Memory interface controller and memory

Abstract

The embodiment of the present invention provides a memory interface controller and a memory, which belongs to the field of data storage. The memory interface controller includes: a first communication module, which is used to receive plaintext data transmitted by an external device, and transmit the received plaintext data to a register module for storage; an encryption module, which is used to encrypt the stored plaintext data to obtain corresponding ciphertext data, and transmit the ciphertext data to a cache module for caching; a data processing module, which is used to transfer the plaintext data stored in the register module to the encryption module, and transfer the ciphertext data cached by the cache module to a second communication module; the second communication module is used to transmit the received ciphertext data to the memory. The memory interface controller of the present invention realizes encryption guarantee at the source of data storage by adding an encryption module, which can ensure data security.

Description

Technical Field

[0001] The present invention relates to the technical field of data storage, and in particular to a memory interface controller and a memory. Background Art

[0002] With the rapid progress of semiconductor technology and the continuous development of architecture, the performance of various memories has been continuously improved and their applications have become increasingly widespread. Taking SD (Secure Digital Memory Card) / eMMC (Embedded Multi Media Card) memory as an example, more and more consumers like to use SD / eMMC memory in the fields of industrial control, consumer electronics, and automotive electronics. For example, SD / eMMC memory is used to store video files in video surveillance, files shot by cameras, and program files in the field of industrial control. SD / eMMC memory is widely used by terminal devices in various fields.

[0003] However, most existing memories transmit data through PCB board-level connections, gold finger connections, or welding points, but these methods expose the interface gold fingers or welding points, which in turn exposes data. For example, the data in SD / eMMC memory can be easily obtained through an SD card reader or contact theft, which poses a great security risk to users. At the same time, the reading and writing modes of data in existing memories are all plaintext, resulting in the data stored in the memory being plaintext as well. In this way, anyone can obtain the original data in the memory, which in turn causes data leakage. In particular, the exposure of video data will cause serious risks of personal / company privacy leakage.

[0004] Therefore, it is of great significance to solve the data security problem in memory application solutions. Summary of the invention

[0005] An object of the embodiments of the present invention is to provide a memory interface controller and a memory, so as to at least partially solve the above technical problems.

[0006] In order to achieve the above-mentioned purpose, an embodiment of the present invention provides a memory interface controller, comprising a first communication module, a register module, an encryption module, a data processing module and a second communication module, wherein: the first communication module is used to receive plaintext data transmitted by an external device of the memory interface controller, and transmit the received plaintext data to the register module for storage; the encryption module is used to encrypt the plaintext data stored in the register module to obtain corresponding ciphertext data; the data processing module is used to transfer the plaintext data stored in the register module to the encryption module for encryption, and transfer the ciphertext data obtained by the encryption module to the second communication module; the second communication module is used to transmit the received ciphertext data to the memory corresponding to the memory interface controller.

[0007] Optionally, the memory interface controller also includes a cache module and a decryption module adapted to the encryption module, and: the second communication module is also used to receive ciphertext data transmitted by the memory corresponding to the memory interface controller, and transmit the received ciphertext data to the cache module for caching; the decryption module is used to decrypt the ciphertext data stored in the cache module to obtain corresponding plaintext data; the data processing module is also used to transfer the ciphertext data from the cache module to the decryption module, and transmit the plaintext data decrypted by the decryption module to the register module for storage; and the first communication module is also used to transmit the plaintext data stored in the register module to an external device of the memory interface controller; wherein the cache module is also used to cache the ciphertext data obtained by the encryption module, so that the data processing module can transfer the ciphertext data obtained by the encryption module and cached in the cache module to the second communication module.

[0008] Optionally, the memory interface controller also includes a command processing module, and the command processing module is used to control at least one or more of the following by sending commands: controlling the first communication module to transmit the plaintext data received from the external device to the register module; controlling the data processing module to move the plaintext data stored in the register module to the encryption module; controlling the data processing module to move the ciphertext data from the cache module to the second communication module; controlling the second communication module to transmit the ciphertext data received from the cache module to the memory; controlling the second communication module to transmit the ciphertext data received from the memory to the cache module; controlling the data processing module to move the ciphertext data cached by the cache module to the decryption module; controlling the data processing module to transmit the plaintext data decrypted by the decryption module to the register module; and controlling the first communication module to transmit the plaintext data stored in the register module to the external device.

