WO2020224171A1

WO2020224171A1 - Data security apparatus and method, electronic device, and storage medium

Info

Publication number: WO2020224171A1
Application number: PCT/CN2019/109064
Authority: WO
Inventors: 周正贤; 谈超; 胡琳
Original assignee: 深圳豪杰创新电子有限公司
Priority date: 2019-05-08
Filing date: 2019-09-29
Publication date: 2020-11-12
Also published as: CN110084054A

Abstract

A data security apparatus (10) and method, an electronic device, and a storage medium, the data security apparatus (10) comprising: a master controller (110), an encryption chip (120), and a memory (130), the master controller (110) being connected to the encryption chip (120) and the memory (130) by means of a bus; the master controller (110) is configured to send an encryption request to the encryption chip (120), the encryption request comprising data to be encrypted; the encryption chip (120) is configured to receive the encryption request sent by the master controller (110) and, in response to the encryption request, encrypt the data to be encrypted in the encryption request to obtain ciphertext data, and to send the ciphertext to the master controller (110) by means of the bus; the master controller (110) is also configured to receive the ciphertext data sent by the encryption chip (120) and store the ciphertext in the memory (130); the master controller (110) is also configured to send a decryption request to the encryption chip (120), the decryption request comprising data to be decrypted; the encryption chip (120) is also configured to receive the decryption request sent by the master controller (110) and, in response to the decryption request, decrypt the data to be decrypted in the decryption request to obtain plaintext data, and to send the plaintext to the master controller (110) by means of the bus. Thus, the algorithms in the encryption chip (120) can be easily updated, and the data can be securely stored.

Description

Data security device, method, electronic equipment and storage medium

Cross references to related applications

This disclosure claims the priority of a Chinese patent application filed with the Chinese Patent Office on May 8, 2019, with the application number 2019103792753, titled "A data security device, method, electronic equipment and storage medium", the entire content of which is by reference Incorporated in this disclosure.

Technical field

The present disclosure relates to the field of information security technology, and in particular, to a data security device, method, electronic device, and storage medium.

Background technique

Data security in modern society has always been a concern for users. In particular, the safe and confidential storage of important information and personal private pictures and videos is becoming more and more urgent for today's users. Traditional hardware encryption is to add encryption or decryption algorithms to the main controller (main controller), and then package it into a main control chip, which is very costly, and because the hardware encryption needs to be packaged into a main control chip, the internal encryption or decryption The algorithm is not easy to update.

Summary of the invention

In view of this, the purpose of the embodiments of the present disclosure includes, for example, providing a data security device, method, electronic device, and storage medium to improve the traditional hardware encryption algorithm or decryption algorithm that is difficult to update.

The embodiments of the present disclosure may be implemented in the following manner, for example:

The embodiment of the present disclosure provides a data security device, including: a main controller, an encryption chip, and a memory, the main controller is connected to the encryption chip and the memory through a bus; the main controller is configured to The encryption chip sends an encryption request, and the encryption request includes the data to be encrypted; the encryption chip is configured to receive the encryption request sent by the main controller, and respond to the encryption request to the encryption request. The data to be encrypted is encrypted to obtain ciphertext data, and the ciphertext data is sent to the main controller through the bus; the main controller is also configured to receive the ciphertext sent by the encryption chip Data, and store the ciphertext data in the memory; the main controller is also configured to send a decryption request to the encryption chip, the decryption request includes the data to be decrypted; the encryption chip is also configured to Receive the decryption request sent by the main controller, decrypt the to-be-decrypted data in the decryption request in response to the decryption request to obtain plaintext data, and send the plaintext data through the bus to the Main controller.

In the embodiments of the present disclosure, the main controller can send the data to be encrypted to the encryption chip for encryption, and then store the ciphertext data in the memory. The data to be decrypted can also be sent to the encryption chip through the main controller, so that the encryption chip is to be decrypted The data is decrypted to obtain plaintext data. Therefore, the main controller and the encryption chip are separately arranged, so that the encryption algorithm and the decryption algorithm in the encryption chip peripheral to the main controller can be updated more easily, and the timely update of the encryption algorithm can also make the data more securely stored. It should be noted that all encryption chips in this application can be encryption and decryption chips that have both encryption and decryption functions. For the convenience of description, they are simply referred to as encryption chips, but this does not mean that the chips only have encryption functions.

Optionally, the main controller is connected to at least one I/O interface through a bus, and the main controller is configured to receive the data to be encrypted sent by the I/O interface and send it to the I/O interface. The interface sends the decrypted plaintext data.

The embodiment of the present disclosure connects the main controller with at least one I/O interface, so that the data security device can receive the data to be encrypted and perform encrypted storage, and can also send plaintext data through the I/O interface to ensure data security Transmit.

Optionally, the main controller receives the to-be-encrypted data sent by an external device through the I/O interface.

Optionally, the encryption chip encrypts the data and/or decrypts the data to be decrypted according to the pre-stored AES algorithm and/or the national secret SM algorithm. The embodiments of the present disclosure adopt the AES algorithm and/or the national secret SM algorithm as the encryption algorithm or the decryption algorithm of the encryption chip, so that the encryption chip can encrypt or decrypt data more safely and quickly.

Optionally, the encryption chip is set independently of the main controller, and the algorithm in the encryption chip is updated independently of the main controller.

Optionally, the decryption request further includes an external device identification code corresponding to the data to be decrypted, and the main controller sends the decrypted plaintext data to the corresponding external device according to the external device identification code.

