WO2021208014A1 - 用于执行加解密处理的装置及方法 - Google Patents

用于执行加解密处理的装置及方法 Download PDF

Info

Publication number
WO2021208014A1
WO2021208014A1 PCT/CN2020/085123 CN2020085123W WO2021208014A1 WO 2021208014 A1 WO2021208014 A1 WO 2021208014A1 CN 2020085123 W CN2020085123 W CN 2020085123W WO 2021208014 A1 WO2021208014 A1 WO 2021208014A1
Authority
WO
WIPO (PCT)
Prior art keywords
encryption
decryption
processing
instruction
data
Prior art date
Application number
PCT/CN2020/085123
Other languages
English (en)
French (fr)
Inventor
谢美伦
王博
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to CN202080004828.8A priority Critical patent/CN113892103B/zh
Priority to PCT/CN2020/085123 priority patent/WO2021208014A1/zh
Publication of WO2021208014A1 publication Critical patent/WO2021208014A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/70—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer
    • G06F21/71—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure computing or processing of information
    • G06F21/76—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure computing or processing of information in application-specific integrated circuits [ASIC] or field-programmable devices, e.g. field-programmable gate arrays [FPGA] or programmable logic devices [PLD]
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/602—Providing cryptographic facilities or services
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06K—GRAPHICAL DATA READING; PRESENTATION OF DATA; RECORD CARRIERS; HANDLING RECORD CARRIERS
    • G06K19/00—Record carriers for use with machines and with at least a part designed to carry digital markings
    • G06K19/06—Record carriers for use with machines and with at least a part designed to carry digital markings characterised by the kind of the digital marking, e.g. shape, nature, code
    • G06K19/067—Record carriers with conductive marks, printed circuits or semiconductor circuit elements, e.g. credit or identity cards also with resonating or responding marks without active components
    • G06K19/07—Record carriers with conductive marks, printed circuits or semiconductor circuit elements, e.g. credit or identity cards also with resonating or responding marks without active components with integrated circuit chips
    • G06K19/073—Special arrangements for circuits, e.g. for protecting identification code in memory
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/30—Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy

