Security verification encryption accelerator, application method, device, medium and product

Abstract

The invention discloses a security verification encryption accelerator, an application method, equipment, a medium and a product, and relates to the technical field of accelerators, and the security verification encryption accelerator comprises a verification module which is used for verifying whether an address interval corresponding to a to-be-verified code is complete based on a preset address verification interval and a preset address verification value under the condition that the to-be-verified code is received; and the security key management module is used for processing the encryption and decryption request corresponding to the to-be-verified code under the condition that the address interval corresponding to the to-be-verified code is complete. The technical problem of poor safety of the accelerator is solved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of accelerators, in particular to a secure verification encryption accelerator, an application method, an electronic device, a storage medium and a product. BACKGROUND

[0002] In the existing general-purpose cryptographic algorithm accelerator system architecture, the behavior of the accelerator is controlled by the host driver code, and its security is completely guaranteed by the host operating system and driver running environment outside the accelerator. If the host code is maliciously tampered with, the accelerator cannot actively identify and block the abnormality of the host code. Therefore, the existing general-purpose cryptographic algorithm accelerator system architecture has the problem of poor accelerator security.

[0003] The above content is only used to assist in understanding the technical solutions of the present application and does not represent the acknowledgement of the above content as prior art. SUMMARY

[0004] The main purpose of the present application is to provide a secure verification encryption accelerator, an application method, an electronic device, a storage medium and a computer program product, which aims to solve the technical problem of poor accelerator security.

[0005] To achieve the above purpose, the present application provides a secure verification encryption accelerator, which comprises:

[0006] A verification module, configured to, in the case of receiving a to-be-verified code, verify whether the address interval corresponding to the to-be-verified code is complete based on a preset address verification interval and a preset address verification value;

[0007] A security key management module, configured to, in the case that the address interval corresponding to the to-be-verified code is complete, process an encryption and decryption request corresponding to the to-be-verified code.

[0008] In an embodiment, the verification module comprises:

[0009] An address management unit, the address management unit comprises respective access intervals, each access interval is allocated with a virtual machine, the access interval of the virtual machine comprises an address verification interval and an instruction interval, the address verification interval stores the preset address verification interval and the preset address verification value, and the instruction interval is configured to receive the to-be-verified code, the to-be-verified code comprising a host driver code and a running environment code;

[0010] The address management unit is configured to, in a case where the host driver code and the runtime environment code are input in the instruction interval, determine a first address interval corresponding to the host driver code and a second address interval corresponding to the runtime environment code, call a data verification unit to calculate a first hash value of the first address interval, compare the first hash value with a first preset address verification value associated with the first address interval to obtain a first verification result, and call the data verification unit to calculate a second hash value of the second address interval, compare the second hash value with a second preset address verification value associated with the second address interval to obtain a second verification result, in a case where the first verification result and the second verification result are both passed, determine that an address interval corresponding to the code to be verified is complete, and input the code to be verified into the secure key management module for execution.

[0011] The data verification unit is configured to receive a verification request of the address management unit, and read an address interval corresponding to the code to be verified for hash value calculation.

[0012] In an embodiment, the preset address verification value is written by the address management unit when performing initial configuration, all available address intervals are taken as the preset address verification intervals, and the data verification unit is called to perform hash value calculation on the preset address verification intervals.

[0013] In an embodiment, the secure key management module comprises:

[0014] The key control unit is configured to generate a root key and control each unit in the secure key management module to respond to the encryption and decryption request.

[0015] The encryption and decryption unit comprises an encryption subunit and a decryption subunit, the encryption subunit is configured to encrypt plaintext, and the decryption subunit is configured to decrypt ciphertext.

[0016] The random number generation unit is configured to generate a first random number for key scrambling and a second random number for generating a key.

[0017] The key scrambling unit is configured to scramble the second random number or the encrypted key in combination with the first random number and store the scrambled key to a key storage unit, and descramble the scrambled key output by the key storage unit.

[0018] The dynamic error correction unit is configured to correct data with errors in the memory in a case where the read-write port is idle.

[0019] The key storage unit is configured to store the scrambled key.

[0020] a key channel for directly transmitting all keys in the secure key management module.

[0021] In an embodiment, the key control unit comprises a PUF subunit for reading an SRAM power-on value in the key control unit after the secure key management module is reset, and processing the SRAM power-on value in combination with a PUF to generate the root key.

[0022] In an embodiment, the key control unit further comprises an encryption and decryption control subunit for responding to an encryption and decryption request;

[0023] In the case of the encryption and decryption request being a key generation request, the random number generation unit is invoked to generate the second random number, and the key scrambling unit is invoked to scramble the second random number and store it to the key storage unit;

[0024] In the case of the encryption and decryption request being a key derivation request, the first target key corresponding to the key derivation request is read from the key storage unit, the key scrambling unit is invoked to descramble the first target key, and the encryption and decryption unit is invoked to encrypt the descrambled first target key based on the root key and output;

[0025] In the case of the encryption and decryption request being a key import request, the encrypted key input by the key import request is received, the encryption and decryption unit is invoked to decrypt the encrypted key based on the root key to obtain a decrypted key, and the key scrambling unit is invoked to scramble the decrypted key and store it to the key storage unit;

[0026] In the case of the encryption and decryption request being a key switch request, the second target key corresponding to the key switch request is read from the key storage unit, the key scrambling unit is invoked to descramble the second target key, and the encryption and decryption unit is invoked to encrypt the descrambled second target key based on the root key and output;

[0027] In the case of the encryption and decryption request being a data encryption and decryption request, the data stream in the data encryption and decryption request is extracted, the third target key corresponding to the data encryption and decryption request is read from the key storage unit, and the encryption and decryption unit is invoked to encrypt and decrypt the data stream based on the third target key and output.

[0028] In an embodiment, the secure verification encryption accelerator comprises a verification module and a secure key management module, and the application method of the secure verification encryption accelerator comprises:

[0029] receive a code to be verified, and check whether an address interval corresponding to the code to be verified is complete based on a preset address check interval and a preset address check value through the check module;

[0030] In a case where the address interval corresponding to the code to be verified is complete, process an encryption and decryption request corresponding to the code to be verified through the security key management module.

[0031] In addition, to achieve the above-mentioned purpose, the present application also provides an electronic device, which comprises a memory, a processor, and a computer program stored in the memory and executable on the processor, and the computer program is configured to implement the steps of the application method of the security check encryption accelerator.

