at least two buses including a first bus and a second bus, an encryption and decryption system corresponding to each bus, and at least one signal processing module corresponding to each bus And a bus converter coupled between the first bus and the second bus;
  • a first signal processing module corresponding to the first bus configured to perform data through the first bus, the bus converter, and the second bus, and the second signal processing module corresponding to the second bus Communication
  • a first encryption and decryption system corresponding to the first bus, configured to perform encryption processing on the first data transmitted on the first bus based on the first encryption algorithm
  • a second encryption and decryption system corresponding to the second bus, configured to perform encryption processing on the second data transmitted on the second bus based on the second encryption algorithm
  • the bus converter is configured to serve as an interface between the first data and the second data Adapting the first bus and the second bus;
  • the first encryption algorithm corresponds to a first security level
  • the second encryption algorithm corresponds to a second security level
  • the first security level and the second security level are different.
  • the first encryption and decryption system includes:
  • a first encryption and decryption unit coupled to the first signal processing module, when receiving the first data including the first plaintext sent by the first signal processing module to the second signal processing module, Encrypting the first data including the first plaintext based on the first encryption algorithm to obtain the first data including the first ciphertext, and passing the first data including the first ciphertext
  • the first bus is forwarded to the bus converter.
  • the second encryption and decryption system includes:
  • a second encryption and decryption unit coupled to the bus converter, configured to receive the first ciphertext included by the bus converter after converting the first data including the first ciphertext Two data, performing encryption based on the second encryption algorithm and decryption based on the first decryption algorithm on the second data including the first ciphertext to obtain the second data including the second ciphertext, and Transmitting the second data including the second ciphertext on the second bus;
  • a third encryption and decryption unit coupled to the second signal processing module, configured to receive the second data including the second ciphertext from the second bus, to the The second data is subjected to decryption based on the second decryption algorithm to obtain second data including the first plaintext required by the second signal processing module;
  • the first decryption algorithm matches the first encryption algorithm; the second decryption algorithm matches the second encryption algorithm.
  • the second encryption and decryption system includes:
  • a second encryption and decryption unit coupled to the bus converter, configured to receive the first ciphertext included by the bus converter after converting the first data including the first ciphertext Two data, performing the adding of the second data including the first ciphertext based on the second encryption algorithm Encrypting to obtain the second data including the third ciphertext, and transmitting the second data including the third ciphertext on the second bus;
  • a third encryption and decryption unit coupled to the second signal processing module, configured to receive the second data including the third ciphertext from the second bus, to the The second data is subjected to decryption based on the first decryption algorithm and the second decryption algorithm to obtain second data including the first plaintext required by the second signal processing module;
  • the first decryption algorithm matches the first encryption algorithm; the second decryption algorithm matches the second encryption algorithm.
  • the bus converter includes: an encryption/decryption conversion unit, configured to: include the first ciphertext The first data is converted to the second data including the first ciphertext, and the second data including the first ciphertext is encrypted and based on the second encryption algorithm. Decrypting the first decryption algorithm to obtain the second data including the second ciphertext, and transmitting the second data including the second ciphertext on the second bus;
  • the second encryption and decryption system includes:
  • a third encryption and decryption unit coupled to the second signal processing module, configured to receive the second data including the second ciphertext from the second bus, to the The second data is subjected to decryption based on the second decryption algorithm to obtain second data including the first plaintext required by the second signal processing module;
  • the first decryption algorithm matches the first encryption algorithm; the second decryption algorithm matches the second encryption algorithm.
  • the first encryption and decryption system further includes: a fourth encryption and decryption unit;
  • the first encryption and decryption unit is further configured to: when receiving, by the first signal processing module, the first data including the second plaintext of the third signal processing module corresponding to the first bus, Encrypting the first data including the second plaintext based on the first encryption algorithm to obtain the first data including the fourth ciphertext, and passing the first data including the fourth ciphertext Said Transmitting, by the first bus, to the fourth encryption and decryption unit;
  • the fourth encryption and decryption unit is configured to perform decryption based on the first decryption algorithm on the first data including the fourth ciphertext to obtain the first content including the second plaintext required by the third signal processing module a data; the first decryption algorithm matches the first encryption algorithm.
  • system further includes: at least one random number generator, configured to generate each encryption and decryption system and Each encryption/decryption conversion unit performs at least one key of a set of cryptographic algorithms used for encryption or decryption.
  • At least one of the first bus and the second bus is: a high performance bus AHB, The advanced peripheral bus APB, or at least one bus in the advanced system bus ASB.
  • the at least one signal processing module corresponding to each bus includes: a signal processing unit, a storage unit, and a random number At least one of a generator, a cryptographic algorithm unit, an interface unit, a clock unit, or a watchdog unit.
  • the system is applied to the field of mobile payment.
  • a bus grading encryption method includes:
  • the second data including the second ciphertext is decrypted by the second decryption algorithm by the third encryption and decryption unit to obtain second data including the first plaintext.
  • a bus grading encryption method includes:
  • the second encryption and decryption unit Performing, by the second encryption and decryption unit, the second data including the first ciphertext by using the second encryption algorithm to obtain the second data including the third ciphertext;
  • the second data including the third ciphertext is decrypted by the third encryption and decryption unit based on the first decryption algorithm and the second decryption algorithm to obtain second data including the first plaintext.
  • At least one of the first bus and the second bus is: a high performance bus AHB, an advanced peripheral bus APB, or is in an advanced system bus ASB At least one bus.
  • the bus hierarchical encryption system in the embodiment of the present invention includes: at least two buses including a first bus and a second bus, an encryption and decryption system corresponding to each bus, and at least one signal processing module corresponding to each bus, and
  • the bus converter coupled between the first bus and the second bus uses the system provided in the embodiment of the present invention to specifically encrypt each module that needs to transmit data on the bus, thereby ensuring high security of some modules. It also guarantees the high speed of some modules.
  • Each module is hung on different levels of bus according to security, physically isolating the security data and common data. Since the data transmitted on the bus is encrypted data, even if the attacker obtains the bus data by using the probe attack, it is difficult. Cracking the key can enhance the system's anti-attack capability.
  • FIG. 1 is a schematic diagram showing a connection relationship between a bus and a module in the background art of the present invention
  • FIG. 2 is a schematic diagram showing a connection relationship between a bus and a module in a two-level bus scheme in the background art of the present invention
  • FIG. 3 is a schematic structural diagram of a bus hierarchical encryption system according to an embodiment of the present invention.
  • FIG. 4 is a schematic structural diagram of a bus hierarchical encryption system according to an embodiment of the present invention.
  • FIG. 5 is a second schematic structural diagram of a bus hierarchical encryption system according to an embodiment of the present invention.
  • the embodiment of the invention provides a bus hierarchical encryption system, which is used to solve the problem that the data transmission between the security module and the ordinary module is not physically isolated, and the bus is not fully utilized according to the security of each module.
  • the method and the device are based on the same inventive concept. Since the principles of the method and the device for solving the problem are similar, the implementation of the device and the method can be referred to each other, and the repeated description is not repeated.
  • an embodiment of the present invention provides a bus hierarchical encryption system, including: at least two buses including a first bus and a second bus, an encryption and decryption system corresponding to each bus, and each bus Corresponding at least one signal processing module, and a bus converter coupled between the first bus and the second bus.
  • the at least one of the first bus and the second bus is: AHB, APB, or at least one bus in an Advanced System Bus (ASB).
  • the bus combination in the bus grading encryption system can be AHB+APB, or ASB+APB, or AHB+APB1+APB2. Or ASB+APB1+APB2, etc.
  • At least one signal processing module corresponding to each bus comprising: at least one of a signal processing unit, a storage unit, a random number generator, a cryptographic algorithm unit, an interface unit, a clock unit, or a watchdog unit.
  • the first signal processing module corresponding to the first bus is configured to perform data communication with the second signal processing module corresponding to the second bus via the first bus, the bus converter and the second bus.
  • Each signal processing module presets a preset security level, and the signal processing modules of different security levels are hung on the bus corresponding to the security level. Therefore, the first bus has the same security level as the first signal processing module.
  • the second bus has the same level of security as the second signal processing module.
  • each signal processing module is set to a first security level, a second security level, and a third security level according to security requirements, and correspondingly, each bus is set to a first security level, a second security level, and a third security. level.
  • the signal processing module is divided into two security levels, that is, a high-level module and a normal module, and the two buses also correspond to two security levels, that is, a high-level bus and a normal bus.
  • the signal processing modules in the eSE are classified into two types according to their security: a high security module and a low security module, wherein the AHB is a high security bus, and the APB is a low security module, and the high security module is Hanging on the AHB, such as a signal processing unit, a storage unit, a random number generating unit, a cryptographic algorithm unit, etc., the low security module is hung on the APB, such as an interface unit, a clock unit, a watchdog unit, and the like.
  • the AHB is a high security bus
  • the APB is a low security module
  • Hanging on the AHB such as a signal processing unit, a storage unit, a random number generating unit, a cryptographic algorithm unit, etc.
  • the low security module is hung on the APB, such as an interface unit, a clock unit, a watchdog unit, and the like.
  • a first encryption and decryption system corresponding to the first bus, configured to perform encryption processing on the first data transmitted on the first bus based on the first encryption algorithm.
  • the data transmitted on the first bus is collectively referred to as the first data.
  • the first encryption and decryption system includes:
  • the first encryption and decryption unit is coupled to the first signal processing module, configured to: when receiving the first data including the first plaintext sent by the first signal processing module to the second signal processing module, the first information including the first plaintext
  • the data is encrypted based on the first encryption algorithm to obtain first data including the first ciphertext, and the first data including the first ciphertext is forwarded to the bus converter via the first bus.
  • the first signal processing module before the first signal processing module encrypts the first data including the first plaintext that needs to be transmitted by using the first encryption and decryption unit, the first signal processing module needs to acquire the bus resource of the first bus.
  • the manner in which the first module obtains the bus resource of the first bus may include the following two methods, but is not limited to the following two methods:
  • the first signal processing module sends a transmission request to a central processing unit (CPU), and the first signal processing module receives the bus resource of the first bus allocated by the CPU.
  • CPU central processing unit
  • the first signal processing module sends a transmission request to a direct memory access (DMA), and the first signal processing module receives the bus resource of the first bus allocated by the DMA.
  • DMA direct memory access
  • the first signal processing module receives the encryption control instruction sent by the preset hardware or the preset software, where the encryption control instruction is used.
  • the first signal processing module is instructed to send the first data including the first plaintext to the first encryption and decryption unit for encryption.
  • the default hardware here can be CPU or DMA.
  • a second encryption and decryption system corresponding to the second bus, configured to perform encryption processing on the second data transmitted on the second bus based on the second encryption algorithm.
  • the data transmitted on the second bus is collectively referred to as the second data.
  • the first encryption algorithm here corresponds to the first security level
  • the second encryption algorithm corresponds to the second security level, the first security level and the second security level being different.
  • the first bus has the same security level as the first signal processing module, the first encryption and decryption system, and the first encryption algorithm, the second bus, the second signal processing module, the second encryption and decryption system, and the second encryption.
  • the algorithm has the same level of security.
  • the second encryption and decryption system includes: a second encryption and decryption unit and a third encryption and decryption unit.
  • the second encryption and decryption unit and the third encryption and decryption unit in the second encryption and decryption system have at least the following two possible implementation manners.
  • a second encryption and decryption unit coupled to the bus converter for receiving the bus converter pair including the first
  • the first data of the ciphertext is converted into the second data including the first ciphertext, and the second data including the first ciphertext is subjected to encryption based on the second encryption algorithm and decryption based on the first decryption algorithm to obtain the inclusion.
  • the second data of the second ciphertext and the second data containing the second ciphertext are transmitted on the second bus.
  • a third encryption and decryption unit coupled to the second signal processing module, configured to receive second data including the second ciphertext from the second bus, and perform decryption based on the second decryption algorithm on the second data that includes the second ciphertext Obtaining second data including the first plaintext required by the second signal processing module.
  • the first decryption algorithm matches the first encryption algorithm
