WO2019109418A1

WO2019109418A1 - Data protection method and apparatus, computer apparatus, and readable storage medium

Info

Publication number: WO2019109418A1
Application number: PCT/CN2017/119040
Authority: WO
Inventors: 李安
Original assignee: 深圳云天励飞技术有限公司
Priority date: 2017-12-05
Filing date: 2017-12-27
Publication date: 2019-06-13
Also published as: CN108090366B; CN108090366A

Abstract

A data protection method and apparatus, and a readable storage medium. The method comprises: receiving an access request of a master device of an application processor chip for data in a secure data area of a memory (101); determining the type of master device (102); if it is determined that the master device is a device not related to an external input and output interface, then allowing the master device to read the data from the secure data area (103); if it is determined that the master device is a low-speed peripheral device with an input and output interface, then prohibiting the master device from reading the data from the secure data area (104); and if it is determined that the master device is a high-speed peripheral device with an input and output interface, then performing security authentication, and if the security authentication is passed, then allowing the master device to read the data from the secure data area (105). The method can protect data conveniently and ensure that the data has a higher security level and reduces implementation costs.

Description

Data protection method and device, computer device and readable storage medium

This application claims the priority of the Chinese patent application filed on December 5, 2017, the Chinese Patent Office, the application number is 201711269114.6, and the invention name is "data protection method and device, computer device and readable storage medium", the entire contents of which are The citations are incorporated herein by reference.

Technical field

The present invention relates to the field of information security technologies, and in particular, to a data protection method and apparatus, a computer apparatus, and a readable storage medium.

Background technique

In face recognition and similar AI (Artificial Intelligence) products, the face image library and similar database are used as the basis for the final check comparison, which is the core data of the product. Once the attacker obtains and further tampers, You can illegally modify the permissions, or enable people who do not have permission to obtain permissions, so the security of the database is very necessary.

In addition, face recognition and similar AI products usually have some parameters (such as CNN (Convolutional Neural Network) parameters), which takes a lot of time and model to debug good parameters is to determine the performance of the algorithm and product. Key data, parameter security is also very necessary.

At present, AI products on the market do not have encryption and protection for databases and parameters for controlling costs, and some purchase high-cost IP and design solutions for encryption protection. The former is low in security and the latter is costly.

Summary of the invention

In view of the above, it is necessary to provide a data protection method and apparatus, a computer apparatus and a readable storage medium, which can conveniently protect data, ensure a high security level of data and reduce implementation cost.

A first aspect of the present application provides a data protection method, which is applied to a computer device including an application processor chip, the application processor chip is connected to a memory, and the memory includes a secure data area, and the method includes:

Receiving, by the master device of the application processor chip, an access request for data in the secure data area;

Determining the type of the primary device;

If it is determined that the master device is a device independent of an external input/output interface, allowing the master device to read the data from the secure data region;

If it is determined that the master device is a low-speed peripheral having an input/output interface, prohibiting the master device from reading the data from the secure data area;

If it is determined that the master device is a high-speed peripheral having an input/output interface, security authentication is performed, and if the security device is authenticated, the master device is allowed to read the data from the secure data region.

In another possible implementation manner, the performing the security certification includes:

Receive the entered permission to unlock the password;

Calculating a message digest of the entered permission unlock password;

Determining whether the calculated message digest of the input authority unlock password is the same as the pre-stored message digest in the application processor chip;

If the calculated message digest of the entered privilege unlock password is the same as the pre-stored message digest in the application processor chip, the security authentication is passed.

In another possible implementation, the memory is encapsulated in the application processor chip.

In another possible implementation, the application processor chip is further connected to an external storage medium and a memory, and the method further includes:

Encrypting the data, and storing the encrypted data in the external storage medium;

Receiving a data read instruction, and reading the encrypted data from the external storage medium according to the data read command;

The encrypted data is decrypted, and the decrypted data is stored in the secure data area.

In another possible implementation manner, the external storage medium includes a removable external storage medium and a non-removable external storage medium.

