WO2020010642A1

WO2020010642A1 - Secure encryption chip and electronic device comprising same

Info

Publication number: WO2020010642A1
Application number: PCT/CN2018/095977
Authority: WO
Inventors: 杨俊佳; 杨俊诚
Original assignee: 杨俊佳
Priority date: 2018-07-10
Filing date: 2018-07-17
Publication date: 2020-01-16
Also published as: CN109145613A

Abstract

A secure encryption chip and an electronic device comprising same. The chip comprises: an encryption unit for generating a key according to a preset encryption algorithm, a memory for saving the key, and a bus interface for data interaction. The encryption unit is electrically connected to the memory; the memory is electrically connected to the bus interface. By means of an approach of providing the encryption unit in the chip, and by providing the memory for storing the key generated by the encryption unit, the purpose of improving the data security is achieved, thereby solving the problem in the related technology of the user data insecurity caused by the unreasonable design of an electronic element.

Description

Security encryption chip and electronic equipment containing the chip

Technical field

The present application relates to the field of integrated circuits, and in particular, to a security encryption chip and an electronic device containing the chip.

Background technique

In recent years, with the development of new technologies such as communication, measurement and control, and embedded systems, in order to meet various needs, designers need to design different terminals. No matter how the design of these terminals changes, its core parts such as processors and memories are not In the related technology, when designing and manufacturing a blockchain-based electronic device, due to design defects, user data is easily stolen and leaked, and absolute security cannot be achieved.

Therefore, a security encryption chip and an electronic device containing the chip are urgently needed to solve the problem of insecure user data caused by the irrational design of electronic components in related technologies.

Summary of the invention

The main purpose of this application is to provide a secure encryption chip and an electronic device containing the chip, in order to solve the problem of insecure user data caused by irrational design of electronic components in the related technology.

To achieve the above object, according to one aspect of the present application, a security encryption chip is provided.

The security encryption chip according to the present application includes: an encryption unit for generating a key according to a preset encryption algorithm, a memory for storing the key, and a bus interface for data interaction. The encryption unit is electrically connected to the memory. The memory is electrically connected to the bus interface.

Further, the bus interface is a CAN bus interface.

Further, the encryption unit generates the key based on a symmetric encryption algorithm and an asymmetric encryption algorithm.

Further, the principle of the symmetric encryption algorithm uses any one or more of DES, 3DES, and AES.

Further, it further comprises an FSMC interface for performing static storage, and the FSMC interface is electrically connected to the memory.

Further, the memory is any one or more of SRAM, ROM, RAM, DRAM, and FLASH.

Further, an ADC data acquisition interface is further included, and the ADC data acquisition interface is electrically connected to the bus interface.

Further, a GPIO interface is further included, and the GPIO interface is electrically connected to the bus interface.

Further, it further comprises a JTAG interface for internal testing of the chip, and the JTAG interface is electrically connected to the encryption unit.

To achieve the above object, according to another aspect of the present application, an electronic device is provided.

The electronic device according to this application includes: the security encryption chip, a local data transmission module, and a local data storage module. The bus interface is electrically connected to the local data transmission module. The local data transmission module is in communication with the local data transmission module. The local data storage module is electrically connected, the security encryption chip receives the to-be-encrypted data sent by the local data transmission module to perform an encryption operation, and saves the encrypted encrypted data to the local data storage module.

In the embodiment of the present application, a method of setting an encryption unit in a chip is adopted, and the purpose of enhancing data security is achieved by setting a memory to store a key generated by the encryption unit, thereby solving the related technical problems due to the design of electronic components. Reasonably insecure user data.

BRIEF DESCRIPTION OF THE DRAWINGS

The accompanying drawings, which form a part of this application, serve to provide further understanding of the application, and make other features, objects, and advantages of the application more apparent. The drawings and descriptions of the schematic embodiments of the present application are used to explain the present application, and do not constitute an improper limitation on the present application. In the drawings:

FIG. 1 is a schematic structural diagram of an encryption chip according to the present application.

detailed description

In order to enable those skilled in the art to better understand the solutions of the present application, the technical solutions in the embodiments of the present application will be clearly and completely described with reference to the accompanying drawings in the embodiments of the present application. Obviously, the described embodiments are merely Examples are part of this application, but not all examples. Based on the embodiments in this application, all other embodiments obtained by a person of ordinary skill in the art without creative efforts should fall within the protection scope of this application.

It should be noted that the terms “first” and “second” in the specification and claims of the present application and the above drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way may be interchanged where appropriate in order to facilitate the embodiments of the present application described herein. Furthermore, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product, or device that contains a series of steps or units need not be limited to those explicitly listed Those steps or units may instead include other steps or units not explicitly listed or inherent to these processes, methods, products or equipment.