  • the second decryption algorithm matches the second encryption algorithm. If the encryption algorithm and the decryption algorithm match, the data encrypted by the encryption algorithm can be decrypted by the corresponding decryption algorithm.
  • a second encryption and decryption unit coupled to the bus converter, configured to receive, by the bus converter, the second data including the first ciphertext obtained by converting the first data including the first ciphertext, and the second ciphertext containing the first ciphertext
  • the second data is subjected to encryption based on the second encryption algorithm to obtain second data including the third ciphertext, and the second data including the third ciphertext is transmitted on the second bus.
  • a third encryption and decryption unit coupled to the second signal processing module, configured to receive second data including the third ciphertext from the second bus, and perform second data based on the first decryption algorithm and the second data Decryption of the decryption algorithm to obtain second data containing the first plaintext required by the second signal processing module.
  • the first decryption algorithm matches the first encryption algorithm
  • the second decryption algorithm matches the second encryption algorithm
  • the third encryption and decryption unit receives the preset hardware or the preset Setting a decryption control instruction sent by the software, the decryption control instruction is used to instruct the third encryption and decryption unit to decrypt the second data including the second ciphertext or the third ciphertext into the second data including the first plaintext, and send the data to the first Two signal processing units.
  • the third encryption and decryption unit performs integrity verification on the second data including the second ciphertext or the third ciphertext. If the integrity check of the second data including the second ciphertext or the third ciphertext is determined to pass, the second data including the second ciphertext or the third ciphertext is decrypted.
  • the first signal processing module sends the first plaintext to the second signal processing module, where the first encryption and decryption unit encrypts the first data including the first plaintext by using the first encryption algorithm.
  • the first data of the first ciphertext is included, and at the same time, the first parity data is calculated by using the first ciphertext.
  • the first data including the first ciphertext is converted into the second data including the first ciphertext by the bus converter, and the second data including the first ciphertext is used to be based on the second encryption algorithm by the second encryption and decryption unit Encrypting to obtain the second data including the third ciphertext, and simultaneously calculating a second parity data by using the third ciphertext, and when the third encryption and decryption unit receives the second data including the third ciphertext, passing the first school Verifying the data and the second check data, performing integrity check on the second data including the third ciphertext, and continuing to decrypt the second data including the third ciphertext if the integrity check is performed, if the integrity check is not passed , an alarm is issued and the bus encryption system is reset.
  • the first encryption and decryption system and the second encryption and decryption system mentioned above are both systems for encrypting and decrypting transmission data on the bus. Therefore, such a system is directly coupled to the corresponding bus and is responsible for the data transmission security of the bus.
  • the existing encryption and decryption technologies are mostly responsible for a specific type of service, that is, for encrypting a certain type of specific service data (service layer encryption and decryption).
  • service layer encryption and decryption For example, a certain type of data generated by a CPU or Digital Signal Processing (DSP), such as identity authentication information, usually needs to be encrypted.
  • DSP Digital Signal Processing
  • such a system may not be responsible for a particular type of service or data, but is directly responsible for the bus, and performs encryption and decryption on multiple types of data or multiple service data transmitted on the corresponding bus. Therefore, the encrypted data may already be ciphertext data, that is, data that has been encrypted and decrypted by the service layer.
  • the signal processing module A on the AHB needs to send the first plaintext to the signal processing module B on the APB, and the first encryption and decryption unit in the first encryption and decryption system corresponding to the AHB is coupled to the signal processing module A, and receives the signal.
  • the processing module A sends the first data including the first plaintext to the signal processing module B
  • the first data including the first plaintext is encrypted by using a first encryption algorithm
  • the first data including the first ciphertext is obtained
  • the first data containing the first ciphertext is sent to the bus converter via the AHB.
  • the first encryption algorithm may adopt a simplified Advanced Encryption Standard (AES) encryption algorithm.
  • AES Advanced Encryption Standard
  • the bus converter converts the first data containing the first ciphertext into the second data containing the first ciphertext.
  • the second encryption and decryption unit in the second encryption and decryption system corresponding to the APB is coupled to the bus converter, and after receiving the second data including the first ciphertext converted by the bus converter, The second data including the first ciphertext is encrypted based on the second encryption algorithm, and decrypted based on the first decryption algorithm to obtain second data including the second ciphertext, which is transmitted on the APB.
  • the first method of encryption and decryption is to avoid explicit exposure and ensure that the transmitted data is more secure.
  • the first decryption algorithm may correspond to a simplified AES decryption algorithm, that is, only three rounds of AES algorithm iterative operations, and the specific number of rounds may be comprehensively determined according to security and performance requirements.
  • the second encryption algorithm may use a permutation in a Data Encryption Standard (DES) algorithm:
  • DES Data Encryption Standard
  • the third encryption and decryption unit in the second encryption and decryption system is coupled to the signal processing module B for receiving the second data including the second ciphertext from the APB, and the second data including the second ciphertext is based on the second decryption algorithm.
  • the decryption obtains the second data containing the first plaintext and forwards it to the signal processing module B.
  • the second decryption algorithm corresponds to an inverse permutation in the DES algorithm:
  • the complexity and the cracking difficulty of the first cryptographic algorithm set formed by the first encryption algorithm and the first decryption algorithm are more than the second cryptographic algorithm formed by the second encryption algorithm and the second decryption algorithm. Collection complexity and cracking are more difficult.
  • the first cryptographic algorithm set may use a symmetric plus street secret algorithm, or a simplified symmetric encryption and decryption algorithm, or a combination of various simplified encryption and decryption algorithms, and other complicated and fast encryption and decryption methods, and second.
  • the cryptographic algorithm can use a simpler encryption and decryption scheme, such as one or more permutations, data stream confusion, and the like.
  • the second encryption and decryption unit in the second encryption and decryption system corresponding to the APB is coupled to the bus converter, and after receiving the second data including the first ciphertext converted by the bus converter, The second data including the first ciphertext is encrypted based on the second encryption algorithm, and the second data including the third ciphertext is obtained and transmitted on the APB.
  • the third encryption and decryption unit in the second encryption and decryption system is coupled to the signal processing module B, configured to receive the second data including the third ciphertext from the APB, and the second data including the third ciphertext is based on the first decryption algorithm. And decrypting with the second decryption algorithm to obtain the second data including the first plaintext, and forwarding the data to the signal processing module B.
  • the bus grading encryption system includes two buses AHB+APB respectively. If the bus grading encryption system includes three buses, AHB+APB1+APB2, when there is a signal processing module 1 on the AHB to the APB 2 When the signal processing module 2 sends the plaintext A, the first encryption and decryption system corresponding to the AHB needs to be encrypted based on the first encryption algorithm, and the second encryption and decryption system corresponding to the APB1 is decrypted based on the second encryption algorithm and the first decryption algorithm, and the APB2 corresponds to the APB2.
  • the third encryption and decryption system is decrypted based on the third encryption algorithm encryption and the second decryption algorithm, and before the signal processing module 2 receives, the third encryption and decryption system decrypts the third data including the plaintext A based on the decryption using the third decryption algorithm.
  • the first encryption and decryption system corresponding to the AHB needs to be encrypted based on the first encryption algorithm
  • the second encryption and decryption system corresponding to the APB1 is encrypted based on the second encryption algorithm
  • the third encryption and decryption system corresponding to the APB2 is encrypted based on the third encryption algorithm.
  • the third encryption and decryption system decrypts the third data including the plaintext A based on the first decryption algorithm, the second decryption algorithm, and the third decryption algorithm.
  • the encryption/decryption unit coupled with the destination signal processing module decrypts the data containing the ciphertext, it is necessary to determine the total number of times of encryption and the number of times of decryption from the source signal processing module to the destination signal processing module, thereby determining the number of times of decryption required. , get accurate decrypted data.
  • a series of flag bits may be added to the transmitted data, that is, after each encryption and decryption unit encrypts the data, a corresponding flag bit of the encryption and decryption unit is added, for example, the first encryption and decryption unit is included in the pair.
  • the second flag of the third ciphertext is correspondingly added with the second flag bit or the third flag bit.
  • the third encryption/decryption unit analyzes the identification bits in the data to determine the number of decryptions, and the decryption algorithm that needs to be employed.
  • a bus converter is configured to interface between the first data and the second data to adapt the first bus and the second bus. Specifically, the first data transmitted on the first bus is converted into the second data adapted to the second bus after passing through the bus converter, and continues to be transmitted on the second bus.
  • a bus converter can be used to isolate the first bus and the second bus for security.
  • a bus converter is an interface for connecting different adjacent buses. For example, the number between different buses According to the need for data caching or synchronization when passing, the bus converter can implement data caching or synchronization interface functions. For example, the data transmission speed of the two buses, that is, the transmission bandwidth may be different, or the timing and protocol of the two buses are different, the bus converter may serve as an interface of two adjacent buses, and the first data corresponding to the first bus The second data corresponding to the second bus is converted to implement data adaptation. It should be noted that even if the two buses are the same type of bus, the bus converter can be used as an interface between two buses of the same type (such as AHB or APB bus) to realize data isolation between the two buses, ensuring 2 The data on the bus has different levels of security.
  • the bus converter can be used as an interface between two buses of the same type (such as AHB or APB bus) to realize data isolation between the two buses, ensuring 2 The data on the bus has different levels of security.
  • bus converter can also assume the function of the partial encryption and decryption system, which is equivalent to the second encryption and decryption unit in the second encryption and decryption system, and can also include at least two implementation modes:
  • the bus converter includes: an encryption/decryption conversion unit, configured to convert the second data including the first ciphertext obtained by converting the first data including the first ciphertext, and the second data including the first ciphertext Encryption of the second encryption algorithm and decryption based on the first decryption algorithm to obtain second data containing the second ciphertext, and transmitting second data containing the second ciphertext on the second bus.
  • the encryption/decryption conversion unit may first perform encryption based on the second encryption algorithm, and then perform decryption based on the first decryption algorithm, so that the data may be prevented from being exposed in a clear text form, thereby improving security.
  • the second encryption and decryption system includes:
  • a third encryption and decryption unit coupled to the second signal processing module, configured to receive second data including the second ciphertext from the second bus, and perform decryption based on the second decryption algorithm on the second data that includes the second ciphertext Obtaining second data including the first plaintext required by the second signal processing module
  • the first decryption algorithm matches the first encryption algorithm
  • the second decryption algorithm matches the second encryption algorithm
  • the bus converter includes: an encryption/decryption conversion unit, configured to convert the second data including the first ciphertext obtained by converting the first data including the first ciphertext, and the second data including the first ciphertext
  • the second encryption algorithm encrypts to obtain the second data including the third ciphertext, and transmits the second data including the third ciphertext on the second bus.
  • the second encryption and decryption system includes:
  • a third encryption and decryption unit coupled to the second signal processing module, configured to receive second data including the third ciphertext from the second bus, and perform second data based on the first decryption algorithm and the second data Decryption of the decryption algorithm to obtain second data containing the first plaintext required by the second signal processing module.
  • the first decryption algorithm matches the first encryption algorithm
  • the second decryption algorithm matches the second encryption algorithm
  • the signal processing module A on the AHB needs to send the first plaintext to the signal processing module B on the APB, and the first encryption and decryption unit in the first encryption and decryption system corresponding to the AHB is coupled to the signal processing module A, and receives the signal.
  • the processing module A sends the first data including the first plaintext to the signal processing module B
  • the first data including the first plaintext is encrypted by using a first encryption algorithm
  • the first data including the first ciphertext is obtained
  • the first data containing the first ciphertext is sent to the bus converter via the AHB.
  • the bus converter converts the first data including the first ciphertext into the second data including the first ciphertext, and encrypts the second data including the first ciphertext based on the second encryption algorithm, and Decrypting based on the first decryption algorithm, obtaining second data including the second ciphertext, and transmitting on the APB.
  • the third encryption and decryption unit in the second encryption and decryption system is coupled to the signal processing module B for receiving the second data including the second ciphertext from the APB, and the second data including the second ciphertext is based on the second decryption algorithm.
  • the decryption obtains the second data containing the first plaintext and forwards it to the signal processing module B.
  • the bus converter converts the first data including the first ciphertext into the second data including the first ciphertext, and encrypts the second data including the first ciphertext based on the second encryption algorithm.
  • the second data containing the third ciphertext is transmitted on the APB.
