Encryption and decryption engine module, encryption and decryption method, storage medium and chip

Abstract

The present application discloses an encryption and decryption engine module, an encryption and decryption method, a storage medium and a chip, and belongs to the field of chip technology. The encryption and decryption engine module includes n PPCs, n vCEs, multiple encryption and decryption modules, a memory protection controller MPC and n memory blocks, n≥2; each PPC is connected to a vCE, and each vCE corresponds to a memory block; the PPC is used to send an external encryption and decryption request to the corresponding vCE; the vCE is used to obtain a key according to the encryption and decryption request and select a target encryption and decryption module from multiple encryption and decryption modules, create an encryption and decryption context according to the target encryption and decryption module and the key, schedule the target encryption and decryption module to process the encryption and decryption request based on the encryption and decryption context, and send the data in the processing process to the MPC; the MPC is used to store the data in the memory block corresponding to the vCE. The present application improves the security of the system and reduces the performance loss of the system through hardware isolation.

Description

Technical Field

[0001] The present application relates to the field of chip technology, and in particular to an encryption and decryption engine module, an encryption and decryption method, a storage medium and a chip. Background Art

[0002] In modern computer systems, virtualization technology is an important technical means that can achieve efficient utilization and flexible management of physical resources. Virtualization technology can virtualize a physical computer into multiple virtual machines, each of which can run a different operating system (OS), thereby achieving resource sharing and reuse.

[0003] In the related art, the Crypto Engine (CE) module includes a CE, multiple cryptographic modules and a memory, and each cryptographic module provides an encryption and decryption method. Usually, software virtualization is used to enable a CE module to provide encryption and decryption services for multiple OSes. Specifically, after receiving an encryption and decryption request, the CE needs to create an encryption and decryption context for the encryption and decryption request, perform encryption and decryption processing on the encryption and decryption request according to the encryption and decryption context, and store the data in the processing process in the memory.

[0004] CE usually uses time-sharing technology to provide encryption and decryption services for multiple OSes at the same time. In each time slice, CE needs to switch different encryption and decryption contexts to perform different encryption and decryption processing. Switching encryption and decryption contexts has a very serious performance loss on the system. In addition, software virtualization is implemented in software and may be affected by software vulnerabilities, thereby reducing the security of the system. Summary of the invention

[0005] The present application provides an encryption and decryption engine module, an encryption and decryption method, a storage medium and a chip, which are used to solve the problem that switching encryption and decryption contexts causes extremely serious performance loss to the system, and software virtualization reduces the security of the system. The technical solution is as follows:

[0006] According to a first aspect of the present application, there is provided an encryption / decryption engine module, the encryption / decryption engine module comprising: n peripheral protection controllers PPC, n virtualization encryption / decryption engines vCE, multiple encryption / decryption modules, a memory protection controller MPC and n memory blocks, n≥2; wherein each PPC is connected to a vCE, and each vCE corresponds to a memory block;

[0007] The PPC is used to receive an encryption and decryption request sent externally, and detect whether the encryption and decryption request matches the first data and the second data; when the encryption and decryption request matches the first data and the second data, send the encryption and decryption request to the corresponding vCE; when the encryption and decryption request does not match the first data and / or the second data, discard the encryption and decryption request; wherein the first data represents a secure environment or a non-secure environment, and the second data represents a domain identifier corresponding to the secure environment or a domain identifier corresponding to the non-secure environment;

[0008] The vCE is used to obtain a key according to the encryption / decryption request and select a target encryption / decryption module from multiple encryption / decryption modules, create an encryption / decryption context according to the target encryption / decryption module and the key, schedule the target encryption / decryption module to process the encryption / decryption request based on the encryption / decryption context, and send data in the process to the MPC;

[0009] The MPC is used to store the data in a memory block corresponding to the vCE.

[0010] In a possible implementation, the PPC includes a security register and a domain identification register, the security register is used to store the first data, and the domain identification register is used to store the second data.

