Key data reading and writing method and system for electronic device

Abstract

The application provides a secret key data reading and writing method and system of an electronic device, which comprises the following steps: creating two or more secret key data storage files with the same data structure and storing them in the memory of the electronic device; detecting whether encrypted secret key data encrypted by an encryption tool is received at a first time interval; if the encrypted secret key data is received, performing a re-encryption operation of first decryption and then encryption on the encrypted secret key data; selecting a secret key data storage file corresponding to the maximum value of file write operation count data, and reading the secret key data storage file into the memory of the electronic device as a first to-be-written file; updating the secret key data after the re-encryption operation to the file main body data of the first to-be-written file when storing the secret key, and performing overall flash writing update on the first to-be-written file; and storing the secret key data storage file formed after the overall flash writing update in the memory again.

Description

TECHNICAL FIELD

[0001] The present application mainly relates to the field of information technology, and in particular to a secret key data reading and writing method and system of an electronic device. BACKGROUND

[0002] In order to prevent secret key data in an electronic device, such as a cash register device, from being abnormally written due to accidental power failure, manufacturers have proposed some solutions. For example, solution one, a deep write protection logic is designed based on a file system (for example, a backup block is set based on a Flash hardware driver, data in a target block is saved in the backup block each time data is written, and then a write target block operation is performed. If power failure occurs during the writing process, the Flash driver initialization function performs a backup block copy to the target block logic after power is turned on again. This solution requires setting an information block to record the mapping relationship between the backup block and the target block); solution two, a large-capacity capacitor is added to the hardware device to identify power failure. Since the large-capacity capacitor can maintain a short power supply after power failure occurs, data can continue to be written during this period. The first solution has a high degree of customization, poor portability, and high requirements for device development and maintenance personnel. The second solution increases hardware costs and cannot effectively solve the problem of products that have already been produced. SUMMARY

[0003] The technical problem to be solved by the present application is to provide a secret key data reading and writing method and system of an electronic device, which can achieve efficient secret key data reading and writing, has high portability, and has a secret key data abnormality recovery function.

[0004] To solve the above technical problems, the application provides a secret key data read-write method of an electronic device, which comprises the following steps: creating two or more secret key data storage files with the same data structure and storing the secret key data storage files in a memory of the electronic device, each of the secret key data storage files comprising file header data, file body data and file tail data, the file header data comprising file write operation count data and secret key validity flag data, and the file tail data comprising first check data generated based on the file header data and the file body data; detecting whether encrypted secret key data encrypted by an encryption tool is received at a first time interval; if new encrypted secret key data is received, performing a re-encryption operation of first decryption and then encryption on the encrypted secret key data; selecting a secret key data storage file corresponding to a maximum value of the file write operation count data, and reading the secret key data storage file into a memory of the electronic device as a first to-be-written file; updating and writing the secret key data subjected to the re-encryption operation to the file body data of the first to-be-written file in the memory, and performing overall write operation count data, secret key validity flag data and first check data update on the file header data and the file tail data of the first to-be-written file; and storing a secret key data storage file formed based on the first to-be-written file and subjected to the overall write operation count data update in the memory again.

[0005] In an embodiment of the application, the secret key data read-write method of the electronic device further comprises the following steps: when encrypted secret key data is received again at the first time interval, selecting a secret key data storage file with the second largest file write operation count data from the two or more secret key data storage files, and reading the secret key data storage file into the memory of the electronic device as a second to-be-written file; performing secret key data update and file overall write operation count data update on the second to-be-written file, and storing a secret key data storage file formed based on the second to-be-written file and subjected to the overall write operation count data update in the memory again.

[0006] In an embodiment of the application, the secret key data read-write method of the electronic device further comprises the following steps: when encrypted secret key data is received again at the first time interval, selecting a secret key data storage file with the second largest file write operation count data from the two or more secret key data storage files, and reading the secret key data storage file into the memory of the electronic device as a second to-be-written file; performing secret key data update and file overall write operation count data update on the second to-be-written file, and storing a secret key data storage file formed based on the second to-be-written file and subjected to the overall write operation count data update in the memory again.

[0007] In an embodiment of the application, the bit width of the secret key validity flag data of the file header data corresponds to the number of secret key data of the file body data.