[0009] Optionally, the memory interface controller also includes a true random number generation module, which is connected to the encryption module and / or the decryption module and is configured to: generate a random number to form a dynamic key string, and send the dynamic key string to the encryption module, so that the encryption module encrypts the plaintext data in combination with the dynamic key string; and / or store the dynamic key string generated by encryption for the encryption module, and send the dynamic key string to the decryption module, so that the decryption module decrypts the ciphertext data in combination with the dynamic key string.

[0010] Optionally, the encryption module encrypts the plaintext data in combination with the dynamic key string, including: selecting plaintext data with the same number of bits as the dynamic key string to perform an XOR operation with the dynamic key string, and outputting initial ciphertext data after the operation; dividing the initial ciphertext data into several groups according to the number of bits, and performing corresponding S-box operations on each group to obtain intermediate ciphertext data; and scrambling the intermediate ciphertext data to obtain final ciphertext data.

[0011] Optionally, the scrambling the intermediate ciphertext data includes: scrambling each bit of the intermediate ciphertext data to another position, and maintaining a one-to-one mapping relationship between each bit of the scrambled data and the corresponding position.

[0012] Optionally, the decryption module decrypts the ciphertext data in combination with the dynamic key string, including: descrambling the ciphertext data according to the scrambling rules used during the scrambling process to obtain initial plaintext data; performing an S-box inverse operation corresponding to the S-box operation on the initial plaintext data to obtain intermediate plaintext data; and performing an XOR operation on the intermediate plaintext data and the dynamic key string to obtain final plaintext data.

[0013] Optionally, the memory is a secure digital memory card SD memory or an embedded multimedia card eMMC memory, and the second communication module transmits or receives encrypted data to the SD memory or eMMC memory based on the eMMC 5.2 standard protocol.

[0014] Optionally, the first communication module includes: a slave unit, used for performing data interaction with the external device in a bus manner; and a host unit, used for performing data interaction with the external device in a direct memory access (DMA) manner.

[0015] On the other hand, an embodiment of the present invention further provides a memory, wherein the memory is configured with the above-mentioned memory interface controller.

[0016] Through the above technical solution, the memory interface controller of the embodiment of the present invention realizes encryption guarantee at the source of data storage by adding an encryption module, and can encrypt both the memory interface and internal data into ciphertext, which can prevent data theft on the transmission channel and data theft from the memory, thereby ensuring data security.

[0017] Other features and advantages of the embodiments of the present invention will be described in detail in the subsequent detailed description. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] The accompanying drawings are used to provide a further understanding of the embodiments of the present invention and constitute a part of the specification. Together with the following specific implementations, they are used to explain the embodiments of the present invention, but do not constitute a limitation on the embodiments of the present invention. In the accompanying drawings:

[0019] Figure 1 is a schematic structural diagram of a memory interface controller according to an embodiment of the present invention;

[0020] FIG2( a ) is a logic implementation block diagram of an exemplary encryption process according to an embodiment of the present invention;

[0021] FIG2( b ) is a logic implementation block diagram of an exemplary decryption process according to an embodiment of the present invention;

[0022] Figure 3 is a schematic diagram of the structure of a memory interface controller in a preferred embodiment of the present invention; and

[0023] Figure 4 is a schematic diagram of the structure of an exemplary memory interface controller according to an embodiment of the present invention.

[0024] Description of Reference Numerals

[0025] 100, memory interface controller; 200, external device; 300, memory;

[0026] 110, first communication module; 120, register module; 130, encryption module; 140, data processing module; 150, cache module; 160, second communication module; 170, decryption module; 180, command processing module; 190, true random number generation module;

[0027] 111. Slave unit; 112. Master unit. DETAILED DESCRIPTION

[0028] The specific implementation of the embodiment of the present invention is described in detail below in conjunction with the accompanying drawings. It should be understood that the specific implementation described here is only used to illustrate and explain the embodiment of the present invention, and is not used to limit the embodiment of the present invention.