In this application, the terms "up", "down", "left", "right", "front", "rear", "top", "bottom", "inside", "outside", "middle", The orientation or position relationship indicated by “vertical”, “horizontal”, “horizontal”, “longitudinal” and the like is based on the orientation or position relationship shown in the drawings. These terms are mainly used to better describe the present invention and its embodiments, and are not used to limit that the indicated device, element or component must have a specific orientation, or be constructed and operated in a specific orientation.

In addition, some of the above terms may be used to indicate other positions or positions, in addition to other meanings. For example, the term "up" may be used to indicate some kind of dependency relationship or connection relationship in some cases. For those of ordinary skill in the art, the specific meanings of these terms in the present invention can be understood according to specific situations.

In addition, the terms "installation", "setup", "installation", "connection", "connection", and "socket" should be interpreted in a broad sense. For example, it can be a fixed connection, a detachable connection, or a monolithic structure; it can be a mechanical connection or an electrical connection; it can be directly connected or indirectly connected through an intermediate medium, or it can be two devices, components, or components. Internal connectivity. For those of ordinary skill in the art, the specific meanings of the above terms in the present invention can be understood according to specific situations.

It should be noted that, in the case of no conflict, the embodiments in the present application and the features in the embodiments can be combined with each other. The application will be described in detail below with reference to the drawings and embodiments.

As shown in FIG. 1, the present application relates to a secure encryption chip. The device includes an encryption unit for generating a key according to a preset encryption algorithm, a memory for storing the key, and a bus interface for data interaction. The encryption unit is electrically connected to the memory, and the memory is connected to the memory. The bus interface is electrically connected.

Preferably, the security encryption chip of the present application is a local data processing chip that can be used independently, and is not connected to the external Internet and does not perform data interaction with the external Internet, thereby ensuring the absolute security of local data.

Preferably, the encryption unit according to the present invention generates a key locally / offline based on the blockchain encryption technology and stores the key to the local / offline local data storage module, thereby preventing hacking and preventing Technical effects of data loss and tampering.

Specifically, the key is a private key and a public key. Although most Bitcoin wallet tools store the private key and the public key together in the form of a key pair for convenience, the public key can be calculated from the private key. Therefore, the key described in the present invention may also be a private key; among them, a Bitcoin wallet contains a series of key pairs, and each key pair includes a private key and a public key. The private key is a number, which is usually randomly selected. With the private key, we can use the one-way encryption function of elliptic curve multiplication to generate a public key. With the public key, we can use a one-way cryptographic hash. The function generates a Bitcoin address.

Preferably, the first and most important step in generating a key is to find a sufficiently secure source of entropy, that is, a source of randomness. Generating a Bitcoin private key is essentially the same as "choosing a number between 1 and 2 ^ 256". As long as the results selected are unpredictable or non-repeatable, the specific method of selecting numbers is not important. Bitcoin software uses a random number generator underlying the operating system to generate 256-bit entropy (randomness). Under normal circumstances, the operating system random number generator is initialized by an artificial random source, and it may also need to be initialized by shaking the mouse continuously for a few seconds; specifically, the private key can be between 1 and n-1 Any number, where n is a constant (n = 1.158 * 10 ^ 77, slightly less than 2 ^ 256), and is defined by the order of the elliptic curve used by Bitcoin. To generate such a private key, we randomly select a 256-bit number and check if it is less than n-1. From a programming point of view, it is generally to take a long string of random bytes from a cryptographically secure random source and use the SHA256 hash algorithm to operate it, so that a 256-bit number can be easily generated. If the result of the operation is less than n-1, we have a suitable private key. Otherwise, we repeat again with another random number.

Preferably, the public key can be calculated from the private key by an elliptic curve algorithm, which is an irreversible process: K = k * G. Where k is the private key, G is a constant point called the generation point, and K is the resulting public key. Among them, the elliptic curve encryption method is an asymmetric (or public key) encryption method based on the discrete logarithm problem.

Preferably, the Bitcoin address is a string of numbers and letters that can be shared with anyone who wants to give you Bitcoin. In transactions, the Bitcoin address usually appears as the payee. If a Bitcoin transaction is compared to a check, the Bitcoin address is the payee, and the Bitcoin address can be obtained from the public key through a one-way cryptographic hash algorithm.

Specifically, the hash algorithm is a one-way function that receives an input of any length to generate a fingerprint digest. Cryptographic hash functions are widely used in Bitcoin: Bitcoin addresses, script addresses, and proof-of-work algorithms in mining. The algorithm used to generate a Bitcoin address from a public key is Secure Hash Algorithm (SHA) and the RACE Integration Primitives Evaluation Message Digest (RIPEMD), especially SHA256 and RIPEMD160. Generally, the Bitcoin address that users see is encoded by "Base58Check" Yes, this encoding uses 58 characters (a Base58 number system) and a check code to improve readability, avoid ambiguity, and effectively prevent errors in address transcription and input.

