WO2024026588A1 - 一种数据读写控制方法和装置 - Google Patents

一种数据读写控制方法和装置 Download PDF

Info

Publication number
WO2024026588A1
WO2024026588A1 PCT/CN2022/109283 CN2022109283W WO2024026588A1 WO 2024026588 A1 WO2024026588 A1 WO 2024026588A1 CN 2022109283 W CN2022109283 W CN 2022109283W WO 2024026588 A1 WO2024026588 A1 WO 2024026588A1
Authority
WO
WIPO (PCT)
Prior art keywords
time period
control
control information
storage device
read
Prior art date
Application number
PCT/CN2022/109283
Other languages
English (en)
French (fr)
Inventor
马崇良
刘宇
尹飞飞
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to PCT/CN2022/109283 priority Critical patent/WO2024026588A1/zh
Publication of WO2024026588A1 publication Critical patent/WO2024026588A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G11—INFORMATION STORAGE
    • G11C—STATIC STORES
    • G11C7/00—Arrangements for writing information into, or reading information out from, a digital store
    • G11C7/22—Read-write [R-W] timing or clocking circuits; Read-write [R-W] control signal generators or management 
    • G—PHYSICS
    • G11—INFORMATION STORAGE
    • G11C—STATIC STORES
    • G11C7/00—Arrangements for writing information into, or reading information out from, a digital store
    • G11C7/24—Memory cell safety or protection circuits, e.g. arrangements for preventing inadvertent reading or writing; Status cells; Test cells