Definitions

  • This application relates to the field of information security technology, and in particular to a device and method for performing encryption and decryption processing.
  • the cloud can process the data arbitrarily, and there may be a privacy risk after the data is synchronized to the cloud.
  • encryption algorithms can also be used to encrypt the data, and then the encrypted data can be uploaded to the cloud.
  • the cloud can encrypt the data. Perform operations on the latter data to obtain specific information without revealing the user's plaintext information, so as to achieve the purpose of protecting user privacy.
  • data is encrypted, usually using Functional Encryption (FE), Homomorphic Encryption (HE), Identity-Based Cryptography (IBC), and Elliptic Curve Encryption (Elliptic Curve).
  • FE Functional Encryption
  • HE Homomorphic Encryption
  • IBC Identity-Based Cryptography
  • Elliptic Curve Encryption Elliptic Curve
  • cryptography ECC
  • PEKS Public-key Encryption with Keyword Search
  • MPC secure Multi-Party Computation
  • software or independent Device implementation where the software implementation is to program the encryption and decryption algorithms through computer language to realize the encryption and decryption of data, but the security and energy efficiency are low; the independent device method is to harden the encryption and decryption algorithms, for example, Encryption and decryption of data is realized through a printed circuit board (Printed Circuit Board, PCB).
  • PCB printed circuit board
  • the embodiment of the present application provides a device and method for performing encryption and decryption processing, which realizes the encryption and decryption of data, and improves the flexibility of the device for performing encryption and decryption processing under the premise of ensuring security.
  • an embodiment of the present application provides a device for performing encryption and decryption processing, including: a processor, an instruction analyzer, and an operator circuit, the processor is connected to the instruction analyzer, and the operator circuit is connected to the instruction analyzer;
  • the processor is used to execute the first part of the encryption and decryption processing by running the encryption and decryption software and is used to generate the encryption and decryption instructions;
  • the instruction analyzer is used to parse the encryption and decryption instructions to obtain the parsed instructions, and call the operator circuit based on the parsed instructions
  • the operator circuit is used to perform the second part of the encryption and decryption processing on the data according to the call, and the second part includes the prime domain operator processing.
  • the processor runs the encryption and decryption software to execute the first part of the encryption and decryption processing and generates the encryption and decryption instructions
  • the encryption and decryption instructions are parsed by the instruction analyzer to obtain the parsed instructions
  • the operator circuit is called according to the parsed instructions
  • the operator circuit executes the second part of the encryption and decryption processing on the data according to the call, and realizes the encryption and decryption processing on the data.
  • this solution can be combined with software and hardware, that is, the first part of the encryption and decryption processing is executed by the software running on the processor, and the instruction analyzer is controlled by the processor.
  • the operator circuit is called to perform the second part of the encryption and decryption processing on the data, which can realize the encryption and decryption processing on the data with high flexibility and security.
  • the first part includes a first encryption and decryption process and a second encryption and decryption process; the processor is specifically configured to perform the first encryption and decryption process to obtain data; and the operator circuit is used to perform encryption and decryption on the data according to the call.
  • the second part of the decryption process is to generate an intermediate result, and the intermediate result includes the result of the prime domain operator processing; the processor is specifically configured to perform a second encryption and decryption process on the intermediate result to obtain the processing result.
  • the apparatus for performing encryption and decryption processing further includes: a memory for storing encryption and decryption instructions, data, and results of prime domain operator processing.
  • the storage of the encryption and decryption instructions, data, and the result of the prime domain operator processing is realized by setting a memory.
  • the memory includes instruction ramdom access memory (IRAM) and data random access memory (data ramdom access memory, DRAM), where IRAM is used to store encryption and decryption instructions; DRAM is used to store encryption and decryption instructions; Store data and the result of prime field operator processing.
  • IRAM instruction ramdom access memory
  • DRAM data random access memory
  • the device for performing encryption and decryption processing is a system-on-chip, and the memory, instruction analyzer, and operator circuit are located in the IP core engine in the system-on-chip.
  • the processor is further configured to: send a start execution instruction to the instruction analyzer, and the start execution instruction is used to instruct the instruction analyzer to obtain the encryption and decryption instructions; the instruction analyzer is also used to: receive the start execution Command, and obtain the encryption and decryption commands from the memory according to the start execution command.
  • the processor is further used to: generate key parameters; the memory is also used to store key parameters; the operator circuit is specifically used to perform encryption and decryption processing on the data by using the key parameters according to the call. Two parts.
  • the processor generates the secret key parameter and stores the secret key parameter through the memory, which not only realizes the generation and storage of the secret key parameter, but also realizes the use of the secret key parameter in a purely software manner compared with the prior art.
  • the secret key parameters are stored in the memory, which can prevent hardware attacks and ensure the security of the key parameters.
  • the instruction analyzer is further used to: send an interrupt message to the processor, the interrupt message is used to instruct the processor to obtain the result of the prime domain operator processing; the processor is also used to: receive the interrupt message, and The result of prime domain operator processing is obtained from the memory according to the interrupt message.
  • the prime field operator processing includes: at least one of the first field modular multiplication, the second field modular multiplication, the fourth field modular multiplication, the 12th field modular multiplication, or the modular inverse operator processing Operation.
  • the result of the prime field operator processing is the calculation result of the bilinear pair of data, or the calculation result of the digital signature algorithm of the data.
  • the operator circuit when the result of the prime field operator processing is the calculation result of the bilinear pair of data, the operator circuit is used to perform the calculation of the bilinear pair.
  • There are multiple encryption and decryption algorithms in the prior art. The calculation of bilinear pairs is required, and the calculation of bilinear pairs of data is performed through the operator circuit.
  • the calculation results of bilinear pairs of data and the algorithm flow of multiple encryption and decryption algorithms can be used to calculate the data. Execute multiple encryption and decryption algorithms, such as PEKS algorithm, IBC algorithm, etc. If the result of the prime domain operator processing is the calculation result of the digital signature algorithm for the data, then the ECC encryption and decryption can be performed according to the calculation result of the digital signature algorithm for the data and the algorithm flow of the ECC algorithm.
  • the encryption and decryption processing includes any one of the following: an encrypted IBC algorithm based on identification, a public key searchable encryption PEKS algorithm, a homomorphic encryption HE algorithm, a function encryption FE algorithm, a secure multi-party computing MCP algorithm, Or elliptic curve encryption ECC algorithm.
  • the following describes the method for performing encryption and decryption provided by the second aspect of the embodiments of the present application, which can be executed by the device for performing encryption and decryption provided by the first aspect of the embodiments of the present application.
  • For effects refer to the method provided by the first aspect.
  • the introduction in the device for performing encryption and decryption processing will not be repeated.
  • an embodiment of the present application provides a method for performing encryption and decryption processing, including: executing the first part of the encryption and decryption processing by running encryption and decryption software through a processor and generating encryption and decryption instructions; The instruction is decrypted to obtain the parsed instruction, and the operator circuit is called based on the parsed instruction; the operator circuit executes the second part of the encryption and decryption processing on the data according to the call, and the second part includes the prime domain operator processing.
  • the first part includes a first encryption and decryption process and a second encryption and decryption process
  • running the encryption and decryption software through the processor to execute the first part of the encryption and decryption process includes: executing the first encryption and decryption process by the processor In order to obtain the data, the second encryption and decryption processing is performed on the intermediate result to obtain the processing result, and the intermediate result includes the result of the prime domain operator processing.
  • the method further includes: sending an execution start instruction to the instruction analyzer through the processor, The start execution instruction is used to instruct the instruction analyzer to obtain the encryption and decryption instructions; the instruction analyzer receives the start execution instruction, and obtains the encryption and decryption instructions from the memory according to the start execution instruction.
  • the method further includes: sending an interrupt message to the processor through an instruction analyzer, the interrupt message It is used to instruct the processor to obtain the processing result of the prime domain operator; receive the interrupt message through the processor, and obtain the result of the prime domain operator processing.
  • the method before sending the start execution instruction to the instruction analyzer through the processor, the method further includes: generating the key parameter through the processor, and storing the key parameter through the memory;
  • the second part of performing encryption and decryption processing includes: the second part of performing encryption and decryption processing on data using key parameters according to the call through the operator circuit.
  • the encryption and decryption instructions, data, and the result of the prime domain operator processing are stored in the memory.
  • the memory includes an instruction random access memory IRAM and a data random access memory DRAM, where the IRAM is used to store encryption and decryption instructions, and the DRAM is used to store data and the result of the prime domain operator processing.
  • the prime field operator processing includes: at least one of the first field modular multiplication, the second field modular multiplication, the fourth field modular multiplication, the 12th field modular multiplication, or the modular inverse operator processing Operation.
  • the result of the prime field operator processing is the calculation result of the bilinear pair of data, or the calculation result of the digital signature algorithm of the data.
  • the encryption and decryption processing includes any one of the following: identification-based encryption IBC algorithm, public key searchable encryption PEKS algorithm, homomorphic encryption HE algorithm, function encryption FE algorithm, secure multi-party computing MCP algorithm, or Elliptic curve encryption ECC algorithm.
  • an embodiment of the present application provides a chip for executing the method for performing encryption and decryption processing as provided in the second aspect and the optional manner of the second aspect.
  • an embodiment of the present application provides a device, including the apparatus for performing encryption and decryption processing as provided in the first aspect and the optional manner of the first aspect.
  • Fig. 1 is an exemplary application scenario diagram of an embodiment of the present application
  • Fig. 2 is another exemplary application scenario diagram of an embodiment of the present application
  • FIG. 3 is a schematic structural diagram of a terminal device provided by an embodiment of the present application.
  • FIG. 4 is a schematic structural diagram of an apparatus for performing encryption and decryption processing provided by an embodiment of the present application
  • FIG. 5 is a schematic structural diagram of an apparatus for performing encryption and decryption processing provided by another embodiment of the present application.
  • FIG. 6 is a schematic structural diagram of an apparatus for performing encryption and decryption processing provided by another embodiment of the present application.
  • FIG. 7 is a schematic flowchart of a method for performing encryption and decryption processing provided by an embodiment of the present application.
  • FIG. 8 is a schematic flowchart of a method for performing encryption and decryption processing according to another embodiment of the present application.
  • FIG. 9 is a schematic flowchart of a method for performing encryption and decryption processing according to another embodiment of the present application.
  • the cloud can process the data arbitrarily, and there may be a privacy risk after the data is synchronized to the cloud.
  • embodiments of the present application provide an apparatus and method for performing encryption and decryption processing.
  • the inventive concept of the device and method for performing encryption and decryption processing provided by the embodiments of the application lies in the combination of software and hardware, that is, the processor runs the encryption and decryption software to execute the first part of the encryption and decryption processing and generate the encryption and decryption instructions
  • the encryption and decryption instructions include encryption instructions or decryption instructions, and control the instruction analyzer to parse the encryption and decryption instructions and call the operator circuit according to the encryption and decryption instructions to perform the second part of the encryption and decryption processing on the data, and finally obtain the encrypted data or decryption of the data Data, realizes the data encryption and decryption processing for different encryption and decryption processing processes, with high flexibility and security.
  • the device for performing encryption and decryption processing provided by the embodiment of the application does not require A PCB board is provided for each type of encryption and decryption processing, and the cost is low.
  • the encryption and decryption (cryptography) technology involved in this embodiment includes encryption and decryption.
  • a typical encryption and decryption technology is an asymmetric encryption and decryption technology, which is not limited in this embodiment.
  • An exemplary application scenario of the embodiment of the present application will be introduced below.
  • applications in the terminal device for example, applications involving chat, photographing, work, or video, etc.
  • the data can include chat content, pictures, work content, corporate information, video files, or voice files, etc.
  • the embodiment of the application does not limit the type and size of the data.
  • the embodiment of the application has The specific types and types of terminal equipment are also not restricted.
  • the terminal device can be a smart phone, a personal computer, a tablet (Personal Computer, PC), a medical device, a game console, a vehicle-mounted terminal device, an autonomous driving device, a virtual reality, an augmented reality, or a mixed reality device, etc.
  • FIG. 1 is an exemplary application scenario diagram of an embodiment of the present application.
  • the data in the terminal device 11 needs to be synchronized to the cloud server 12, and the data in the terminal device 11 is uploaded to the cloud Before the server 12, the data can be encrypted, and the encrypted data can be uploaded to the cloud server, thus realizing the protection of the data.
  • FIG. 1 is an exemplary application scenario diagram of an embodiment of the present application.
  • the data in the terminal device 11 needs to be synchronized to the cloud server 12, and the data in the terminal device 11 is uploaded to the cloud Before the server 12, the data can be encrypted, and the encrypted data can be uploaded to the cloud server, thus realizing the protection of the data.
  • FIG. 1 is an exemplary application scenario diagram of an embodiment of the present
  • the terminal device 21 performs data communication with the terminal device 23.
  • the user uses the terminal device 21 and the terminal device.
  • the terminal device 21 needs to transmit the file through the cloud server 22 during the process of transferring the file to the terminal device 23.
  • the terminal device 21 uploads the file 21 to the cloud server 22.
  • Encrypt the file, and upload the encrypted file to the cloud server 22 the cloud server 22 sends the encrypted file to the terminal device 23, and the terminal device 23 decrypts the encrypted file to obtain the file, which ensures the file transmission Security.
  • FIG. 3 is a schematic structural diagram of a terminal device provided by an embodiment of the present application.
  • the terminal device 100 may include a system-on-chip 110, an external memory interface 120, an internal memory 121, and a universal serial bus ( universal serial bus, USB) interface 130, charging management module 140, power management module 141, battery 142, antenna 1, antenna 2, mobile communication module 150, wireless communication module 160, audio module 170, speaker 170A, receiver 170B, microphone 170C , Earphone interface 170D, sensor 180, button 190, motor 191, indicator 192, camera 193, display screen 194, subscriber identification module (SIM) card interface 195, etc.
  • SIM subscriber identification module
  • the structure illustrated in this embodiment does not constitute a specific limitation on the terminal device 100.
  • the terminal device 100 may include more or fewer components than those shown in the figure, or combine certain components, or split certain components, or arrange different components.
  • the illustrated components can be implemented in hardware, software, or a combination of software and hardware.
  • the system-on-chip 110 may include one or more processing units.
  • the system-on-chip 110 may include an application processor (AP), a modem processor, an image processing unit (GPU), an image processor (ISP), a controller, a video codec, and a digital signal processor (digital signal processor). DSP), baseband processor, and/or neural-network processing unit (NPU), etc.
  • the different processing units may be independent devices or integrated in one or more processors.
  • the terminal device 100 may also include one or more system-on-chips 110.
  • the application processor can be regarded as a controller, and the controller can be the nerve center and command center of the terminal device 100.
  • the controller can generate operation control signals according to the instruction operation code and timing signals to complete the control of fetching instructions and executing instructions.
  • a memory may also be provided in the system-on-chip 110 for storing instructions and data.
  • the memory in the system-on-chip 110 is a cache memory.
  • the memory can store instructions or data that have just been used or recycled by the system-on-chip 110. If the system-level chip 110 needs to use the instruction or data again, it can be directly called from the memory. This avoids repeated access and reduces the waiting time of the system-on-chip 110, thereby improving the system efficiency of the terminal device 100.
  • the system-on-chip 110 may include one or more interfaces.
  • the interface may include an integrated circuit (inter-integrated circuit, I2C) interface, an integrated circuit built-in audio (inter-integrated circuit sound, I2S) interface, a pulse code modulation (pulse code modulation, PCM) interface, and a universal asynchronous transmitter/receiver (universal asynchronous) interface.
  • receiver/transmitter, UART) interface MIPI, general-purpose input/output (GPIO) interface, subscriber identity module (SIM) interface, and/or USB interface, HDMI, V-By-One Interface, DP, etc., among them, V-By-One interface is a digital interface standard for image transmission development.
  • the USB interface 130 is an interface that complies with the USB standard specification, and specifically may be a Mini USB interface, a Micro USB interface, a USB Type C interface, and so on.
  • the USB interface 130 can be used to connect a charger to charge the terminal device 100, and can also be used to transfer data between the terminal device 100 and peripheral devices. It can also be used to connect earphones and play audio through earphones.
  • the interface connection relationship between the modules illustrated in the embodiment of the present application is merely a schematic description, and does not constitute a structural limitation of the terminal device 100.
  • the terminal device 100 may also adopt different interface connection modes in the foregoing embodiments, or a combination of multiple interface connection modes.
  • the charging management module 140 is used to receive charging input from the charger.
  • the charger can be a wireless charger or a wired charger.
  • the charging management module 140 may receive the charging input of the wired charger through the USB interface 130.
  • the charging management module 140 may receive the wireless charging input through the wireless charging coil of the terminal device 100. While the charging management module 140 charges the battery 142, it can also supply power to the terminal device 100 through the power management module 141.
  • the power management module 141 is used to connect the battery 142, the charging management module 140 and the system-on-chip 110.
