Electronic device using homomorphic encryption and encrypted data processing method thereof

Abstract

An electronic device using homomorphic encryption and a method for processing encrypted data thereof are provided. The electronic device includes: a memory for storing data from an external source; an application processing unit (APU) for sending a secret key generation command and a public key generation command; an isolated execution environment (IEE) for generating a secret key in response to the secret key generation command, generating a public key based on the secret key in response to the public key generation command, and storing the secret key; and a non-volatile memory for performing write and read operations based on requests from the APU. When data is stored in the memory, the APU sends a public key request to the IEE. The IEE transmits the public key to the APU via a mailbox protocol in response to the public key request. The APU generates ciphertext by performing homomorphic encryption on the data based on an encryption key in the public key. The APU classifies the public key and ciphertext and stores them in the non-volatile memory.

Description

[0001] CROSS-REFERENCE TO RELATED APPLICATIONS

[0002] This application claims priority from Korean Patent Application No. 10-2020-0083213 filed on July 7, 2020, in the Korean Intellectual Property Office, the disclosure of which is incorporated herein by reference in its entirety. Technical Field

[0003] Embodiments of the inventive concept described herein relate to an encryption system, and more particularly, to an electronic device that processes data by using homomorphic encryption and an encrypted data processing method thereof. Background Art

[0004] With the advancement of information and communications technology, we are entering an era of hyperconnectivity, where vast amounts of data are continuously collected and all devices are connected through the activation of the Internet of Things. As data traffic increases with the advancement of communications technology, the demand for security technologies is also growing. Cryptography systems are used to exchange confidential communications information and aim to provide users with secure networks or storage. To this end, the development of encryption systems is actively underway, with increasing attention being paid to homomorphic encryption technology, considered the fourth generation of encryption systems.

[0005] First-generation encryption systems use password-based authentication technology. They generate passwords by simply changing characters or changing their order. Second-generation encryption systems use symmetric key encryption. Symmetric key encryption systems, where the encryption and decryption keys are identical, perform both encryption and decryption using a single encryption key. The advantage of symmetric key encryption schemes is their relatively fast computational speed. However, because the key itself is not encrypted, symmetric key encryption schemes have the following problems: key management is difficult and security is relatively weak. Third-generation encryption systems use asymmetric key encryption. In asymmetric key encryption systems, the encryption and decryption keys are two different keys. The advantage of asymmetric key encryption schemes, which do not disclose the private key, is their high security level. However, the disadvantages of asymmetric key encryption schemes are their high capacity requirements and relatively slow processing speed. Furthermore, even with the high security provided by third-generation encryption systems, decryption is still required at least once to interpret the data. Therefore, data leakage cannot be fundamentally prevented. Summary of the Invention

[0006] Embodiments of the inventive concept provide an electronic device that processes data internally by using homomorphic encryption and an encrypted data processing method thereof.

[0007] According to an exemplary embodiment, an electronic device includes: a memory that stores data received from an external source; an application processing unit (APU) that sends a secret key generation command and a public key generation command; an isolated execution environment (IEE) that generates a secret key in response to the secret key generation command, generates a public key based on the secret key in response to the public key generation command, and stores the secret key; and a non-volatile memory that performs write operations and read operations based on a request from the APU. When the data is stored in the memory, the APU sends a public key request to the IEE. In response to the public key request, the IEE transmits the public key to the APU via a mailbox protocol. The APU generates ciphertext by performing homomorphic encryption on the data based on an encryption key included in the public key, and the APU classifies the public key and the ciphertext and stores them in the non-volatile memory.

[0008] According to an exemplary embodiment, a method for processing encrypted data includes: receiving first data from an external source; loading a public key generated at an isolated execution environment (IEE) through a mailbox protocol; homomorphically encrypting the first data based on an encryption key included in the public key to generate first encrypted data; storing the public key and the first encrypted data in a non-volatile memory; receiving second data from the external source; loading the public key stored in the non-volatile memory; homomorphically encrypting the second data based on the encryption key included in the public key to generate second encrypted data; and performing calculations on the first encrypted data and the second encrypted data based on a multiplication key included in the public key.

[0009] According to an exemplary embodiment, an electronic device with a malicious code determination function includes: a modem that receives malicious code information from an external source; an application processing unit (APU) that extracts characteristic information of the malicious code from the malicious code information and sends a secret key generation command and a public key generation command; an isolated execution environment (IEE) that generates a secret key in response to the secret key generation command, generates a public key based on the secret key in response to the public key generation command, and stores the secret key; and a non-volatile memory that performs write operations and read operations based on requests from the APU. When the characteristic information of the malicious code is extracted, the APU sends a public key request to the IEE. In response to the public key request, the IEE transmits the public key to the APU via a mailbox protocol. The APU generates first encrypted data by performing homomorphic encryption on the characteristic information of the malicious code based on an encryption key included in the public key, and the APU stores the first encrypted data in the non-volatile memory. BRIEF DESCRIPTION OF THE DRAWINGS

[0010] The above and other objects and features of the present inventive concept will become apparent by describing in detail exemplary embodiments of the present inventive concept with reference to the attached drawings.

[0011] Figure 1 is a block diagram illustrating an electronic device using homomorphic encryption according to an embodiment of the inventive concept.

[0012] Figure 2 is a diagram illustrating how an electronic device generates an encryption key according to an embodiment of the inventive concept.

[0013] Figure 3 It shows Figure 1 The block diagram of the configuration of the IEE is shown in FIG.

[0014] Figure 4 is a diagram illustrating an area of a nonvolatile memory for classifying and storing encrypted data generated at an electronic device according to an embodiment of the inventive concept.

[0015] Figure 5 is a diagram illustrating a manner of classifying encrypted data generated according to an embodiment of the inventive concept.

[0016] Figure 6 is a flowchart illustrating a data encryption method of an electronic device according to an embodiment of the inventive concept.

[0017] Figure 7 is a flowchart illustrating an encrypted data processing method of an electronic device according to an embodiment of the inventive concept.

[0018] Figure 8 is a block diagram illustrating an electronic device providing a biometric authentication function according to an embodiment of the inventive concept.

[0019] Figure 9 It is shown that Figure 8 A flowchart of an operating method of an electronic device with a biometric authentication function disclosed in.

[0020] Figure 10 is a block diagram illustrating an electronic device providing a malicious code determination function according to an embodiment of the inventive concept.

[0021] Figure 11 It is shown in Figure 10 A flowchart of a method for establishing a malicious code database in an electronic device with a malicious code determination function disclosed in the disclosure.

[0022] Figure 12 It is shown in Figure 10 A flowchart of a method for detecting malicious code in an electronic device with a malicious code determination function disclosed in the disclosure. DETAILED DESCRIPTION

[0023] Hereinafter, embodiments of the present inventive concept may be described in detail and clearly to such an extent that a person having ordinary skill in the art can easily realize the present inventive concept.

[0024] The terms used in the specification are provided to describe the embodiments, not to limit the inventive concept. Unless the context clearly indicates otherwise, the singular terms "a", "an" and "the" as used in the specification are also intended to include the plural forms. When the terms "comprise" and / or "include" are used in the specification, it indicates the presence of steps, operations, elements and / or components, but does not exclude the presence or addition of one or more other steps, operations, elements, components and / or groups thereof.