Definitions

  • the present application relates to the field of control technology, and more specifically, to a data reading and writing control method and device.
  • system on chip or chip-level system
  • SOC system on chip
  • the off-chip memory includes storage particles that can still retain data after power off, since the data will still remain in the off-chip memory after the off-chip memory is powered off, an attacker can easily obtain the data in the off-chip memory. Stored data or modifications to data. In this way, once the SOC re-reads the data that has been modified by the attacker, it will be misled by the modified data. Therefore, the security of data reading and writing is poor.
  • This application provides a data reading and writing control method and device, which can improve the security of data reading and writing.
  • the present application provides a data reading and writing control method.
  • the method may include: a control device sending first control information to a storage device within a first time period, the first control information being used to control reading and writing of the storage device.
  • the channel is in a conductive state during a second time period, the first time period is used for the control device and the storage device to transmit control information, and the second time period is used for the control device and the storage device to transmit data; the control device Based on the first control information, data reading and/or data writing operations are performed on the storage device within the second time period.
  • data reading and/or data writing described in this application may be simply referred to as data reading and writing.
  • the control device uses the first control information to control the reading and writing channel of the storage device to be in a conductive state during the second time period, that is, the control device for the data reading and writing during the second time period is obtained.
  • the storage device has the authority to perform data reading and writing operations. In this way, the control device can only perform data reading and/or data writing operations on the storage device within the authorized second time period. Therefore, the security of data reading and writing can be improved.
  • this application does not limit the duration of the first time period and the second time period. That is to say, the duration of the first time period and the second time period may be equal or unequal.
  • the duration of the first time period may be shorter than the duration of the second time period.
  • the starting time of the second time period is later than the starting time of the first time period.
  • the method further includes: the control device sending second control information to the storage device within a third time period, the second control information being used to control the read-write channel within a fourth time period.
  • the third time period is used for the control device and the storage device to transmit control information
  • the fourth time period is used for the control device and the storage device to transmit data; the control device is based on the second control information, Data reading and/or data writing operations are performed on the storage device within the fourth time period.
  • the first time period and the third time period are used for the control device and the storage device to transmit control information, and the first time period is different from the third time period.
  • the second time period and the fourth time period are used for the control device and the storage device to transmit control information, and the second time period is different from the fourth time period.
  • the first time period and the third time period may partially overlap or not overlap at all, which is not limited in this embodiment of the present application.
  • the method further includes: the control device stopping data reading and/or data writing operations on the storage device from the end of the second time period.
  • the control device can only transmit data within the time period authorized by the control information. From the end of the authorized time period, the control device no longer has the ability to transmit data to the storage device.
  • the permissions for read and write operations that is, from the end of the second time period, the control device is prohibited (or blocked) from data reading and/or data writing operations on the storage device. Therefore, data reading and writing are more secure.
  • the first control information is encrypted with a session key
  • the method further includes: the control device and The storage device performs key negotiation to obtain the session key.
  • the session data (such as the first control information and the second control information) between the control device and the storage device are encrypted using the session key, which can improve the efficiency of the data transmission process. safety.
  • control device and the storage device perform key negotiation to obtain the session key, including: the control device and the storage device perform key negotiation based on a preset symmetric key to obtain the session key. Session key.
  • the control device and the storage device perform key negotiation through a preset symmetric key to obtain the session key.
  • the session key can be regenerated directly based on the symmetric key without reacquiring the symmetric key, which can improve the efficiency of data transmission.
  • each session key and/or each control information (such as the first control information) is stored in a register (or storage unit) in the control device when the control device is powered on.
  • the control device can directly obtain each session key and/or each control information from the register (or storage unit).
  • the control device can back up each session key and each control information in a dedicated storage area (or dedicated memory).
  • each session key and/or stored in the flash memory/register Each control information will be erased or released.
  • the control device can directly read each session key and/or each control information from the dedicated storage area (or dedicated memory).
  • this application also provides a data reading and writing control method.
  • the method may include: the storage device receives first control information from the control device within a first time period, and the first control information is used to control the storage device.
  • the read-write channel is in a conductive state during a second time period, the first time period is used for the control device and the storage device to transmit control information, and the second time period is used for the control device and the storage device to transmit data;
  • the storage device controls the read-write switch to be in an open state within the second time period based on the first control information.
  • data reading and/or data writing described in this application may be simply referred to as data reading and writing.
  • the control device uses the first control information to control the reading and writing channel of the storage device to be in a conductive state during the second time period, that is, the control device for the data reading and writing during the second time period is obtained.
  • the storage device has the authority to perform data reading and writing operations. In this way, the control device can only perform data reading and/or data writing operations on the storage device within the authorized second time period. Therefore, the security of data reading and writing can be improved.
  • this application does not limit the duration of the first time period and the second time period. That is to say, the duration of the first time period and the second time period may be equal or unequal.
  • the duration of the first time period may be shorter than the duration of the second time period.
  • the starting time of the second time period is later than the starting time of the first time period.
  • the method further includes: the storage device receiving second control information from the control device in a third time period, the second control information being used to control the read-write channel in a fourth time period. is in a conductive state, the third time period is used for the control device and the storage device to transmit control information, and the fourth time period is used for the control device and the storage device to transmit data; the storage device is based on the second control information , controlling the read-write channel to be in a conductive state during the fourth time period.
  • the first time period and the third time period are used for the control device and the storage device to transmit control information, and the first time period is different from the third time period.
  • the second time period and the fourth time period are used for the control device and the storage device to transmit control information, and the second time period is different from the fourth time period.
  • the first time period and the third time period may partially overlap or not overlap at all, which is not limited in this embodiment of the present application.
  • the method further includes: the storage device controlling the read-write channel to be in a disconnected state from the end of the second time period.
  • the control device can only transmit data within the time period authorized by the control information. From the end of the authorized time period, the control device no longer has the ability to transmit data to the storage device.
  • the permissions for read and write operations that is, from the end of the second time period, the control device is prohibited (or blocked) from data reading and/or data writing operations on the storage device. Therefore, data reading and writing are more secure.
  • the storage device controls the read-write channel to be in a conductive state during the second time period based on the first control information, including: the storage device authenticates the first control information, An authentication result is obtained, which includes authentication success or authentication failure; when the authentication result is authentication success, the storage device controls the read-write channel to be in a conductive state during the second time period.
  • the storage device needs to authenticate the first control information. Only if the authentication is successful, the control device will be granted permission to read and write data. If the authentication fails, the control device will be blocked. The control device reads and writes data. In this way, the security of data reading and writing can be improved.
  • the first control information is encrypted with a session key.
  • the method further includes: the storage device based on the The session key is used to decrypt the first control information to obtain the first initial control information; the storage device authenticates the first control information and obtains the authentication result, including: the storage device authenticates the first initial control information. , get the certification result.
  • the method before the storage device decrypts the first control information based on the session key to obtain the first initial control information, the method further includes: the storage device encrypts the control device with the control device. Key negotiation is performed to obtain the session key.
  • the session data (such as the first control information) between the control device and the storage device is encrypted using the session key, which can improve security during data transmission.
  • the storage device and the control device perform key negotiation to obtain the session key, including: the storage device and the control device perform key negotiation based on a preset symmetric key to obtain the session key. Session key.
  • the control device and the storage device perform key negotiation through a preset symmetric key to obtain the session key.
  • the session fails due to the power off of the control device or the storage device or other reasons, If the key is lost, the session key can be regenerated directly based on the symmetric key without re-obtaining the symmetric key, which can improve the efficiency of data transmission.
  • each session key and/or each control information (such as the first control information) is stored in a register (or trigger) in the storage device when the storage device is powered on.
  • the storage device can directly obtain each session key and/or each control information from the register (or trigger).
  • the storage device can back up each session key and each control information in the persistent memory.
  • each session key and/or each control information stored in the trigger or register will be Erase or release, at this time, the storage device can directly read each session key and/or each control information from the persistent memory.
  • this application also provides a data reading and writing control device.
  • the device may include: a sending module, configured to send first control information to the storage device within a first time period, where the first control information is used to control the storage device.
  • the read-write channel of the device is in a conductive state during a second time period.
  • the first time period is used for the data read-write control device and the storage device to transmit control information.
  • the second time period is used for the data read-write control device. Transmit data with the storage device; a read-write module, configured to perform data reading and/or data writing operations on the storage device within the second time period based on the first control information.
  • the sending module can also be used to send second control information to the storage device within a third time period, where the second control information is used to control the read-write channel to be in the leading state during the fourth time period.
  • the third time period is used for the control device and the storage device to transmit control information
  • the fourth time period is used for the control device and the storage device to transmit data;
  • the read-write module is also used to transmit data based on the second control information, and perform data reading and/or data writing operations on the storage device within the fourth time period.
  • the read-write module is also configured to stop data reading and/or data writing operations on the storage device from the end of the second time period.
  • the first control information is encrypted with a session key
  • the device further includes a key agreement module; the key agreement module is used to send the sending module to the storage device within the first time period.
  • key negotiation is performed with the storage device to obtain the session key.
  • the key agreement module is specifically configured to perform key agreement with the storage device based on a preset symmetric key to obtain the session key.
  • the present application also provides a data reading and writing device.
  • the device may include: a receiving module, configured to receive first control information from the control device within a first time period, where the first control information is used to control the data reading and writing device.
  • the read-write channel of the data read-write device is in a conductive state during a second time period.
  • the first time period is used for the control device and the data read-write device to transmit control information.
  • the second time period is used for the control device and the data read-write device.
  • the data reading and writing device transmits data; the control module is configured to control the reading and writing channel to be in a conductive state within the second time period based on the first control information.
  • the receiving module is also configured to receive second control information from the control device within the third time period, and the second control information is used to control the read-write channel to be in the fourth time period.
  • the third time period is used for the control device and the data reading and writing device to transmit control information
  • the fourth time period is used for the control device and the data reading and writing device to transmit data
  • the control module is also used to transmit data based on The second control information controls the read-write channel to be in a conductive state during the fourth time period.
  • the device further includes: the control module is further configured to control the read-write channel to be in a disconnected state from the end of the second time period.
  • the device further includes an authentication module; the authentication module is used to authenticate the first control information and obtain an authentication result, where the authentication result includes authentication success or authentication failure; the control module is specifically configured to: When the authentication result is successful, the read-write channel is controlled to be in a conductive state during the second time period.
  • the first control information is encrypted with a session key
  • the device further includes: a decryption module; the decryption module is used to authenticate the first control information in the authentication module to obtain authentication Before the result, the first control information is decrypted based on the session key to obtain the first initial control information; the authentication module is specifically used to authenticate the first initial control information to obtain the authentication result.
  • the device further includes: a key agreement module; the key agreement module is used to decrypt the first control information based on the session key in the decryption module to obtain the first initial control Before sending the information, perform key negotiation with the control device to obtain the session key.
  • the key agreement module is specifically configured to perform key agreement with the control device based on a preset symmetric key to obtain the session key.
  • this application also provides a data reading and writing control device.
  • the device may include a controller and a communication interface, and the controller is coupled to the communication interface.
  • the communication interface is used to input data to the controller (such as data to be written to the storage device) and/or output data from the controller (such as data to be read from the storage device); the controller is used to run a computer program or Instructions are provided to enable the device to implement the method described in the above first aspect or various possible implementations thereof.
  • the data reading and writing control device may be specifically the control device described in the first aspect or its various possible implementations.
  • the application also provides a data reading and writing device.
  • the device may include a controller, a storage area and a reading and writing channel.
  • the storage area is coupled to the reading and writing channel.
  • the controller is used to control the reading and writing channel to be in a leading position. open or closed state.
  • the control device when the controller controls the read-write channel to be in the on state, the control device can read and write data to the storage area through the read-write channel; conversely, when the controller controls the read-write channel to be in the off state.
  • the control device When in the open state, the control device cannot read and write data to the storage area through the read-write channel, that is, it does not have the authority to read and write data to the storage area through the read-write channel.
  • the data reading and writing device may be specifically the storage device described in the second aspect or its various possible implementations.
  • the present application also provides a computer-readable storage medium for storing a computer program, characterized in that the computer program includes instructions for implementing the methods described in the above aspects or any possible implementation thereof. .
  • the present application also provides a computer program product.
  • the computer program product contains instructions, which are characterized in that when the instructions are run on a computer or a processor, the computer or the processor implements the above aspects or The method described in any possible implementation.