[0032] In addition, to achieve the above-mentioned purpose, the present application also provides a storage medium, which is a computer readable storage medium, and the storage medium stores a computer program, and the computer program is executed by a processor to implement the steps of the application method of the security check encryption accelerator.

[0033] In addition, to achieve the above-mentioned purpose, the present application also provides a computer program product, which comprises a computer program, and the computer program is executed by a processor to implement the steps of the application method of the security check encryption accelerator.

[0034] The present application provides a security check encryption accelerator, which comprises a check module configured to check whether an address interval corresponding to a code to be verified is complete based on a preset address check interval and a preset address check value when the code to be verified is received, and a security key management module configured to process an encryption and decryption request corresponding to the code to be verified in a case where the address interval corresponding to the code to be verified is complete.

[0035] Compared with the existing general-purpose cryptographic algorithm accelerator system architecture, the security of the accelerator depends on the external operating environment of the host operating system and the driver, and when the host code is maliciously tampered with, the accelerator cannot actively identify and block the exception, resulting in poor security. The present application actively checks the integrity of the address interval corresponding to the code to be verified through the check module, which can timely find out whether the code to be verified is tampered with, rather than passively relying on the security of the external environment, thereby enhancing the identification ability of the accelerator itself to abnormal situations. The security key management module only processes the encryption and decryption request in a case where the address interval of the code to be verified is complete, thereby closely associating the encryption and decryption operation with the security of the system environment, avoiding critical operations in an unsafe environment, and internally ensuring the safe operation of the accelerator, effectively solving the problem of poor security of the accelerator in the prior art, and improving the security and reliability of the entire system. BRIEF DESCRIPTION OF DRAWINGS

[0036] The accompanying drawings, which are incorporated herein and constitute part of the specification, illustrate embodiments consistent with the application and, together with the description, serve to explain the principles of the application.

[0037] In order to more clearly illustrate the technical solutions of the embodiments of the present application or the prior art, the accompanying drawings required by the embodiments or the prior art description will be briefly introduced as follows. Obviously, for those of ordinary skill in the art, the other drawings can also be obtained based on these drawings without any creative effort.

[0038] Figure 1 A general-purpose password algorithm accelerator system architecture provided for the first embodiment of the security verification encryption accelerator of the present application;

[0039] Figure 2 A module structure schematic diagram of the security verification encryption accelerator of the present application embodiment;

[0040] Figure 3 A scene schematic diagram of the address management unit provided for the first embodiment of the security verification encryption accelerator of the present application;

[0041] Figure 4 A brief flowchart of the application method of the security verification encryption accelerator provided for the second embodiment of the present application;

[0042] Figure 5 An application flowchart of the security verification encryption accelerator provided for the second embodiment of the application method of the security verification encryption accelerator of the present application;

[0043] Figure 6 An overall architecture diagram of the security key management unit provided for the second embodiment of the application method of the security verification encryption accelerator of the present application;

[0044] Figure 7 A device structure schematic diagram of the hardware running environment involved in the application method of the security verification encryption accelerator in the embodiment of the present application.

[0045] The purpose implementation, functional features and advantages of the present application will be further described with reference to the embodiments and the accompanying drawings. DETAILED DESCRIPTION

[0046] It should be understood that the first embodiment described herein is only used to explain the technical solutions of the present application, and is not used to limit the present application.

[0047] In order to better understand the technical solutions of the present application, the following will be described in detail in combination with the drawings of the specification and the specific embodiments.

[0048] In the first embodiment of the present application, the security check encryption accelerator comprises: a check module, configured to, in the case of receiving to-be-checked code, check whether an address interval corresponding to the to-be-checked code is complete based on a preset address check interval and a preset address check value; and a security key management module, configured to, in the case that the address interval corresponding to the to-be-checked code is complete, process encryption and decryption requests corresponding to the to-be-checked code.

[0049] In the first embodiment, for the convenience of description, the security check encryption accelerator is taken as the execution subject for illustration.

[0050] Reference Figure 1 , Figure 1 FIG. 1 is a general-purpose cryptographic algorithm accelerator system architecture diagram provided by the first embodiment of the security check encryption accelerator of the present application. The host code is input into the accelerator through the bus, the accelerator directly receives the host code, processes the input instructions, and inputs the input instructions into the code operation unit to obtain the output data, which is output to the output queue. As can be seen, in the existing general-purpose cryptographic algorithm accelerator system architecture, the security of the accelerator depends on the external operating environment such as the host operating system and the driver program. When the host code is maliciously tampered with, the accelerator cannot actively identify and block the exception, resulting in poor security.

[0051] The present application provides a solution. The check module actively checks the integrity of the address interval corresponding to the to-be-checked code, which can timely find out whether the to-be-checked code is tampered with, instead of passively relying on the security of the external environment, thereby enhancing the identification ability of the accelerator itself to abnormal situations. The security key management module processes the encryption and decryption requests only when the address interval of the to-be-checked code is complete, thereby closely associating the encryption and decryption operations with the security of the system environment, avoiding critical operations in an unsafe environment, and internally ensuring the safe operation of the accelerator. The problem of poor security of the accelerator in the prior art is effectively solved, and the security and reliability of the entire system are improved.

[0052] It should be noted that the execution subject of the first embodiment can be a computing service device with data processing, network communication and program running functions, such as a tablet computer, a personal computer, a mobile phone and the like, or a system, an application, a program and the like capable of realizing the above functions. The first embodiment and the following embodiments are described below by taking the security check encryption accelerator as an example.

[0053] All actions of obtaining signals, information or data in the present application are performed under the premise of complying with the corresponding data protection regulations and policies of the country where the device is located, and with the authorization given by the owner of the corresponding device.

[0054] Based on this, the embodiments of the present application provide a security check encryption accelerator, which is described with reference to Figure 2 ,Figure 2 A schematic diagram of a module structure of a security check encryption accelerator of the present application.

[0055] In this embodiment, the security check encryption accelerator comprises:

[0056] The check module 10 is configured to, in the case of receiving the code to be checked, check whether the address interval corresponding to the code to be checked is complete based on the preset address check interval and the preset address check value.

[0057] It should be noted that the code to be checked refers to program code or data code that needs to be subjected to security check and possibly subsequent encryption and decryption processing. The preset address check interval is all available address intervals recorded in advance, including the address intervals corresponding to all applicable codes. The preset address check value is the hash value calculated for each address interval in the preset address check interval, which is used for subsequent comparison with the hash value calculated for the address interval to be checked.