A second aspect of the present application provides a data protection device for a computer device including an application processor chip, the application processor chip being connected to a memory, the memory including a secure data area, the device comprising:

a receiving unit, configured to receive, by the master device of the application processor chip, an access request for data in the secure data area;

a determining unit, configured to determine a type of the master device;

a first processing unit, configured to: if the master device is determined to be a master device independent of an external input/output interface, permit the master device to read the data from the secure data region;

a second processing unit, configured to: if the master device is determined to be a low-speed peripheral having an input/output interface, prohibit the master device from reading the data from the secure data area;

a third processing unit, configured to perform security authentication if the master device is determined to be a high-speed peripheral device having an input/output interface, and if the security device is authenticated, permit the master device to read the data from the secure data region .

In another possible implementation, the application processor chip is further connected to an external storage medium and a memory, and the device further includes:

An encryption unit, configured to encrypt data, and store the encrypted data in the external storage medium;

a reading unit, configured to receive a data read instruction, and read the encrypted data from the external storage medium according to the data read instruction;

And a decryption unit, configured to decrypt the encrypted data, and store the decrypted data in the secure data area.

A third aspect of the present application provides a computer apparatus including an application processor chip for implementing the data protection method when executing a computer program stored in a memory.

A fourth aspect of the present application provides a computer readable storage medium having stored thereon a computer program that implements the data protection method when executed by an application processor chip.

The invention receives an access request of the main device of the application processor chip to the data in the secure data area of the memory; determines the type of the main device; if it is determined that the main device is a device unrelated to the external input and output interface, the device is allowed The master device reads the data from the secure data area; if it is determined that the master device is a low-speed peripheral having an input/output interface, prohibiting the master device from reading the data from the secure data area; It is determined that the master device is a high-speed peripheral having an input/output interface, and then performs security authentication. If the security device is authenticated, the master device is allowed to read the data from the secure data region. The invention can conveniently protect the data, ensure the data has a higher security level and reduce the implementation cost.

DRAWINGS

FIG. 1 is a flowchart of a data protection method according to Embodiment 1 of the present invention.

FIG. 2 is a flowchart of a data protection method according to Embodiment 2 of the present invention.

FIG. 3 is a data flow diagram of a data protection method according to Embodiment 2 of the present invention.

4 is a structural diagram of a data protection device according to Embodiment 3 of the present invention.

FIG. 5 is a structural diagram of a data protection device according to Embodiment 4 of the present invention.

FIG. 6 is a schematic diagram of a computer apparatus according to Embodiment 5 of the present invention.

Detailed ways

The present invention will be described in detail below with reference to the accompanying drawings and specific embodiments. It should be noted that the embodiments in the present application and the features in the embodiments may be combined with each other without conflict.

In the following description, numerous specific details are set forth in the description All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative efforts are within the scope of the present invention.

All technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention belongs, unless otherwise defined. The terminology used in the description of the present invention is for the purpose of describing particular embodiments and is not intended to limit the invention.

Preferably, the data protection method of the present invention is applied in one or more computer devices. The computer device is a device capable of automatically performing numerical calculation and/or information processing according to an instruction set or stored in advance, and the hardware thereof includes but is not limited to an application processor chip, an external storage medium, a memory, and the like.

The computer device may be a host device such as a desktop computer, a notebook, a palmtop computer, and a cloud server. The computer device can perform human-computer interaction with the user through a keyboard, a mouse, a remote controller, a touch panel, or a voice control device.

Embodiment 1

FIG. 1 is a flowchart of a data protection method according to Embodiment 1 of the present invention. The data protection method is applied to a computer device including an application processor chip, the application processor chip being coupled to a memory.

In order to increase the security level of the data, the memory can be packaged in the main chip to prevent direct reading or interception of data in the memory. For example, the memory is a DDR SDRAM (Double Data Rate Synchronous Dynamic Random Access Memory), and the DDR SDRAM particles are SIP (System In a Package) or POP (Package on Package, The package is packaged in the main chip to prevent direct reading or interception of data from the DDR SDRAM. Since the memory is packaged in the main chip, it is difficult and costly to read or intercept the data in the memory.

