Data calling method, system and electronic device

Abstract

The present application discloses a data calling method, system and electronic device, which realizes encrypted storage of basic input and output data partition blocks by storing basic input and output data partition blocks in an encrypted memory of a first chip, and encrypting and storing header files of different blocks in a second memory, so that when calling, the header block in the second memory is called first, and then the block in the first memory is called based on a mapping relationship, thereby improving the security of the basic input and output data; in addition, the basic input and output data is stored in partition blocks, so that when calling the basic input and output data, it can be called according to the calling requirements according to the block, without calling all the data of the basic input and output data, thereby improving the data calling speed.

Description

Technical Field

[0001] The present application relates to the field of calling, and in particular to a data calling method, system and electronic device. Background Art

[0002] In modern trusted computing systems, it is generally believed that BIOS (Basic Input Output System) is trusted and is used as a trusted root. However, during use, the security of BIOS may be affected due to insufficient security level of BIOS. Summary of the invention

[0003] In view of this, the present application provides a data calling method, system and electronic device, and the specific scheme thereof is as follows:

[0004] A data calling method, comprising:

[0005] Determine a header file of a block to be called based on a call instruction obtained through a designated communication interface, wherein the header file of the block to be called is stored in a first memory in a first chip of an electronic device, the block to be called includes at least part of basic input and output data, and the first memory is an encrypted memory;

[0006] Determine the block to be called in the second memory in the first chip of the electronic device based on the mapping relationship between the header file of the block to be called and the block to be called, the block stored in the second memory is the encrypted data to be called;

[0007] Decrypting the block to be called through the permission module;

[0008] The decrypted data of the block to be called is output to the designated communication interface.

[0009] Furthermore, decrypting the block to be called by the permission module includes:

[0010] The file data of the block to be called stored in the second memory is decrypted by the permission module, and the file data is other files in the block to be called except the header file.

[0011] Further, the file data of the block to be called stored in the second memory is decrypted by the permission module, and the file data is other files in the block to be called except the header file, including:

[0012] If the calling instruction includes calling header files of at least two blocks to be called, determining a calling order of the header files of the at least two blocks to be called; determining the at least two blocks to be called in the second memory according to the mapping relationship based on the header files of the at least two blocks to be called;

[0013] The permission module sequentially decrypts the files in the at least two blocks to be called according to the calling order.

[0014] Furthermore,

[0015] The basic input-output data is encrypted and stored in the second memory, the basic input-output data is divided into at least one part, and each part of the at least one part is stored as a block;

[0016] The method further comprises:

[0017] The header file of each block in the at least one block is determined, and the header file of each block that meets the condition is stored in the first memory according to the mapping relationship, so as to determine the header file of the block to be called based on the calling instruction.

[0018] Furthermore, storing the header file of each block that meets the condition in the first memory according to the mapping relationship includes:

[0019] A security check is performed on the basic input and output data based on the permission module of the first chip. If the security check passes, the header file of each block is stored in the first memory according to the mapping relationship.

[0020] Furthermore, the security verification of the basic input and output data includes:

[0021] determining whether the basic input and output data stored in the second memory is complete;

[0022] and / or,

[0023] Determine whether the basic input and output data stored in the second memory has been modified.

[0024] An electronic device, comprising:

[0025] Specify the communication interface;

[0026] A first chip includes a first memory, a second memory and a permission module, wherein the first memory is an encrypted memory;

[0027] The processor is configured to determine a header file of a block to be called based on the calling instruction obtained by the designated communication interface, wherein the header file of the block to be called is stored in the first memory, and the block to be called includes at least part of the basic input and output data; determine the block to be called in the second memory based on a mapping relationship between the header file of the block to be called and the block to be called, wherein the block stored in the second memory is encrypted data to be called;

[0028] The block to be called is decrypted by the permission module, and the decrypted data of the block to be called is output to the designated communication interface.

[0029] Furthermore, decrypting the block to be called by the permission module includes:

[0030] The file data of the block to be called stored in the second memory is decrypted by the permission module, and the file data is other files in the block to be called except the header file.

[0031] Furthermore, the basic input-output data is encrypted and stored in the second memory, the basic input-output data is divided into at least one part, and each part of the at least one part is stored as a block;

[0032] The processor is also used to: determine the header file of each block in the at least one block, and store the header file of each block that meets the conditions in the first memory according to the mapping relationship, so as to determine the header file of the block to be called based on the calling instruction.