[0025] Unless otherwise defined, all terms used in this specification (including technical and scientific terms) shall have the same meaning as commonly understood by those skilled in the art to which the present invention pertains. Unless expressly defined herein, terms such as those defined in general dictionaries shall not be interpreted in an idealized or overly formal sense. Throughout this specification, the same reference numerals denote the same elements.

[0026] Figure 1 is a block diagram illustrating an electronic device 100 using homomorphic encryption (HE) according to an embodiment of the inventive concept. Figure 1 The electronic device 100 disclosed in the disclosure may encrypt specific data by using homomorphic encryption and may process the encrypted data.

[0027] Reference Figure 1According to an embodiment of the present inventive concept, an electronic device 100 using homomorphic encryption may include an application processing unit (APU) 110, an isolated execution environment (IEE) 140, a non-volatile memory 150, a memory 160, and a data input device 170. The APU 110 may include a core 120 and a homomorphic encryption (HE) accelerator 130. The core 120 and the homomorphic encryption accelerator 130 may be separate processing units of the APU 110, each of which reads and executes program instructions.

[0028] The APU 110 may include a general-purpose processor and may drive an operating system or application programs. Furthermore, the APU 110 may control multiple hardware components connected to the APU 110, execute various software components, and process and compute various data, including multimedia data. In some embodiments, the APU 110 may be implemented using a system on a chip (SoC).

[0029] The core 120 may control the homomorphic encryption accelerator 130 to encrypt data input to the electronic device 100 and process the encrypted data. The homomorphic encryption accelerator 130 may be designed to more efficiently perform computationally intensive cryptographic operations. In addition, the core 120 may control the non-volatile memory 150 to store encrypted data and utilize the stored data.

[0030] Homomorphic encryption accelerator 130 can speed up the processing and interpretation of data input to electronic device 100. Homomorphic encryption technology offers the advantage of storing, transmitting, and using data with a high level of security. However, due to the relatively large size of the encryption key, homomorphic encryption technology suffers from a processing speed that is several hundredths to several thousandths of the speed of interpreting pure data. Therefore, homomorphic encryption accelerator 130 can accelerate the execution of homomorphic encryption on data and the processing of encrypted data, thereby enabling more efficient homomorphic encryption.

[0031] The IEE 140 refers to a hardware isolation area for performing homomorphic encryption on input data. The IEE 140 can be a component independent of other components of the electronic device 100. For example, the IEE 140 can include a separate processor and a separate memory, so that the IEE 140 includes hardware that is independent of other hardware of the other components of the electronic device 100 (i.e., "hardware independent"). The IEE 140 can generate a secret key and a public key necessary for homomorphic encryption of data. The secret key generated by the IEE 140 can be stored within the IEE 140. A public key can be generated based on the secret key, and the generated public key can be transmitted to the outside of the IEE 140 for homomorphic encryption of data and calculation of homomorphic encrypted data.

[0032] The nonvolatile memory 150 may store data used by the electronic device 100. The nonvolatile memory 150 may include at least one of a NAND flash memory, a programmable read-only memory (PROM), an erasable programmable ROM (EPROM), an electrically erasable programmable ROM (EEPROM), a one-time programmable ROM (OTPROM), and a shield ROM. Figure 1 , an example in which the nonvolatile memory 150 is embedded in the electronic device 100 is shown, but the nonvolatile memory 150 may be implemented in the form of an external memory.

[0033] The memory 160 may store data received from the outside. The memory 160 may be a working memory of the electronic device 100. The memory 160 may include at least one of a dynamic random access memory (DRAM), a synchronous DRAM (SDRAM), a static RAM (SRAM), a phase change RAM (PRAM), a magnetic RAM (MRAM), a ferroelectric RAM (FRAM), a resistive RAM (RRAM), and a flash memory.

[0034] The data input device 170 can receive data from the outside. The data input device 170 may include a keyboard, a keypad, a touch pad, a mouse, a microphone, a sensor, a camera, etc. Figure 1 , an example is shown in which the electronic device 100 includes the data input device 170. However, in another embodiment, the electronic device 100 may further include a data output device that outputs data processed within the electronic device 100.

[0035] exist Figure 1 In the embodiment of the present invention, the data input device 170 can receive data requiring a high level of security. The core 120 can provide the IEE 140 with a command for generating a key required for homomorphic encryption of the data. The key required for homomorphic encryption may include a secret key and a public key, and the secret key generation command and the public key generation command can be sent to the IEE 140 simultaneously or sequentially. When the secret key generation command and the public key generation command are sent to the IEE 140 sequentially, the secret key generation command can be sent before the public key generation command.

[0036] The IEE 140, which receives the command to generate the secret key, can generate the secret key for homomorphic encryption. When the secret key is generated, the IEE 140 can block access from the core 120 to the IEE 140 to prevent leakage of the secret key. Alternatively, after the IEE 140 transmits the public key to the core 120 according to the process described below, the IEE 140 can block access from the core 120 to the IEE 140. After the IEE 140 blocks access from the core 120, a separate authentication process can be performed in which the IEE 140 releases the block on access from the core 120. The secret key can be stored in a hardware-independent IEE 140 to prevent leakage of the secret key to the outside.

[0037] The IEE 140 can generate a public key based on the secret key. The public key can be stored in a normal area of the electronic device 100 to perform homomorphic encryption on the input data. For example, the public key can be stored in the non-volatile memory 150 included in the electronic device 100. In an embodiment, the public key may include an encryption key, a multiplication key, a rotation key, and a conjugation key. The encryption key can be used for encryption of the input data. The multiplication key can be used for calculation of the ciphertext. The rotation key and the conjugation key can be used for boot-strapping to remove noise that occurs during the encryption process. The bootstrap refers to a restart process for removing noise, the amount of which increases as the homomorphic encryption operation is performed multiple times. Reference will be made to Figure 2 More fully describes how the IEE 140 generates keys.

[0038] The core 120 may request a public key generated by the IEE 140. The IEE 140 may transmit the public key to the outside according to the mailbox protocol. Alternatively, the core 120 may request the IEE 140 to load the public key according to the mailbox protocol. When receiving the public key request from the mailbox, the IEE 140 may transmit the public key to the outside through the mailbox. The public key transmitted to the outside may be stored in the non-volatile memory 150. The public keys may be classified according to size, access frequency, type, etc. and may be stored in the non-volatile memory 150. Figure 4 and Figure 5 More fully describes methods for cataloging and storing public keys.

[0039] Data input to the electronic device 100 can be homomorphically encrypted by using an encryption key that is a public key. Based on the degree of security required, the electronic device 100 can select a portion of the input data and homomorphically encrypt the selected portion. That is, a portion of the input data can be encrypted by using homomorphic encryption, and another portion can be encrypted by using symmetric key encryption or asymmetric key encryption, and the remaining portion, which is data that does not require security, may not be encrypted. Homomorphically encrypted data, data encrypted by using an existing encryption scheme, and unencrypted data can be classified according to size, access frequency, type, etc., and can be stored in the non-volatile memory 150. Reference will be made to Figure 4 and Figure 5 More fully describe how data is categorized and stored.

