WO2023274011A1

WO2023274011A1 - Method and apparatus for protecting data in otp memory, and device and storage medium

Info

Publication number: WO2023274011A1
Application number: PCT/CN2022/100710
Authority: WO
Inventors: 唐伟
Original assignee: 湖南国科微电子股份有限公司
Priority date: 2021-06-30
Filing date: 2022-06-23
Publication date: 2023-01-05
Also published as: CN113408017B; CN113408017A

Abstract

A method and apparatus for protecting data in an OTP memory, and a device and a storage medium. The method comprises: after a programming request sent by an OTP memory is received, acquiring a target key; acquiring security data to be encrypted, and reading a parameter configuration area of the OTP memory, so as to determine a target encryption algorithm; and encrypting said security data by using the target encryption algorithm and the target key, so as to obtain encrypted security data, and storing the encrypted security data in a security data area of the OTP memory. It can be seen that an OTP controller encrypts security sensitive data and then programs same to a security data area, and performs hardware selection on encryption and decryption algorithms, such that the processing of different encryption and decryption keys and the selection of the encryption and decryption algorithms are realized. Therefore, the security and confidentiality of security data encryption is improved; and the security and confidentiality after OTP data programming can be enhanced, thereby preventing data from being tampered with or preventing important sensitive data from being illegitimately stolen.

Description

A method, device, equipment and storage medium for protecting data in an OTP memory

This application claims the priority of the Chinese patent application submitted to the China Patent Office on June 30, 2021, the application number is 202110744345.8, and the invention title is "a method, device, equipment and storage medium for data protection in OTP memory", all of which The contents are incorporated by reference in this application.

technical field

The present application relates to the field of OTP memory, in particular to a data protection method, device, equipment and storage medium in the OTP memory.

Background technique

At present, the security performance requirements of products are getting higher and higher. In order to meet the protection requirements of security-sensitive data in hardware systems, such as sensitive data with high security requirements such as security root keys and identity information in chips, OTP (One Time Programmable , one-time programmable) memory can meet the requirements of high confidentiality and high reliability to a certain extent due to its non-volatile and high reliability of stored data. However, how to further improve the security and reliability of OTP memory is currently the issues of widespread concern. In the prior art, through research on the OTP memory, the data stability of the OTP memory is improved at the level of physical manufacturing, but the lack of data protection reduces the security of data storage.

Contents of the invention

In view of this, the object of the present invention is to provide a data protection method, device, equipment and medium in an OTP memory, which can enhance the security and confidentiality of the OTP data after programming. The specific plan is as follows:

In the first aspect, the application discloses a data protection method in an OTP memory, including:

Obtain the target key after receiving the programming request sent by the OTP memory;

Obtain the security data to be encrypted, and read the parameter configuration area of the OTP memory to determine the target encryption algorithm;

Utilize the target encryption algorithm and the target key to encrypt the security data to be encrypted to obtain encrypted security data, and store the encrypted security data to the security data area of the OTP memory.

Optionally, the acquiring the target key includes:

Read the fixed key preset in the key configuration field in the parameter configuration area of the OTP memory, and use the fixed key as the target key.

Optionally, the target encryption algorithm includes Advanced Data Encryption Standard, Triple Data Encryption Standard and SM4 encryption algorithm.

Optionally, the acquiring the target key includes:

Send a random number request to the random number generator, and obtain the random value fed back by the random number generator;

The random value is used as the target key and stored in the random data area of the OTP memory.

Optionally, after storing the encrypted secure data in the secure data area of the OTP memory, it further includes:

Using the latch state configuration area of the OTP memory, the random data area, the security data area and the parameter configuration area are respectively configured for read and/or write operations.

