Key generation method, device, system on chip, equipment and storage medium

Abstract

The embodiments of the present application disclose a key generation method, apparatus, system on chip, device and storage medium, belonging to the field of chip technology. The method comprises: in the i-th operation stage of the system on chip startup process, based on the first secret value derivation factor corresponding to the i-1-th operation stage and the second secret value derivation factor corresponding to the i+1-th operation stage, generating the i-th secret value corresponding to the i-th operation stage, where i is a positive integer; based on the i-th secret value, generating the i-th key corresponding to the i-th operation stage, the i-th key is used to protect the data in the i-th operation stage. The solution provided by the embodiments of the present application is adopted to realize the protection of key secrets between different operation stages, and if any problem occurs in any operation stage, it will not cause the key secrets in other software stages to be attacked, thereby ensuring the flexibility and security of key deployment.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of chip technology, and in particular to a key generation method, apparatus, system on chip, device, and storage medium. Background Art

[0002] With the widespread application of SoC (System on Chip) in the electronics field, the security of SoC systems has received increasing attention.

[0003] Related technologies usually protect key secrets on SoCs through access control based on hardware signals such as master device identification and security attributes. However, since different software stages with the same security attributes on the same master device have the same access rights to resources, problems in any software stage will cause the secrets of other software stages to be attacked.

[0004] Therefore, it is particularly important to improve the security of SoC systems. Summary of the Invention

[0005] The present invention provides a method, apparatus, system-on-chip, device, and storage medium for generating a key. The technical solution is as follows:

[0006] In one aspect, an embodiment of the present application provides a key generation method, the method comprising:

[0007] In an i-th operation phase of a system-on-chip startup process, generating an i-th secret value corresponding to the i-th operation phase based on a first secret value derivation factor corresponding to an i-1-th operation phase and a second secret value derivation factor corresponding to an i+1-th operation phase, where i is a positive integer;

[0008] An i-th key corresponding to the i-th running stage is generated based on the i-th secret value, and the i-th key is used to protect data in the i-th running stage.

[0009] On the other hand, an embodiment of the present application provides a key generation device, the device comprising:

[0010] a secret value generation module configured to generate, during an i-th running phase of a system-on-chip startup process, an i-th secret value corresponding to the i-th running phase based on a first secret value derivation factor corresponding to the i-1-th running phase and a second secret value derivation factor corresponding to the i+1-th running phase, where i is a positive integer;

[0011] A key generation module is used to generate an i-th key corresponding to the i-th operation stage based on the i-th secret value, and the i-th key is used to protect data in the i-th operation stage.

[0012] On the other hand, an embodiment of the present application provides a system on chip, which includes at least one master device, and at least one master device is connected to each other via a bus, and the system on chip is used to implement the key generation method described in the above aspects.

[0013] On the other hand, an embodiment of the present application provides a computer device, in which the system on chip described in the above aspects is provided.

[0014] On the other hand, an embodiment of the present application provides a computer-readable storage medium, which stores at least one program, and the at least one program is loaded and executed by a processor to implement the key generation method as described in the above aspects.

[0015] On the other hand, an embodiment of the present application provides a computer program product, which includes computer instructions, and the computer instructions are stored in a computer-readable storage medium; a processor reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the terminal device executes the key generation method described in the above aspect.

[0016] The technical solutions provided in the embodiments of the present application can bring the following beneficial effects:

[0017] In an embodiment of the present application, in the i-th operating stage of the SoC startup process, the main device generates an i-th secret value corresponding to the i-th operating stage based on the first secret value derivation factor corresponding to the i-1-th operating stage and the second secret value derivation factor corresponding to the i+1-th operating stage, and then generates an i-th key corresponding to the i-th operating stage based on the i-th secret value, so that the i-th key can be used to protect the data in the i-th operating stage subsequently; using the solution provided by the embodiment of the present application, the keys between different operating stages are isolated from each other and are associated. Even if there is a vulnerability in a certain operating stage, it will not cause the key secrets in other operating stages to be attacked, which effectively improves the security of the encrypted data and solves the problem of the short board effect of the overall security. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0019] Figure 1 A schematic structural diagram of a SoC provided by an exemplary embodiment of the present application is shown;

[0020] Figure 2A schematic structural diagram of a SoC provided by an exemplary embodiment of the present application is shown;

[0021] Figure 3 A flowchart of a key generation method provided by an exemplary embodiment of the present application is shown;

[0022] Figure 4 A flowchart of a key generation method provided by another exemplary embodiment of the present application is shown;

[0023] Figure 5 A schematic diagram illustrating an implementation of a key generation method provided by an exemplary embodiment of the present application is shown;

[0024] Figure 6 A schematic diagram illustrating an implementation of a key generation method provided by another exemplary embodiment of the present application is shown;

[0025] Figure 7 A schematic diagram illustrating an implementation of a data encryption process provided by an exemplary embodiment of the present application is shown;

[0026] Figure 8 A schematic diagram illustrating an implementation of a data encryption process provided by another exemplary embodiment of the present application is shown;

[0027] Figure 9 A schematic structural diagram of a key generation device provided by an exemplary embodiment of the present application is shown. DETAILED DESCRIPTION

[0028] In order to make the objectives, technical solutions and advantages of this application clearer, the implementation methods of this application will be further described in detail below with reference to the accompanying drawings.