[0033] A data calling system, comprising:

[0034] A first determining unit is used to determine a header file of a block to be called based on a calling instruction obtained by a specified communication interface, wherein the header file of the block to be called is stored in a first memory in a first chip of the electronic device, the block to be called includes at least part of basic input and output data, and the first memory is an encrypted memory;

[0035] A second determining unit is used to determine the block to be called in the second memory in the first chip of the electronic device based on the mapping relationship between the header file of the block to be called and the block to be called, wherein the block stored in the second memory is encrypted data to be called;

[0036] A decryption unit, used for decrypting the block to be called through a permission module;

[0037] The output unit is used to output the decrypted data of the block to be called to the designated communication interface.

[0038] It can be seen from the above technical scheme that the data calling method, system and electronic device disclosed in the present application determine the header file of the block to be called based on the calling instruction obtained by the specified communication interface, the header file of the block to be called is stored in the first memory in the first chip of the electronic device, the block to be called includes at least part of the basic input and output data, the first memory is an encrypted memory, and the block to be called in the second memory in the first chip of the electronic device is determined based on the mapping relationship between the header file of the block to be called and the block to be called, the block stored in the second memory is the encrypted data to be called, the block to be called is decrypted by the permission module, and the decrypted data of the block to be called is output to the specified communication interface. This solution achieves encrypted storage of basic input / output data partition blocks by storing them in an encrypted memory of a first chip, and encrypting and storing header files of different blocks in a second memory, so that when calling, the header block in the second memory is called first, and then the block in the first memory is called based on a mapping relationship, thereby improving the security of the basic input / output data. In addition, the basic input / output data is stored in partition blocks, so that when calling the basic input / output data, it can be called according to the calling requirements according to the block, without calling all the basic input / output data, thereby improving the data calling speed. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0040] Figure 1 A flowchart of a data calling method disclosed in an embodiment of the present application;

[0041] Figure 2 A flowchart of a data calling method disclosed in an embodiment of the present application;

[0042] Figure 3 A calling schematic diagram disclosed in an embodiment of the present application;

[0043] Figure 4 A flowchart of a data calling method disclosed in an embodiment of the present application;

[0044] Figure 5 A schematic diagram of the structure of an electronic device disclosed in an embodiment of the present application;

[0045] Figure 6 A structural diagram of a data calling system disclosed in an embodiment of the present application. DETAILED DESCRIPTION

[0046] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0047] This application discloses a data calling method, and its flow chart is as follows: Figure 1 As shown, including:

[0048] Step S11, determining a header file of a block to be called based on a calling instruction obtained through a designated communication interface, wherein the header file of the block to be called is stored in a first memory in a first chip of an electronic device, the block to be called includes at least part of basic input and output data, and the first memory is an encrypted memory;

[0049] Step S12: determining the block to be called in the second memory in the first chip of the electronic device based on the mapping relationship between the header file of the block to be called and the block to be called, wherein the block stored in the second memory is the encrypted data to be called;

[0050] Step S13, decrypting the block to be called through the permission module;

[0051] Step S14: output the decrypted data of the block to be called to the designated communication interface.

[0052] The first chip at least includes: a first memory, a second memory and a permission module.

[0053] Among them, the first memory is an encrypted memory, such as: Encrypted RAM; the second memory can be: NOR Flash, which can encrypt data stored in NOR Flash; the permission module can at least encrypt and decrypt data stored in the first memory and the second memory, such as: hardware encryption engine HW Crypto Engine.

[0054] The basic input / output data is stored in the second memory of the first chip in blocks, that is, the basic input / output data is divided into a plurality of blocks, each block can realize different functions, so that when one or several functions need to be realized, only the blocks corresponding to these functions are called to realize the corresponding functions, without calling all the data in the basic input / output data, thereby improving the efficiency of data calling;

[0055] In addition, each block in the basic input and output data is encrypted and stored in the second memory, thereby improving the security of the basic input and output data.

[0056] The header files corresponding to the different blocks stored in the second memory are stored in the first memory, and the header files have a structure of specific information of the corresponding blocks. Each header file stored in the first memory is stored corresponding to the block to be called stored in the second memory, that is, each block to be called has a corresponding mapping relationship with its corresponding header file, and when calling, the calling of data in different memories can be realized based on the mapping relationship.