[0058] The security key management module 20 is configured to, in the case that the address interval corresponding to the code to be checked is complete, process the encryption and decryption request corresponding to the code to be checked.

[0059] It should be noted that the decryption request refers to a request issued by the code to be checked, such as key generation, key import, key export, etc. All keys are stored in the security key management module, which can meet the encryption and decryption request in the code to be checked.

[0060] For example, when the check module confirms that the address interval corresponding to the code to be checked is complete, it sends a signal allowing processing to the security key management module. After receiving this signal, the security key management module will start the corresponding encryption and decryption processing procedure according to the encryption and decryption request information carried by the code to be checked. For example, the encryption key or decryption key corresponding to the code to be checked is obtained from the security key storage area, and these keys and the preset encryption and decryption algorithm are used to perform encryption or decryption operation on the code to be checked. During the processing, the security key management module will strictly follow the security protocol and encryption standard to ensure the security and reliability of the encryption and decryption process.

[0061] In this embodiment, the check module actively checks the integrity of the address interval corresponding to the code to be checked, which can timely discover whether the code is tampered with, and associates the check result with the processing operation of the security key management module. Only in the case that the code address interval is complete, the encryption and decryption and other key operations are performed, rather than passively relying on the security of the external environment, thus actively ensuring the safe operation of the accelerator from the inside.

[0062] In one possible embodiment, the check module comprises:

[0063] The address management unit includes access intervals, each of which is allocated with a virtual machine, and the access interval of the virtual machine includes an address verification interval and an instruction interval. The address verification interval stores preset address verification intervals and preset address verification values. The instruction interval is used to receive to-be-verified code, which includes host driver code and runtime environment code.

[0064] It should be noted that the address management unit allocates independent access intervals for each virtual machine, and these access intervals include address verification intervals and instruction intervals. In the initialization stage, the address intervals of all possible codes are written into the registers of the address verification intervals, and the hash values of these address intervals are calculated as preset address verification values for storage. The host driver code is the driver program code of the accelerator host end, which is used to send the parameters of the to-be-processed task to the accelerator through the system bus for processing, and control the behavior of the accelerator. The runtime environment code refers to the related code in the environment of the host operating system and the like on which the accelerator depends. These codes provide the necessary support environment for the operation of the accelerator, such as providing codes related to memory management, task scheduling and the like.

[0065] The address management unit is used to determine the first address interval corresponding to the host driver code and the second address interval corresponding to the runtime environment code when the host driver code and the runtime environment code are input in the instruction interval, call the data verification unit to calculate the first hash value of the first address interval, compare the first hash value with the first preset address verification value associated with the first address interval to obtain a first verification result, and call the data verification unit to calculate the second hash value of the second address interval, compare the second hash value with the second preset address verification value associated with the second address interval to obtain a second verification result. In the case that the first verification result and the second verification result are both passed, it is determined that the address interval corresponding to the to-be-verified code is complete, and the to-be-verified code is input into the security key management module for execution.

[0066] It should be noted that the first address interval is a specific address range occupied by the host driver code in the system storage space, and the second address interval is an address range of the running environment code in the system storage space. The first hash value is a value obtained by the data verification unit after performing hash calculation on the address data of the first address interval, and the second hash value is a value obtained by the data verification unit after performing hash calculation on the address data of the second address interval. The first preset address verification value is a standard hash value stored in the address verification interval and associated with the first address interval, and the second preset address verification value is a standard hash value stored in the address verification interval and associated with the second address interval. The first verification result is a judgment result obtained by the address management unit after comparing the first hash value with the first preset address verification value, and the second verification result is a judgment result obtained by the address management unit after comparing the second hash value with the second preset address verification value.

[0067] In addition, it should be noted that after determining the first address interval and the second address interval, the address management unit sends a verification request to the data verification unit. After receiving the request, the data verification unit reads the first address interval and the second address interval corresponding to the code to be verified, and uses a specific hash algorithm (such as SHA-256) to calculate the data in the two address intervals. For the first address interval, the data verification unit calculates the first hash value, and then compares the first hash value with the first preset address verification value stored in the address verification interval and associated with the first address interval. If they are completely consistent, it means that the data in the first address interval has not been changed, the verification is passed, and the first verification result is passed. On the contrary, if they are not consistent, it means that the data may be tampered with or damaged, the verification is not passed, and the first verification result is not passed. Similarly, for the second address interval, the data verification unit calculates the second hash value and compares it with the second preset address verification value to obtain the second verification result.

[0068] The data verification unit is configured to receive the verification request of the address management unit and read the address interval corresponding to the code to be verified to calculate the hash value.

[0069] It should be noted that after receiving the verification request of the address management unit, the data verification unit reads the address interval data corresponding to the code to be verified and calculates the hash value to obtain the verification result. The address management unit finds the target preset address verification interval corresponding to the current instruction in the address verification interval according to the address interval corresponding to the current instruction, and determines the target preset address verification value corresponding to the interval. The calculated verification result is compared with the target preset address verification value. In the case of passing the comparison, the address management unit inputs the code to be verified into the security key management module for execution. In the case of failing the comparison, the related instruction is rejected for execution, and the related exception is reported.

[0070] In this embodiment, by assigning an independent access interval to each virtual machine and presetting a check value, a hardware-based check basis is established, which is independent of the security of external software environment. By triggering the check when the instruction is received, it can be found in time whether the code to be checked is tampered with, preventing malicious code from entering the accelerator for execution. By comparing the hash values, it can be ensured that the code to be checked has not been tampered with, preventing security problems such as key leakage caused by code tampering, timely stopping the execution of illegal code, and reporting exceptions for the system administrator to handle security problems in time.

[0071] In a feasible embodiment, the preset address check value is written by the address management unit during initial configuration, taking all available address intervals as preset address check intervals, and calling the data check unit to calculate the hash value of the preset address check interval.

[0072] It should be noted that the available address interval refers to a set of address ranges in the system memory that can be used by virtual machines to store host driver code and runtime environment code. These address intervals are pre-planned, and each virtual machine is assigned independent and non-overlapping space to ensure data isolation and security between virtual machines. For example, in a system with multiple virtual machines, the available address interval of virtual machine A may be 0x1000-0x2000, and the available address interval of virtual machine B may be 0x3000-0x4000.