[0029] In related technologies, the protection of key secrets on SoCs is usually based on access control based on hardware signals such as the master device identification and security attributes. The hardware signals such as the master device identification and security attributes of each access request are first determined, and then a permission check is performed on the access to software and hardware resources to arbitrate whether the request has permission to access.

[0030] As SoC designs become increasingly complex, and the main devices on an SoC often run multiple layers with the same security attributes, they are typically divided into several operational stages, each running different software code. However, because these stages share the same security attributes, secret information exclusive to one stage can lead to unnecessary access to other stages, increasing the attack surface and exposing weaknesses in the overall security level.

[0031] In addition, for each request for the same security attribute on the same master device, the arbitration logic assumes that different operating stages with the same security attribute on the same master device have the same access rights to resources. Therefore, if any of the operating stages has a vulnerability or is compromised, the secrets of other operating stages may also be attacked.

[0032] Moreover, because there is no comprehensive solution combining software and hardware, even if patches are applied during the runtime phase, there is no guarantee that certain key secrets can only be accessed during specific software phases, making it difficult to achieve isolation and layered protection of key secrets between different runtime phases.

[0033] In view of this, in an embodiment of the present application, in the i-th operating stage of the SoC startup process, the main device generates an i-th secret value corresponding to the i-th operating stage based on the first secret value derivation factor corresponding to the i-1-th operating stage and the second secret value derivation factor corresponding to the i+1-th operating stage, and then generates an i-th key corresponding to the i-th operating stage based on the i-th secret value. The i-th key is used to protect data in the i-th operating stage, thereby realizing the mutual isolation of keys between different operating stages. Even if there is a vulnerability in a software stage, it will not cause the key secrets in other software stages to be attacked, effectively improving the security of encrypted data and solving the problem of the short board effect of overall security.

[0034] like Figure 1 FIG. 1 shows a schematic diagram of a system on chip (SoC) according to an exemplary embodiment of the present invention. The SoC 100 includes a host device 101 , a bus 102 , and a memory controller 103 .

[0035] The master device 101 is connected to the memory controller 103 via a bus 102, and the master devices 101 can communicate with each other via the bus 102. The memory controller 103 is connected to the memory via a physical layer interface. In some embodiments, the memory is a dynamic random access memory (DRAM).

[0036] The main device 101 is a processor or non-processor with data reading and writing needs. The processor can integrate one or a combination of a central processing unit (CPU), a graphics processing unit (GPU), a neural network processing unit (NPU), and a baseband chip. Among them, the CPU mainly processes the operating system, user interface, and application programs; the GPU is responsible for rendering and drawing the content to be displayed on the display; the NPU is used to implement AI functions; and the baseband chip is used to handle wireless communication.

[0037] Among them, the processor uses various interfaces and lines to connect various parts within the entire computer device, and performs various functions of the terminal and processes data by running or executing instructions, programs, code sets or instruction sets stored in the memory, and calling data stored in the memory.

[0038] In some embodiments, the processor may be implemented in at least one hardware form of digital signal processing (DSP), field-programmable gate array (FPGA), or programmable logic array (PLA).

[0039] Figure 1 The processor is schematically illustrated as including a central processing unit (CPU), a graphics processing unit (GPU), and a coprocessor (Coprocessor), but this is not intended to be limiting.

[0040] In some embodiments, a link using the AXI protocol is established between the master device 101 and the bus 102. Figure 1 As shown, four AXI links with a bit width of 256 bits are established between each master device 101 and the bus 102.

[0041] The memory controller 103 is a device for controlling access to data in the memory, and has functions such as address conversion and memory channel selection.

[0042] Figure 1 Take the case where the system on chip does not include a memory (ie, the memory is set outside the system on chip) as an example for explanation. In other possible designs, such as Figure 2 As shown, the memory 104 may be integrated on the system on chip 100 , that is, disposed inside the system on chip.

[0043] The memory 104 may include one or a combination of read-only memory (ROM), random access memory (RAM), and flash memory (Flash).

[0044] Please refer to Figure 3 , which shows a flowchart of a key generation method provided by an exemplary embodiment of the present application. This embodiment uses this method for Figure 1 Taking the SoC shown in FIG. 1 as an example, the method may include the following steps:

[0045] Step 301, in the i-th running stage of the on-chip system startup process, based on the first secret value derivation factor corresponding to the i-1-th running stage and the second secret value derivation factor corresponding to the i+1-th running stage, generate the i-th secret value corresponding to the i-th running stage, where i is a positive integer.

[0046] In one possible implementation, in the i-th operation stage of the SoC startup process, the main device obtains the first secret value derivation factor corresponding to the i-1-th operation stage, and obtains the second secret value derivation factor corresponding to the i+1-th operation stage, and then generates the i-th secret value corresponding to the i-th operation stage based on the first secret value derivation factor corresponding to the i-1-th operation stage and the second secret value derivation factor corresponding to the i+1-th operation stage.