  • the power management module 141 receives input from the battery 142 and/or the charging management module 140, and supplies power to the system-on-chip 110, the internal memory 121, the display screen 194, the camera 193, and the wireless communication module 160.
  • the power management module 141 can also be used to monitor parameters such as battery capacity, battery cycle times, and battery health status (leakage, impedance).
  • the power management module 141 may also be provided in the system-on-chip 110.
  • the power management module 141 and the charging management module 140 may also be provided in the same device.
  • the wireless communication function of the terminal device 100 can be implemented by the antenna 1, the antenna 2, the mobile communication module 150, the wireless communication module 160, the modem processor, and the baseband processor.
  • the antenna 1 and the antenna 2 are used to transmit and receive electromagnetic wave signals.
  • Each antenna in the terminal device 100 can be used to cover a single or multiple communication frequency bands. Different antennas can also be reused to improve antenna utilization.
  • Antenna 1 can be multiplexed as a diversity antenna of a wireless local area network.
  • the antenna can be used in combination with a tuning switch.
  • the mobile communication module 150 may provide a wireless communication solution including 2G/3G/4G/5G and the like applied to the terminal device 100.
  • the mobile communication module 150 may include at least one filter, switch, power amplifier, low noise amplifier, and so on.
  • the mobile communication module 150 can receive electromagnetic waves by the antenna 1, and perform processing such as filtering, amplifying and transmitting the received electromagnetic waves to the modem processor for demodulation.
  • the mobile communication module 150 can also amplify the signal modulated by the modem processor, and convert it into electromagnetic waves for radiation via the antenna 1.
  • at least part of the functional modules of the mobile communication module 150 may be provided in the system-on-chip 110.
  • at least part of the functional modules of the mobile communication module 150 and at least part of the modules of the system-on-chip 110 may be provided in the same device.
  • the modem processor may include a modulator and a demodulator.
  • the modulator is used to modulate the low frequency baseband signal to be sent into a medium and high frequency signal.
  • the demodulator is used to demodulate the received electromagnetic wave signal into a low-frequency baseband signal.
  • the demodulator then transmits the demodulated low-frequency baseband signal to the baseband processor for processing.
  • the application processor outputs a sound signal through an audio device (not limited to the speaker 170A, the receiver 170B, etc.), or displays an image or video through the display screen 194.
  • the modem processor may be an independent device.
  • the modem processor may be independent of the system-on-chip 110 and be provided in the same device as the mobile communication module 150 or other functional modules.
  • the wireless communication module 160 can provide applications on the terminal device 100 including wireless local area networks (WLAN), Bluetooth, global navigation satellite system (GNSS), frequency modulation (FM), NFC, Infrared technology (infrared, IR) and other wireless communication solutions.
  • the wireless communication module 160 may be one or more devices integrating at least one communication processing module.
  • the wireless communication module 160 receives electromagnetic waves via the antenna 2, frequency modulates and filters the electromagnetic wave signals, and sends the processed signals to the system-on-chip 110.
  • the wireless communication module 160 may also receive the signal to be sent from the system-on-chip 110, perform frequency modulation, amplify, and convert it into electromagnetic waves to radiate through the antenna 2.
  • the antenna 1 of the terminal device 100 is coupled with the mobile communication module 150, and the antenna 2 is coupled with the wireless communication module 160, so that the terminal device 100 can communicate with the network and other devices through wireless communication technology.
  • the wireless communication technology may include GSM, GPRS, CDMA, WCDMA, TD-SCDMA, LTE, GNSS, WLAN, NFC, FM, and/or IR technology.
  • the aforementioned GNSS may include global positioning system (GPS), global navigation satellite system (GLONASS), Beidou navigation satellite system (BDS), and quasi-zenith satellite system (quasi- Zenith satellite system, QZSS) and/or satellite-based augmentation systems (SBAS).
  • the terminal device 100 can implement a display function through a GPU, a display screen 194, an application processor, and the like.
  • the GPU is an image processing microprocessor, which is connected to the display screen 194 and the application processor.
  • the GPU is used to perform mathematical and geometric calculations and is used for graphics rendering.
  • the system-on-chip 110 may include one or more GPUs, which execute instructions to generate or change display information.
  • the display screen 194 is used to display images, videos, and the like.
  • the display screen 194 includes a display panel.
  • the display panel can use liquid crystal display (LCD), organic light-emitting diode (OLED), active matrix organic light-emitting diode or active-matrix organic light-emitting diode (active-matrix organic light-emitting diode).
  • LCD liquid crystal display
  • OLED organic light-emitting diode
  • active-matrix organic light-emitting diode active-matrix organic light-emitting diode
  • AMOLED flexible light-emitting diode (FLED), Miniled, MicroLed, Micro-oLed, quantum dot light-emitting diode (QLED), etc.
  • the terminal device 100 may include one or N display screens 194, and N is a positive integer greater than one.
  • the terminal device 100 can implement a shooting function through an ISP, one or more cameras 193, a video codec, a GPU, one or more display screens 194, and an application processor.
  • NPU is a neural-network (NN) computing processor.
  • NN neural-network
  • applications such as intelligent cognition of the terminal device 100 can be implemented, such as image recognition, face recognition, voice recognition, text understanding, and so on.
  • the external memory interface 120 may be used to connect an external memory card, such as a Micro SD card, so as to expand the storage capacity of the terminal device 100.
  • the external memory card communicates with the system-on-chip 110 through the external memory interface 120 to realize the data storage function. For example, save music, photos, videos and other data files in an external memory card.
  • the internal memory 121 may be used to store one or more computer programs, and the one or more computer programs include instructions.
  • the system-on-chip 110 can execute the above-mentioned instructions stored in the internal memory 121 to enable the terminal device 100 to execute the encryption and decryption methods provided in some embodiments of the present application, as well as various functional applications and data processing.
  • the internal memory 121 may include a storage program area and a storage data area. Among them, the storage program area can store the operating system; the storage program area can also store one or more application programs (such as photo galleries, contacts, etc.).
  • the data storage area can store data (such as photos, contacts, etc.) created during the use of the terminal device 100.
  • the internal memory 121 may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one magnetic disk storage device, a flash memory device, a universal flash storage (UFS), and the like.
  • the system-on-chip 110 may execute the instructions stored in the internal memory 121 and/or the instructions stored in the memory provided in the system-on-chip 110 to cause the terminal device 100 to execute the instructions in the embodiments of the present application. Provides encryption and decryption methods, as well as various functional applications and data processing.
  • the terminal device 100 can implement audio functions through the audio module 170, the speaker 170A, the receiver 170B, the microphone 170C, the earphone interface 170D, and the application processor. For example, music playback, recording, etc.
  • the audio module 170 is used to convert digital audio information into an analog audio signal for output, and also used to convert an analog audio input into a digital audio signal.
  • the audio module 170 can also be used to encode and decode audio signals.
  • the audio module 170 may be provided in the system-on-chip 110, or part of the functional modules of the audio module 170 may be provided in the system-on-chip 110.
  • the speaker 170A also called “speaker", is used to convert audio electrical signals into sound signals.
  • the terminal device 100 can listen to music through the speaker 170A, or listen to a hands-free call.
  • the receiver 170B also called “earpiece” is used to convert audio electrical signals into sound signals.
  • the microphone 170C also called “microphone”, “microphone”, is used to convert sound signals into electrical signals.
  • the user can make a sound by approaching the microphone 170C through the human mouth, and input the sound signal into the microphone 170C.
  • the terminal device 100 may be provided with at least one microphone 170C.
  • the terminal device 100 may be provided with two microphones 170C, which can implement noise reduction functions in addition to collecting sound signals. In other embodiments, the terminal device 100 may also be provided with three, four or more microphones 170C to collect sound signals, reduce noise, identify sound sources, and realize directional recording functions.
  • the earphone interface 170D is used to connect wired earphones.
  • the earphone interface 170D can be a USB interface 130, a 3.5mm open mobile terminal platform (OMTP) standard interface, or a cellular telecommunications industry association of the USA (CTIA) Standard interface.
  • the sensor 180 may include a pressure sensor 180A, a gyroscope sensor 180B, an air pressure sensor 180C, a magnetic sensor 180D, an acceleration sensor 180E, a distance sensor 180F, a proximity light sensor 180G, a fingerprint sensor 180H, a temperature sensor 180J, a touch sensor 180K, and an ambient light sensor 180L , Bone conduction sensor 180M and so on.
  • the pressure sensor 180A is used to sense a pressure signal, and can convert the pressure signal into an electrical signal.
  • the pressure sensor 180A may be provided on the display screen 194.
  • the capacitive pressure sensor may include at least two parallel plates with conductive materials.
  • the terminal device 100 may also calculate the touched position based on the detection signal of the pressure sensor 180A.
  • touch operations that act on the same touch position but have different touch operation strengths may correspond to different operation instructions. For example: when a touch operation whose intensity of the touch operation is less than the first pressure threshold is applied to the short message application icon, an instruction to view the short message is executed. When a touch operation with a touch operation intensity greater than or equal to the first pressure threshold acts on the short message application icon, an instruction to create a new short message is executed.
  • the gyro sensor 180B may be used to determine the movement posture of the terminal device 100.
  • the angular velocity of the terminal device 100 around three axes ie, x, y, and z axes
  • the gyro sensor 180B can be used for image stabilization.
  • the gyro sensor 180B detects the shake angle of the terminal device 100, calculates the distance that the lens module needs to compensate according to the angle, and allows the lens to counteract the shake of the terminal device 100 through reverse movement to achieve anti-shake.
  • the gyro sensor 180B can also be used for navigation, somatosensory game scenes and so on.
  • the acceleration sensor 180E can detect the magnitude of the acceleration of the terminal device 100 in various directions (generally three axes). When the terminal device 100 is stationary, the magnitude and direction of gravity can be detected. It can also be used to identify the posture of the terminal device, and it can be used in applications such as horizontal and vertical screen switching, pedometer and so on.
  • the terminal device 100 can measure the distance by infrared or laser. In some embodiments, when shooting a scene, the terminal device 100 may use the distance sensor 180F to measure the distance to achieve fast focusing.
  • the proximity light sensor 180G may include, for example, a light emitting diode (LED) and a light detector such as a photodiode.
  • the light emitting diode may be an infrared light emitting diode.
  • the terminal device 100 emits infrared light to the outside through the light emitting diode.
  • the terminal device 100 uses a photodiode to detect infrared reflected light from nearby objects. When sufficient reflected light is detected, it can be determined that there is an object near the terminal device 100. When insufficient reflected light is detected, the terminal device 100 can determine that there is no object near the terminal device 100.
  • the terminal device 100 can use the proximity light sensor 180G to detect that the user holds the terminal device 100 close to the ear to talk, so as to automatically turn off the screen to save power.
  • the proximity light sensor 180G can also be used in leather case mode, and the pocket mode will automatically unlock and lock the screen.
  • the ambient light sensor 180L is used to sense the brightness of the ambient light.
  • the terminal device 100 can adaptively adjust the brightness of the display screen 194 according to the perceived brightness of the ambient light.
  • the ambient light sensor 180L can also be used to automatically adjust the white balance when taking pictures.
  • the ambient light sensor 180L can also cooperate with the proximity light sensor 180G to detect whether the terminal device 100 is in a pocket to prevent accidental touch.
  • the fingerprint sensor 180H (also called a fingerprint reader) is used to collect fingerprints.
  • the terminal device 100 can use the collected fingerprint characteristics to implement fingerprint unlocking, access application locks, fingerprint photographs, fingerprint answering calls, and so on.
  • fingerprint unlocking is used to implement fingerprint unlocking, access application locks, fingerprint photographs, fingerprint answering calls, and so on.
  • other descriptions of the fingerprint sensor can be found in the international patent application PCT/CN2017/082773 entitled “Method and Terminal Device for Processing Notification", the entire content of which is incorporated in this application by reference.
  • the touch sensor 180K can also be called a touch panel or a touch-sensitive surface.
  • the touch sensor 180K may be disposed on the display screen 194, and the touch screen is composed of the touch sensor 180K and the display screen 194, which is also called a touch screen.
  • the touch sensor 180K is used to detect touch operations acting on or near it.
  • the touch sensor can pass the detected touch operation to the application processor to determine the type of touch event.
  • the visual output related to the touch operation can be provided through the display screen 194.
  • the touch sensor 180K may also be disposed on the surface of the terminal device 100, which is different from the position of the display screen 194.
  • the bone conduction sensor 180M can acquire vibration signals.
  • the bone conduction sensor 180M can obtain the vibration signal of the vibrating bone mass of the human voice.
  • the bone conduction sensor 180M can also contact the human pulse and receive the blood pressure pulse signal.
  • the bone conduction sensor 180M may also be provided in the earphone, combined with the bone conduction earphone.
  • the audio module 170 can parse the voice signal based on the vibration signal of the vibrating bone block of the voice obtained by the bone conduction sensor 180M, and realize the voice function.
  • the application processor can analyze the heart rate information based on the blood pressure beating signal obtained by the bone conduction sensor 180M to realize the heart rate detection function.
  • the button 190 includes a power-on button, a volume button, and so on.
  • the button 190 may be a mechanical button or a touch button.
  • the terminal device 100 may receive key input, and generate key signal input related to user settings and function control of the terminal device 100.
  • the SIM card interface 195 is used to connect to the SIM card.
  • the SIM card can be inserted into the SIM card interface 195 or pulled out from the SIM card interface 195 to achieve contact and separation with the terminal device 100.
  • the terminal device 100 may support 1 or N SIM card interfaces, and N is a positive integer greater than 1.
  • the SIM card interface 195 can support Nano SIM cards, Micro SIM cards, SIM cards, etc.
  • the same SIM card interface 195 can insert multiple cards at the same time. The types of the multiple cards can be the same or different.
  • the SIM card interface 195 can also be compatible with different types of SIM cards.
  • the SIM card interface 195 may also be compatible with external memory cards.
  • the terminal device 100 interacts with the network through the SIM card to implement functions such as call and data communication.
  • the terminal device 100 adopts an eSIM, that is, an embedded SIM card.
  • the eSIM card can be embedded in the terminal device 100 and cannot be separated from the terminal device 100.
  • the apparatus for performing encryption and decryption processing may be implemented by a terminal device, or may be implemented by a part of the terminal device, for example, in a system-on-a-chip (SoC) in the terminal device.
  • SoC system-on-a-chip
  • the system-level chip includes a processor running an operating system and an application program, and an intellectual property (IP) core hardware or an IP core engine; among them, the embodiment of the present application does not limit the type of the processor, for example, the processor may include upper-layer applications
  • IP intellectual property
  • the application of the program Central Processing Unit (Application Central Processing Unit, ACPU, the AP mentioned earlier), Microprocessor (UP), Microcontroller Unit (MCU), or DSP, etc.
  • IP core is a section with Hardware description language programs for specific circuit functions can be transplanted to different semiconductor processes to produce integrated circuit chips.
  • the IP core hardware is a hardware circuit designed in the hardware description language program and integrated in the SOC.
  • the IP core circuit includes an instruction analyzer and an operator circuit.
  • the processor runs the encryption and decryption software to perform the first part of the encryption and decryption processing, and controls the IP core hardware to perform the second part of the encryption and decryption processing on the data through instructions.
  • the data can be The original data uploaded by the user can also be the data generated after the original data is processed by the processor to perform the first part of the encryption and decryption processing, or it may be the data generated after the original data is processed by the processor to perform the partial encryption and decryption processing in the first part.
  • the embodiment of the application does not limit this. Furthermore, it realizes the encryption and decryption of data through the combination of software and hardware.
  • the software program includes at least one of an application program or a driver program.
  • Figure 4 is a schematic structural diagram of a device for performing encryption and decryption processing provided by an embodiment of the present application.
  • the device can be part or all of a terminal device, for example, it can be implemented by ACPU and IP core hardware in the terminal device.
  • the apparatus for performing encryption and decryption processing provided in the embodiment of the present application is introduced.
  • the apparatus for performing encryption and decryption processing provided by the embodiment of the present application may include a processor, an instruction analyzer, and an operator circuit.
  • the processor is connected to the instruction analyzer, and the operator circuit is connected to the instruction analyzer; the processor is used to execute the first part of the encryption and decryption processing by running the encryption and decryption software and is used to generate encryption and decryption instructions; the instruction analyzer is used to parse the encryption and decryption instructions In order to obtain the parsed instruction, and call the operator circuit based on the parsed instruction; the operator circuit is used to perform the second part of the encryption and decryption processing on the data according to the call, and the second part includes the prime domain operator processing.
  • the device for performing encryption and decryption processing provided by the embodiment of the present application is a system-on-chip.
  • the system-on-chip may include a processor and an IP core hardware or an IP core engine, where the processor may be an ACPU, and the instruction
  • the analyzer and the operator circuit are located in the IP core hardware or IP core engine in the system-level chip.
  • the processor can generate encryption and decryption instructions according to the processing flow of the encryption and decryption processing, where the encryption and decryption instructions can be encryption instructions or decryption instructions.
  • the encryption and decryption processing can be considered as an encryption and decryption algorithm processing.
  • the embodiment of the present application does not limit the specific algorithm of the encryption and decryption processing.
  • the encryption and decryption algorithm may be an asymmetric encryption and decryption algorithm or a symmetric encryption and decryption algorithm.
  • the encryption and decryption processing includes any one of the following: identity-based encryption (IBC) algorithm, public key searchable encryption (PEKS) algorithm, homomorphic encryption (HE) algorithm, functional encryption (FE) Algorithm, secure multi-party computing (MCP) algorithm, or elliptic curve encryption (ECC) algorithm.
  • IBC identity-based encryption
  • PEKS public key searchable encryption
  • HE homomorphic encryption
  • FE functional encryption
  • MCP secure multi-party computing
  • ECC elliptic curve encryption
  • the IBC algorithm is a cryptographic technology based on identification, which uses the user's identification as the user's public key.
  • the PEKS algorithm is public key searchable encryption.
  • PEKS is a new type of cryptographic system that allows users to search for keywords on data encrypted with public keys, and can quickly and effectively perform search operations without decrypting the data.
  • HE is a cryptographic technology based on the computational complexity theory of mathematical problems.