Optionally, the encryption request further includes an encryption algorithm identifier corresponding to the data to be encrypted, and the encryption chip is configured to select a corresponding encryption algorithm according to the encryption algorithm identifier to encrypt the data to be encrypted, Thereby, ciphertext data is obtained. The decryption request further includes a decryption algorithm identifier corresponding to the data to be decrypted, and the encryption chip is configured to select a corresponding decryption algorithm according to the decryption algorithm identifier to decrypt the data to be decrypted, thereby obtaining plaintext data .

In the embodiments of the present disclosure, the request sent by the main controller includes the algorithm identifier, so that the encryption chip can select the corresponding algorithm according to the algorithm identifier to encrypt the data to be encrypted and decrypt the data to be decrypted, so that the data can be encrypted in a targeted manner Or decrypt it to ensure the safe storage of data.

Optionally, the data to be encrypted is plaintext data or ciphertext data that has undergone encryption processing. The encrypted ciphertext data is the ciphertext data that the main controller takes out from the memory. The data to be decrypted is ciphertext data received by the main controller from an external device, or ciphertext data taken by the main controller from the memory.

Optionally, the main controller is connected to the encryption chip through an SPI bus.

In the embodiments of the present disclosure, the main controller and the encryption chip perform data transmission through the SPI bus, so that data can be encrypted and decrypted more quickly, and the work efficiency of the data security device is improved.

Optionally, the main controller includes a clock oscillation module, which is connected to the encryption chip through the SPI bus, and the clock oscillation module is configured to increase the transmission rate of the SPI bus by a preset multiple.

In the embodiments of the present disclosure, the transmission rate of the SPI bus can be increased through the clock oscillation module, so that data can be encrypted and decrypted more quickly, and the working efficiency of the data security device is improved.

The embodiment of the present disclosure also provides a data security method, including: an encryption chip receives an encryption request sent by a main controller through a bus, the encryption request includes data to be encrypted; and the encryption chip responds to the encryption request The data to be encrypted is encrypted to obtain ciphertext data; the encryption chip sends the ciphertext data to the main controller so that the main controller stores the ciphertext data in a memory; the encryption chip receives The decryption request sent by the main controller, the decryption request includes the data to be decrypted; the encryption chip decrypts the data to be decrypted in response to the decryption request to obtain plaintext data; the encryption chip sends the data to the host The controller sends the plaintext data.

The embodiment of the present disclosure encrypts the received data to be encrypted, and then sends the ciphertext data to the main controller for storage in the memory. It is also possible to decrypt the received data to be decrypted to obtain plaintext data, and then transfer the plaintext data Send to the main controller. As a result, the encryption chip external to the main controller is encrypted and decrypted, and the ciphertext data can be stored more securely. At the same time, the encryption algorithm and decryption algorithm in the encryption chip are also easier to update, and the encryption chip is updated in time It can also make it possible to decrypt different ciphertext data.

The embodiment of the present disclosure includes an algorithm identifier in the request sent by the main controller to the encryption chip, so that the encryption chip can select the corresponding algorithm according to the algorithm identifier to encrypt the data to be encrypted and decrypt the data to be decrypted, so that the data can be targeted Perform encryption or decryption processing to ensure the safe storage of data.

The embodiment of the present disclosure also provides an electronic device including the above-mentioned data security device.

The embodiments of the present disclosure also provide a non-transitory computer-readable storage medium that stores computer instructions that cause the computer to execute the above-mentioned method.

Other features and advantages of the present disclosure will be described in the following description, and partly become obvious from the description, or understood by implementing the embodiments of the present disclosure. The objectives and other advantages of the present disclosure can be realized and obtained through the structures specifically pointed out in the written description, claims, and drawings.

Description of the drawings

In order to explain the technical solutions of the embodiments of the present disclosure more clearly, the following will briefly introduce the drawings that need to be used in the embodiments. It should be understood that the following drawings only show certain embodiments of the present disclosure, and therefore do not It should be regarded as a limitation of the scope. For those of ordinary skill in the art, other related drawings can be obtained based on these drawings without creative work.

FIG. 1 is a schematic structural diagram of a data security device provided by an embodiment of the disclosure;

2 is a schematic diagram of the pin structure of a main controller connected to an encryption chip according to an embodiment of the disclosure;

FIG. 3 is a schematic flowchart of a data privacy method provided by an embodiment of the disclosure;

FIG. 4 is a structural block diagram of an electronic device that can be applied to the embodiments of the present disclosure provided by the embodiments of the present disclosure.

Icon: 10-data security device; 110-main controller; 120-encryption chip; 130-memory; 140-I/O interface; 20-external equipment.

Detailed ways

The technical solutions in the embodiments of the present disclosure will be described below in conjunction with the drawings in the embodiments of the present disclosure.

It should be noted that similar reference numerals and letters indicate similar items in the following figures. Therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures. At the same time, in the description of the present disclosure, the terms “first”, “second”, etc. are only used to distinguish the description, and cannot be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Thus, the features defined with "first" and "second" may explicitly or implicitly include one or more of these features. In the description of the present disclosure of the present invention, "plurality" means two or more, unless otherwise specifically defined.

FIG. 1 is a schematic structural diagram of a data security device provided by an embodiment of the disclosure. As shown in FIG. 1, the data security device 10 provided by the embodiment of the present disclosure may include: a main controller 110, an encryption chip 120, and a memory 130. The main controller 110 may communicate with the encryption chip 120 and the encryption chip 120 via a bus such as an SPI bus. The storage 130 is connected.