[0057] Specifically, when a calling instruction is obtained through a designated communication interface, the calling instruction at least includes relevant information of a block to be called, such as identification information, through which the block to be called in the calling instruction can be determined.

[0058] After determining the relevant information of the block to be called based on the calling instruction, first determine the header file of the calling block stored in the first memory, and decrypt and output the header file; at the same time, based on the mapping relationship between the header file and the block to be called, determine the block to be called corresponding to the header file, and decrypt and output the data in the block to be called.

[0059] For example: basic input and output data are divided into 4 blocks, such as: a first block, a second block, a third block and a fourth block, which are respectively stored in a second memory, and header files of the 4 blocks and a mapping relationship between the header files and the blocks are respectively obtained. The header files corresponding to the 4 blocks are respectively stored in the first memory, and the header files corresponding to the 4 blocks are respectively: a first header file, a second header file, a third header file and a fourth header file, wherein the mapping relationship is: the first header file is a header file of the first block, the second header file is a header file of the second block, the third header file is a header file of the third block, and the fourth header file is a header file of the fourth block.

[0060] When the calling instruction indicates that the data in the third block needs to be called, the third header file corresponding to the third block is first searched from the first memory, and the third header file is decrypted and output. After the third header file is determined, the third block associated with the third header file is searched from the second memory based on the mapping relationship, and the third block is decrypted and output through the permission module.

[0061] In addition, after determining the header file corresponding to the block to be called based on the analysis of the calling instruction, the header file is decrypted. At the same time, the block to be called corresponding to the header file is determined based on the mapping relationship, so that while the header file is decrypted, the block to be called corresponding to the header file can be decrypted, thereby shortening the time for decrypting data and improving calling efficiency.

[0062] Furthermore, after the permission module decrypts the block to be called stored in the second memory, the decrypted data is stored in the first memory, so that the decrypted data of the block to be called can be output through the first memory.

[0063] Specifically, different header files are stored in different locations in the first memory. After the block to be called corresponding to a header file is decrypted, the decrypted data of the block to be called is stored in the first memory at the location where the header file corresponding to the block to be called is located, and the decrypted data of the block to be called is output through the location where the header file is located.

[0064] For example: referring to the above example, the block to be called is the third block, and its corresponding header file is the third header file, which is stored in the third position of the first memory. After the permission module decrypts the data of the third block, the decrypted data is first stored in the third position of the first memory, and then the decrypted block to be called is output from the third position of the first memory to ensure that the block to be called and its corresponding header file are output from the same position of the first memory, so that after the output, if the decrypted header file and the decrypted block to be called are not output at the same time, the receiving end can also directly determine that the data output from the same position is for the same block based on the position of the output data.

[0065] In addition, the designated communication interface may be a SPI (Serial Peripheral Interface) serial peripheral interface, that is, the processor is connected to the first chip via the SPI interface, and data is transmitted via the SPI interface.

[0066] The processor may be a CPU (Central Processing Unit), and the CPU can call at least some blocks of basic input and output data through an SPI interface.

[0067] In addition, the EC can also be connected to the first chip through the SPI interface. The EC accesses the first chip through the SPI interface to obtain certain specific data stored in the first chip.

[0068] The data calling method disclosed in this embodiment determines the header file of the block to be called based on the calling instruction obtained by the specified communication interface, the header file of the block to be called is stored in the first memory in the first chip of the electronic device, the block to be called includes at least part of the basic input and output data, the first memory is an encrypted memory, the block to be called in the second memory in the first chip of the electronic device is determined based on the mapping relationship between the header file of the block to be called and the block to be called, the block stored in the second memory is the encrypted data to be called, the block to be called is decrypted by the permission module, and the data of the decrypted block to be called is output to the specified communication interface. This scheme stores the basic input and output data partition blocks in the encrypted memory of the first chip, and encrypts and stores the header files of different blocks in the second memory, so that the header block in the second memory is called first when calling, and then the block in the first memory is called based on the mapping relationship, so as to realize the encrypted storage of the basic input and output data partition blocks, and improve the security of the basic input and output data; in addition, the basic input and output data is stored in the partition blocks, so that when calling the basic input and output data, it can be called according to the call requirements according to the block, without calling all the data of the basic input and output data, thereby improving the data calling speed.