[0047] Optionally, after the master device obtains the first secret value derivation factor and the second secret value derivation factor, it derives the secret value of the current operation stage through a key derivation function (KDF).

[0048] Optionally, the first secret value derivation factor and the second secret value derivation factor of each running stage are unique to the running stage. Therefore, the secret value of the running stage derived by the key derivation function is also unique to the running stage.

[0049] Step 302: Generate an i-th key corresponding to the i-th running stage based on the i-th secret value, where the i-th key is used to protect data in the i-th running stage.

[0050] In a possible implementation, the master device generates a key corresponding to the running phase based on the secret value, and uses the key to encrypt the plaintext data of the running phase, thereby protecting the data.

[0051] Optionally, the key can be at least one of a symmetric key and an asymmetric key. When using symmetric key encryption, the sender and receiver of the information use the same key to encrypt and decrypt data. Symmetric key encryption / decryption is fast and suitable for encrypting large amounts of data. Asymmetric key encryption, also known as public key encryption, provides a very secure method for encrypting and decrypting data. It uses a pair of keys, a public key and a private key. The private key can only be kept securely by one party and cannot be leaked, while the public key can be sent to any device that requests it. Asymmetric key encryption uses one of the keys for encryption, while decryption requires the other key.

[0052] Therefore, when the amount of data is large, the data can be encrypted using a symmetric key. When the data requires higher security, the data can be signed using an asymmetric key. Alternatively, both symmetric and asymmetric keys can be used to ensure both processing speed and security.

[0053] To sum up, in the embodiment of the present application, in each operating stage of the SoC startup process, the main device generates a secret value corresponding to the current operating stage based on the first secret value derivation factor of the previous operating stage of the current operating stage and the second secret value derivation factor of the next operating stage, and then generates a key corresponding to the current operating stage based on the secret value, so that the key can be used to protect the data in the current operating stage subsequently; using the scheme provided by the embodiment of the present application, since the key can only be generated in the current operating stage, the data encrypted with the key can only be correctly decrypted in the current operating stage, thereby achieving mutual isolation and correlation between the keys of different operating stages, ensuring the protection of key secrets between different operating stages, even if there is a vulnerability in a software stage, it will not cause the key secrets in other software stages to be attacked, effectively improving the security of encrypted data and solving the problem of the short board effect of overall security.

[0054] In one possible implementation, when the master device generates the secret value corresponding to the current operating stage, it uses the secret value generated in the previous operating stage as the first secret value derivation factor, and the summary value of the next operating stage as the second secret value derivation factor, and then derives the secret value of the current operating stage through a key derivation function.

[0055] Please refer to Figure 4 , which shows a flowchart of a key generation method provided by an exemplary embodiment of the present application. This embodiment uses this method for Figure 1 Taking the SoC shown in FIG. 1 as an example, the method may include the following steps:

[0056] Step 401: Obtain the (i-1)th secret value corresponding to the (i-1)th running stage, and obtain the (i+1)th digest value corresponding to the (i+1)th running stage.

[0057] In a possible implementation, in the i-th running phase of the SoC startup process, the master device obtains the i-1th secret value corresponding to the i-1th running phase, and obtains the i+1th digest value corresponding to the i+1th running phase.

[0058] Optionally, the summary value is related to the software code corresponding to the running stage. The i+1th summary value corresponding to the i+1th running stage is related to the software code run in the i+1th running stage. Since the software codes run in different running stages are different, the summary values ​​corresponding to different running stages are different.

[0059] Schematically, after the SoC is powered on, it includes the following operating stages: the main device usually runs the system startup code (BootROM) first, and then after the boot loader (BootLoader) is executed, the operating system (OS) is loaded from a certain firmware (Firmware) into the memory for execution. In these multiple different operating stages, the running software code is different, and the corresponding summary value is different.

[0060] Optionally, different running stages belong to the same main device or different main devices on the SoC. For example, different running stages all belong to the CPU. Of course, different running stages can also belong to different main devices on the SoC. For example, some running stages belong to the coprocessor and some running stages belong to the CPU.

[0061] Of course, the startup process of the SoC has multiple operating stages, and the embodiments of the present application do not limit the specific operating stages.

[0062] In an embodiment of the present application, in each operation stage during the SoC startup process, the main device on the SoC will obtain the secret value of the previous operation stage and the summary value of the next operation stage, that is, in the i-th operation stage during the SoC startup process, the i-1th secret value corresponding to the i-1th operation stage is obtained, and the i+1th summary value corresponding to the i+1th operation stage is obtained.

[0063] Step 402: Generate an i-th secret value corresponding to the i-th running stage based on the i-1-th secret value and the i+1-th digest value.

[0064] In one possible implementation, after obtaining the secret value of the previous operating stage and the summary value of the next operating stage, the master device uses the secret value of the previous operating stage as the first secret value derivation factor and the summary value of the next operating stage as the second secret value derivation factor to derive the secret value of the current operating stage through a key derivation function.

[0065] Since the secret value and digest value of each running stage are unique to the running stage, the secret value of the running stage derived by the key derivation function is also unique to the running stage.