Optionally, the method for protecting data in the OTP memory also includes:

When receiving the starting signal sent by the random number generator after the system reset, read the random number flag bit of the random data area in the OTP memory, to determine whether there is a random value in the random data area;

If it exists, read the data information in the random data area, the security data area, the parameter configuration area and the latch state configuration area, and store the data information locally;

judging whether the data in the secure data area is encrypted according to the algorithm configuration field in the parameter configuration area;

If not encrypted, the locally stored data information is sent to the system external module through the local interface output module, so that the system external module uses the data information to generate a key.

Optionally, after the judging whether the data in the secure data area is encrypted, it also includes:

If it is encrypted, according to the target key corresponding to the key configuration field in the parameter configuration area, and according to the target encryption algorithm corresponding to the algorithm configuration field, the encrypted data in the secure data area is decrypted to obtain the decrypted post-safety data;

The local interface output module sends the locally stored data information in the random data area, the parameter configuration area and the latch state configuration area, and the decrypted security data to the system external module.

In a second aspect, the application discloses a data protection device in an OTP memory, including:

The target key acquisition module is used to obtain the target key after receiving the programming request sent by the OTP memory;

Data and encryption algorithm acquisition module, used to obtain the security data to be encrypted, and read the parameter configuration area of the OTP memory to determine the target encryption algorithm;

An encryption storage module, configured to encrypt the security data to be encrypted by using the target encryption algorithm and the target key to obtain encrypted security data, and store the encrypted security data in the OTP memory data area.

In a third aspect, the present application discloses an electronic device, comprising:

memory for storing computer programs;

A processor is configured to execute the computer program to implement the aforementioned method for protecting data in the OTP memory.

In a fourth aspect, the present application discloses a computer-readable storage medium for storing a computer program; wherein when the computer program is executed by a processor, the aforementioned OTP memory data protection method is implemented.

In the present application, after receiving the programming request sent by the OTP memory, obtain the target key; obtain the security data to be encrypted, and read the parameter configuration area of the OTP memory to determine the target encryption algorithm; use the target encryption The algorithm and the target key encrypt the security data to be encrypted to obtain encrypted security data, and store the encrypted security data in the security data area of the OTP memory. It can be seen that the security-sensitive data is encrypted by the OTP controller and then programmed into the secure data area, and the encryption and decryption algorithm is selected by hardware to realize the processing of different encryption and decryption keys and the selection of encryption and decryption algorithms, which improves the security of data encryption. The security and confidentiality can enhance the security and confidentiality of OTP data after programming, and prevent data from being tampered with or important sensitive data from being illegally stolen.

Description of drawings

In order to more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the following will briefly introduce the drawings that need to be used in the description of the embodiments or the prior art. Obviously, the accompanying drawings in the following description are only It is an embodiment of the present invention, and those skilled in the art can also obtain other drawings according to the provided drawings without creative work.

Fig. 1 is a flow chart of a data protection method in an OTP memory provided by the application;

Fig. 2 is a kind of specific target algorithm configuration method provided by the present application;

Fig. 3 is the flow chart of a kind of specific data protection method in OTP memory that the application provides;

Figure 4 is a specific target key configuration method provided by the present application;

Fig. 5 provides the hardware architecture of a kind of concrete OTP storage system provided by the application and the hardware structural representation in the OTP controller;

Fig. 6 is a kind of OTP initialization flowchart that the present application provides;

Fig. 7 is a kind of specific OTP initialization flowchart that the present application provides;

FIG. 8 is a flow chart of a specific random value acquisition method provided by the present application;

FIG. 9 is a schematic structural diagram of a data protection device in an OTP memory provided by the present application;

FIG. 10 is a structural diagram of an electronic device provided by the present application.

detailed description

In the prior art, through research on the OTP memory, the data stability of the OTP memory is improved at the level of physical manufacturing, but the lack of data protection reduces the security of data storage. In order to overcome the above-mentioned technical problems, the present application proposes a data protection method in an OTP memory, which can enhance the security and confidentiality of the OTP data after programming.