  • the third encryption and decryption unit in the second encryption and decryption system is coupled to the signal processing module B, configured to receive the second data including the third ciphertext from the APB, and the second data including the third ciphertext is based on the first decryption algorithm. And decrypting with the second decryption algorithm to obtain the second data including the first plaintext, and forwarding the signal to the signal Module B.
  • the bus converter can also be just an interface between the buses, not including the encryption and decryption conversion unit, that is, the encryption and decryption function is completely implemented outside the bus.
  • the external encryption and decryption unit at this time is coupled to the bus converter, and the functions realized are similar to the built-in encryption/decryption conversion unit.
  • the encryption and decryption process is: algorithm 1 encryption, algorithm 2 encryption, algorithm 1 decryption, bus 2 transmission, and algorithm 2 decryption.
  • the second implementation differs from the first implementation in that data is decrypted for the first decryption algorithm before being passed on the second bus or passed to the target unit, such as the third encryption and decryption unit, by the third
  • the encryption and decryption unit performs decryption for the first decryption algorithm. That is, the third encryption and decryption unit in the second implementation performs two decryptions.
  • the encryption and decryption process is: algorithm 1 encryption, algorithm 2 encryption, bus 2 transmission, algorithm 1 decryption, and algorithm 2 decryption.
  • the two decryption (algorithm 1 decryption and algorithm 2 decryption) of the third encryption and decryption unit in this embodiment are not limited in order.
  • the bus hierarchical encryption system further includes: at least one random number generator for generating at least one key of each cryptographic unit and each cryptographic conversion unit to perform encryption or decryption using a set of cryptographic algorithms.
  • each bus can correspond to a random number generator, or a bus encryption system has a random number generator.
  • a bus encryption system has a random number generator that is a high security level module that is coupled to a high security level bus.
  • the random number generator may be a true random number generator or a pseudo random number generator.
  • the true random number generator can generate a key, key information such as a key needs to be stored in any module.
  • the secure address of the memory (not shown) that is inaccessible, modified, or deleted.
  • the first signal processing module herein can not only perform data communication with the second signal processing module corresponding to the second bus but also perform data communication with other signal processing modules on the first bus.
  • the first encryption and decryption system further includes: a fourth encryption and decryption unit;
  • the first encryption and decryption unit is further configured to: when receiving the first data including the second plaintext sent by the first signal processing module to the third signal processing module corresponding to the first bus, based on the first data including the second plaintext
  • the first encryption algorithm performs encryption to obtain first data including the fourth ciphertext, and forwards the first data including the fourth ciphertext to the fourth encryption and decryption unit via the first bus.
  • a fourth encryption and decryption unit configured to perform decryption based on the first decryption algorithm on the first data including the fourth ciphertext to obtain first data including the second plaintext required by the third signal processing module.
  • the first decryption algorithm matches the first encryption algorithm.
  • the signal processing module A on the AHB needs to send a third plaintext to the signal processing module C on the AHB.
  • the first encryption and decryption unit in the first encryption and decryption system corresponding to the AHB is coupled to the signal processing module A, and is received.
  • the signal processing module A sends the first data including the second plaintext to the signal processing module C
  • the first data including the second plaintext is encrypted by using a first encryption algorithm to obtain the first data including the fourth ciphertext.
  • the fourth encryption and decryption unit is coupled to the signal processing module C.
  • the first data including the fourth ciphertext is decrypted based on the first decryption algorithm to obtain the second plaintext.
  • the first data is forwarded to the signal processing module C.
  • the two signal processing modules of the storage unit and the cryptographic algorithm 1 unit are all first security level modules, both with the first security level encryption and decryption system (encryption and decryption system 1) and the first security level bus. (AHB) corresponds.
  • the process of encrypting the data in the storage unit by the cryptographic algorithm 1 unit and storing the data back to the storage unit includes:
  • the encryption/decryption unit 1 in the encryption and decryption system 1 is coupled to the storage unit, and encrypts the first data including the plaintext 1 in the storage unit based on the encryption algorithm 1 to obtain the first data including the ciphertext 1, and
  • the AHB is transmitted to the encryption/decryption unit 2 in the encryption/decryption system 1.
  • the encryption/decryption unit 2 is coupled to the cryptographic algorithm 1 unit, and decrypts the first data including the ciphertext 1 based on the decryption algorithm 1 to obtain the first data including the plaintext 1. Forward to the cryptographic algorithm unit 1.
  • the cryptographic algorithm 1 unit After receiving the first data including the plaintext 1, the cryptographic algorithm 1 unit encrypts the plaintext 1 by using the preset encryption algorithm stored in the cryptographic algorithm 1 unit, and forwards the ciphertext 2 to the encryption/decryption unit 2.
  • the encryption/decryption unit 2 encrypts the first data including the ciphertext 2 based on the encryption algorithm 1 to obtain the first data including the ciphertext 3, and transmits the first data to the encryption/decryption unit 1 via the AHB.
  • the encryption/decryption unit 1 decrypts the first data including the ciphertext 3 based on the decryption algorithm 1 to obtain the first data including the ciphertext 2, and forwards the data to the storage unit.
  • the storage unit stores the ciphertext 2 in the first data including the ciphertext 2.
  • the storage unit is a first security level module corresponding to the first security level encryption and decryption system (encryption and decryption system 1) and the first security level bus (AHB).
  • the interface is a second security level module corresponding to the second security level encryption and decryption system (encryption and decryption system 2) and the second security level bus (APB).
  • the process of transmitting data in a storage unit through an interface unit includes:
  • the encryption/decryption unit 1 in the encryption and decryption system 1 is coupled to the storage unit, and encrypts the first data including the plaintext 2 in the storage unit based on the encryption algorithm 1 to obtain the first data including the ciphertext 4, and transmits the data to the bus via the AHB. converter.
  • the APB/AHB bus converter converts the first data containing the ciphertext 4 into the second data containing the ciphertext 4, and forwards it to the encryption/decryption unit 3 in the encryption/decryption system 2.
  • the APB/AHB bus converter converter is used to convert APB bus data into AHB bus bus data, and realize data adaptation between the APB bus and the AHB bus.
  • the encryption/decryption unit 3 encrypts the second data including the ciphertext 4 based on the encryption algorithm 2 to obtain the second data including the ciphertext 5, and forwards it to the encryption/decryption unit 4 via the second bus.
  • the encryption/decryption unit 4 is coupled to the interface unit, and decrypts the second data including the ciphertext 5 based on the decryption algorithm 1 and the decryption algorithm 2 to obtain the second data including the plaintext 2, and forwards the data to the interface unit.
  • the interface unit after receiving the second data including the plaintext 2, sends it to the outside of the system.
  • the storage unit is a first security level module corresponding to the first security level encryption and decryption system (encryption and decryption system 1) and the first security level bus (AHB).
  • the interface unit is a second security level module corresponding to the second security level encryption and decryption system (encryption and decryption system 2) and the second security level bus (APB).
  • the APB/AHB bus converter includes an encryption and decryption conversion unit.
  • the process of transmitting data in a storage unit through an interface unit includes:
  • the encryption/decryption unit 1 in the encryption and decryption system 1 is coupled to the storage unit, and encrypts the first data including the plaintext 2 in the storage unit based on the encryption algorithm 1 to obtain the first data including the ciphertext 4, and transmits the data to the bus via the AHB. converter.
  • the APB/AHB bus converter converts the first data including the ciphertext 4 into the second data including the ciphertext 4, and encrypts the second data including the ciphertext 4 based on the encryption algorithm 2 to obtain the second data including the ciphertext 5. And decrypting the second data containing the ciphertext 5 based on the decryption algorithm 1 to obtain the second data including the ciphertext 6.
  • the encryption/decryption unit 4 is coupled to the interface unit, and decrypts the second data including the ciphertext 6 based on the decryption algorithm 2 to obtain the second data including the plaintext 2, and forwards the data to the interface unit.
  • the interface unit after receiving the second data including the plaintext 2, sends it to the outside of the system.
  • the encryption/decryption unit 1 in the encryption and decryption system 1 is coupled to the storage unit, and encrypts the first data including the plaintext 2 in the storage unit based on the encryption algorithm 1 to obtain the first data including the ciphertext 4, and transmits the data to the bus via the AHB. converter.
  • the APB/AHB bus converter converter converts the first data containing the ciphertext 4 into the second data containing the ciphertext 4, and forwards it to the encryption/decryption unit 3 in the encryption/decryption system 2.
  • the APB/AHB bus converter converter is used to convert APB bus data into AHB bus bus data, and realize data adaptation between the APB bus and the AHB bus.
  • the encryption/decryption unit 3 encrypts the second data including the ciphertext 4 based on the second encryption algorithm to obtain the second data including the ciphertext 5, and forwards it to the encryption/decryption unit 4 via the second bus.
  • the encryption and decryption unit 4 is coupled to the interface unit, and based on the decryption algorithm, the second data including the ciphertext 5 1 and the decryption algorithm 2 decrypts the second data containing the plaintext 2 and forwards it to the interface unit.
  • the interface unit after receiving the second data including the plaintext 2, sends it to the outside of the system.
  • the encryption/decryption unit 1 in the encryption and decryption system 1 is coupled to the storage unit, and encrypts the first data including the plaintext 2 in the storage unit based on the encryption algorithm 1 to obtain the first data including the ciphertext 4, and transmits the data to the bus via the AHB. converter.
  • the APB/AHB bus converter converter converts the first data containing the ciphertext 4 into the second data containing the ciphertext 4, and forwards it to the encryption/decryption unit 3 in the encryption/decryption system 2.
  • the APB/AHB bus converter converter is used to convert APB bus data into AHB bus bus data, and realize data adaptation between the APB bus and the AHB bus.
  • the encryption/decryption unit 3 encrypts the second data including the ciphertext 4 based on the second encryption algorithm to obtain the second data including the ciphertext 5, and forwards it to the encryption/decryption unit 4 via the second bus.
  • the encryption/decryption unit 4 is coupled to the interface unit, and decrypts the second data including the ciphertext 5 based on the decryption algorithm 1 and the decryption algorithm 2 to obtain the second data including the plaintext 2, and forwards the data to the interface unit.
  • the interface unit after receiving the second data including the plaintext 2, sends it to the outside of the system.
  • the solution mentioned in the embodiment of the present invention can be used for an eSE chip such as a mobile payment chip or a financial IC card chip.
  • the eSE can be integrated into other functional circuit chips or as a stand-alone chip.
  • the security of eSE functions is generally higher than other non-secure business functions, such as ordinary voice or data communication processing or application (APP) software services.
  • APP application
  • the system provided in the embodiment of the present invention can enhance the anti-attack capability of the system. Since the data transmitted on the bus is encrypted data, even if the attacker obtains the bus data by using the probe attack, it is difficult to crack the key. Further, for a module with a high security level corresponding to a high-level encryption and decryption unit, the algorithm complexity is higher, and the security of the transmitted data is further ensured. In addition, the key corresponding to each system is unique, which increases the difficulty of chip cracking.
  • the two-stage or multi-stage bus and the corresponding module and the encryption and decryption unit are distributed on the layout.
  • the high-level module circuit is hidden in large-scale and complex circuits. It is difficult for physical means to detect and find the corresponding function circuit. More sexual.
  • each module that transmits data on the bus has targeted encryption, which guarantees high security of some modules and ensures high speed of some modules.
  • Each module is hung on different levels of bus according to security, physically isolating the security data and common data, and further improving the security of the security data.
  • the system bus is fully and efficiently utilized by properly designing the bus level.
  • the improved safety bus grading design effectively improves the processing efficiency of the system, and the maintenance of subsequent systems is also simpler.
  • this embodiment is not limited to the application in the eSE field, but the eSE field is a preferred application field.
  • Each unit or module of the embodiments of the present invention may be a module formed by an electronic device such as a transistor or the like, such as a processor or an integrated circuit. Some of these modules can implement software-driven code through electronic devices to implement related functions.
  • the cryptographic algorithm module 1 mentioned in the embodiment may be a processor that executes a cryptographic algorithm, and implements cryptographic algorithm functions by executing cryptographic algorithm related software driver code.
  • embodiments of the invention may be provided to include a method, system, or computer program product.
  • the system of embodiments of the present invention may take the form of an entirely hardware embodiment or an embodiment of the software and hardware.
  • some of the related functions of some of the modules of the present invention may employ a computer implemented on one or more computer usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) having computer usable program code embodied therein.
  • computer usable storage media including but not limited to disk storage, CD-ROM, optical storage, etc.
  • Coupled as referred to in this embodiment includes connection through wires or through connections of other modules, units or devices, which should be understood as being used in a broad sense to implement different modules to achieve signal communication through certain forms and should not be Interpreted as including only direct connections.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Theoretical Computer Science (AREA)
  • Signal Processing (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Computer Hardware Design (AREA)
  • General Engineering & Computer Science (AREA)
  • Software Systems (AREA)
  • Business, Economics & Management (AREA)
  • Health & Medical Sciences (AREA)
  • Bioethics (AREA)
  • General Health & Medical Sciences (AREA)
  • Accounting & Taxation (AREA)
  • Strategic Management (AREA)
  • General Business, Economics & Management (AREA)
  • Computing Systems (AREA)
  • Storage Device Security (AREA)
  • Small-Scale Networks (AREA)