[0029] Figure 1 1 is a schematic diagram of the structure of a memory interface controller 100 according to an embodiment of the present invention. The memory interface controller is suitable for an encryption scenario in which plain text data from an external device 200 is encrypted and then transmitted to a memory 300 .

[0030] like Figure 1 As shown, the memory interface controller 100 of the embodiment of the present invention includes a first communication module 110, a register module 120, an encryption module 130, a data processing module 140 and a second communication module 160, wherein: the first communication module 110 is used to receive plaintext data transmitted by an external device 200 of the memory interface controller, and transmit the received plaintext data to the register module 120 for storage; the encryption module 130 is used to encrypt the plaintext data stored in the register module 120 to obtain corresponding ciphertext data; the data processing module 140 is used to transfer the plaintext data stored in the register module 120 to the encryption module 130 for encryption, and transfer the ciphertext data obtained by the encryption module 130 to the second communication module 160; the second communication module 160 is used to transmit the received ciphertext data to the memory 300 corresponding to the memory interface controller.

[0031] Among them, the external device 200 is, for example, a device that transmits data to the memory interface controller 100 through the CPU (Central Processing Unit) based on the bus, such as a camera commonly used in the field of video surveillance or security, which uploads the collected image data to the CPU through a network port or other interface, and the CPU then forwards the data to the memory interface controller 100 through the AHB / AXI bus, and the memory interface controller 100 then writes the data into the memory 300.

[0032] The memory 300 includes, but is not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory, SD / eMMC memory, etc. It should be noted that the second communication module 160 needs to be compatible with the memory 300. For example, when the memory 300 is an SD / eMMC memory, the second communication module should be able to adapt to the eMMC protocol for data transmission.

[0033] In the above, the encryption module 130 is used to encrypt the data that the external device 200 intends to store in the memory 300, so that the data has become ciphertext data before entering the memory 300, thereby realizing encryption guarantee at the source of data storage. In this way, even if the memory leaks data due to the exposure of gold fingers or welding points, the data is ciphertext data, which greatly improves data security.

[0034] In a preferred embodiment, corresponding to the encryption process, the memory interface controller 100 can also be applied to a decryption scenario in which the ciphertext data stored in the memory 300 is decrypted for transmission to the external device 200. For example, the decryption scenario is that the controller of a certain device (external device 200) needs to read the data stored in the memory 300.

[0035] For the decryption scenario, in the preferred embodiment, the memory interface controller 100 further includes a cache module 150 and a decryption module 170. Moreover, to adapt to the decryption scenario, the functions of each module can be configured as follows: the second communication module 160 is further used to receive the ciphertext data transmitted by the memory 300 corresponding to the memory interface controller, and transmit the received ciphertext data to the cache module 150 for caching; the decryption module 170 is used to decrypt the ciphertext data stored in the cache module 150 to obtain the corresponding plaintext data; the data processing module 140 is further used to transfer the ciphertext data from the cache module 150 to the decryption module 170, and transmit the plaintext data decrypted by the decryption module 170 to the register module 120 for storage; and the first communication module 110 is further used to transmit the plaintext data stored in the register module 120 to the external device 200 of the memory interface controller.

[0036] The decryption module 170 should be compatible with the encryption module 130 so that it can decrypt the ciphertext data encrypted by the encryption module 130. Through the decryption module 170, the data is also in ciphertext form when it is output from the memory, thereby avoiding the data from being intercepted through the external transmission channel of the memory 300. In the encryption scenario, the cache module 150 is also used to cache the ciphertext data obtained by the encryption module 130, so that the data processing module 140 can transfer the ciphertext data obtained by the encryption module 130 cached in the cache module 150 to the second communication module 160.