[0040] The electronic device 100 according to the present invention can generate secret keys and public keys at the IEE 140, which is a hardware isolated area, and can store the secret keys in the IEE 140, thereby reducing the risk of data leakage through the network and providing a high level of security. In addition, the electronic device 100 can classify public keys, ciphertext, and any other data according to size, access frequency, type, etc., and can store the classification results in the non-volatile memory 150, thereby preventing data processing from being delayed and improving the performance of processing encrypted data.

[0041] In addition, the electronic device 100 conceived according to the present invention can perform homomorphic encryption that complies with an encryption technology based on error learning (LWE). Specifically, the electronic device 100 can more efficiently implement calculations by complying with homomorphic encryption based on an encryption technology based on ring learning with errors (RLWE). In the specification, the electronic device 100 conceived according to the present invention will be described as an example in which the electronic device 100 changes a complex plaintext into a polynomial calculation and performs a calculation based on an encryption technology based on RLWE, but this is only an example. The type of encryption technology to be applied to the present invention is not limited.

[0042] Figure 2 FIG. 1 is a diagram showing an electronic device 100 (see FIG. Figure 1 ) is a diagram showing how to generate an encryption key. The electronic device 100 according to an embodiment of the inventive concept can internally generate a key to be used in a homomorphic encryption system to internally perform homomorphic encryption and process encrypted data.

[0043] The core 120 of the electronic device 100 (see Figure 1) can be submitted to IEE 140 (refer to Figure 1 ) sends a secret key generation command (or secret key generation request) (S11). When the IEE 140 receives the secret key generation command from the core 120, the IEE 140 may generate a secret key based on the Gaussian distribution x σ The secret key s(x) is generated by sampling the polynomial elements. The secret key s(x) is an n-order polynomial whose coefficients are composed of "-1", "0", and "1". When the secret key s(x) is generated, the IEE 140 can send a secret key generation response to the core 120 (S12). The secret key s(x) generated in this way can be stored in an independent area of the IEE 140.

[0044] In addition, the core 120 may send a public key generation command (or a public key generation request) to the IEE 140 (S13). When the IEE 140 receives the public key generation command from the core 120, the IEE 140 may generate a public key based on the secret key s(x) using a homomorphic encryption algorithm. In the RLWE-based encryption technology, the public key may be composed of (a(x), b(x)), which is in the form of an ordered pair of polynomials. The first random polynomial a(x) may be determined based on a uniform distribution, and the second random polynomial b(x) may be determined by the following formula 1.

[0045] [Formula 1]

[0046] b(x)=-a(x)s(x)+e(x)

[0047] In Formula 1, a(x) represents a first random polynomial determined based on a uniform distribution, and s(x) represents a secret key generated at IEE 140. e(x) can be determined based on an error extracted from a discrete Gaussian distribution. The first random polynomial a(x), the second random polynomial b(x), and e(x) can be N-order polynomials with coefficients of q bits, and the key generation process can be represented by the following Formula 2.

[0048] [Formula 2]

[0049] Key Generation(N, q)→(Secret Key:=s(x),Public Key::=(a(x),b(x)))

[0050] When the public key is generated, the IEE 140 may send a public key generation response to the core 120 (S14). When a public key transmission command (or public key request) is received from the core 120 (S15), the IEE 140 may transmit the public key to the outside of the IEE 140 via the mailbox protocol (S16). Alternatively, without a separate command from the core 120, the IEE 140 may transmit the public key to the outside of the IEE 140 (e.g., the core 120) via the mailbox protocol based on the public key generation response.

[0051] exist Figure 2 , an example is shown in which the core 120 included in the APU 110 independently or sequentially transmits a secret key generation command and a public key generation command to the IEE 140, but the core 120 may simultaneously transmit the secret key generation command and the public key generation command to the IEE 140. When the secret key generation command and the public key generation command are transmitted simultaneously, the IEE 140 may generate a secret key and then may generate a public key based on the secret key.

[0052] Figure 3 It shows Figure 1 A block diagram of the configuration of the IEE 140 is shown in FIG. Figure 3 , the IEE 140 may include a homomorphic encryption key generator 141, a secret key storage device 142, a decoder 143, and a memory 144. The homomorphic encryption key generator 141 may respond to the core 120 (refer to Figure 1 ) request, generate the secret key and public key required for homomorphic encryption and encrypted data processing. Figure 2 The series of processes described above generates secret keys and public keys. The public keys may include: encryption keys for encrypting plaintext into ciphertext, multiplication keys for performing calculations on ciphertext, rotation keys and conjugation keys for bootstrapping, etc.

[0053] The secret key storage device 142 can store the secret key generated by the homomorphic encryption key generator 141. Since the homomorphic encryption is calculated in the state of decrypting the encrypted data, the homomorphic encryption does not need to access the secret key in order to process the encrypted data. However, the homomorphic encryption uses the secret key only when decryption is required to check the result value. Therefore, the electronic device 100 (refer to the embodiment of the present invention) according to the embodiment of the present invention is not necessarily the same as the one in the present invention. Figure 1 ) Access from the outside and leakage of the secret key to the outside can be prevented by storing the secret key in the secret key storage device 142 of the IEE 140 which is physically isolated from other components of the electronic device.

[0054] The decoder 143 can decode the result value in the homomorphically encrypted form obtained by processing the encrypted data at the electronic device 100 according to the present invention into data in the plain text form. The decoder 143 can decode the result value in the homomorphically encrypted form based on the secret key stored in the secret key storage device 142. The result value in the homomorphically encrypted form can be input to the decoder 143 through the mailbox protocol, and the result value obtained after the decoder 143 decodes the input can be transmitted to the outside of the IEE 140 through the mailbox protocol.

[0055] The memory 144 may be a working memory of the IEE 140. The homomorphic encryption key generator 141 may generate a secret key and a public key by using the memory 144. The decoder 143 may perform decryption by using the memory 144 and may store the decrypted result in the memory 144.

[0056] The IEE 140 may also include additional components configured to process the decryption result. The IEE 140 may also include an interface for providing the result of processing the decryption result. Alternatively, the IEE 140 may also include an interface for providing the decryption result or the processing result to the core 120.

[0057] According to an embodiment of the inventive concept, since the electronic device 100 uses the encryption technology based on RLWE, the electronic device 100 can q Perform polynomial multiplication, polynomial addition, modulo reduction, etc. For ring arithmetic operations, the homomorphic encryption key generator 141 may include an NTT / INTT (number theoretic transformation / inverse number theoretic transformation) calculation unit 141a, a multiplication / modulo (multiplication / modulo) calculation unit 141b, and a Gaussian random number generator 141c.

[0058] The NTT / INTT calculation unit 141a can provide an NTT / INTT-based algorithm for performing polynomial multiplication in RLWE-based homomorphic encryption calculations. Since ring polynomial multiplication requires an arithmetic process that requires a long processing time, the ring polynomial multiplication can be efficiently performed using an NTT / INTT-based algorithm. The two polynomials above the ring can represent a(x) and b(x) obtained by the above formula 2 and can be expressed by the following formula 3.

[0059] [Formula 3]

[0060] a(x)=a0+a1x+a2x 2 +…+a n-1 x n-1 b(x)=b0+b1x+b2x 2 +…+b n-1 xn-1

[0061] In order to multiply the polynomials a(x) and b(x), NTT calculation and INTT calculation for a(x) and b(x) may be performed, respectively. The NTT calculation and INTT calculation are represented by the following equations 4 and 5, respectively.