  • the data reading and writing control devices, data reading and writing devices, computer storage media and computer program products provided by this application are all used to execute the data reading and writing control methods provided above. Therefore, the beneficial effects they can achieve can be referred to the above. The beneficial effects of the provided data reading and writing control method will not be described again here.
  • Figure 1 provides a schematic block diagram of the data reading and writing control system 100 according to the embodiment of the present application
  • Figure 2 provides a schematic diagram of the application scenario of the embodiment of the present application
  • Figure 3 provides a schematic diagram of another application scenario according to the embodiment of the present application.
  • Figure 4 provides a schematic flow chart of the data reading and writing control method 200 according to the embodiment of the present application.
  • Figure 5 provides a schematic block diagram of the data reading and writing control device 300 according to the embodiment of the present application.
  • Figure 6 provides a schematic block diagram of the data reading and writing control device 400 according to the embodiment of the present application.
  • Figure 7 provides a schematic block diagram of the data reading and writing device 500 provided by the embodiment of the present application.
  • Figure 8 provides a schematic block diagram of the data reading and writing device 600 provided by the embodiment of the present application.
  • At least one (item) refers to one or more, and “plurality” refers to two or more.
  • “And/or” is used to describe the relationship between associated objects, indicating that there can be three relationships. For example, “A and/or B” can mean: only A exists, only B exists, and A and B exist simultaneously. , where A and B can be singular or plural. The character “/” generally indicates that the related objects are in an "or” relationship. “At least one of the following” or similar expressions thereof refers to any combination of these items, including any combination of a single item (items) or a plurality of items (items).
  • At least one of a, b or c can mean: a, b, c, "a and b", “a and c", “b and c", or "a and b and c” ”, where a, b, c can be single or multiple.
  • FIG. 1 shows a schematic block diagram of a data reading and writing control system 100 provided by an embodiment of the present application.
  • the system 100 may include a control device 110 and a storage device 120, wherein the control device 110 may perform data reading and writing operations on the storage device 120.
  • the storage device 120 may include storage particles that can retain data after power off, such as persistent memory (persistent memory).
  • persistent memory persistent memory
  • system 100 can be applied to a variety of application scenarios, which are not limited in the embodiments of the present application.
  • the system 100 can be used in a terminal.
  • the terminal described in this application may be a transportation vehicle or an intelligent device.
  • the terminal can be a motor vehicle (such as an unmanned vehicle, a smart vehicle, an electric vehicle, a digital vehicle, etc.), a drone, a rail car, a bicycle, a traffic light, etc.
  • the terminal can be a mobile phone, tablet, laptop, personal digital assistant, sales terminal, augmented reality device, virtual reality, wearable device, etc.
  • FIG. 2 shows a schematic diagram of an application scenario provided by the embodiment of the present application.
  • the control device 110 may be a system-on-chip (chip-level system) SOC, and correspondingly, the storage device 120 may be an off-chip memory of the SOC.
  • system 100 can be used on the cloud side.
  • Figure 3 shows a schematic diagram of another application scenario provided by the embodiment of the present application.
  • the control device 110 may be a chiplet, and correspondingly, the storage device 120 may be an external memory of the chiplet.
  • Figure 4 shows the data reading and writing control method 200 provided by the embodiment of the present application.
  • the method 200 may be used with the system 100 described in FIG. 1 .
  • the method 200 may include the following steps. It should be noted that the steps listed below may be executed in various orders and/or occur simultaneously, and are not limited to the execution order shown in FIG. 4 .
  • the control device sends the first control information to the storage device within the first time period.
  • the first control information is used to control the read and write channel of the storage device to be in a conductive state during the second time period.
  • the first time period uses The control device and the storage device transmit control information, and the second time period is used for the control device and the storage device to transmit data.
  • data reading and/or data writing described in this application may be simply referred to as data reading and writing.
  • this application does not limit the duration of the first time period and the second time period. That is to say, the duration of the first time period and the second time period may be equal or unequal.
  • the duration of the first time period may be shorter than the duration of the second time period.
  • the starting time of the second time period is later than the starting time of the first time period.
  • the first control information may be encrypted with a session key. That is to say, the communication between the control device and the storage device can be encrypted and decrypted based on the session key, which can improve the security of the session between the control device and the storage device.
  • both the control device and the storage device can save session keys used respectively.
  • both the control device and the storage device can save the first control information.
  • the method further includes: the control device encrypting the first initial control information based on the session key to obtain the first control information. That is to say, the first control information is information obtained by encrypting the first initial control information.
  • the method further includes: the storage device decrypts the first control information based on the session key to obtain the first initial control information.
  • control device and the storage device can obtain the session key in a variety of ways, which are not limited in the embodiments of the present application.
  • control device and the storage device can be pre-configured with the session key when leaving the factory.
  • control device and the storage device may perform key negotiation to obtain the session key.
  • the key agreement described in the embodiment of the present application refers to the negotiation of the session key through a handshake between the control device and the storage device.
  • control device and the storage device can perform key negotiation through a preset symmetric key to obtain the session key; or they can perform key negotiation through an asymmetric key to obtain the session key.
  • This application There is no restriction on this.
  • the preset symmetric key can be obtained by binding the control device and the storage device before leaving the factory.
  • control device and the storage device can perform key negotiation in a variety of ways, which is not limited in this application.
  • control device and the storage device can complete the key agreement process through the following steps (1) to (15):
  • the control device determines that it is the first operation after power-on, and then starts the authentication docking process.
  • the control device encrypts the random number R_A with a preset symmetric key to obtain an encrypted random number M(R_A).
  • the control device sends the M(R_A) to the address ADDR_A0 of the storage device; accordingly, the storage device receives the M(R_A) from the control device.
  • the storage device generates random number R_B.
  • the storage device uses the symmetric key to decrypt the M(R_A) to obtain R_A; append the R_B after the R_A to obtain the combination number R_A+R_B; use the symmetric key to decrypt the R_A+R_B Encrypt to obtain the encrypted combination number M(R_A+R_B); finally, save the M(R_A+R_B) to the address ADDR_A1.
  • the control device reads the M(R_A+R_B) from the address ADDR-A1 of the storage device.
  • the control device decrypts M(R_A+R_B) using the symmetric key to obtain R_A+R_B.
  • the control device determines whether the decrypted R_A is consistent with the locally generated R_A. If they are consistent, it is determined that the decrypted R_B is correct.
  • the control device encrypts R_B using the symmetric key to obtain the encrypted random number M(R_B).
  • the control device sends the M(R_A) and the M(R_B) to the address ADDR_A2 of the storage device.
  • the storage device determines that the key negotiation is completed and stores the key negotiation completion flag used to indicate the completion of the key negotiation. Address ADDR_A3.
  • the control device reads the key negotiation completion flag from the address ADDR_A3 of the storage device, and determines that the key negotiation is completed based on the key negotiation completion flag.
  • the control device decrypts the M(R_A) and the M(R_B) respectively to obtain the R_A and the R_B.
  • the control device determines the session key based on the R_A and the R_B. For example, use R_A+R_B as the session key.
  • the storage device controls the read-write channel to be in a conductive state during the second time period.
  • the control device can perform data reading and writing operations on the storage device through the read-write channel; conversely, when the read-write channel is in a disconnected state, the control device cannot Data reading and writing operations are performed on the storage device through the reading and writing channel, that is, the control device is prevented from reading and writing data on the storage device through the reading and writing channel.
  • S202 may include: the storage device authenticates the first control information and obtains an authentication result.
  • the authentication result includes authentication success or authentication failure; when the authentication result is authentication success, the storage device The device controls the read-write channel to be in a conductive state during the second time period.
  • the storage device can authenticate the above-mentioned first initial control information to obtain the authentication result.
  • this application does not limit the specific content of the first control information.
  • the first control information may be a first numerical value.
  • the first value may be a random value.
  • the storage device determines that the difference between the first value and the preset initial value is less than the first threshold, the authentication result is determined to be authentication successful; otherwise, the authentication result is determined to be authentication failed.
  • the first value may be greater than the second value, and the second value may be the time before the control device sends the first control information.
  • the control information sent accordingly, when the storage device determines that the first value is greater than the second value, it determines that the authentication result is authentication success; otherwise, it determines that the authentication result is authentication failure.
  • the control device performs data reading and/or data writing operations on the storage device within the second time period based on the first control information.
  • control device stops performing data reading and/or data writing operations on the storage device from the end of the second time period. That is to say, from the end of the second time period, the control device is prohibited (or blocked) from data reading and/or data writing operations on the storage device.
  • the storage device can send feedback information to the control device, where the feedback information is used to feedback that the read-write channel is turned on; accordingly, S203 may include: the control device performing data read and write operations on the storage device within the second time period based on the first control information and the feedback information.
  • the method 200 may also include: the control device sending second control information to the storage device within a third time period, the second control information being used to control the read-write channel to be turned on during a fourth time period. state, the third time period is used for the control device and the storage device to transmit control information, and the fourth time period is used for the control device and the storage device to transmit data; the control device based on the second control information, in the Perform data reading and/or data writing operations on the storage device within four time periods.
  • the first time period and the third time period are used for the control device and the storage device to transmit control information, and the first time period is different from the third time period.
  • the second time period and the fourth time period are used for the control device and the storage device to transmit control information, and the second time period is different from the fourth time period.
  • the first time period and the third time period may partially overlap or not overlap at all, which is not limited in this embodiment of the present application.
  • the data reading and writing control method between the control device and the storage device may include the following steps (a) to (h):
  • control device and the storage device are bound before leaving the factory to obtain a preset symmetric key.
  • control device and the storage device perform key negotiation based on the symmetric key to obtain the session key.
  • the control device encrypts the first initial control information based on the session key to obtain the first control information.
  • the first control information is used to control the read and write channel of the storage device to be on during the second time period. state.
  • the control device sends the first control information to the storage device within a first time period.
  • the storage device decrypts based on the session key to obtain the first initial control information.
  • the storage device authenticates the first initial control information and obtains an authentication result, which includes authentication success or authentication failure.
  • the storage device controls the read-write channel to be in a conductive state during the second time period.
  • the control device performs data reading and writing operations on the storage device within the second time period based on the first control information.
  • the method may also include the following steps (i) to (j):
  • the storage device controls the read-write channel to be in a disconnected state from the end of the second time period.
  • the control device stops performing data reading and writing operations on the storage device from the end of the second time period.
  • control device no longer has the authority to perform read and write operations on the storage device from the end of the second time period, that is, the control device will be blocked from reading and writing operations on the storage device. .
  • the method may also include the following steps (k) to (r). It should be noted that this step (k) to step (r) and the above-mentioned steps (c) to step (j) are two independent data reading and writing control processes. This application implements the above two data reading and writing control processes. The order is not limited.
  • the control device encrypts the second initial control information based on the session key to obtain second control information.
  • the second control information is used to control the read and write channels of the storage device to be on during the fourth time period. state.
  • the control device sends the second control information to the storage device within a third time period.
  • the storage device decrypts based on the session key to obtain the second initial control information.
  • the storage device authenticates the second initial control information and obtains an authentication result, which includes authentication success or authentication failure.
  • the storage device controls the read and write channel of the read storage device to be in a conductive state during the fourth time period.
  • the control device performs data reading and writing operations on the storage device within the fourth time period based on the second control information.
  • the method may also include the following steps (q) to (r):
  • the storage device controls the read-write channel to be in a disconnected state from the end of the fourth time period.
  • the control device stops performing data reading and writing operations on the storage device from the end of the fourth time period.
  • FIG. 5 shows a schematic block diagram of the data reading and writing control device 300 provided by the embodiment of the present application.
  • the data reading and writing control device 300 may include a sending module 301 and a reading and writing module 302 .
  • the data reading and writing control device 300 can be used in the above-mentioned system 100. Further, the data reading and writing control device 300 can be used in the control device 110 in the above-mentioned system 100, such as by a processor on the control device 110 or The software executed by the controller forms a virtual device.
  • the sending module 301 is used to send first control information to the storage device in a first time period.
  • the first control information is used to control the read and write channel of the storage device to be in a conductive state in a second time period.
  • the first time period is used for the data read-write control device and the storage device to transmit control information
  • the second time period is used for the data read-write control device and the storage device to transmit data.
  • the reading and writing module 302 is configured to perform data reading and/or data writing operations on the storage device within the second time period based on the first control information.
  • the sending module 301 is also configured to send second control information to the storage device within a third time period, where the second control information is used to control the read-write channel to perform the operation at the fourth time.
  • the third time period is used for the control device and the storage device to transmit control information
  • the fourth time period is for the control device and the storage device to transmit data;
  • the read The writing module 302 is also configured to perform data reading and/or data writing operations on the storage device within the fourth time period based on the second control information.
  • the sending module 301 is also configured to stop data reading and/or data writing operations on the storage device from the end of the second time period.
  • the first control information is encrypted with a session key
  • the data reading and writing control device 300 may further include an encryption module 303 .
  • the encryption module 303 is also configured to perform the first initial control information on the first initial control information based on the session key before the sending module 301 sends the first control information to the storage device within the first time period. Encrypt to obtain the first control information.
  • the data reading and writing control device 300 may also include a key agreement module 304.
  • the first control information is encrypted by a session key
  • the key agreement module 304 is configured to, before the sending module 301 sends the first control information to the storage device within the first time period, Perform key negotiation with the storage device to obtain the session key.
  • the key agreement module 303 is specifically configured to perform key agreement with the storage device based on a preset symmetric key to obtain the session key.
  • the data reading and writing control device 300 may be specifically the control device in the above-mentioned method 200 embodiment, and the data reading and writing control device 300 may be used to execute various steps corresponding to the control device in the above-mentioned method 200 embodiment. To avoid repetition, the processes and/or steps will not be repeated here.