The memory (eg, DDR SDRAM) is divided into a secure data area and a non-secure data area. The data to be protected, such as a database of AI (Artificial Intelligence) products (such as a face image library), parameters (such as CNN (Convolutional Neural Network) parameters), can store core data or key data. In the secure data area, other data is stored in the non-secure data area. A fixed address segment can be divided as a secure data area.

As shown in FIG. 1 , the data protection method specifically includes the following steps:

101: Receive an access request of the master device of the application processor chip to data in the secure data area.

For example, when the processor of the application processor chip detects a face image and needs to perform face comparison according to the stored face image library, an access request for the face image library and the CNN parameter in the secure data area is proposed.

The data in the secure data area may be unencrypted data (ie, plaintext) or encrypted data (ie, ciphertext).

102: Determine the type of the master device.

The type of the master device may include at least the following types:

(1) Devices that are not related to the external I/O interface, such as the processor of the application processor chip (the state in which the JTAG port is disabled) or the DMA (Direct Memory Access) controller.

(2) Low-speed peripherals with input and output interfaces, such as UART (Universal Asynchronous Receiver/Transmitter), I ² C (Inter-Integrated Circuit) device, SPI of the application processor chip (Serial Peripheral Interface) device.

(3) A high-speed peripheral device having an input/output interface, such as a USB (Universal Serial Bus) device of the application processor chip, and a PCIe (peripheral component interconnect express) device.

The correspondence between the master device identifier (for example, the master device name, the master device number, and the like) of the application processor chip and the master device type may be set in advance, and the corresponding relationship defines the master device type corresponding to the different master device identifiers. After receiving the access request of the master device of the application processor chip to the data in the secure data area, acquiring a master device identifier (for example, a master device name) of the master device, according to the master device identifier Find the corresponding master device type in the corresponding relationship, that is, obtain the type of the master device.

103: If it is determined that the master device is a device unrelated to an external input/output interface, the master device is allowed to read the data from the secure data region.

For example, if it is determined that the master device is a DMA controller of the application processor chip, the master device is allowed to read the data from the secure data region.

104: If it is determined that the master device is a low-speed peripheral having an input/output interface, prohibiting the master device from reading the data from the secure data area.

For example, if it is determined that the master device is an SPI device of the application processor chip, the master device is prohibited from reading the data from the secure data region.

105: If it is determined that the master device is a high-speed peripheral device having an input/output interface, performing security authentication, and if passing the security authentication, allowing the master device to read the data from the secure data region.

For example, if it is determined that the master device is a USB device of the application processor chip, security authentication is performed, and if the security device is authenticated, the master device is allowed to read the data from the secure data region.

Two accessible address segments A and B can be configured for high-speed peripherals with input and output interfaces, where A is a non-secure data address segment, corresponding to a non-secure data region, and B is a secure data address segment corresponding to the secure data region. By default, only the A address segment is valid. The high-speed peripherals with input and output interfaces can only access the non-secure data area of the memory and prohibit access to the secure data area of the memory. After receiving the high-speed peripheral with the input and output interface to access the data in the secure data area, the security authentication process is started. If the security authentication process is passed, the access permission is turned on, the valid address segment is switched to B, and the high-speed peripheral having the input/output interface accesses the data of the secure data area. After the access is complete, switch the valid address segment back to A and close the access rights.

Security verification can be performed by the HASH encryption algorithm. Specifically, the performing security authentication may include: receiving an input permission unlock password; calculating a message digest of the input authority unlock password; determining a calculated message digest of the input authority unlock password and the application processor chip Whether the pre-stored message digests are the same; if the calculated message digest of the input rights unlocking password is the same as the pre-stored message digest in the application processor chip, the security authentication is passed.

Security verification can be done in other ways. For example, biometric information of the user (eg, fingerprint, iris, face image, sound, etc.) may be collected; whether the collected biometric information matches the pre-stored biometric information; if the collected biometric information and the pre-stored biometrics If the feature information matches, it passes the security certification.