The embodiment of the present application discloses a method for protecting data in an OTP memory, which is applied to an OTP controller, as shown in Figure 1, the method may include the following steps:

Step S11: Obtain the target key after receiving the programming request sent by the OTP memory.

In this embodiment, after receiving the programming request sent by the OTP memory, the target key is obtained. It can be understood that the OTP memory initiates a programming request to the OTP controller through an external serial port, and the OTP controller actively obtains the target key after receiving the programming request. key. In this embodiment, the acquiring the target key may include: reading the fixed key preset in the key configuration field in the parameter configuration area of the OTP memory, and using the fixed key as the target key key, that is, a fixed key can be stored in the key configuration field of the parameter configuration area of the OTP storage area in advance, and the OTP controller reads the key configuration in the parameter configuration area of the OTP memory after receiving the programming request sent by the OTP memory. The preset fixed key in the field, and use the above fixed key as the target key to encrypt secure data.

Step S12: Obtain the security data to be encrypted, and read the parameter configuration area of the OTP memory to determine the target encryption algorithm.

In this embodiment, secure data to be encrypted is acquired, wherein the above-mentioned secure data to be encrypted includes but not limited to data with high security requirements such as security root key and identity information, and reads the parameter configuration area of the above-mentioned OTP memory to determine Find out the target encryption algorithm, specifically, you can determine the corresponding target encryption algorithm according to the fields in the parameter configuration area. In this embodiment, the target encryption algorithm includes but not limited to Advanced Encryption Standard (Advanced Encryption Standard, AES), Triple Data Encryption Standard (Triple Data Encryption Standard, TDES) and SM4 encryption algorithm, it can be understood that the parameter configuration The area pre-stores the character string with mapping relationship and the corresponding algorithm type. A specific algorithm configuration method is shown in Figure 2. Set the PROGRAM_MODE field as the target algorithm configuration field. When the PROGRAM_MODE value is 2'b00, encryption is not treated Secure data is encrypted; when PROGRAM_MODE is 2'b01, use AES algorithm for encryption; when PROGRAM_MODE is 2'b10, use SM4 algorithm for encryption; when PROGRAM_MODE is 2'b11, use TDES algorithm for encryption.

Step S13: Encrypt the security data to be encrypted by using the target encryption algorithm and the target key to obtain encrypted security data, and store the encrypted security data in the security data area of the OTP memory.

In this embodiment, the above-mentioned secure data to be encrypted is encrypted according to the determined target encryption algorithm and target key to obtain encrypted secure data, and the encrypted secure data is stored in the secure data area of the OTP memory.

As can be seen from the above, in this embodiment, after receiving the programming request sent by the OTP memory, the target key is obtained; the security data to be encrypted is obtained, and the parameter configuration area of the OTP memory is read to determine the target encryption algorithm; Encrypting the security data to be encrypted by using the target encryption algorithm and the target key to obtain encrypted security data, and storing the encrypted security data in the security data area of the OTP memory. It can be seen that the security-sensitive data is encrypted by the OTP controller and then programmed into the secure data area, and the encryption and decryption algorithm is selected by hardware to realize the processing of different encryption and decryption keys and the selection of encryption and decryption algorithms, which improves the security of data encryption. It can enhance the security and confidentiality of OTP data after programming, and prevent data from being tampered with or important sensitive data from being illegally stolen. With the help of the current OTP security and reliability, a safe and effective data security protection mechanism is used to realize Effective protection of security-sensitive data, improving data security and data confidentiality of security-sensitive data in products or systems.

The embodiment of the present application discloses a specific OTP memory data protection method, as shown in Figure 3, the method may include the following steps:

Step S21: After receiving the programming request sent by the OTP memory, send a random number request to the random number generator, and obtain the random value fed back by the random number generator.

In this embodiment, after receiving the programming request sent by the OTP memory, a random number request is sent to a random number generator (TRNG, True Random Number Generator), and the random value fed back by the random number generator is obtained.