  • One or more of the various modules in the embodiment shown in Figure 5 may be implemented through software, hardware, firmware, or a combination thereof.
  • the software or firmware includes, but is not limited to, computer program instructions or code, and may be executed by a hardware processor.
  • the hardware includes but is not limited to various types of integrated circuits, such as Central Processing Unit (CPU), Digital Signal Processor (DSP), Field Programmable Gate Array (FPGA) or Application Specific Integrated Circuit (ASIC, Application Specific Integrated Circuit).
  • Figure 6 shows a schematic block diagram of a data reading and writing control device 400 provided by an embodiment of the present application.
  • the data reading and writing control device 400 may include a controller 401 and a communication interface 402.
  • the controller 401 and the Communication interface 402 couples.
  • the data reading and writing control device 400 can be specifically the control device in the above method 200, and the data reading and writing control device 400 can be an entity of the data reading and writing control device 300. Hardware structure.
  • the data reading and writing control device 400 can be used to execute various processes and/or steps corresponding to the control device in the above-mentioned method 200 embodiment. To avoid duplication, they will not be described again here.
  • the communication interface 402 is used to input data to the controller 401 (such as data to be written to the storage device) and/or output data from the controller 401 (such as data to be read from the storage device); the controller 401 uses By running a computer program or instruction, the data reading and writing control device 400 implements the method described in the above method 200 embodiment.
  • the controller 401 in the embodiment of this application includes but is not limited to a central processing unit (Central Processing Unit, CPU), a general-purpose processor, a digital signal processor (Digital Signal Processor, DSP), an application specific integrated circuit (Application Specific Integrated Circuit, ASIC ), off-the-shelf programmable gate array (Field Programmable Gate Array, FPGA), discrete gate or transistor logic devices or discrete hardware components, etc.
  • a general-purpose processor can be a microprocessor, a microcontroller, or any conventional processor.
  • the controller 401 is used to send first control information to the storage device within a first time period, and the first control information is used to control the read and write channel of the storage device to be in a conductive state during a second time period,
  • the first time period is used for the data read-write control device and the storage device to transmit control information
  • the second time period is used for the data read-write control device and the storage device to transmit data; based on the The first control information is to perform data reading and/or data writing operations on the storage device through the communication interface 402 within the second time period.
  • the data reading and writing control device 400 may also include a memory 403.
  • the memory 403 may be volatile memory or non-volatile memory, or may include both volatile and non-volatile memory.
  • non-volatile memory can be read-only memory (Read-Only Memory, ROM), programmable read-only memory (Programmable ROM, PROM), erasable programmable read-only memory (Erasable PROM, EPROM), electrically removable memory.
  • Erase programmable read-only memory Electrode EPROM, EEPROM
  • Volatile memory may be Random Access Memory (RAM), which is used as an external cache.
  • RAM static random access memory
  • DRAM dynamic random access memory
  • DRAM synchronous dynamic random access memory
  • SDRAM double data rate synchronous dynamic random access memory
  • Double Data Rate SDRAM DDR SDRAM
  • ESDRAM enhanced synchronous dynamic random access memory
  • Synchlink DRAM SLDRAM
  • Direct Rambus RAM Direct Rambus RAM
  • the memory 403 is used to store program codes and instructions of the data reading and writing control device 400 .
  • the memory 403 is also used to store data obtained when the controller 401 executes the above embodiment of the method 200, such as session keys and various control information (such as the first control information).
  • the memory 403 may be a separate device or integrated in the controller 401.
  • FIG. 6 only shows a simplified design of the data reading and writing control device 400.
  • the data reading and writing control device 400 may also include other necessary components, including but not limited to any number of communication interfaces, processors, controllers, memories, etc., all of which can implement the data reading and writing of the present application.
  • the control device 400 is within the protection scope of this application.
  • the data reading and writing control device 400 may also include an encryption component (or encryption engine), which is coupled to the controller 401.
  • the encryption component is used to encrypt the first initial control information to obtain the third A control information, that is, the encryption process does not need to be implemented by the controller through software, but is implemented by the encryption component of the hardware.
  • the data reading and writing control device 400 also includes a random number generator, which is coupled to the controller 401.
  • the random number generator is used to generate random numbers for key negotiation, that is, The random number generation process does not need to be implemented by the controller through software, but is implemented by a hardware random number generator.
  • the data reading and writing control device 400 may be a chip device.
  • the chip device can also include one or more memories for storing computer execution instructions.
  • the processor can execute the computer execution instructions stored in the memory, so that the chip device executes the above command transmission method. .
  • the chip device can be a field programmable gate array, a dedicated integrated chip, a system chip, a central processing unit, a network processor, a digital signal processing circuit, a microcontroller, or a programmable controller that implements related functions. or other integrated chips.
  • FIG. 7 shows a schematic block diagram of the data reading and writing device 500 provided by the embodiment of the present application.
  • the data reading and writing device 500 may include: a receiving module 501 and a control module 502.
  • the data reading and writing device 500 can be used in the above-mentioned system 100. Further, the data reading and writing device 500 can be used in the storage device 120 in the above-mentioned system 100, such as by a processor or controller on the storage device 120.
  • the executing software forms a virtual device.
  • the receiving module 501 is used to receive first control information from the control device within a first time period, and the first control information is used to control the read and write channel of the data reading and writing device to be turned on during a second time period. state, the first time period is used for the control device and the data reading and writing device to transmit control information, and the second time period is used for the control device and the data reading and writing device to transmit data.
  • the control module 502 is configured to control the read-write channel to be in a conductive state within the second time period based on the first control information.
  • the receiving module 501 is also configured to receive second control information from the control device within a third time period, where the second control information is used to control the read-write channel in a fourth time period.
  • the third time period is used for the control device and the data reading and writing device to transmit control information
  • the fourth time period is used for the control device and the data reading and writing device.
  • the control module 502 is also used to control the read-write channel to be in a conductive state during the fourth time period based on the second control information.
  • the receiving module 501 is also configured to control the read-write channel to be in a disconnected state from the end of the second time period.
  • the data reading and writing device 500 may also include an authentication module 503.
  • the authentication module 503 is used to authenticate the first control information to obtain an authentication result, where the authentication result includes authentication success or authentication failure; the control module 502 is specifically used when the When the authentication result is successful, the read-write channel is controlled to be in a conductive state during the second time period.
  • the data reading and writing device 500 may also include a decryption module 504.
  • the first control information is encrypted by a session key
  • the decryption module 504 is used to authenticate the first control information by the authentication module 503 and obtain the authentication result based on
  • the session key is used to decrypt the first control information to obtain the first initial control information
  • the authentication module 503 is specifically used to authenticate the first initial control information to obtain the authentication result.
  • the data reading and writing device 500 may also include a key agreement module 505.
  • the key agreement module 505 is configured to perform key agreement with the control device before the decryption module decrypts the first control information based on the session key, Get the session key.
  • the key agreement module 505 is specifically configured to perform key agreement with the control device based on a preset symmetric key to obtain the session key.
  • one or more of the receiving module 501, control module 502, authentication module 503, decryption module 504 and key agreement module 505 in the data reading and writing device 500 can be implemented using a high security mechanism to ensure data reading and writing. security.
  • the above-mentioned high-security mechanisms include but are not limited to: using a dedicated high-security encryption and decryption engine to encrypt and decrypt important internal registers and combinational logic; or encrypting and decrypting various keys and/or control information (such as the first control information). ) to perform double backup (that is, backup separately in the register and persistent memory area) to prevent attacks.
  • the data reading and writing device 500 may be specifically a storage device in the embodiment of the above method 200, and the data reading and writing device 500 may be used to execute various processes corresponding to the storage device in the above method 200 and/or To avoid repetition, the steps will not be repeated here.
  • One or more of the various modules in the embodiment shown in Figure 7 may be implemented through software, hardware, firmware, or a combination thereof.
  • the software or firmware includes, but is not limited to, computer program instructions or code, and may be executed by a hardware processor.
  • the hardware includes but is not limited to various types of integrated circuits, such as CPU, DSP, FPGA or ASIC.
  • Figure 8 shows a schematic block diagram of a data reading and writing device 600 provided by an embodiment of the present application.
  • the data reading and writing device 600 may include a sub-control system 601, a storage area 602 and a reading and writing channel 603.
  • the storage The area 602 is coupled to the read-write channel 603, and the sub-control system 601 is used to control the read-write channel 603 to be in a conductive state or a closed state.
  • the control device can perform data read-write operations on the storage area 602 through the read-write channel 603; conversely, when the sub-control When the system 601 controls the read-write channel 603 to be in a disconnected state, the control device cannot perform data read-write operations on the storage area 602 through the read-write channel 603, that is, the control device uses the read-write channel 603 to perform data reading and writing operations on the storage area 602. Data read and write operations performed will be prohibited (or blocked).
  • the data reading and writing device 600 can be specifically the storage device in the above method 200, and the data reading and writing device 600 can be the physical hardware structure of the data reading and writing device 500, The data reading and writing device 600 can be used to perform various processes and/or steps corresponding to the storage device in the above-mentioned method 200 embodiment. To avoid duplication, they will not be described again here.
  • the sub-control system 601 is used to receive first control information from the control device within a first time period, and the first control information is used to control the read-write channel of the data read-write device to be in the leading position during the second time period.
  • the first time period is used for the control device and the data reading and writing device to transmit control information
  • the second time period is used for the control device and the data reading and writing device to transmit data; based on the The first control information controls the read-write channel 603 to be in a conductive state during the second time period.
  • the sub-control system 601 may include a read-write controller, which is used to control the conduction or disconnection of the read-write channel 603.
  • the storage area 602 may be a non-volatile storage area.
  • the storage area can include persistent storage particles.
  • the sub-control system 601 is also configured to receive second control information from the control device within a third time period, and the second control information is used to control the read-write channel in a fourth time period.
  • the third time period is used for the control device and the storage device to transmit control information
  • the fourth time period is used for the control device and the storage device to transmit data; based on The second control information controls the read-write channel 603 to be in a conductive state during the fourth time period.
  • the sub-control system 601 is also used to control the read-write channel 603 to be in a disconnected state from the end of the second time period.
  • the sub-control system 601 is specifically configured to authenticate the first control information and obtain an authentication result, which includes authentication success or authentication failure; when the authentication result is authentication success, the control The read/write channel 603 is in a conductive state during the second time period.
  • the sub-control system 601 may include an authenticator, which is used to authenticate the first control information.
  • the first control information is encrypted with a session key
  • the sub-control system 601 is also configured to authenticate the first control information and obtain the authentication result based on the session key. , decrypt the first control information to obtain the first initial control information; the sub-control system 601 is specifically used to authenticate the first initial control information to obtain the authentication result.
  • the sub-control system 601 may include a decryptor, which is used to decrypt the first control information based on the session key to obtain the first initial control information.
  • a decryptor which is used to decrypt the first control information based on the session key to obtain the first initial control information.
  • the sub-control system 601 is also configured to perform key negotiation with the control device before decrypting the first control information based on the session key to obtain the first initial control information. Get the session key.
  • the sub-control system 601 may include a key negotiator, which is used to perform key negotiation with the control device to obtain the session key.
  • the sub-control system 601 is specifically configured to perform key negotiation with the control device based on a preset symmetric key to obtain the session key.
  • the sub-control system 601 in the data reading and writing device 600 can be implemented using a high security mechanism to ensure the security of data reading and writing.
  • the above-mentioned high-security mechanisms include but are not limited to: using a dedicated high-security encryption and decryption engine to encrypt and decrypt important internal registers and combinational logic; or encrypting and decrypting various keys and/or control information (such as the first control information). ) to perform double backup (that is, backup separately in the register and persistent memory area) to prevent attacks.
  • each session key and/or each control information (such as the first control information) is saved in a register (or trigger) in the sub-control system 601 when the sub-control system 601 is powered on.
  • each session key and/or each control information can be obtained directly from the register (or trigger) during the data reading and writing process.
  • the sub-control system 601 can backup each session key and each control information in the persistent memory (ie, the storage area 602).
  • the session keys and control information are saved in the register (or trigger).
  • Each session key and/or each control information will be erased or released.
  • the sub-control system 601 can read each session key and/or each control information from the persistent memory.
  • the data reading and writing device 600 may be a chip device.
  • the chip device can also include one or more memories for storing computer execution instructions.
  • the processor can execute the computer execution instructions stored in the memory, so that the chip device executes the above command transmission method. .
  • the chip device can be a field programmable gate array, a dedicated integrated chip, a system chip, a central processing unit, a network processor, a digital signal processing circuit, a microcontroller, or a programmable controller that implements related functions. or other integrated chips.
  • the size of the sequence numbers of the above-mentioned processes does not mean the order of execution.
  • the execution order of each process should be determined by its functions and internal logic, and should not be used in the embodiments of the present application.
  • the implementation process constitutes any limitation.
  • the disclosed systems, devices and methods can be implemented in other ways.
  • the device embodiments described above are only illustrative.
  • the division of the units is only a logical function division. In actual implementation, there may be other division methods.
  • multiple units or components may be combined or can be integrated into another system, or some features can be ignored, or not implemented.
  • the coupling or direct coupling or communication connection between each other shown or discussed may be through some interfaces, and the indirect coupling or communication connection of the devices or units may be in electrical, mechanical or other forms.
  • the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place, or they may be distributed to multiple network units. Some or all of the units can be selected according to actual needs to achieve the purpose of the solution of this embodiment.
  • each functional unit in each embodiment of the present application can be integrated into one processing unit, each unit can exist physically alone, or two or more units can be integrated into one unit.
  • the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium.
  • the technical solution of the present application is essentially or the part that contributes to the existing technology or the part of the technical solution can be embodied in the form of a software product.
  • the computer software product is stored in a storage medium, including Several instructions are used to cause a computer device (which may be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in various embodiments of this application.
  • the aforementioned storage media include: U disk, mobile hard disk, Read Only Memory (ROM), Random Access Memory (RAM), magnetic disk or optical disk and other media that can store program code.