The data protection method of the first embodiment receives an access request of the master device of the application processor chip to the data in the secure data area of the memory; determines the type of the master device; if it is determined that the master device is independent of the external input and output interface The device, the master device is allowed to read the data from the secure data area; if the master device is determined to be a low-speed peripheral device having an input/output interface, the master device is prohibited from reading from the secure data area The data; if it is determined that the master device is a high-speed peripheral having an input/output interface, performing security authentication, and if passing the security authentication, allowing the master device to read the data from the secure data region. The data protection method of the first embodiment can conveniently protect data, ensure that the data has a higher security level and reduce the implementation cost.

Embodiment 2

FIG. 2 is a flowchart of a data protection method according to Embodiment 2 of the present invention. FIG. 3 is a data flow diagram of a data protection method according to Embodiment 2 of the present invention. The data protection method provided by the second embodiment of the present invention will be described below with reference to FIG. 2 and FIG.

The data protection method is applied to an application processor chip, and the application processor chip is connected to an external storage medium and a memory, and the memory includes a secure data area. As shown in FIG. 2, the data protection method specifically includes the following steps:

201: Encrypt data, and store the encrypted data in the external storage medium.

The data can be any data that needs to be secured. For example, the data may be user's private data, such as a phone book, a short message, a mail, an account number, and the like. The data may also be key data or core data, such as a database of AI products (eg, a face picture library) and parameters (eg, CNN parameters).

The data can be a single file, such as a picture, document, music, video or application, or a folder.

The encrypted data is ciphertext, that is, the external storage medium stores ciphertext.

The data can be encrypted by an asymmetric encryption algorithm. In the preferred embodiment, the data may be encrypted by an RSA asymmetric encryption algorithm. For example, the database of the AI product (such as a face picture library) and parameters (such as CNN parameters) can be encrypted by the RSA public key, and the encrypted database (such as a face picture library) and parameters (such as CNN parameters) can be stored. Into the external storage medium.

Alternatively, the data can be encrypted by a symmetric encryption algorithm. In the preferred embodiment, the data can be encrypted by an AES symmetric encryption algorithm. For example, an AES encryption algorithm with a key bit width of 256 bits or more is used to encrypt a database (for example, a face image library) and parameters (for example, CNN parameters) of an AI product, and an encrypted database (for example, a face image library) and parameters (for example) For example, CNN parameters are stored in the external storage medium.

The external storage medium may include a removable external storage medium, such as an SD/TF card, for storing frequently changed data, such as a face image library, for routine maintenance and updates.

The external storage medium may also include a non-removable external storage medium, such as nandflash/norflash, emmc flash, for storing infrequently changed data, such as trained CNN parameters.

202: Receive a data read instruction, and read the encrypted data from the external storage medium according to the data read command.

For example, when it is required to use the stored face image library to compare with the collected face image, the encrypted face image library and CNN parameters are read from the external storage medium.

203: Decrypt the encrypted data, and store the decrypted data in the secure data area.

According to the encryption algorithm in step 201, the encrypted data is decrypted by using a corresponding decryption algorithm. For example, in step 201, the data is encrypted with an RSA public key, and in step 203, the encrypted data is decrypted with an RSA private key. For another example, in step 201, the data is encrypted by the AES key, and in step 203, the AES key is used for decryption.

The decrypted data is plaintext, that is, the secure data area stores plaintext. In this embodiment, the data in the secure data area (such as the face picture library and the CNN parameter) needs to be frequently used. If the ciphertext is stored in the secure data area, it will need to be repeatedly encrypted and decrypted frequently, which will greatly affect the performance. Therefore, the plaintext (ie, the decrypted data) is stored in the secure data area of the memory.

204: Receive an access request of the master device of the application processor chip to the decrypted data in the secure data area.

The step 204 in this embodiment is substantially the same as the step 101 in the first embodiment. The data is the decrypted data. For details, refer to the description of step 101 in the first embodiment. Narration.

205: Determine the type of the primary device.

Step 205 is the same as step 102 in the first embodiment. For details, refer to the description of step 102 in the first embodiment, and details are not described herein.