Step S22: Use the random value as the target key, and store it in the random data area of the OTP memory.

In this embodiment, the above-mentioned random value is used as the target key, and stored in the random data area of the above-mentioned OTP memory. It can be understood that, in addition to using a fixed key as the target key, a random value can also be used as an encryption key for secure data. Specifically, as shown in Figure 4, you can set PROGRAM_KEY_SEL in the parameter configuration area of the OTP memory Configuration field, when the field is 0, you can select the fixed key OTP_KEY in the OTP interval as the above-mentioned target key, and when the field value is 1, choose to obtain a random number as the above-mentioned target key.

Step S23: Obtain the security data to be encrypted, and read the parameter configuration area of the OTP memory to determine the target encryption algorithm.

Step S24: Encrypt the security data to be encrypted by using the target encryption algorithm and the target key to obtain encrypted security data, and store the encrypted security data in the security data area of the OTP memory.

Step S25: Using the latch state configuration area of the OTP memory, perform latch configuration for read and/or write operations on the random data area, the security data area, and the parameter configuration area, respectively.

In this embodiment, at the end of the programming and configuration process, the latch state configuration area of the OTP memory is used for programming and configuration, and the random data area, the security data area and the parameter configuration area are respectively locked for reading and/or writing operations. Save configuration. Specifically, the programming operation of the parameter configuration area and the security data area can be latched to prevent the area from being programmed for the second time. The read operation of the random data area is latched, so that the area cannot be read by other external modules such as the host computer, so as to ensure the randomness and unpredictability of the value of this part of the area, and to improve the confidentiality and security of encryption and decryption.

For example, as shown in Figure 5, a hardware architecture of an OTP storage system and a hardware structure in an OTP controller are provided. HOST initiates a programming or read operation request to OTP as a host, and TRNG is a true random number generator. During production, at the initialization stage of the OTP system, the OTP controller sends a random number request to the TRNG module, applies for a set of 128BIT random number data, and programs this set of data into the OTP security data area; OTP_WRAPPER is the OTP controller, where, OTP_ASYNC is the synchronous module that external host computer carries out programming or read operation to OTP; OTP_CTRL is the main control module of OTP controller, understandably, in the present embodiment, programming address and programming data are sent to OTP_ASYNC module after synchronizing, send to OTP The main control module OTP_CTRL; OTP_INIT is the initialization control module of OTP, which is responsible for reading each area of OTP in stages after the OTP is powered on, completing the initialization of the OTP output value of the entire system, and sending the security-sensitive data generated by the initialization to OTP_OUTPUT is finally sent to other modules outside the system; OTP_PROGRAM is the OTP programming interface module; OTP_READ module is the OTP read operation interface module; OTP_ALGO module is the encryption and decryption algorithm operation module in the OTP controller, including SM4, AES and TDES Encryption and decryption algorithm hardware implementation module. This module is used to encrypt sensitive security data, and then send the encrypted data to the OTP_PROGRAM module. During the system initialization phase, the OTP_ALGO module is used to provide decryption of secure data. The OTP_OUTPUT module is an interface module between OTP_WRAPPER and external modules, and outputs security-sensitive data.

It can be understood that the OTP memory in this embodiment is divided into four areas, the random data area OTP_TRNG_RANDOM_AREA is used to program and store 128BIT random numbers, which are generated by the external true random number generation module TRNG for subsequent encryption and decryption operation processing, and , after the latch state is programmed to 1, this area is guaranteed to be invisible to the external HOST and external modules; the security data area OTP_SECURITY_AREA is used to program and store security-sensitive data; the parameter configuration area OTP_CONFIGURE_AREA is used to program and store hardware configuration data, for example 2bit is used to configure the PROGRAM_MODE field of the encryption and decryption algorithm, and the 1bit encryption and decryption key selection is used to configure the PROGRAM_KEY_SEL field; the latch status configuration area OTP_LOCK_AREA is used to program and store latch status information.