[0069] This embodiment discloses a data calling method, and its flow chart is as follows: Figure 2 As shown, including:

[0070] Step S21, determining a header file of a block to be called based on a calling instruction obtained through a designated communication interface, wherein the header file of the block to be called is stored in a first memory in a first chip of an electronic device, the block to be called includes at least part of basic input and output data, and the first memory is an encrypted memory;

[0071] Step S22, determining the block to be called in the second memory in the first chip of the electronic device based on the mapping relationship between the header file of the block to be called and the block to be called, the block stored in the second memory is the encrypted data to be called;

[0072] Step S23, decrypting the file data of the block to be called stored in the second memory by the permission module, where the file data is other files in the block to be called except the header file;

[0073] Step S24: output the decrypted data of the block to be called to the designated communication interface.

[0074] The first memory of the first chip stores header files of each block in the basic input and output data, and the second memory stores file data of each to-be-called block in the basic input and output data.

[0075] Since the header file of the block to be called is already stored in the first memory, when the file data of the block to be called is stored in the second memory, there is no need to store the header file, so as to avoid that when calling, the header file of the corresponding block has been decrypted and output from the first memory, and the permission module decrypts and outputs all the data of the block to be called stored in the second memory once, which leads to multiple decryption outputs of the header file, thereby reducing the output efficiency of the data. Therefore, the file data of each block to be called stored in the second memory are other files in the block to be called except the header file.

[0076] Furthermore, when the calling instruction includes header files of no less than two blocks to be called, the calling order of the header files of no less than two blocks to be called is determined, and based on the mapping relationship of the header files of no less than two blocks to be called, no less than two blocks to be called in the second memory are determined; the permission module decrypts the file sequence in no less than two blocks to be called in turn according to the calling order.

[0077] If there are at least two blocks to be called, the blocks to be called in the second memory need to be called in the calling order of at least two header files.

[0078] When the calling instruction includes calling header files of at least two to-be-called blocks, the calling instruction may have indicated a calling order, and the header files and the to-be-called blocks are called in sequence based on the indicated calling order;

[0079] If the calling order is not indicated in the calling instruction, the calling order of the header files is first determined, which may be specifically: determining a decoding order of at least two header files, determining the decoding order as the calling order, and calling at least two to-be-called blocks based on the calling order;

[0080] Alternatively, at least two header files are determined, and in the process of storing the header files in the first memory, there is a storage sequence, or a storage address sequence, then at least two header files and at least two to-be-called blocks are called based on the storage sequence or the storage address sequence;

[0081] Alternatively, the calling order is determined based on the relationship between the blocks to be called corresponding to the header file in the basic input-output data, that is, the blocks to be called stored in the second memory are formed by dividing the basic input-output data into different blocks, and these different blocks may have corresponding relationships in the basic input-output data, such as: the importance of the function corresponding to each block, the corresponding logical relationship between the functions corresponding to the blocks, etc. The calling order is determined based on these corresponding relationships, and the header file in the first memory and the blocks to be called in the second memory are called based on the calling order.

[0082] In addition, it should be noted that the mapping relationship that can characterize the association relationship between the header file stored in the first memory and the block to be called stored in the second memory can be stored in the first memory, that is, when the header file is stored in the first memory, the mapping relationship is synchronously stored in the first memory, so that when the header file of the block to be called stored in the first memory is determined based on the calling instruction, the block to be called in the second memory is directly determined based on the mapping relationship stored in the first memory;

[0083] Alternatively, the mapping relationship can also be stored in a designated communication interface, or a memory in the first chip corresponding to the designated storage interface, such as the SPI Output Cache. The mapping relationship between the header file and the block to be called is stored in the SPI Output Cache. Then, when a call instruction is obtained through the designated communication interface and the header file of the block to be called indicated in the call instruction is determined, the block to be called in the second memory associated with the header file can be directly determined based on the mapping relationship stored in the SPI Output Cache. In this way, while obtaining the header file in the first memory for decryption and output, the block to be called in the second memory can be decrypted and output through the permission module, thereby improving the calling efficiency.