  • the FE algorithm is aimed at the user who has the decryption key and can obtain the function value of the encrypted data without obtaining any other information about the plaintext.
  • the MCP algorithm is a secure multi-party computing technology.
  • the ECC algorithm is a public key encryption system, and its mathematical foundation is to use the computational difficulty on the elliptic curve.
  • the processor For each encryption and decryption process, there is a corresponding encryption process and decryption process.
  • the processor generates an encryption instruction or a decryption instruction according to a preset algorithm process of the encryption and decryption process.
  • a preset algorithm process of the encryption and decryption process In a possible implementation manner, taking the sm9 protocol in the IBC algorithm as an example, in the sm9 key encapsulation algorithm flow and in the sm9 encryption algorithm flow, there are bilinear pair calculations. In other sm9 protocols There is also the calculation of bilinear pairs in. Therefore, when the current encryption and decryption process is the IBC algorithm, the encryption and decryption instructions can be used to instruct or schedule the calculation of the bilinear pair.
  • bilinear pairing as pairing bilinear pairing as an example
  • the algorithm flow of the ECC algorithm needs to calculate the digital signature algorithm (ED25519) of the data. Therefore, when the encryption and decryption processing is the ECC algorithm, the encryption and decryption instructions can be It is used to instruct or schedule the calculation of ED25519. In the calculation process of ED25519, it is necessary to call 1 domain modular multiplication, 2 domain modular multiplication and modular inverse operators multiple times.
  • the operator circuit in the apparatus for performing encryption and decryption processing can be used to perform 1 domain modular multiplication, 2 domain modular multiplication, and 4 domain modular multiplication. At least one of modular multiplication, 12-fold domain modular multiplication, or modular inverse operator.
  • the IP core hardware can be called once to obtain the calculation result of the bilinear pair in sm9 or the ECC algorithm
  • the calculation result of ED25519 in ED25519 avoids frequent and repeated calls to the IP core hardware, and is simple to implement, and the IP core hardware has an independent execution control unit and memory, programmable instructions, and flexible support for multiple encryption and decryption processing.
  • the embodiment of the present application splits the complete encryption and decryption processing into two processing parts, wherein the processor executes the first part of the encryption and decryption processing, and the operator circuit executes the second part of the encryption and decryption processing according to the call of the instruction analyzer.
  • the second part includes the prime field operator processing part.
  • the embodiment of this application does not limit the specific processing method and the processing result of prime field operator processing.
  • the prime field operator processing result is right
  • the bilinear pair may include pairing bilinear pair, rate bilinear pair, etc.
  • the embodiment of the present application does not limit the specific calculation method of the bilinear pair.
  • the operator circuit when the result of the prime field operator processing is the calculation result of the bilinear pair of data, the operator circuit is used to perform the calculation of the bilinear pair.
  • the calculation of bilinear pairing is required.
  • the result of prime domain operator processing can be obtained through the calculation of the bilinear pair of data by the operator circuit.
  • the result of prime domain operator processing can be used for further algorithm flow to execute the data
  • a variety of encryption and decryption processing for example, PEKS algorithm, IBC algorithm, etc. If the result of the prime domain operator processing is the calculation result of the digital signature algorithm of the data, then the ECC encryption and decryption can be further performed according to the result of the prime domain operator processing and the subsequent algorithm flow of the ECC algorithm.
  • the embodiment of the application does not limit the processing sequence of the first part and the second part of the encryption and decryption processing.
  • the processor first executes the first part of the encryption and decryption processing to obtain the first result, and then passes The operator circuit executes the second part of the encryption and decryption processing on the first result according to the call of the instruction analyzer to obtain the encryption and decryption data, that is, the software processing is executed first and then the hardware processing is executed.
  • the operator circuit first executes the second part of the encryption and decryption processing on the data according to the call of the instruction analyzer to obtain the second result, and then executes the encryption and decryption processing on the second result by the processor.
  • the first part is to get the encrypted and decrypted data, that is, perform hardware processing first and then perform software processing.
  • the first part of the encryption and decryption processing and the second part of the encryption and decryption processing may respectively include at least one processing method, which is not limited in the embodiment of the present application.
  • the first part includes a first encryption and decryption process and a second encryption and decryption process; the processor is specifically configured to perform the first encryption and decryption process to obtain data; and the operator circuit is used to perform encryption and decryption on the data according to the call.
  • the second part of the decryption process is to generate an intermediate result, which includes the result of the prime domain operator processing; the processor is specifically used to perform the second encryption and decryption process on the intermediate result to obtain the processing result.
  • Hardware processing is performed in between.
  • the first encryption and decryption processing and the second encryption and decryption processing can be processing methods of different processing stages in the first part of the encryption and decryption processing.
  • the processor performs the first encryption and decryption processing to obtain data, and then the operator circuit performs encryption on the data according to the call.
  • the second part of the decryption process is to generate an intermediate result, and then the processor performs a second encryption and decryption process on the intermediate result to obtain encrypted and decrypted data.
  • the processor can also be used to control the work of the IP core hardware.
  • the processor is also used to: send a start execution instruction to the instruction analyzer, and start executing the instruction It is used to instruct the instruction analyzer to obtain the encryption and decryption instructions; the instruction analyzer is also used to: receive the start execution instruction, and obtain the encryption and decryption instructions from the memory according to the start execution instruction.
  • the processor sends an execution start instruction to the instruction analyzer to control the instruction analyzer to obtain the encryption and decryption instructions, and then invoke the operator circuit to execute the second part of the encryption and decryption processing according to the encryption and decryption instructions.
  • the instruction analyzer is further used to: send an interrupt to the processor
  • the interrupt message is used to instruct the processor to obtain the result of the prime domain operator processing;
  • the processor is also used to: receive the interrupt message, and obtain the result of the prime domain operator processing from the memory according to the interrupt message.
  • the instruction analyzer sends a terminal message to the processor, instructing the processor to obtain the result of the prime domain operator processing, so that the processor performs the subsequent process according to the result of the prime domain operator processing, thereby realizing encryption and decryption deal with.
  • the embodiment of this application implements a combination of software and hardware processing by hardening part of the functions in the encryption and decryption processing, that is, through the processor control
  • the instruction analyzer calls the operator circuit, and the operator circuit only performs the calculation of the second part of the encryption and decryption processing on the data.
  • the calculation of the first part of the encryption and decryption processing is performed by the software, which not only realizes the encryption and decryption on the basis of ensuring security. Processing, and the flexibility is high, and there is no need to set up a PCB board for each encryption and decryption process, and the cost is low.
  • an embodiment of the present application may further include a memory.
  • FIG. 5 is a schematic structural diagram of an apparatus for performing encryption and decryption processing provided by another embodiment of the present application.
  • the device may be part or all of the terminal device, for example, it may be implemented by the ACPU and IP core hardware in the terminal device.
  • the following takes the terminal device as the execution body as an example to introduce the device for performing encryption and decryption processing provided in the embodiments of the present application.
  • the apparatus for performing encryption and decryption processing provided by the embodiment of the present application may further include a memory, which is used to store encryption and decryption instructions, data, and the result of the prime domain operator processing.
  • the processor After the processor generates encryption and decryption instructions according to the preset encryption and decryption processing, it can send the encryption and decryption instructions to the memory.
  • the processor obtains the original data or original data that needs to be encrypted and decrypted. After the data is obtained after the processor executes the first part of the encryption and decryption process, the original data or the data obtained after the processor executes the first part of the encryption and decryption process may also be sent to the memory. There is data communication between the memory and the instruction analyzer.
  • the instruction analyzer can read data from the memory and encrypt and decrypt instructions, or it can call the operator circuit according to the encryption and decryption instructions to perform prime-domain operator processing on the data, and calculate the prime domain
  • the result of the sub-processing is sent to the memory.
  • the processor can read the result of the prime domain operator processing from the memory.
  • the processor may also generate a key parameter, and then send the encryption and decryption processing key to the memory, and the memory is also used to store the key Parameter, the operator circuit is specifically used to: according to the call, use the key parameter to perform the second part of the encryption and decryption processing on the data.
  • the security can be improved by storing the key parameter in the hardware.
  • the apparatus for performing encryption and decryption processing provided by the application embodiment further includes: an interface; the processor is respectively connected to the memory and the instruction analyzer through the interface.
  • the embodiment of the present application realizes data transmission between the processor and the instruction analyzer through the interface.
  • the instructions of the processor are not transferred to the instruction analyzer through the memory, but are implemented through the interface.
  • the interface can also be used as a transmission medium between the memory and the memory, which is not specifically limited in this embodiment.
  • FIG. 6 is a schematic structural diagram of an apparatus for performing encryption and decryption processing provided by another embodiment of the present application, as shown in FIG. 6
  • the memory includes IRAM and DRAM, where IRAM is used to store encryption and decryption instructions, and DRAM is used to store data and the result of prime domain operator processing.
  • the processor After the processor generates the encryption and decryption instructions, it sends the encryption and decryption instructions to IRAM for storage through the interface, and sends the data to DRAM for storage.
  • the instruction analyzer reads the encryption and decryption instructions from IRAM and reads data from DRAM. The analyzer processes the data according to the encryption and decryption instructions to obtain the result of the prime domain operator processing, and sends the result of the prime domain operator processing to the DRAM for storage.
  • the memory can also store key parameters.
  • the key parameters can be stored in DRAM. If the key parameters are random parameters, the key parameters can be stored In IRAM, the embodiments of the present application do not impose restrictions on this.
  • the storage of the encryption and decryption instructions, data, and the result of the prime domain operator processing is realized by setting a memory.
  • the following describes the method for performing encryption and decryption processing provided by the embodiment of the application.
  • the method can be executed by the device for performing encryption and decryption processing provided by the embodiment of the application.
  • the device for performing encryption and decryption processing provided by the embodiment of the application For its content and beneficial effects, please refer to the above-mentioned embodiments.
  • FIG. 7 is a schematic flowchart of a method for performing encryption and decryption processing provided by an embodiment of the present application.
  • the method for performing encryption and decryption processing provided by an embodiment of the present application may include: Step S101: Through a processor Run the encryption and decryption software to execute the first part of the encryption and decryption processing and is used to generate encryption and decryption instructions.
  • the encryption and decryption processing may include any one of the following: IBC algorithm, PEKS algorithm, HE algorithm, FE algorithm, MCP algorithm, or ECC algorithm.
  • the specific processing procedures of the first part of the encryption and decryption processing may be different, and the embodiment of this application does not limit this.
  • the first part of the encryption and decryption processing includes the first part of the encryption and decryption processing.
  • One encryption and decryption processing and the second encryption and decryption processing; the first part of the encryption and decryption processing executed by the processor running the encryption and decryption software includes: the processor performs the first encryption and decryption processing to obtain data, and the second encryption and decryption processing is performed on the intermediate result In order to obtain the processing result, the intermediate result includes the result of the prime field operator processing.
  • the embodiment of the present application only uses this as an example, and is not limited to this.
  • the embodiments of this application do not limit the specific instruction form and content of the encryption and decryption instructions.
  • the encryption and decryption processing is any of the IBC algorithm, the PEKS algorithm, the HE algorithm, the FE algorithm, or the MCP algorithm
  • the encryption and decryption instructions can be used to indicate or call the calculation of pairing bilinear pairs or the calculation of rate bilinear pairs;
  • the encryption and decryption processing is an ECC algorithm
  • the encryption and decryption commands can be used to indicate or call the ED25519
  • the embodiment of the present application only uses this as an example, and is not limited to this.
  • Step S102 Parse the encryption and decryption instructions through the instruction analyzer to obtain the parsed instructions, and call the operator circuit based on the parsed instructions.
  • the parsed instruction can be used to instruct the calculation of the bilinear pairing of the data or the digital signature algorithm for the data.
  • the operator circuit is called based on the parsed instruction.
  • Step S103 Perform the second part of the encryption and decryption processing on the data according to the call through the operator circuit.
  • the second part includes prime field operator processing to get the result of prime field operator processing.
  • the prime field operator processing includes: at least one of the first field modular multiplication, the second field modular multiplication, the fourth field modular multiplication, the 12th field modular multiplication, or the modular inverse operator processing Operation.
  • the result of the prime domain operator processing may be the calculation result of the bilinear pair of data, or the calculation result of the digital signature algorithm of the data.
  • the result of prime domain operator processing can be obtained by calling the IP core hardware once, which is simple to implement.
  • the IP core hardware has an independent execution control unit and memory, programmable instructions, and flexible support for multiple encryption and decryption deal with.
  • the ACPU and the IP core are integrated in the SoC, which does not occupy PCB area, is low in cost, and has high energy efficiency.
  • FIG. 8 is a schematic flowchart of a method for performing encryption and decryption processing provided by another embodiment of the present application.
  • the provided method for performing encryption and decryption processing may further include: step S201: sending an execution start instruction to the instruction analyzer through the processor. Before the processor generates the encryption and decryption instructions, the start execution instruction is used to instruct the instruction analyzer to obtain the encryption and decryption instructions.
  • Step S202 Receive an execution start instruction through the instruction analyzer, and obtain an encryption/decryption instruction from the memory according to the execution start instruction. After sending the start execution instruction to the instruction analyzer through the processor, the instruction analyzer receives the start execution instruction, and obtains the encryption and decryption instructions from the memory to parse the encryption and decryption instructions to obtain the parsed instructions, and call the algorithm based on the parsed instructions. Sub-circuit.
  • the processor sends an execution start instruction to the instruction analyzer to control the instruction analyzer to invoke the operator circuit to execute the second part of the encryption and decryption processing.
  • FIG. 9 is a schematic flowchart of a method for performing encryption and decryption processing provided by another embodiment of the present application.
  • the method for performing encryption and decryption processing provided by an embodiment of the present application is Before step S201, the method may further include: step S301: generating a key parameter by the processor.
  • the processor After the processor generates the encryption and decryption key, it sends the encryption and decryption key parameters to the memory.
  • the memory stores the key parameters.
  • the memory can include DRAM and IRAM. If the key parameters are fixed parameters, the encryption can be The key parameter is stored in DRAM. If the key parameter is a random parameter, the key parameter can be stored in IRAM, which is not limited in the embodiment of the present application. In the embodiment of the present application, the memory may also be used to store encryption and decryption instructions, data, and the result of prime field operator processing.
  • the processor generates the secret key parameter and sends the secret key parameter to the memory, which not only realizes the generation and storage of the secret key parameter, but also realizes it through pure software compared with the prior art.
  • the secret key parameters are stored in the memory of the IP core, which can prevent hardware attacks and ensure the security of the key parameters.
  • step S103 in the embodiment of the present application is correspondingly changed to step S302 through the operator circuit to execute the second part of the encryption and decryption processing on the data according to the call.
  • Step S302 Perform the second part of the encryption and decryption processing on the data by using the key parameter according to the call by the operator circuit.
  • the embodiment of the present application does not limit the specific implementation of the second part of performing encryption and decryption processing on data by using the key parameter according to the call by the operator circuit.
  • step S303 and step S304 may be further included.
  • Step S303 Send an interrupt message to the processor through the instruction analyzer.
  • the interrupt message is used to instruct the processor to obtain the result of the prime domain operator.
  • the instruction analyzer calls the operator circuit to execute the second part of the encryption and decryption process, and obtains the result of the prime domain operator, the instruction analyzer sends the processor Send an interrupt message to enable the processor to obtain the result of the prime domain operator processing.
  • Step S304 Receive the interrupt message through the processor, and obtain the result of the prime domain operator processing.
  • the processor clears the interrupt after obtaining the result of the prime field operator processing.
  • the processor calculates the result of the prime domain operator processing according to the algorithm flow of the encryption and decryption processing to obtain encrypted data or decrypted data of the data.
  • the processing methods for the results of the prime field operator processing may be different, which is not limited in the embodiment of the present application.
  • the embodiment of the present application also provides a system-level chip for executing the above-mentioned method for performing encryption and decryption processing.
  • a system-level chip for executing the above-mentioned method for performing encryption and decryption processing.
  • the embodiment of the present application also provides a terminal device.
  • the terminal device may include the apparatus for performing encryption and decryption processing provided in the embodiment of the present application.
  • the terminal device may include the apparatus for performing encryption and decryption processing provided in the embodiment of the present application.
  • the embodiments of the present application also provide a computer-readable storage medium.
  • the computer-readable storage medium stores computer-executable instructions.
  • the user equipment executes the aforementioned various possibilities. Methods.