206: If it is determined that the master device is a master device that is independent of an external input/output interface, the master device is allowed to read the decrypted data from the secure data region.

The step 206 in this embodiment is substantially the same as the step 103 in the first embodiment (the embodiment only defines the data as the decrypted data). For details, refer to the related description in step 102 in the first embodiment. Narration.

207: If it is determined that the master device is a low-speed peripheral device having an input/output interface, the master device is prohibited from reading the decrypted data from the secure data region.

The step 207 in this embodiment is substantially the same as the step 104 in the first embodiment (the embodiment only defines the data as the decrypted data). For details, refer to the related description in step 102 in the first embodiment. Narration.

208: If it is determined that the master device is a high-speed peripheral device having an input/output interface, perform security authentication, and if the security device is authenticated, allow the master device to read the decrypted data from the secure data region.

The step 208 in this embodiment is substantially the same as the step 105 in the first embodiment (the embodiment only defines the data as the decrypted data). For details, refer to the related description in step 103 in the first embodiment. Narration.

The data protection method of the second embodiment encrypts the data, stores the encrypted data in an external storage medium, receives a data read instruction, and reads the encrypted data from the external storage medium according to the data read command. Decrypting the encrypted data, storing the decrypted data in a secure data area of the memory; and receiving, by the master device of the application processor chip, an access request for the decrypted data in the secure data area Determining a type of the master device; if it is determined that the master device is a device independent of an external input/output interface, allowing the master device to read the decrypted data from the secure data region; The master device is a low-speed peripheral having an input/output interface, and the master device is prohibited from reading the decrypted data from the secure data area; if the master device is determined to be a high-speed peripheral having an input/output interface, Performing security authentication, if passing the security authentication, allowing the master device to read the decrypted data from the secure data area. The data protection method of the second embodiment can conveniently protect the data, ensure the data has a high security level and reduce the implementation cost.

Embodiment 3

4 is a structural diagram of a data protection device according to Embodiment 3 of the present invention. As shown in FIG. 4, the data protection device 10 may include: a receiving unit 401, a determining unit 402, a first processing unit 403, a second processing unit 404, and a third processing unit 405.

The receiving unit 401 is configured to receive an access request of the master device of the application processor chip to the data in the secure data area.

For example, when the processor of the application processor chip detects the face image and needs to perform face matching according to the stored face picture library, an access request for the face picture library and the CNN parameter in the secure data area is proposed.

The determining unit 402 is configured to determine the type of the master device.

The type of the master device may include at least the following types:

The first processing unit 403 is configured to allow the master device to read the data from the secure data area if it is determined that the master device is a device independent of an external input/output interface.

The second processing unit 404 is configured to, if it is determined that the master device is a low-speed peripheral device having an input/output interface, prohibit the master device from reading the data from the secure data region.

The third processing unit 405 is configured to perform security authentication if it is determined that the master device is a high-speed peripheral device having an input/output interface, and if the security device is authenticated, allow the master device to read the security data region from the security data region. data.

The data protection device of the third embodiment receives an access request of the master device of the application processor chip to the data in the secure data area of the memory; determines the type of the master device; if it is determined that the master device is independent of the external input and output interface The device, the master device is allowed to read the data from the secure data area; if the master device is determined to be a low-speed peripheral device having an input/output interface, the master device is prohibited from reading from the secure data area The data; if it is determined that the master device is a high-speed peripheral having an input/output interface, performing security authentication, and if passing the security authentication, allowing the master device to read the data from the secure data region. The data protection device of the third embodiment can conveniently protect the data, ensure the data has a higher security level and reduce the implementation cost.

Embodiment 4

FIG. 5 is a structural diagram of a data protection apparatus according to Embodiment 4 of the present invention. As shown in FIG. 5, the data protection device 50 may include: an encryption unit 501, a reading unit 502, a decryption unit 503, a receiving unit 504, a determining unit 505, a first processing unit 506, a second processing unit 507, and a third. Processing unit 508.

The encryption unit 501 is configured to encrypt data and store the encrypted data in the external storage medium.