Abstract

本发明涉及系统安全技术领域，尤其涉及一种总线分级加密系统，以解决安全模块与普通模块的数据传输没有物理隔离，没有充分根据各模块的安全性合理利用总线的问题，该系统包括：包括第一总线和第二总线在内的至少两个总线、与每个总线对应的加解密系统、与每个总线对应的至少一个信号处理模块，以及耦合在第一总线和第二总线间的总线转换器，采用本发明实施例中提供的系统，由于总线上传输的数据都是加密数据，即使攻击者采用探针攻击获得了总线数据，也很难破解出密钥，能够增强系统的防攻击能力。

Description

一种总线分级加密系统
本申请要求在2016年2月26日提交中国专利局、申请号为201610109754.X、发明名称为“一种总线分级加密系统”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本发明涉及系统安全技术领域，尤其涉及一种总线分级加密系统。
背景技术
移动支付领域发展越来越快，对嵌入式安全元件(embedded Security Element，eSE)的安全性要求也越来越高。现有技术中提供的两种eSE系统模型均未能较好地保证eSE传输的安全性。
具体的，现有方案1参阅图1所示，所有模块都挂在同一个高性能总线，即(Advanced High-performance Bus，AHB)总线上，这些模块包括安全模块，例如密码算法单元、存储单元等，和普通模块，例如接口单元、看门狗单元等。安全模块与普通模块在数据传输上没有物理隔离。
由于大部分现有方案没有对总线上的传输数据进行加密保护，因此其中的保密数据可被攻击者获得，安全性不高。具体的，当攻击者使用探针进行攻击时，可以获取AHB总线上传输的数据，并根据获取的数据分析得出密钥。而如果对总线上的传输数据进行加密保护，则普通模块的非保密数据也会一起加密，这样将会对产品性能造成影响。
由上可知，如图1所示的方案，所有模块都挂在一个AHB总线上，安全模块与普通模块在数据传输上没有物理隔离，总线负荷大，影响系统处理效率，没有充分根据各模块的安全性合理利用总线。
现有方案2参阅图2所示，提出了一种二级总线方案，用以充分利用中央处理器提供的总线系统。具体的，采用二级总线，分别是AHB总线和高级外设总线(Advanced Peripheral Bus，APB)总线，并对模块进行分类，分类依 据一般是模块对数据传输速率的要求，速率要求高的模块挂在AHB总线上，速率要求低的模块挂在APB总线上，但是这种方案依然没有把安全模块和普通模块在安全性要求上进行区分，也没有对传输数据进行加密。
因此，与图1中的方案类似，采用二级总线方案，如果没有对传输数据进行加密保护，也可能出现被攻击者利用分析得出密钥的情况。如果对总线上的传输数据进行加密保护，则普通模块的非保密数据也会一起加密，影响产品性能。同样，安全模块与普通模块数据传输没有物理隔离，只是针对数据传输速率要求进行区分，没有充分根据各模块的安全性合理利用总线。
发明内容
本发明实施例的目的是提供一种总线分级加密系统，以解决安全模块与普通模块的数据传输没有物理隔离，没有充分根据各模块的安全性合理利用总线的问题。
本发明实施例的目的是通过以下技术方案实现的：
第一方面，一种总线分级加密系统，包括：包括第一总线和第二总线在内的至少两个总线、与每个总线对应的加解密系统、与每个总线对应的至少一个信号处理模块，以及耦合在所述第一总线和所述第二总线间的总线转换器；其中，
与所述第一总线对应的第一信号处理模块，用于经过所述第一总线、所述总线转换器和所述第二总线，与所述第二总线对应的第二信号处理模块进行数据通信；
与所述第一总线对应的第一加解密系统，用于基于第一加密算法对在所述第一总线上传输的第一数据做加密处理；
与所述第二总线对应的第二加解密系统，用于基于第二加密算法对在所述第二总线上传输的第二数据做加密处理；
所述总线转换器，用于作为所述第一数据和所述第二数据之间的接口以 适配所述第一总线和所述第二总线；
所述第一加密算法对应于第一安全级别，所述第二加密算法对应于第二安全级别，所述第一安全级别和所述第二安全级别不同。
结合第一方面，在第一种可能的实现方式中，所述第一加解密系统包括：
第一加解密单元，耦合于所述第一信号处理模块，用于在接收到所述第一信号处理模块发往所述第二信号处理模块的包含第一明文的所述第一数据时，对所述包含第一明文的所述第一数据基于所述第一加密算法进行加密以获得包含第一密文的所述第一数据，并将所述包含第一密文的第一数据经过所述第一总线转发至所述总线转换器。
结合第一方面和第一方面的第一种可能的实现方式，在第二种可能的实现方式中，所述第二加解密系统包括：
第二加解密单元，耦合于所述总线转换器，用于接收所述总线转换器对所述包含第一密文的第一数据做转换后得到的所述包含第一密文的所述第二数据，对所述包含第一密文的所述第二数据进行基于所述第二加密算法的加密和基于第一解密算法的解密以得到包含第二密文的所述第二数据，并在所述第二总线上传输所述包含第二密文的所述第二数据；
第三加解密单元，耦合于所述第二信号处理模块，用于从所述第二总线接收所述包含第二密文的所述第二数据，对所述包含第二密文的所述第二数据进行基于第二解密算法的解密以得到所述第二信号处理模块需要的包含第一明文的第二数据；
所述第一解密算法匹配所述第一加密算法；所述第二解密算法匹配所述第二加密算法。
结合第一方面和第一方面的任一一种可能的实现方式，在第三种可能的实现方式中，所述第二加解密系统包括：
第二加解密单元，耦合于所述总线转换器，用于接收所述总线转换器对所述包含第一密文的第一数据做转换后得到的所述包含第一密文的所述第二数据，对所述包含第一密文的所述第二数据进行基于所述第二加密算法的加 密以得到包含第三密文的所述第二数据，并在所述第二总线上传输所述包含第三密文的所述第二数据；
第三加解密单元，耦合于所述第二信号处理模块，用于从所述第二总线接收所述包含第三密文的所述第二数据，对所述包含第三密文的所述第二数据进行基于第一解密算法和第二解密算法的解密以得到所述第二信号处理模块需要的包含第一明文的第二数据；
所述第一解密算法匹配所述第一加密算法；所述第二解密算法匹配所述第二加密算法。
结合第一方面和第一方面的任一一种可能的实现方式，在第四种可能的实现方式中，所述总线转换器包括：加解密转换单元，用于对所述包含第一密文的第一数据做转换后得到的所述包含第一密文的所述第二数据，以及对所述包含第一密文的所述第二数据进行基于所述第二加密算法的加密和基于第一解密算法的解密以得到包含第二密文的所述第二数据，并在所述第二总线上传输所述包含第二密文的所述第二数据；
所述第二加解密系统包括：
第三加解密单元，耦合于所述第二信号处理模块，用于从所述第二总线接收所述包含第二密文的所述第二数据，对所述包含第二密文的所述第二数据进行基于第二解密算法的解密以得到所述第二信号处理模块需要的包含第一明文的第二数据；
所述第一解密算法匹配所述第一加密算法；所述第二解密算法匹配所述第二加密算法。
结合第一方面和第一方面的任一一种可能的实现方式，在第五种可能的实现方式中，所述第一加解密系统还包括：第四加解密单元；
所述第一加解密单元，还用于在接收到所述第一信号处理模块发往所述第一总线对应的所述第三信号处理模块的包含第二明文的所述第一数据时，对所述包含第二明文的所述第一数据基于所述第一加密算法进行加密以获得包含第四密文的所述第一数据，并将所述包含第四密文的第一数据经过所述 第一总线转发至所述第四加解密单元；
所述第四加解密单元，用于对所述包含第四密文的第一数据进行基于第一解密算法的解密以得到与所述第三信号处理模块需要的包含第二明文的所述第一数据；所述第一解密算法匹配所述第一加密算法。
结合第一方面和第一方面的任一一种可能的实现方式，在第六种可能的实现方式中，所述系统还包括：至少一个随机数发生器，用于产生每个加解密系统和每个加解密转换单元执行加密或解密所使用的密码算法集合的至少一个密钥。
结合第一方面和第一方面的任一一种可能的实现方式，在第七种可能的实现方式中，所述第一总线和所述第二总线中的至少一个是：高性能总线AHB、高级外设总线APB、或为高级系统总线ASB中的至少一种总线。
结合第一方面和第一方面的任一一种可能的实现方式，在第八种可能的实现方式中，每个总线对应的至少一个信号处理模块，包括：信号处理单元、存储单元、随机数发生器、密码算法单元、接口单元、时钟单元、或看门狗单元中的至少一项。
结合第一方面和第一方面的任一一种可能的实现方式，在第九种可能的实现方式中，所述系统应用于移动支付领域。
第二方面，一种总线分级加密方法，包括：
利用第一加解密单元对第一总线上传输的包含第一明文的第一数据基于所述第一加密算法进行加密以获得包含第一密文的所述第一数据；
通过第一总线将所述包含第一密文的第一数据转发至所述总线转换器；
通过所述总线转换器将将所述包含第一密文的第一数据转换为能够在第二总线上传输的包含第一密文的第二数据；
通过第二加解密单元对所述包含第一密文的所述第二数据进行基于所述第二加密算法的加密和基于第一解密算法的解密以得到包含第二密文的所述第二数据；
通过第二总线将所述包含第二密文的所述第二数据转发至第三加解密单 元；
通过所述第三加解密单元对所述包含第二密文的所述第二数据进行基于第二解密算法的解密以得到包含第一明文的第二数据。
第三方面，一种总线分级加密方法，包括：
利用第一加解密单元对第一总线上传输的包含第一明文的第一数据基于所述第一加密算法进行加密以获得包含第一密文的所述第一数据；
通过第一总线将所述包含第一密文的第一数据转发至所述总线转换器；
通过所述总线转换器将将所述包含第一密文的第一数据转换为能够在第二总线上传输的包含第一密文的第二数据；
通过第二加解密单元对所述包含第一密文的所述第二数据进行基于所述第二加密算法的加密以得到包含第三密文的所述第二数据；