[0008] In an embodiment of the present application, the method further comprises: when the electronic device is powered on again after being powered off, detecting whether the first check data of the two or more secret key data storage files is abnormal; for the secret key data storage file whose first check data is determined to be normal through detection, preferentially performing secret key data update and file overall update.

[0009] In an embodiment of the present application, the secret key data comprises a serial number, data length, data body and check data.

[0010] In an embodiment of the present application, the first check data comprises check data generated by a hash algorithm based on file header data and the file body data.

[0011] In an embodiment of the present application, the file header data comprises second header check data; when the first check data of the two or more secret key data storage files is abnormal, verifying the second header check data of the two or more secret key data storage files; for the secret key data storage file whose second header check data is determined to be normal through verification, preferentially performing secret key data update and file overall update.

[0012] In an embodiment of the present application, the method further comprises: for the secret key data storage file whose first check data is determined to be abnormal through detection, performing file repair operation; wherein the file repair operation comprises performing piece-by-piece check operation on the secret key data in the file body data.

[0013] In an embodiment of the present application, the secret key data comprises a serial number, data length, data body and check data; the piece-by-piece check operation on the secret key data comprises: based on the check data of the secret key data, checking each piece of the secret key data, retaining the secret key data that passes the check, and deleting the secret key data that fails the check, to form updated file body data; based on the updated file body data, performing overall update on the file header data area and file tail data of the secret key data storage file.

[0014] In an embodiment of the present application, the second header check data comprises check data generated by a first cyclic redundancy check algorithm based on file header data.

[0015] In an embodiment of the present application, when the second header check data of the two or more secret key data storage files is abnormal, the two or more secret key data storage files are cleared, and new secret key data storage files are created.

[0016] In an embodiment of the present application, the file body data includes key data used for the application of the electronic device to run corresponding business data processing operations.

[0017] In an embodiment of the present application, the conversion encryption operation is performed by a special security processor, and the decryption key of the security processor corresponds to the encryption key of the encryption tool.

[0018] In an embodiment of the present application, the electronic device includes a POS machine and a self-service checkout device.

[0019] The present application also provides a key data reading and writing system of an electronic device, including a processor, a memory and a storage, and the system is configured to perform the following operations: creating two or more key data storage files with the same data structure and storing them in the storage of the electronic device, each of the key data storage files including file header data, file body data and file tail data, the file header data including file write operation count data and key valid flag data, and the file tail data including first check data generated based on the file header data and the file body data; detecting whether encrypted key data encrypted by an encryption tool is received at a first time interval; if new encrypted key data is received, performing a conversion encryption operation of first decryption and then encryption on the encrypted key data; selecting a key data storage file corresponding to the maximum value of the file write operation count data, and reading it into the memory of the electronic device as a first to-be-written file; updating the key data after the conversion encryption operation to the file body data of the first to-be-written file in the memory, and performing overall brush writing update on the file write operation count data, the key valid flag data and the first check data of the file header data and the file tail data of the first to-be-written file; and storing a key data storage file formed based on the first to-be-written file and after the overall brush writing update back into the storage.

[0020] In an embodiment of the present application, the system is further configured to perform the following operations: when encrypted key data is received again after the first time interval, selecting a key data storage file with the second value of the file write operation count data from the two or more key data storage files, and reading it into the memory of the electronic device as a second to-be-written file; performing a key data update brush writing operation and a file overall brush writing update operation on the second to-be-written file, and storing a key data storage file formed after the overall brush writing update back into the storage.

[0021] In an embodiment of the present application, the system is further configured to perform the following operation: when the encrypted key data is received subsequently, based on the size of the file write operation count data of the file header data, sequentially update and re-store the remaining key data storage files in the two or more key data storage files.

[0022] Compared with the prior art, the present application has the following advantages: the technical solution of the present application realizes efficient key data read and write, has high portability, and has a key data abnormality recovery function. For example, when the electronic device is powered off, the application program related to the key data can continue to run stably and quickly after power-on, avoiding the influence of power-off of the electronic device; for another example, the key data can be prevented from being modified accidentally. BRIEF DESCRIPTION OF DRAWINGS

[0023] The accompanying drawings are included to provide a further understanding of the present application, and are incorporated in and constitute apart of this application, illustrate embodiments of the present application, and together with the description serve to explain the principles of the present application.

[0024] In the drawings:

[0025] Figure 1 is a flowchart of a key data read and write method of an electronic device according to an embodiment of the present application.