Optionally, the main controller 110 may be configured to send an encryption request to the encryption chip 120, and the encryption request may include the data to be encrypted. The encryption chip 120 may be configured to receive the encryption request sent by the main controller 110, in response to the received encryption request, encrypt the data to be encrypted in the encryption request to obtain ciphertext data, and The ciphertext data is sent back to the main controller 110 through the bus. The main controller 110 may also be configured to receive the ciphertext data sent by the encryption chip 120 and store the ciphertext data in the memory 130.

In the embodiment of the present disclosure, optionally, the encryption request sent by the main controller 110 to the encryption chip 120 may further include an external device identification code corresponding to the data to be encrypted. In this case, in response to receiving the encryption request from the main controller 110, the encryption chip 120 may encrypt the data to be encrypted in the encryption request to obtain the corresponding ciphertext data, and the encryption chip 120 may encrypt the encrypted data. The text data, the aforementioned external device identification code, and the encryption algorithm identification corresponding to the cipher text data are sent to the main controller 110 together. Correspondingly, the main controller 110 may store the ciphertext data received from the encryption chip 120, the external device identification code, and the encryption algorithm identification corresponding to the ciphertext data together. In the above-mentioned manner, the data security device 10 can securely store the encrypted data, so that the source of the data can be easily and safely checked through the external device identification code.

Optionally, in the embodiment of the present disclosure, the data to be encrypted may be plaintext data, or may also be ciphertext data that needs to be encrypted again. Correspondingly, upon receiving the encryption request, the encryption chip 120 may encrypt the plaintext data included in the encryption request as the data to be encrypted to obtain ciphertext data, or may also perform the encryption on the ciphertext data included in the encryption request as the data to be encrypted. Encryption is performed to obtain twice-encrypted ciphertext data or multiple-encrypted ciphertext data.

In addition, when the external device 20 connected to the main controller 110 needs data, the data security device 10 can also conveniently decrypt the ciphertext data to provide the decrypted data to the external device 20. It should be noted that all the encryption chips 120 in this application may be encryption and decryption chips that have both encryption and decryption functions. For ease of description, they are simply referred to as encryption chips, but this does not mean that the chips only have encryption functions.

Specifically, the main controller 110 may also be configured to send a decryption request to the encryption chip 120, and the decryption request may include the data to be decrypted. The encryption chip 120 may also be configured to receive the decryption request sent by the main controller 110, decrypt data to be decrypted in the decryption request in response to the received decryption request to obtain plaintext data, and The plaintext data is sent to the main controller 110 through the bus.

In the embodiment of the present disclosure, optionally, the decryption request sent by the main controller 110 to the encryption chip 120 may further include an external device identification code corresponding to the data to be decrypted. In this case, in response to receiving the decryption request from the main controller 110, the encryption chip 120 can decrypt the data to be decrypted in the decryption request to obtain corresponding plaintext data, and the encryption chip 120 can decrypt the plaintext data obtained by decryption. It is sent to the main controller 110 together with the external device identification code corresponding to the plaintext data. Correspondingly, the main controller 110 can send the decrypted plaintext data to the corresponding external device 20 according to the external device identification code, that is, the data security device 10 can decrypt the data to be decrypted before sending it out.

Optionally, the data to be decrypted may be ciphertext data retrieved from the memory 130 by the main controller 110, or ciphertext data received by the main controller 110 from the external device 20. Optionally, the source of the specific data to be decrypted can be selected according to the decryption requirements of the actual data.

Therefore, in the embodiment of the present disclosure, optionally, the main controller 110 may send an encryption request including the data to be encrypted to the encryption chip 120, so that the encryption chip 120 encrypts the data to be encrypted in the encryption request to obtain the encryption. The ciphertext data is stored in the memory 130; in addition, the main controller 110 may also send a decryption request including the data to be decrypted to the encryption chip 120, so that the encryption chip 120 decrypts the data to be decrypted in the decryption request , Get the plaintext data. In this way, the main controller 110 can be set separately from the encryption chip 120, that is, independently, so that the encryption algorithm and decryption algorithm in the encryption chip 120 peripheral to the main controller can be updated more easily, and the encryption chip 120 can be updated in time. The ciphertext data can also be stored more securely, and the timely update of the encryption chip can also enable the decryption of different ciphertext data.

Optionally, the main controller 110 may be a controller capable of managing storage, which may be a single chip or a combination of multiple chips. Optionally, the memory 130 may be a mechanical hard disk, a solid state hard disk, a flash memory, or various memories using flash memory as storage, as well as other emerging types of memory 130. The specific types of the main controller 110 and the memory 130 can be adjusted according to actual requirements for at least one of data encryption and decryption.

Optionally, the main controller 110 may be connected to at least one I/O interface 140 through a bus, and the main controller may be configured to receive an encryption request including the data to be encrypted sent by the I/O interface 140, And the decrypted plaintext data can be sent to the I/O interface 140.

In the embodiment of the present disclosure, optionally, the main controller 110 may receive the encryption request including the data to be encrypted sent by the external device 20 through the I/O interface 140, so as to send the encryption request to the encryption chip 120 to perform the encryption on the data to be encrypted. Encryption to obtain ciphertext data, and store the ciphertext data in the memory 130.

Optionally, the main controller 110 may receive a data decryption request from the external device 20 through the I/O interface 140, and the data decryption request may include a key, a data identification, and an external device identification code corresponding to the data identification. Including the data to be decrypted. Correspondingly, the main controller 110 may first identify whether the key in the received data decryption request is consistent with the preset key. If the key in the data decryption request is consistent with the preset key, the main controller 110 may The data identifier in the data decryption request obtains the corresponding data to be decrypted from the memory 130, and includes the obtained data to be decrypted in the decryption request to be sent to the encryption chip 120 for decryption. Then, the main controller 110 may receive the plaintext data returned by the encryption chip 120 through decryption and the external device identification code corresponding to the plaintext data, and send the plaintext data to the corresponding external device according to the external device identification code 20.