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Computer Hardware Design (AREA)
  • Physics & Mathematics (AREA)
  • Computer Security & Cryptography (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Microelectronics & Electronic Packaging (AREA)
  • Software Systems (AREA)
  • Mathematical Physics (AREA)
  • Health & Medical Sciences (AREA)
  • Bioethics (AREA)
  • General Health & Medical Sciences (AREA)
  • Computing Systems (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Storage Device Security (AREA)

Abstract

一种用于执行加解密处理的装置及方法，该装置包括：处理器、指令分析器和算子电路，处理器与指令分析器连接，算子电路与指令分析器连接；处理器，用于通过运行加解密软件执行加解密处理的第一部分以及用于生成加解密指令；指令分析器，用于解析加解密指令以得到解析的指令，并基于解析的指令调用算子电路；算子电路，用于根据调用对数据执行加解密处理的第二部分，第二部分包括素域算子处理。该装置实现了对数据的加解密，在保证安全性的前提下提高了用于执行加解密处理的装置的灵活性，且成本较低。

Description

用于执行加解密处理的装置及方法 技术领域
本申请涉及信息安全技术领域，尤其涉及一种用于执行加解密处理的装置及方法。
背景技术
数据在同步到云端之后，云端可以任意处理数据，可能会存在数据同步至云端之后的泄露隐私风险。为了保护数据，除了可以通过遵守通用数据保护条例(General Data Protection Regulation，GDPR)及相关法规之外，还可以采用加密算法对数据进行加密，然后将加密后的数据上传至云端，云端可以在加密后的数据上进行运算得到特定信息，而又不泄露用户的明文信息，达到保护用户隐私的目的。
现有技术中，对数据进行加密，通常采用函数加密(Functional Encryption，FE)、同态加密(Homomorphic Encryption，HE)、基于标识的加密(Identity-Based Cryptography，IBC)、椭圆曲线加密(Elliptic curve cryptography，ECC)、公钥可搜索加密(Public-key Encryption with Keyword Search，PEKS)、或安全多方计算(secure Multi-Party Computation，MPC)等方式，为了实现对数据的加密，通常采用软件或独立器件实现，其中，软件实现为通过计算机语言将加解密算法进行编程，以实现对数据的加解密，但是安全性和能效均较低；独立器件方式为通过将加解密算法进行硬化处理，例如，通过印制电路板(Printed Circuit Board，PCB)实现对数据的加解密。
然而，现有技术中，通过独立器件方式实现对数据的加解密，灵活性差，不易升级和更改。因此，如何设计一种安全性高且具有灵活性的安全加解密技术就成为一个亟待解决的问题。
发明内容
本申请实施例提供一种用于执行加解密处理的装置及方法，实现了对数据的加解密，在保证安全性的前提下提高了用于执行加解密处理的装置的灵活性。
第一方面，本申请实施例提供一种用于执行加解密处理的装置，包括：处理器、指令分析器和算子电路，处理器与指令分析器连接，算子电路与指令分析器连接；处理器，用于通过运行加解密软件执行加解密处理的第一部分以及用于生成加解密指令；指令分析器，用于解析加解密指令以得到解析的指令，并基于解析的指令调用算子电路；算子电路，用于根据调用对数据执行加解密处理的第二部分，第二部分包括素域算子处理。
本申请实施例中，通过处理器运行加解密软件执行加解密处理的第一部分以及生成加解密指令，通过指令分析器解析加解密指令以得到解析的指令，并根据解析的指令调用算子电路，算子电路根据调用对数据执行加解密处理的第二部分，实现了对数 据的加解密处理。相比于现有技术中的纯软件方式或独立器件方式，本方案可以通过软件和硬件结合的方式，即，通过处理器运行的软件执行加解密处理的第一部分，通过处理器控制指令分析器调用算子电路，对数据执行加解密处理的第二部分，可以实现对数据进行加解密处理，灵活性较高，且安全性有所保证。
在一种可能的实施方式中，第一部分包括第一加解密处理和第二加解密处理；处理器具体用于执行第一加解密处理以得到数据；算子电路用于根据调用对数据执行加解密处理的第二部分以生成中间结果，中间结果包括素域算子处理的结果；处理器具体用于对中间结果执行第二加解密处理以得到处理结果。
在一种可能的实施方式中，本申请实施例提供的用于执行加解密处理的装置，还包括：存储器，用于存储加解密指令、数据和素域算子处理的结果。
本申请实施例中，通过设置存储器，实现了对加解密指令、数据和素域算子处理的结果的存储。
在一种可能的实施方式中，存储器包括指令随机访问存储器(instruction ramdom access memory，IRAM)和数据随机访问存储器(data ramdom access memory，DRAM)，其中，IRAM用于存储加解密指令；DRAM用于存储数据和素域算子处理的结果。
在一种可能的实施方式中，本申请实施例提供的用于执行加解密处理的装置是系统级芯片，存储器、指令分析器和算子电路位于系统级芯片中的IP核引擎中。
在一种可能的实施方式中，处理器，还用于：向指令分析器发送开始执行指令，开始执行指令用于指示指令分析器获取加解密指令；指令分析器，还用于：接收开始执行指令，并根据开始执行指令从存储器中获取加解密指令。
在一种可能的实施方式中，处理器还用于：生成密钥参数；存储器还用于存储密钥参数；算子电路具体用于根据调用，利用密钥参数对数据执行加解密处理的第二部分。
本申请实施例中，处理器生成秘钥参数，并通过存储器存储密钥参数，不仅实现了对秘钥参数的生成和存储，而且，相比于现有技术中通过纯软件的方式实现对用于数据的加解密，将秘钥参数存储在存储器中，可以防止硬件攻击，保证了密钥参数的安全性。
在一种可能的实施方式中，指令分析器还用于：向处理器发送中断消息，中断消息用于指示处理器获取素域算子处理的结果；处理器还用于：接收中断消息，并根据中断消息从存储器中获取素域算子处理的结果。
在一种可能的实施方式中，素域算子处理包括：1次域模乘、2次域模乘、4次域模乘、12次域模乘、或模逆算子处理中的至少一项运算。
在一种可能的实施方式中，素域算子处理的结果为对数据的双线性对的计算结果，或，对数据的数字签名算法的计算结果。
本申请实施例中，素域算子处理的结果为对数据的双线性对的计算结果时，算子电路用于执行双线性对的计算，在现有技术中的多种加解密算法，均需要进行双线性对的计算，通过算子电路执行对数据的双线性对的计算，可以利用对数据的双线性对的计算结果和多种加解密算法的算法流程，对数据执行多种加解密算法，例如，PEKS算法、IBC算法等。若素域算子处理的结果为对数据的数字签名算法的计算结果，则 可以根据对数据的数字签名算法的计算结果和ECC算法的算法流程，进行ECC加解密。
在一种可能的实施方式中，加解密处理包括以下任意一种：基于标识的加密IBC算法、公钥可搜索加密PEKS算法、同态加密HE算法、函数加密FE算法、安全多方计算MCP算法、或椭圆曲线加密ECC算法。
下面介绍本申请实施例第二方面提供的用于执行加解密处理的方法，可以通过本申请实施例第一方面提供的用于执行加解密处理的装置执行，其效果可参考第一方面提供的用于执行加解密处理的装置中的介绍，不再赘述。
第二方面，本申请实施例提供一种用于执行加解密处理的方法，包括：通过处理器运行加解密软件执行加解密处理的第一部分以及用于生成加解密指令；通过指令分析器解析加解密指令以得到解析的指令，并基于解析的指令调用算子电路；通过算子电路根据调用对数据执行加解密处理的第二部分，第二部分包括素域算子处理。
在一种可能的实施方式中，第一部分包括第一加解密处理和第二加解密处理；通过处理器运行加解密软件执行加解密处理的第一部分，包括：通过处理器执行第一加解密处理以得到数据，对中间结果执行第二加解密处理以得到处理结果，中间结果包括素域算子处理的结果。
在一种可能的实施方式中，在通过指令分析器解析加解密指令以得到解析的指令，并基于解析的指令调用算子电路之前，还包括：通过处理器向指令分析器发送开始执行指令，开始执行指令用于指示指令分析器获取加解密指令；通过指令分析器接收开始执行指令，并根据开始执行指令从存储器中获取加解密指令。
在一种可能的实施方式中，在通过所述算子电路根据所述调用对数据执行所述加解密处理的第二部分之后，还包括：通过指令分析器向处理器发送中断消息，中断消息用于指示处理器获取素域算子处理的结果；通过处理器接收中断消息，并获取素域算子处理的结果。
在一种可能的实施方式中，在通过处理器向指令分析器发送开始执行指令之前，还包括：通过处理器生成密钥参数，并通过存储器存储密钥参数；通过算子电路根据调用对数据执行加解密处理的第二部分，包括：通过算子电路根据调用，利用密钥参数对数据执行加解密处理的第二部分。
在一种可能的实施方式中，通过存储器存储加解密指令、数据、素域算子处理的结果。
在一种可能的实施方式中，存储器包括指令随机访问存储器IRAM和数据随机访问存储器DRAM，其中，IRAM用于存储加解密指令，DRAM用于存储数据和素域算子处理的结果。
在一种可能的实施方式中，素域算子处理包括：1次域模乘、2次域模乘、4次域模乘、12次域模乘、或模逆算子处理中的至少一项运算。
在一种可能的实施方式中，素域算子处理的结果为对数据的双线性对的计算结果，或，对数据的数字签名算法的计算结果。
在一种可能的实施方式中，加解密处理包括以下任意一种：基于标识的加密IBC算法、公钥可搜索加密PEKS算法、同态加密HE算法、函数加密FE算法、安全多方 计算MCP算法或椭圆曲线加密ECC算法。
第三方面，本申请实施例提供一种芯片，用于执行如第二方面及第二方面可选方式提供的用于执行加解密处理的方法。
第四方面，本申请实施例提供一种设备，包括如第一方面及第一方面可选方式提供的用于执行加解密处理的装置。
附图说明
图1是本申请实施例一示例性应用场景图；
图2是本申请实施例另一示例性应用场景图；
图3是本申请一实施例提供的终端设备的结构示意图；
图4是本申请一实施例提供的用于执行加解密处理的装置的结构示意图；
图5是本申请另一实施例提供的用于执行加解密处理的装置的结构示意图；
图6是本申请又一实施例提供的用于执行加解密处理的装置的结构示意图；
图7是本申请实施例提供的用于执行加解密处理的方法的流程示意图；
图8是本申请另一实施例提供的用于执行加解密处理的方法的流程示意图；
图9是本申请又一实施例提供的用于执行加解密处理的方法的流程示意图。
具体实施方式
数据在同步到云端之后，云端可以任意处理数据，可能会存在数据同步至云端之后的泄露隐私风险。为了保护数据，除了可以通过遵守通用数据保护条例GDPR及相关法规之外，还可以采用加密算法对数据进行加密，然后将加密后的数据上传至云端，云端可以在加密后的数据上进行运算得到特定信息，而又不泄露用户的明文信息，达到保护用户隐私的目的。为了解决背景技术提到的技术问题，本申请实施例提供一种用于执行加解密处理的装置及方法。
本申请实施例提供的用于执行加解密处理的装置及方法的发明构思在于，通过软硬件结合的方式，即，通过处理器运行加解密软件执行加解密处理的第一部分以及生成加解密指令，其中，加解密指令包括加密指令或解密指令，并控制指令分析器解析加解密指令并根据加解密指令调用算子电路，对数据执行加解密处理的第二部分，最终得到数据的加密数据或解密数据，实现针对不同的加解密处理的处理流程对数据进行加解密处理，灵活性较高，且安全性有所保证，另外，本申请实施例提供的用于执行加解密处理的装置，不需要针对每种加解密处理均设置PCB板，成本较低。本实施例涉及的加解密(cryptography)技术包括加密(encryption)和解密(decryption)。一种典型的加解密技术是非对称加解密技术，本实施例对此不限定。
下面对本申请实施例的一示例性应用场景进行介绍。在终端设备中的应用程序中，例如，涉及聊天、拍照、工作、或视频等的应用程序，可能会对数据上传至云端服务器，通过云端服务器存储数据或者是通过云端服务器与其他终端设备进行交换等，其中，数据可以包括聊天内容、图片、工作内容、企业资料、视频文件、或语音文件等，本申请实施例对数据的类型、和大小等不做限制，本申请实施例对应用程序的具体类型以及终端设备的类型也不做限制。终端设备可以是智能手机、个人电脑、平板电脑(Personal Computer，PC)、医疗设备、游戏主机、车载终端设备、自动驾驶设备、 虚拟现实、增强现实、或混合现实设备等等。以终端设备为PC为例，图1是本申请实施例一示例性应用场景图，如图1所示，终端设备11中的数据需要同步到云端服务器12，在终端设备11将数据上传至云端服务器12之前，可以对数据进行加密，并将加密后的数据上传至云端服务器，实现了对数据的保护。以终端设备为智能手机为例，图2是本申请实施例另一示例性应用场景图，如图2所示，终端设备21与终端设备23进行数据通信，例如，用户使用终端设备21和终端设备23进行文件传输，则终端设备21在将文件传输至终端设备23的过程中，需要通过云端服务器22进行传输，为了保证文件的安全性，终端设备21在将文件21上传至云端服务器22之前，对文件进行加密，并将加密后的文件上传至云端服务器22，云端服务器22将加密后的文件发送至终端设备23，终端设备23对加密后的文件进行解密，得到文件，保证了文件传输的安全性。
示例性的，图3是本申请一实施例提供的终端设备的结构示意图，如图3所示，终端设备100可以包括系统级芯片110，外部存储器接口120，内部存储器121，通用串行总线(universal serial bus，USB)接口130，充电管理模块140，电源管理模块141，电池142，天线1，天线2，移动通信模块150，无线通信模块160，音频模块170，扬声器170A，受话器170B，麦克风170C，耳机接口170D，传感器180，按键190，马达191，指示器192，摄像头193，显示屏194，以及用户标识模块(subscriber identification module，SIM)卡接口195等。可以理解的是，本实施例示意的结构并不构成对终端设备100的具体限定。在本申请另一些实施例中，终端设备100可以包括比图示更多或更少的部件，或者组合某些部件，或者拆分某些部件，或者不同的部件布置。图示的部件可以以硬件，软件，或软件和硬件的组合实现。
系统级芯片110可以包括一个或多个处理单元。系统级芯片110可以包括应用处理器(AP)，调制解调处理器，图像处理单元(GPU)，图像处理器(ISP)，控制器，视频编解码器，数字信号处理器(digital signal processor，DSP)，基带处理器，和/或神经网络处理器(neural-network processing unit，NPU)等。其中，不同的处理单元可以是独立的器件，也可以集成在一个或多个处理器中。在一些实施例中，终端设备100也可以包括一个或多个系统级芯片110。其中，应用处理器可被视为是个控制器，控制器可以是终端设备100的神经中枢和指挥中心。控制器可以根据指令操作码和时序信号，产生操作控制信号，完成取指令和执行指令的控制。系统级芯片110中还可以设置存储器，用于存储指令和数据。在一些实施例中，系统级芯片110中的存储器为高速缓冲存储器。该存储器可以保存系统级芯片110刚用过或循环使用的指令或数据。如果系统级芯片110需要再次使用该指令或数据，可从所述存储器中直接调用。这就避免了重复存取，减少了系统级芯片110的等待时间，因而提高了终端设备100系统的效率。