Wherein, for the specific process of the above-mentioned step S23 and step S24, reference may be made to the corresponding content disclosed in the foregoing embodiments, which will not be repeated here.

It can be seen from the above that in this embodiment, a series of security protection measures such as random number processing on the encryption and decryption keys and encrypted data decryption are only completed by the OTP controller in the OTP initialization stage, which improves the security of programming into the OTP. Security and confidentiality of sensitive data. The random value provided by the true random number generator ensures the randomness and uncertainty of the value programmed into the secure data area, that is, the randomness of the key used to encrypt the secure data, which improves the impossibility of encryption and decryption of the confidential data predictability. On this basis, the data latch mechanism ensures the invisibility of the random key and the data validity of the security-sensitive data programming area during the data use process. As a result, when the external host performs a read operation on the sensitive data programmed in the secure data area, the read value is encrypted data, thereby improving the security and confidentiality of the data.

The embodiment of the present application discloses an OTP initialization process, as shown in Figure 6, which may include the following steps:

Step S31: When receiving the startup signal sent by the random number generator after the system is reset, read the random number flag in the random data area of the OTP memory to determine whether there is a random number in the random data area.

In this embodiment, for example, during the OTP initialization process shown in Figure 7, after the system reset is released, the true random number generator automatically completes the initialization configuration, and pulls the signal TRNG_READY to 1. After the OTP controller receives the signal, Initiate the read operation of the OTP memory of OTP_INIT_STEP1 in the first stage. In this stage, other non-sensitive data areas and the random number flag TRNG_RANDOM_KEY_READY field are read. If the flag is 1, it means that the OTP has 128BIT random number in the production stage. If the flag bit is 0, it means that the random storage area is not programmed, and the OTP initialization process skips to the end OTP_INIT_FINISH, that is, during the OTP initialization process, the reading process of the security data area will be skipped , and directly end the initialization process of the entire OTP. In this case, since the security data area has not been programmed and initialized to read, the valid signal of the sensitive data will always remain in a low state.

Step S32: If it exists, read the data information in the random data area, security data area, parameter configuration area and latch state configuration area in the OTP memory, and store the data information locally.

In this embodiment, if the random value exists, that is, the random number flag is 0, then the OTP power-on initialization enters the second stage OTP_INIT_STEP2, and the OTP controller reads the random data area, security data area, parameter configuration area and The data information in the state configuration area is latched, and the above data information is stored in a local memory. If the random number flag is 0, after the initialization process is completed, it is necessary to initiate a request for programming random numbers to the OTP controller through the external serial port, as shown in Figure 8. After receiving the request, the OTP controller sends a request to the random number module Request a group of 128BIT random numbers, and program the requested true random numbers into the above random data area. After the programming is completed, program the random number flag to 1. That is, configure the random number programming request start register of the OTP controller through the external serial port, and initiate the entire random number request and programming operation.

Step S33: According to the algorithm configuration field in the parameter configuration area, determine whether the data in the secure data area is encrypted.

In this embodiment, after storing the data, enter OTP_INIT_STEP3, the third stage of the OTP power-on initialization process, read the algorithm configuration field in the above-mentioned parameter configuration area, and judge whether the data in the above-mentioned security data area is encrypted, that is, by reading the data shown in Figure 2 Algorithm configuration field PROGRAM_MODE shown to determine whether the above security data is encrypted or the corresponding encryption algorithm.

Step S34: If encrypted, decrypt the encrypted data in the secure data area according to the target key corresponding to the key configuration field in the parameter configuration area and according to the target encryption algorithm corresponding to the algorithm configuration field , get the decrypted security data.

In this embodiment, if encrypted, the encrypted data in the secure data area is decrypted according to the target key corresponding to the key configuration field in the parameter configuration area and according to the target encryption algorithm corresponding to the algorithm configuration field , get the decrypted security data. That is, the decryption operation is performed on the read security data, the decryption algorithm is selected through the PROGRAM_MODE field, and the decryption key is selected through the PROGRAM_KEY_SEL field.