[0073] Illustratively, during the initial configuration phase of system startup or virtual machine creation, the address management unit determines all available address intervals according to system design or resource allocation requirements of the virtual machine, and writes these address intervals as preset address check intervals into the corresponding storage area under the address check interval. These preset address check intervals precisely define the code storage range that needs to be checked for integrity. After completing the writing of the preset address check interval, the address management unit calls the data check unit to read all data in the interval according to the address range specified by the preset address check interval, and uses a specific hash algorithm (such as SHA-256, etc.) to calculate these data, finally obtaining a unique hash value. This hash value is the preset address check value, which is stored in the corresponding storage area under the address check interval.

[0074] For the sake of understanding the technical concept or technical principle of the present application, please refer to Figure 3 , Figure 3A scenario diagram of an address management unit is provided, which contains a plurality of virtual machine access intervals (such as a virtual machine 0 access interval, a virtual machine 1 access interval, …, a virtual machine x access interval), each of which includes an address verification interval and an instruction interval, the address verification interval stores a to-be-verified address interval, a corresponding verification value, and a verification enable state, for example, a to-be-verified address interval in the virtual machine 0 access interval is 0x0000-0x0FFF, the corresponding verification value is 0xabcd_efgh, and the verification enable state is 1, indicating that it is in a verification state, and the instruction interval stores instructions (such as instruction 1, instruction 2, …).

[0075] In this embodiment, by writing the available address interval into the preset address verification interval, a foundation is established for subsequent verification work, the code storage range that needs to be verified is determined, and illegal code is prevented from being executed in an unauthorized address interval. By storing the preset address verification value, data support is provided for subsequent verification work, and the accuracy and reliability of the verification process are ensured.

[0076] In a feasible embodiment, the security key management module includes:

[0077] A key control unit for generating a root key and controlling each unit in the security key management module to respond to encryption and decryption requests;

[0078] It should be noted that the root key is the cornerstone of the entire key management system and is the source of all other key derivation, and has very high security and authority. The encryption and decryption request is an instruction sent by an external system to the security key management module, requiring encryption or decryption operation on specific data. For example, when a user needs to send a sensitive file, the application program will send an encryption request to the security key management module, and the request contains the file data to be encrypted and related encryption parameters; when the recipient receives the encrypted file, a decryption request will be sent to decrypt the file.

[0079] Illustratively, the key control unit generates the root key of the key management unit after the security key management module is powered on and reset. This key can only be used as an encryption and decryption key for key import and export, and cannot be exported. When the security key management module receives an encryption and decryption request, the key control unit first parses and verifies the request. If the request is legal, the key control unit controls each unit in the security key management module to respond to the encryption and decryption request, including key generation, key import, key export, etc.

[0080] An encryption and decryption unit, which includes an encryption subunit and a decryption subunit, the encryption unit is used for encrypting plaintext, and the decryption unit is used for decrypting ciphertext;

[0081] It should be noted that the encryption subunit is part of the encryption and decryption unit, responsible for encrypting plaintext data, which converts the original plaintext data into ciphertext data according to the preset encryption algorithm and key. The decryption subunit is also an important part of the encryption and decryption unit, and its function is opposite to that of the encryption subunit, which is responsible for decrypting the ciphertext data. It uses the same algorithm and corresponding key as encryption to restore the ciphertext to plaintext.

[0082] Illustratively, if it is a key encryption request, the encryption unit encrypts the key plaintext using the root key, and if it is a key decryption request, the decryption unit decrypts the key ciphertext using the corresponding root key.

[0083] A random number generation unit for generating a first random number for key scrambling and a second random number for generating a key;

[0084] It should be noted that the first random number is generated by the random number generation unit, which is a random number for key scrambling, which can increase the randomness of the key scrambling process and improve the security of the key. The second random number is also generated by the random number generation unit, mainly used for generating the key, which can be used as a seed for key generation, and the final key is generated through a specific algorithm.

[0085] Illustratively, the random number generation unit generates the first random number and the second random number using a random number generation algorithm according to the instructions of the key control unit, which have high randomness and unpredictability, providing security for key generation and scrambling.

[0086] A key scrambling unit for scrambling the second random number or the encrypted key in combination with the first random number and storing it to the key storage unit, and descrambling the scrambled key output by the key storage unit;

[0087] It should be noted that the scrambled key is the key processed by the key scrambling unit, which combines the second random number or the encrypted key with the first random number, changes the original form of the key, and increases the complexity and security of the key.

[0088] Illustratively, when storing the key, the key scrambling unit scrambles the second random number or the encrypted key in combination with the first random number, such as using the random number as a hash seed to change the hash value distribution to prevent output concentration due to similar input, and then stores the scrambled key to the key storage unit; When the key is needed, the key scrambling unit reads the scrambled key from the key storage unit and descrambles it to restore the original key.

[0089] A dynamic error correction unit for correcting erroneous data in the memory when the read-write port is idle;

[0090] It should be noted that the dynamic error correction unit monitors the working state of the read-write port in real time, and judges whether the read port is in a busy state of reading data or an idle state by reading the control signal of the memory, such as the read enable signal. For example, when the read enable signal is in an active state, it is judged that the read port is in a busy state; when the read enable signal is in an inactive state and there is no read operation request, it is judged that the read port is in an idle state. When it is detected that the read-write port is idle, the error data read in the memory is automatically corrected to obtain corrected data.

[0091] A key storage unit for storing the scrambling key;

[0092] It should be noted that the scrambling key generated by the key scrambling unit will be stored in the key storage unit.

[0093] A key channel for directly transmitting all keys in the secure key management module.

[0094] It should be noted that the key channel is a hardware channel in the secure key management module that is specially used for directly transmitting all keys, and it is independent of other data transmission channels and has high security and isolation. The key channel uses encryption transmission technology to encrypt the transmitted keys in real time, ensuring that the keys cannot be stolen or tampered with during transmission.

[0095] For example, in the process of transmitting the key from the key storage unit to the encryption and decryption unit, the key is transmitted through the key channel and encrypted using a specific encryption algorithm, and only the encryption and decryption unit can decrypt and use the keys.

[0096] In this embodiment, the key control unit ensures the standardization and orderliness of the key generation, encryption and decryption processes by centrally managing and controlling the operation of each unit, avoiding security vulnerabilities caused by operational errors. The encryption and decryption unit enhances the encryption strength of the data and improves the security of the data during transmission and storage by providing multiple encryption algorithm selections and strict key usage management. The random number generation unit solves the problem of predictable random numbers by using a hardware random number generator, improving the security of key generation and scrambling. The key scrambling unit improves the security of the key during storage by scrambling the key, so that even if an attacker obtains the scrambled key, the original key cannot be directly obtained. The dynamic error correction unit ensures the accuracy and reliability of the data in the memory by monitoring and correcting error data in real time. The key storage unit solves the security problem of key storage by using high-security storage media and strict access control mechanisms. The key channel solves the security problem in the key transmission process by providing an independent and encrypted transmission channel, preventing the key from being leaked during transmission.