[0011] In a possible implementation, the PPC is further used to obtain the engine identifier of the corresponding vCE at startup, obtain configuration information corresponding to the engine identifier from a configuration file, and configure the first data of the security register and the second data of the domain identifier register according to the configuration information.

[0012] In a possible implementation, the MPC is also used to obtain the engine identifiers of n vCEs at startup, obtain the address segment corresponding to each engine identifier from the configuration file, divide the memory into n memory blocks according to the n address segments, and configure the correspondence between the n memory blocks and the n vCEs.

[0013] In a possible implementation, the vCE is further used to send a key acquisition request to the key authority logic module, wherein the key acquisition request carries the engine identifier of the vCE and the key identifier in the encryption and decryption request;

[0014] The vCE is also used to receive a key corresponding to the key identifier fed back by the key authority logic module, where the key is fed back after the key authority logic module determines that the engine identifier and the key identifier have a binding relationship in a one-time programming (OTP).

[0015] According to a second aspect of the present application, there is provided an encryption and decryption method, which is used in the encryption and decryption engine module as described above, and the method comprises:

[0016] The PPC receives an encryption and decryption request sent externally, and detects whether the encryption and decryption request matches the first data and the second data; when the encryption and decryption request matches the first data and the second data, sends the encryption and decryption request to the corresponding vCE; when the encryption and decryption request does not match the first data and / or the second data, discards the encryption and decryption request; wherein the first data represents a secure environment or a non-secure environment, and the second data represents a domain identifier corresponding to the secure environment or a domain identifier corresponding to the non-secure environment;

[0017] The vCE obtains a key according to the encryption / decryption request and selects a target encryption / decryption module from multiple encryption / decryption modules, creates an encryption / decryption context according to the target encryption / decryption module and the key, schedules the target encryption / decryption module to process the encryption / decryption request based on the encryption / decryption context, and sends data in the process to the MPC;

[0018] The MPC stores the data in a memory block corresponding to the vCE.

[0019] In a possible implementation, the PPC includes a security register and a domain identification register, the security register is used to store the first data, and the domain identification register is used to store the second data.

[0020] In a possible implementation, the method further includes:

[0021] The vCE sends a key acquisition request to the key authority logic module, where the key acquisition request carries the engine identifier of the vCE and the key identifier in the encryption and decryption request;

[0022] The vCE receives a key corresponding to the key identifier fed back by the key authority logic module, where the key is fed back after the key authority logic module determines that the engine identifier and the key identifier have a binding relationship in a one-time programming (OTP).

[0023] According to a third aspect of the present application, a computer-readable storage medium is provided, wherein at least one instruction is stored in the storage medium, and the at least one instruction is loaded and executed by a processor to implement the encryption and decryption method as described above.

[0024] According to a fourth aspect of the present application, a chip is provided, wherein the chip includes the above-mentioned encryption and decryption device.

[0025] The beneficial effects of the technical solution provided by this application include at least:

[0026] Through hardware isolation technology, the encryption and decryption engine module is virtualized into n PPCs and n vCEs, and each PPC is connected to a vCE, so that the system security is not affected by software vulnerabilities, thereby improving the security of the system.

[0027] When using time-sharing technology to provide encryption and decryption services for multiple OSes, each PPC sends external encryption and decryption requests to the corresponding vCE, which creates an encryption and decryption context and processes the encryption and decryption request based on the encryption and decryption context. Since each vCE can create an encryption and decryption context based on an encryption and decryption request, different encryption and decryption processing can be performed in each time slice by simply switching different vCEs, without switching the encryption and decryption context in the vCE, which can reduce the performance loss of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0029] Figure 1 It is a structural diagram of an encryption and decryption engine module provided by an embodiment of the present application;

[0030] Figure 2 It is a schematic diagram of a configuration of a PPC provided by an embodiment of the present application;

[0031] Figure 3 This is a flow chart of an encryption and decryption method provided by an embodiment of the present application;

[0032] Figure 4 This is a flowchart of an encryption and decryption method provided by an embodiment of the present application. DETAILED DESCRIPTION

[0033] In order to make the objectives, technical solutions and advantages of the embodiments of the present application clearer, the implementation methods of the present application will be further described in detail below in conjunction with the accompanying drawings.