In this way, the data security device 10 can not only receive the data to be encrypted for encrypted storage, but can also send the decrypted plaintext data to the external device 20 to ensure that the data security device 10 secure transmission of ciphertext data stored in the memory 130.

Optionally, the main controller 110 may be connected to one external device 20 through a bus, or may be connected to multiple external devices 20 through multiple buses. The specific number of connections between the external device 20 and the main controller 110 can be adjusted according to actual data encryption requirements.

Optionally, the I/O interface 140 is various portable product interfaces such as Universal Serial Bus (USB), SD memory card interface, EMMC interface, CF interface, etc., and sends the encryption request or decryption request to the main controller 110. The type of the specific I/O interface 140 can be adjusted according to actual data transmission requirements.

Optionally, the external device 20 may be a terminal such as a personal computer (PC), a tablet computer, a smart phone, a personal digital assistant (PDA), and a wearable device.

Optionally, the encryption chip 120 may perform encryption processing and/or decryption processing on the data according to the pre-stored AES algorithm and/or the national secret SM algorithm.

In the embodiment of the present disclosure, optionally, the encryption chip 120 may perform encryption processing and/or decryption processing on data according to the pre-stored national standard algorithm AES128/256bit and/or national secret SM1/2/3/4 algorithm. Therefore, the encryption chip 120 can encrypt the data to be encrypted and decrypt the data to be decrypted more safely and quickly, so as to ensure the security of the data.

Optionally, multiple encryption algorithms can be stored in the encryption chip 120 in advance. Optionally, the encryption algorithm can be updated by software burning, or the encryption algorithm can be updated by replacing the encryption chip 120. Optionally, the selection of the encryption chip 120 can be adjusted according to actual data encryption requirements. Optionally, multiple decryption algorithms may be stored in the encryption chip 120 in advance. Optionally, the decryption algorithm can also be updated by software burning, or the decryption algorithm can be updated by replacing the encryption chip 120. Optionally, the selection of the encryption chip 120 can be adjusted according to actual data decryption requirements.

Optionally, the encryption request may further include an encryption algorithm identifier corresponding to the data to be encrypted. The encryption chip 120 may be configured to select a corresponding encryption algorithm according to the encryption algorithm identifier to encrypt the data to be encrypted, thereby obtaining ciphertext data. Optionally, the decryption request may also include a decryption algorithm identifier corresponding to the data to be decrypted, and the encryption chip 120 may be configured to select a corresponding decryption algorithm according to the decryption algorithm identifier to perform the decryption on the data to be decrypted. Perform decryption to obtain plaintext data.

In the embodiment of the present disclosure, in the case that the encryption request includes the data to be encrypted and the encryption algorithm identification corresponding to the data to be encrypted, optionally, the encryption algorithm identification may identify the AES algorithm and/or the national secret SM algorithm, After receiving the encryption request, the encryption chip 120 can select the pre-stored national standard algorithm AES128/256bit and/or the national secret SM1/2/3/4 algorithm to encrypt the encrypted data according to the encryption algorithm identifier in the encryption request.

For example, the main controller 110 may send an encryption request to the encryption chip 120, where the encryption request may include the data A to be encrypted and the corresponding encryption algorithm identifier a, the encryption algorithm identifier a corresponds to the encryption algorithm ①, and the encryption request may also include the data to be encrypted. Encrypted data B and corresponding encryption algorithm identifier b, and encryption algorithm identifier b corresponds to encryption algorithm ②. After receiving the encryption request, the encryption chip 120 can select the corresponding encryption algorithm ① to encrypt the data A to be encrypted according to the encryption algorithm identifier a, and select the corresponding encryption algorithm ② to encrypt the data B to be encrypted according to the encryption algorithm identifier b.

Optionally, when the decryption request includes the data to be decrypted and the decryption algorithm identifier corresponding to the data to be decrypted, the decryption algorithm identifier may identify the AES algorithm and/or the national secret SM algorithm, so that the encryption chip 120 is receiving After the decryption request, the pre-stored national standard algorithm AES128/256bit or national secret SM1/2/3/4 algorithm can be selected according to the decryption algorithm identifier to decrypt the data to be decrypted. Optionally, if the data to be decrypted is ciphertext data pre-stored in the memory 130, the corresponding decryption algorithm identifier may be obtained according to the encryption algorithm identifier corresponding to the ciphertext data.

For example, the main controller 110 may send a decryption request to the encryption chip 120, where the decryption request may include the data C to be decrypted and the corresponding decryption algorithm identifier c, the decryption algorithm identifier c corresponds to the decryption algorithm ③, and the decryption request may also include the data to be decrypted. The decrypted data D and the corresponding decryption algorithm identifier d, the decryption algorithm identifier d corresponds to the decryption algorithm ④. After receiving the decryption request, the encryption chip 120 can select the corresponding decryption algorithm ③ to decrypt the data C to be decrypted according to the decryption algorithm identifier c, and select the corresponding decryption algorithm ④ to decrypt the data D to be decrypted according to the decryption algorithm identifier d.

FIG. 2 is a schematic diagram of a pin structure for connecting a main controller and an encryption chip according to an embodiment of the present disclosure. As shown in FIG. 2, the main controller 110 may be connected to the encryption chip 120 via an SPI bus.