[0097] In an implementable embodiment, the key control unit comprises a PUF subunit, which is configured to read the SRAM power-on value in the key control unit after the secure key management module is reset, and process the SRAM power-on value in combination with the PUF to generate a root key.

[0098] It should be noted that the PUF (Physical Unclonable Function) subunit is a hardware module that generates unique identification and keys by utilizing hardware physical characteristics. During the manufacturing process, each hardware device will have unique physical characteristics due to slight process differences. The PUF subunit can capture these subtle and non-reproducible physical characteristics and convert them into digital information that can be used for security authentication and key generation. For example, in integrated circuits, the slight differences in physical parameters such as transistor threshold voltage and wire resistance can be utilized by the PUF subunit to generate unique responses. These responses have high randomness and unpredictability and are difficult to copy or forge, providing a natural security foundation for the system. SRAM (Static Random-Access Memory) is a common memory device, and the power-on value refers to the initial state value (0 or 1) of each memory cell at the moment of power-on. Due to the randomness of the manufacturing process, the initial state of the SRAM memory cell at power-on is uncertain and random. Even for SRAM chips of the same design and manufacturing, the initial values of individual memory cells will be different each time they are powered on.

[0099] Illustratively, when the secure key management module receives a reset signal, the PUF subunit begins to work. First, it reads the power-on value of the SRAM in the key control unit. The PUF subunit is connected to the SRAM through a specific interface and captures the initial state data of the SRAM memory cell at the moment of reset. After the PUF subunit obtains the SRAM power-on value, it further processes these data using its own physical characteristics. It will generate a unique and non-reproducible response value based on the characteristics of the SRAM power-on value and its own PUF algorithm. This response value is closely related to the SRAM power-on value and the physical characteristics of the PUF subunit, has extremely high uniqueness and security, and finally outputs a stable root key. This root key will serve as the basis for the secure key management module and be used for subsequent key derivation, encryption and decryption operations.

[0100] In this embodiment, by reading the SRAM power-on value, original data with high randomness is obtained, which lays the foundation for generating a secure root key. This randomness makes it difficult for attackers to obtain the root key through guessing or prediction, enhancing the security of the system. After processing by the PUF sub-unit, a unique and secure root key is generated. This root key not only has the randomness of the SRAM power-on value, but also combines the physical uniqueness of the PUF sub-unit, making it impossible for attackers to recover the root key even if they obtain the SRAM power-on value. This greatly improves the security and reliability of the root key, ultimately generating a secure and reliable root key, providing a solid foundation for the subsequent operation of the secure key management module.

[0101] In a feasible implementation, the key control unit further comprises a decryption control sub-unit, and the decryption control sub-unit is configured to respond to a decryption request;

[0102] In the case where the decryption request is a key generation request, the random number generation unit is called to generate a second random number, and the key scrambling unit is called to scramble the second random number and store it in the key storage unit;

[0103] It should be noted that the key generation request is an instruction signal sent by a system external or internal module to the decryption control sub-unit, requiring the generation of a new key. For example, when a new encrypted communication session starts, the application layer modules of the communication parties will send a key generation request to the key control unit to obtain the key for this communication encryption.

[0104] For example, when the decryption control sub-unit receives a key generation request, it calls the random number generation unit to generate a second random number, then calls the key scrambling unit to scramble the second random number, and stores the scrambled result in the key storage unit.

[0105] In the case where the decryption request is a key derivation request, the first target key corresponding to the key derivation request is read from the key storage unit, the key scrambling unit is called to descramble the first target key, and the decryption unit is called to encrypt the descrambled first target key based on the root key and output;

[0106] It should be noted that the key derivation request is an instruction to obtain a specific key from the key storage unit. For example, when a certain encryption module needs to use a previously stored key for data encryption, it will send a key derivation request to the decryption control sub-unit, specifying the key information to be derived. The first target key refers to the specific key that needs to be read from the key storage unit in the key derivation request. For example, in a multi-key management system, according to the identification information in the key derivation request, the key to be derived for specific business encryption is determined as the first target key.

[0107] Exemplarily, upon receiving the key derivation request, the encryption and decryption control subunit reads the first target key corresponding to the key derivation request from the key storage unit, calls the key scrambling unit to descramble the first target key, and then calls the encryption and decryption unit to encrypt the descrambled first target key based on the root key and output.

[0108] In the case where the encryption and decryption request is a key import request, the encryption key input by the key import request is received, the encryption and decryption unit is called to decrypt the encryption key based on the root key to obtain a decryption key, and the key scrambling unit is called to scramble the decryption key and store it in the key storage unit;

[0109] It should be noted that the key import request refers to a request in which an external system inputs an encryption key and requires the encryption key to be imported into the system and processed accordingly. For example, during system initialization or key update, a security administrator sends a key import request to the key control unit through a security interface to transmit a new encryption key into the system. The encryption key is in the form of a key obtained by encrypting an original key using a specific encryption algorithm. The decryption key is the original key obtained by decrypting the encryption key.

[0110] Exemplarily, upon receiving the key import request, the encryption and decryption control subunit receives the encryption key input by the key import request, calls the encryption and decryption unit to decrypt the encryption key based on the root key to obtain a decryption key, and then calls the key scrambling unit to scramble the decryption key and store it in the key storage unit.

[0111] In the case where the encryption and decryption request is a key switch request, the second target key corresponding to the key switch request is read from the key storage unit, the key scrambling unit is called to descramble the second target key, and the encryption and decryption unit is called to encrypt the descrambled second target key based on the root key and output;

[0112] It should be noted that the key switch request refers to an instruction that requires the system to switch the currently used key to another key. For example, when it is detected that the currently used key may have security risks, or the key needs to be replaced according to a preset key rotation strategy, a key switch request is issued. The second target key refers to a specific key that needs to be read from the key storage unit and subjected to a switching operation in the key switch request. For example, when the system needs to switch from the currently used key to another backup key, the key to be switched as determined according to the key switch request is the second target key.

[0113] Exemplarily, after receiving the key switching request, the encryption and decryption control subunit reads the second target key corresponding to the key switching request from the key storage unit, calls the key scrambling unit to descramble the second target key, and then calls the encryption and decryption unit to encrypt the descrambled second target key based on the root key and then output.