Preferably, the private key must be kept secret. BIP0038 proposes a common standard. A password is used to encrypt the private key and Base58Check is used to encode the encrypted private key. In this way, the encrypted private key can be safely stored in the backup medium Transfer between wallets, keeping the security of the key in any possible exposure. This encryption standard uses AES, a standard established by NIST and widely used for data encryption in commercial and military applications.

In some embodiments of the present application, the bus interface is a CAN bus interface.

Preferably, CAN is the abbreviation of Controller Area Network (hereinafter referred to as CAN) and is a serial communication protocol standardized by ISO International. In order to meet the needs of "reducing the number of wiring harnesses" and "high-speed communication of a large amount of data through multiple LANs", in 1986, the German electric maker Bosch developed a CAN communication protocol for automobiles.

In some embodiments of the present application, the encryption unit generates the key based on a symmetric encryption algorithm and an asymmetric encryption algorithm, and the principle of the symmetric encryption algorithm uses any one or more of DES, 3DES, and AES.

Preferably, the DES algorithm changes a 64-bit plaintext input block into a ciphertext output block with a data length of 64 bits, of which 8 bits are parity bits and the other 56 bits are the length of the password. First, DES reassembles the input 64-bit data block bit by bit, and divides the output into two parts, L0 and R0, each of which is 32 bits in length. After 16 iterative operations according to this rule, L16 and R16 are obtained, and this is used as an input to perform inverse permutation opposite to the initial permutation to obtain the ciphertext output. The DES algorithm has extremely high security. So far, Except for using the exhaustive search method to attack the DES algorithm, no more effective method has been found. The exhaustive space of a 56-bit long key is 2 ^ 56, which means that if a computer's speed is detected per second, 1 million keys, it will take almost 2285 years to search all the keys, so the DES algorithm is a very reliable encryption method.

Preferably, the 3DES is also called Triple DES, which is a mode of the DES encryption algorithm. It uses three 56-bit keys to encrypt 3DES data three times. The Data Encryption Standard (DES) is a long-established encryption standard in the United States. It uses a symmetric key encryption method and was standardized by the ANSI organization as ANSI X.3.92 in 1981. DES uses a 56-bit key and cipher block method. In the cipher block method, the text is divided into 64-bit-sized text blocks and then encrypted. 3DES is more secure than the original DES.

Preferably, the AES Advanced Encryption Standard (English: Advanced Encryption Standard, abbreviation: AES), also called Rijndael encryption method in cryptography, is a block encryption standard adopted by the US federal government. This standard is used to replace the original DES, which has been analyzed by many parties and widely used throughout the world. After a five-year selection process, the Advanced Encryption Standard was published by the National Institute of Standards and Technology (NIST) on FIPS PUB 197 on November 26, 2001, and became a valid standard on May 26, 2002. In 2006, the Advanced Encryption Standard has become one of the most popular algorithms in symmetric key encryption; unlike its predecessor, DES, Rijndael uses a substitution-permutation network instead of the Feistel architecture. AES can be quickly encrypted and decrypted in both software and hardware. It is relatively easy to implement and requires very little memory. As a new encryption standard, it is being deployed to a wider range.

Preferably, the encryption unit adopts an asymmetric encryption algorithm for encryption, and adopts an asymmetric encryption algorithm. The strength of the algorithm is complex, and the security depends on the algorithm and the key. However, due to the complexity of the algorithm, the encryption and decryption speed does not have the speed of the symmetric encryption and decryption. fast. There is only one kind of key in a symmetric cryptosystem, and it is not public. If you want to decrypt it, you must let the other party know the key. Therefore, to ensure its security is to ensure the security of the key. There are two types of keys in the asymmetric key system, one of which is public, so that it is not necessary to transfer the other party's key like a symmetric password, which greatly improves data security. Sex.

In other embodiments of the present application, the encryption unit may also use other encryption algorithms to generate a key.

In some embodiments of the present application, an FSMC interface for static storage is further included, and the FSMC interface is electrically connected to the memory.

Preferably, FSMC (Flexible Static Memory Controller) is a new type of memory expansion technology adopted by the STM32 series. It has unique advantages in terms of external memory expansion. It can easily expand different types of large-capacity static memories according to the application needs of the system.

In some embodiments of the present application, the memory is any one or more of SRAM, ROM, RAM, DRAM, and FLASH.

Preferably, Static Random Access Memory (SRAM) is a type of random access memory. The so-called "static" means that as long as the memory is kept powered, the data stored in it can be constantly maintained. In contrast, data stored in dynamic random access memory (DRAM) needs to be updated periodically. However, when the power supply is stopped, the data stored in the SRAM will still disappear (known as volatile memory), which is different from the ROM or flash memory that can store data after power failure.