通过第二总线将所述包含第三密文的所述第二数据转发至第三加解密单元；
通过所述第三加解密单元对所述包含第三密文的所述第二数据进行基于第一解密算法和第二解密算法的解密以得到包含第一明文的第二数据。
在第二方面或第三方面中，可选地，所述第一总线和所述第二总线中的至少一个是：高性能总线AHB、高级外设总线APB、或为高级系统总线ASB中的至少一种总线。
本发明实施例中总线分级加密系统包括：包括第一总线和第二总线在内的至少两个总线、与每个总线对应的加解密系统、与每个总线对应的至少一个信号处理模块，以及耦合在第一总线和第二总线间的总线转换器，采用本发明实施例中提供的系统，对需要在总线传输数据的每个模块有针对性的加密，即保证了部分模块的高安全性，也保证了部分模块的高速度性。各模块根据安全性分别挂在不同级别的总线上，物理上隔离了安全数据与普通数据，由于总线上传输的数据都是加密数据，即使攻击者采用探针攻击获得了总线数据，也很难破解出密钥，能够增强系统的防攻击能力。
附图说明
图1为本发明背景技术中总线与模块的连接关系示意图；
图2为本发明背景技术中二级总线方案中总线与模块的连接关系示意图；
图3为本发明实施例中总线分级加密系统的结构示意图；
图4为本发明实施例中总线分级加密系统的具体结构示意图之一；
图5为本发明实施例中总线分级加密系统的具体结构示意图之二。
具体实施方式
为使本发明实施例的目的、技术方案和优点更加清楚，下面将结合本发明实施例中的附图，对本发明实施例中的技术方案进行清楚、完整地描述，显然，所描述的实施例是本发明一部分实施例，而不是全部的实施例。基于本发明中的实施例，本领域普通技术人员在没有做出创造性劳动前提下所获得的所有其他实施例，都属于本发明保护的范围。
本发明实施例提供一种总线分级加密系统，用以解决安全模块与普通模块的数据传输没有物理隔离，没有充分根据各模块的安全性合理利用总线的问题。
其中，方法和装置是基于同一发明构思的，由于方法及装置解决问题的原理相似，因此装置与方法的实施可以相互参见，重复之处不再赘述。
下面结合附图对本发明优选的实施方式进行详细说明。
参阅图3所示，本发明实施例提供一种总线分级加密系统，包括：包括第一总线和第二总线在内的至少两个总线、与每个总线对应的加解密系统、与每个总线对应的至少一个信号处理模块，以及耦合在第一总线和第二总线间的总线转换器。
其中，第一总线和第二总线中的至少一个是：AHB、APB、或为高级系统总线(Advanced System Bus，ASB)中的至少一种总线。总线分级加密系统中的总线组合可以为AHB+APB，或ASB+APB，或AHB+APB1+APB2， 或ASB+APB1+APB2等。
每个总线对应的至少一个信号处理模块，包括：信号处理单元、存储单元、随机数发生器、密码算法单元、接口单元、时钟单元、或看门狗单元中的至少一项。
与第一总线对应的第一信号处理模块，用于经过第一总线、总线转换器和第二总线，与第二总线对应的第二信号处理模块进行数据通信。
其中，每个信号处理模块预置一个预设的安全级别，不同安全级别的信号处理模块挂在对应安全级别的总线上，因此，第一总线与第一信号处理模块具有相同的安全级别。第二总线与第二信号处理模块具有相同的安全级别。
例如，将各个信号处理模块按照安全保密的需要设置为第一安全级别、第二安全级别以及第三安全级别，相应的，将各个总线设置为第一安全级别、第二安全级别以及第三安全级别。
又例如，将信号处理模块分成两个安全级别，即高级别模块和普通模块，则两个总线也对应两个安全级别，即高级别总线和普通总线。
又例如，将eSE中的信号处理模块按照其安全性分为两类，高安全性模块和低安全性模块，其中，AHB为高安全性总线，APB为低安全性模块，则高安全性模块挂在AHB上，如信号处理单元、存储单元、随机数生成单元、密码算法单元等，低安全性模块挂在APB上，如接口单元、时钟单元、看门狗单元等。
与第一总线对应的第一加解密系统，用于基于第一加密算法对在第一总线上传输的第一数据做加密处理。
其中，在第一总线上传输的数据统称为第一数据。
该第一加解密系统包括：
第一加解密单元，耦合于第一信号处理模块，用于在接收到第一信号处理模块发往第二信号处理模块的包含第一明文的第一数据时，对包含第一明文的第一数据基于第一加密算法进行加密以获得包含第一密文的第一数据，并将包含第一密文的第一数据经过第一总线转发至总线转换器。
具体的，在实际应用中，第一信号处理模块将需要传输的包含第一明文的第一数据通过第一加解密单元加密之前，第一信号处理模块需要获取第一总线的总线资源。可选的，第一模块获取第一总线的总线资源的方式可以包括以下两种，但不限于以下两种方式：
第一种方式，第一信号处理模块发送传输请求至中央处理器(Central Processing Unit，CPU)，第一信号处理模块接收CPU分配的第一总线的总线资源。
第二种方式，第一信号处理模块发送传输请求至直接内存存取(Directional Memory Access，DMA)，第一信号处理模块接收DMA分配的第一总线的总线资源。
可选的，在第一信号处理模块将需要传输的数据通过第一加解密单元加密之前，第一信号处理模块接收由预设硬件或预设软件发送的加密控制指令，其中，加密控制指令用于指示第一信号处理模块将包含第一明文的第一数据发送至第一加解密单元加密。这里的预设硬件可以是CPU或DMA。
与第二总线对应的第二加解密系统，用于基于第二加密算法对在第二总线上传输的第二数据做加密处理。
其中，在第二总线上传输的数据统称为第二数据。
这里的第一加密算法对应于第一安全级别，第二加密算法对应于第二安全级别，第一安全级别和第二安全级别不同。
即第一总线、与第一信号处理模块、与第一加解密系统以及第一加密算法具有相同的安全级别，第二总线、与第二信号处理模块、与第二加解密系统以及第二加密算法具有相同的安全级别。
该第二加解密系统包括：第二加解密单元和第三加解密单元。其中，第二加解密系统中的第二加解密单元和第三加解密单元至少有以下两种可能的实现方式。
第一种实现方式：
第二加解密单元，耦合于总线转换器，用于接收总线转换器对包含第一 密文的第一数据做转换后得到的包含第一密文的第二数据，对包含第一密文的第二数据进行基于第二加密算法的加密和基于第一解密算法的解密以得到包含第二密文的第二数据，并在第二总线上传输包含第二密文的第二数据。
第三加解密单元，耦合于第二信号处理模块，用于从第二总线接收包含第二密文的第二数据，对包含第二密文的第二数据进行基于第二解密算法的解密以得到第二信号处理模块需要的包含第一明文的第二数据。
其中，第一解密算法匹配第一加密算，第二解密算法匹配第二加密算法。如果加密算法和解密算法匹配，通过加密算法加密的数据可以通过相应的解密算法来解密。
第二种实现方式：
第二加解密单元，耦合于总线转换器，用于接收总线转换器对包含第一密文的第一数据做转换后得到的包含第一密文的第二数据，对包含第一密文的第二数据进行基于第二加密算法的加密以得到包含第三密文的第二数据，并在第二总线上传输包含第三密文的第二数据。
第三加解密单元，耦合于第二信号处理模块，用于从第二总线接收包含第三密文的第二数据，对包含第三密文的第二数据进行基于第一解密算法和第二解密算法的解密以得到第二信号处理模块需要的包含第一明文的第二数据。
其中，第一解密算法匹配第一加密算法，第二解密算法匹配第二加密算法。
针对上述两种可能的实现方式，可选的，在第二信号处理模块接收经第三加解密单元解密的包含第一明文的第二数据之前，第三加解密单元接收由预设硬件或预设软件发送的解密控制指令，该解密控制指令用于指示第三加解密单元将包含第二密文或第三密文的第二数据解密为包含第一明文的第二数据，并发送至第二信号处理单元。
此外，在第三加解密单元将包含第二密文或第三密文的第二数据解密之前，第三加解密单元针对包含第二密文或第三密文的第二数据进行完整性校 验，若确定包含第二密文或第三密文的第二数据的完整性校验通过，则将包含第二密文或第三密文的第二数据进行解密。
可选的，以第二种实现方式为例，第一信号处理模块向第二信号处理模块发送第一明文，第一加解密单元采用第一加密算法对包含第一明文的第一数据加密得到包含第一密文的第一数据，并同时用第一密文计算一个第一校验数据。之后，经总线转换器将包含第一密文的第一数据转换为包含第一密文的第二数据，在通过第二加解密单元对包含第一密文的第二数据基于第二加密算法加密得到包含第三密文的第二数据，并同时用第三密文计算一个第二校验数据，在第三加解密单元接收到包含第三密文的第二数据时，通过第一校验数据和第二校验数据对包含第三密文的第二数据进行完整性校验，若通过完整性校验则继续解密包含第三密文的第二数据，若不通过完整性校验，则发出报警，总线加密系统复位。
须知，上述提到的第一加解密系统和第二加解密系统均是用于对在总线上的传输数据进行加解密的系统。因此，这种系统与相对应的总线直接耦合，并对总线的数据传输安全负责。虽然在电子系统中可以存在各类不同的加解密，但是现有的加解密技术大多是对某一种特定的业务负责，即用于加密某一类特定的业务数据(业务层加解密)。例如，一个CPU或数字信号处理器(Digital Signal Processing，DSP)生成的某一类数据，如身份认证信息通常需要被加密。此外，这种系统可以不对特定类型业务或数据负责，而是直接对总线负责，针对对应总线上传输的多种类型数据或多种业务数据做加解密。因此被加解密的数据可能已经是密文数据，即已经经过业务层加解密的数据。
例如，AHB上的信号处理模块A需要向APB上的信号处理模块B发送第一明文，AHB对应的第一加解密系统中的第一加解密单元，耦合于信号处理模块A，在接收到信号处理模块A发往信号处理模块B的包含第一明文的第一数据时，对包含第一明文的第一数据采用第一加密算法进行加密，获得包含第一密文的第一数据，并将包含第一密文的第一数据经AHB发送至总线转换器。