[0066] Step 403: Generate an i-th key corresponding to the i-th running stage based on the i-th secret value, where the i-th key is used to protect data in the i-th running stage.

[0067] The implementation of this step can refer to the above-mentioned step 302, and will not be described in detail in this embodiment.

[0068] In an embodiment of the present application, in each operating stage of the SoC startup process, the main device obtains the secret value of the previous operating stage of the current operating stage, and after obtaining the summary value corresponding to the next operating stage, the secret value of the previous operating stage is used as the first secret value derivation factor, and the summary value of the next operating stage is used as the second secret value derivation factor. The secret value unique to the current operating stage is derived through the key derivation function, thereby realizing the mutual isolation of keys between different operating stages, ensuring the protection of key secrets between different operating stages, effectively improving the security of encrypted data, and solving the problem of the short board effect of overall security.

[0069] In a possible implementation, with respect to step 401 , at different operation stages of the SoC startup process, the master device obtains the secret value of the previous operation stage in different ways.

[0070] Optionally, during the first operational phase of the SoC boot process, the master device obtains the zeroth secret value from a hardware root of trust. A root of trust is a source that can always be trusted in a key system. Because data security relies on keys that encrypt and decrypt data and perform functions such as generating and verifying digital signatures, the root of trust typically includes a hardware module, which can be called a hardware root of trust.

[0071] Optionally, the hardware root of trust is a one-time programmable memory (OTP), which can be an electric fuse (EFUSE), a programmable read-only memory (PROM), etc. The embodiments of the present application do not limit the specific type of one-time programmable memory.

[0072] Optionally, after the SoC is powered on, the master device usually runs the system startup code (BootROM) first, and uses this stage as the first running stage in the SoC startup process. In this running stage, the master device obtains the unique device secret value of the SoC from the hardware trust root.

[0073] It should be noted that in most SoCs, the hardware root of trust is only accessible to hardware, and the unique device secret value of the SoC can only be obtained in the first operating stage, that is, in the BootROM.

[0074] In one possible implementation, in the i-th running phase of the SoC startup process, when i=1, that is, in the first running phase of the SoC startup process, the master device obtains the zeroth secret value from the OTP, and the zeroth secret value is the unique device secret value (Hardware Unique Key, HUK) of the SoC.

[0075] In another possible implementation, the unique device secret value is the hardware root of trust of the entire key hierarchy system. To increase security and uniqueness, it can be designed as a result value derived from multiple fields in the OTP or obtained through logical operations.

[0076] Optionally, an encryption algorithm may be used in advance to calculate the HUK and HBK (HASH of Boot Key, a hash value of the boot signature verification public key) to obtain a unique device secret value.

[0077] Optionally, in the jth running phase of the SoC startup process, the master device obtains the j-1th secret value input in the j-1th running phase, and the j-1th secret value is generated in the j-1th running phase, where j is an integer greater than or equal to 2.

[0078] In one possible implementation, in the i-th running stage of the SoC startup process, when i≥2, that is, in the j-th running stage of the SoC startup process, the j-1-th secret value passed in the j-1-th running stage is obtained, and the j-1-th secret value is generated in the j-1-th running stage, where j is an integer greater than or equal to 2.

[0079] Similarly, in one possible implementation, with respect to step 401, during the i-th operation phase of the SoC startup process, the master device loads the i+1th software image corresponding to the i+1th operation phase, and determines the digest value of the i+1th software image as the i+1th digest value. Of course, the embodiments of the present application support not only executable software images at startup, but also non-executable images such as configuration files, and images dynamically loaded during runtime.

[0080] In one possible implementation, the software image is stored in a flash memory (Flash). During each operation phase of the SoC boot process, the master device loads the software image corresponding to the current operation phase from the Flash. Flash is a form of electronically erasable programmable read-only memory that allows it to be erased or written multiple times during operation.

[0081] In an embodiment of the present application, the master device determines the digest value of the software image in the next running stage as the digest value of the next running stage. In one possible implementation, the master device performs a security check on the (i+1)th software image based on the image signature of the (i+1)th software image, where the security check is used to verify whether the software image has been tampered with.

[0082] If the digest value of the software image is directly used as the digest value obtained by the master device, once the digest value of the software image is attacked and becomes incomplete or tampered with, the secret value derived by the master device after obtaining the digest value will also be incorrect, and the data will not be protected. Therefore, in the embodiment of the present application, the digest value of the software image is pre-encrypted by the private key, and the encrypted ciphertext is obtained, which is called the image signature. The image signature and the software image are stored together in the flash memory.

[0083] Optionally, the master device obtains a digest value of the next-stage software image, which serves as the encrypted image signature, and then decrypts the digest value using the public key to obtain a decrypted first digest value. Simultaneously, the master device performs a digest calculation on the obtained next-stage software image to obtain a second digest value. By comparing the first and second digest values, the master device determines whether the software image has been tampered with.

[0084] Optionally, since the private key used to encrypt the digest values ​​of software images in different running stages is the same, the public key used to decrypt the signatures of images in different running stages should also be the same. Therefore, the master device can also use the same HBK to verify the public keys of image signatures in different running stages, that is, the HBK can be pre-burned in the SoC. If the HBK cannot use the hash value to obtain the verification public key, it can be determined that the public key of the running stage has been tampered with.