Landscapes

  • Storage Device Security (AREA)

Abstract

本申请提供一种数据读写控制方法和装置，能够提高数据读写的安全性。该方法可以包括：控制装置在第一时间段内向存储装置发送第一控制信息，该第一控制信息用于控制该存储装置的读写通道在第二时间段内处于导通状态；该控制装置基于该第一控制信息，在该第二时间段内对该存储装置进行数据读取和/或数据写入操作。

Description

一种数据读写控制方法和装置 技术领域
本申请涉及控制技术领域，并且更具体地，涉及一种数据读写控制方法和装置。
背景技术
为了提高数据的读写速度和存储容量，片上系统(或芯片级系统)(system on chip，SOC)通常搭配高速大容量的片外存储器使用。片外存储器可以包括下电后不保留数据的存储颗粒和/或下电后仍能保留数据的存储颗粒。
然而，若片外存储器包括下电后仍能保留数据的存储颗粒，由于该片外存储器下电后，数据仍然会保留在该片外存储器内，攻击者可以很容易的获取该片外存储器中存储的数据或对数据进行修改。这样，一旦SOC重新读取已经被攻击者修改后的数据，就会被修改后的数据误导，因此，数据读写的安全性较差。
发明内容
本申请提供一种数据读写控制方法和装置，能够提高数据读写的安全性。
第一方面，本申请提供一种数据读写控制方法，该方法可以包括：控制装置在第一时间段内向存储装置发送第一控制信息，该第一控制信息用于控制该存储装置的读写通道在第二时间段内处于导通状态，该第一时间段用于该控制装置与该存储装置传输控制信息，该第二时间段用于该控制装置与该存储装置传输数据；该控制装置基于该第一控制信息，在该第二时间段内对该存储装置进行数据读取和/或数据写入操作。
需要说明的是，本申请中所述的数据读取和/或数据写入可以简称为数据读写。
采用本申请实施例提供的数据读写控制方法，控制装置通过第一控制信息，控制存储装置的读写通道在第二时间段内处于导通状态，即获得在该第二时间段内对该存储装置进行数据读写操作的权限，这样，控制装置只能在授权的第二时间段内对该存储装置进行数据读取和/或数据写入操作，因此，能够提高数据读写的安全性。
可选地，本申请对该第一时间段和该第二时间段的时长不做限定。也就是说，该第一时间段和该第二时间段的时长可以相等或不等。
示例的，为保证连贯使用，该第一时间段的时长可以小于该第二时间段的时长。
在一种可能的实现方式中，该第二时间段的起始时刻晚于该第一时间段的起始时刻。
在一种可能的实现方式中，该方法还包括：该控制装置在第三时间段内向该存储装置发送第二控制信息，该第二控制信息用于控制该读写通道在第四时间段内处于导通状态，该第三时间段用于该控制装置与该存储装置传输控制信息，该第四时间段用于该控制装置与该存储装置传输数据；该控制装置基于该第二控制信息，在该第四时间段内对该存储装置进行数据读取和/或数据写入操作。
也就是说，该第一时间段和该第三时间段用于该控制装置与该存储装置传输控制信息，该第一时间段与该第三时间段不同。该第二时间段和该第四时间段用于该控制装置与 该存储装置传输控制信息，该第二时间段与该第四时间段不同。
可选地，该第一时间段与该第三时间段可以部分重叠或完全不重叠，本申请实施例对此不做限定。
在一种可能的实现方式中，该方法还包括：该控制装置从该第二时间段的结束时刻起，停止对该存储装置进行数据读取和/或数据写入操作。
采用本申请实施例提供的数据读写控制方法，控制装置只能在控制信息授权的时间段内传输数据，从该授权的时间段的结束时刻起，该控制装置不再具有对存储装置进行数据读写操作的权限，也就是说，从该第二时间段的结束时刻起，该控制装置对该存储装置的数据读取和/或数据写入操作被禁止(或阻止)。因此，数据读写的安全性较高。
在一种可能的实现方式中，该第一控制信息是经过会话密钥加密的，在该控制装置在第一时间段内向存储装置发送第一控制信息之前，该方法还包括：该控制装置与该存储装置进行密钥协商，得到该会话密钥。
采用本申请实施例提供的数据读写控制方法，通过会话密钥对控制装置和存储装置之间的会话数据(如第一控制信息、第二控制信息)进行加密，能够提高数据传输过程中的安全性。
在一种可能的实现方式中，该控制装置与该存储装置进行密钥协商，得到该会话密钥，包括：该控制装置与该存储装置基于预置的对称密钥进行密钥协商，得到该会话密钥。
采用本申请实施例提供的数据读写控制方法，控制装置和存储装置通过预置的对称密钥进行密钥协商得到会话密钥，这样，如果由于控制装置或者存储装置下电或其他原因导致会话密钥丢失时，可以直接根据该对称密钥重新生成会话密钥，而无需重新获取该对称密钥，能够提高数据传输的效率。
在一种可能的实现方式中，各会话密钥和/或各控制信息(如第一控制信息)，在该控制装置上电的时候保存在该控制装置中的寄存器(或存储单元)中，在数据读写过程中该控制装置可以直接从寄存器(或存储单元)中获取各会话密钥和/或各控制信息。此外，该控制装置可以将各会话密钥和各控制信息备份保存在专用存储区(或专用存储器)中，当该控制装置下电的时候，闪存/寄存器中保存的各会话密钥和/或各控制信息会擦除或释放，这时，该控制装置可以从专用存储区(或专用存储器)中直接读取各会话密钥和/或各控制信息。
第二方面，本申请还提供一种数据读写控制方法，该方法可以包括：存储装置在第一时间段内接收来自控制装置的第一控制信息，该第一控制信息用于控制该存储装置的读写通道在第二时间段内处于导通状态，该第一时间段用于该控制装置与该存储装置传输控制信息，该第二时间段用于该控制装置与该存储装置传输数据；该存储装置基于该第一控制信息，控制该读写开关在该第二时间段内处于打开状态。
需要说明的是，本申请中所述的数据读取和/或数据写入可以简称为数据读写。
采用本申请实施例提供的数据读写控制方法，控制装置通过第一控制信息，控制存储装置的读写通道在第二时间段内处于导通状态，即获得在该第二时间段内对该存储装置进行数据读写操作的权限，这样，控制装置只能在授权的第二时间段内对该存储装置进行数据读取和/或数据写入操作，因此，能够提高数据读写的安全性。
可选地，本申请对该第一时间段和该第二时间段的时长不做限定。也就是说，该第一 时间段和该第二时间段的时长可以相等或不等。
示例的，为保证连贯使用，该第一时间段的时长可以小于该第二时间段的时长。
在一种可能的实现方式中，该第二时间段的起始时刻晚于该第一时间段的起始时刻。
在一种可能的实现方式中，该方法还包括：该存储装置在第三时间段内接收来自该控制装置第二控制信息，该第二控制信息用于控制该读写通道在第四时间段内处于导通状态，该第三时间段用于该控制装置与该存储装置传输控制信息，该第四时间段用于该控制装置与该存储装置传输数据；该存储装置基于该第二控制信息，控制该读写通道在该第四时间段内处于导通状态。
也就是说，该第一时间段和该第三时间段用于该控制装置与该存储装置传输控制信息，该第一时间段与该第三时间段不同。该第二时间段和该第四时间段用于该控制装置与该存储装置传输控制信息，该第二时间段与该第四时间段不同。
可选地，该第一时间段与该第三时间段可以部分重叠或完全不重叠，本申请实施例对此不做限定。
在一种可能的实现方式中，该方法还包括：该存储装置控制该读写通道从该第二时间段的结束时刻起处于断开状态。
采用本申请实施例提供的数据读写控制方法，控制装置只能在控制信息授权的时间段内传输数据，从该授权的时间段的结束时刻起，该控制装置不再具有对存储装置进行数据读写操作的权限，也就是说，从该第二时间段的结束时刻起，该控制装置对该存储装置的数据读取和/或数据写入操作被禁止(或阻止)。因此，数据读写的安全性较高。
在一种可能的实现方式中，该存储装置基于该第一控制信息，控制该读写通道在该第二时间段内处于导通状态，包括：该存储装置对该第一控制信息进行认证，得到认证结果，该认证结果包括认证成功或认证失败；当该认证结果为认证成功时，该存储装置控制该读写通道在该第二时间段内处于导通状态。
采用本申请实施例提供的数据读写控制方法，存储装置需要对第一控制信息进行认证，只有在认证成功的情况下，才会授予控制装置进行数据读写的权限，如果认证失败，则阻止控制装置进行数据读写。这样，能够提高数据读写的安全性。
在一种可能的实现方式中，该第一控制信息是经过会话密钥加密的，在该存储装置对该第一控制信息进行认证，得到认证结果之前，该方法还包括：该存储装置基于该会话密钥，对该第一控制信息进行解密，得到第一初始控制信息；该存储装置对该第一控制信息进行认证，得到认证结果，包括：该存储装置对该第一初始控制信息进行认证，得到该认证结果。
在一种可能的实现方式中，在该存储装置基于该会话密钥，对该第一控制信息进行解密，得到第一初始控制信息之前，该方法还包括：该存储装置与该控制装置进行密钥协商，得到该会话密钥。
采用本申请实施例提供的数据读写控制方法，通过会话密钥对控制装置和存储装置之间的会话数据(如第一控制信息)进行加密，能够提高数据传输过程中的安全性。
在一种可能的实现方式中，该存储装置与该控制装置进行密钥协商，得到该会话密钥，包括：该存储装置与该控制装置基于预置的对称密钥进行密钥协商，得到该会话密钥。
采用本申请实施例提供的数据读写控制方法，控制装置和存储装置通过预置的对称密 钥进行密钥协商得到会话密钥，这样，如果由于控制装置或者存储装置下电或其他原因导致会话密钥丢失，则可以直接根据该对称密钥重新生成会话密钥，而无需重新再重新获取该对称密钥，能够提高数据传输的效率。
在一种可能的实现方式中，各会话密钥和/或各控制信息(如第一控制信息)，在该存储装置上电的时候保存在该存储装置中的寄存器(或触发器)中，在数据读写过程中该存储装置可以直接从寄存器(或触发器)中获取各会话密钥和/或各控制信息。此外，该存储装置可以将各会话密钥和各控制信息备份保存在持久化内存中，当该存储装置下电的时候，触发器或寄存器中保存的各会话密钥和/或各控制信息会擦除或释放，这时，该存储装置可以从持久化内存中直接读取各会话密钥和/或各控制信息。
第三方面，本申请还提供一种数据读写控制装置，该装置可以包括：发送模块，用于在第一时间段内向存储装置发送第一控制信息，该第一控制信息用于控制该存储装置的读写通道在第二时间段内处于导通状态，该第一时间段用于该数据读写控制装置与该存储装置传输控制信息，该第二时间段用于该数据读写控制装置与该存储装置传输数据；读写模块，用于基于该第一控制信息，在该第二时间段内对该存储装置进行数据读取和/或数据写入操作。
在一种可能的实现方式中，该发送模块还可用于在第三时间段内向该存储装置发送第二控制信息，该第二控制信息用于控制该读写通道在第四时间段内处于导通状态，该第三时间段用于该控制装置与该存储装置传输控制信息，该第四时间段用于该控制装置与该存储装置传输数据；该读写模块还用于基于该第二控制信息，在该第四时间段内对该存储装置进行数据读取和/或数据写入操作。
在一种可能的实现方式中，该读写模块还用于从该第二时间段的结束时刻起，停止对该存储装置进行数据读取和/或数据写入操作。
在一种可能的实现方式中，该第一控制信息是经过会话密钥加密的，该装置还包括密钥协商模块；该密钥协商模块用于在该发送模块在第一时间段内向存储装置发送第一控制信息之前，与该存储装置进行密钥协商，得到该会话密钥。
在一种可能的实现方式中，该密钥协商模块具体用于与该存储装置基于预置的对称密钥进行密钥协商，得到该会话密钥。
第四方面，本申请还提供一种数据读写装置，该装置可以包括：接收模块，用于在第一时间段内接收来自控制装置的第一控制信息，该第一控制信息用于控制该数据读写装置的读写通道在第二时间段内处于导通状态，该第一时间段用于该控制装置与该数据读写装置传输控制信息，该第二时间段用于该控制装置与该数据读写装置传输数据；控制模块，用于基于该第一控制信息，控制该读写通道在该第二时间段内处于导通状态。
在一种可能的实现方式中，该接收模块还用于在第三时间段内接收来自该控制装置第二控制信息，该第二控制信息用于控制该读写通道在第四时间段内处于导通状态，该第三时间段用于该控制装置与该数据读写装置传输控制信息，该第四时间段用于该控制装置与该数据读写装置传输数据；该控制模块还用于基于该第二控制信息，控制该读写通道在该第四时间段内处于导通状态。
在一种可能的实现方式中，该装置还包括：该控制模块还用于控制该读写通道从该第二时间段的结束时刻起处于断开状态。
在一种可能的实现方式中，该装置还包括认证模块；该认证模块用于对该第一控制信息进行认证，得到认证结果，该认证结果包括认证成功或认证失败；该控制模块具体用于当该认证结果为认证成功时，控制该读写通道在该第二时间段内处于导通状态。
在一种可能的实现方式中，该第一控制信息是经过会话密钥加密的，该装置还包括：解密模块；该解密模块用于在该认证模块对该第一控制信息进行认证，得到认证结果之前，基于该会话密钥，对该第一控制信息进行解密，得到第一初始控制信息；该认证模块具体用于对该第一初始控制信息进行认证，得到该认证结果。
在一种可能的实现方式中，该装置还包括：密钥协商模块；该密钥协商模块用于在该解密模块基于该会话密钥，对该第一控制信息进行解密，得到第一初始控制信息之前，与该控制装置进行密钥协商，得到该会话密钥。
在一种可能的实现方式中，该密钥协商模块具体用于与该控制装置基于预置的对称密钥进行密钥协商，得到该会话密钥。
第五方面，本申请还提供一种数据读写控制装置，该装置可以包括控制器和通信接口，该控制器和该通信接口耦合。该通信接口用于向该控制器输入数据(如待写入存储装置的数据)和/或从该控制器输出数据(如从存储装置中读取的数据)；该控制器用于运行计算机程序或指令，以使该装置实现上述第一方面或其各种可能的实现方式中所述的方法。
在一种可能的实现方式中，该数据读写控制装置可以具体为上述第一方面或其各种可能的实现方式中所述的控制装置。
第六方面，本申请还提供一种数据读写装置，该装置可以包括控制器、存储区和读写通道，该存储区和该读写通道耦合，该控制器用于控制该读写通道处于导通状态或闭合状态。
需要说明的是，当该控制器控制该读写通道处于导通状态时，控制装置可以通过该读写通道对该存储区进行数据读写；反之，当该控制器控制该读写通道处于断开状态时，控制装置无法通过该读写通道对该存储区进行数据读写，即不具备通过该读写通道对该存储区进行数据读写的权限。
在一种可能的实现方式中，该数据读写装置可以具体为上述第二方面或其各种可能的实现方式中所述的存储装置。
第七方面，本申请还提供一种计算机可读存储介质，用于存储计算机程序，其特征在于，该计算机程序包括用于实现上述各方面或其任意可能的实现方式中所述的方法的指令。
第八方面，本申请还提供一种计算机程序产品，该计算机程序产品中包含指令，其特征在于，当该指令在计算机或处理器上运行时，使得该计算机或该处理器实现上述各方面或其任意可能的实现方式中所述的方法。
本申请提供的数据读写控制装置、数据读写装置、计算机存储介质和计算机程序产品均用于执行上文所提供的数据读写控制方法，因此，其所能达到的有益效果可参考上文所提供的数据读写控制方法中的有益效果，此处不再赘述。
附图说明
图1提供了本申请实施例的数据读写控制系统100的示意性框图；
图2提供了本申请实施例的应用场景示意图；
图3提供了本申请实施例的另一应用场景示意图；
图4提供了本申请实施例的数据读写控制方法200的示意性流程图；
图5提供了本申请实施例的数据读写控制装置300的示意性框图；
图6提供了本申请实施例的数据读写控制装置400的示意性框图；
图7提供了本申请实施例提供的数据读写装置500的示意性框图；
图8提供了本申请实施例提供的数据读写装置600的示意性框图。
具体实施方式
下面将结合本申请中的附图，对本申请中的技术方案进行描述。