[0062] [Formula 4]

[0063]

[0064] [Formula 5]

[0065]

[0066] In Equations 4 and 5, "a" represents the coefficient of the polynomial a(x), and "n" represents that the nth root is 1. In addition, "n" may satisfy the equation "1 mod q", and "w" may also be composed of numbers satisfying the equation "1 mod q". That is, "n" and "w" may be composed of numbers satisfying n x n -1 ≡1 mod q and w ⅹ w -1 ≡1 condition.

[0067] The multiplication / modulus calculation unit 141b can perform multiplication and modulus operations on the NTT results of the polynomials a(x) and b(x). When multiplying the NTT results, point-by-point multiplication can be used. In this way, coefficients of the same order can be multiplied. The result of the point-by-point multiplication can be used to obtain the final result of multiplying the polynomials a(x) and b(x) through the INTT calculation. Modulus reduction can be performed so that the result value satisfies the ring condition in the above calculation. The NTT-based polynomial multiplication can be expressed by the following formula 6.

[0068] [Formula 6]

[0069] C=INTT(NTT(a(x))·NTT(b(x))

[0070] The Gaussian random number generator 141c can provide random numbers for generating keys and calculating ciphertexts. Since RLWE-based homomorphic encryption requires polynomials sampled from a discrete Gaussian distribution with a standard deviation, the Gaussian random number generator 141c can perform discrete Gaussian sampling to generate random numbers. Rejection sampling and inverse sampling can be used to perform discrete Gaussian sampling. In this case, in order to reduce complexity by approximating a uniform pseudo-random distribution, the Gaussian random number generator 141c can select a linear feedback shift register (LFSR) to generate random numbers.

[0071] Figure 4is a diagram illustrating an area of a non-volatile memory 150 for classifying and storing encrypted data generated at an electronic device 100 according to an embodiment of the present invention. The non-volatile memory 150 may include a non-encrypted data area 151, an encrypted data area 152, and a homomorphically encrypted data area 153. The non-encrypted data area 151, the encrypted data area 152, and the homomorphically encrypted data area 153 refer to spaces of the non-volatile memory 150 that are logically or physically separated from each other. Since the size of the homomorphically encrypted data and the public key used in homomorphic encryption is larger than the plaintext, the speed of processing the public key and the homomorphically encrypted data is very slow. Therefore, the electronic device 100 conceived according to the present invention can prevent data processing from being delayed by storing data in separate spaces according to the type of data (e.g., encrypted form). For example, the type of data may include non-encrypted data, encrypted data, and homomorphically encrypted data.

[0072] The non-encrypted data area 151 is an area for storing data that does not require security (i.e., non-encrypted data) among multiple pieces of data input into the electronic device 100. The encrypted data area 152 is an area for storing data (i.e., encrypted data) obtained by encrypting data (which does not require a very high level of security but needs to be stored in an encrypted form) using a method different from the homomorphic encryption method. The electronic device 100 can store data encrypted by an encryption algorithm such as the AES encryption algorithm or the RSA encryption algorithm in the encrypted data area 152. The homomorphically encrypted data area 153 is an area for storing data (i.e., homomorphically encrypted data) obtained by performing homomorphic encryption on data that requires a high level of security in the electronic device 100. Reference will be made to Figure 6 More fully describes methods for homomorphically encrypting data.

[0073] Figure 5 is a diagram illustrating a manner of classifying encrypted data generated according to an embodiment of the inventive concept. Figure 5 The non-volatile memory 150 may include different regions, such as a single level cell (SLC) 154, a multi-level cell (MLC) 155, a triple level cell (TLC) 156, and a quad level cell (QLC) 157. Each of the different regions may be configured as an SLC 154, an MLC 155, a TLC 156, or a QLC 157 by a control logic circuit (not shown) of the memory. The SLC 154, MLC 155, TLC 156, or QLC 157 may be included in the reference Figure 4The non-encrypted data area 151, the encrypted data area 152, and the homomorphically encrypted data area 153 are described in detail. The QLC 157 includes cells of a higher order than the SLC 154, the MLC 155, and the TLC 156. The TLC 156 includes cells of a higher order than the SLC 154 and the MLC 155. The MLC 155 includes cells of a higher order than the SLC 154. The plurality of pieces of data stored in the non-volatile memory 150 can be stored in accordance with the reference Figure 4 The types of data described are categorized and can then be classified based on size and access frequency.

[0074] For example, the homomorphically encrypted data area 153 may include an SLC 154, an MLC 155, a TLC 156, or a QLC 157. Homomorphically encrypted data and public keys may be stored in the homomorphically encrypted data area 153. As the size of the homomorphically encrypted data and public keys increases, the order of the unit for storing the homomorphically encrypted data and public keys may become higher. As the access frequency of the homomorphically encrypted data and public keys increases, the order of the unit for storing the homomorphically encrypted data and public keys may become lower. As the speed of accessing the homomorphically encrypted data and public keys increases, the order of the unit for storing the homomorphically encrypted data and public keys may become lower. In addition, if the access frequency and required speed associated with the homomorphically encrypted data and public keys change, the order of the unit for storing the homomorphically encrypted data and public keys may change.

[0075] Specifically, data with a relatively small size or requiring fast calculation among the plurality of pieces of homomorphically encrypted data may be stored in the SLC 154. Data with a relatively large size or not requiring fast calculation among the plurality of pieces of homomorphically encrypted data may be stored in the MLC 155. In addition, a multiplication key required for multiplication among the above-mentioned keys included in the public key may be stored in the TLC 156. An encryption key required for data encryption among the above-mentioned keys included in the public key may be stored in the QLC 157.

[0076] For another example, the encrypted data area 152 may include an SLC 154, an MLC 155, and a TLC 156. Public keys and data encrypted using a method other than homomorphic encryption may be stored in the encrypted data area 152. Data that is relatively small in size or requires fast calculation among multiple pieces of encrypted data may be stored in the SLC 154. Data that is relatively large in size or does not require fast calculation among multiple pieces of encrypted data may be stored in the MLC 155.

[0077] As reference Figure 4 and Figure 5As described above, the electronic device 100 according to the present invention can implement selective homomorphic encryption according to the required data security level. The electronic device 100 can classify and store non-encrypted data, encrypted data, and homomorphically encrypted data generated by selective homomorphic encryption, thereby preventing data processing from being delayed and improving the performance of processing encrypted data.

[0078] Figure 6 FIG. 1 is a diagram showing an electronic device 100 (see FIG. Figure 1 ) is a flowchart of a data encryption method.

[0079] In operation S1010, the electronic device 100 according to an embodiment of the present invention may receive first data as a homomorphic encryption target. When the first data as the encryption target is received, the core 120 (referring to Figure 1 ) can instruct the IEE 140 to generate a key. The IEE 140 can receive a command from the core 120 and can generate a secret key and generate a public key based on the secret key. When the key is generated, the IEE 140 can send a key generation response to the core 120 to provide a notification that the key is generated. Upon receiving the key generation response, the core 120 can request the public key from the IEE 140. The IEE 140 can transmit the public key to the outside of the IEE 140 through the mailbox protocol. The public key transmitted to the outside of the IEE 140 can be stored in the non-volatile memory 150 (refer to Figure 1 )middle.