Step S35: Send the locally stored data information in the random data area, the parameter configuration area and the latch state configuration area, as well as the decrypted security data to the outside of the system through the local interface output module module, so that the external modules of the system use the data information to generate a key.

In this embodiment, after the decryption is completed, enter the OUTPUT stage, and send the decrypted security-sensitive data in the third stage and other data read during the second stage initialization to the OTP_OUTPUT module for output to the external module of the system, so that the external module of the system can use the above data information Generate keys from the root key and identity information in the security data, and pull the valid signal of sensitive data to 1. If it is not encrypted, the locally stored data information read by the second stage initialization is directly sent to the external module of the system through the local interface output module, and then the external module of the system can use the root key and identity information in the secure data area, etc. Generate the corresponding key.

As can be seen from the above, in this embodiment, when the start signal sent by the random number generator after the system reset is received, the random number flag in the random data area in the OTP memory is read to determine whether there is a random value in the random data area. . If it exists, then read the data information in the random data area, security data area, parameter configuration area and latch state configuration area in the OTP memory, and store the data information locally. Then, according to the algorithm configuration field in the parameter configuration area, it is judged whether the data in the secure data area is encrypted. If it is encrypted, according to the target key corresponding to the key configuration field in the parameter configuration area, and according to the target encryption algorithm corresponding to the algorithm configuration field, the encrypted data in the secure data area is decrypted to obtain the decrypted post-safety data. Send the data information in the random data area, the parameter configuration area and the latch state configuration area stored locally, and the decrypted security data to the system external module through the local interface output module, so that The system external module uses the data information to generate a key. It can be seen that the decryption of security data in this embodiment only occurs in the OTP initialization stage after the system is powered on. This part of the decryption control is controlled by hardware, and external hosts and other parts cannot control it to ensure its independence and security.

Correspondingly, the embodiment of the present application also discloses a data protection device in an OTP memory, as shown in Figure 9, the device includes:

The target key acquisition module 11 is used to acquire the target key after receiving the programming request sent by the OTP memory;

Data and encryption algorithm acquisition module 12, used to obtain the security data to be encrypted, and read the parameter configuration area of the OTP memory to determine the target encryption algorithm;

An encryption storage module 13, configured to encrypt the security data to be encrypted by using the target encryption algorithm and the target key to obtain encrypted security data, and store the encrypted security data in the OTP memory Secure data area.

As can be seen from the above, in this embodiment, after receiving the programming request sent by the OTP memory, the target key is obtained; the security data to be encrypted is obtained, and the parameter configuration area of the OTP memory is read to determine the target encryption algorithm; The target encryption algorithm and the target key encrypt the security data to be encrypted to obtain encrypted security data, and store the encrypted security data in the security data area of the OTP memory. It can be seen that the security-sensitive data is encrypted by the OTP controller and then programmed into the secure data area, and the encryption and decryption algorithm is selected by hardware to realize the processing of different encryption and decryption keys and the selection of encryption and decryption algorithms, which improves the security of data encryption. The security and confidentiality can enhance the security and confidentiality of OTP data after programming, and prevent data from being tampered with or important sensitive data from being illegally stolen.

In some specific embodiments, the target key acquisition module 11 may specifically include:

A first key acquisition unit, configured to read the fixed key preset in the key configuration field in the parameter configuration area of the OTP memory, and use the fixed key as the target key;

The second key acquisition unit is configured to send a random number request to a random number generator, and obtain a random value fed back by the random number generator; use the random value as the target key, and store it in the OTP Random data area of memory.

In some specific embodiments, the data protection device in the OTP memory may specifically include:

The latch module is used to utilize the latch state configuration area of the OTP memory to carry out the latch configuration of the read operation and/or write operation to the random data area, the security data area and the parameter configuration area respectively.