本申请的说明书实施例和权利要求书及附图中的术语“第一”、“第二”等仅用于区分描述的目的，而不能理解为指示或暗示相对重要性，也不能理解为指示或暗示顺序。此外，术语“包括”和“具有”以及他们的任何变形，意图在于覆盖不排他的包含，例如，包含了一系列步骤或单元。方法、系统、产品或设备不必限于清楚地列出的那些步骤或单元，而是可包括没有清楚地列出的或对于这些过程、方法、产品或设备固有的其它步骤或单元。
应当理解，在本申请中，“至少一个(项)”是指一个或者多个，“多个”是指两个或两个以上。“和/或”，用于描述关联对象的关联关系，表示可以存在三种关系，例如，“A和/或B”可以表示：只存在A，只存在B以及同时存在A和B三种情况，其中A，B可以是单数或者复数。字符“/”一般表示前后关联对象是一种“或”的关系。“以下至少一项(个)”或其类似表达，是指这些项中的任意组合，包括单项(个)或复数项(个)的任意组合。例如，a，b或c中的至少一项(个)，可以表示：a、b、c、“a和b”、“a和c”、“b和c”、或“a和b和c”，其中a，b，c可以是单个，也可以是多个。
首先，请参考图1，图1示出了本申请实施例提供的数据读写控制系统100的示意性框图。该系统100可以包括控制装置110和存储装置120，其中，该控制装置110可以对该存储装置120进行数据读写操作。
在一种可能的实现方式中，该存储装置120中可以包括下电后仍能保留数据的存储颗粒，如持久化内存(persistent memory)。
可选地，该系统100可以应用于多种应用场景，本申请实施例对此不做限定。
在一种可能的实现方式中，该系统100可以用于终端。
可选地，本申请所述的终端可以为运输工具或者智能设备。其中，该终端可以为机动车辆(如无人车、智能车、电动车、数字汽车等)、无人机、轨道车、自行车、交通灯等。该终端可以为手机、平板电脑、笔记本电脑、个人数字助理、销售终端、增强现实设备、虚拟现实、可穿戴设备等。
示例的，以该系统100用于手机为例，图2示出了本申请实施例提供的应用场景示意图。如图2所示，该控制装置110可以为片上系统(芯片级系统)SOC，对应的，该存储装置120可以为该SOC的片外存储器。
在另一种可能的实现方式中，该系统100可以用于云侧。
示例的，以该系统100用于云侧为例，图3示出了本申请实施例提供的另一应用场景示意图。如图3所示，该控制装置110可以为小芯片(chiplet)，对应的，该存储装置120 可以为该chiplet的外部存储器。
图4示出了本申请实施例提供的数据读写控制方法200。该方法200可以用于图1中所述的系统100。如图4所示，该方法200可以包括以下步骤，需要说明的是，以下所列步骤可以以各种顺序执行和/或同时发生，不限于图4所示的执行顺序。
S201.控制装置在第一时间段内向存储装置发送第一控制信息，该第一控制信息用于控制该存储装置的读写通道在第二时间段内处于导通状态，该第一时间段用于该控制装置与该存储装置传输控制信息，该第二时间段用于该控制装置与该存储装置传输数据。
需要说明的是，本申请中所述的数据读取和/或数据写入可以简称为数据读写。
可选地，本申请对该第一时间段和该第二时间段的时长不做限定。也就是说，该第一时间段和该第二时间段的时长可以相等或不等。
示例的，为保证连贯使用，该第一时间段的时长可以小于该第二时间段的时长。
在一种可能的实现方式中，该第二时间段的起始时刻晚于该第一时间段的起始时刻。
在一种可能的实现方式中，该第一控制信息可以是经过会话密钥加密的。也就是说，该控制装置与该存储装置之间可以基于该会话密钥对往来会话进行加解密，这样能够提高该控制装置与该存储装置之间会话的安全性。
可选地，该控制装置和该存储装置均可以保存各自使用的会话密钥。
可选地，该控制装置和该存储装置均可以保存该第一控制信息。
可选地，在S201之前，该方法还包括：该控制装置基于该会话密钥对第一初始控制信息进行加密得到该第一控制信息。也就是说，该第一控制信息是对该第一初始控制信息加密后得到的信息。
相应地，在S201之后，该方法还包括：该存储装置基于该会话密钥对该第一控制信息进行解密，得到该第一初始控制信息。
可选地，该控制装置和该存储装置可以通过多种方式获取该会话密钥，本申请实施例对此不做限定。
在一种可能的实现方式中，该控制装置与该存储装置可以在出厂时预配置该会话密钥。
在另一种可能的实现方式中，该控制装置与该存储装置可以进行密钥协商，以得到该会话密钥。
需要说明的是，本申请实施例中所述的密钥协商是指该控制装置与该存储装置之间通过握手(Shakehand)完成会话密钥的协商。
可选地，该控制装置与该存储装置可以通过预置的对称密钥进行密钥协商，得到该会话密钥；或可以通过非对称密钥进行密钥协商，得到该会话密钥，本申请对此不做限定。
可选地，该预置的对称密钥可以为该控制装置与该存储装置在出厂前绑定得到的。
可选地，该控制装置与该存储装置可以通过多种方式进行密钥协商，本申请对此不作限定。
示例的，该控制装置与该存储装置可以通过以下步骤(1)至(15)完成密钥协商流程：
(1)该控制装置判断为上电第一次操作，则启动认证对接过程。
(2)该控制装置生成随机数R_A。
(3)该控制装置通过预置的对称密钥，对该随机数R_A进行加密，得到加密随机数M(R_A)。
(4)该控制装置向该存储装置的地址ADDR_A0发送该M(R_A)；相应地，该存储装置接收来自该控制装置的该M(R_A)。
(5)该存储装置生成随机数R_B。
(6)该存储装置通过该对称密钥，对该M(R_A)进行解密，得到R_A；在该R_A后附加该R_B，得到组合数R_A+R_B；通过该对称密钥，对该R_A+R_B进行加密，得到加密组合数M(R_A+R_B)；最后将该M(R_A+R_B)保存至地址ADDR_A1。
(7)该控制装置从该存储装置的地址ADDR-A1读取该M(R_A+R_B)。
(8)该控制装置通过该对称密钥，对该M(R_A+R_B)进行解密，得到R_A+R_B。
(9)该控制装置判断解密得到的R_A和本地生成的R_A是否一致，若一致，则确定解密得到的R_B正确。
(10)该控制装置通过该对称密钥，对R_B进行加密，得到加密随机数M(R_B)。
(11)该控制装置向该存储装置的地址ADDR_A2发送该M(R_A)和该M(R_B)。
(12)当该存储装置的地址ADDR_A2收到该M(R_A)和该M(R_B)时，该存储装置确定密钥协商完成，将用于指示密钥协商完成的密钥协商完成标志存入地址ADDR_A3。
(13)该控制装置从该存储装置的地址ADDR_A3读取该密钥协商完成标志，并基于该密钥协商完成标志确定密钥协商完成。
(14)该控制装置对该M(R_A)和该M(R_B)分别进行解密，得到该R_A和该R_B。
(15)该控制装置基于该R_A和该R_B，确定会话密钥。如将R_A+R_B作为该会话密钥。
S202.该存储装置基于该第一控制信息，控制该读写通道在该第二时间段内处于导通状态。
需要说明的是，当该读写通道处于导通状态时，控制装置可以通过该读写通道对该存储装置进行数据读写操作；反之，当该读写通道处于断开状态时，控制装置不能通过该读写通道对该存储装置进行数据读写操作哦，即控制装置通过该读写通道对该存储装置进行数据读写的操作将被阻止。
在一种可能的实现方式中，S202可以包括：该存储装置对该第一控制信息进行认证，得到认证结果，该认证结果包括认证成功或认证失败；当该认证结果为认证成功时，该存储装置控制该读写通道在该第二时间段内处于导通状态。
可选地，该存储装置可以对上述第一初始控制信息进行认证，得到该认证结果。
可选地，本申请对该第一控制信息的具体内容不做限定。
在一种可能的实现方式中，该第一控制信息可以为第一数值。
示例的，若该第一控制信息是该控制装置首次发送的控制信息，则该第一数值可以为随机数值。相应地，该存储装置确定该第一数值与预设的初始数值之间的差值小于第一阈值时，确定该认证结果为认证成功，反之，确定该认证结果为认证失败。
示例的，若该第一控制信息不是该控制装置首次发送的控制信息，则该第一数值可以 大于第二数值，该第二数值可以为该控制装置在发送该第一控制信息的前一次所发送的控制信息；相应地，该存储装置确定该第一数值大于该第二数值时，确定该认证结果为认证成功，反之，确定该认证结果为认证失败。
S203.该控制装置基于该第一控制信息，在该第二时间段内对该存储装置进行数据读取和/或数据写入操作。
进一步地，该控制装置从该第二时间段的结束时刻起，停止对该存储装置进行数据读取和/或数据写入操作。也就是说，从该第二时间段的结束时刻起，该控制装置对该存储装置的数据读取和/或数据写入操作被禁止(或阻止)。
可选地，在该存储装置对该第一控制信息认证成功之后，S203之前，该存储装置可以向该控制装置发送反馈信息，该反馈信息用于反馈该读写通道已导通；相应地，S203可以包括：该控制装置基于该第一控制信息和该反馈信息，在该第二时间段内对该存储装置进行数据读写操作。
可选地，该方法200还可以包括：该控制装置在第三时间段内向该存储装置发送第二控制信息，该第二控制信息用于控制该读写通道在第四时间段内处于导通状态，该第三时间段用于该控制装置与该存储装置传输控制信息，该第四时间段用于该控制装置与该存储装置传输数据；该控制装置基于该第二控制信息，在该第四时间段内对该存储装置进行数据读取和/或数据写入操作。
也就是说，该第一时间段和该第三时间段用于该控制装置与该存储装置传输控制信息，该第一时间段与该第三时间段不同。该第二时间段和该第四时间段用于该控制装置与该存储装置传输控制信息，该第二时间段与该第四时间段不同。
可选地，该第一时间段与该第三时间段可以部分重叠或完全不重叠，本申请实施例对此不做限定。
在一种可能的实现方式中，该控制装置与该存储装置之间的数据读写控制方法可以包括以下步骤(a)至(h)：
(a)控制装置与存储装置在出厂前进行绑定，得到预置的对称密钥。
(b)该控制装置与该存储装置基于该对称密钥进行密钥协商，以得到会话密钥。
(c)该控制装置基于该会话密钥对第一初始控制信息进行加密，得到第一控制信息，该第一控制信息用于控制该存储装置的读写通道在第二时间段内处于导通状态。
(d)该控制装置在第一时间段内向该存储装置发送该第一控制信息。
(e)该存储装置基于该会话密钥进行解密，得到该第一初始控制信息。
(f)该存储装置对该第一初始控制信息进行认证，得到认证结果，该认证结果包括认证成功或认证失败。
(g)当该认证结果为认证成功时，该存储装置控制该读写通道在该第二时间段内处于导通状态。
(h)该控制装置基于该第一控制信息，在该第二时间段内对该存储装置进行数据读写操作。
可选地，在步骤(h)之后，该方法还可以包括以下步骤(i)至(j)：
(i)该存储装置控制所述读写通道从所述第二时间段的结束时刻起处于断开状态。
(j)该控制装置从所述第二时间段的结束时刻起，停止对所述存储装置进行数据读 写操作。
也就是说，该控制装置从该第二时间段的结束时刻起，不再具有对该存储装置进行读写操作的权限，也即是，该控制装置对该存储装置的读写操作会被阻止。
可选地，该方法还可以包括以下步骤(k)至(r)。需要说明的是，该步骤(k)至步骤(r)与上述步骤(c)至步骤(j)为两个独立的数据读写控制过程，本申请对上述两个数据读写控制过程的执行顺序不做限定。
(k)该控制装置基于该会话密钥对第二初始控制信息进行加密，得到第二控制信息，该第二控制信息用于控制该存储装置的读写通道在第四时间段内处于导通状态。
(l)该控制装置在第三时间段内向该存储装置发送该第二控制信息。
(m)该存储装置基于该会话密钥进行解密，得到该第二初始控制信息。
(n)该存储装置对该第二初始控制信息进行认证，得到认证结果，该认证结果包括认证成功或认证失败。
(o)当该认证结果为认证成功时，该存储装置控制该读存储装置的读写通道在该第四时间段内处于导通状态。
(p)该控制装置基于该第二控制信息，在该第四时间段内对该存储装置进行数据读写操作。
可选地，在步骤(p)之后，该方法还可以包括以下步骤(q)至(r)：
(q)该存储装置控制所述读写通道从所述第四时间段的结束时刻起处于断开状态。
(r)该控制装置从所述第四时间段的结束时刻起，停止对所述存储装置进行数据读写操作。
图5示出了本申请实施例提供的数据读写控制装置300的示意性框图。如图5所示，该数据读写控制装置300可以包括发送模块301和读写模块302。
可选地，该数据读写控制装置300可以用于上述系统100，进一步地，该数据读写控制装置300可以用于上述系统100中的控制装置110，如由控制装置110上的处理器或控制器执行的软件形成的虚拟装置。
该发送模块301用于在第一时间段内向存储装置发送第一控制信息，所述第一控制信息用于控制所述存储装置的读写通道在第二时间段内处于导通状态，所述第一时间段用于所述数据读写控制装置与所述存储装置传输控制信息，所述第二时间段用于所述数据读写控制装置与所述存储装置传输数据。
该读写模块302用于基于所述第一控制信息，在所述第二时间段内对所述存储装置进行数据读取和/或数据写入操作。
在一种可能的实现方式中，该发送模块301还用于在第三时间段内向所述存储装置发送第二控制信息，所述第二控制信息用于控制所述读写通道在第四时间段内处于导通状态，所述第三时间段用于所述控制装置与所述存储装置传输控制信息，所述第四时间段用于所述控制装置与所述存储装置传输数据；该读写模块302还用于基于所述第二控制信息，在所述第四时间段内对所述存储装置进行数据读取和/或数据写入操作。
在一种可能的实现方式中，该发送模块301还用于从所述第二时间段的结束时刻起，停止对所述存储装置进行数据读取和/或数据写入操作。
可选地，所述第一控制信息是经过会话密钥加密的，该数据读写控制装置300还可以包括加密模块303。
在一种可能的实现方式中，该加密模块303还用于在该发送模块301在第一时间段内向存储装置发送第一控制信息之前，基于所述会话密钥，对第一初始控制信息进行加密，得到所述第一控制信息。
可选地，该数据读写控制装置300还可以包括密钥协商模块304。
在一种可能的实现方式中，该第一控制信息是经过会话密钥加密的，该密钥协商模块304用于在该发送模块301在第一时间段内向存储装置发送第一控制信息之前，与所述存储装置进行密钥协商，得到所述会话密钥。
在一种可能的实现方式中，该密钥协商模块303具体用于与所述存储装置基于预置的对称密钥进行密钥协商，得到所述会话密钥。
需要说明的是，上述装置之间的信息交互、执行过程等内容，由于与本申请方法实施例基于同一构思，其具体功能及带来的技术效果，具体可参见方法实施例部分，此处不再赘述。在一个可选例子中，该数据读写控制装置300可以具体为上述方法200实施例中的控制装置，该数据读写控制装置300可以用于执行上述方法200实施例中与控制装置对应的各个流程和/或步骤，为避免重复，在此不再赘述。
图5所示实施例中的各个模块中的一个或多个可以通过软件、硬件、固件或其结合实现。所述软件或固件包括但不限于计算机程序指令或代码，并可以被硬件处理器所执行。所述硬件包括但不限于各类集成电路，如中央处理单元(CPU，Central Processing Unit)、数字信号处理器(DSP，Digital Signal Processor)、现场可编程门阵列(FPGA，Field Programmable Gate Array)或专用集成电路(ASIC，Application Specific Integrated Circuit)。
请参见图6，图6示出了本申请实施例提供的数据读写控制装置400的示意性框图，该数据读写控制装置400可以包括控制器401和通信接口402，该控制器401和该通信接口402耦合。