[0034] like Figure 1As shown, it shows a structural block diagram of an encryption and decryption engine module provided by an embodiment of the present application, and the encryption and decryption engine module can be applied to a chip. The encryption and decryption engine module may include: n peripheral protection controllers (PPCs), n virtualized encryption and decryption engines (vCEs), multiple encryption and decryption modules, a memory protection controller (MPC), and n memory blocks, where n≥2.

[0035] After virtualizing CE and PPC using hardware isolation technology, n vCEs and n PPCs are obtained, such as Figure 1 In the embodiment, the engine identifier is used to identify each vCE, wherein each vCE is connected to a PPC. As the front end of the vCE, the PPC is responsible for providing access to the upper-layer OS, and the vCE is responsible for responding to the encryption and decryption requests sent by the upper-layer OS.

[0036] The encryption and decryption module is a module with encryption and decryption algorithms that can be scheduled by vCE, such as the Public Key Encryption (PKE) module, the Symmetric Key Encryption (SKE) module, the Hash module, and so on. Figure 1 Only the above three encryption and decryption modules are taken as examples. In actual applications, more or fewer encryption and decryption modules can be set according to business needs.

[0037] MPC is used to manage system memory (Static RAM, SRAM). For example, MPC divides the memory into n memory blocks, such as Figure 1 SRAM1, SRAM2, SRAM3, ..., SRAMn in it. Each memory block corresponds to a vCE, and each memory block is used to store data generated by a corresponding vCE in the process of processing encryption and decryption requests. MPC can provide separate permission control for each divided memory block, so as to achieve the technical effect of having different permission controls for different memory blocks on a single memory, rather than only having unified permission control for different memory blocks.

[0038] Figure 1 The key permission logic module is also included in the system, which is used to manage n keys, such as Figure 1In the embodiment, the key identifier is used to identify each key, wherein each vCE corresponds to at least one key. Specifically, the binding relationship between the engine identifier of the vCE and at least one key identifier can be burned into the One Time Programmable (OTP), so that the key permission logic module can provide the corresponding key for the vCE according to the binding relationship.

[0039] The following is an explanation of the encryption and decryption process of the encryption and decryption engine module:

[0040] (1) PPC, used to send external encryption and decryption requests to the corresponding vCE.

[0041] When implementing the filtering function, the PPC is used to receive an encryption and decryption request sent externally, and detect whether the encryption and decryption request matches the first data and the second data; when the encryption and decryption request matches the first data and the second data, the encryption and decryption request is sent to the corresponding vCE; when the encryption and decryption request does not match the first data and / or the second data, the encryption and decryption request is discarded; wherein the first data represents a secure environment or a non-secure environment, and the second data represents a domain identifier corresponding to the secure environment or a domain identifier corresponding to the non-secure environment.

[0042] In this embodiment, different values ​​may be set for the first data to represent a secure environment or a non-secure environment. For example, setting the value of the first data to 1 represents a secure environment, and setting the value of the first data to 0 represents a non-secure environment.

[0043] In this embodiment, different domain IDs may be set for the second data. For example, one domain ID is used to represent a domain ID corresponding to a secure environment, and another domain ID is used to represent a domain ID corresponding to a non-secure environment.

[0044] In this embodiment, the PPC can configure the first data and the second data through a register. Specifically, the PPC includes a security register and a domain identification register, the security register is used to store the first data, and the domain identification register is used to store the second data. Figure 2 As shown, the security register identifying the secure environment can be called a Secure register, and the security register identifying the non-secure environment can be called a NonSecure register.

[0045] In addition, the PPC may also configure the first data and the second data by looking up a table / displaying a look-up table (Look-Up-Table, LUT) or using a fixed multiplexer / data selector (Multiplexer, MUX).