[0114] In the case of the encryption and decryption request being a data encryption and decryption request, the data stream in the data encryption and decryption request is extracted, the third target key corresponding to the data encryption and decryption request is read from the key storage unit, the encryption and decryption unit is called, and the data stream is encrypted and decrypted based on the third target key and then output.

[0115] It should be noted that the data encryption and decryption request is an instruction for requesting encryption or decryption operation on a specific data stream. For example, in the data transmission process, the sender will issue a data encryption request to convert plaintext data into ciphertext data, and the receiver will issue a data decryption request to restore the ciphertext data to plaintext data. The third target key refers to a specific key used for encryption and decryption operation on the data stream in the data encryption and decryption request. For example, the key read from the key storage unit according to the specified service type or data source in the data encryption and decryption request is the third target key.

[0116] Exemplarily, when receiving the data encryption and decryption request, the encryption and decryption control subunit extracts the data stream in the data encryption and decryption request, reads the third target key corresponding to the data encryption and decryption request from the key storage unit, calls the encryption and decryption unit, and encrypts and decrypts the data stream based on the third target key and then outputs.

[0117] In this embodiment, the second random number is generated by calling the random number generation unit, which increases the randomness of the key. The random number is further scrambled to further enhance the security of the key, prevent the key from being stolen during generation and storage, ensure the security of the key during derivation by descrambling the first target key and encrypting it based on the root key, even if the key is intercepted during transmission, the attacker cannot obtain its real content, and ensure the security of the key during import and storage by decrypting the encrypted key based on the root key and scrambling the decrypted key. The security of the key during switching is ensured by descrambling the second target key and encrypting it based on the root key, so that the system can smoothly and safely complete the key switching operation. The data stream is quickly and accurately extracted, the corresponding third target key is read, and the encryption and decryption operation is efficiently performed, thereby improving the efficiency and security of data encryption and decryption.

[0118] Based on the first embodiment of the present application, in the second embodiment of the present application, the same or similar contents as the above first embodiment can be referred to the above introduction, and will not be described in detail. On this basis, please refer to Figure 4, applied to a security check encryption accelerator, the security check encryption accelerator comprising a check module and a security key management module, and the application method of the security check encryption accelerator comprising steps S01-S02:

[0119] In step S01, a code to be checked is received, and the address interval corresponding to the code to be checked is checked by the check module based on a preset address check interval and a preset address check value.

[0120] It should be noted that the security check encryption accelerator receives host driver code and runtime environment code, and then extracts the address interval corresponding to the two types of code through the internal check module. For example, in a computer system, the host driver code is responsible for managing the interaction between hardware devices and the operating system, and the runtime environment code provides a specific environment required for the application program to run. When these codes are transmitted to the security check encryption accelerator, the check module will accurately locate the start address and end address of the code in the memory, like a precision scanner, to determine the address interval thereof, and at the same time, determine the preset address check interval corresponding to the extracted address interval, and then calculate the hash value corresponding to the address interval and compare it with the preset address check value corresponding to the preset address check interval.

[0121] It can be understood that step S01 extracts the address interval corresponding to the code, ensures that the code entering the accelerator has a clear address range, provides basic data for subsequent checking, can preliminarily identify the position information of the code, prevents illegal code from being executed in an unknown address region, accurately judges whether the code address is within a legal range by determining the preset address check interval and comparing the hash values, discovers address tampering behavior in a timely manner, realizes accurate checking of the code address, and effectively prevents security threats caused by address tampering.

[0122] In step S02, in the case where the address interval corresponding to the code to be checked is complete, the encryption and decryption request corresponding to the code to be checked is processed by the security key management module.

[0123] It should be noted that in the case where the hash value and the preset address check value are consistent, it is determined that the address interval corresponding to the code to be checked is complete, and the security key management module in the security check encryption accelerator will execute the encryption and decryption request corresponding to the host driver code. For example, after the check is passed, the accelerator considers that the host driver code is safe and reliable, at which time the security key management module will acquire the corresponding keys from the secure key storage area according to the encryption and decryption instructions in the code, and use these keys to perform encryption or decryption operations on the data.

[0124] By way of example, in order to facilitate understanding of the technical concept or technical principle of the present application, reference can be made to Figure 5 , Figure 5An application flowchart of the security check encryption accelerator is provided. After the host code is input into the check module, the data check unit and the address management unit in the check module check whether the host code is complete, and obtain each instruction (for example, instruction 1, instruction 2, …) corresponding to the host code. The instructions are input into the security key management module for processing, and the results are output to each output buffer (for example, output buffer 1, output buffer 2, …), and finally an output queue is obtained, which contains the execution results of the host code.

[0125] It can be understood that step S02 ensures that only the code that has passed the security verification can use the encryption function by performing the encryption and decryption request only after the hash value comparison is consistent, guarantees the security of the encryption and decryption operation, and prevents illegal access to the key and data by malicious code.

[0126] For the purpose of facilitating the understanding of the technical concept or technical principle of the present application, reference can be made to Figure 6 , Figure 6The overall architecture diagram of the security key management unit is provided, which comprises an encryption unit, a decryption unit, a key scrambling unit, a random number generator unit, a key control unit, a dynamic error correction unit and a key storage unit. The decryption unit is used for decrypting the external key ciphertext and storing it into the key storage unit through the key channel to realize key import. The encryption unit is used for encrypting the key output by the key storage unit and saving it externally to realize key export. The root key used by the encryption unit and the decryption unit is transmitted through the key channel and directly used by the encryption and decryption logic circuit without being leaked to the data path. The encryption unit and the decryption unit can also perform encryption and decryption of plaintext or ciphertext when key import and export are not required. The key scrambling unit performs XOR operation on the random number provided by the random number generation unit to realize scrambling of the input key or descrambling of the output key, thereby realizing key scrambling storage. The random number generation unit is used to provide the random number required for key scrambling under the control of the key control unit, and also provides a random number for key generation. The generated key will be scrambled by the key scrambling unit and then stored. The key control unit is used to respond to the encryption and decryption request input from the outside. The key control unit is composed of an encryption and decryption control unit and a PUF unit. The encryption and decryption control unit is used to process the encryption and decryption request to realize key generation, key import, key export and other functions. The PUF unit is an SRAM-based physically unclonable function, which is used to generate the root key of the key management unit. The root key is the key used for key import and export, and the key cannot be exported. The dynamic error correction unit mainly comprises a read-write unit and a read-write monitoring unit. The read-write monitoring unit is used to monitor the read-write behavior of the memory, and the read-write unit is used to initiate the read-write behavior of the memory and perform ECC correction of the read-write data. The dynamic error correction unit timely corrects the original data in the memory when the read-write port is idle to avoid the occurrence of 2-bit error correction and other situations as much as possible. The key storage unit is used to store the scrambled key.