在一个可选例子中，本领域技术人员可以理解，该数据读写控制装置400可以具体为上述方法200中的控制装置，该数据读写控制装置400可以为该数据读写控制装置300的实体硬件结构。该数据读写控制装置400可以用于执行上述方法200实施例中与控制装置对应的各个流程和/或步骤，为避免重复，在此不再赘述。
该通信接口402用于向该控制器401输入数据(如待写入存储装置的数据)和/或从该控制器401输出数据(如从存储装置中读取的数据)；该控制器401用于运行计算机程序或指令，以使该数据读写控制装置400实现上述方法200实施例所描述的方法。
本申请实施例中的控制器401包括但不限于中央处理单元(Central Processing Unit，CPU)、通用处理器、数字信号处理器(Digital Signal Processor，DSP)、专用集成电路(Application Specific Integrated Circuit，ASIC)、现成可编程门阵列(Field Programmable Gate Array，FPGA)、分立门或者晶体管逻辑器件或分立硬件组件等。通用处理器可以是微处理器、微控制器或者是任何常规的处理器等。
例如，该控制器401用于在第一时间段内向存储装置发送第一控制信息，所述第一控制信息用于控制所述存储装置的读写通道在第二时间段内处于导通状态，所述第一时间段用于所述数据读写控制装置与所述存储装置传输控制信息，所述第二时间段用于所述数据 读写控制装置与所述存储装置传输数据；基于所述第一控制信息，在所述第二时间段内通过该通信接口402对所述存储装置进行数据读取和/或数据写入操作。
可选地，该数据读写控制装置400还可以包括存储器403。
该存储器403可以是易失性存储器或非易失性存储器，或可包括易失性和非易失性存储器两者。其中，非易失性存储器可以是只读存储器(Read-Only Memory，ROM)、可编程只读存储器(Programmable ROM，PROM)、可擦除可编程只读存储器(Erasable PROM，EPROM)、电可擦除可编程只读存储器(Electrically EPROM，EEPROM)或闪存。易失性存储器可以是随机存取存储器(Random Access Memory，RAM)，其用作外部高速缓存。通过示例性但不是限制性说明，许多形式的RAM可用，例如静态随机存取存储器(Static RAM，SRAM)、动态随机存取存储器(Dynamic RAM，DRAM)、同步动态随机存取存储器(Synchronous DRAM，SDRAM)、双倍数据速率同步动态随机存取存储器(Double Data Rate SDRAM，DDR SDRAM)、增强型同步动态随机存取存储器(Enhanced SDRAM，ESDRAM)、同步连接动态随机存取存储器(Synchlink DRAM，SLDRAM)和直接内存总线随机存取存储器(Direct Rambus RAM，DR RAM)。
具体地，该存储器403用于存储该数据读写控制装置400的程序代码和指令。可选地，该存储器403还用于存储该控制器401执行上述方法200实施例过程中获得的数据，如会话密钥和各控制信息(如第一控制信息)。
可选地，存储器403可以为单独的器件或集成在控制器401中。
需要说明的是，图6仅仅示出了数据读写控制装置400的简化设计。在实际应用中，该数据读写控制装置400还可以分别包含必要的其他元件，包含但不限于任意数量的通信接口、处理器、控制器、存储器等，而所有可以实现本申请的数据读写控制装置400都在本申请的保护范围之内。
示例的，该数据读写控制装置400中还可以包括加密组件(或加密引擎)，该加密组件与该控制器401耦合，该加密组件用于对该第一初始控制信息进行加密，得到该第一控制信息，也即是，加密过程无需由该控制器通过软件实现，而是由硬件的加密组件实现。
示例的，该数据读写控制装置400中还包括随机数生成器，该随机数生成器与该控制器401耦合，该随机数生成器用于生成用于密钥协商的随机数，也即是，随机数的生成过程无需由控制器通过软件实现，而是由硬件的随机数生成器实现。
在一种可能的设计中，该数据读写控制装置400可以为芯片装置。可选地，该芯片装置还可以包括一个或多个存储器，用于存储计算机执行指令，当该芯片装置运行时，处理器可执行存储器存储的计算机执行指令，以使芯片装置执行上述命令传输方法。
可选地，该芯片装置可以为实现相关功能的现场可编程门阵列，专用集成芯片，系统芯片，中央处理器，网络处理器，数字信号处理电路，微控制器，还可以采用可编程控制器或其他集成芯片。
图7示出了本申请实施例提供的数据读写装置500的示意性框图。该数据读写装置500可以包括：接收模块501和控制模块502。
可选地，该数据读写装置500可以用于上述系统100，进一步地，该数据读写装置500可以用于上述系统100中的存储装置120，如由存储装置120上的处理器或控制器执行的软件形成的虚拟装置。
该接收模块501用于在第一时间段内接收来自控制装置的第一控制信息，所述第一控制信息用于控制所述数据读写装置的读写通道在第二时间段内处于导通状态，所述第一时间段用于所述控制装置与所述数据读写装置传输控制信息，所述第二时间段用于所述控制装置与所述数据读写装置传输数据。
该控制模块502用于基于所述第一控制信息，控制所述读写通道在所述第二时间段内处于导通状态。
在一种可能的实现方式中，该接收模块501还用于在第三时间段内接收来自所述控制装置第二控制信息，所述第二控制信息用于控制所述读写通道在第四时间段内处于导通状态，所述第三时间段用于所述控制装置与所述数据读写装置传输控制信息，所述第四时间段用于所述控制装置与所述数据读写装置传输数据；该控制模块502还用于基于所述第二控制信息，控制所述读写通道在所述第四时间段内处于导通状态。
在一种可能的实现方式中，该接收模块501还用于控制所述读写通道从所述第二时间段的结束时刻起处于断开状态。
可选地，该数据读写装置500还可以包括认证模块503。
在一种可能的实现方式中，该认证模块503用于对所述第一控制信息进行认证，得到认证结果，所述认证结果包括认证成功或认证失败；该控制模块502具体用于当所述认证结果为认证成功时，控制所述读写通道在所述第二时间段内处于导通状态。
可选地，该数据读写装置500还可以包括解密模块504。
在一种可能的实现方式中，所述第一控制信息是经过会话密钥加密的，该解密模块504用于在该认证模块503对所述第一控制信息进行认证，得到认证结果之前，基于所述会话密钥，对所述第一控制信息进行解密，得到第一初始控制信息；该认证模块503具体用于对所述第一初始控制信息进行认证，得到所述认证结果。
可选地，该数据读写装置500还可以包括密钥协商模块505。
在一种可能的实现方式中，该密钥协商模块505用于在所述解密模块基于所述会话密钥，对所述第一控制信息进行解密之前，与所述控制装置进行密钥协商，得到所述会话密钥。
在一种可能的实现方式中，该密钥协商模块505具体用于与所述控制装置基于预置的对称密钥进行密钥协商，得到所述会话密钥。
可选地，该数据读写装置500中的接收模块501、控制模块502、认证模块503、解密模块504和密钥协商模块505中的一个或多个模块可以采用高安机制实现，保证数据读写的安全性。
可选地，上述高安机制包括但不限于：使用专用的高安加解密引擎，对内部的重要寄存器，组合逻辑进行加解密；或者对各类密钥和/或各控制信息(如第一控制信息)进行双备份(即在寄存器和persistent memory区分别进行备份)，以防止攻击。
需要说明的是，上述装置之间的信息交互、执行过程等内容，由于与本申请方法实施例基于同一构思，其具体功能及带来的技术效果，具体可参见方法实施例部分，此处不再赘述。在一个可选例子中，该数据读写装置500可以具体为上述方法200实施例中的存储装置，该数据读写装置500可以用于执行上述方法200中与存储装置对应的各个流程和/或步骤，为避免重复，在此不再赘述。
图7所示实施例中的各个模块中的一个或多个可以通过软件、硬件、固件或其结合实现。所述软件或固件包括但不限于计算机程序指令或代码，并可以被硬件处理器所执行。所述硬件包括但不限于各类集成电路，如CPU、DSP、FPGA或ASIC。
请参见图8，图8示出了本申请实施例提供的数据读写装置600的示意性框图，该数据读写装置600可以包括子控制系统601、存储区602和读写通道603，该存储区602和该读写通道603耦合，该子控制系统601用于控制该读写通道603处于导通状态或闭合状态。
需要说明的是，当该子控制系统601控制该读写通道603处于导通状态时，该控制装置可以通过该读写通道603对该存储区602进行数据读写操作；反之，当该子控制系统601控制该读写通道603处于断开状态时，该控制装置无法通过该读写通道603对该存储区602进行数据读写操作，即该控制装置通过该读写通道603对该存储区602进行的数据读写操作将被禁止(或阻止)。
在一个可选例子中，本领域技术人员可以理解，该数据读写装置600可以具体为上述方法200中的存储装置，该数据读写装置600可以为该数据读写装置500的实体硬件结构，该数据读写装置600可以用于执行上述方法200实施例中与存储装置对应的各个流程和/或步骤，为避免重复，在此不再赘述。
该子控制系统601用于在第一时间段内接收来自控制装置的第一控制信息，所述第一控制信息用于控制所述数据读写装置的读写通道在第二时间段内处于导通状态，所述第一时间段用于所述控制装置与所述数据读写装置传输控制信息，所述第二时间段用于所述控制装置与所述数据读写装置传输数据；基于所述第一控制信息，控制所述读写通道603在所述第二时间段内处于导通状态。
可选地，该子控制系统601中可以包括读写控制器，该读写控制器用于控制该读写通道603的导通或断开。
可选地，该存储区602可以为非易失性存储区。如该存储区可以包括persistent存储颗粒。
在一种可能的实现方式中，该子控制系统601还用于第三时间段内接收来自所述控制装置第二控制信息，所述第二控制信息用于控制所述读写通道在第四时间段内处于导通状态，所述第三时间段用于所述控制装置与所述存储装置传输控制信息，所述第四时间段用于所述控制装置与所述存储装置传输数据；基于所述第二控制信息，控制所述读写通道603在所述第四时间段内处于导通状态。
在一种可能的实现方式中，该子控制系统601还用于控制该读写通道603从该第二时间段的结束时刻起处于断开状态。
在一种可能的实现方式中，该子控制系统601具体用于对该第一控制信息进行认证，得到认证结果，该认证结果包括认证成功或认证失败；当该认证结果为认证成功时，控制该读写通道603在该第二时间段内处于导通状态。
可选地，该子控制系统601中可以包括认证器，该认证器用于对该第一控制信息进行认证。
在一种可能的实现方式中，该第一控制信息是经过会话密钥加密的，该子控制系统601还用于在对该第一控制信息进行认证，得到认证结果之前，基于该会话密钥，对该第 一控制信息进行解密，得到第一初始控制信息；该子控制系统601具体用于对该第一初始控制信息进行认证，得到该认证结果。
可选地，该子控制系统601中可以包括解密器，该解密器用于基于该会话密钥，对该第一控制信息进行解密，得到第一初始控制信息。
在一种可能的实现方式中，该子控制系统601还用于在基于该会话密钥，对该第一控制信息进行解密，得到第一初始控制信息之前，与该控制装置进行密钥协商，得到该会话密钥。
可选地，该子控制系统601中可以包括密钥协商器，该密钥协商器用于与该控制装置进行密钥协商，得到该会话密钥。
在一种可能的实现方式中，该子控制系统601具体用于与该控制装置基于预置的对称密钥进行密钥协商，得到该会话密钥。
可选地，该数据读写装置600中的子控制系统601可以采用高安机制实现，保证数据读写的安全性。
可选地，上述高安机制包括但不限于：使用专用的高安加解密引擎，对内部的重要寄存器，组合逻辑进行加解密；或者对各类密钥和/或各控制信息(如第一控制信息)进行双备份(即在寄存器和persistent memory区分别进行备份)，以防止攻击。
在一种可能的实现方式中，各会话密钥和/或各控制信息(如第一控制信息)，在该子控制系统601上电的时候保存在该子控制系统601中的寄存器(或触发器)中，在数据读写过程中可以直接从寄存器(或触发器)中获取各会话密钥和/或各控制信息。同时，该子控制系统601可以将各会话密钥和各控制信息备份保存在持久化内存(即存储区602)中，当该子控制系统601下电的时候，寄存器(或触发器)中保存的各会话密钥和/或各控制信息会擦除或释放，这时，子控制系统601可以从持久化内存中读取各会话密钥和/或各控制信息。
在一种可能的设计中，该数据读写装置600可以为芯片装置。可选地，该芯片装置还可以包括一个或多个存储器，用于存储计算机执行指令，当该芯片装置运行时，处理器可执行存储器存储的计算机执行指令，以使芯片装置执行上述命令传输方法。
可选地，该芯片装置可以为实现相关功能的现场可编程门阵列，专用集成芯片，系统芯片，中央处理器，网络处理器，数字信号处理电路，微控制器，还可以采用可编程控制器或其他集成芯片。
应理解，在本申请的各种实施例中，上述各过程的序号的大小并不意味着执行顺序的先后，各过程的执行顺序应以其功能和内在逻辑确定，而不应对本申请实施例的实施过程构成任何限定。
本领域普通技术人员可以意识到，结合本文中所公开的实施例描述的各示例的单元及算法步骤，能够以电子硬件、或者计算机软件和电子硬件的结合来实现。这些功能究竟以硬件还是软件方式来执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本申请的范围。
所属领域的技术人员可以清楚地了解到，为描述的方便和简洁，上述描述的系统、装置和单元的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。
在本申请所提供的几个实施例中，应该理解到，所揭露的系统、装置和方法，可以通过其它的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，例如，所述单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，装置或单元的间接耦合或通信连接，可以是电性，机械或其它的形式。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本申请各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。
所述功能如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本申请的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行本申请各个实施例所述方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器(Read Only Memory，ROM)、随机存取存储器(Random Access Memory，RAM)、磁碟或者光盘等各种可以存储程序代码的介质。
以上所述，仅为本申请的具体实施方式，但本申请的保护范围并不局限于此，任何熟悉本技术领域的技术人员在本申请揭露的技术范围内，可轻易想到变化或替换，都应涵盖在本申请的保护范围之内。因此，本申请的保护范围应所述以权利要求的保护范围为准。