The initialization module is used to read the random number flag bit of the random data area in the OTP memory when receiving the start signal sent by the random number generator after the system is reset, so as to determine whether the random number in the random data area is There is a random value; if it exists, read the data information in the random data area, the security data area, the parameter configuration area and the latch state configuration area, and store the data information locally; According to the algorithm configuration field in the parameter configuration area, it is judged whether the data in the safe data area is encrypted; if it is not encrypted, the data information stored locally is sent to the system external module through the local interface output module , so that the external module of the system uses the data information to generate a key.

In some specific embodiments, the initialization module may specifically include:

The decryption module is configured to, if the data in the secure data area is encrypted, encrypt the secure data according to the target key corresponding to the key configuration field in the parameter configuration area and according to the target encryption algorithm corresponding to the algorithm configuration field The encrypted data in the area is decrypted to obtain the decrypted security data; through the local interface output module, the data information in the locally stored random data area, the parameter configuration area and the latch state configuration area, and The decrypted security data is sent to the external module of the system.

Further, the embodiment of the present application also discloses an electronic device, as shown in FIG. 10 , and the content in the figure should not be regarded as any limitation on the application scope of the present application.

FIG. 10 is a schematic structural diagram of an electronic device 20 provided in an embodiment of the present application. The electronic device 20 may specifically include: at least one processor 21 , at least one memory 22 , a power supply 23 , a communication interface 24 , an input/output interface 25 and a communication bus 26 . Wherein, the memory 22 is used to store a computer program, and the computer program is loaded and executed by the processor 21 to implement relevant steps in the OTP in-memory data protection method disclosed in any of the foregoing embodiments.

In this embodiment, the power supply 23 is used to provide working voltage for each hardware device on the electronic device 20; the communication interface 24 can create a data transmission channel between the electronic device 20 and external devices, and the communication protocol it follows is applicable Any communication protocol in the technical solution of the present application is not specifically limited here; the input and output interface 25 is used to obtain external input data or output data to the external, and its specific interface type can be selected according to specific application needs, here Not specifically limited.

In addition, the memory 22, as a resource storage carrier, can be a read-only memory, random access memory, magnetic disk or optical disk, etc., and the resources stored thereon include an operating system 221, a computer program 222, and data 223 including security data to be encrypted. , the storage method can be temporary storage or permanent storage.

Wherein, the operating system 221 is used to manage and control each hardware device and computer program 222 on the electronic device 20, so as to realize the operation and processing of the massive data 223 in the memory 22 by the processor 21, which can be Windows Server, Netware, Unix, Linux, etc. The computer program 222 may further include a computer program capable of completing other specific tasks in addition to the computer program capable of implementing the OTP in-memory data protection method performed by the electronic device 20 disclosed in any of the foregoing embodiments.

Further, the embodiment of the present application also discloses a computer storage medium, the computer storage medium stores computer-executable instructions, and when the computer-executable instructions are loaded and executed by a processor, the implementation of any one of the foregoing embodiments is disclosed. The step of the data protection method in the OTP memory.

Each embodiment in this specification is described in a progressive manner, each embodiment focuses on the difference from other embodiments, and the same or similar parts of each embodiment can be referred to each other. As for the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and for the related information, please refer to the description of the method part.

The steps of the methods or algorithms described in connection with the embodiments disclosed herein may be directly implemented by hardware, software modules executed by a processor, or a combination of both. Software modules can be placed in random access memory (RAM), internal memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disk, removable disk, CD-ROM, or any other Any other known storage medium.

Finally, it should also be noted that in this text, relational terms such as first and second etc. are only used to distinguish one entity or operation from another, and do not necessarily require or imply that these entities or operations, any such actual relationship or order exists. Furthermore, the term "comprises", "comprises" or any other variation thereof is intended to cover a non-exclusive inclusion such that a process, method, article or apparatus comprising a set of elements includes not only those elements, but also includes elements not expressly listed. other elements of or also include elements inherent in such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of additional identical elements in the process, method, article or apparatus comprising said element.