[0046] Optionally, the PPC may also include other registers such as a read permission register and a write permission register. The number and type of registers are not limited in this embodiment.

[0047] When configuring PPC, PPC is also used to obtain the corresponding vCE engine identifier at startup, obtain configuration information corresponding to the engine identifier from the configuration file, and configure the first data of the security register and the second data of the domain identifier register according to the configuration information.

[0048] A configuration file is pre-stored in the chip, and the configuration file includes multiple configuration information, each of which includes an engine identifier, a value of the first data, and a domain identifier of the second data. The PPC can read the engine identifier of the vCE corresponding to it, use the engine identifier as an index to find the corresponding configuration information in the configuration file, and then configure the first data and the second data according to the configuration information. The configuration process is protected by the system security boot process.

[0049] When detecting whether the encryption and decryption request matches the first data, the PPC can read the system identifier of the OS that sends the encryption and decryption request from the encryption and decryption request to detect whether the system identifier corresponds to a secure environment or a non-secure environment. If the system identifier corresponds to a secure environment, and the numerical value of the first data identifies a secure environment; or, if the system identifier corresponds to a non-secure environment, and the numerical value of the first data identifies a non-secure environment, then it is determined that the encryption and decryption request matches the first data; if the system identifier corresponds to a secure environment, and the numerical value of the first data identifies a non-secure environment; or, if the system identifier corresponds to a non-secure environment, and the numerical value of the first data identifies a secure environment, then it is determined that the encryption and decryption request does not match the first data.

[0050] When detecting whether the encryption / decryption request matches the second data, the PPC can read the domain identifier from the encryption / decryption request and detect whether the read domain identifier is the same as the domain identifier in the second data; if the read domain identifier is the same as the domain identifier in the second data, it is determined that the encryption / decryption request matches the second data; if the read domain identifier is different from the domain identifier in the second data, it is determined that the encryption / decryption request does not match the second data.

[0051] If the detection result is that the encryption / decryption request matches both the first data and the second data, the PPC forwards the encryption / decryption request to the corresponding vCE; if the detection result is that the encryption / decryption request does not match at least one of the first data and the second data, the PPC does not forward the encryption / decryption request to the corresponding vCE and directly discards the encryption / decryption request.

[0052] (2) vCE, which is used to obtain the key according to the encryption and decryption request and select the target encryption and decryption module from multiple encryption and decryption modules, create an encryption and decryption context according to the target encryption and decryption module and the key, schedule the target encryption and decryption module to process the encryption and decryption request based on the encryption and decryption context, and send the data in the processing process to the MPC.

[0053] vCE can read the identifier of the register of the encryption / decryption module from the encryption / decryption request, and select an encryption / decryption module from multiple encryption / decryption modules according to the identifier as the target encryption / decryption module. For example, if the encryption / decryption request carries the identifier of the register of the PKE module, the PKE module is selected as the target encryption / decryption module.

[0054] vCE can read the key identifier from the encryption and decryption request, and generate a key acquisition request carrying the key identifier and the engine identifier; then, send the key acquisition request to the key authority logic module, where the key acquisition request carries the engine identifier of vCE and the key identifier in the encryption and decryption request; receive the key corresponding to the key identifier fed back by the key authority logic module, where the key is fed back after the key authority logic module determines that the engine identifier and the key identifier have a binding relationship in the OTP.

[0055] That is to say, the key permission logic module detects whether the key identifier and the engine identifier in the key acquisition request have a binding relationship based on the binding relationship burned in the OTP; if the key identifier and the engine identifier in the key acquisition request have a binding relationship, it is determined that the vCE has the authority to obtain the key corresponding to the key identifier, and the key is fed back to the vCE; if the key identifier and the engine identifier in the key acquisition request do not have a binding relationship, it is determined that the vCE does not have the authority to obtain the key corresponding to the key identifier, and the key is not fed back to the vCE.