[0084] The calling diagram is as follows Figure 3 As shown, including:

[0085] The first memory RAM, the second memory, the hardware encryption engine, the SPI Output Cache, wherein the first memory stores at least one header file, such as: NVRAM Header, FV_MAIN Header, FV_BB2 Header, FV_BB1 Header; the second memory stores at least one block to be called, such as: NVRAM, FV_MAIN, FV_BB2, FV_BB1.

[0086] S1 is: obtaining a call instruction sent by the CPU through a designated communication interface, and the designated communication interface may be an SPI interface; the call instruction directly acts on the first memory, such as: the header file indicated by the call instruction is: FV_MAIN Header, because a mapping relationship is stored in the SPI Output Cache, after the first memory obtains the call instruction, based on the mapping relationship, the corresponding block to be called in the second memory can also obtain the instruction, such as: FV_MAIN, and the corresponding block to be called in the second memory is decrypted by the hardware encryption engine, that is, S2; after the hardware encryption engine decrypts the block to be called, it obtains the decrypted block to be called, that is, Remained FV MAIN, and places the decrypted block to be called RemainedFV MAIN into the FV_MAIN Header position of the first memory, that is, S3, the first memory outputs the decrypted header file and the block to be called decrypted by the hardware encryption engine to the designated communication interface, that is, S4, and the decrypted data is fed back to the CPU through the designated communication interface. Of course, in S4, the first memory can output the decrypted header file and the block to be called decrypted by the hardware encryption engine to the designated communication interface at the same time, or they can be output separately, such as: the first memory first obtains the decrypted header file, and then directly outputs the header file to the designated communication interface after obtaining the decrypted header file, and the decrypted block to be called obtained later is also output to the designated communication interface after obtaining it, without waiting.

[0087] The data calling method disclosed in this embodiment determines the header file of the block to be called based on the calling instruction obtained by the specified communication interface, the header file of the block to be called is stored in the first memory in the first chip of the electronic device, the block to be called includes at least part of the basic input and output data, the first memory is an encrypted memory, the block to be called in the second memory in the first chip of the electronic device is determined based on the mapping relationship between the header file of the block to be called and the block to be called, the block stored in the second memory is the encrypted data to be called, the block to be called is decrypted by the permission module, and the data of the decrypted block to be called is output to the specified communication interface. This scheme stores the basic input and output data partition blocks in the encrypted memory of the first chip, and encrypts and stores the header files of different blocks in the second memory, so that the header block in the second memory is called first when calling, and then the block in the first memory is called based on the mapping relationship, so as to realize the encrypted storage of the basic input and output data partition blocks, and improve the security of the basic input and output data; in addition, the basic input and output data is stored in the partition blocks, so that when calling the basic input and output data, it can be called according to the call requirements according to the block, without calling all the data of the basic input and output data, thereby improving the data calling speed.

[0088] This embodiment discloses a data calling method, and its flow chart is as follows: Figure 4 As shown, including:

[0089] Step S41, determining the header file of each block in at least one block, and storing the header file of each block that meets the conditions in the first memory according to the mapping relationship;

[0090] Step S42, determining a header file of a block to be called based on a calling instruction obtained through a designated communication interface, wherein the header file of the block to be called is stored in a first memory in a first chip of the electronic device, the block to be called includes at least a portion of the basic input and output data, and the first memory is an encrypted memory;

[0091] Step S43, determining the block to be called in the second memory in the first chip of the electronic device based on the mapping relationship between the header file of the block to be called and the block to be called, the block stored in the second memory is the encrypted data to be called;

[0092] Step S44, decrypting the block to be called through the permission module;

[0093] Step S45: output the decrypted data of the block to be called to the designated communication interface.

[0094] The basic input-output data is encrypted and stored in the second memory. The basic input-output data is divided into at least one part, and each part of the at least one part is stored as a block.

[0095] The process of encrypting the basic input and output data and storing them in the second memory, and dividing them into different parts and storing them as different blocks is performed in advance and is a pre-processing process.

[0096] Determine the header file of each block in at least one block, and store the header file of each block that meets the conditions in the first memory according to the mapping relationship, so as to determine the header file of the block to be called based on the call instruction. This process can be executed during the boot process, or it can be executed in advance, so as to ensure that the block to be called can be directly called based on the call instruction during boot, without storing the header file of each block in the first memory during the boot process, so as to achieve the purpose of reducing the boot process and improving the call speed.