[0026] Figure 2 is a data structure diagram of a key data storage file according to an embodiment of the present application.

[0027] Figure 3 is a partial data structure diagram of a key data storage file according to an embodiment of the present application.

[0028] Figure 4 is a composition diagram of a key data read and write system of an electronic device according to an embodiment of the present application.

[0029] Figure 5 is a flowchart of a key data read and write method of an electronic device according to another embodiment of the present application.

[0030] Figure 6 is a flowchart of a key data read and write method of an electronic device according to another embodiment of the present application. DETAILED DESCRIPTION

[0031] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings needed to be used in the embodiment description will be briefly introduced. Obviously, the drawings in the following description only show some examples or embodiments of the present application, and for those skilled in the art, the present application can be applied to other similar scenarios without creative labor on the basis of the drawings. Unless it is clear from the language context or otherwise stated, the same reference numbers in the drawings represent the same structures or operations.

[0032] As shown in the present application and claims, unless the context clearly indicates otherwise, the words "one", "an", "a", and / or "the" do not specify a singular number, but can also include a plural number. Generally, the terms "comprising" and "including" only indicate the inclusion of the steps and elements explicitly identified, and these steps and elements do not constitute an exclusive list, and the method or device can also include other steps or elements.

[0033] Unless otherwise specifically stated, the relative arrangement of components and steps, numerical expressions, and numerical values set forth in the various examples herein are not meant to limit the scope of the present application. It is also to be understood that the dimensions of the various parts shown in the drawings are not necessarily to scale, and that for the convenience of description, the dimensions of the various parts shown in the drawings are not necessarily to scale. The techniques, methods, and devices known to those skilled in the relevant art can not be discussed in detail, but should be considered as part of the authorized description when appropriate. In all examples shown and discussed herein, any specific value should be interpreted as merely exemplary, and not as a limitation. Therefore, other examples of the exemplary embodiments can have different values. It should be noted that similar reference numbers and letters represent similar items in the following drawings, and therefore, once an item is defined in one drawing, it does not need to be further discussed in subsequent drawings.

[0034] In addition, it should be noted that the use of the words "first", "second", and the like do not have a special meaning, and therefore, cannot be understood as limiting the scope of protection of the present application, unless otherwise stated.

[0035] Flowcharts are used in the present application to illustrate the operations performed by the system according to the embodiments of the present application. It should be understood that the preceding or following operations are not necessarily performed in sequence. On the contrary, various steps can be processed in reverse order or simultaneously. Meanwhile, other operations can be added to these processes, or one or more steps of operations can be removed from these processes.

[0036] The embodiments of the present application describe a secret key data reading and writing method and system of an electronic device.

[0037] Figure 1is a flow chart of a secret key data read-write method of an electronic device according to an embodiment of the present application. As shown in Figure 1 The secret key data read-write method of the electronic device includes: step 101, creating two or more secret key data storage files with the same data structure and storing them in the memory of the electronic device, each secret key data storage file including file header data, file body data and file tail data, the file header data including file write operation count data and secret key validity flag data, and the file tail data including first check data generated based on the file header data and the file body data; step 102, detecting whether encrypted secret key data encrypted by an encryption tool is received at a first time interval; if new encrypted secret key data is received, performing a re-encryption operation of first decryption and then encryption on the encrypted secret key data; step 103, selecting a secret key data storage file corresponding to the maximum value of the file write operation count data and reading it into the memory of the electronic device as a first to-be-written file; step 104, updating and writing the secret key data after the re-encryption operation to the file body data of the first to-be-written file in the memory, and performing overall write operation count data, secret key validity flag data and first check data update on the file header data and the file tail data of the first to-be-written file; and step 105, storing the secret key data storage file formed based on the first to-be-written file and after the overall write operation update in the memory again.

[0038] Specifically, in step 101, two or more secret key data storage files with the same data structure are created and stored in the memory of the electronic device, the type of the memory being, for example, a readable and writable FLASH, each secret key data storage file including file header data, file body data and file tail data, the file header data including file write operation count data and secret key validity flag data, and the file tail data including first check data generated based on the file header data and the file body data.