[0037] Furthermore, the above relates to data transmission between multiple modules within the memory interface controller 100. In order to manage these data transmissions, in a preferred embodiment, the memory interface controller 100 may further include a command processing module 180, and the command processing module 180 is used to control at least one or more of the following by sending commands:

[0038] 1) corresponding to the encryption scenario, controlling the first communication module 110 to transmit the plaintext data received from the external device 200 to the register module 120;

[0039] 2) corresponding to the encryption scenario, controlling the data processing module 140 to transfer the plaintext data stored in the register module 120 to the encryption module 130;

[0040] 3) corresponding to the encryption scenario, controlling the data processing module 140 to transfer the ciphertext data from the cache module 150 to the second communication module 160;

[0041] 4) corresponding to the encryption scenario, controlling the second communication module 160 to transmit the ciphertext data received from the cache module 150 to the memory 300;

[0042] 5) corresponding to the decryption scenario, controlling the second communication module 160 to transmit the ciphertext data received from the memory 300 to the cache module 150;

[0043] 6) corresponding to the decryption scenario, controlling the data processing module 140 to transfer the ciphertext data cached by the cache module 150 to the decryption module 170;

[0044] 7) corresponding to the decryption scenario, controlling the data processing module 140 to transmit the plaintext data decrypted by the decryption module 170 to the register module 120; and

[0045] 8) Controlling the first communication module 110 to transmit the plaintext data stored in the register module 120 to the external device 200 .

[0046] For example, based on the above 1)-8), the command processing module 180 can control the data transmission timing and sequence of the memory interface controller 100 by sending or receiving read and write commands based on the data direction.

[0047] Further, regarding the encryption module 130, it can encrypt the plaintext data by using a preset fixed key, that is, using a fixed key method. However, the fixed key is easy to be cracked to a certain extent, so for the sake of higher security, the embodiment of the present invention further proposes a dynamic key method assisted by the following true random number generation module.

[0048] In a preferred embodiment, the memory interface controller 100 also includes a true random number generation module 190, which is connected to the encryption module 130 and / or the decryption module 170 and is configured to: generate a random number to form a dynamic key string, and send the dynamic key string to the encryption module 130, so that the encryption module 130 encrypts the plaintext data in combination with the dynamic key string; and / or store the dynamic key string generated by encryption for the encryption module 130, and send the dynamic key string to the decryption module 170, so that the decryption module 170 decrypts the ciphertext data in combination with the dynamic key string.

[0049] That is, the true random number generation module 190 implements the above encryption scenario and decryption scenario by generating and storing a dynamic key string.

[0050] For encryption scenarios, the encryption module 130 encrypts the plaintext data in combination with the dynamic key string, including: selecting plaintext data with the same number of bits as the dynamic key string to perform an XOR operation with the dynamic key string, and outputting the initial ciphertext data after the operation; dividing the initial ciphertext data into several groups according to the number of bits, and performing a corresponding S-box (Substitution-box, referred to as S-box, which is the basic structure of the symmetric key algorithm to perform substitution calculation) operation on each group to obtain intermediate ciphertext data; and scrambling the intermediate ciphertext data to obtain the final ciphertext data. Among them, scrambling the intermediate ciphertext data may include: scrambling each bit of the intermediate ciphertext data to another position, and maintaining a one-to-one mapping relationship between each bit of the scrambled data and the corresponding position.

[0051] The logical operations involved in this encryption scenario are described below through examples.

[0052] FIG2 (a) is a logic implementation block diagram of an example encryption process of an embodiment of the present invention. As shown in FIG2 (a), the following processes are included:

[0053] 1) First, a 64-bit random number is generated by the true random number generation module 190, which is used as the key KEY (denoted as i_key) and saved;

[0054] 2) XOR the 64-bit data (denoted as i_data) with the 64-bit key KEY, and output the 64-bit XORed ciphertext data;

[0055] 3) The 64-bit XORed ciphertext data from bit0 to bit63 is divided into 16 groups of 4 bits each. Each group is transformed into a new 64-bit data through a 4-bit S-box (4-input and 4-output, denoted as S);

[0056] 4) After the new 64-bit data bits are scrambled (denoted as P), the final 64-bit ciphertext data (denoted as o_data) is output. The scrambling principle is: each bit is scrambled to other positions, and there is a one-to-one mapping relationship before and after the scrambling.