[0127] It should be noted that the above examples are only used for understanding the present application and do not constitute a limitation on the application method of the security verification encryption accelerator. Further simple transformations based on this technical concept are within the protection scope of the present application.

[0128] The security verification encryption accelerator provided by the present application adopts the application method of the security verification encryption accelerator in the above embodiment, which can solve the technical problem of poor security of the accelerator. Compared with the prior art, the security verification encryption accelerator provided by the present application has the same beneficial effects as the application method of the security verification encryption accelerator provided by the above embodiment, and other technical features in the security verification encryption accelerator are the same as the features disclosed in the above embodiment method, which will not be repeated here.

[0129] The application provides an electronic device, comprising: at least one processor; and a memory connected with the at least one processor in communication; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the application method of the secure verification encryption accelerator in the above embodiment one.

[0130] Reference will now be made to the following description Figure 7 , which shows a structural schematic diagram of an electronic device suitable for implementing the embodiments of the application. The electronic device in the embodiments of the application can include, but is not limited to, mobile terminals such as mobile phones, notebook computers, digital broadcast receivers, PDAs (Personal Digital Assistant), PADs (Portable Application Description), PMPs (Portable Media Player), vehicle-mounted terminals (for example, vehicle-mounted navigation terminals), and the like, and fixed terminals such as digital TVs, desktop computers, and the like. Figure 7 The electronic device shown is merely an example and should not impose any limitation on the functions and use range of the embodiments of the application.

[0131] As Figure 7 shown, the electronic device can include a processing device 1001 (for example, a central processor, a graphics processor, and the like) that can perform various appropriate actions and processes according to programs stored in a read-only memory 1002 or loaded from a storage device 1003 into a random access memory 1004. Various programs and data required for the operation of the electronic device are also stored in the random access memory 1004. The processing device 1001, the read-only memory 1002, and the random access memory 1004 are connected to each other through a bus 1005. An input / output interface 1006 is also connected to the bus. Generally, the following systems can be connected to the input / output interface 1006: input devices 1007 including, for example, a touch screen, a touch pad, a keyboard, a mouse, an image sensor, a microphone, an accelerometer, a gyroscope, and the like; output devices 1008 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, and the like; the storage device 1003 including, for example, a magnetic tape, a hard disk, and the like; and a communication device 1009. The communication device 1009 can allow the electronic device to communicate with other devices wirelessly or by wire to exchange data. Although the electronic device with various systems is shown in the figure, it should be understood that all the systems shown are not required to be implemented or provided. More or fewer systems can be alternatively implemented or provided.

[0132] In particular, according to the embodiments disclosed in the present application, the process described above with reference to the flowchart can be implemented as a computer software program. For example, the embodiments disclosed in the present application include a computer program product comprising a computer program carried on a computer readable medium, the computer program containing program code for executing the method shown in the flowchart. In such embodiments, the computer program can be downloaded and installed from a network through a communication device, or installed from the storage device 1003, or installed from the read-only memory 1002. When the computer program is executed by the processing device 1001, the above-mentioned functions defined in the method of the embodiments disclosed in the present application are executed.

[0133] The electronic device provided by the present application adopts the application method of the security check encryption accelerator in the above-mentioned embodiments, and can solve the technical problem of poor security of the accelerator. Compared with the prior art, the electronic device provided by the present application has the same beneficial effects as the application method of the security check encryption accelerator provided by the above-mentioned embodiments, and other technical features in the electronic device are the same as the features disclosed in the previous embodiment method, which will not be repeated here.

[0134] It should be understood that parts of the present application can be realized by hardware, software, firmware or a combination thereof. In the description of the above-mentioned embodiments, specific features, structures, materials or characteristics can be combined in any one or more embodiments or examples in a suitable manner.

[0135] The above is merely specific embodiments of the present application, but the protection scope of the present application is not limited thereto, and any person skilled in the art can easily think of changes or replacements within the technical scope disclosed in the present application, which should be covered within the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.

[0136] The present application provides a computer readable storage medium having stored thereon computer readable program instructions (i.e. computer program) for executing the application method of the security check encryption accelerator in the above-mentioned embodiments.

[0137] The computer readable storage medium provided in the application may be, for example, a U disk, but is not limited to an electric, magnetic, optical, electromagnetic, infrared, or semiconductor system or device, or any combination of the above. More specific examples of the computer readable storage medium may include, but are not limited to, an electric connection with one or more conductive wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the embodiment, the computer readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system or device. The program code contained on the computer readable storage medium can be transmitted by any suitable medium, including but not limited to an electric wire, an optical cable, an RF (Radio Frequency), and the like, or any suitable combination of the above.

[0138] The computer readable storage medium described above may be contained in an electronic device, or may exist separately without being assembled into an electronic device.

[0139] The computer readable storage medium described above carries one or more programs, which, when executed by the electronic device, cause the secure verification encryption accelerator to: receive to-be-verified code, verify, by a verification module, whether an address interval corresponding to the to-be-verified code is complete based on a preset address verification interval and a preset address verification value; and in a case where the address interval corresponding to the to-be-verified code is complete, process, by a security key management module, an encryption and decryption request corresponding to the to-be-verified code.

[0140] Computer program code for carrying out operations of the present application can be written in any combination of one or more programming languages, including an object oriented programming language such as Java, Smalltalk, C++ or the like and conventional procedural programming languages, such as the "C" programming language or similar programming languages. The program code can execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer or entirely on the remote computer or server. In the latter scenario, the remote computer can be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection can be made to an external computer (for example, through the Internet using an Internet Service Provider).

[0141] The flow diagrams and the block diagrams in the drawings are meant as methodological and functional description of implementations of systems, methods, and computer program products according to various embodiments of the present application. In this regard, each block in the flow diagrams or block diagrams can represent a module, a segment, or a portion of code, which comprises one or more executable instructions for implementing the specified logical function(s). It should also be noted that in some alternative implementations, the functions noted in the blocks can occur out of the order noted in the figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently or the blocks may

[0142] The modules involved in the embodiments of the present application can be implemented in software or hardware. In some cases, the names of the modules do not limit the modules themselves.