[0039] Figure 2 is a data structure diagram of a secret key data storage file according to an embodiment of the present application. The secret key data storage file is actually an electronic file, Figure 2 is to represent the structure of the data contained in the secret key data storage file. Referring to Figure 2, the key data storage file 200 includes file header data 201, file body data 202 and file tail data 203. The file header data 201 includes file write operation count data 212 and key valid flag data 214. The file header data 201 may, for example, further include key version data 211, key data storage file length data 213. The file tail data 203 includes first check data 261 generated based on the file header data 201 and the file body data 202. The file body data 202 includes, for example, first key data 221, second key data 222, third key data 223, and so on. The bit width of the key valid flag data of the file header data may, for example, correspond to the number of key data in the file body data. For example, if the number of key data in the file body data is 100, the bit width of the key valid flag data of the file header data is 100 bits, and when the key is valid, each bit of the 100 bits is set to a valid state (for example, set to '1' or '0').

[0040] Figure 3 is a schematic diagram of part of the data structure of the key data storage file according to an embodiment of the present application. Figure 3 corresponds to part of the content in Figure 2 . Refer to Figure 3 , the key data storage file can be opened by a file viewer to check the specific data structure therein. Figure 3 The data shown in

[0041] In some embodiments, the first check data 261 includes check data generated based on the file header data 201 and the file body data 202 by a Hash algorithm. The specific type of the Hash algorithm may, for example, be SHA256 algorithm.

[0042] In some embodiments, the key data includes a serial number, a data length, a data body and a check data bit. For example, the first key data 221 includes a serial number 231, a data length 232, a data body 233 and a check data bit 234. The data of the check data bit 234 may, for example, be generated based on the serial number 231, the data length 232 and the data body 233 by a second cyclic redundancy check algorithm. The specific type of the second cyclic redundancy check algorithm may, for example, be CRC8 algorithm (i.e. the check data length is 8 bits, 1 byte of CRC algorithm). The key data included in the file body data is used for the corresponding business data processing operation of the application program running on the electronic device. The application program may, for example, be a cash register related application program. The electronic device may, for example, be a POS machine (Point of Sale) or a self-service cash register device.

[0043] In step 102, it is detected whether encrypted key data encrypted by an encryption tool is received at a first time interval, the encryption tool including, for example, a dedicated encryption application; if new encrypted key data is received, the encrypted key data is decrypted to recover the key plaintext and then re-encrypted. The first time interval is, for example, 100 ms (milliseconds), 150 ms, 200 ms, and can be set as needed. The encryption tool (ROOTKEY) has a root key, which is an operation tool specially developed by an electronic device manufacturer or user. In some embodiments, key operations (re-encryption operation, key decryption) are performed by a dedicated security processor, and the key used for decryption corresponds to the key used for encryption in the encryption tool. The re-encryption operation is performed in a dedicated security processor (SP), and the key used for decryption corresponds to the key used for encryption in the encryption tool. The key data is always stored in ciphertext form when stored, and only appears in plaintext form in the RAM of the SP for a short time interval during use. After use, the encrypted key data is stored again in ciphertext form.

[0044] In step 103, the key data storage file corresponding to the maximum value of the file write operation count data is selected and read into the memory (e.g., RAM, Read Access Memory) of the electronic device as a first to-be-written file. In step 104, the re-encrypted key data is updated and written to the file body data of the first to-be-written file in the memory, and the file write operation count data 212, the key valid flag data 214, and the first check data 261 of the file header data 201 and the file tail data 203 of the first to-be-written file are updated and written as a whole.

[0045] Next, in step 105, the key data storage file formed by the overall update based on the first to-be-written file is stored in the memory again.

[0046] In some embodiments, with reference to Figure 5 , the key data read / write method of the electronic device further includes, on the basis of the steps 501 to 505 similar to the steps 101 to 105 described above, the step 506 of selecting a key data storage file with the file write operation count data in the second position from two or more key data storage files when the encrypted key data is received again after the first time interval, and reading the key data storage file into the memory of the electronic device as a second to-be-written file; and the step 507 of performing a key data update and write operation and a file overall update and write operation on the second to-be-written file, and storing the key data storage file formed by the overall update in the memory again.

[0047] In some embodiments, with reference toFigure 6 The key data read-write method of the electronic device can further include, on the basis of steps 601 to 607 similar to steps 501 to 507, step 608: when the encrypted key data is subsequently received, based on the size of the file header data file write operation count data, sequentially updating and re-storing the remaining key data storage files in the two or more key data storage files.