[0057] For the decryption scenario, the decryption module 170 decrypts the ciphertext data in combination with the dynamic key string, including: descrambling the ciphertext data according to the scrambling rules during the scrambling process to obtain initial plaintext data; performing an S-box inverse operation corresponding to the S-box operation on the initial plaintext data to obtain intermediate plaintext data; and performing an XOR operation on the intermediate plaintext data and the dynamic key string to obtain the final plaintext data.

[0058] The logical operations involved in the decryption scenario will also be described below through examples.

[0059] Continuing from FIG2(a), FIG2(b) is a logic implementation block diagram of an exemplary decryption process of an embodiment of the present invention. As shown in FIG2(b), the process includes the following steps:

[0060] 1) The 64-bit ciphertext data (denoted as i_data) is descrambled according to the scrambling rules (denoted as P -1 ), get 64 bits of data;

[0061] 2) 64-bit data is inversely calculated through 16 sets of 4-bit S-boxes (4 in, 4 out) (denoted as S -1 ) into new 64-bit data;

[0062] 3) XOR the 64-bit data with the 64-bit previously saved key KEY (denoted as i_key), and output the 64-bit XORed plaintext data (denoted as o_data).

[0063] In the examples of Figure 2 (a) and Figure 2 (b), the cache module 150 is SRAM, the data processing module 140 is DataHander, the memory 300 is SD / eMMC memory, and the second communication module 160 is a communication interface adapted to the SD / eMMC memory. In this way, the original data cached in the SRAM is encrypted, handed over to the Data Hander to be sent to the communication interface and then written into the SD / eMMC memory, ensuring that the data in the communication interface and the SD / eMMC memory are safe during the reading and writing process. The encryption and decryption algorithms based on combinational logic design in Figures 2 (a) and 2 (b) can increase the speed of encryption and decryption, reduce the delay of data operations, and at the same time improve the efficiency of data conversion.

[0064] Furthermore, as mentioned above, the external device 200 transmits data to the memory interface controller 100 through the CPU based on a bus, for example. In this scenario, the first communication module 110 can be configured to interact with the external device 200 based on CPU data through a corresponding bus, such as AHB, AXI, etc. However, in this process, the inventor of the present application found that because this process always requires the participation of the CPU, and there is a delay in the CPU when forwarding storage data, the data transfer efficiency from the memory interface controller 100 to the memory 300 is low, which cannot meet the requirements of high-speed memory.

[0065] Accordingly, Figure 3 Schematic diagram of the structure of the memory interface controller in the preferred embodiment of the present invention, the controller realizes efficient data transmission while realizing data encryption and decryption. Figure 1Based on the memory interface controller 100 shown, the preferred memory interface controller 100 is further configured with the first communication module 110 including: a slave unit 111, used for data interaction with the external device 200 in a bus manner; and a host unit 112, used for data interaction with the external device 200 in a DMA (Direct Memory Access) manner.

[0066] DMA is a technology that directly accesses memory without the need for CPU process participation, thus enabling the system to achieve a very high data transfer rate. In a preferred embodiment of the present invention, DMA is added so that data from the external device 200 can be directly moved to the memory interface controller 100, thereby solving the problem that the data transmission speed does not meet the requirements when only the slave unit 111 based on the bus mode is used.

[0067] In addition, the slave unit 111 and the host unit 112 can determine the corresponding module type based on the bus type. For example, when the bus types are AXI (Advanced Extensible Interface) and AHB (Advanced High Performance Bus), the corresponding slave units 111 are AXI slave units and AHB slave units, respectively, and the corresponding host units 112 are AXI host units and AHB host units, respectively.

[0068] In summary, on the one hand, the embodiment of the present invention constructs a data encryption and decryption module, which can realize the encryption and decryption of data communicating with the memory, thereby improving the security of data on the corresponding communication interface (second communication module); on the other hand, it can also increase the DMA transmission mode, thereby improving the data transmission rate and conversion efficiency from the external device to the memory interface controller.