[0056] vCE can read the text from the encryption and decryption request, use the created encryption and decryption context to encrypt and decrypt the text, and send the processed data to MPC.

[0057] In this embodiment, time-sharing technology can be used to provide encryption and decryption services for multiple OSes at the same time. If the vCE fails to process the encryption and decryption request within a time slice, the encryption and decryption context can be retained until the next time slice corresponding to the vCE is reached, and the encryption and decryption context can continue to be used to process the encryption and decryption request without switching the encryption and decryption context, thereby reducing the performance loss of the system.

[0058] (3) MPC, used to store data into the memory block corresponding to the vCE.

[0059] The MPC is also used to obtain the engine identifiers of n vCEs at startup, obtain the address segment corresponding to each engine identifier from the configuration file, divide the memory into n memory blocks according to the n address segments, and configure the correspondence between the n memory blocks and the n vCEs.

[0060] The chip has a configuration file pre-stored in it, which includes multiple configuration information, each of which includes an engine ID and an address segment. The MPC can read the engine ID of a vCE, use the engine ID as an index to find the corresponding address segment in the configuration file, and then allocate the memory block corresponding to the address segment to the vCE.

[0061] After completing the configuration, the MPC can store the data sent by the vCE. Specifically, the vCE can send a storage request to the MPC, which carries the engine identifier, the data to be stored, and the memory size. The MPC determines the memory block corresponding to the engine identifier and stores the data to be stored in the memory block according to the memory size.

[0062] To sum up, the encryption and decryption engine module provided in the embodiment of the present application virtualizes the encryption and decryption engine module into n PPCs and n vCEs through hardware isolation technology, and each PPC is connected to a vCE, so that the security of the system is not affected by software vulnerabilities, thereby improving the security of the system.

[0063] When using time-sharing technology to provide encryption and decryption services for multiple OSes, each PPC sends external encryption and decryption requests to the corresponding vCE, which creates an encryption and decryption context and processes the encryption and decryption request based on the encryption and decryption context. Since each vCE can create an encryption and decryption context based on an encryption and decryption request, different encryption and decryption processing can be performed in each time slice by simply switching different vCEs, without switching the encryption and decryption context in the vCE, which can reduce the performance loss of the system.

[0064] like Figure 3 As shown, it shows a method flow chart of an encryption and decryption method provided by an embodiment of the present application, and the encryption and decryption method can be applied to an encryption and decryption engine module. The encryption and decryption method may include:

[0065] Step 301, the PPC receives an encryption and decryption request sent externally, and detects whether the encryption and decryption request matches the first data and the second data; when the encryption and decryption request matches the first data and the second data, the encryption and decryption request is sent to the corresponding vCE; when the encryption and decryption request does not match the first data and / or the second data, the encryption and decryption request is discarded; wherein the first data represents a secure environment or a non-secure environment, and the second data represents a domain identifier corresponding to the secure environment or a domain identifier corresponding to the non-secure environment.

[0066] As the front end of vCE, PPC is responsible for providing access to the upper-layer OS. Specifically, PPC receives encryption and decryption requests sent by the upper-layer OS, filters the encryption and decryption requests according to the first data and the second data, and forwards the filtered encryption and decryption requests to the corresponding vCE.

[0067] When detecting whether the encryption and decryption request matches the first data, the PPC can read the system identifier of the OS that sends the encryption and decryption request from the encryption and decryption request to detect whether the system identifier corresponds to a secure environment or a non-secure environment. If the system identifier corresponds to a secure environment, and the numerical value of the first data identifies a secure environment; or, if the system identifier corresponds to a non-secure environment, and the numerical value of the first data identifies a non-secure environment, then it is determined that the encryption and decryption request matches the first data; if the system identifier corresponds to a secure environment, and the numerical value of the first data identifies a non-secure environment; or, if the system identifier corresponds to a non-secure environment, and the numerical value of the first data identifies a secure environment, then it is determined that the encryption and decryption request does not match the first data.