在一些实施例中，系统级芯片110可以包括一个或多个接口。接口可以包括集成电路(inter-integrated circuit，I2C)接口，集成电路内置音频(inter-integrated circuit sound，I2S)接口，脉冲编码调制(pulse code modulation，PCM)接口，通用异步收发传输器(universal asynchronous receiver/transmitter，UART)接口，MIPI，通用输入输出(general-purpose input/output，GPIO)接口，用户标识模块(subscriber identity module， SIM)接口，和/或USB接口、HDMI、V-By-One接口，DP等，其中，V-By-One接口是一种面向图像传输开发的数字接口标准。其中，USB接口130是符合USB标准规范的接口，具体可以是Mini USB接口，Micro USB接口，USB Type C接口等。USB接口130可以用于连接充电器为终端设备100充电，也可以用于终端设备100与外围设备之间传输数据。也可以用于连接耳机，通过耳机播放音频。
可以理解的是，本申请实施例示意的各模块间的接口连接关系，只是示意性说明，并不构成对终端设备100的结构限定。在本申请另一些实施例中，终端设备100也可以采用上述实施例中不同的接口连接方式，或多种接口连接方式的组合。
充电管理模块140用于从充电器接收充电输入。其中，充电器可以是无线充电器，也可以是有线充电器。在一些有线充电的实施例中，充电管理模块140可以通过USB接口130接收有线充电器的充电输入。在一些无线充电的实施例中，充电管理模块140可以通过终端设备100的无线充电线圈接收无线充电输入。充电管理模块140为电池142充电的同时，还可以通过电源管理模块141为终端设备100供电。
电源管理模块141用于连接电池142，充电管理模块140与系统级芯片110。电源管理模块141接收电池142和/或充电管理模块140的输入，为系统级芯片110，内部存储器121，显示屏194，摄像头193，和无线通信模块160等供电。电源管理模块141还可以用于监测电池容量，电池循环次数，电池健康状态(漏电，阻抗)等参数。在其他一些实施例中，电源管理模块141也可以设置于系统级芯片110中。在另一些实施例中，电源管理模块141和充电管理模块140也可以设置于同一个器件中。
终端设备100的无线通信功能可以通过天线1，天线2，移动通信模块150，无线通信模块160，调制解调处理器以及基带处理器等实现。天线1和天线2用于发射和接收电磁波信号。终端设备100中的每个天线可用于覆盖单个或多个通信频带。不同的天线还可以复用，以提高天线的利用率。例如：可以将天线1复用为无线局域网的分集天线。在另外一些实施例中，天线可以和调谐开关结合使用。
移动通信模块150可以提供应用在终端设备100上的包括2G/3G/4G/5G等无线通信的解决方案。移动通信模块150可以包括至少一个滤波器，开关，功率放大器，低噪声放大器等。移动通信模块150可以由天线1接收电磁波，并对接收的电磁波进行滤波，放大等处理，传送至调制解调处理器进行解调。移动通信模块150还可以对经调制解调处理器调制后的信号放大，经天线1转为电磁波辐射出去。在一些实施例中，移动通信模块150的至少部分功能模块可以被设置于系统级芯片110中。在一些实施例中，移动通信模块150的至少部分功能模块可以与系统级芯片110的至少部分模块被设置在同一个器件中。
调制解调处理器可以包括调制器和解调器。其中，调制器用于将待发送的低频基带信号调制成中高频信号。解调器用于将接收的电磁波信号解调为低频基带信号。随后解调器将解调得到的低频基带信号传送至基带处理器处理。低频基带信号经基带处理器处理后，被传递给应用处理器。应用处理器通过音频设备(不限于扬声器170A，受话器170B等)输出声音信号，或通过显示屏194显示图像或视频。在一些实施例中，调制解调处理器可以是独立的器件。在另一些实施例中，调制解调处理器可以独立于系统级芯片110，与移动通信模块150或其他功能模块设置在同一个器件中。
无线通信模块160可以提供应用在终端设备100上的包括无线局域网(wireless local area networks，WLAN)，蓝牙，全球导航卫星系统(global navigation satellite system，GNSS)，调频(frequency modulation，FM)，NFC，红外技术(infrared，IR)等无线通信的解决方案。无线通信模块160可以是集成至少一个通信处理模块的一个或多个器件。无线通信模块160经由天线2接收电磁波，将电磁波信号调频以及滤波处理，将处理后的信号发送到系统级芯片110。无线通信模块160还可以从系统级芯片110接收待发送的信号，对其进行调频，放大，经天线2转为电磁波辐射出去。
在一些实施例中，终端设备100的天线1和移动通信模块150耦合，天线2和无线通信模块160耦合，使得终端设备100可以通过无线通信技术与网络以及其他设备通信。所述无线通信技术可以包括GSM，GPRS，CDMA，WCDMA，TD-SCDMA，LTE，GNSS，WLAN，NFC，FM，和/或IR技术等。上述GNSS可以包括全球卫星定位系统(global positioning system，GPS)，全球导航卫星系统(global navigation satellite system，GLONASS)，北斗卫星导航系统(beidou navigation satellite system，BDS)，准天顶卫星系统(quasi-zenith satellite system，QZSS)和/或星基增强系统(satellite based augmentation systems，SBAS)。
终端设备100通过GPU，显示屏194，以及应用处理器等可以实现显示功能。GPU为图像处理的微处理器，连接显示屏194和应用处理器。GPU用于执行数学和几何计算，用于图形渲染。系统级芯片110可包括一个或多个GPU，其执行指令以生成或改变显示信息。
显示屏194用于显示图像，视频等。显示屏194包括显示面板。显示面板可以采用液晶显示屏(liquid crystal display，LCD)，有机发光二极管(organic light-emitting diode，OLED)，有源矩阵有机发光二极体或主动矩阵有机发光二极体(active-matrix organic light emitting diode的，AMOLED)，柔性发光二极管(flex light-emitting diode，FLED)，Miniled，MicroLed，Micro-oLed，量子点发光二极管(quantum dot light emitting diodes，QLED)等。在一些实施例中，终端设备100可以包括1个或N个显示屏194，N为大于1的正整数。
终端设备100可以通过ISP，一个或多个摄像头193，视频编解码器，GPU，一个或多个显示屏194以及应用处理器等实现拍摄功能。
NPU为神经网络(neural-network，NN)计算处理器，通过借鉴生物神经网络结构，例如借鉴人脑神经元之间传递模式，对输入信息快速处理，还可以不断的自学习。通过NPU可以实现终端设备100的智能认知等应用，例如：图像识别，人脸识别，语音识别，文本理解等。
外部存储器接口120可以用于连接外部存储卡，例如Micro SD卡，实现扩展终端设备100的存储能力。外部存储卡通过外部存储器接口120与系统级芯片110通信，实现数据存储功能。例如将音乐、照片、视频等数据文件保存在外部存储卡中。
内部存储器121可以用于存储一个或多个计算机程序，该一个或多个计算机程序包括指令。系统级芯片110可以通过运行存储在内部存储器121的上述指令，从而使得终端设备100执行本申请一些实施例中所提供的加解密方法，以及各种功能应用以及数据处理等。内部存储器121可以包括存储程序区和存储数据区。其中，存储程序 区可存储操作系统；该存储程序区还可以存储一个或多个应用程序(比如图库、联系人等)等。存储数据区可存储终端设备100使用过程中所创建的数据(比如照片，联系人等)等。此外，内部存储器121可以包括高速随机存取存储器，还可以包括非易失性存储器，例如至少一个磁盘存储器件，闪存器件，通用闪存存储器(universal flash storage，UFS)等。在一些实施例中，系统级芯片110可以通过运行存储在内部存储器121的指令，和/或存储在设置于系统级芯片110中的存储器的指令，来使得终端设备100执行本申请实施例中所提供的基于加解密方法，以及各种功能应用及数据处理。
终端设备100可以通过音频模块170，扬声器170A，受话器170B，麦克风170C，耳机接口170D，以及应用处理器等实现音频功能。例如音乐播放，录音等。其中，音频模块170用于将数字音频信息转换成模拟音频信号输出，也用于将模拟音频输入转换为数字音频信号。音频模块170还可以用于对音频信号编码和解码。在一些实施例中，音频模块170可以设置于系统级芯片110中，或将音频模块170的部分功能模块设置于系统级芯片110中。扬声器170A，也称“喇叭”，用于将音频电信号转换为声音信号。终端设备100可以通过扬声器170A收听音乐，或收听免提通话。受话器170B，也称“听筒”，用于将音频电信号转换成声音信号。当终端设备100接听电话或语音信息时，可以通过将受话器170B靠近人耳接听语音。麦克风170C，也称“话筒”，“传声器”，用于将声音信号转换为电信号。当拨打电话或发送语音信息时，用户可以通过人嘴靠近麦克风170C发声，将声音信号输入到麦克风170C。终端设备100可以设置至少一个麦克风170C。在另一些实施例中，终端设备100可以设置两个麦克风170C，除了采集声音信号，还可以实现降噪功能。在另一些实施例中，终端设备100还可以设置三个，四个或更多麦克风170C，实现采集声音信号，降噪，还可以识别声音来源，实现定向录音功能等。耳机接口170D用于连接有线耳机。耳机接口170D可以是USB接口130，也可以是3.5mm的开放移动终端设备平台(open mobile terminal platform，OMTP)标准接口，还可以是美国蜂窝电信工业协会(cellular telecommunications industry association of the USA，CTIA)标准接口。
传感器180可以包括压力传感器180A，陀螺仪传感器180B，气压传感器180C，磁传感器180D，加速度传感器180E，距离传感器180F，接近光传感器180G，指纹传感器180H，温度传感器180J，触摸传感器180K，环境光传感器180L，骨传导传感器180M等。
其中，压力传感器180A用于感受压力信号，可以将压力信号转换成电信号。在一些实施例中，压力传感器180A可以设置于显示屏194。压力传感器180A的种类很多，如电阻式压力传感器，电感式压力传感器，电容式压力传感器等。电容式压力传感器可以是包括至少两个具有导电材料的平行板。当有力作用于压力传感器180A，电极之间的电容改变。终端设备100根据电容的变化确定压力的强度。当有触摸操作作用于显示屏194，终端设备100根据压力传感器180A检测所述触摸操作强度。终端设备100也可以根据压力传感器180A的检测信号计算触摸的位置。在一些实施例中，作用于相同触摸位置，但不同触摸操作强度的触摸操作，可以对应不同的操作指令。例如：当有触摸操作强度小于第一压力阈值的触摸操作作用于短消息应用图标时，执行查看短消息的指令。当有触摸操作强度大于或等于第一压力阈值的触摸操作作用于 短消息应用图标时，执行新建短消息的指令。
陀螺仪传感器180B可以用于确定终端设备100的运动姿态。在一些实施例中，可以通过陀螺仪传感器180B确定终端设备100围绕三个轴(即，x，y和z轴)的角速度。陀螺仪传感器180B可以用于拍摄防抖。示例性的，当按下快门，陀螺仪传感器180B检测终端设备100抖动的角度，根据角度计算出镜头模组需要补偿的距离，让镜头通过反向运动抵消终端设备100的抖动，实现防抖。陀螺仪传感器180B还可以用于导航，体感游戏场景等。
加速度传感器180E可检测终端设备100在各个方向上(一般为三轴)加速度的大小。当终端设备100静止时可检测出重力的大小及方向。还可以用于识别终端设备姿态，应用于横竖屏切换，计步器等应用。
距离传感器180F，用于测量距离。终端设备100可以通过红外或激光测量距离。在一些实施例中，拍摄场景，终端设备100可以利用距离传感器180F测距以实现快速对焦。
接近光传感器180G可以包括例如发光二极管(LED)和光检测器，例如光电二极管。发光二极管可以是红外发光二极管。终端设备100通过发光二极管向外发射红外光。终端设备100使用光电二极管检测来自附近物体的红外反射光。当检测到充分的反射光时，可以确定终端设备100附近有物体。当检测到不充分的反射光时，终端设备100可以确定终端设备100附近没有物体。终端设备100可以利用接近光传感器180G检测用户手持终端设备100贴近耳朵通话，以便自动熄灭屏幕达到省电的目的。接近光传感器180G也可用于皮套模式，口袋模式自动解锁与锁屏。
环境光传感器180L用于感知环境光亮度。终端设备100可以根据感知的环境光亮度自适应调节显示屏194亮度。环境光传感器180L也可用于拍照时自动调节白平衡。环境光传感器180L还可以与接近光传感器180G配合，检测终端设备100是否在口袋里，以防误触。
指纹传感器180H(也称为指纹识别器)，用于采集指纹。终端设备100可以利用采集的指纹特性实现指纹解锁，访问应用锁，指纹拍照，指纹接听来电等。另外，关于指纹传感器的其他记载可以参见名称为“处理通知的方法及终端设备”的国际专利申请PCT/CN2017/082773，其全部内容通过引用结合在本申请中。
触摸传感器180K，也可称触控面板或触敏表面。触摸传感器180K可以设置于显示屏194，由触摸传感器180K与显示屏194组成触摸屏，也称触控屏。触摸传感器180K用于检测作用于其上或附近的触摸操作。触摸传感器可以将检测到的触摸操作传递给应用处理器，以确定触摸事件类型。可以通过显示屏194提供与触摸操作相关的视觉输出。在另一些实施例中，触摸传感器180K也可以设置于终端设备100的表面，与显示屏194所处的位置不同。
骨传导传感器180M可以获取振动信号。在一些实施例中，骨传导传感器180M可以获取人体声部振动骨块的振动信号。骨传导传感器180M也可以接触人体脉搏，接收血压跳动信号。在一些实施例中，骨传导传感器180M也可以设置于耳机中，结合成骨传导耳机。音频模块170可以基于所述骨传导传感器180M获取的声部振动骨块的振动信号，解析出语音信号，实现语音功能。应用处理器可以基于所述骨传导传 感器180M获取的血压跳动信号解析心率信息，实现心率检测功能。
按键190包括开机键，音量键等。按键190可以是机械按键，也可以是触摸式按键。终端设备100可以接收按键输入，产生与终端设备100的用户设置以及功能控制有关的键信号输入。
SIM卡接口195用于连接SIM卡。SIM卡可以通过插入SIM卡接口195，或从SIM卡接口195拔出，实现和终端设备100的接触和分离。终端设备100可以支持1个或N个SIM卡接口，N为大于1的正整数。SIM卡接口195可以支持Nano SIM卡，Micro SIM卡，SIM卡等。同一个SIM卡接口195可以同时插入多张卡。所述多张卡的类型可以相同，也可以不同。SIM卡接口195也可以兼容不同类型的SIM卡。SIM卡接口195也可以兼容外部存储卡。终端设备100通过SIM卡和网络交互，实现通话以及数据通信等功能。在一些实施例中，终端设备100采用eSIM，即：嵌入式SIM卡。eSIM卡可以嵌在终端设备100中，不能和终端设备100分离。
本申请实施例提供的用于执行加解密处理的装置可以通过终端设备实现，也可以通过终端设备中的部分实现，例如，终端设备中的系统级芯片(System on a Chip，SoC)中。系统级芯片中包括运行操作系统和应用程序的处理器以及知识产权(IP)核硬件或IP核引擎；其中，本申请实施例对处理器的类型不做限制，例如，处理器可以包括上层应用程序的应用中央处理器(Application Central Processing Unit，ACPU，即之前提到的AP)、微处理器(Microprocessor，UP)、微控制单元(Microcontroller Unit，MCU)、或DSP等；IP核是一段具有特定电路功能的硬件描述语言程序，可以移植到不同的半导体工艺中去生产集成电路芯片。IP核硬件则是以所述硬件描述语言程序设计出的硬件电路，被集成在所述SOC中。IP核电路中包括指令分析器和算子电路，处理器运行加解密软件执行加解密处理的第一部分，并通过指令控制IP核硬件对数据执行加解密处理的第二部分，其中，数据可以是用户上传的原始数据，也可以是原始数据在经过处理器执行加解密处理的第一部分之后生成的数据，还可以是原始数据在经过处理器执行第一部分中的部分加解密处理之后生成的数据，本申请实施例对此不做限制。进而实现了通过软件与硬件结合的方式，对数据进行加解密处理。该软件程序包括应用程序或驱动程序中至少一项。