The above provides a detailed introduction to the data protection method, device, equipment and medium in a kind of OTP memory provided by the present invention. In this paper, specific examples are used to illustrate the principle and implementation of the present invention. The description of the above embodiments is only used To help understand the method of the present invention and its core idea; at the same time, for those of ordinary skill in the art, according to the idea of the present invention, there will be changes in the specific implementation and scope of application. In summary, this specification The content should not be construed as a limitation of the invention.

Claims

A kind of data protection method in OTP memory, it is characterized in that being applied to OTP controller, comprising:

Obtain the target key after receiving the programming request sent by the OTP memory;

Obtain the security data to be encrypted, and read the parameter configuration area of the OTP memory to determine the target encryption algorithm;

Encrypting the security data to be encrypted by using the target encryption algorithm and the target key to obtain encrypted security data, and storing the encrypted security data in the security data area of the OTP memory.
The data protection method in OTP memory according to claim 1, is characterized in that, described obtaining target key, comprises:

Read the fixed key preset in the key configuration field in the parameter configuration area of the OTP memory, and use the fixed key as the target key.
The method for protecting data in the OTP memory according to claim 1, wherein the target encryption algorithm comprises Advanced Data Encryption Standard, Triple Data Encryption Standard and SM4 encryption algorithm.
The data protection method in OTP memory according to claim 1, is characterized in that, described obtaining target key, comprises:

Send a random number request to the random number generator, and obtain the random value fed back by the random number generator;

The random value is used as the target key and stored in the random data area of the OTP memory.
The method for protecting data in the OTP memory according to claim 4, wherein, after storing the encrypted security data into the secure data area of the OTP memory, further comprising:

Using the latch state configuration area of the OTP memory, the random data area, the security data area and the parameter configuration area are respectively configured for read and/or write operations.
The data protection method in OTP memory according to claim 4, is characterized in that, also comprises:

When receiving the starting signal sent by the random number generator after the system reset, read the random number flag bit of the random data area in the OTP memory, to determine whether there is a random value in the random data area;

If it exists, read the data information in the random data area, the security data area, the parameter configuration area and the latch state configuration area, and store the data information locally;

According to the algorithm configuration field in the parameter configuration area, determine whether the data in the secure data area is encrypted;

If not encrypted, the locally stored data information is sent to the system external module through the local interface output module, so that the system external module uses the data information to generate a key.
The method for protecting data in the OTP memory according to claim 6, wherein after said judging whether the data in the secure data area is encrypted, it also includes:

If it is encrypted, according to the target key corresponding to the key configuration field in the parameter configuration area, and according to the target encryption algorithm corresponding to the algorithm configuration field, the encrypted data in the secure data area is decrypted to obtain the decrypted post-safety data;

The local interface output module sends the data information stored locally in the random data area, the parameter configuration area and the latch state configuration area, and the decrypted security data to the system external module.
A kind of data protection device in OTP memory, it is characterized in that, is applied to OTP controller, comprises:

The target key acquisition module is used to obtain the target key after receiving the programming request sent by the OTP memory;

Data and encryption algorithm acquisition module, used to obtain the security data to be encrypted, and read the parameter configuration area of the OTP memory to determine the target encryption algorithm;

An encryption storage module, configured to encrypt the security data to be encrypted by using the target encryption algorithm and the target key to obtain encrypted security data, and store the encrypted security data in the OTP memory data area.
An electronic device, characterized in that it comprises:

memory for storing computer programs;

A processor, configured to execute the computer program, so as to realize the method for protecting data in the OTP memory according to any one of claims 1 to 7.
A computer-readable storage medium, characterized in that it is used to store a computer program; wherein when the computer program is executed by a processor, the method for protecting data in the OTP memory according to any one of claims 1 to 7 is realized.