[0080] In operation S1020, the APU 110 (refer to Figure 1 ) can load the public key through the mailbox protocol. The public key may include an encryption key, a multiplication key, a rotation key, etc. In addition, along with the public key, the IEE 140 may store the secret key in the secret key storage device 142 of the IEE 140 (refer to Figure 3 ), and access from the core 120 may be blocked. Alternatively, in a case where the public key is pre-stored in the non-volatile memory 150, the APU 110 may load the public key stored in the non-volatile memory 150 without requesting the public key from the IEE 140.

[0081] In operation S1030, the APU 110 may perform homomorphic encryption on the first data using an encryption key included in the public key. For example, a RLWE encryption system may be used to encrypt the first data. In the RLWE encryption system, the first data, serving as the encryption target, may be encrypted into ciphertext C as the first encrypted data. The ciphertext C may consist of (C0(x), C1(x)), which is an ordered pair of polynomials. The encryption of the first data may be represented by the following equation 7.

[0082] [Formula 7]

[0083] Encryption(d,pk)→C=(C0(x), C1(x))=(e1(x)a(x)+e2(x), e1(x)b(x)+m(x)+e3(x))

[0084] In Formula 7, "d" represents data to be encrypted, and "pk" represents a public key generated at the IEE 140. Figure 2 As described, a(x) represents a first random polynomial determined based on a uniform distribution, b(x) represents a second random polynomial determined based on e(x), and e(x) is determined based on a secret key and an error extracted from a discrete Gaussian distribution. m(x) represents a polynomial element obtained by encoding the first data. e1(x), e2(x), and e3(x) represent three error polynomial elements generated from a discrete Gaussian distribution. The homomorphic encryption accelerator 130 can speed up the encryption process during the homomorphic encryption of the first data.

[0085] In operation S1040, the APU 110 may send the first encrypted data to the non-volatile memory 150. The first encrypted data may be stored in the homomorphically encrypted data area 153 (refer to Figure 4 ). The first encrypted data, which is homomorphically encrypted data, can be classified according to the size of the ciphertext, the access frequency, and the required calculation speed, and can be stored in the homomorphically encrypted data area 153. For example, in the case where the ciphertext has a relatively small size or requires fast calculation, the ciphertext can be stored in a relatively low-order unit in the homomorphically encrypted data area 153. Alternatively, in the case where the ciphertext has a relatively large size or does not require fast calculation, the ciphertext can be stored in a relatively high-order unit in the homomorphically encrypted data area 153.

[0086] Figure 7 FIG. 1 is a diagram showing an electronic device 100 (see FIG. Figure 1 ) is a flowchart of an encrypted data processing method. Figure 7 The encrypted data processing method disclosed in corresponds to the method that can be used in accordance with the reference Figure 6 Describes the encryption method for data calculation.

[0087] In operation S2010, the electronic device 100 according to an embodiment of the inventive concept can input a data from the data input device 170 (refer to Figure 1 ) receives second data as a data processing target. The second data may be a target of homomorphic encryption so as to Figure 6 The encryption process described is related to the data stored in the non-volatile memory 150 (refer to Figure 1 ) is calculated together with the first encrypted data in ).

[0088] In operation S2020, the APU 110 (refer to Figure 1 ) can be loaded in reference Figure 6 The public key stored in the non-volatile memory 150 in operation S1010 is described. The public key may include an encryption key, a multiplication key, a rotation key, etc. The encryption key can be used for homomorphic encryption of input data. The multiplication key can be used for calculation of homomorphic encrypted data. The rotation key can be used for a bootstrap program to remove noise added during the processing of encrypted data.

[0089] In operation S2030, the APU 110 can Figure 6 The APU 110 may generate second encrypted data by performing homomorphic encryption on the second data based on the encryption key included in the public key. Figure 1 ) can speed up the encryption process in the homomorphic encryption of the second encrypted data.

[0090] In operation S2040, in order to perform calculation on the second encrypted data, the APU 110 may read the second encrypted data in the reference Figure 6 The first encrypted data stored in the nonvolatile memory 150 in operation S1040 is described. The APU 110 may perform calculations on the first encrypted data and the second encrypted data. Since the encrypted data processing method according to an embodiment of the present inventive concept can be performed based on a fully homomorphic encryption (FHE) system, addition and multiplication calculation results can be simultaneously maintained, and thus various calculations such as size comparison, summation, multiplication, data analysis, AI learning, etc. can be performed.

[0091] In operation S2050, the electronic device 100 may interpret the calculation results of the first encrypted data and the second encrypted data. Because embodiments of the present inventive concept are based on a homomorphic encryption system, the result of calculating the ciphertext can be the same as the result of calculating the plaintext. For example, the calculation results of the first encrypted data and the second encrypted data can be the same as the result of performing homomorphic encryption on the calculation result of the plaintext. Therefore, the result of the operation intended to be performed by the electronic device 100 can be derived based on the calculation results of the first encrypted data and the second encrypted data. For example, it can be determined whether the first encrypted data and the second encrypted data are consistent with each other.

[0092] Alternatively, the electronic device 100 may send a message to the IEE 140 (see Figure 1 ) sends the calculation result of the first encrypted data and the second encrypted data, and can be stored in the secret key storage device 142 (see Figure 3 ) to decrypt the calculation result. The IEE 140 can transmit only the decryption result based on the secret key to the outside through the mailbox protocol. In other words, only the calculation result of the first encrypted data and the second encrypted data is transmitted to the outside without leaking information about the first encrypted data and the second encrypted data input to the IEE 140. Therefore, leakage of data information used in the electronic device 100 can be prevented.

[0093] Figure 8 1 is a block diagram illustrating an electronic device 100a providing a biometric authentication function according to an embodiment of the present invention. The electronic device 100a providing a biometric authentication function may include an APU 110, an IEE 140, a non-volatile memory (NVM) 150, a memory 160, and a biometric recognition device 170a. The APU 110 may include a core 120 and a homomorphic encryption accelerator 130. Figure 8 In the electronic device 100a with a biometric authentication function disclosed in Figures 1 to 7 Additional descriptions associated with the described components, functions, features, and operations may be omitted to avoid redundancy.

[0094] The electronic device 100a with a biometric authentication function can determine whether the registered biometric information and the input biometric information are consistent with each other. In the electronic device 100a with a biometric authentication function, the biometric information corresponds to information that needs to be protected. Therefore, the multiple pieces of biometric information registered and input to the electronic device 100a with a biometric authentication function can be homomorphically encrypted, thereby protecting the biometric information.

[0095] In the electronic device 100a with biometric authentication functionality, the biometric recognition device 170a can receive biometric information used for biometric authentication as data. For example, the biometric recognition device 170a can receive body information (e.g., fingerprint, face, iris, voice, and vein) as data. The biometric recognition device 170a can transmit the biometric information data to the APU 110.