[0085] Further, when the (i+1)th software image passes the security check, the digest value of the (i+1)th software image is determined as the (i+1)th digest value.

[0086] In the embodiment of the present application, when the image signature passes the security check, the master device determines the summary value of the software image as the summary value of the running stage.

[0087] Indicative, such as Figure 5 As shown, after the SoC is powered on, the master device usually runs the system startup code (BootROM) first, and uses this stage as the first operation stage in the SoC startup process. In this operation stage, the master device obtains the unique device secret value of the SoC from the one-time programmable memory. In addition, starting from the second operation stage of the SoC startup process, the master device obtains the secret value passed in from the previous operation stage of the current operation stage, and the secret value is generated in the previous operation stage. At the same time, the master device loads the software image corresponding to the next operation stage of the current operation stage, and determines the digest value of the software image as the digest value corresponding to the next operation stage. The master device uses the secret value and the digest value as factors to derive the secret value of the current operation stage through the key derivation function, and then derives the key of the current operation stage based on the secret value.

[0088] In an embodiment of the present application, in the first operating stage, the master device obtains the unique device secret value of the SoC from the hardware trust root, and signs and verifies the image digest in each operating stage, thereby ensuring the security of the secret value derived in any operating stage and forming a trusted chain structure to ensure the security of encrypted data.

[0089] In one possible implementation, at least two parallel execution operation stages may appear after a certain operation stage of the SoC startup process. Therefore, when the i-th operation stage corresponds to at least two parallel execution (i+1)-th operation stages, the master device obtains the i+1-th digest value corresponding to each of the at least two (i+1)-th operation stages, and generates at least two (i-1)-th secret values ​​corresponding to the i-th operation stage based on the (i-1)-th secret value and at least two (i+1)-th digest values.

[0090] During a certain operation phase of the SoC startup process, there may be at least two software images (such as virtual machines). At this time, the two software images are in parallel. Therefore, the previous operation phase of this operation phase will obtain at least two image digest values, and then derive at least two secret values.

[0091] Indicative, such as Figure 6 As shown, after the second operation phase of the SoC boot process, two parallel executions of the third operation phase a and the third operation phase b occur. Therefore, in the second operation phase, the master device obtains the secret value passed in during the first operation phase and the digest values ​​of the software images corresponding to the third operation phase a and the third operation phase b, respectively. The master device uses the secret value of the first operation phase and the digest values ​​of the third operation phase a and the digest values ​​of the third operation phase b as factors, and derives two secret values ​​for the second operation phase through a key derivation function. The key for the second operation phase is then derived based on these two secret values. Similarly, in the third operation phase of the SoC boot process, the master device obtains the two secret values ​​passed in during the second operation phase and the digest value of the software image corresponding to the fourth operation phase. The master device uses the two secret values ​​of the second operation phase and the digest value of the fourth operation phase as factors, and derives two secret values ​​for the third operation phase through a key derivation function. The key for the third operation phase is then derived based on these two secret values.

[0092] In this embodiment, except for the first operation stage, the subsequent software stages support multiple stages in parallel. Although the link is bifurcated, the chain relationship of the single path still holds, ensuring the flexibility and security of key deployment.

[0093] In one possible implementation, if the software code is updated, the software image is also updated, so the summary value of the software image is also updated. Therefore, when the software code is updated, the master device updates the secret value corresponding to the running stage, and updates the key corresponding to the running stage based on the updated secret value.

[0094] Optionally, when the software code is updated, it can be updated in whole or in part. When the software code is updated in whole, the master device will update the secret value of each running stage during the SoC startup process.

[0095] Optionally, when a software code portion is updated, that is, when the software code corresponding to the i-th operation stage is updated, the master device updates the secret value corresponding to the target operation stage. The target operation stage includes the i-1-th operation stage, the i-th operation stage, and the downstream operation stage of the i-th operation stage, where the downstream operation stage is located after the i-th operation stage and is located in the same operation link as the i-th operation stage.

[0096] At this time, since only part of the software code is updated, the software image of the corresponding running stage is updated, which causes the secret value of the previous running stage of the corresponding running stage to be updated, and then causes the secret value of the corresponding running stage and its downstream running stage to be updated.

[0097] Illustratively, if the software code corresponding to the third operating stage is updated, the software image of the third operating stage is updated, so the summary value of the software image is also updated. After the summary value of the software image of the third operating stage is updated, the second operating stage uses the summary value of the updated software image and the secret value of the first operating stage as factors to derive a new secret value of the second operating stage through a key derivation function. After the secret value of the second operating stage is updated, the third operating stage uses the summary value of the software image of the fourth operating stage and the updated secret value of the second operating stage as factors to derive a new secret value of the third operating stage through a key derivation function. The same is true for subsequent operating stages.

[0098] In this embodiment, when the software code is updated, the software image of the corresponding running stage of the SoC startup process is updated, so that the summary value is updated, which in turn causes the secret values ​​of the previous running stage of the corresponding running stage, the corresponding running stage and its downstream running stage to be updated, so that after the software code is updated, the main device can derive the updated key and protect the data through the updated key.