In the embodiment of the present disclosure, optionally, the data between the main controller 110 and the encryption chip 120 can be transmitted through the SPI bus, which can speed up the encryption and decryption of the data by the encryption chip 120, and improve the data security device 10. Work efficiency.

Optionally, the SPI bus can be a synchronous serial peripheral interface, which can enable the main controller to communicate with various external devices in a serial manner to exchange information. The SPI bus can be directly connected to a variety of standard external devices produced by various manufacturers, including network controllers, LCD display drivers, A/D converters, and micro control units.

Optionally, both the main controller 110 and the encryption chip 120 may be provided with an SPI interface, the SPI interface of the main controller 110 may be used as a host side, and the SPI interface of the encryption chip 120 may be used as a slave side. Optionally, the main controller 110 and the encryption chip 120 may transmit the encryption request and/or the decryption request through four signal lines (SS1, SCK1, MOSI1, MISO1). The main controller 110 can also control the encryption chip 120 through three signal lines (GINT0, GINT1, POR).

Optionally, the SS1 pin of the encryption chip 120 can be connected to the SS1 pin of the main controller 110, the SCK1 pin of the encryption chip 120 can be connected to the SCK1 pin of the main controller 110, and the MOSI1 pin of the encryption chip 120 can be It is connected to the MOSI1 pin of the main controller 110, and the MISO1 pin of the encryption chip 120 can be connected to the MISO1 pin of the main controller 110. The GINT1 pin of the encryption chip 120 can be connected to the GPIO1 pin of the main controller 110, the GINT0 pin of the encryption chip 120 can be connected to the GPIO2 pin of the main controller 110, and the POR pin of the encryption chip 120 can be connected to the main controller. 110 GPIO3 pin connection.

Optionally, during the operation of the data security device 10, the main controller 110 may generally first send a low-level signal to the GINT0 pin of the encryption chip 120, so that the encryption chip 120 can wake up from a low power consumption state. Then, the main controller 110 can read the output signal sent by the GINT1 pin of the encryption chip 120. When the output signal is high, it indicates that the encryption chip 120 is in a busy state, and the encryption chip 120 cannot currently accept encryption requests or decryption requests. When the output signal is low, it indicates that the encryption chip 120 is in a ready state, and the main controller 110 can send an encryption request or a decryption request to the encryption chip 120 through the SS1 signal line, SCK1 signal line, MOSI1 signal line, and MISO1 signal line, so that The encryption chip 120 works. After the encryption chip 120 completes encryption or decryption, it can send ciphertext data or plaintext data to the main controller 110 through the SS1 signal line, the SCK1 signal line, the MOSI1 signal line and the MISO1 signal line. After the main controller 110 receives the data, A low level can be sent to the POR pin of the encryption chip 120 so that the encryption chip 120 can be reset and wait for the next instruction of the main controller 110.

Optionally, the main controller 110 and the encryption chip 120 can use the full-duplex mode SPI bus to transmit data, so that the main controller 110 can send an encryption request or decryption request to the encryption chip 120, and at the same time, the encryption chip 120 can send data to the main controller. The device 110 sends ciphertext data or plaintext data, so that the working efficiency of the data security device 10 can be higher.

Optionally, the main controller 110 includes a clock oscillation module that is connected to the encryption chip 120 through the SPI bus. The clock oscillation module may be configured to increase the transmission rate of the SPI bus. Set multiples.

In the embodiment of the present disclosure, optionally, a clock oscillation module can be provided in the main controller 110 to perform frequency multiplication processing, so that the maximum transmission rate of the SPI bus can be increased, and the main controller 110 and the encryption chip 120 can be performed faster. The data transfer between the two makes the data security device 10 work more efficiently.

For example, if the maximum transmission rate of the SPI bus is 52 Mbps, the maximum transmission rate of the SPI bus can be increased to 104 Mbps after the clock oscillation module of the main controller 110 doubles the frequency, so that the main controller and the encryption chip 120 Can carry on high-speed data transmission.

FIG. 3 is a schematic flowchart of a data privacy method provided by an embodiment of the disclosure. As shown in Figure 3, the data privacy method provided by the embodiment of the present disclosure may include:

Step 310: The encryption chip receives the encryption request sent by the main controller through the bus, and the encryption request may include the data to be encrypted.

Step 320: The encryption chip encrypts the data to be encrypted in the encryption request to obtain ciphertext data.

Step 330: The encryption chip sends the ciphertext data to the main controller, so that the main controller stores the ciphertext data in a memory.

In the embodiment of the present disclosure, optionally, the encryption chip may receive an encryption request sent by the main controller, and the encryption request may include the data to be encrypted. The encryption chip can encrypt the to-be-encrypted data according to the encryption request to obtain the ciphertext data, and send the ciphertext data to the main controller, so that the main controller 110 stores the ciphertext data in the memory, thereby realizing the confidential storage of the data.

Optionally, the encryption request may be received by the main controller from the external device. Optionally, the to-be-encrypted data in the encryption request may also be taken out by the main controller from pre-stored ciphertext data. That is, the encryption chip can encrypt plaintext data, can also re-encrypt ciphertext data, and can also encrypt plaintext data multiple times. Optionally, the specific encryption process of the encryption chip can be adjusted according to data encryption requirements.

Step 340: The encryption chip receives a decryption request sent by the main controller, and the decryption request may include data to be decrypted.

Step 350: The encryption chip decrypts the data to be decrypted in the decryption request to obtain plaintext data.