The reading unit 502 is configured to receive a data read instruction, and read the encrypted data from the external storage medium according to the data read instruction.

The decryption unit 503 is configured to decrypt the encrypted data, and store the decrypted data in the secure data area.

The encrypted data is decrypted according to an encryption algorithm of the encryption unit 501 using a corresponding decryption algorithm. For example, the encryption unit 501 encrypts the data with the RSA public key, and the decryption unit 503 decrypts the encrypted data with the RSA private key. For another example, the encryption unit 501 encrypts the data with the AES key, and the decryption unit 503 decrypts with the AES key.

The receiving unit 504 is configured to receive, by the master device of the application processor chip, an access request for the decrypted data in the secure data area.

In this embodiment, the receiving unit 504 is substantially the same as the receiving unit 401 in the third embodiment. The data is the decrypted data. For details, refer to the related description of the receiving unit 401 in the third embodiment. I will not go into details here.

The determining unit 505 is configured to determine the type of the master device.

The determining unit 505 is the same as the determining unit 402 in the third embodiment. For details, refer to the related description of the determining unit 402 in the third embodiment, and details are not described herein.

The first processing unit 506 is configured to, if it is determined that the master device is a master device that is independent of an external input/output interface, allow the master device to read the decrypted data from the secure data region.

In the embodiment, the first processing unit 506 is substantially the same as the first processing unit 403 in the third embodiment. (The present embodiment only defines the data as the decrypted data. For details, refer to the first processing in the third embodiment. The related description of the unit 403 is not described here.

The second processing unit 507 is configured to, if it is determined that the master device is a low-speed peripheral device having an input/output interface, prohibit the master device from reading the decrypted data from the secure data region.

In this embodiment, the second processing unit 507 is substantially the same as the second processing unit 404 in the third embodiment. This embodiment only defines the data as the decrypted data. For details, refer to the second processing in the third embodiment. A related description of the unit 404 is not described herein.

The third processing unit 508 is configured to perform security authentication if it is determined that the master device is a high-speed peripheral device having an input/output interface, and if the security device is authenticated, allow the master device to read the security data region from the security data region. Decrypted data.

In this embodiment, the third processing unit 508 is substantially the same as the third processing unit 405 in the third embodiment. (The embodiment only defines the data as the decrypted data. For details, refer to the third processing in the third embodiment. The related description of unit 405 is not described herein.

The data protection device of the fourth embodiment encrypts the data, stores the encrypted data in an external storage medium, receives a data read command, and reads the encrypted data from the external storage medium according to the data read command. Decrypting the encrypted data, storing the decrypted data in a secure data area of the memory; and receiving, by the master device of the application processor chip, an access request for the decrypted data in the secure data area Determining a type of the master device; if it is determined that the master device is a device independent of an external input/output interface, allowing the master device to read the decrypted data from the secure data region; The master device is a low-speed peripheral having an input/output interface, and the master device is prohibited from reading the decrypted data from the secure data area; if the master device is determined to be a high-speed peripheral having an input/output interface, Performing security authentication, if passing the security authentication, allowing the master device to read the decrypted data from the secure data area. The data protection device of the fourth embodiment can conveniently protect the data, ensure the data has a higher security level and reduce the implementation cost.

Embodiment 5

FIG. 6 is a schematic diagram of a computer apparatus according to Embodiment 5 of the present invention. The computer device 1 includes a memory 20, an application processor chip 30, and a computer program 40, such as a data protection program, stored in the memory 20 and executable on the application processor chip 30. When the application processor chip 30 executes the computer program 40, the steps in the foregoing data protection method embodiment are implemented, for example, steps 101-105 shown in FIG. 1 or steps 201-208 shown in FIG. Alternatively, when the application processor chip 30 executes the computer program 40, the functions of the modules/units in the above device embodiments are implemented, such as the units 401-405 in FIG. 4 or the units 501-508 in FIG.