Claims (26)

  1. 一种数据读写控制方法，其特征在于，包括：
    控制装置在第一时间段内向存储装置发送第一控制信息，所述第一控制信息用于控制所述存储装置的读写通道在第二时间段内处于导通状态，所述第一时间段用于所述控制装置与所述存储装置传输控制信息，所述第二时间段用于所述控制装置与所述存储装置传输数据；
    所述控制装置基于所述第一控制信息，在所述第二时间段内对所述存储装置进行数据读取和/或数据写入操作。
  2. 根据权利要求1所述的方法，其特征在于，所述方法还包括：
    所述控制装置在第三时间段内向所述存储装置发送第二控制信息，所述第二控制信息用于控制所述读写通道在第四时间段内处于导通状态，所述第三时间段用于所述控制装置与所述存储装置传输控制信息，所述第四时间段用于所述控制装置与所述存储装置传输数据；
    所述控制装置基于所述第二控制信息，在所述第四时间段内对所述存储装置进行数据读取和/或数据写入操作。
  3. 根据权利要求1所述的方法，其特征在于，所述方法还包括：
    所述控制装置从所述第二时间段的结束时刻起，停止对所述存储装置进行数据读取和/或数据写入操作。
  4. 根据权利要求1-3中任一项所述的方法，其特征在于，所述第一控制信息是经过会话密钥加密的，在所述控制装置在第一时间段内向存储装置发送第一控制信息之前，所述方法还包括：
    所述控制装置与所述存储装置进行密钥协商，得到所述会话密钥。
  5. 根据权利要求4所述的方法，其特征在于，所述控制装置与所述存储装置进行密钥协商，得到所述会话密钥，包括：
    所述控制装置与所述存储装置基于预置的对称密钥进行密钥协商，得到所述会话密钥。
  6. 一种数据读写控制方法，其特征在于，包括：
    存储装置在第一时间段内接收来自控制装置的第一控制信息，所述第一控制信息用于控制所述存储装置的读写通道在第二时间段内处于导通状态，所述第一时间段用于所述控制装置与所述存储装置传输控制信息，所述第二时间段用于所述控制装置与所述存储装置传输数据；
    所述存储装置基于所述第一控制信息，控制所述读写开关在所述第二时间段内处于打开状态。
  7. 根据权利要求6所述的方法，其特征在于，所述方法还包括：
    所述存储装置在第三时间段内接收来自所述控制装置第二控制信息，所述第二控制信息用于控制所述读写通道在第四时间段内处于导通状态，所述第三时间段用于所述控制装置与所述存储装置传输控制信息，所述第四时间段用于所述控制装置与所述存储装置传输数据；
    所述存储装置基于所述第二控制信息，控制所述读写通道在所述第四时间段内处于导通状态。
  8. 根据权利要求6所述的方法，其特征在于，所述方法还包括：
    所述存储装置控制所述读写通道从所述第二时间段的结束时刻起处于断开状态。
  9. 根据权利要求6-8中任一项所述的方法，其特征在于，所述存储装置基于所述第一控制信息，控制所述读写通道在所述第二时间段内处于导通状态，包括：
    所述存储装置对所述第一控制信息进行认证，得到认证结果，所述认证结果包括认证成功或认证失败；
    当所述认证结果为认证成功时，所述存储装置控制所述读写通道在所述第二时间段内处于导通状态。
  10. 根据权利要求9所述的方法，其特征在于，所述第一控制信息是经过会话密钥加密的，在所述存储装置对所述第一控制信息进行认证，得到认证结果之前，所述方法还包括：
    所述存储装置基于所述会话密钥，对所述第一控制信息进行解密，得到第一初始控制信息；
    所述存储装置对所述第一控制信息进行认证，得到认证结果，包括：
    所述存储装置对所述第一初始控制信息进行认证，得到所述认证结果。
  11. 根据权利要10所述的方法，其特征在于，在所述存储装置基于所述会话密钥，对所述第一控制信息进行解密，得到第一初始控制信息之前，所述方法还包括：
    所述存储装置与所述控制装置进行密钥协商，得到所述会话密钥。
  12. 根据权利要求11所述的方法，其特征在于，所述存储装置与所述控制装置进行密钥协商，得到所述会话密钥，包括：
    所述存储装置与所述控制装置基于预置的对称密钥进行密钥协商，得到所述会话密钥。
  13. 一种数据读写控制装置，其特征在于，包括：
    发送模块，用于在第一时间段内向存储装置发送第一控制信息，所述第一控制信息用于控制所述存储装置的读写通道在第二时间段内处于导通状态，所述第一时间段用于所述数据读写控制装置与所述存储装置传输控制信息，所述第二时间段用于所述数据读写控制装置与所述存储装置传输数据；
    读写模块，用于基于所述第一控制信息，在所述第二时间段内对所述存储装置进行数据读取和/或数据写入操作。
  14. 根据权利要求13所述的装置，其特征在于，
    所述发送模块还用于在第三时间段内向所述存储装置发送第二控制信息，所述第二控制信息用于控制所述读写通道在第四时间段内处于导通状态，所述第三时间段用于所述控制装置与所述存储装置传输控制信息，所述第四时间段用于所述控制装置与所述存储装置传输数据；
    所述读写模块还用于基于所述第二控制信息，在所述第四时间段内对所述存储装置进行数据读取和/或数据写入操作。
  15. 根据权利要求13所述的装置，其特征在于，
    所述读写模块还用于从所述第二时间段的结束时刻起，停止对所述存储装置进行数据读取和/或数据写入操作。
  16. 根据权利要求13-15中任一项所述的装置，其特征在于，所述第一控制信息是经过会话密钥加密的，所述装置还包括密钥协商模块；
    所述密钥协商模块用于在所述发送模块在第一时间段内向存储装置发送第一控制信息之前，与所述存储装置进行密钥协商，得到所述会话密钥。
  17. 根据权利要求16所述的装置，其特征在于，
    所述密钥协商模块具体用于与所述存储装置基于预置的对称密钥进行密钥协商，得到所述会话密钥。
  18. 一种数据读写装置，其特征在于，包括：
    接收模块，用于在第一时间段内接收来自控制装置的第一控制信息，所述第一控制信息用于控制所述数据读写装置的读写通道在第二时间段内处于导通状态，所述第一时间段用于所述控制装置与所述数据读写装置传输控制信息，所述第二时间段用于所述控制装置与所述数据读写装置传输数据；
    控制模块，用于基于所述第一控制信息，控制所述读写通道在所述第二时间段内处于导通状态。
  19. 根据权利要求18所述的装置，其特征在于，
    所述接收模块还用于在第三时间段内接收来自所述控制装置第二控制信息，所述第二控制信息用于控制所述读写通道在第四时间段内处于导通状态，所述第三时间段用于所述控制装置与所述数据读写装置传输控制信息，所述第四时间段用于所述控制装置与所述数据读写装置传输数据；
    所述控制模块还用于基于所述第二控制信息，控制所述读写通道在所述第四时间段内处于导通状态。
  20. 根据权利要求18所述的装置，其特征在于，所述装置还包括：
    所述控制模块还用于控制所述读写通道从所述第二时间段的结束时刻起处于断开状态。
  21. 根据权利要求18-20中任一项所述的装置，其特征在于，所述装置还包括认证模块；
    所述认证模块用于对所述第一控制信息进行认证，得到认证结果，所述认证结果包括认证成功或认证失败；
    所述控制模块具体用于当所述认证结果为认证成功时，控制所述读写通道在所述第二时间段内处于导通状态。
  22. 根据权利要求21所述的装置，其特征在于，所述第一控制信息是经过会话密钥加密的，所述装置还包括：解密模块；
    所述解密模块用于在所述认证模块对所述第一控制信息进行认证，得到认证结果之前，基于所述会话密钥，对所述第一控制信息进行解密，得到第一初始控制信息；
    所述认证模块具体用于对所述第一初始控制信息进行认证，得到所述认证结果。
  23. 根据权利要22所述的装置，其特征在于，所述装置还包括：密钥协商模块；
    所述密钥协商模块用于在所述解密模块基于所述会话密钥，对所述第一控制信息进行解密，得到第一初始控制信息之前，与所述控制装置进行密钥协商，得到所述会话密钥。
  24. 根据权利要求23所述的装置，其特征在于，
    所述密钥协商模块具体用于与所述控制装置基于预置的对称密钥进行密钥协商，得到所述会话密钥。
  25. 一种计算机可读存储介质，用于存储计算机程序，其特征在于，所述计算机程序包括用于实现上述权利要求1至12中任一项所述的方法的指令。
  26. 一种计算机程序产品，所述计算机程序产品中包含指令，其特征在于，当所述指令在计算机或处理器上运行时，使得所述计算机或所述处理器实现上述权利要求1至12中任一项所述的方法。
PCT/CN2022/109283 2022-07-30 2022-07-30 一种数据读写控制方法和装置 WO2024026588A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
PCT/CN2022/109283 WO2024026588A1 (zh) 2022-07-30 2022-07-30 一种数据读写控制方法和装置

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2022/109283 WO2024026588A1 (zh) 2022-07-30 2022-07-30 一种数据读写控制方法和装置

Publications (1)

Publication Number Publication Date
WO2024026588A1 true WO2024026588A1 (zh) 2024-02-08

Family

ID=89848173

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2022/109283 WO2024026588A1 (zh) 2022-07-30 2022-07-30 一种数据读写控制方法和装置

Country Status (1)

Country Link
WO (1) WO2024026588A1 (zh)

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101488110A (zh) * 2008-12-30 2009-07-22 成都市华为赛门铁克科技有限公司 加密存储的方法、装置和系统
US20130339730A1 (en) * 2012-06-14 2013-12-19 Kabushiki Kaisha Toshiba Device authentication using restriced memory
CN106845290A (zh) * 2017-01-25 2017-06-13 天津大学 用于安全存储芯片的sram控制器及其接口电路
CN108351949A (zh) * 2015-08-25 2018-07-31 K·斯特拉特福德 用于安全数据存储的方法和系统
US20220100397A1 (en) * 2020-09-25 2022-03-31 Micron Technology, Inc. Semiconductor devices with security lock and associated methods and systems

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101488110A (zh) * 2008-12-30 2009-07-22 成都市华为赛门铁克科技有限公司 加密存储的方法、装置和系统
US20130339730A1 (en) * 2012-06-14 2013-12-19 Kabushiki Kaisha Toshiba Device authentication using restriced memory
CN108351949A (zh) * 2015-08-25 2018-07-31 K·斯特拉特福德 用于安全数据存储的方法和系统
CN106845290A (zh) * 2017-01-25 2017-06-13 天津大学 用于安全存储芯片的sram控制器及其接口电路
US20220100397A1 (en) * 2020-09-25 2022-03-31 Micron Technology, Inc. Semiconductor devices with security lock and associated methods and systems

Similar Documents

Publication Publication Date Title
US8464073B2 (en) Method and system for secure data storage
US9100187B2 (en) Authenticator
US10068109B2 (en) Secure subsystem
US8966580B2 (en) System and method for copying protected data from one secured storage device to another via a third party
CN105243344A (zh) 具有硬盘加密功能的芯片组以及主机控制器
US10558589B1 (en) Secure data access between computing devices using host-specific key
KR20220091578A (ko) 메모리 서브시스템에 대한 암호화 키의 위임
CN111881490A (zh) 与外置加密芯片融合应用nvme存储设备的共享数据保护方法
RU2007117685A (ru) Сертифицированный накопитель на жестких дисках с сетевой проверкой достоверности
CN105354503A (zh) 储存装置数据加解密方法
JP5118494B2 (ja) イン−ストリームデータ暗号化／復号の機能を有するメモリシステム
CN109766731B (zh) 基于固态硬盘的加密数据处理方法、装置和计算机设备
US20090187770A1 (en) Data Security Including Real-Time Key Generation
KR20130136559A (ko) 정보 기록 장치, 호스트 장치, 및 정보 기록 장치의 처리 방법
WO2024119918A1 (zh) 密钥管理方法、数据保护方法、系统、芯片及计算机设备
US20230289428A1 (en) Method for implementing dongle, and dongle
US9076002B2 (en) Stored authorization status for cryptographic operations
JP5532198B2 (ja) 電子デバイスにおけるセキュリティ・フィーチャー
WO2024026588A1 (zh) 一种数据读写控制方法和装置
TWI789291B (zh) 用於認證在儲存裝置和主機裝置之間的資料傳輸之模組和方法
JP2004199689A (ja) 不安全なｐｃｉバスを介した安全なメディア・カードの運用
CN112149167B (zh) 一种基于主从系统的数据存储加密方法及装置
CN115391844A (zh) 安全密钥存储装置
TW202011248A (zh) 資料儲存裝置以及其操作方法
US20220294632A1 (en) Utilization of a memory device as security token

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 22953405

Country of ref document: EP

Kind code of ref document: A1