[0068] When detecting whether the encryption / decryption request matches the second data, the PPC can read the domain identifier from the encryption / decryption request and detect whether the read domain identifier is the same as the domain identifier in the second data; if the read domain identifier is the same as the domain identifier in the second data, it is determined that the encryption / decryption request matches the second data; if the read domain identifier is different from the domain identifier in the second data, it is determined that the encryption / decryption request does not match the second data.

[0069] If the detection result is that the encryption / decryption request matches both the first data and the second data, the PPC forwards the encryption / decryption request to the corresponding vCE; if the detection result is that the encryption / decryption request does not match at least one of the first data and the second data, the PPC does not forward the encryption / decryption request to the corresponding vCE and directly discards the encryption / decryption request.

[0070] In step 302, the vCE obtains a key according to the encryption / decryption request and selects a target encryption / decryption module from multiple encryption / decryption modules, creates an encryption / decryption context according to the target encryption / decryption module and the key, schedules the target encryption / decryption module to process the encryption / decryption request based on the encryption / decryption context, and sends the data in the process to the MPC.

[0071] vCE is responsible for responding to the encryption and decryption requests sent by the upper-layer OS. Specifically, vCE reads the key identifier from the encryption and decryption request, and obtains the key corresponding to the key identifier from the MPC; vCE reads the identifier of the register of the encryption and decryption module from the encryption and decryption request, and selects an encryption and decryption module from multiple encryption and decryption modules as the target encryption and decryption module according to the identifier; vCE creates an encryption and decryption context based on the key and the target encryption and decryption module, schedules the target encryption and decryption module to process the text in the encryption and decryption request based on the encryption and decryption context, and sends the generated storage request to the MPC, which includes the data to be stored, the engine identifier, and the memory size.

[0072] In step 303 , the MPC stores the data in the memory block corresponding to the vCE.

[0073] The MPC determines a memory block corresponding to the engine identifier in the storage request, and stores the data to be stored in the memory block according to the memory size in the storage request.

[0074] To sum up, the encryption and decryption method provided in the embodiment of the present application virtualizes the encryption and decryption engine module into n PPCs and n vCEs through hardware isolation technology, and each PPC is connected to a vCE, so that the security of the system is not affected by software vulnerabilities, thereby improving the security of the system.

[0075] When using time-sharing technology to provide encryption and decryption services for multiple OSes, each PPC sends external encryption and decryption requests to the corresponding vCE, which creates an encryption and decryption context and processes the encryption and decryption request based on the encryption and decryption context. Since each vCE can create an encryption and decryption context based on an encryption and decryption request, different encryption and decryption processing can be performed in each time slice by simply switching different vCEs, without switching the encryption and decryption context in the vCE, which can reduce the performance loss of the system.

[0076] like Figure 4 As shown, it shows a flow chart of an encryption and decryption method provided by an embodiment of the present application, and the encryption and decryption method can be applied to a chip. The encryption and decryption method may include:

[0077] In step 401, the PPC receives an encryption and decryption request sent externally, and detects whether the encryption and decryption request matches the first data and the second data; when the encryption and decryption request matches the first data and the second data, the PPC sends the encryption and decryption request to the corresponding vCE; when the encryption and decryption request does not match the first data and / or the second data, the PPC discards the encryption and decryption request, wherein the first data represents a secure environment or a non-secure environment, and the second data represents a domain identifier corresponding to the secure environment or a domain identifier corresponding to the non-secure environment.

[0078] The implementation process of step 401 is the same as that of step 301 and will not be described again here.

[0079] In step 402, the vCE obtains a key according to the encryption / decryption request and selects a target encryption / decryption module from multiple encryption / decryption modules, creates an encryption / decryption context according to the target encryption / decryption module and the key, schedules the target encryption / decryption module to process the encryption / decryption request based on the encryption / decryption context, and sends the data in the process to the MPC.