[0099] There are two possible ways to encrypt data. The master device can directly encrypt the plaintext data using the key derived during the run phase, or it can first encrypt the plaintext data using a plaintext key and then encrypt the plaintext key using the key derived during the run phase.

[0100] In one possible implementation, the i-th key is used to encrypt the plaintext data in the i-th operating stage to obtain ciphertext data, the main device decrypts the ciphertext data based on the i-th key before the update to obtain plaintext data, and then encrypts the plaintext data based on the i-th key after the update to obtain ciphertext data.

[0101] In this embodiment, the main device directly encrypts the plaintext data using the key derived during the operation phase to obtain the ciphertext data. After the software code is updated, the ciphertext data is first decrypted using the key before the operation phase is updated to obtain the plaintext data. After that, the plaintext data is re-encrypted using the key after the operation phase is updated.

[0102] Indicative, such as Figure 7 As shown, the main device encrypts the plaintext data 710 of the current running stage through the first key 720 derived from the current running stage to obtain the first ciphertext data 730. After the software code corresponding to the current running stage is updated, the main device first decrypts the first ciphertext data 730 based on the first key 720 before the current running stage is updated, and after obtaining the plaintext data 710, the main device re-encrypts the plaintext data 710 based on the updated second key 740 to obtain the updated second ciphertext data 750.

[0103] In this embodiment, when the software code corresponding to the current running stage is updated, the master device can update the summary value of the software image, thereby updating the key derived from the current running stage, and re-encrypt the data based on the updated key.

[0104] In another possible implementation, the i-th key is used to encrypt the plaintext key corresponding to the i-th operating stage to obtain the ciphertext key, and the plaintext key is used to encrypt the plaintext data in the i-th operating stage to obtain the ciphertext data.

[0105] When the key derived in the current running stage is a symmetric key, in order to reduce the workload of the symmetric key in the plaintext data of the current running stage, the embodiment of the present application adopts the idea of ​​encapsulating the key and encrypting another key (Key Encryption Key, KEK) with the key. First, a plaintext key is adopted, which is the encapsulation key (Wrap Key). The main device encrypts the plaintext data of the current running stage with the plaintext key to obtain ciphertext data, and then encrypts the plaintext key with the symmetric key derived in the current software stage to obtain the ciphertext key.

[0106] Optionally, the master device decrypts the ciphertext key based on the i-th key before the update to obtain a plaintext key, and then encrypts the plaintext key based on the i-th key after the update to obtain a ciphertext key.

[0107] Indicative, such as Figure 8 As shown, the main device encrypts the plaintext data 810 of the current running stage through the plaintext key 820 to obtain the ciphertext data 830, and then encrypts the plaintext key 820 through the first key 840 derived from the current running stage to obtain the first ciphertext key 850. After the software code corresponding to the current running stage is updated, the main device first decrypts the first ciphertext key 850 based on the first key 840 before the current running stage is updated, and after obtaining the plaintext key 820, the main device re-encrypts the plaintext key 820 based on the updated second key 860 to obtain the updated second ciphertext key 870.

[0108] In the embodiments of the present application, the reconstruction of the key hierarchy link after a software upgrade can be based on the KEK concept, requiring only encryption and decryption of the plaintext key. That is, the master device only needs to encrypt and decrypt the Wrap Key, eliminating the need to decrypt and re-encrypt the plaintext data at each software stage. This reduces the workload of the master device while improving the security of data encryption. Furthermore, the embodiments of the present application can flexibly implement remote key deployment and management, such as key deployment, key updates, and key revocation, through online upgrades, enhancing the flexibility of key management.

[0109] In the embodiments of the present application, at each operation stage of the SoC, the key management algorithm, mode, key length, etc. can be customized in advance according to user needs through the methods provided in the above embodiments.

[0110] Please refer to Figure 9 , which shows a schematic diagram of the structure of a key generation device provided by an exemplary embodiment of the present application. The key generation device includes:

[0111] a secret value generation module 910 for generating, during an i-th running stage of a system-on-chip startup process, an i-th secret value corresponding to the i-th running stage based on a first secret value derivation factor corresponding to the i-1-th running stage and a second secret value derivation factor corresponding to the i+1-th running stage, where i is a positive integer;

[0112] The key generation module 920 is used to generate an i-th key corresponding to the i-th operation stage based on the i-th secret value, and the i-th key is used to protect data in the i-th operation stage.

[0113] Optionally, the secret value generation module 910 is configured to:

[0114] Obtaining the (i-1)th secret value corresponding to the (i-1)th running stage, and obtaining the (i+1)th digest value corresponding to the (i+1)th running stage;

[0115] The i-th secret value corresponding to the i-th running stage is generated based on the i-1-th secret value and the i+1-th digest value.

[0116] Optionally, the secret value generation module 910 is configured to:

[0117] During a first operational phase of a system-on-chip boot process, obtaining a zeroth secret value from a hardware root of trust;

[0118] In the jth running phase of the system-on-chip startup process, the j-1th secret value input in the j-1th running phase is obtained, the j-1th secret value is generated in the j-1th running phase, and j is an integer greater than or equal to 2.