Illustratively, the computer program 40 can be partitioned into one or more modules/units that are stored in the memory 20 and executed by the application processor chip 30, To complete the present invention. The one or more modules/units may be a series of computer program instruction segments capable of performing a particular function for describing the execution of the computer program 40 in the computer device 1. For example, the computer program 40 may be divided into a receiving unit 401, a determining unit 402, a first processing unit 403, a second processing unit 404, a third processing unit 405 in FIG. 4, or may be segmented into the encryption in FIG. The unit 501, the reading unit 502, the decryption unit 503, the receiving unit 504, the determining unit 505, the first processing unit 506, the second processing unit 507, and the third processing unit 508, and the specific functions of each unit, refer to the third embodiment and the fourth embodiment. .

The computer device 1 may be a computing device such as a desktop computer, a notebook, a palmtop computer, and a cloud server. It will be understood by those skilled in the art that the schematic diagram 6 is merely an example of the computer device 1 and does not constitute a limitation of the computer device 1. It may include more or less components than those illustrated, or may combine some components, or different. The components, such as the computer device 1, may also include input and output devices, network access devices, buses, and the like.

The application processor chip 30 is referred to as a processor. The processor may be a central processing unit (CPU), and may also include other general-purpose processors, a digital signal processor (DSP), an application specific integrated circuit (ASIC), and an off-the-shelf device. Field-Programmable Gate Array (FPGA) or other programmable logic device, discrete gate or transistor logic device, discrete hardware components, etc. The general purpose processor may be a microprocessor or the processor or any conventional processor or the like, which is a control center of the computer device 1, and connects various parts of the entire computer device 1 by various interfaces and lines. .

The memory 20 can be used to store the computer program 40 and/or modules/units by running or executing computer programs and/or modules/units stored in the memory 20, and invoking storage The data within the memory 20 implements various functions of the computer device 1. The memory 20 may mainly include a storage program area and a storage data area, wherein the storage program area may store an operating system, an application required for at least one function (such as a sound playing function, an image playing function, etc.), and the like; the storage data area may be Data (such as audio data, phone book, etc.) created according to the use of the computer device 1 is stored. The memory 20 may include an external storage medium, and may also include a memory. In addition, the memory 20 may include a high-speed random access memory, and may also include a non-volatile memory such as a hard disk, a memory, a plug-in hard disk, a smart memory card (SMC), and a secure digital (Secure Digital, SD). Card, flash card, at least one disk storage device, flash device, or other volatile solid state storage device.

The modules/units integrated by the computer device 1 can be stored in a computer readable storage medium if implemented in the form of a software functional unit and sold or used as a stand-alone product. Based on such understanding, the present invention implements all or part of the processes in the foregoing embodiments, and may also be completed by a computer program to instruct related hardware. The computer program may be stored in a computer readable storage medium. The steps of the various method embodiments described above may be implemented when the program is executed by the processor. Wherein, the computer program comprises computer program code, which may be in the form of source code, object code form, executable file or some intermediate form. The computer readable medium may include any entity or device capable of carrying the computer program code, a recording medium, a USB flash drive, a removable hard disk, a magnetic disk, an optical disk, a computer memory, a read-only memory (ROM). , random access memory (RAM, Random Access Memory), electrical carrier signals, telecommunications signals, and software distribution media. It should be noted that the content contained in the computer readable medium may be appropriately increased or decreased according to the requirements of legislation and patent practice in a jurisdiction, for example, in some jurisdictions, according to legislation and patent practice, computer readable media Does not include electrical carrier signals and telecommunication signals.

In the several embodiments provided by the present invention, it should be understood that the disclosed computer apparatus and methods may be implemented in other manners. For example, the computer device embodiments described above are merely illustrative. For example, the division of the unit is only a logical function division, and the actual implementation may have another division manner.

In addition, each functional unit in each embodiment of the present invention may be integrated in the same processing unit, or each unit may exist physically separately, or two or more units may be integrated in the same unit. The above integrated unit can be implemented in the form of hardware or in the form of hardware plus software function modules.