[0096] The electronic device 100a with biometric authentication function can be based on Figure 6 The data encryption method disclosed in the present invention registers the biometric information inputted by the biometric identification device 170a as an authentication reference. In addition, the electronic device 100a with a biometric authentication function can register the biometric information inputted by the biometric identification device 170a with the biometric information inputted by the biometric identification device 170a as an authentication reference. Figure 7 The encrypted data processing method disclosed in the disclosure compares the registered biometric information and can determine whether the input authentication information is authenticated. Figure 9 The operating method of the electronic device 100a with biometric authentication function is described more comprehensively.

[0097] Figure 9 It shows Figure 8 The electronic device 100a providing a biometric authentication function disclosed in Figure 8 ) is a flowchart of the operation method. Figure 9 In the operating method of the electronic device 100a with a biometric authentication function disclosed in , operations S3010 to S3030 correspond to a process of registering biometric information as an authentication reference, and operations S3040 to S3100 correspond to a process of determining whether the input authentication information is authenticated.

[0098] In operation S3010, the biometric recognition device 170a (refer to Figure 8 ) can receive first biometric information from the outside. The first biometric information can be information about the user's fingerprint, face, iris, or vein. The first biometric information refers to biometric information used as an authentication reference for the electronic device 100a having a biometric authentication function. The biometric recognition device 170a can send a biometric information to the APU 110 (refer to Figure 8 ) transmits first biometric information input from the outside.

[0099] When the first biometric information is input to the APU 110, the core 120 (see Figure 8 ) may order IEE 140 (see Figure 8) to encrypt the first biometric information. The IEE 140 may generate a secret key based on a command from the core 120, and may generate a public key based on the secret key. When the key is generated, the IEE 140 may send a key generation response to the core 120 to notify the core 120 of the key generation. Upon receiving the key generation response, the core 120 may request the public key from the IEE 140. The IEE 140 may transmit the public key to an external device of the IEE 140 via a mailbox protocol.

[0100] In operation S3020, the APU 110 may load the public key generated at the IEE 140 through the mailbox protocol. Along with transmitting the public key, the IEE 140 may store the secret key in the secret key storage device 142 of the IEE 140 (refer to Figure 3 Alternatively, the public key is pre-stored in the non-volatile memory 150 (refer to Figure 8 ), the APU 110 may load the public key from the non-volatile memory 150. When the secret key is stored in the secret key storage 142, the IEE 140 may block access from the core 120 to the IEE 140.

[0101] In operation S3030, the APU 110 may encrypt the first biometric information by using the encryption key included in the public key. The first biometric information may be homomorphically encrypted into first encrypted data. In this case, the homomorphic encryption accelerator 130 (refer to Figure 8 ) can improve the encryption speed. The first encrypted data can be sent to the non-volatile memory 150. The homomorphically encrypted first encrypted data can be stored in the homomorphically encrypted data area 153 (refer to Figure 8 In addition, the public key used to homomorphically encrypt the first biometric information can be stored in the homomorphically encrypted data area 153 of the non-volatile memory 150.

[0102] In contrast, in the electronic device 100a having a biometric authentication function, data that does not require encryption among a plurality of pieces of input data for operating the electronic device 100a can be stored in the non-encrypted data area 151 of the non-volatile memory 150 (see Figure 8 ) without encryption processing. Data that does not require a high level of security can be encrypted by an encryption algorithm different from homomorphic encryption (such as the AES encryption algorithm or the RSA encryption algorithm), and the encrypted data can be stored in the encrypted data area 152 of the non-volatile memory 150.

[0103] In operation S3040, the biometric recognition device 170a may receive second biometric information from an external device. The second biometric information may also include information about the user's fingerprint, face, iris, or veins. The second biometric information is biometric information that serves as an authentication target for the electronic device 100a having biometric authentication functionality. The biometric recognition device 170a may transmit the externally input second biometric information to the APU 110.

[0104] When the second biometric information is input to the APU 110, the core 120 of the APU 110 may read the public key stored in the nonvolatile memory 150 to encrypt the second biometric information in operation S3050. The APU 110 may generate second encrypted data by performing homomorphic encryption on the second biometric information based on the public key.

[0105] In operation S3060, the APU 110 may read the first encrypted data to authenticate the second encrypted data serving as the authentication target. The first encrypted data, which is data used as an authentication reference for the electronic device 100a having a biometric authentication function, refers to the data stored in the homomorphically encrypted data area 153 of the non-volatile memory 150 in operation S3030.

[0106] In operation S3070, the APU 110 may calculate the first encrypted data and the second encrypted data using a multiplication key, a rotation key, etc. included in the public key. For example, the APU 110 may perform a size comparison, a summation, or a multiplication on the first encrypted data and the second encrypted data. The APU 110 may transmit the calculation results of the first encrypted data and the second encrypted data to the IEE 140 via a mailbox protocol.

[0107] In operation S3080, the IEE 140 may decode the calculation results of the first encrypted data and the second encrypted data using the secret key stored in the secret key storage device 142, and may compare the decoded calculation results with a threshold value. The threshold value refers to a value pre-stored in the electronic device 100a with a biometric authentication function in order to interpret the data calculation results. The threshold value may be stored in the memory 144 included in the IEE 140 (refer to Figure 3 )middle.

[0108] When the decoded calculation result is less than the threshold value, the electronic device 100a with a biometric authentication function may proceed to operation S3090 and may authorize access to the electronic device including the electronic device 100a with a biometric authentication function. When the decoded calculation result is not less than the threshold value, the electronic device 100a with a biometric authentication function may proceed to operation S3100 and may deny access to the electronic device including the electronic device 100a with a biometric authentication function.

[0109] Figure 10 1 is a block diagram illustrating an electronic device 100b that provides a malicious code (or malware) determination function according to an embodiment of the present invention. The electronic device 100b that provides a malicious code determination function may include an APU 110, an IEE 140, a non-volatile memory 150, and a modem 170b. The APU 110 may include a core 120, a homomorphic encryption accelerator 130, and an interpreter 180. Figure 10 In the electronic device 100b with a malicious code determination function disclosed in Figures 1 to 7 Additional descriptions associated with the described components, functions, features, and operations will be omitted to avoid redundancy.

[0110] The electronic device 100b with a malicious code determination function can determine whether the information in the malicious code database and the information in the input code are consistent with each other. In the event that the malicious code database and the input code information processed by the electronic device 100b with a malicious code determination function are leaked, any other measures to prevent the electronic device 100b from malicious code can be implemented. Therefore, in the electronic device 100b with a malicious code determination function, the malicious code database and the input code information can correspond to information that must be protected. In the electronic device 100b with a malicious code determination function, the malicious code database and the input code information can be protected by homomorphic encryption and stored in the homomorphic encrypted data area 153 of the non-volatile memory 150.

[0111] In the electronic device 100b having a malicious code determination function, the modem 170b can communicate with an external device. For example, the modem 170b can communicate with an external device through wireless communication schemes such as Long Term Evolution (LTE), Global System for Mobile Communications (GSM), Wireless Fidelity (Wi-Fi), Near Field Communication (NFC), and Bluetooth. As another example, the modem 170b can communicate with an external device through wired communication schemes such as Ethernet and Cable Data Service Interface Specification (DOCSIS). That is, the modem 170b can be connected to a network through wired or wireless communication, and can communicate with an external device through the network.

[0112] The modem 170b may decode a signal received from an external device and may provide the decoded signal to an internal component of the electronic device 100b having a malicious code determination function. The signal received from the external device may include information about a malicious code input to the external device.