[0119] Optionally, the zeroth secret value is a unique device secret value of the system on chip.

[0120] Optionally, the secret value generation module 910 is configured to:

[0121] Loading the (i+1)th software image corresponding to the (i+1)th running stage;

[0122] The digest value of the (i+1)th software image is determined as the (i+1)th digest value.

[0123] Optionally, the secret value generation module 910 is specifically configured to:

[0124] Based on the image signature of the (i+1)th software image, performing a security check on the (i+1)th software image, the security check being used to verify whether the software image has been tampered with;

[0125] In a case where the (i+1)th software image passes the security verification, the digest value of the (i+1)th software image is determined as the (i+1)th digest value.

[0126] Optionally, the secret value generation module 910 is specifically configured to:

[0127] In a case where the i-th running stage corresponds to at least two i+1-th running stages executed in parallel, obtaining the i+1-th digest value corresponding to each of the at least two i+1-th running stages;

[0128] The generating, based on the (i-1)th secret value and the (i+1)th digest value, the i-th secret value corresponding to the i-th running stage includes:

[0129] At least two i-th secret values ​​corresponding to the i-th running stage are generated based on the i-1-th secret value and the at least two i+1-th digest values.

[0130] Optionally, the device further includes:

[0131] A secret value update module, used to update the secret value corresponding to the running stage when the software code is updated;

[0132] The key update module is used to update the key corresponding to the running stage based on the updated secret value.

[0133] Optionally, the secret value updating module is used to:

[0134] When the software code corresponding to the i-th running stage is updated, the secret value corresponding to the target running stage is updated, and the target running stage includes the i-1-th running stage, the i-th running stage, and the downstream running stage of the i-th running stage. The downstream running stage is located after the i-th running stage and is located in the same running link as the i-th running stage.

[0135] Optionally, the i-th key is used to encrypt the plaintext data in the i-th running stage to obtain ciphertext data;

[0136] The device further comprises:

[0137] a first decryption module, configured to decrypt the ciphertext data based on the i-th key before the update to obtain the plaintext data;

[0138] The first encryption module is used to encrypt the plaintext data based on the updated i-th key to obtain the ciphertext data.

[0139] Optionally, the i-th key is used to encrypt the plaintext key corresponding to the i-th operation stage to obtain a ciphertext key, and the plaintext key is used to encrypt the plaintext data in the i-th operation stage to obtain ciphertext data;

[0140] The device further comprises:

[0141] a second decryption module, configured to decrypt the ciphertext key based on the i-th key before the update to obtain the plaintext key;

[0142] The second encryption module is configured to encrypt the plaintext key based on the updated i-th key to obtain the ciphertext key.

[0143] To sum up, in the embodiments of the present application, in each operating stage of the SoC startup process, the main device generates a secret value corresponding to the current operating stage based on the first secret value derivation factor of the previous operating stage of the current operating stage and the second secret value derivation factor of the next operating stage, and then generates a key corresponding to the current operating stage based on the secret value, so that the key can be used to protect the data in the current operating stage subsequently; using the scheme provided by the embodiments of the present application, since the key can only be generated in the current operating stage, the data encrypted with the key can only be correctly decrypted in the current operating stage, thereby realizing the mutual isolation of keys between different operating stages and ensuring the protection of key secrets between different operating stages. Even if there is a vulnerability in a software stage, it will not cause the key secrets in other software stages to be attacked, effectively improving the security of encrypted data and solving the problem of the short board effect of overall security.

[0144] It should be noted that the apparatus provided in the above embodiments is merely exemplified by the division of the above functional modules. In actual applications, the above functions can be distributed among different functional modules as needed, that is, the internal structure of the apparatus can be divided into different functional modules to complete all or part of the functions described above. In addition, the apparatus and method embodiments provided in the above embodiments are based on the same concept. The implementation process is detailed in the method embodiments and will not be repeated here.

[0145] In some embodiments, the present application also provides a computer device, which is provided with Figure 1 or Figure 2 The system-on-chip shown.

[0146] It should be noted that in addition to the system on chip, the computer device may also include other necessary components, such as memory, display components, microphones, speakers, radio frequency circuits, input units, sensors (such as acceleration sensors, angular velocity sensors, light sensors, etc.), WiFi modules, power supplies, Bluetooth modules and other components, which are not described in detail in this embodiment.

[0147] An embodiment of the present application further provides a computer-readable storage medium, which stores at least one program, and the at least one program is loaded and executed by a processor to implement the key generation method described in the above embodiments.

[0148] An embodiment of the present application provides a computer program product, which includes computer instructions stored in a computer-readable storage medium; a processor reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the computer device executes the key generation method provided in various optional implementations of the above aspects.

[0149] It should be understood that the "multiple" mentioned in this article refers to two or more. "And / or" describes the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can represent three situations: A exists alone, A and B exist at the same time, and B exists alone. The character " / " generally indicates that the previous and subsequent associated objects are in an "or" relationship. In addition, the step numbers described in this article only illustrate a possible execution sequence between the steps. In some other embodiments, the above steps may not be executed in the order of the numbers, such as two steps with different numbers are executed at the same time, or two steps with different numbers are executed in the opposite order to the diagram. The embodiments of the present application do not limit this.