[0097] Among them, the header file of each block that meets the conditions is stored in the first memory according to the mapping relationship. It can be: the header file of each block that meets the conditions and the mapping relationship are stored in the first memory at the same time. At this time, the first memory not only stores the header files of each block, but also stores the mapping relationship between the header file and the block to be called; or, it can also be: the header file of each block that meets the conditions is stored in the first memory, and the storage process is executed according to the mapping relationship stored in other memories in the first chip, other memories, such as: SPI Output Cache.

[0098] Further, the header file of each block that meets the conditions is stored in the first memory according to the mapping relationship, including:

[0099] The permission module based on the first chip performs security check on the basic input and output data. If the security check passes, the header file of each block is stored in the first memory according to the mapping relationship.

[0100] The permission module can be a hardware encryption engine. The hardware encryption engine in the first chip, in addition to having the function of encrypting and decrypting data stored in the first memory and the second memory, can also perform security verification on the basic input and output data stored in the second memory to determine whether the basic input and output data stored in the second memory is safe and whether it can pass the security verification. Only after the basic input and output data stored in the second memory passes the security verification can the header file of each block therein be stored in the first memory, thereby ensuring the security of the header file stored in the first memory.

[0101] The security check may include: determining whether the basic input and output data stored in the second memory are complete; and / or determining whether the basic input and output data stored in the second memory have been modified. Only when the data in the second memory is complete and unmodified can it be shown that the basic input and output data are safe and reliable, and the boot operation can be performed through the basic input and output data.

[0102] Specifically, to determine whether the basic input and output data stored in the second memory is complete, it can be as follows: since the basic input and output data stored in the second memory is divided into different blocks, in the process of verifying whether the basic input and output data is complete, it is necessary to combine the data in all blocks to form the basic input and output data in order to verify the integrity.

[0103] The data calling method disclosed in this embodiment determines the header file of the block to be called based on the calling instruction obtained by the specified communication interface, the header file of the block to be called is stored in the first memory in the first chip of the electronic device, the block to be called includes at least part of the basic input and output data, the first memory is an encrypted memory, the block to be called in the second memory in the first chip of the electronic device is determined based on the mapping relationship between the header file of the block to be called and the block to be called, the block stored in the second memory is the encrypted data to be called, the block to be called is decrypted by the permission module, and the data of the decrypted block to be called is output to the specified communication interface. This scheme stores the basic input and output data partition blocks in the encrypted memory of the first chip, and encrypts and stores the header files of different blocks in the second memory, so that the header block in the second memory is called first when calling, and then the block in the first memory is called based on the mapping relationship, so as to realize the encrypted storage of the basic input and output data partition blocks, and improve the security of the basic input and output data; in addition, the basic input and output data is stored in the partition blocks, so that when calling the basic input and output data, it can be called according to the call requirements according to the block, without calling all the data of the basic input and output data, thereby improving the data calling speed.

[0104] This embodiment discloses an electronic device, and its structural diagram is as follows: Figure 5 As shown, including:

[0105] A communication interface 51 , a first chip 52 and a processor 53 are specified.

[0106] The first chip includes: a first memory, a second memory and a permission module, and the first memory is an encrypted memory;

[0107] The processor is used to determine the header file of the block to be called based on the calling instruction obtained by the designated communication interface, the header file of the block to be called is stored in the first memory, and the block to be called includes at least part of the basic input and output data; based on the mapping relationship between the header file of the block to be called and the block to be called, the block stored in the second memory is the encrypted data to be called; the block to be called is decrypted by the permission module, and the decrypted data of the block to be called is output to the designated communication interface.

[0108] Further, the block to be called is decrypted by the permission module, including: decrypting the file data of the block to be called stored in the second memory by the permission module, the file data being other files in the block to be called except the header file.

[0109] Furthermore, the file data of the block to be called stored in the second memory is decrypted by the permission module, and the file data is other files in the block to be called except the header file, including:

[0110] If the calling instruction includes calling header files of at least two blocks to be called, the processor determines the calling order of the header files of at least two blocks to be called; and determines at least two blocks to be called in the second memory according to the mapping relationship based on the header files of at least two blocks to be called;

[0111] The permission module sequentially decrypts files in no less than two blocks to be called in the order of calling.