Step 360: The encryption chip sends the plaintext data to the main controller.

In the embodiment of the present disclosure, optionally, the encryption chip may also accept a decryption request sent by the main controller, where the decryption request includes the data to be decrypted. The encryption chip can decrypt the data to be decrypted according to the decryption request to obtain plaintext data, and send the plaintext data to the main controller, so that the main controller can send the plaintext data to the corresponding external device.

Optionally, the main controller may receive a data decryption request sent by an external device, extract the data to be decrypted from the pre-stored ciphertext data according to the data decryption request, and then include the extracted data to be decrypted in the decryption request sent to the encryption chip in.

Optionally, the encryption chip may obtain the ciphertext data after receiving the encryption request to encrypt the data, and then receive the decryption request to decrypt the ciphertext data; the encryption chip may also first receive the decryption request and perform the encryption on the pre-stored ciphertext data. Decrypt, and then receive an encryption request to encrypt the data to be encrypted.

Optionally, the encryption request may also include an encryption algorithm identifier corresponding to the data to be encrypted, the decryption request may also include a decryption algorithm identifier corresponding to the data to be decrypted, and the encryption chip may be configured to A corresponding encryption algorithm is selected according to the encryption algorithm identifier to encrypt the data to be encrypted, and the encryption chip may be configured to select a corresponding decryption algorithm according to the decryption algorithm identifier to decrypt the data to be decrypted.

In the embodiment of the present disclosure, optionally, the encryption chip can select the corresponding encryption algorithm from the pre-stored encryption algorithms to encrypt the data to be encrypted according to the encryption algorithm identifier in the encryption request, and the encryption chip can also encrypt the data to be encrypted according to the decryption request. In the decryption algorithm identification, select the corresponding decryption algorithm from the pre-stored decryption algorithms to decrypt the data to be decrypted.

Optionally, the encryption algorithm identifier may be selected by the main controller according to the type of data to be encrypted sent by the external device, and may also be selected by the main controller according to the time period during which the data to be encrypted is transmitted. The encryption algorithm identifier may be configured to identify one or more encryption algorithms stored in advance. Optionally, the selection of a specific encryption algorithm identifier can be adjusted according to actual encryption requirements.

In addition, the decryption algorithm identification can be selected by the main controller according to the type of the data request sent by the external device, and can also be selected by the main controller according to the encryption algorithm corresponding to the data to be decrypted. The decryption algorithm identification may be configured to identify one or more pre-stored decryption algorithms. Optionally, the selection of a specific decryption algorithm identifier can be adjusted according to actual decryption requirements.

For the specific implementation of step 310 to step 360, please refer to the detailed description above, which will not be repeated here.

Please refer to FIG. 4, which shows a structural block diagram of an electronic device 40 to which the embodiments of the present disclosure can be applied. The electronic device 40 may include a storage device 401, a storage controller 402, a processor 403, a peripheral interface 404, an input output unit 405, and a display unit 407.

Optionally, the storage device 401, the storage controller 402, the processor 403, the peripheral interface 404, the input output unit 405, and the display unit 407 are directly or indirectly electrically connected to each other to realize data transmission. Or interactive. For example, these components can be electrically connected to each other through one or more communication buses or signal lines. Optionally, at least one piece of software or firmware (firmware) may be stored in the storage device 401 or may be solidified in a software function module in an operating system (OS). The processor 403 may be configured to execute executable modules, software function modules or computer programs stored in the storage device 401.

Optionally, the storage device 401 may be, but is not limited to: Random Access Memory (RAM), Read Only Memory (ROM), Programmable Read-Only Memory (PROM) , Erasable Programmable Read-Only Memory (EPROM), Electrical Erasable Programmable Read-Only Memory (EEPROM), etc. Optionally, the storage device 401 may correspond to the storage 130 described above. Optionally, the storage device 401 may be configured to store a program, and the processor 403 may execute the program after receiving an execution instruction. The encryption and/or decryption method described in the foregoing embodiments of the present disclosure may be applied to In the processor 403, or implemented by the processor 403.

Optionally, the processor 403 may be an integrated circuit chip with the ability to process signals. Optionally, the aforementioned processor 403 may be a general-purpose processor, including a central processing unit (Central Processing Unit, CPU for short), a network processor (Network Processor, NP), etc.; it may also be a digital signal processor (DSP), Application specific integrated circuit (ASIC), off-the-shelf programmable gate array (FPGA) or other programmable logic device, discrete gate or transistor logic device, discrete hardware component. The processor 403 may implement or execute various methods, steps, and logical block diagrams disclosed in the embodiments of the present disclosure. The general-purpose processor may be a microprocessor or the processor 403 may also be any conventional processor or the like.

Optionally, the peripheral interface 404 can couple various input/output devices to the processor 403 and the storage device 401. In some embodiments, optionally, the peripheral interface 404, the processor 403, and the storage controller 402 may be implemented in a single chip. In some other examples, optionally, they can be implemented by independent chips.

Optionally, the input and output unit 405 may be configured to provide user input data to realize the interaction between the user and the server (or local terminal). The input and output unit 405 may be, but is not limited to, a mouse, a keyboard, and the like.

Optionally, the display unit 407 may provide an interactive interface (for example, a user operation interface) between the electronic device 40 and the user, or may be configured to display image data for the user's reference. In this embodiment, the display unit 407 may be a liquid crystal display or a touch display. If it is a touch display, optionally, it can be a capacitive touch screen or a resistive touch screen that supports single-point and multi-touch operations. Supports single-point and multi-touch operations. It can mean that the touch display can sense simultaneous touch operations from one or more positions on the touch display, and can handle the sensed touch operations The calculator 403 performs calculations and processing.