[0080] The vCE may read an identifier of a register of an encryption / decryption module from an encryption / decryption request, and select an encryption / decryption module from multiple encryption / decryption modules according to the identifier as a target encryption / decryption module.

[0081] vCE can read the key identifier from the encryption and decryption request, and generate a key acquisition request carrying the key identifier and the engine identifier; then, send the key acquisition request to the key authority logic module, where the key acquisition request carries the engine identifier of vCE and the key identifier in the encryption and decryption request; receive the key corresponding to the key identifier fed back by the key authority logic module, where the key is fed back after the key authority logic module determines that the engine identifier and the key identifier have a binding relationship in the OTP.

[0082] That is to say, the key permission logic module detects whether the key identifier and the engine identifier in the key acquisition request have a binding relationship based on the binding relationship burned in the OTP; if the key identifier and the engine identifier in the key acquisition request have a binding relationship, it is determined that the vCE has the authority to obtain the key corresponding to the key identifier, and the key is fed back to the vCE; if the key identifier and the engine identifier in the key acquisition request do not have a binding relationship, it is determined that the vCE does not have the authority to obtain the key corresponding to the key identifier, and the key is not fed back to the vCE.

[0083] vCE can read the text from the encryption and decryption request, create an encryption and decryption context according to the key and the target encryption and decryption module, schedule the target encryption and decryption module to process the text based on the encryption and decryption context, and send the generated storage request to MPC, which includes the data to be stored, the engine identifier and the memory size to MPC.

[0084] In step 403 , the MPC stores the data in the memory block corresponding to the vCE.

[0085] The configuration process of the memory block is described in detail above and will not be repeated here.

[0086] After completing the configuration, the MPC determines the memory block corresponding to the engine identifier in the storage request, and stores the data to be stored in the memory block according to the memory size in the storage request.

[0087] To sum up, the encryption and decryption method provided in the embodiment of the present application virtualizes the encryption and decryption engine module into n PPCs and n vCEs through hardware isolation technology, and each PPC is connected to a vCE, so that the security of the system is not affected by software vulnerabilities, thereby improving the security of the system.

[0088] When using time-sharing technology to provide encryption and decryption services for multiple OSes, each PPC sends external encryption and decryption requests to the corresponding vCE, which creates an encryption and decryption context and processes the encryption and decryption request based on the encryption and decryption context. Since each vCE can create an encryption and decryption context based on an encryption and decryption request, different encryption and decryption processing can be performed in each time slice by simply switching different vCEs, without switching the encryption and decryption context in the vCE, which can reduce the performance loss of the system.

[0089] An embodiment of the present application provides a computer-readable storage medium, in which at least one instruction is stored. The at least one instruction is loaded and executed by a processor to implement the encryption and decryption method as described above.

[0090] An embodiment of the present application provides a chip, wherein the chip includes any of the above-mentioned encryption and decryption devices.

[0091] It should be noted that: the encryption and decryption engine module provided in the above embodiment only uses the division of the above functional modules as an example when performing encryption and decryption. In actual applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the encryption and decryption engine module is divided into different functional modules to complete all or part of the functions described above. In addition, the encryption and decryption engine module provided in the above embodiment belongs to the same concept as the encryption and decryption method embodiment. The specific implementation process is detailed in the method embodiment and will not be repeated here.

[0092] A person skilled in the art will understand that all or part of the steps to implement the above embodiments may be accomplished by hardware or by instructing related hardware through a program, and the program may be stored in a computer-readable storage medium, and the above-mentioned storage medium may be a read-only memory, a disk or an optical disk, etc.

[0093] The above description is not intended to limit the embodiments of the present application. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the embodiments of the present application should be included in the protection scope of the embodiments of the present application.