[0112] Further, the basic input-output data is encrypted and stored in the second memory, the basic input-output data is divided into at least one part, and each part of the at least one part is stored as a block;

[0113] The processor is also used to: determine the header file of each block in at least one block, and store the header file of each block that meets the conditions in the first memory according to the mapping relationship, so as to determine the header file of the block to be called based on the calling instruction.

[0114] Further, the processor stores the header file of each block that meets the conditions in the first memory according to the mapping relationship, including:

[0115] The processor performs security verification on the basic input and output data based on the permission module of the first chip. If the security verification passes, the header file of each block is stored in the first memory according to the mapping relationship.

[0116] Furthermore, the permission module performs security checks on basic input and output data, including:

[0117] The permission module determines whether the basic input and output data stored in the second memory is complete;

[0118] and / or,

[0119] The permission module determines whether the basic input and output data stored in the second memory has been modified.

[0120] The electronic device on which this embodiment is based is implemented based on the data calling method disclosed in the above embodiment, which will not be described in detail here.

[0121] The electronic device disclosed in this embodiment determines the header file of the block to be called based on the call instruction obtained by the specified communication interface, the header file of the block to be called is stored in the first memory in the first chip of the electronic device, the block to be called includes at least part of the basic input and output data, the first memory is an encrypted memory, the block to be called in the second memory in the first chip of the electronic device is determined based on the mapping relationship between the header file of the block to be called and the block to be called, the block stored in the second memory is the encrypted data to be called, the block to be called is decrypted by the permission module, and the data of the decrypted block to be called is output to the specified communication interface. This scheme stores the basic input and output data partition blocks in the encrypted memory of the first chip, and encrypts and stores the header files of different blocks in the second memory, so that the header block in the second memory is called first when calling, and then the block in the first memory is called based on the mapping relationship, so as to realize the encrypted storage of the basic input and output data partition blocks, and improve the security of the basic input and output data; in addition, the basic input and output data is stored in the partition blocks, so that when calling the basic input and output data, it can be called according to the call requirements according to the block, without calling all the data of the basic input and output data, thereby improving the data calling speed.

[0122] This embodiment discloses a data calling system, and its structural diagram is as follows: Figure 6 As shown, including:

[0123] A first determining unit 61 , a second determining unit 62 , a decrypting unit 63 and an output unit 64 .

[0124] The first determining unit 61 is used to determine the header file of the block to be called based on the calling instruction obtained by the specified communication interface, the header file of the block to be called is stored in the first memory in the first chip of the electronic device, the block to be called includes at least part of the basic input and output data, and the first memory is an encrypted memory;

[0125] The second determining unit 62 is used to determine the block to be called in the second memory in the first chip of the electronic device based on the mapping relationship between the header file of the block to be called and the block to be called, and the block stored in the second memory is the encrypted data to be called;

[0126] The decryption unit 63 is used to decrypt the block to be called through the permission module;

[0127] The output unit 64 is used to output the decrypted data of the block to be called to a designated communication interface.

[0128] The data calling system disclosed in this embodiment is implemented based on the data calling method disclosed in the above embodiment, which will not be described in detail here.

[0129] The data calling system disclosed in this embodiment determines the header file of the block to be called based on the calling instruction obtained by the specified communication interface, the header file of the block to be called is stored in the first memory in the first chip of the electronic device, the block to be called includes at least part of the basic input and output data, the first memory is an encrypted memory, the block to be called in the second memory in the first chip of the electronic device is determined based on the mapping relationship between the header file of the block to be called and the block to be called, the block stored in the second memory is the encrypted data to be called, the block to be called is decrypted by the permission module, and the data of the decrypted block to be called is output to the specified communication interface. This scheme stores the basic input and output data partition blocks in the encrypted memory of the first chip, and encrypts and stores the header files of different blocks in the second memory, so that the header block in the second memory is called first when calling, and then the block in the first memory is called based on the mapping relationship, so as to realize the encrypted storage of the basic input and output data partition blocks, and improve the security of the basic input and output data; in addition, the basic input and output data is stored in the partition blocks, so that when calling the basic input and output data, it can be called according to the call requirements according to the block, without calling all the data of the basic input and output data, thereby improving the data calling speed.

[0130] In this specification, each embodiment is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can be referred to each other. For the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part.