[0113] Interpreter 180 can extract characteristic information of the malicious code from the information about the malicious code to establish a malicious code database and identify the malicious code. For example, interpreter 180 can extract the signature of the input malicious code to interpret the characteristics of the malicious code. Alternatively, to dynamically analyze the malicious code, interpreter 180 can extract abnormal behavior information of the input malicious code.

[0114] The electronic device 100b with malicious code determination function can be based on Figure 6 The data encryption method disclosed in registers (or adds) the characteristic information (e.g., signature or abnormal behavior information) of the malicious code transmitted from the interpreter 180 to the database.

[0115] Alternatively, the electronic device 100b having the malicious code determination function may receive the information based on the modem 170b. Figure 6 The electronic device 100b may register (or add) the encrypted signature or abnormal behavior information to the database. In this case, the electronic device 100b may provide the public key for encryption to the external device so that Figure 6 The encryption method can be performed on the external device.

[0116] Interpreter 180 may monitor the operation of the operating system or application. For example, interpreter 180 may monitor whether a candidate access pattern occurs. A candidate access pattern may be, for example, an access pattern that is irregular with respect to memory 160 or non-volatile memory 150 and is therefore likely to be accessed by malicious code. If a candidate access pattern occurs in an application, interpreter 180 may transmit information indicating the occurrence of the candidate access pattern to core 120.

[0117] The electronic device 100b with malicious code determination function can be based on Figure 7 The encrypted data processing method disclosed in the present invention compares the candidate access pattern transmitted from the interpreter 180 with the characteristic information registered in the database, and can determine whether the candidate access pattern is associated with malicious code. Figure 12 The operating method of the electronic device 100b having malicious code determination functionality is described more comprehensively.

[0118] Figure 11 It is shown in Figure 10The electronic device 100b with malicious code determination function disclosed in Figure 10 ) is a flowchart of a method for establishing a malicious code database. Figure 10 The following description is given: the process of establishing a database is performed for an example of malicious code information. However, the database establishment method according to the present invention can be implemented in parallel or sequentially. Figure 11 The database establishment method described above can eventually establish a database storing a large amount of malicious code data. In addition, the data stored in the database can be additionally updated based on malicious code information newly received while the electronic device 100b with a malicious code determination function is operating.

[0119] In operation S4010, the APU 110 (refer to Figure 10 ) can be obtained from modem 170b (refer to Figure 10 ) receives the characteristic information of the malicious code. The characteristic information of the malicious code may include signature information, abnormal behavior information, etc. In order to encrypt the characteristic information of the malicious code, the core 120 may command the IEE 140 (refer to Figure 10 ) generates a key. The IEE 140 may generate a secret key based on a command from the core 120, and may generate a public key based on the secret key. When a key is generated, the IEE 140 may send a key generation response to the core 120 to notify the core 120 of the key generation. Upon receiving the key generation response, the core 120 may request the public key from the IEE 140. The IEE 140 may transmit the public key to an external device of the IEE 140 via a mailbox protocol.

[0120] In operation S4020, the APU 110 may read the public key generated at the IEE 140 through the mailbox protocol. Along with transmitting the public key to the outside, the IEE 140 may store the secret key in the secret key storage device 142 of the IEE 140 (refer to Figure 3 ). The public key is pre-stored in the non-volatile memory 150 (refer to Figure 10 ), the APU 110 may read the public key from the non-volatile memory 150. When the secret key is stored in the secret key storage 142, the IEE 140 may block access from the core 120 to the IEE 140.

[0121] In operation S4030, the APU 110 may encrypt the input characteristic information of the malicious code by using the encryption key included in the public key. The characteristic information of the malicious code may be homomorphically encrypted into the first encrypted data. In this case, the homomorphic encryption accelerator 130 (refer to Figure 10 ) can increase encryption speed.

[0122] In operation S4040, the non-volatile memory 150 (refer to Figure 10 ) sends the first encrypted data. The homomorphically encrypted first encrypted data can be stored in the homomorphically encrypted data area 153 of the non-volatile memory 150 (refer to Figure 10 ). In addition, the public key used for homomorphically encrypting the characteristic information of the malicious code can be stored in the homomorphically encrypted data area 153 of the non-volatile memory 150. The first encrypted data stored in the homomorphically encrypted data area 153 can be used as data of a database for determining malicious code. The electronic device 100b having a malicious code determination function can be implemented in parallel or sequentially. Figure 11 The database establishment method disclosed in is used to establish a database for storing various malicious code data.

[0123] In contrast, in the electronic device 100b having the malicious code determination function, data that does not require encryption among a plurality of pieces of input data for operating the electronic device 100b may be stored in the non-encrypted data area 151 of the non-volatile memory 150 (see Figure 10 ) without encryption processing. Data that does not require a high level of security can be encrypted by an encryption algorithm different from homomorphic encryption (such as the AES encryption algorithm or the RSA encryption algorithm), and the encrypted data can be stored in the encrypted data area 152 of the non-volatile memory 150.

[0124] Figure 12 It is shown in Figure 10 The electronic device 100b with malicious code determination function disclosed in Figure 10 ) is a flowchart of a method for detecting malicious code. Figure 12 Public malicious code detection methods can be used after executing Figure 11 The malicious code database establishment method is executed at least once. Figure 12 The illustrated method of detecting malicious code may be performed after storing the malicious code database in the homomorphically encrypted data area 153 of the non-volatile memory 150 .

[0125] In operation S5010, the APU 110 (refer to Figure 10 ) can detect whether a specific access pattern occurs. The interpreter 180 of the APU 110 (refer to Figure 10 ) can detect whether a candidate access pattern appears from the received monitoring information.

[0126] In operation S5020, the APU 110 may read the Figure 11The public key stored in the nonvolatile memory 150 in operation S4040 of the described database establishment method can be used to homomorphically encrypt the candidate access mode information received from the modem 170b based on the public key. The APU 110 can generate encrypted data by performing homomorphic encryption on the candidate access mode information.

[0127] In operation S5030, the APU 110 may read the malicious code database information to determine whether the encrypted data as the determination target corresponds to the malicious code. The malicious code database information as reference data for the electronic device 100b having the malicious code determination function to determine the malicious code refers to data included in the database, which is obtained by performing a reference operation in parallel or sequentially. Figure 11 The malicious code database was created based on the method described in the previous section.

[0128] In operation S5040, the APU 110 may calculate the encrypted data and the data included in the malicious code database using a multiplication key, a rotation key, etc. included in the public key. For example, the APU 110 may perform a size comparison, a summation, or a multiplication on the encrypted data and the data included in the database. The APU 110 may transmit the calculation result of the encrypted data and the data included in the database to the IEE 140 via a mailbox protocol.

[0129] In operation S5050, the IEE 140 may decode the encrypted data and the calculation result of the data included in the database, and may compare the decoded calculation result with a threshold value. The threshold value refers to a value pre-stored in the electronic device 100b having a malicious code determination function in order to interpret the data calculation result. The threshold value may be stored in the memory 144 included in the IEE 140 (refer to Figure 3 )middle.