It can be understood that the structure shown in FIG. 4 is only for illustration, and the electronic device 40 may also include more or less components than those shown in FIG. 4, or may have a different configuration from that shown in FIG. The components shown in FIG. 4 may be implemented by hardware, software, or a combination thereof, and the electronic device provided in FIG. 4 may be configured to execute the aforementioned data security method.

Those skilled in the art can clearly understand that, for the convenience and concise description, the specific working process of the above-mentioned device can refer to the corresponding process in the aforementioned method, which will not be repeated here.

In summary, the embodiments of the present disclosure provide a data security device 10, a method, an electronic device, and a storage medium. The data security device may include a main controller 110, an encryption chip 120, and a memory 130. The main controller 110 It may be connected to the encryption chip 120 and the memory 130 through a bus; the main controller 110 may be configured to send an encryption request to the encryption chip 120, and the encryption request may include the data to be encrypted; the encryption chip 120 may be configured to receive the encryption request sent by the main controller 110, encrypt data to be encrypted in the encryption request in response to the encryption request to obtain ciphertext data, and combine the ciphertext data It is sent to the main controller 110 via the bus; the main controller 110 may also be configured to receive the ciphertext data sent by the encryption chip 120, and store the ciphertext data in the memory 130; the main controller 110 may also be configured to send a decryption request to the encryption chip 120, the decryption request may include the data to be decrypted; the encryption chip 120 may also be configured to receive the main controller 110 The sent decryption request decrypts the to-be-decrypted data in the decryption request in response to the decryption request to obtain plaintext data, and sends the plaintext data to the main controller 110 through the bus. In the embodiment of the present disclosure, optionally, the main controller 110 may send an encryption request including the data to be encrypted to the encryption chip 120, so that the encryption chip 120 encrypts the data to be encrypted in the encryption request to obtain ciphertext data , And then store the ciphertext data in the memory 130; in addition, the main controller 110 may also send a decryption request including the data to be decrypted to the encryption chip 120, so that the encryption chip 120 decrypts the data to be decrypted in the decryption request to obtain Plain text data. As a result, the encryption algorithm and decryption algorithm in the encryption chip 120 external to the main controller 110 can be updated more easily, and the ciphertext data can be stored more securely, and the encryption chip can be updated in time. Make it possible to decrypt different ciphertext data.

In the several embodiments provided in the present disclosure, it should be understood that the disclosed device and method may also be implemented in other ways. The device embodiments described above are merely illustrative. For example, the flowcharts and block diagrams in the accompanying drawings show possible implementation architectures of the devices, methods, and computer program products according to multiple embodiments of the present disclosure. Function and operation. In this regard, each block in the flowchart or block diagram can represent a module, program segment, or part of the code, and the module, program segment, or part of the code contains one or more that can be configured to implement prescribed Executable instructions for logic functions. It should also be noted that, in some alternative implementations, the functions marked in the block may also occur in a different order from the order marked in the drawings. For example, two consecutive blocks can actually be executed in parallel, or they can sometimes be executed in the reverse order, depending on the functions involved. It should also be noted that each block in the block diagram and/or flowchart, and the combination of the blocks in the block diagram and/or flowchart, can be implemented by a dedicated hardware-based system that performs the specified functions or actions Or it can be realized by a combination of dedicated hardware and computer instructions.

In addition, the functional modules in the various embodiments of the present disclosure may be integrated together to form an independent part, or each module may exist alone, or two or more modules may be integrated together to form an independent part. .

If the function is implemented in the form of a software function module and sold or used as an independent product, it can be stored in a computer readable storage medium. Based on this understanding, the technical solution of the present disclosure essentially or the part that contributes to the prior art or the part of the technical solution can be embodied in the form of a software product. The computer software product is stored in a storage medium, including Several instructions are used to make a computer device (which may be a personal computer, a server, or a network device, etc.) execute all or part of the steps of the methods described in the various embodiments of the present disclosure. The aforementioned storage media include: U disk, mobile hard disk, read-only memory (Read-Only Memory, ROM) 130, random access memory (Random Access Memory, RAM) 130, magnetic disks or optical disks, etc., which can store program code medium.

The foregoing descriptions are only preferred embodiments of the present disclosure, and are not intended to limit the present disclosure. For those skilled in the art, the present disclosure may have various modifications and changes. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present disclosure shall be included in the protection scope of the present disclosure. It should be noted that similar reference numerals and letters indicate similar items in the following figures. Therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures.

The above are only specific implementations of the present disclosure, but the protection scope of the present disclosure is not limited thereto. Any change or replacement that can be easily conceived by those skilled in the art within the technical scope disclosed in the present disclosure shall be covered Within the protection scope of this disclosure.

It should be noted that in this article, relational terms such as first and second are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply one of these entities or operations. There is any such actual relationship or order between. Moreover, the terms "include", "include" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article, or device that includes a series of elements includes not only those elements, but also includes Other elements of, or also include elements inherent to this process, method, article or equipment. If there are no more restrictions, the element defined by the sentence "including a..." does not exclude the existence of other same elements in the process, method, article, or equipment that includes the element.