图4是本申请一实施例提供的用于执行加解密处理的装置的结构示意图，该装置可以是终端设备的部分或全部，例如可以通过终端设备中ACPU和IP核硬件实现，下面以终端设备为执行主体为例，对本申请实施例提供的用于执行加解密处理的装置进行介绍。如图4所示，本申请实施例提供的用于执行加解密处理的装置，可以包括处理器、指令分析器和算子电路。
处理器与指令分析器连接，算子电路与指令分析器连接；处理器用于通过运行加解密软件执行加解密处理的第一部分以及用于生成加解密指令；指令分析器，用于解析加解密指令以得到解析的指令，并基于解析的指令调用算子电路；算子电路，用于根据调用对数据执行加解密处理的第二部分，第二部分包括素域算子处理。
如图4所示，本申请实施例提供的用于执行加解密处理的装置是系统级芯片，系统级芯片可以包括处理器和IP核硬件或IP核引擎，其中，处理器可以是ACPU，指令分析器和算子电路位于系统级芯片中的IP核硬件或IP核引擎中。处理器可以根据 加解密处理的处理流程生成加解密指令，其中，加解密指令可以是加密指令或解密指令。其中，加解密处理可认为是一种加解密算法处理，本申请实施例对加解密处理的具体算法不做限制，例如，加解密算法可以是非对称加解密算法或对称加解密算法。在一种可能的实施方式中，加解密处理包括以下任意一种：基于标识的加密(IBC)算法、公钥可搜索加密(PEKS)算法、同态加密(HE)算法、函数加密(FE)算法、安全多方计算(MCP)算法、或椭圆曲线加密(ECC)算法。本实施例的方案在于将一个完整加解密算法拆分为不同的部分，分别采用软件和IP核硬件执行所述不同的部分，实现性能最优。为便于理解，下面对上述加解密处理进行简单的介绍。
IBC算法是基于标识的密码技术，采用用户的标识作为用户的公钥。PEKS算法为公钥可搜索加密，PEKS是一种新型密码体制，允许用户在经过公钥加密的数据上进行关键字搜索，无需对数据进行解密就能快速有效的进行搜索操作。HE为基于数学难题的计算复杂性理论的密码学技术。FE算法，针对拥有解密密钥的用户，可以获得的加密数据的函数值，而不会获得其他有关明文的任何信息。MCP算法为安全多方计算技术。ECC算法是一种公钥加密体制，其数学基础是利用椭圆曲线上的计算困难性。
针对每一种加解密处理，均存在各自对应的加密流程和解密流程，处理器根据预设的加解密处理的算法流程，生成加密指令或解密指令。在一种可能的实施方式中，以IBC算法中的sm9协议为例，在sm9的密钥封装算法流程的以及在sm9加密算法流程中，都有双线性对的计算，在其他的sm9协议中也有双线性对的计算。因此，当前加解密处理为IBC算法时，加解密指令可以用于指示或调度进行双线性对的计算。以双线性对为pairing双线性对为例，在对pairing双线性对的计算过程中，需要多次调用1次域模乘、2次域模乘、4次域模乘、12次域模乘以及模逆算子。在另一种可能的实施方式中，以ECC算法为例，ECC算法的算法流程中需要对数据的数字签名算法(ED25519)进行计算，因此，当加解密处理为ECC算法时，加解密指令可以用于指示或调度进行ED25519的计算，在对ED25519的计算过程中，需要多次调用1次域模乘、2次域模乘以及模逆算子。基于此，在一种可能的实施方式中，本申请实施例提供的用于执行加解密处理的装置中的算子电路，可用于执行1次域模乘、2次域模乘、4次域模乘、12次域模乘、或模逆算子中的至少一项运算。通过将sm9中的双线性对的计算过程或将ECC算法中的ED25519的计算过程进行硬化处理，可以通过一次调用IP核硬件，得到对sm9中的双线性对的计算结果或得到ECC算法中的ED25519的计算结果，避免了对IP核硬件的频繁反复调用，实现简单，且IP核硬件有独立执行控制单元和存储器，指令可编程，灵活支持多种加解密处理。
本申请实施例将完整的加解密处理拆分为两个处理部分，其中，通过处理器执行加解密处理的第一部分，通过算子电路根据指令分析器的调用执行加解密处理的第二部分，第二部分包括素域算子处理部分，本申请实施例对素域算子处理的具体处理方式以及处理结果不做限制，在一种可能的实施方式中，素域算子处理的结果为对数据的双线性对的计算结果，或，对数据的数字签名算法的计算结果。双线性对可以包括pairing双线性对、rate双线性对等，本申请实施例对双线性对的具体计算方式不做限制。本申请实施例中，素域算子处理的结果为对数据的双线性对的计算结果时，算子电路用于执行双线性对的计算，在现有技术中的多种加解密处理，均需要进行双线性 对的计算，通过算子电路对数据的双线性对的计算得到素域算子处理的结果，可以利用素域算子处理的结果进行进一步算法流程，对数据执行多种加解密处理，例如，PEKS算法、IBC算法等。若素域算子处理的结果为数据的数字签名算法的计算结果，则可以根据素域算子处理的结果和ECC算法的后续算法流程，进一步进行ECC加解密。
本申请实施例对加解密处理的第一部分和第二部分的处理顺序不做限制，在一种可能的实施方式中，首先通过处理器执行加解密处理的第一部分，得到第一结果，然后通过算子电路根据指令分析器的调用对第一结果执行加解密处理的第二部分，得到加解密数据，即先执行软件处理然后执行硬件处理。在另一种可能的实施方式中，首先通过算子电路根据指令分析器的调用对数据执行加解密处理的第二部分，得到第二结果，然后通过处理器对第二结果执行加解密处理的第一部分，得到加解密数据，即先执行硬件处理然后执行软件处理。在又一种可能的实施方式中，加解密处理的第一部分和加解密处理的第二部分可以分别包括至少一种处理方式，本申请实施例对此不做限制。
在一种可能的实施方式中，第一部分包括第一加解密处理和第二加解密处理；处理器具体用于执行第一加解密处理以得到数据；算子电路用于根据调用对数据执行加解密处理的第二部分以生成中间结果，中间结果包括素域算子处理的结果；处理器具体用于对中间结果执行第二加解密处理以得到处理结果，即本方案在两部分软件处理之间进行硬件处理。第一加解密处理和第二加解密处理可以是加解密处理中第一部分的不同处理阶段的处理方式，通过处理器执行第一加解密处理得到数据，然后通过算子电路根据调用对数据执行加解密处理的第二部分以生成中间结果，然后再通过处理器对中间结果执行第二加解密处理得到加解密数据。
为了保证加解密处理的顺利执行，处理器还可以用于控制IP核硬件的工作，在一种可能的实施方式中，处理器，还用于：向指令分析器发送开始执行指令，开始执行指令用于指示指令分析器获取加解密指令；指令分析器，还用于：接收开始执行指令，并根据开始执行指令从存储器中获取加解密指令。
本申请实施例中，处理器通过向指令分析器发送开始执行指令，控制指令分析器获取加解密指令，进而根据加解密指令调用算子电路执行加解密处理的第二部分。
在根据加解密指令调用算子电路执行加解密处理的第二部分，并生成素域算子处理的结果之后，在一种可能的实施方式中，指令分析器还用于：向处理器发送中断消息，中断消息用于指示处理器获取素域算子处理的结果；处理器还用于：接收中断消息，并根据中断消息从存储器中获取素域算子处理的结果。
本申请实施例中，通过指令分析器向处理器发送终端消息，指示处理器获取素域算子处理的结果，以使处理器根据素域算子处理的结果进行后续流程，进而实现了加解密处理。
本申请实施例相比于现有技术中的纯软件处理或独立器件处理的方式，通过将加解密处理中的部分功能进行硬化处理，实现软件和硬件结合的方式处理，即，通过处理器控制指令分析器调用算子电路，算子电路仅对数据进行加解密处理的第二部分的计算，通过软件对执行加解密处理的第一部分的计算，不仅在保证安全性的基础上实现了加解密处理，而且灵活性较高，且不需要针对每个加解密处理均设置PCB板，成 本较低。
在一种可能的实施方式中，在上述实施例的基础上，本申请实施例还可以包括存储器，图5是本申请另一实施例提供的用于执行加解密处理的装置的结构示意图，该装置可以是终端设备的部分或全部，例如可以通过终端设备中ACPU和IP核硬件实现，下面以终端设备为执行主体为例，对本申请实施例提供的用于执行加解密处理的装置进行介绍。如图5所示，本申请实施例提供的用于执行加解密处理的装置，还可以包括：存储器，存储器用于存储加解密指令、数据和素域算子处理的结果。
存储器与处理器之间存在数据传输，例如，处理器在根据预设的加解密处理生成加解密指令之后，可以将加解密指令发送至存储器，处理器在获取到需要加解密的原始数据或者原始数据经过处理器执行加解密处理的第一部分之后得到数据之后，还可以将原始数据或经过处理器执行加解密处理的第一部分之后得到数据发送至存储器。存储器与指令分析器之间存在数据通信，指令分析器可以从存储器中读取数据和加解密指令，也可以根据加解密指令调用算子电路对数据进行素域算子处理，并将素域算子处理的结果发送至存储器中，此时，处理器可以从存储器中读取素域算子处理的结果。
为了进一步保证加解密处理的安全性，在一种可能的实施方式中，处理器还可以生成密钥(key)参数，然后将加解密处理的key发送至存储器中，存储器还用于存储密钥参数，则算子电路具体用于：根据调用，利用密钥参数对数据执行加解密处理的第二部分。本申请实施例中，通过将密钥参数保存在硬件中，可以提高安全性。
由于存储器和指令分析器位于IP核硬件中，为了便于ACPU和IP核硬件中的指令分析器、算子电路和存储器进行数据传输，在一种可能的实施方式中，如图5所示，本申请实施例提供的用于执行加解密处理的装置，还包括：接口；处理器通过接口分别与存储器和指令分析器连接。本申请实施例通过接口，实现了处理器与指令分析器之间的数据传输。在此实现方案中，处理器的指令不是通过存储器传递给指令分析器，而是通过接口实现。该接口同样可用于作为与存储器之间的传输媒介，本实施例不做具体限制。
本申请实施例对存储器的类型和数量不做限制，在一种可能的实施方式中，图6是本申请又一实施例提供的用于执行加解密处理的装置的结构示意图，如图6所示，本申请实施例提供的用于执行加解密处理的装置，存储器包括IRAM和DRAM，其中，IRAM用于存储加解密指令，DRAM用于存储数据和素域算子处理的结果。
处理器生成加解密指令之后，通过接口将加解密指令发送至IRAM中存储，并将数据发送至DRAM中存储，指令分析器从IRAM中读取加解密指令，并从DRAM中读取数据，指令分析器以根据加解密指令对数据进行处理，得到素域算子处理的结果，并将素域算子处理的结果发送至DRAM中存储。
存储器还可以存储密钥参数，在一种可能的实施方式中，密钥参数为固定参数，则可以将密钥参数存储在DRAM中，若密钥参数为随机参数，则可以将密钥参数存储在IRAM中，本申请实施例对此不做限制。本申请实施例中，通过设置存储器，实现了对加解密指令、数据和素域算子处理的结果的存储。
下面介绍本申请实施例提供的用于执行加解密处理的方法，该方法可以通过本申 请实施例提供的用于执行加解密处理的装置执行，其内容及有益效果可以参考上述实施例。
图7是本申请实施例提供的用于执行加解密处理的方法的流程示意图，如图7所示，本申请实施例提供的用于执行加解密处理的方法可以包括：步骤S101：通过处理器运行加解密软件执行加解密处理的第一部分以及用于生成加解密指令。在一种可能的实施方式中，加解密处理可以包括以下任意一种：IBC算法、PEKS算法、HE算法、FE算法、MCP算法、或ECC算法。
针对不同的加解密处理的处理流程，加解密处理的第一部分的具体处理过程可能不同，本申请实施例对此不做限制，在一种可能的实施方式中，加解密处理的第一部分包括第一加解密处理和第二加解密处理；通过处理器运行加解密软件执行加解密处理的第一部分，包括：通过处理器执行第一加解密处理以得到数据，对中间结果执行第二加解密处理以得到处理结果，中间结果包括素域算子处理的结果。本申请实施例仅以此为例，并不限于此。
本申请实施例对加解密指令的具体指令形式以及内容也不做限制，在一种可能的实施方式中，若加解密处理为IBC算法、PEKS算法、HE算法、FE算法或MCP算法中的任意一种，则加解密指令可以用于指示或调用对pairing双线性对的计算或rate双线性对的计算；若加解密处理为ECC算法，则加解密指令可以用于指示或调用对ED25519的计算，本申请实施例仅以此为例，并不限于此。
步骤S102：通过指令分析器解析加解密指令以得到解析的指令，并基于解析的指令调用算子电路。其中，解析的指令可以用于指示对数据进行双线性对的计算或对数据进行数字签名算法，指令分析器在解析加解密指令之后，基于解析的指令调用算子电路。
步骤S103：通过算子电路根据调用对数据执行加解密处理的第二部分。第二部分包括素域算子处理，得到素域算子处理的结果。在一种可能的实施方式中，素域算子处理包括：1次域模乘、2次域模乘、4次域模乘、12次域模乘、或模逆算子处理中的至少一项运算。素域算子处理的结果可以为对数据的双线性对的计算结果，或，对数据的数字签名算法的计算结果。
本申请实施例中，通过一次调用IP核硬件，就可以得到素域算子处理的结果，实现简单，并且，IP核硬件有独立执行控制单元和存储器，指令可编程，灵活支持多种加解密处理。在一种可能的实施方式中，ACPU和IP核集成在SoC中，不占用PCB面积，成本低，且能效高。
在上述实施例的基础上，在一种可能的实施方式中，图8是本申请另一实施例提供的用于执行加解密处理的方法的流程示意图，如图8所示，本申请实施例提供的用于执行加解密处理的方法在步骤S102之前还可以包括：步骤S201：通过处理器向指令分析器发送开始执行指令。在处理器生成加解密指令之前，开始执行指令用于指示指令分析器获取加解密指令。
步骤S202：通过指令分析器接收开始执行指令，并根据开始执行指令从存储器中获取加解密指令。在通过处理器向指令分析器发送开始执行指令之后，通过指令分析器接收开始执行指令，并从存储器中获取加解密指令，以解析加解密指令以得到解析 的指令，并基于解析的指令调用算子电路。
本申请实施例中，通过处理器向指令分析器发送开始执行指令，以控制指令分析器调用算子电路执行加解密处理的第二部分。
在一种可能的实施方式中，图9是本申请又一实施例提供的用于执行加解密处理的方法的流程示意图，如图9所示，本申请实施例提供的用于执行加解密处理的方法在步骤S201之前还可以包括：步骤S301：通过处理器生成密钥参数。
处理器生成加解密处理的密钥后，将加解密处理的密钥参数发送至存储器中，通过存储器存储密钥参数，存储器可以包括DRAM和IRAM，若密钥参数为固定参数，则可以将密钥参数存储在DRAM中，若密钥参数为随机参数，则可以将密钥参数存储在IRAM中，本申请实施例对此不做限制。本申请实施例中，存储器还可以用于存储加解密指令、数据和素域算子处理的结果。
本申请实施例中，通过处理器生成秘钥参数，并将密钥参数发送至存储器，不仅实现了对秘钥参数的生成和存储，而且，相比于现有技术中通过纯软件的方式实现对用于数据的加解密，将秘钥参数存储在IP核的存储器中，可以防止硬件攻击，保证了密钥参数的安全性。
则本申请实施例中的步骤S103通过算子电路根据调用对数据执行加解密处理的第二部分相应的更改为步骤S302。步骤S302：通过算子电路根据调用，利用密钥参数对数据执行加解密处理的第二部分。本申请实施例对通过算子电路根据调用，利用密钥参数对数据执行加解密处理的第二部分的具体实现方式不做限制。在一种可能的实施方式中，如图9所示，在步骤S302之后，还可以包括步骤S303和步骤S304。
步骤S303：通过指令分析器向处理器发送中断消息。中断消息用于指示处理器获取素域算子处理的结果，在通过指令分析器调用算子电路执行加解密处理的第二部分，得到素域算子处理的结果之后，指令分析器向处理器发送中断消息，以使处理器获取素域算子处理的结果。
步骤S304：通过处理器接收中断消息，并获取素域算子处理的结果。处理器在获取素域算子处理的结果之后，清除中断。在一种可能的实施方式中，处理器在获取素域算子处理的结果之后，根据加解密处理的算法流程，对素域算子处理的结果进行计算，得到数据的加密数据或解密数据。针对不同的加解密处理的算法流程，对素域算子处理的结果的处理方式可能不同，本申请实施例对此不做限制。
本申请实施例还提供一种系统级芯片，用于执行上述用于执行加解密处理的方法，其内容和效果可参考上述实施例，不再赘述。
本申请实施例还提供一种终端设备，终端设备可以包括本申请实施例提供的用于执行加解密处理的装置，其内容和效果可参考上述实施例，不再赘述。
此外，本申请实施例还提供一种计算机可读存储介质，计算机可读存储介质中存储有计算机执行指令，当用户设备的至少一个处理器执行该计算机执行指令时，用户设备执行上述各种可能的方法。
以上所述，仅为本申请的具体实施方式，但本申请的保护范围并不局限于此，任何熟悉本技术领域的技术人员在本申请揭露的技术范围内，可轻易想到变化或替换，都应涵盖在本申请的保护范围之内。因此，本申请的保护范围应以所述权利要求的保 护范围为准。