可选的，第一加密算法可以采用简化的高级加密标准(Advanced Encryption Standard，AES)加密算法。
总线转换器将包含第一密文的第一数据转换成包含第一密文的第二数据。
针对第一种实现方式，APB对应的第二加解密系统中的第二加解密单元，耦合于总线转换器，在接收到总线转换器转换后的包含第一密文的第二数据后，将包含第一密文的第二数据基于第二加密算法加密，以及基于第一解密算法解密，得到包含第二密文的第二数据，在APB上传输。
这里采用先加密再解密的做法是为了避免明文暴露，确保传输的数据更加安全。可选的，第一解密算法可以对应为简化的AES解密算法，即只进行3轮AES算法的迭代运算，其具体的轮数可以根据安全性和性能需要综合评估确定。可选的，第二加密算法可以采用数据加密标准(Data Encryption Standard，DES)算法中的置换：
置换表：
58,50,42,34,26,18,10,2,
60,52,44,36,28,20,12,4,
62,54,46,38,30,22,14,6,
64,56,48,40,32,24,16,8,
57,49,41,33,25,17,9,1,
59,51,43,35,27,19,11,3,
61,53,45,37,29,21,13,5,
63,55,47,39,31,23,15,7
第二加解密系统中的第三加解密单元，耦合于信号处理模块B，用于从APB接收包含第二密文的第二数据，将包含第二密文的第二数据基于第二解密算法的解密得到包含第一明文的第二数据，转发给信号处理模块B。
至此完成本次AHB上的信号处理模块A向APB上的信号处理模块B发送第一明文的全过程。
可选的，第二解密算法为对应为DES算法中的逆置换：
逆向置换表：
40,8,48,16,56,24,64,32,
39,7,47,15,55,23,63,31,
38,6,46,14,54,22,62,30,
37,5,45,13,53,21,61,29,
36,4,44,12,52,20,60,28,
35,3,43,11,51,19,59,27,
34,2,42,10,50,18,58,26,
33,1,41,9,49,17,57,25
若AHB上的模块安全级别更高，则第一加密算法和第一解密算法构成的第一密码算法集合的复杂度和破解难度要比第二加密算法和第二解密算法构成的第二密码算法集合的复杂度和破解难度更高。
又例如，第一密码算法集合可使用对称加街密算法，或简化的对称加解密算法，或各种简化加解密算法的组合，以及其他复杂度高且速度快的加解密方式，而第二密码算法可使用更为简单的加解密方案，如一次或多次置换、数据流混淆等。
针对第二种实现方式，APB对应的第二加解密系统中的第二加解密单元，耦合于总线转换器，在接收到总线转换器转换后的包含第一密文的第二数据后，将包含第一密文的第二数据基于第二加密算法加密，得到包含第三密文的第二数据，在APB上传输。
第二加解密系统中的第三加解密单元，耦合于信号处理模块B，用于从APB接收包含第三密文的第二数据，将包含第三密文的第二数据基于第一解密算法和第二解密算法解密，得到包含第一明文的第二数据，转发给信号处理模块B。
至此完成本次AHB上的信号处理模块A向APB上的信号处理模块B发送第一明文的全过程。
须知，上述总线分级加密系统中包含两个总线分别为AHB+APB，若总线分级加密系统中包含三个总线，AHB+APB1+APB2，则当有AHB上的信号处理模块1向APB 2上的信号处理模块2发送明文A时，需要经过AHB对应的第一加解密系统基于第一加密算法加密，APB1对应的第二加解密系统基于第二加密算法加密和第一解密算法解密，以及APB2对应的第三加解密系统基于第三加密算法加密和第二解密算法解密，并在信号处理模块2接收前，第三加解密系统基于采用第三解密算法解密获得包含明文A的第三数据。又或者，需要经过AHB对应的第一加解密系统基于第一加密算法加密，APB1对应的第二加解密系统基于第二加密算法加密，以及APB2对应的第三加解密系统基于第三加密算法加密，并在信号处理模块2接收前，第三加解密系统基于第一解密算法、第二解密算法以及第三解密算法解密获得包含明文A的第三数据。
因此，与目的信号处理模块耦合的加解密单元在针对包含密文的数据解密时，需要确定从源信号处理模块到目的信号处理模块总共的已加密次数和已解密次数，进而确定需要解密的次数，获得准确的解密数据。
可选的，可以选择在传输的数据中添加一系列的标志位，即在每个加解密单元加密数据后添加一个对应的该加解密单元的标志位，例如，第一加解密单元在对包含第一明文的第一数据加密得到的包含第一密文的第一数据中添加第一标志位，第二加解密单元在对包含第一密文的第二数据加密得到的包含第二密文或第三密文的第二数据中分别对应添加第二标志位，或第三标志位。这样第三加解密单元分析获得数据中的标识位确定解密次数，以及需要采用的解密算法。
总线转换器，用于作为第一数据和第二数据之间的接口以适配第一总线和第二总线。具体的，第一总线上传输的第一数据在经过总线转换器后转换成适配第二总线的第二数据，并继续在第二总线上传输。或者说，总线转换器可用于隔离所述第一总线和第二总线，以实现安全性。
总线转换器是用于连接不同相邻总线的接口。例如，不同总线之间的数 据传递时需要进行数据缓存或同步，总线转换器可以实现数据缓存或同步的接口功能。例如两个总线的数据传输速度，即传输带宽可能不同，或两个总线遵循的时序、协议不同，该总线转换器可作为相邻的两个总线的接口，将第一总线对应的第一数据转换为第二总线对应的第二数据，实现数据的适配。需要说明的是，即便两个总线是同一类型的总线，总线转换器也可作为两个同类型总线(如AHB或APB总线)之间的接口，实现2个总线之间的数据隔离，保证2个总线上的数据具有不同的安全级别。
此外，总线转换器也可承担部分加解密系统的功能，相当于上述第二加解密系统中的第二加解密单元，也可至少包括两种实现方式：
第一种实现方式：
总线转换器包括：加解密转换单元，用于对包含第一密文的第一数据做转换后得到的包含第一密文的第二数据，以及对包含第一密文的第二数据进行基于第二加密算法的加密和基于第一解密算法的解密以得到包含第二密文的第二数据，并在第二总线上传输包含第二密文的第二数据。在本实施方式中，该加解密转换单元可先做基于第二加密算法的加密，再做基于第一解密算法的解密，这样可以避免数据以明文形式被暴露，提高安全性。
此时第二加解密系统包括：
第三加解密单元，耦合于第二信号处理模块，用于从第二总线接收包含第二密文的第二数据，对包含第二密文的第二数据进行基于第二解密算法的解密以得到第二信号处理模块需要的包含第一明文的第二数据
其中，第一解密算法匹配第一加密算法，第二解密算法匹配第二加密算法。
第二种实现方式：
总线转换器包括：加解密转换单元，用于对包含第一密文的第一数据做转换后得到的包含第一密文的第二数据，以及对包含第一密文的第二数据进行基于第二加密算法的加密以得到包含第三密文的第二数据，并在第二总线上传输包含第三密文的第二数据。
此时第二加解密系统包括：
第三加解密单元，耦合于第二信号处理模块，用于从第二总线接收包含第三密文的第二数据，对包含第三密文的第二数据进行基于第一解密算法和第二解密算法的解密以得到第二信号处理模块需要的包含第一明文的第二数据。
其中，第一解密算法匹配第一加密算法，第二解密算法匹配第二加密算法。
例如，AHB上的信号处理模块A需要向APB上的信号处理模块B发送第一明文，AHB对应的第一加解密系统中的第一加解密单元，耦合于信号处理模块A，在接收到信号处理模块A发往信号处理模块B的包含第一明文的第一数据时，对包含第一明文的第一数据采用第一加密算法进行加密，获得包含第一密文的第一数据，并将包含第一密文的第一数据经AHB发送至总线转换器。
针对第一种实现方式，总线转换器将包含第一密文的第一数据转换成包含第一密文的第二数据，将包含第一密文的第二数据基于第二加密算法加密，以及基于第一解密算法解密，得到包含第二密文的第二数据，在APB上传输。
第二加解密系统中的第三加解密单元，耦合于信号处理模块B，用于从APB接收包含第二密文的第二数据，将包含第二密文的第二数据基于第二解密算法的解密得到包含第一明文的第二数据，转发给信号处理模块B。
至此完成本次AHB上的信号处理模块A向APB上的信号处理模块B发送第一明文的全过程。
针对第二种实现方式，总线转换器将包含第一密文的第一数据转换成包含第一密文的第二数据，将包含第一密文的第二数据基于第二加密算法加密，得到包含第三密文的第二数据，在APB上传输。
第二加解密系统中的第三加解密单元，耦合于信号处理模块B，用于从APB接收包含第三密文的第二数据，将包含第三密文的第二数据基于第一解密算法和第二解密算法解密，得到包含第一明文的第二数据，转发给信号处 理模块B。
至此完成本次AHB上的信号处理模块A向APB上的信号处理模块B发送第一明文的全过程。
当然，总线转换器也可以只是一个总线之间的接口，不包括加解密转换单元，也就是说加解密功能完全在总线外实现。此时的外置加解密单元与总线转换器耦合，实现的功能与内置的加解密转换单元类似。
在第一种实现方式中，加解密过程依次是：算法1加密，算法2加密，算法1解密，总线2传输，算法2解密。
第二种实现方式与第一种实现方式的区别在于，数据是在第二总线上传递前做针对第一解密算法的解密还是在传递到目标单元，如第三加解密单元后，由第三加解密单元做针对第一解密算法的解密。即第二种实现方式中的第三加解密单元进行了两次解密。在第二种实现方式中，加解密过程依次是：算法1加密，算法2加密，总线2传输，算法1解密，算法2解密。本实施例中第三加解密单元的两次解密(算法1解密和算法2解密)先后顺序不作限定。