It is apparent to those skilled in the art that the present invention is not limited to the details of the above-described exemplary embodiments, and the present invention can be embodied in other specific forms without departing from the spirit or essential characteristics of the invention. Therefore, the present embodiments are to be considered as illustrative and not restrictive, and the scope of the invention is defined by the appended claims instead All changes in the meaning and scope of equivalent elements are included in the present invention. Any reference signs in the claims should not be construed as limiting the claim. In addition, it is to be understood that the word "comprising" does not exclude other elements or steps. A plurality of units or computer devices recited in the computer device claims can also be implemented by the same unit or computer device in software or hardware. The first, second, etc. words are used to denote names and do not denote any particular order.

It should be noted that the above embodiments are only for explaining the technical solutions of the present invention and are not intended to be limiting, and the present invention will be described in detail with reference to the preferred embodiments. Modifications or equivalents are made without departing from the spirit and scope of the invention.

Claims

A data protection method is applied to a computer device including an application processor chip, wherein the application processor chip is connected to a memory, wherein the memory includes a secure data area, and the method includes:

Receiving, by the master device of the application processor chip, an access request for data in the secure data area;

Determining the type of the primary device;

If it is determined that the master device is a device independent of an external input/output interface, allowing the master device to read the data from the secure data region;

If it is determined that the master device is a low-speed peripheral having an input/output interface, prohibiting the master device from reading the data from the secure data area;

If it is determined that the master device is a high-speed peripheral having an input/output interface, security authentication is performed, and if the security device is authenticated, the master device is allowed to read the data from the secure data region.
The method of claim 1 wherein said performing security authentication comprises:

Receive the entered permission to unlock the password;

Calculating a message digest of the entered permission unlock password;

Determining whether the calculated message digest of the input authority unlock password is the same as the pre-stored message digest in the application processor chip;

If the calculated message digest of the entered privilege unlock password is the same as the pre-stored message digest in the application processor chip, the security authentication is passed.
The method of claim 1 or 2 wherein said memory is encapsulated within said application processor chip.
The method of claim 1 or 2, wherein the application processor chip is further connected to an external storage medium and a memory, the method further comprising:

Encrypting the data, and storing the encrypted data in the external storage medium;

Receiving a data read instruction, reading the encrypted data from the external storage medium according to the data read command;

The encrypted data is decrypted, and the decrypted data is stored in the secure data area.
The method of claim 4 wherein said encrypting the data comprises:

Encrypting the data by an asymmetric encryption algorithm, the asymmetric encryption algorithm including an RSA algorithm; or

Encrypting the data by a symmetric encryption algorithm, where the symmetric encryption algorithm includes an AES algorithm;

The security certification includes:

Security verification is performed by the HASH encryption algorithm.
The method according to claim 4 or 5, wherein the external storage medium comprises a removable external storage medium and a non-removable external storage medium.
A data protection device is applied to a computer device including an application processor chip, wherein the application processor chip is connected to a memory, wherein the memory comprises a secure data area, and the device comprises:

a receiving unit, configured to receive, by the master device of the application processor chip, an access request for data in the secure data area;

a determining unit, configured to determine a type of the master device;

a first processing unit, configured to: if the master device is determined to be a master device independent of an external input/output interface, permit the master device to read the data from the secure data region;

a second processing unit, configured to: if the master device is determined to be a low-speed peripheral having an input/output interface, prohibit the master device from reading the data from the secure data area;

a third processing unit, configured to perform security authentication if the master device is determined to be a high-speed peripheral device having an input/output interface, and if the security device is authenticated, permit the master device to read the data from the secure data region .
The device of claim 7, wherein the application processor chip is further connected to an external storage medium and a memory, the device further comprising:

An encryption unit, configured to encrypt data, and store the encrypted data in the external storage medium;

a reading unit, configured to receive a data read instruction, and read the encrypted data from the external storage medium according to the data read instruction;

And a decryption unit, configured to decrypt the encrypted data, and store the decrypted data in the secure data area.
A computer apparatus, comprising: an application processor chip, wherein the application processor chip is configured to perform data protection according to any one of claims 1-6 when executing a computer program stored in a memory method.
A computer readable storage medium having stored thereon a computer program, wherein the computer program is executed by an application processor chip to implement the data protection method according to any one of claims 1-6.