[0069] For the two aspects of the solution, the following is combined Figure 4 Four application examples of the embodiments of the present invention are described below. Figure 4: is a schematic diagram of the structure of an example memory interface controller of an embodiment of the present invention. In the example memory interface controller: the memory 300 is an SD / eMMC memory, and the second communication module 160 is a communication interface adapted to the SD / eMMC memory (denoted as SD I / F, where I / F is the abbreviation of Interface); the slave unit 111 is an AHB Slave, and the host unit 112 is an AHB Master; the register module 120 is a Register File, the data processing module 140 is a Data Hander, the command processing module 180 is a Command Hander, and the cache module 150 is an SRAM; the encryption module 130 is Data Encrypt, the decryption module 170 is Data Decrypt, and the true random number generation module 190 is TRNG. It should be noted that the various English terms involved here are common terms used by technicians in the field of designing memory interface controllers, and their meanings are well known to those skilled in the art.

[0070] In addition, some of the corresponding scenarios in the four application examples are the same, for example, the external device 200 refers to a camera for collecting image data in the field of video surveillance or security. The following is a detailed introduction to these four application examples:

[0071] Application example 1: Using a fixed key method to encrypt data through the CPU and then transmit it to the SD / eMMC storage, as well as the corresponding decryption process.

[0072] refer to Figure 4 , the image data collected by the camera is uploaded to the CPU through the network port or other interfaces, and the CPU forwards the data to the AHB Slave module through the AHB bus. The AHB Slave module hands the data to the Register File module, and the DataHander module then moves the data in the Register File module to the Data Encrypt module. The DataEncrypt module encrypts the data with a fixed key to obtain a ciphertext, and then hands the ciphertext to the SRAM for caching. The Command Hander module controls the Data Hander module to hand the ciphertext cached in the SRAM to the SD I / F module. After receiving the command, the SD I / F module writes the ciphertext data to the SD / eMMC memory according to the eMMC 5.2 standard protocol timing. In this way, the data has become ciphertext since it is encrypted by the Data Encrypt module, so even if the data can be stolen on the data transmission channel, or can be stolen directly from the SD / eMMC memory, the data cannot be decrypted.

[0073] When reading data from the SD / eMMC memory, the Command Hander module controls the SD I / F module to issue a read command and read timing according to the eMMC 5.2 standard protocol, and reads the ciphertext of the SD / eMMC memory to the Data Hander module. The Data Hander module then moves the ciphertext to the Decrypt module. The Decrypt module calculates the ciphertext data with the previous key to decrypt the plaintext data (i.e., the original data). The Data Hander module then passes the data to the Register File module, which then uploads it to the CPU through the AHB Slave module to provide it to external devices that need data.

[0074] In this application example 1, the interface controller of the SD / eMMC memory is designed to address the data security issues of the SD / eMMC memory. The entire SD / eMMC memory communication interface and internal data are encrypted into ciphertext, which can prevent data theft on the transmission channel and data theft in the SD / eMMC memory, ensuring data security and preventing data leakage. In addition, this application example uses a fixed key and uses a bus method to interact with external devices for data, which is the easiest solution to implement.

[0075] Application Example 2: Using a fixed key method to encrypt data and transfer it to the SD / eMMC storage via DMA, as well as the corresponding decryption process.

[0076] refer to Figure 4 The image data collected by the camera is uploaded to the AHBMaster (DMA) module through the network port or other interfaces. The AHB Master module then transfers the data to the Data Hander module through DMA. The DataHander module then transfers the data to the Data Encrypt encryption module. The subsequent process is consistent with the application example 1.

[0077] When reading data, the previous process is consistent with application example 1, but after decrypting the plaintext data, the DataHander module hands the data to the AHB Master (DMA) module, and the AHB Master (DMA) module then moves the data to the interface network port or other interfaces to transmit it to the external device that needs the data.

[0078] Compared with application example 1, application example 2 also uses a fixed key, but uses a DMA method to interact with external devices for data, which improves data transmission speed and efficiency compared to a bus method.

[0079] Application example three: Using dynamic key method to encrypt data through CPU and transmit it to SD / eMMC storage, as well as the corresponding decryption process.

[0080] refer to Figure 4 The previous process is consistent with the application example 1, but after the data reaches the Data Encrypt encryption module, the Data Encrypt encryption module encrypts the data with the dynamic key string generated by the TRNG module to obtain the ciphertext, and then sends the ciphertext to the SRAM for caching. The subsequent process is consistent with the application example 1.