此外，该总线分级加密系统中还包括：至少一个随机数发生器，用于产生每个加解密单元和每个加解密转换单元执行加密或解密所使用的密码算法集合的至少一个密钥。
参阅图4所示，须知，随机数发生器就是一个信号处理模块，每个总线可以对应一个随机数发生器，或者一个总线加密系统中有一个随机数发生器就可以了。一般地，一个总线加密系统中有一个随机数发生器，为高安全级别模块，与高安全级别总线耦合。
具体的，随机数发生器可以为真随机数发生器或伪随机数发生器，可选的，由于真随机数发生器能够产生密钥，而密钥之类的关键信息需存储在一个任何模块都不可访问、修改或删除的存储器(图中未示出)的安全地址中。
此外，这里的第一信号处理模块不仅能够与第二总线对应的第二信号处理模块进行数据通信，还能与第一总线上的其他信号处理模块进行数据通信。
进一步地，第一加解密系统还包括：第四加解密单元；
第一加解密单元，还用于在接收到第一信号处理模块发往第一总线对应的第三信号处理模块的包含第二明文的第一数据时，对包含第二明文的第一数据基于第一加密算法进行加密以获得包含第四密文的第一数据，并将包含第四密文的第一数据经过第一总线转发至第四加解密单元。
第四加解密单元，用于对包含第四密文的第一数据进行基于第一解密算法的解密以得到与第三信号处理模块需要的包含第二明文的第一数据。
其中，第一解密算法匹配第一加密算法。
例如，AHB上的信号处理模块A需要向同在AHB上的信号处理模块C发送第三明文，AHB对应的第一加解密系统中的第一加解密单元，耦合于信号处理模块A，在接收到信号处理模块A发往信号处理模块C的包含第二明文的第一数据时，对包含第二明文的第一数据采用第一加密算法进行加密，获得包含第四密文的第一数据，并将包含第四密文的第一数据经AHB发送至AHB对应的第四加解密单元。
第四加解密单元，耦合于信号处理模块C，在接收到包含第四密文的第一数据时，对包含第四密文的第一数据基于第一解密算法解密，得到包含第二明文的第一数据，转发给信号处理模块C。
至此完成本次AHB上的信号处理模块A向同在AHB上的信号处理模块C发送第二明文的全过程。下面分为三种实施例做简要介绍。
实施例1：
参阅图4所示，其中，存储单元和密码算法1单元这两个信号处理模块均为第一安全级别模块，均与第一安全级别加解密系统(加解密系统1)和第一安全级别总线(AHB)对应。
将存储单元中的数据经密码算法1单元加密后存储回存储单元的过程包括：
加解密系统1中的加解密单元1，与存储单元耦合，将存储单元中的包含明文1的第一数据基于加密算法1加密后得到包含密文1的第一数据，并经 AHB传输至加解密系统1中的加解密单元2。
加解密单元2，与密码算法1单元耦合，将包含密文1的第一数据基于解密算法1解密得到包含明文1的第一数据。转发至密码算法1单元。
密码算法1单元接收到包含明文1的第一数据后，采用密码算法1单元中存储的预设加密算法对明文1加密得到密文2，转发至加解密单元2。
加解密单元2，将包含密文2的第一数据基于加密算法1加密得到包含密文3的第一数据，并经AHB传输至加解密单元1。
加解密单元1，将包含密文3的第一数据基于解密算法1解密得到包含密文2的第一数据，转发至存储单元。
存储单元，针对包含密文2的第一数据中的密文2进行保存。
实施例2：
参阅图4所示，其中，存储单元为第一安全级别模块，分别与第一安全级别加解密系统(加解密系统1)和第一安全级别总线(AHB)对应。接口为第二安全级别模块，分别与第二安全级别加解密系统(加解密系统2)和第二安全级别总线(APB)对应。
将存储单元中的数据通过接口单元发送的过程包括：
加解密系统1中的加解密单元1，与存储单元耦合，将存储单元中的包含明文2的第一数据基于加密算法1加密后得到包含密文4的第一数据，并经AHB传输至总线转换器。
APB/AHB总线转换器将包含密文4的第一数据转换为包含密文4的第二数据，转发至加解密系统2中的加解密单元3。该APB/AHB总线转换器转换器用于将APB总线数据转换为AHB总线总线数据，实现APB总线和AHB总线之间的数据适配。
加解密单元3，将包含密文4的第二数据基于加密算法2加密得到包含密文5的第二数据，并经第二总线转发至加解密单元4。
加解密单元4，与接口单元耦合，将包含密文5的第二数据基于解密算法1和解密算法2解密得到包含明文2的第二数据，转发至接口单元。
接口单元，在接收到包含明文2的第二数据后，发送至系统外部。
实施例3：
参阅图5所示，存储单元为第一安全级别模块，分别与第一安全级别加解密系统(加解密系统1)和第一安全级别总线(AHB)对应。接口单元为第二安全级别模块，分别与第二安全级别加解密系统(加解密系统2)和第二安全级别总线(APB)对应。APB/AHB总线转换器中包括加解密转换单元。
将存储单元中的数据通过接口单元发送的过程包括：
加解密系统1中的加解密单元1，与存储单元耦合，将存储单元中的包含明文2的第一数据基于加密算法1加密后得到包含密文4的第一数据，并经AHB传输至总线转换器。
APB/AHB总线转换器将包含密文4的第一数据转换为包含密文4的第二数据，将包含密文4的第二数据基于加密算法2加密得到包含密文5的第二数据，以及基于解密算法1对包含密文5的第二数据解密得到包含密文6的第二数据。
加解密单元4，与接口单元耦合，将包含密文6的第二数据基于解密算法2解密得到包含明文2的第二数据，转发至接口单元。
接口单元，在接收到包含明文2的第二数据后，发送至系统外部。
加解密系统1中的加解密单元1，与存储单元耦合，将存储单元中的包含明文2的第一数据基于加密算法1加密后得到包含密文4的第一数据，并经AHB传输至总线转换器。
APB/AHB总线转换器转换器将包含密文4的第一数据转换为包含密文4的第二数据，转发至加解密系统2中的加解密单元3。该APB/AHB总线转换器转换器用于将APB总线数据转换为AHB总线总线数据，实现APB总线和AHB总线之间的数据适配。
加解密单元3，将包含密文4的第二数据基于第二加密算法加密得到包含密文5的第二数据，并经第二总线转发至加解密单元4。
加解密单元4，与接口单元耦合，将包含密文5的第二数据基于解密算法 1和解密算法2解密得到包含明文2的第二数据，转发至接口单元。
接口单元，在接收到包含明文2的第二数据后，发送至系统外部。
加解密系统1中的加解密单元1，与存储单元耦合，将存储单元中的包含明文2的第一数据基于加密算法1加密后得到包含密文4的第一数据，并经AHB传输至总线转换器。
APB/AHB总线转换器转换器将包含密文4的第一数据转换为包含密文4的第二数据，转发至加解密系统2中的加解密单元3。该APB/AHB总线转换器转换器用于将APB总线数据转换为AHB总线总线数据，实现APB总线和AHB总线之间的数据适配。
加解密单元3，将包含密文4的第二数据基于第二加密算法加密得到包含密文5的第二数据，并经第二总线转发至加解密单元4。
加解密单元4，与接口单元耦合，将包含密文5的第二数据基于解密算法1和解密算法2解密得到包含明文2的第二数据，转发至接口单元。
接口单元，在接收到包含明文2的第二数据后，发送至系统外部。
综上所述，本发明实施例中提到的方案可用于移动支付芯片、金融IC卡芯片等eSE芯片。eSE可以集成在其他功能电路芯片中或自身作为一个独立芯片。eSE功能的安全性通常高于其他非安全类业务功能，例如普通的语音或数据通信处理或应用(APP)软件业务。
采用本发明实施例中提供的系统，能够增强系统的防攻击能力，由于总线上传输的数据都是加密数据，即使攻击者采用探针攻击获得了总线数据，也很难破解出密钥。进一步地，对于高安全级别的模块对应高级别的加解密单元，算法复杂度更高，进一步保证传输数据的安全性。此外，每个系统对应的密钥是独一无二的，增加了芯片破解的难度。
此外，两级或多级总线及对应的模块和加解密单元在版图上分散的布局布线，高级别模块电路隐藏于大规模复杂的电路中，物理手段难以探测和查找到对应功能的电路，安全性更高。
因此，如果相关技术应用于eSE领域，安全性和性能得到保障，对需要 在总线传输数据的每个模块有针对性的加密，即保证了部分模块的高安全性，也保证了部分模块的高速度性。各模块根据安全性分别挂在不同级别的总线上，物理上隔离了安全数据与普通数据，进一步提高安全数据的安全性。通过合理设计总线级别，充分高效的利用了系统总线。改进后的安全总线分级设计有效提升了系统的处理效率，后续系统的维护也更加简单。当然，本实施例不仅限于应用在eSE领域，但eSE领域是一种优选的应用领域。
本发明实施例的各个单元或模块可以是电子器件(如晶体管等)形成的模块，如处理器或集成电路等。其中一些模块可以通过电子器件执行软件驱动代码实现相关功能。例如，实施例中曾经提到的密码算法模块1可以是一个执行密码算法的处理器，通过执行密码算法相关的软件驱动代码来实现密码算法功能。因此本发明的实施例可提供包括方法、系统、或计算机程序产品。因此，本发明实施例的系统可采用完全硬件实施例、或结合软件和硬件方面的实施例的形式。而且，本发明的一些模块的部分相关功能可采用在一个或多个其中包含有计算机可用程序代码的计算机可用存储介质(包括但不限于磁盘存储器、CD-ROM、光学存储器等)上实施的计算机程序产品的形式。
尽管已描述了本发明的优选实施例，但本领域内的技术人员一旦得知了基本创造性概念，则可对这些实施例作出另外的变更和修改。所以，所附权利要求意欲解释为包括优选实施例以及落入本发明范围的所有变更和修改。
本实施例中提到的“耦合”包括直接通过导线连接或通过其他模块、单元或设备的连接，其应被理解为是广义上的用于实现不同模块通过一定形式实现信号交流，不应被解释为仅包括直接相连。
显然，本领域的技术人员可以对本发明实施例进行各种改动和变型而不脱离本发明实施例的精神和范围。这样，倘若本发明实施例的这些修改和变型属于本发明权利要求及其等同技术的范围之内，则本发明也意图包含这些改动和变型在内。