Industrial applicability

The data security device provided by the embodiment of the present disclosure can send an encryption request including the data to be encrypted to the encryption chip through the main controller, so that the encryption chip encrypts the data to be encrypted in the encryption request to obtain the cipher text data, and then encrypts the data. The text data is stored in the memory; the decryption request including the data to be decrypted can also be sent to the encryption chip through the main controller, so that the encryption chip decrypts the data to be decrypted in the decryption request to obtain plaintext data. Therefore, the data security device provided by the embodiment of the present disclosure can be set separately through the main controller and the encryption chip, that is, set independently, so that the encryption algorithm and decryption algorithm in the encryption chip peripheral to the main controller can be performed more easily The update enables the ciphertext data to be stored more securely, and the timely update of the encryption chip can also enable the decryption of different ciphertext data.

Claims

A data security device, characterized in that it comprises:

A main controller, an encryption chip and a memory, the main controller being connected to the encryption chip and the memory through a bus;

The main controller is configured to send an encryption request to the encryption chip, the encryption request including data to be encrypted;

The encryption chip is configured to receive the encryption request sent by the main controller, encrypt the data to be encrypted in the encryption request in response to the encryption request to obtain ciphertext data, and combine the ciphertext Data is sent to the master controller via the bus;

The main controller is also configured to receive the ciphertext data sent by the encryption chip, and store the ciphertext data in the memory;

The main controller is further configured to send a decryption request to the encryption chip, where the decryption request includes data to be decrypted;

The encryption chip is also configured to receive the decryption request sent by the main controller, decrypt the data to be decrypted in the decryption request in response to the decryption request to obtain plaintext data, and combine the plaintext data Send to the main controller via the bus.
The data security device according to claim 1, wherein the main controller is connected to at least one I/O interface through the bus, and the main controller is configured to receive data sent by the I/O interface. The data to be encrypted, and the decrypted plaintext data is sent to the I/O interface.
The data security device according to any one of claims 1-2, wherein the main controller receives the data to be encrypted sent by an external device through the I/O interface.
The data security device according to any one of claims 1-3, wherein the encryption chip encrypts and/or encrypts the data to be encrypted according to the pre-stored AES algorithm and/or the national secret SM algorithm Perform decryption processing on the data to be decrypted.
The data security device according to any one of claims 1 to 4, wherein the encryption chip is set independently of the main controller, and the algorithm in the encryption chip is updated independently of the main controller .
The data security device according to any one of claims 1 to 5, wherein the decryption request further includes an external device identification code corresponding to the data to be decrypted, and the main controller according to the external device The identification code sends the decrypted plaintext data to the corresponding external device.
The data security device according to any one of claims 1-6, wherein the encryption request further includes an encryption algorithm identifier corresponding to the data to be encrypted, and the encryption chip is configured to Algorithm identification: selecting a corresponding encryption algorithm to encrypt the data to be encrypted, thereby obtaining ciphertext data;
The data security device according to any one of claims 1-7, wherein the decryption request further includes a decryption algorithm identifier corresponding to the data to be decrypted, and the encryption chip is configured to be based on the decryption The algorithm identification selects a corresponding decryption algorithm to decrypt the data to be decrypted, thereby obtaining plaintext data.
The data security device according to any one of claims 1-8, wherein the data to be encrypted is plaintext data or ciphertext data that has undergone encryption processing.
The data security device according to any one of claims 1-9, wherein the ciphertext data that has undergone encryption processing is ciphertext data retrieved from the memory by the main controller.
The data security device according to any one of claims 1-10, wherein the data to be decrypted is ciphertext data received by the main controller from an external device, or the main controller receives The ciphertext data fetched from the memory.
The data security device according to any one of claims 1-11, wherein the main controller is connected to the encryption chip through an SPI bus.
The data security device according to any one of claims 1-12, wherein the main controller comprises a clock oscillation module, and the clock oscillation module is connected to the encryption chip through the SPI bus, and the The clock oscillation module is configured to increase the transmission rate of the SPI bus by a preset multiple.
A data security method, characterized in that the method includes:

The encryption chip receives the encryption request sent by the main controller through the bus, where the encryption request includes the data to be encrypted;

The encryption chip encrypts the data to be encrypted in response to the encryption request to obtain ciphertext data;

The encryption chip sends the ciphertext data to the main controller, so that the main controller stores the ciphertext data in a memory;

The encryption chip receives a decryption request sent by the main controller, where the decryption request includes data to be decrypted;

The encryption chip decrypts the data to be decrypted in response to the decryption request to obtain plaintext data;

The encryption chip sends the plaintext data to the main controller.
The data security method according to claim 14, wherein the encryption request further includes an encryption algorithm identifier corresponding to the data to be encrypted, and the encryption chip is configured to select a corresponding encryption algorithm according to the encryption algorithm identifier. An algorithm is used to encrypt the data to be encrypted to obtain ciphertext data.
The data security method according to claims 14-15, wherein the decryption request further includes a decryption algorithm identifier corresponding to the data to be decrypted, and the encryption chip is configured to select the corresponding decryption algorithm identifier according to the decryption algorithm identifier. The decryption algorithm is used to decrypt the to-be-decrypted data to obtain plaintext data.
The data security method according to claims 14-16, wherein the encryption chip encrypts the data to be encrypted and/or performs encryption processing on the data to be encrypted according to the pre-stored AES algorithm and/or the national secret SM algorithm. Decrypt the data for decryption processing.
The data security method according to claims 14-17, wherein the encryption chip is set independently of the main controller, and the algorithm in the encryption chip is updated independently of the main controller.
An electronic device, characterized by comprising the data security device according to any one of claims 1-13.
A non-transitory computer-readable storage medium, wherein the non-transitory computer-readable storage medium stores computer instructions, and the computer instructions cause the computer to execute the computer according to any one of claims 14-18 Methods.