[0131] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0132] The steps of the method or algorithm described in conjunction with the embodiments disclosed herein may be implemented directly using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0133] The above description of the disclosed embodiments enables those skilled in the art to implement or use the present application. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present application. Therefore, the present application will not be limited to the embodiments shown herein, but will conform to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A data calling method, comprising: Determine a header file of a block to be called based on a call instruction obtained through a designated communication interface, wherein the header file of the block to be called is stored in a first memory in a first chip of an electronic device, wherein the block to be called includes at least part of basic input and output data, and the first memory is an encrypted memory; Determine the block to be called in the second memory in the first chip of the electronic device based on the mapping relationship between the header file of the block to be called and the block to be called, the block stored in the second memory is the encrypted data to be called; wherein the basic input and output data are encrypted and stored in the second memory, the basic input and output data are divided into at least one part, and each part of the at least one part is stored as a block; Decrypting the block to be called through the permission module; The decrypted data of the block to be called is output to the designated communication interface.

2. The method according to claim 1, wherein: Decrypting the block to be called by the permission module includes: The file data of the block to be called stored in the second memory is decrypted by the permission module, and the file data is other files in the block to be called except the header file.

3. The method according to claim 2, wherein: The decrypting of the file data of the block to be called stored in the second memory by the permission module, wherein the file data is other files in the block to be called except the header file, includes: If the calling instruction includes calling header files of at least two blocks to be called, determining a calling order of the header files of the at least two blocks to be called; determining the at least two blocks to be called in the second memory according to the mapping relationship based on the header files of the at least two blocks to be called; The permission module sequentially decrypts the files in the at least two blocks to be called according to the calling order.

4. The method according to claim 1, The method further comprises: The header file of each block in the at least one block is determined, and the header file of each block that meets the condition is stored in the first memory according to the mapping relationship, so as to determine the header file of the block to be called based on the calling instruction.

5. The method according to claim 4, wherein: The step of storing the header file of each block that meets the condition in the first memory according to the mapping relationship includes: A security check is performed on the basic input and output data based on the permission module of the first chip. If the security check passes, the header file of each block is stored in the first memory according to the mapping relationship.

6. The method according to claim 5, wherein: The performing security verification on the basic input and output data includes: determining whether the basic input and output data stored in the second memory is complete; and / or, Determine whether the basic input and output data stored in the second memory has been modified.

7. An electronic device comprising: Specify the communication interface; A first chip includes a first memory, a second memory and a permission module, wherein the first memory is an encrypted memory; a processor, configured to determine a header file of a block to be called based on a calling instruction obtained by the designated communication interface, wherein the header file of the block to be called is stored in the first memory, and the block to be called includes at least part of basic input and output data; Determine the block to be called in the second memory based on the mapping relationship between the header file of the block to be called and the block to be called, the block stored in the second memory is the encrypted data to be called; wherein the basic input and output data are encrypted and stored in the second memory, the basic input and output data are divided into at least one part, and each part of the at least one part is stored as a block; The block to be called is decrypted by the permission module, and the decrypted data of the block to be called is output to the designated communication interface.

8. The device according to claim 7, wherein: The decrypting the block to be called by the permission module includes: The file data of the block to be called stored in the second memory is decrypted by the permission module, and the file data is other files in the block to be called except the header file.

9. According to the device of claim 7, the processor is also used to: determine the header file of each block in the at least one block, and store the header file of each block that meets the conditions to the first memory according to the mapping relationship, so as to determine the header file of the block to be called based on the calling instruction.

10. A data calling system, comprising: A first determining unit is used to determine a header file of a block to be called based on a calling instruction obtained by a specified communication interface, wherein the header file of the block to be called is stored in a first memory in a first chip of the electronic device, the block to be called includes at least part of basic input and output data, and the first memory is an encrypted memory; A second determining unit is used to determine the block to be called in the second memory in the first chip of the electronic device based on the mapping relationship between the header file of the block to be called and the block to be called, and the block stored in the second memory is the encrypted data to be called; wherein the basic input and output data are encrypted and stored in the second memory, and the basic input and output data are divided into at least one part, and each part of the at least one part is stored as a block; A decryption unit, used for decrypting the block to be called through a permission module; The output unit is used to output the decrypted data of the block to be called to the designated communication interface.

Images