Claims

1. An encryption and decryption engine module, characterized in that: The encryption and decryption engine module includes: n peripheral protection controllers PPC, n virtualization encryption and decryption engines vCE, multiple encryption and decryption modules, a memory protection controller MPC and n memory blocks, n≥2; wherein each PPC is connected to a vCE, and each vCE corresponds to a memory block; The PPC is used to receive an encryption and decryption request sent externally, and detect whether the encryption and decryption request matches the first data and the second data; when the encryption and decryption request matches the first data and the second data, send the encryption and decryption request to the corresponding vCE; when the encryption and decryption request does not match the first data and / or the second data, discard the encryption and decryption request; wherein the first data represents a secure environment or a non-secure environment, and the second data represents a domain identifier corresponding to the secure environment or a domain identifier corresponding to the non-secure environment; The vCE is used to obtain a key according to the encryption / decryption request and select a target encryption / decryption module from multiple encryption / decryption modules, create an encryption / decryption context according to the target encryption / decryption module and the key, schedule the target encryption / decryption module to process the encryption / decryption request based on the encryption / decryption context, and send data in the process to the MPC; The MPC is used to store the data in a memory block corresponding to the vCE.

2. The encryption and decryption engine module according to claim 1, characterized in that: The PPC includes a security register and a domain identification register, the security register is used to store the first data, and the domain identification register is used to store the second data.

3. The encryption and decryption engine module according to claim 2, characterized in that: The PPC is further used to obtain the engine identifier of the corresponding vCE at startup, obtain configuration information corresponding to the engine identifier from a configuration file, and configure the first data of the security register and the second data of the domain identifier register according to the configuration information.

4. The encryption and decryption engine module according to claim 1, characterized in that: The MPC is also used to obtain the engine identifiers of n vCEs at startup, obtain the address segment corresponding to each engine identifier from the configuration file, divide the memory into n memory blocks according to the n address segments, and configure the correspondence between the n memory blocks and the n vCEs.

5. The encryption and decryption engine module according to claim 1, characterized in that: The vCE is further configured to send a key acquisition request to the key authority logic module, wherein the key acquisition request carries the engine identifier of the vCE and the key identifier in the encryption and decryption request; The vCE is also used to receive a key corresponding to the key identifier fed back by the key authority logic module, where the key is fed back after the key authority logic module determines that the engine identifier and the key identifier have a binding relationship in a one-time programming (OTP).

6. An encryption and decryption method, characterized in that: Used in the encryption and decryption engine module according to any one of claims 1 to 5, the method comprises: The PPC receives an encryption and decryption request sent externally, and detects whether the encryption and decryption request matches the first data and the second data; when the encryption and decryption request matches the first data and the second data, sends the encryption and decryption request to the corresponding vCE; when the encryption and decryption request does not match the first data and / or the second data, discards the encryption and decryption request; wherein the first data represents a secure environment or a non-secure environment, and the second data represents a domain identifier corresponding to the secure environment or a domain identifier corresponding to the non-secure environment; The vCE obtains a key according to the encryption / decryption request and selects a target encryption / decryption module from multiple encryption / decryption modules, creates an encryption / decryption context according to the target encryption / decryption module and the key, schedules the target encryption / decryption module to process the encryption / decryption request based on the encryption / decryption context, and sends data in the process to the MPC; The MPC stores the data in a memory block corresponding to the vCE.

7. The encryption and decryption method according to claim 6, characterized in that: The PPC includes a security register and a domain identification register, the security register is used to store the first data, and the domain identification register is used to store the second data.

8. The encryption and decryption method according to claim 6, characterized in that: The method further comprises: The vCE sends a key acquisition request to the key authority logic module, where the key acquisition request carries the engine identifier of the vCE and the key identifier in the encryption and decryption request; The vCE receives a key corresponding to the key identifier fed back by the key authority logic module, where the key is fed back after the key authority logic module determines that the engine identifier and the key identifier have a binding relationship in a one-time programming (OTP).

9. A computer-readable storage medium, characterized in that: The storage medium stores at least one instruction, and the at least one instruction is loaded and executed by the processor to implement the encryption and decryption method according to any one of claims 6 to 8.

10. A chip, characterized in that: The chip comprises: the encryption and decryption engine module according to any one of claims 1 to 5.

Images