Claims (10)

  1. 一种总线分级加密系统，其特征在于，包括：包括第一总线和第二总线在内的至少两个总线、与每个总线对应的加解密系统、与每个总线对应的至少一个信号处理模块，以及耦合在所述第一总线和所述第二总线间的总线转换器；其中，
    与所述第一总线对应的第一信号处理模块，用于经过所述第一总线、所述总线转换器和所述第二总线，与所述第二总线对应的第二信号处理模块进行数据通信；
    与所述第一总线对应的第一加解密系统，用于基于第一加密算法对在所述第一总线上传输的第一数据做加密处理；
    与所述第二总线对应的第二加解密系统，用于基于第二加密算法对在所述第二总线上传输的第二数据做加密处理；
    所述总线转换器，用于作为所述第一数据和所述第二数据之间的接口以适配所述第一总线和所述第二总线；
    所述第一加密算法对应于第一安全级别，所述第二加密算法对应于第二安全级别，所述第一安全级别和所述第二安全级别不同。
  2. 如权利要求1所述的系统，其特征在于，所述第一加解密系统包括：
    第一加解密单元，耦合于所述第一信号处理模块，用于在接收到所述第一信号处理模块发往所述第二信号处理模块的包含第一明文的所述第一数据时，对所述包含第一明文的所述第一数据基于所述第一加密算法进行加密以获得包含第一密文的所述第一数据，并将所述包含第一密文的第一数据经过所述第一总线转发至所述总线转换器。
  3. 如权利要求2所述的系统，其特征在于，所述第二加解密系统包括：
    第二加解密单元，耦合于所述总线转换器，用于接收所述总线转换器对所述包含第一密文的第一数据做转换后得到的所述包含第一密文的所述第二数据，对所述包含第一密文的所述第二数据进行基于所述第二加密算法的加 密和基于第一解密算法的解密以得到包含第二密文的所述第二数据，并在所述第二总线上传输所述包含第二密文的所述第二数据；
    第三加解密单元，耦合于所述第二信号处理模块，用于从所述第二总线接收所述包含第二密文的所述第二数据，对所述包含第二密文的所述第二数据进行基于第二解密算法的解密以得到所述第二信号处理模块需要的包含第一明文的第二数据；
    所述第一解密算法匹配所述第一加密算法；所述第二解密算法匹配所述第二加密算法。
  4. 如权利要求2所述的系统，其特征在于，所述第二加解密系统包括：
    第二加解密单元，耦合于所述总线转换器，用于接收所述总线转换器对所述包含第一密文的第一数据做转换后得到的所述包含第一密文的所述第二数据，对所述包含第一密文的所述第二数据进行基于所述第二加密算法的加密以得到包含第三密文的所述第二数据，并在所述第二总线上传输所述包含第三密文的所述第二数据；
    第三加解密单元，耦合于所述第二信号处理模块，用于从所述第二总线接收所述包含第三密文的所述第二数据，对所述包含第三密文的所述第二数据进行基于第一解密算法和第二解密算法的解密以得到所述第二信号处理模块需要的包含第一明文的第二数据；
    所述第一解密算法匹配所述第一加密算法；所述第二解密算法匹配所述第二加密算法。
  5. 如权利要求2所述的系统，其特征在于，所述总线转换器包括：加解密转换单元，用于对所述包含第一密文的第一数据做转换后得到的所述包含第一密文的所述第二数据，以及对所述包含第一密文的所述第二数据进行基于所述第二加密算法的加密和基于第一解密算法的解密以得到包含第二密文的所述第二数据，并在所述第二总线上传输所述包含第二密文的所述第二数据；
    所述第二加解密系统包括：
    第三加解密单元，耦合于所述第二信号处理模块，用于从所述第二总线接收所述包含第二密文的所述第二数据，对所述包含第二密文的所述第二数据进行基于第二解密算法的解密以得到所述第二信号处理模块需要的包含第一明文的第二数据；
    所述第一解密算法匹配所述第一加密算法；所述第二解密算法匹配所述第二加密算法。
  6. 如权利要求2至5中任一项所述的系统，其特征在于，所述第一加解密系统还包括：第四加解密单元；
    所述第一加解密单元，还用于在接收到所述第一信号处理模块发往所述第一总线对应的所述第三信号处理模块的包含第二明文的所述第一数据时，对所述包含第二明文的所述第一数据基于所述第一加密算法进行加密以获得包含第四密文的所述第一数据，并将所述包含第四密文的第一数据经过所述第一总线转发至所述第四加解密单元；
    所述第四加解密单元，用于对所述包含第四密文的第一数据进行基于第一解密算法的解密以得到与所述第三信号处理模块需要的包含第二明文的所述第一数据；所述第一解密算法匹配所述第一加密算法。
  7. 如权利要求1至6中任一项所述的系统，其特征在于，所述系统还包括：至少一个随机数发生器，用于产生每个加解密系统和每个加解密转换单元执行加密或解密所使用的密码算法集合的至少一个密钥。
  8. 如权利要求1至7中任一项所述的系统，其特征在于，所述第一总线和所述第二总线中的至少一个是：高性能总线AHB、高级外设总线APB、或为高级系统总线ASB中的至少一种总线。
  9. 如权利要求1至8中任一项所述的系统，其特征在于，每个总线对应的至少一个信号处理模块，包括：信号处理单元、存储单元、随机数发生器、密码算法单元、接口单元、时钟单元、或看门狗单元中的至少一项。
  10. 如权利要求1至9中任一项所述的系统，其特征在于，所述系统应用于移动支付领域。
PCT/CN2016/096288 2016-02-26 2016-08-22 一种总线分级加密系统 WO2017143744A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
US16/111,228 US10943020B2 (en) 2016-02-26 2018-08-24 Data communication system with hierarchical bus encryption system

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201610109754.X 2016-02-26
CN201610109754.XA CN105790927B (zh) 2016-02-26 2016-02-26 一种总线分级加密系统

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US16/111,228 Continuation US10943020B2 (en) 2016-02-26 2018-08-24 Data communication system with hierarchical bus encryption system

Publications (1)

Publication Number Publication Date
WO2017143744A1 true WO2017143744A1 (zh) 2017-08-31

Family

ID=56402918

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2016/096288 WO2017143744A1 (zh) 2016-02-26 2016-08-22 一种总线分级加密系统

Country Status (3)

Country Link
US (1) US10943020B2 (zh)
CN (1) CN105790927B (zh)
WO (1) WO2017143744A1 (zh)

Families Citing this family (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN105790927B (zh) 2016-02-26 2019-02-01 华为技术有限公司 一种总线分级加密系统
WO2018035655A1 (zh) * 2016-08-22 2018-03-01 武汉芯泰科技有限公司 一种基于加密总线的多处理器系统
CN106203181A (zh) * 2016-08-22 2016-12-07 武汉芯泰科技有限公司 一种基于加密总线的多处理器系统
CN108073818B (zh) * 2016-11-14 2021-07-09 华为技术有限公司 芯片的数据保护电路、芯片和电子设备
CN108073837B (zh) * 2016-11-15 2021-08-20 华为技术有限公司 一种总线安全保护方法及装置
CN109347791B (zh) * 2018-09-02 2021-04-20 黄策 双i/o总线sim卡
CN112181879B (zh) * 2020-08-28 2022-04-08 珠海欧比特宇航科技股份有限公司 用于dma控制器的apb接口模块、dma控制器和芯片
CN114095302A (zh) * 2021-11-23 2022-02-25 北京云迹科技有限公司 一种基于can总线传输的加密系统

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101533438A (zh) * 2008-05-24 2009-09-16 威盛电子股份有限公司 提供安全执行环境的微处理器及其执行安全编码的方法
EP2428910A2 (en) * 2010-09-10 2012-03-14 Raytheon Company Multi-level security data processing architecture
CN103218572A (zh) * 2012-01-23 2013-07-24 国际商业机器公司 用于在数据处理系统中访问数据的方法和设备
CN105323249A (zh) * 2015-11-04 2016-02-10 大连理工大学 一种加密解密通信系统及其加密解密方法
CN105790927A (zh) * 2016-02-26 2016-07-20 华为技术有限公司 一种总线分级加密系统

Family Cites Families (16)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US5638448A (en) * 1995-10-24 1997-06-10 Nguyen; Minhtam C. Network with secure communications sessions
US6378072B1 (en) * 1998-02-03 2002-04-23 Compaq Computer Corporation Cryptographic system
KR100672097B1 (ko) * 1998-07-31 2007-01-19 코닌클리즈케 필립스 일렉트로닉스 엔.브이. 데이터 처리 장치 및 데이터 처리 장치용 회로
WO2000057290A1 (fr) * 1999-03-19 2000-09-28 Hitachi, Ltd. Processeur d'informations
FR2800952B1 (fr) * 1999-11-09 2001-12-07 Bull Sa Architecture d'un circuit de chiffrement mettant en oeuvre differents types d'algorithmes de chiffrement simultanement sans perte de performance
US20020150248A1 (en) * 2001-03-06 2002-10-17 Kovacevic Branko D. System for digital stream reception via memory buffer and method thereof
KR100400386B1 (ko) * 2001-05-18 2003-10-08 아라리온 (주) 이종버스를 연결하는 고기밀 호스트 어댑터
KR100428786B1 (ko) * 2001-08-30 2004-04-30 삼성전자주식회사 내부 버스 입출력 데이터를 보호할 수 있는 집적 회로
CN101299228B (zh) * 2008-01-26 2010-09-01 青岛大学 一种基于单cpu双总线的安全网络终端
US8826039B2 (en) * 2010-02-02 2014-09-02 Broadcom Corporation Apparatus and method for providing hardware security
US9256734B2 (en) * 2012-04-27 2016-02-09 Broadcom Corporation Security controlled multi-processor system
US9407329B2 (en) * 2013-04-19 2016-08-02 Nxp B.V. Secure near field communication solutions and circuits
CN103078775B (zh) * 2012-12-31 2018-05-04 新奥特（北京）视频技术有限公司 一种基于多级esb总线间信息交互的方法及系统
CN104021104B (zh) * 2014-06-12 2017-11-07 国家电网公司 一种基于双总线结构的协同系统及其通信方法
US10169618B2 (en) * 2014-06-20 2019-01-01 Cypress Semiconductor Corporation Encryption method for execute-in-place memories
EP3291504B1 (en) * 2016-08-30 2020-03-11 Wacom Co., Ltd. Authentication and secure transmission of data between signature devices and host computers using transport layer security

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101533438A (zh) * 2008-05-24 2009-09-16 威盛电子股份有限公司 提供安全执行环境的微处理器及其执行安全编码的方法
EP2428910A2 (en) * 2010-09-10 2012-03-14 Raytheon Company Multi-level security data processing architecture
CN103218572A (zh) * 2012-01-23 2013-07-24 国际商业机器公司 用于在数据处理系统中访问数据的方法和设备
CN105323249A (zh) * 2015-11-04 2016-02-10 大连理工大学 一种加密解密通信系统及其加密解密方法
CN105790927A (zh) * 2016-02-26 2016-07-20 华为技术有限公司 一种总线分级加密系统

Also Published As

Publication number Publication date
US10943020B2 (en) 2021-03-09
CN105790927B (zh) 2019-02-01
US20190012472A1 (en) 2019-01-10
CN105790927A (zh) 2016-07-20

Similar Documents

Publication Publication Date Title
WO2017143744A1 (zh) 一种总线分级加密系统
JP6998435B2 (ja) メモリ動作の暗号化
CN108345806B (zh) 一种硬件加密卡和加密方法
US10680816B2 (en) Method and system for improving the data security during a communication process
JP2020535693A (ja) 記憶データ暗号化／復号化装置及び方法
US10715332B2 (en) Encryption for transactions in a memory fabric
CN209803788U (zh) 一种pcie可信密码卡
US10699031B2 (en) Secure transactions in a memory fabric
US7636441B2 (en) Method for secure key exchange
TW202121868A (zh) 資料的加解密方法、裝置、存儲介質及加密文件
CN107528690A (zh) 一种基于异构加速平台的sm4对称加解密方法及系统
US10776294B2 (en) System architecture with secure data exchange
US10037441B2 (en) Bus protection with improved key entropy
CN110430051A (zh) 一种密钥存储方法、装置及服务器
US11431489B2 (en) Encryption processing system and encryption processing method
WO2020118583A1 (zh) 数据处理方法、电路、终端设备及存储介质
TW201832514A (zh) 隱藏還原區塊鏈交易中交易方資訊之裝置及其方法
US11997192B2 (en) Technologies for establishing device locality
US9031239B2 (en) Information processing apparatus, information processing method, and computer readable storage medium
CN116962067A (zh) 一种信息加密方法、装置和设备
TWI675578B (zh) 加解密系統、加密裝置、解密裝置和加解密方法
US20210014052A1 (en) Method and terminal for establishing security infrastructure and device
CN114978714B (zh) 基于risc-v的轻量级数据总线加密安全传输方法
US20240273220A1 (en) Information processing system, information processing method and computer readable medium
CN116132031A (zh) 一种数据传输方法、系统、设备和可读存储介质

Legal Events

Date Code Title Description
NENP Non-entry into the national phase

Ref country code: DE

121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 16891192

Country of ref document: EP

Kind code of ref document: A1

122 Ep: pct application non-entry in european phase

Ref document number: 16891192

Country of ref document: EP

Kind code of ref document: A1