Preferably, ROM is an abbreviation of ROM image (read-only memory mirroring), which is often used in the circle of mobile phone customization system players. The ROM in the smart phone configuration refers to EEProm (electrically erasable and writable read-only memory), which is similar to the hard disk of a computer. The process of flashing a mobile phone is to write the read-only memory image (ROM image) into the read-only memory (ROM). )the process of. The ROM of a smart phone refers to its storage space, which is generally made of flash memory such as UFS. Its hardware is not read-only. The so-called read-only refers to the software layer's read and write permission settings for the system partition.

Preferably, random access memory (RAM) is also called "random memory", which is an internal memory that directly exchanges data with the CPU, also called main memory (memory). It can be read and written at any time, and it is very fast. It is usually used as a temporary data storage medium for the operating system or other running programs.

Preferably, DRAM (Dynamic Random Access Memory), that is, dynamic random access memory, is the most common system memory. DRAM can only hold data for a short time. In order to maintain data, DRAM uses capacitor storage, so it must be refreshed once in a while. If the memory cell is not refreshed, the stored information will be lost (data will be lost when the power is turned off).

Preferably, the English name of the FLASH flash memory is "Flash", generally referred to as "Flash", which belongs to a type of memory device and is a non-volatile (Non-Volatile) memory.

In some embodiments of the present application, an ADC data acquisition interface is further included, and the ADC data acquisition interface is electrically connected to the bus interface.

Preferably, ADC, an abbreviation of Analog-to-Digital Converter, refers to an analog-to-digital converter or an analog-to-digital converter. A device that converts a continuously changing analog signal into a discrete digital signal. Real-world analog signals, such as temperature, pressure, sound, or images, need to be converted into digital forms that are easier to store, process, and emit. The A / D converter can achieve this function, and it can be found in various products.

In some embodiments of the present application, a GPIO interface is further included, and the GPIO interface is electrically connected to the bus interface.

Preferably, General Input / Output is called GPIO or bus expander for short. People use industry standard I2C, SMBus or SPI interface to simplify the expansion of I / O port. When the microcontroller or chipset does not have enough I / O ports, or when the system needs to use remote serial communication or control, GPIO products can provide additional control and monitoring functions.

In some embodiments of the present application, a JTAG interface for chip internal testing is further included, and the JTAG interface is electrically connected to the encryption unit.

Preferably, JTAG (Joint Test Action Group) is an international standard test protocol (IEEE 1149.1 compatible), which is mainly used for chip internal testing. Most advanced devices now support the JTAG protocol, such as DSP and FPGA devices. The standard JTAG interface is 4 lines: TMS, TCK, TDI, TDO, which are the mode selection, clock, data input and data output lines.

From the above description, it can be seen that the present application achieves the following technical effects:

The above description is only a preferred embodiment of the present application, and is not intended to limit the present application. For those skilled in the art, this application may have various modifications and changes. Any modification, equivalent replacement, or improvement made within the spirit and principle of this application shall be included in the protection scope of this application.

Industrial applicability

Claims

A security encryption chip, comprising: an encryption unit for generating a key according to a preset encryption algorithm; a memory for storing the key; and a bus interface for data interaction. The memory is electrically connected, and the memory is electrically connected to the bus interface.
The security encryption chip according to claim 1, wherein the bus interface is a CAN bus interface.
The security encryption chip according to claim 1, wherein the encryption unit generates the key based on a symmetric encryption algorithm and an asymmetric encryption algorithm.
The security encryption chip according to claim 3, wherein the principle of the symmetric encryption algorithm uses any one or more of DES, 3DES, and AES.
The security encryption chip according to claim 1, further comprising an FSMC interface for performing static storage, wherein the FSMC interface is electrically connected to the memory.
The security encryption chip according to claim 1, wherein the memory is any one or more of SRAM, ROM, RAM, DRAM, and FLASH.
The security encryption chip according to claim 1, further comprising an ADC data acquisition interface, wherein the ADC data acquisition interface is electrically connected to the bus interface.
The security encryption chip according to claim 1, further comprising a GPIO interface, wherein the GPIO interface is electrically connected to the bus interface.
The security encryption chip according to claim 1, further comprising a JTAG interface for internal testing of the chip, wherein the JTAG interface is electrically connected to the encryption unit.
An electronic device, comprising the security encryption chip, the local data transmission module, and the local data storage module according to the preceding claims 1 to 9, and the bus interface is electrically connected to the local data transmission module. The local data transmission module is electrically connected to the local data storage module, the security encryption chip receives the data to be encrypted sent by the local data transmission module to perform an encryption operation, and saves the encrypted data after encryption Described in the local data storage module.