[0143] The readable storage medium provided by the present application is a computer readable storage medium, which stores computer readable program instructions (i.e. computer programs) for executing the application method of the security verification encryption accelerator, and can solve the technical problem of poor security of the accelerator. Compared with the prior art, the computer readable storage medium provided by the present application has the same beneficial effects as the security verification encryption accelerator application method provided by the above embodiments, which will not be repeated here.

[0144] The application further provides a computer program product comprising a computer program which, when executed by a processor, implements the steps of the application method of the secure verification encryption accelerator as described above.

[0145] The computer program product provided by the application can solve the technical problem of poor security of the accelerator. Compared with the prior art, the computer program product provided by the application has the same beneficial effects as the application method of the secure verification encryption accelerator provided by the above-mentioned embodiments, and will not be described here.

[0146] The above-mentioned is only part of the embodiments of the application, and does not limit the patent scope of the application. Any equivalent structural transformation, direct / indirect application in other related technical fields based on the technical concept of the application, and the contents of the specification and drawings are included in the patent protection scope of the application.

Claims

1. A secure check cryptographic accelerator, comprising: The security check encryption accelerator comprises: a check module, configured to check, when receiving a code to be checked, whether an address interval corresponding to the code to be checked is complete based on a preset address check interval and a preset address check value; a security key management module, configured to process an encryption and decryption request corresponding to the code to be checked when the address interval corresponding to the code to be checked is complete.

2. The secure checkpointing encryption accelerator of claim 1, wherein, The check module comprises: an address management unit, comprising access intervals, each of which is allocated with a virtual machine, an access interval of the virtual machine comprising an address check interval and an instruction interval, the address check interval storing the preset address check interval and the preset address check value, and the instruction interval being configured to receive the code to be checked, the code to be checked comprising a host driver code and a runtime environment code; the address management unit being configured to, when detecting that the host driver code and the runtime environment code are input in the instruction interval, determine a first address interval corresponding to the host driver code and a second address interval corresponding to the runtime environment code, call a data check unit to calculate a first hash value of the first address interval, compare the first hash value with a first preset address check value associated with the first address interval to obtain a first check result, call the data check unit to calculate a second hash value of the second address interval, compare the second hash value with a second preset address check value associated with the second address interval to obtain a second check result, and determine that the address interval corresponding to the code to be checked is complete when both the first check result and the second check result are passed, and input the code to be checked into the security key management module for execution; a data check unit, configured to receive a check request of the address management unit and read an address interval corresponding to the code to be checked for hash value calculation.

3. The secure checkpoint cryptographic accelerator of claim 2, wherein, The preset address check value is written by the address management unit when performing initial configuration, all available address intervals being taken as the preset address check interval, and the data check unit being called to calculate a hash value of the preset address check interval.

4. The secure checkpoint cryptographic accelerator of claim 1, wherein, The security key management module comprises: a key control unit, configured to generate a root key and control each unit in the security key management module to respond to the encryption and decryption request; an encryption and decryption unit, comprising an encryption subunit and a decryption subunit, the encryption subunit being configured to encrypt plaintext, and the decryption subunit being configured to decrypt ciphertext; a random number generation unit, configured to generate a first random number for key scrambling and a second random number for generating a key; a key scrambling unit, configured to scramble the second random number or an encrypted key in combination with the first random number and store the scrambled key to a key storage unit, and descramble a scrambled key output by the key storage unit; a dynamic error correction unit, configured to correct data with errors in a memory when a read-write port is idle; a key storage unit, configured to store a scrambled key; a key channel, configured to directly transmit all keys in the security key management module.

5. The secure checksum cryptographic accelerator of claim 4, wherein, The key control unit comprises a PUF subunit configured to read an SRAM power-on value in the key control unit after a secure key management module is reset, and to process the SRAM power-on value in combination with a PUF to generate the root key.

6. The secure checksum cryptographic accelerator of claim 4, wherein, The key control unit further comprises an encryption and decryption control subunit configured to respond to an encryption and decryption request; In a case where the encryption and decryption request is a key generation request, the random number generation unit is invoked to generate the second random number, and the key scrambling unit is invoked to scramble the second random number and store it in the key storage unit; In a case where the encryption and decryption request is a key derivation request, the key storage unit is read to obtain a first target key corresponding to the key derivation request, the key scrambling unit is invoked to descramble the first target key, and the encryption and decryption unit is invoked to encrypt the descrambled first target key based on the root key and output the encrypted first target key; In a case where the encryption and decryption request is a key import request, the encryption key input by the key import request is received, the encryption and decryption unit is invoked to decrypt the encryption key based on the root key to obtain a decryption key, and the key scrambling unit is invoked to scramble the decryption key and store it in the key storage unit; In a case where the encryption and decryption request is a key switch request, the key storage unit is read to obtain a second target key corresponding to the key switch request, the key scrambling unit is invoked to descramble the second target key, and the encryption and decryption unit is invoked to encrypt the descrambled second target key based on the root key and output the encrypted second target key; In a case where the encryption and decryption request is a data encryption and decryption request, the data stream in the data encryption and decryption request is extracted, the key storage unit is read to obtain a third target key corresponding to the data encryption and decryption request, and the encryption and decryption unit is invoked to encrypt or decrypt the data stream based on the third target key and output the encrypted or decrypted data stream.

7. A method for applying a security check to a cryptographic accelerator, characterized in that The secure verification encryption accelerator comprises a verification module and a secure key management module, and the application method of the secure verification encryption accelerator comprises: receiving a code to be verified, and verifying, by the verification module, whether an address interval corresponding to the code to be verified is complete based on a preset address verification interval and a preset address verification value; in a case where the address interval corresponding to the code to be verified is complete, processing, by the secure key management module, an encryption and decryption request corresponding to the code to be verified.

8. An electronic device, comprising: The device comprises a memory, a processor, and a computer program stored on the memory and executable on the processor, and the computer program is configured to implement the steps of the application method of the secure verification encryption accelerator of claim 7.

9. A storage medium, characterized by The storage medium is a computer-readable storage medium, and the storage medium stores a computer program, and the computer program is executed by a processor to implement the steps of the application method of the secure verification encryption accelerator of claim 7.

10. A computer program product, characterised in that, The computer program product comprises a computer program which, when executed by a processor, implements the steps of the method for applying a secure verification encryption accelerator according to claim 7.

Images