[0081] When reading data, the previous process is consistent with application example 1, but after the ciphertext is transferred to the Decrypt module, the Decrypt module operates the ciphertext data with the dynamic key string previously generated and stored by the TRNG module, decrypts the plaintext data, and continues data transmission similar to application example 1.

[0082] Compared with application example 1, application example 3 introduces a true random number generation scheme, changing from a fixed key encryption and decryption scheme to a dynamic key encryption and decryption scheme. The dynamic key encryption and decryption scheme further ensures the security of data on the SD / eMMC memory interface and in the memory, thereby improving the data security level.

[0083] Application Example 4: Using dynamic key method to encrypt data and transfer it to SD / eMMC storage via DMA, and the corresponding decryption process.

[0084] refer to Figure 4 The image data collected by the camera is uploaded to the AHB Master (DMA) module through the network port or other interfaces. The AHB Master (DMA) module then transfers the data to the Data Hander module through DMA. The Data Handler module then transfers the data to the Data Encrypt module. The Data Encrypt module encrypts the data with the dynamic key string generated by the TRNG module to obtain the ciphertext. The subsequent steps are consistent with the application example 1.

[0085] When reading data, the previous steps are consistent with application example 1, but after the ciphertext is transferred to the Data Decrypt module, the Data Decrypt module calculates the ciphertext data with the previous dynamic key string to decrypt the plaintext data (i.e., original data), and then the Data Hander module hands the data to the AHB Master (DMA) module, which then transfers the data to the interface network port or other interfaces to transmit it to external devices that need data.

[0086] Compared with the first application example, the fourth application example has improved the encryption and decryption method and the data transfer method relative to the external device, thereby having the following two advantages:

[0087] 1) The interface controller of the SD / eMMC memory uses DMA technology to transfer data on the external high-speed interface, which speeds up the data forwarding rate and meets the 400MB / s rate and timing requirements of the SD / eMMC standard protocol version 5.2 standard specification;

[0088] 2) The interface controller of the SD / eMMC memory uses a true random number generation (TRNG) module to generate true random numbers as dynamic keys KEY for use in encryption and decryption algorithms. Each dynamic key (e.g. 64 bits) is used for encryption and decryption operations with each set of changing data (a set of data, e.g. 64 bits), forming a dynamic encryption method, which ensures the security of data on the SD / eMMC memory interface and in the memory, and improves the security level of the data.

[0089] In summary, the above four application examples realize a secure (and efficient) read-write communication interface controller for SD / eMMC memory, which encrypts the data at the source (even dynamically), ensures the security of the external transmission channel and internal original data in the SD / eMMC memory, prevents data interception on the transmission channel or direct reading of the original data in the SD / eMMC memory, and has important significance for data security issues in application solutions using SD / eMMC memory in the fields of industrial control, consumer electronics, and automotive electronics. In addition, the interface controllers of the above four application examples realize the communication and read-write control of SD / eMMC memory by the eMMC 5.2 standard protocol through modules such as AHB Slave module, AHB Master (DMA) module, Data Hander module, Register File module, Command Hander module, and SD I / F module.

[0090] Another embodiment of the present invention further provides a memory, which is configured with the memory interface controller described in any of the above embodiments. For example, the memory is the SD / eMMC memory mentioned in the above application example. The advantages of the memory are consistent with the memory interface controller described in the above embodiment, and will not be repeated here.

[0091] Another embodiment of the present invention provides a device, which includes the memory configured with the memory interface controller described in any of the above embodiments. For example, the device can be a device that uses the application solution of the memory in the industrial control field, consumer electronics field, automotive electronics field, etc.

[0092] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.

[0093] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0094] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0095] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0096] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0097] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0098] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0099] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0100] The above are only embodiments of the present application and are not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application should be included within the scope of the claims of the present application.