[0150] The above description is merely an optional embodiment of the present application and is not intended to limit the present application. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the present application shall be included in the scope of protection of the present application.

Claims

1. A key generation method, characterized in that: The method comprises: During a first operation phase of a system-on-chip boot process, obtaining a zeroth secret value from a hardware root of trust, the zeroth secret value being a unique device secret value of the system-on-chip; In an i-th running stage of the system-on-chip startup process, obtaining an i-1th secret value input in an i-1th running stage, where the i-1th secret value is generated in the i-1th running stage, where i is an integer greater than or equal to 2 and the i-th running stage is not the last running stage; Get the i+1th summary value corresponding to the i+1th running stage; Generate an i-th secret value corresponding to the i-th running stage based on the i-1-th secret value and the i+1-th digest value; An i-th key corresponding to the i-th running stage is generated based on the i-th secret value, and the i-th key is used to protect data in the i-th running stage.

2. The method according to claim 1, characterized in that The obtaining of the (i+1)th summary value corresponding to the (i+1)th running stage includes: Loading the (i+1)th software image corresponding to the (i+1)th running stage; The digest value of the (i+1)th software image is determined as the (i+1)th digest value.

3. The method according to claim 2, characterized in that Determining the digest value of the (i+1)th software image as the (i+1)th digest value includes: Performing a security check on the (i+1)th software image based on the image signature of the (i+1)th software image, wherein the security check is used to verify whether the software image has been tampered with; In a case where the (i+1)th software image passes the security verification, the digest value of the (i+1)th software image is determined as the (i+1)th digest value.

4. The method according to claim 1, wherein The obtaining of the (i+1)th summary value corresponding to the (i+1)th running stage includes: In a case where the i-th running stage corresponds to at least two i+1-th running stages executed in parallel, obtaining the i+1-th digest value corresponding to each of the at least two i+1-th running stages; The generating, based on the (i-1)th secret value and the (i+1)th digest value, the i-th secret value corresponding to the i-th running stage includes: At least two i-th secret values ​​corresponding to the i-th running stage are generated based on the i-1-th secret value and the at least two i+1-th digest values.

5. The method according to any one of claims 1 to 4, characterized in that: The method further comprises: When the software code is updated, the secret value corresponding to the running stage is updated; Update the key corresponding to the runtime based on the updated secret value.

6. The method according to claim 5, characterized in that When the software code is updated, updating the secret value corresponding to the running stage includes: When the software code corresponding to the i-th running stage is updated, the secret value corresponding to the target running stage is updated, and the target running stage includes the i-1-th running stage, the i-th running stage, and the downstream running stage of the i-th running stage. The downstream running stage is located after the i-th running stage and is located in the same running link as the i-th running stage.

7. The method according to claim 6, characterized in that The i-th key is used to encrypt the plaintext data in the i-th operation stage to obtain ciphertext data; The method further comprises: Decrypting the ciphertext data based on the i-th key before updating to obtain the plaintext data; The plaintext data is encrypted based on the updated i-th key to obtain the ciphertext data.

8. The method according to claim 6, characterized in that The i-th key is used to encrypt the plaintext key corresponding to the i-th operation stage to obtain a ciphertext key, and the plaintext key is used to encrypt the plaintext data in the i-th operation stage to obtain ciphertext data; The method further comprises: Decrypting the ciphertext key based on the i-th key before updating to obtain the plaintext key; The plaintext key is encrypted based on the updated i-th key to obtain the ciphertext key.

9. A key generation device, characterized in that: The device comprises: a secret value generation module, configured to obtain, during a first operation phase of a system-on-chip boot process, a zeroth secret value from a hardware root of trust, the zeroth secret value being a unique device secret value of the system-on-chip; and, during an i-th operation phase of the system-on-chip boot process, obtain an i-1th secret value input during an i-1th operation phase, the i-1th secret value being generated during the i-1th operation phase, where i is an integer greater than or equal to 2, and the i-th operation phase is not the last operation phase; Get the i+1th summary value corresponding to the i+1th running stage; Generate an i-th secret value corresponding to the i-th running stage based on the i-1-th secret value and the i+1-th digest value; A key generation module is used to generate an i-th key corresponding to the i-th operation stage based on the i-th secret value, and the i-th key is used to protect data in the i-th operation stage.

10. A system on chip, characterized in that: The system on chip includes at least one master device, and the at least one master device is connected via a bus. The system on chip is used to implement the key generation method according to any one of claims 1 to 8.

11. A computer device, characterized in that: The computer device is provided with the system on chip according to claim 10.

12. A computer-readable storage medium, characterized in that The computer-readable storage medium stores at least one program, and the at least one program is loaded and executed by a processor to implement the key generation method according to any one of claims 1 to 8.

13. A computer program product, characterized in that The computer program product includes computer instructions, which are stored in a computer-readable storage medium; a processor reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that a computer device executes the key generation method according to any one of claims 1 to 8.

Images