[0130] When the decoded calculation result is less than the threshold value, the electronic device 100b with a malicious code determination function may proceed to operation S5060 and deny access to the corresponding code. When the decoded calculation result is not less than the threshold value, the electronic device 100b with a malicious code determination function may proceed to operation S5070 and authorize access to the corresponding code.

[0131] As described above, the electronic device 100 (referring to Figure 1 ) is described as including an APU 110 (cf. Figure 1 ), an IEE 140 (refer to Figure 1 ) and a non-volatile memory 150 (refer to Figure 1However, the electronic device 100 disclosed in the specification may be merely one embodiment of the present inventive concept. For example, the electronic device 100 according to an embodiment of the present inventive concept may include multiple APUs 110, multiple IEEs 140, or multiple non-volatile memories 150. In addition, the electronic device 100 may be implemented in the form of any electronic device requiring data security, such as a desktop computer, a notebook computer, a smartphone, a tablet PC, or a wearable device.

[0132] The electronic device and the encrypted data processing method according to the inventive concept can reduce the risk of data leakage through a network and can provide a high level of security.

[0133] The electronic device and the encrypted data processing method according to the inventive concept can prevent delays in data processing by using selective homomorphic encryption, thereby improving processing performance of encrypted data.

[0134] While the inventive concept has been described with reference to exemplary embodiments thereof, it will be apparent to those skilled in the art that various changes and modifications can be made therein without departing from the spirit and scope of the inventive concept as set forth in the appended claims.

Claims

1. An electronic device comprising: a memory configured to store data received from an external source; an application processing unit (APU), the APU being configured to send a secret key generation command and a public key generation command; an isolated execution environment (IEE), the IEE being configured to generate a secret key in response to the secret key generation command, generate a public key based on the secret key in response to the public key generation command, and store the secret key; as well as a non-volatile memory configured to perform a write operation and a read operation according to a request of the APU, wherein, when the data is stored in the memory, the APU sends a public key request to the IEE; wherein, in response to the public key request, the IEE transmits the public key to the APU via a mailbox protocol, wherein the APU generates a ciphertext by performing homomorphic encryption on the data based on an encryption key included in the public key, and The APU classifies the public key and the ciphertext and stores them in the non-volatile memory.

2. The electronic device according to claim 1, wherein The APU includes: A homomorphic encryption accelerator is configured to accelerate the homomorphic encryption.

3. The electronic device according to claim 1, wherein The IEE includes: a homomorphic encryption key generator configured to generate the secret key and the public key; a secret key storage device configured to store the secret key; and A decoder is configured to decode a calculation result associated with the ciphertext based on the secret key.

4. The electronic device according to claim 3, wherein The homomorphic encryption key generator includes: a number-theoretic transform / inverse number-theoretic transform calculation unit configured to perform a number-theoretic transform and an inverse number-theoretic transform; a multiplication / modulo calculation unit configured to perform a multiplication operation and a modulo operation; and A Gaussian random number generator is configured to generate random numbers for generating the secret key and the public key.

5. The electronic device according to claim 3, wherein When the secret key and the public key are generated, the IEE blocks the APU from accessing the IEE. The electronic device according to claim 1 , wherein: The public keys include rotating keys used to perform a boot procedure.

7. The electronic device according to claim 1, wherein The non-volatile memory includes a non-encrypted data area, an encrypted data area, and a homomorphically encrypted data area. The public key and the ciphertext generated based on the homomorphic encryption are stored in the homomorphic encryption data area.

8. The electronic device according to claim 7, wherein: The homomorphically encrypted data area includes: single-level cells SLC, multi-level cells MLC, triple-level cells TLC and quadruple-level cells QLC, The APU classifies the ciphertext based on the size, access frequency, or required speed of the ciphertext, and stores the ciphertext in one of the SLC, the MLC, the TLC, and the QLC.

9. The electronic device according to claim 1, wherein The APU performs the homomorphic encryption by using an on-ring error learning encryption technique.

10. A method for processing encrypted data, comprising: receiving first data from an external source; Load the public key generated in the isolated execution environment (IEE) through the mailbox protocol; performing homomorphic encryption on the first data based on an encryption key included in the public key to generate first encrypted data; storing the public key and the first encrypted data in a non-volatile memory; receiving second data from the external source; loading the public key stored in the non-volatile memory; performing homomorphic encryption on the second data based on the encryption key included in the public key to generate second encrypted data; as well as Calculation is performed on the first encrypted data and the second encrypted data based on a multiplication key included in the common key.

11. The encrypted data processing method according to claim 10, further comprising: When the first data is received, a command for generating a secret key and a public key is sent from an application processing unit APU to the IEE.

12. The encrypted data processing method according to claim 11, further comprising: When the IEE receives the command, the secret key is generated at the IEE, and the public key is generated based on the secret key.

13. The encrypted data processing method according to claim 12, further comprising: transmitting the public key to a location external to the IEE via the mailbox protocol; as well as The secret key is stored in a secret key storage device included in the IEE.

14. The encrypted data processing method according to claim 10, wherein: The execution calculation includes: A boot procedure is performed based on a rotation key included in the public key.

15. The encrypted data processing method according to claim 11, wherein: The non-volatile memory includes a non-encrypted data area, an encrypted data area, and a homomorphically encrypted data area. The first encrypted data generated based on the public key and the homomorphic encryption is stored in the homomorphic encryption data area.

16. The encrypted data processing method according to claim 15, wherein: The homomorphically encrypted data area includes: single-level cells SLC, multi-level cells MLC, triple-level cells TLC and quadruple-level cells QLC, The APU classifies the second encrypted data based on the size, access frequency, or required speed of the second encrypted data, and stores the second encrypted data in one of the SLC, the MLC, the TLC, and the QLC.

17. The encrypted data processing method according to claim 10, wherein: The homomorphic encryption uses a ring error learning encryption technique.

18. An electronic device with a malicious code detection function, comprising: a modem configured to receive information about malicious code from an external source; an application processing unit (APU), the APU being configured to: extract characteristic information of the malicious code from the information of the malicious code, and send a secret key generation command and a public key generation command; an isolated execution environment (IEE), the IEE being configured to: generate a secret key in response to the secret key generation command, generate a public key based on the secret key in response to the public key generation command, and store the secret key; as well as a non-volatile memory configured to perform a write operation and a read operation according to a request of the APU, When the characteristic information of the malicious code is extracted, the APU sends a public key request to the IEE; wherein, in response to the public key request, the IEE transmits the public key to the APU via a mailbox protocol, wherein the APU generates first encrypted data by performing homomorphic encryption on the feature information of the malicious code based on an encryption key included in the public key, and The APU stores the first encrypted data in the non-volatile memory.

19. The electronic device according to claim 18, wherein The APU includes: a homomorphic encryption accelerator configured to accelerate the homomorphic encryption, Wherein, the IEE includes: a homomorphic encryption key generator configured to generate the secret key and the public key; a secret key storage device configured to store the secret key; and A decoder is configured to decode a calculation result associated with the first encrypted data based on the secret key.

20. The electronic device according to claim 18, wherein The APU is configured to: When a candidate access pattern of the malicious code is detected, generating second encrypted data by encrypting the candidate access pattern based on the encryption key; reading the first encrypted data from the non-volatile memory; as well as A calculation is performed on the second encrypted data and the first encrypted data.

Images