Claims

1. A memory interface controller adapted for memory configuration, characterized in that: The memory interface controller includes a first communication module, a register module, an encryption module, a data processing module and a second communication module, wherein: The first communication module is used to receive plaintext data transmitted by the external device of the memory interface controller, and transmit the received plaintext data to the register module for storage, and the first communication module includes: a slave unit, used to perform data interaction with the external device in a bus mode; and a host unit, used to perform data interaction with the external device in a direct memory access DMA mode; The encryption module is used to encrypt the plaintext data stored in the register module to obtain corresponding ciphertext data; The data processing module is used to transfer the plaintext data stored in the register module to the encryption module for encryption, and transfer the ciphertext data obtained by the encryption module to the second communication module; The second communication module is used to transmit the received ciphertext data to the memory corresponding to the memory interface controller.

2. The memory interface controller according to claim 1, wherein: The memory interface controller further includes a cache module and a decryption module adapted to the encryption module, and: The second communication module is further used to receive ciphertext data transmitted by the memory corresponding to the memory interface controller, and transmit the received ciphertext data to the cache module for caching; The decryption module is used to decrypt the ciphertext data stored in the cache module to obtain corresponding plaintext data; The data processing module is further used to transfer the ciphertext data from the cache module to the decryption module, and to transmit the plaintext data decrypted by the decryption module to the register module for storage; and The first communication module is further used to transmit the plaintext data stored in the register module to an external device of the memory interface controller; The cache module is further used to cache the ciphertext data obtained by the encryption module, so that the data processing module can transfer the ciphertext data obtained by the encryption module and cached in the cache module to the second communication module.

3. The memory interface controller according to claim 2, wherein: The memory interface controller further includes a command processing module, and the command processing module is used to control at least one or more of the following by sending commands: Controlling the first communication module to transmit the plaintext data received from the external device to the register module; Controlling the data processing module to transfer the plaintext data stored in the register module to the encryption module; Controlling the data processing module to transfer the ciphertext data from the cache module to the second communication module; Control the second communication module to transmit the ciphertext data received from the cache module to the memory; Control the second communication module to transmit the ciphertext data received from the memory to the cache module; Controlling the data processing module to transfer the ciphertext data cached by the cache module to the decryption module; Controlling the data processing module to transmit the plaintext data decrypted by the decryption module to the register module; as well as The first communication module is controlled to transmit the plaintext data stored in the register module to the external device.

4. The memory interface controller according to claim 2, wherein: The memory interface controller further includes a true random number generation module, which is connected to the encryption module and / or the decryption module and is configured to: Generate a random number to form a dynamic key string, and send the dynamic key string to the encryption module, so that the encryption module encrypts the plaintext data in combination with the dynamic key string; and / or The dynamic key string generated by encrypting the encryption module is stored, and the dynamic key string is sent to the decryption module, so that the decryption module decrypts the ciphertext data in combination with the dynamic key string.

5. The memory interface controller according to claim 4, wherein: The encryption module encrypts the plaintext data in combination with the dynamic key string, including: Select plaintext data with the same number of bits as the dynamic key string to perform an XOR operation with the dynamic key string, and output the initial ciphertext data after the operation; Dividing the initial ciphertext data into several groups according to the number of bits, and performing corresponding S-box operations on each group to obtain intermediate ciphertext data; and The intermediate ciphertext data is scrambled to obtain final ciphertext data.

6. The memory interface controller according to claim 5, wherein: The scrambling of the intermediate ciphertext data comprises: Each bit of the intermediate ciphertext data is scrambled to another position, and each bit of the scrambled data is kept in a one-to-one mapping relationship with the corresponding position.

7. The memory interface controller according to claim 5, wherein: The decryption module decrypts the ciphertext data in combination with the dynamic key string, including: Descrambling the ciphertext data according to the scrambling rule during the scrambling process to obtain initial plaintext data; Performing an S-box inverse operation corresponding to the S-box operation on the initial plaintext data to obtain intermediate plaintext data; and An XOR operation is performed on the intermediate plaintext data and the dynamic key string to obtain final plaintext data.

8. The memory interface controller according to claim 2, wherein: The memory is a secure digital memory card SD memory or an embedded multimedia card eMMC memory, and the second communication module transmits or receives ciphertext data to the SD memory or the eMMC memory based on the eMMC 5.2 standard protocol.

9. A memory, characterized in that: The memory is configured with the memory interface controller as claimed in any one of claims 1 to 8.

Images