Claims (21)

  1. 一种用于执行加解密处理的装置，其特征在于，包括：处理器、指令分析器和算子电路，所述处理器与所述指令分析器连接，所述算子电路与所述指令分析器连接；
    所述处理器，用于通过运行加解密软件执行加解密处理的第一部分以及用于生成加解密指令；
    所述指令分析器，用于解析所述加解密指令以得到解析的指令，并基于所述解析的指令调用所述算子电路；
    所述算子电路，用于根据所述调用对数据执行所述加解密处理的第二部分，所述第二部分包括素域算子处理。
  2. 根据权利要求1所述的装置，其特征在于，所述第一部分包括第一加解密处理和第二加解密处理；
    所述处理器具体用于执行所述第一加解密处理以得到所述数据；
    所述算子电路用于根据所述调用对所述数据执行所述加解密处理的第二部分以生成中间结果，所述中间结果包括所述素域算子处理的结果；
    所述处理器具体用于对所述中间结果执行所述第二加解密处理以得到处理结果。
  3. 根据权利要求1或2所述的装置，其特征在于，还包括：存储器，用于存储所述加解密指令、所述数据和所述素域算子处理的结果。
  4. 根据权利要求3所述的装置，其特征在于，
    所述存储器包括指令随机访问存储器IRAM和数据随机访问存储器DRAM，其中，IRAM用于存储所述加解密指令，所述DRAM用于存储所述数据和所述素域算子处理的结果。
  5. 根据权利要求3或4所述的装置，其特征在于，
    所述装置是系统级芯片，所述存储器、所述指令分析器和所述算子电路位于所述系统级芯片中的IP核引擎中。
  6. 根据权利要求3至5中任一项所述的装置，其特征在于，所述处理器，还用于：
    向所述指令分析器发送开始执行指令，所述开始执行指令用于指示所述指令分析器获取所述加解密指令；
    所述指令分析器，还用于：接收所述开始执行指令，并根据所述开始执行指令从所述存储器中获取所述加解密指令。
  7. 根据权利要求3至6任一项所述的装置，其特征在于，所述处理器还用于：生成密钥参数；
    所述存储器还用于存储所述密钥参数；
    所述算子电路具体用于根据所述调用，利用所述密钥参数对所述数据执行所述加解密处理的第二部分。
  8. 根据权利要求6所述的装置，其特征在于，所述指令分析器还用于：
    向所述处理器发送中断消息，所述中断消息用于指示所述处理器获取所述素域算子处理的结果；
    所述处理器还用于：接收所述中断消息，并根据所述中断消息从所述存储器中获取所述素域算子处理的结果。
  9. 根据权利要求1至8中任一项所述的装置，其特征在于，
    所述素域算子处理包括：1次域模乘、2次域模乘、4次域模乘、12次域模乘、或模逆算子处理中的至少一项运算。
  10. 根据权利要求1至8中任一项所述的装置，其特征在于，
    所述素域算子处理的结果为对所述数据的双线性对的计算结果，或，对所述数据的数字签名算法的计算结果。
  11. 根据权利要求1至10中任一项所述的装置，其特征在于，所述加解密处理包括以下任意一种：
    基于标识的加密IBC算法、公钥可搜索加密PEKS算法、同态加密HE算法、函数加密FE算法、安全多方计算MCP算法或椭圆曲线加密ECC算法。
  12. 一种用于执行加解密处理的方法，其特征在于，包括：
    通过处理器运行加解密软件执行加解密处理的第一部分以及用于生成加解密指令；
    通过指令分析器解析所述加解密指令以得到解析的指令，并基于所述解析的指令调用算子电路；
    通过所述算子电路根据所述调用对数据执行所述加解密处理的第二部分，所述第二部分包括素域算子处理。
  13. 根据权利要求12所述的方法，其特征在于，所述第一部分包括第一加解密处理和第二加解密处理；所述通过处理器运行加解密软件执行加解密处理的第一部分，包括：
    通过所述处理器执行所述第一加解密处理以得到所述数据，对中间结果执行所述第二加解密处理以得到处理结果，所述中间结果包括所述素域算子处理的结果。
  14. 根据权利要求12或13所述的方法，其特征在于，在通过指令分析器解析所述加解密指令以得到解析的指令，并基于所述解析的指令调用算子电路之前，还包括：
    通过所述处理器向所述指令分析器发送开始执行指令，所述开始执行指令用于指示所述指令分析器获取所述加解密指令；
    通过所述指令分析器接收所述开始执行指令，并根据所述开始执行指令从存储器中获取所述加解密指令。
  15. 根据权利要求14所述的方法，其特征在于，在通过所述算子电路根据所述调用对数据执行所述加解密处理的第二部分之后，还包括：
    通过所述指令分析器向所述处理器发送中断消息，所述中断消息用于指示所述处理器获取所述素域算子处理的结果；
    通过所述处理器接收所述中断消息，并获取所述素域算子处理的结果。
  16. 根据权利要求14所述的方法，其特征在于，在通过所述处理器向所述指令分析器发送开始执行指令之前，还包括：
    通过所述处理器生成密钥参数，并通过存储器存储所述密钥参数；
    所述通过所述算子电路根据所述调用对数据执行所述加解密处理的第二部分，包括：
    通过所述算子电路根据所述调用，利用所述密钥参数对所述数据执行所述加解密处理的第二部分。
  17. 根据权利要求16所述的方法，其特征在于，通过所述存储器存储所述加解密指令、所述数据、所述素域算子处理的结果。
  18. 根据权利要求17所述的方法，其特征在于，
    所述存储器包括指令随机访问存储器IRAM和数据随机访问存储器DRAM，其中，IRAM用于存储所述加解密指令，所述DRAM用于存储所述数据和所述素域算子处理的结果。
  19. 根据权利要求12至18中任一项所述的方法，其特征在于，
    所述素域算子处理包括：1次域模乘、2次域模乘、4次域模乘、12次域模乘、或模逆算子处理中的至少一项运算。
  20. 根据权利要求12至19中任一项所述的方法，其特征在于，
    所述素域算子处理的结果为对所述数据的双线性对的计算结果，或，对所述数据的数字签名算法的计算结果。
  21. 根据权利要求12至20中任一项所述的方法，其特征在于，所述加解密处理包括以下任意一种：
    基于标识的加密IBC算法、公钥可搜索加密PEKS算法、同态加密HE算法、函数加密FE算法、安全多方计算MCP算法或椭圆曲线加密ECC算法。
PCT/CN2020/085123 2020-04-16 2020-04-16 用于执行加解密处理的装置及方法 WO2021208014A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
CN202080004828.8A CN113892103B (zh) 2020-04-16 2020-04-16 用于执行加解密处理的装置及方法
PCT/CN2020/085123 WO2021208014A1 (zh) 2020-04-16 2020-04-16 用于执行加解密处理的装置及方法

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2020/085123 WO2021208014A1 (zh) 2020-04-16 2020-04-16 用于执行加解密处理的装置及方法

Publications (1)

Publication Number Publication Date
WO2021208014A1 true WO2021208014A1 (zh) 2021-10-21

Family

ID=78084243

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2020/085123 WO2021208014A1 (zh) 2020-04-16 2020-04-16 用于执行加解密处理的装置及方法

Country Status (2)

Country Link
CN (1) CN113892103B (zh)
WO (1) WO2021208014A1 (zh)

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114172651A (zh) * 2021-11-15 2022-03-11 武汉大学 一种sm9公钥加密算法、解密算法的gpu加速实现方法
CN114661656A (zh) * 2022-05-25 2022-06-24 广州万协通信息技术有限公司 一种可重构阵列配置方法、装置、设备以及存储介质
WO2023115692A1 (zh) * 2021-12-22 2023-06-29 杭州万高科技股份有限公司 一种适用于dlms/cosem通信协议的加解密模块和抄表系统

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102737270A (zh) * 2011-04-15 2012-10-17 航天信息股份有限公司 一种基于国产算法的银行智能卡芯片安全协处理器
CN106712964A (zh) * 2016-12-27 2017-05-24 广州智慧城市发展研究院 一种基于Java卡的应用验证方法及验证系统
CN106941407A (zh) * 2017-05-10 2017-07-11 成都课迪科技有限公司 一种平台数据动态加密的方法和装置
CN107294720A (zh) * 2017-07-07 2017-10-24 广东工业大学 一种素域Fp下的SM2椭圆曲线公钥加密算法的硬件实现系统

Family Cites Families (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103294961A (zh) * 2013-06-07 2013-09-11 北京奇虎科技有限公司 一种文件加/解密方法以及文件加/解密装置
CN104899527A (zh) * 2015-05-12 2015-09-09 广州中大微电子有限公司 一种片上安全协处理器
CN105871552A (zh) * 2016-06-14 2016-08-17 天津大学 双核并行rsa密码处理方法及协处理器

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102737270A (zh) * 2011-04-15 2012-10-17 航天信息股份有限公司 一种基于国产算法的银行智能卡芯片安全协处理器
CN106712964A (zh) * 2016-12-27 2017-05-24 广州智慧城市发展研究院 一种基于Java卡的应用验证方法及验证系统
CN106941407A (zh) * 2017-05-10 2017-07-11 成都课迪科技有限公司 一种平台数据动态加密的方法和装置
CN107294720A (zh) * 2017-07-07 2017-10-24 广东工业大学 一种素域Fp下的SM2椭圆曲线公钥加密算法的硬件实现系统

Cited By (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114172651A (zh) * 2021-11-15 2022-03-11 武汉大学 一种sm9公钥加密算法、解密算法的gpu加速实现方法
CN114172651B (zh) * 2021-11-15 2023-07-18 武汉大学 一种sm9公钥加密算法、解密算法的gpu加速实现方法
WO2023115692A1 (zh) * 2021-12-22 2023-06-29 杭州万高科技股份有限公司 一种适用于dlms/cosem通信协议的加解密模块和抄表系统
CN114661656A (zh) * 2022-05-25 2022-06-24 广州万协通信息技术有限公司 一种可重构阵列配置方法、装置、设备以及存储介质

Also Published As

Publication number Publication date
CN113892103B (zh) 2024-06-14
CN113892103A (zh) 2022-01-04

Similar Documents

Publication Publication Date Title
WO2021052178A1 (zh) 一种Wi-Fi连接方法及设备
CN111373713B (zh) 一种消息传输方法及设备
WO2021208014A1 (zh) 用于执行加解密处理的装置及方法
WO2021073448A1 (zh) 画面渲染方法、装置、电子设备及存储介质
EP3993460A1 (en) Method, electronic device and system for realizing functions through nfc tag
WO2022143156A1 (zh) 一种加密通话方法、装置、终端及存储介质
EP4047967A1 (en) Mobile device management method and device
CN113408016B (zh) 保存密文的方法和装置
WO2021175266A1 (zh) 身份验证方法、装置和电子设备
WO2021147660A1 (zh) 一种数据传输方法及设备
WO2020237617A1 (zh) 控屏方法、装置、设备及存储介质
CN113676879A (zh) 一种分享信息的方法、电子设备和系统
WO2021184264A1 (zh) 数据保存方法、数据访问方法及相关装置、设备
WO2023216930A1 (zh) 基于穿戴设备的振动反馈方法、系统、穿戴设备和电子设备
US20240178771A1 (en) Method and apparatus for adjusting vibration waveform of linear motor
CN113676440B (zh) 通信过程中的权限协商方法、装置和电子设备
WO2021110117A1 (zh) 事件订阅方法及电子设备
WO2022037405A1 (zh) 信息验证的方法、电子设备及计算机可读存储介质
WO2021110115A1 (zh) 事件订阅方法及电子设备
CN115525366A (zh) 一种投屏方法及相关装置
WO2023246695A1 (zh) 设备授权方法及电子设备、系统
WO2022042273A1 (zh) 密钥使用方法及相关产品
CN115599596B (zh) 数据处理方法、电子设备、系统及存储介质
WO2021227820A1 (zh) 通信过程中的权限协商方法、装置和电子设备
WO2024037040A1 (zh) 数据处理方法及电子设备

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 20931682

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 20931682

Country of ref document: EP

Kind code of ref document: A1