[0048] In some embodiments, the file header data 201 includes second header check data 218. The second header check data 218 includes check data generated based on the file header data 201 by a first cyclic redundancy check (CRC) algorithm. The first cyclic redundancy check algorithm is specifically, for example, a CRC16 algorithm (i.e., a CRC algorithm with a check data length of 16 bits, 2 bytes).

[0049] In some embodiments, the key data read-write method of the electronic device further includes: when the electronic device is powered off and then powered on again, detecting whether the first check data of the two or more key data storage files is abnormal; for the key data storage file for which it is determined through detection that the first check data is not abnormal, preferentially performing a key data update flashing operation and a file overall flashing update operation.

[0050] When the first check data of the two or more key data storage files is abnormal, the second header check data of the two or more key data storage files is verified; for the key data storage file for which it is determined through verification that the second header check data is not abnormal, preferentially performing a key data update flashing operation and a file overall flashing update operation.

[0051] In some embodiments, the key data read-write method of the electronic device further includes: for the key data storage file for which it is determined through detection that the first check data is abnormal, performing a file repair operation. The file repair operation includes performing a piece-by-piece check operation on the key data in the file body data. The piece-by-piece check operation on the key data includes, for example, step 701: based on the check data bits of the key data, checking each piece of key data, retaining the key data that passes the check, and deleting the key data that fails the check, to form updated file body data; and step 702: based on the updated file body data, performing overall flashing update on the file header data area and the file tail data of the key data storage file.

[0052] In some embodiments, when the second header check data of the two or more key data storage files is abnormal, the two or more key data storage files are cleared, and new key data storage files are created.

[0053] The application also provides a secret key data reading and writing system of an electronic device. Figure 4 is a schematic diagram of a secret key data reading and writing system of an electronic device according to an embodiment of the application. As shown in Figure 4 the secret key data reading and writing system 400 of the electronic device comprises a processor 401, a memory 411 and a storage 412. Figure 4 A security processor 421 is also shown in the figure. Data and instructions are transmitted between the various components of the system through a network.

[0054] In some embodiments, the secret key data reading and writing system of the electronic device is configured to perform the operations described in the foregoing steps 101 to 105. The secret key data reading and writing system of the electronic device can also be configured to perform the operations described in the foregoing steps 201 to 207 or steps 301 to 308. The specific implementation is described in the foregoing.

[0055] The secret key data reading and writing method and system of the electronic device according to the application can cope with the situation that the electronic device is powered off when performing the secret key writing operation on the secret key data storage file, avoid the problem that the secret key data storage file is lost due to the power-off of the electronic device during the flashing operation, and cause the secret key related application program in the electronic device to fail to operate normally. The technical solution of the application enables the secret key related application program to continue to operate normally based on the secret key data storage file in the storage after the electronic device is powered on again, ensures stable reading and writing speed, and prevents the secret key data from being modified accidentally, thereby improving the security of the secret key data usage.

[0056] The foregoing description has been made to the basic concepts. Obviously, the above-mentioned disclosure of the application is only taken as an example and does not constitute a limitation on the application. Although it is not explicitly stated herein, those skilled in the art can make various modifications, improvements and corrections to the application. Such modifications, improvements and corrections are suggested in the application, so such modifications, improvements and corrections still belong to the spirit and scope of the exemplary embodiments of the application.

[0057] Meanwhile, specific words are used in the application to describe the embodiments of the application. For example, "one embodiment", "an embodiment" and / or "some embodiments" means a certain feature, structure or characteristic related to at least one embodiment of the application. Therefore, it should be emphasized and noted that the "one embodiment" or "one embodiment" or "one alternative embodiment" mentioned in different places in the specification does not necessarily refer to the same embodiment. In addition, some features, structures or characteristics in one or more embodiments of the application can be properly combined.

[0058] Some aspects of the application can be performed entirely in hardware, entirely in software (including firmware, resident software, micro-code, etc.), or a combination of hardware and software. The above hardware or software can be referred to as a "block," "module," "engine," "unit," "component," or "system." A processor can be one or more application specific integrated circuits (ASICs), digital signal processors (DSPs), digital audio player devices (DAPDs), programmable logic devices (PLDs), field programmable gate arrays (FPGAs), processors, controllers, micro-controllers, microprocessors, or combinations thereof. Furthermore, aspects of the application can be presented in a computer program product, which can include a computer-readable medium having computer program code embodied therein.

[0059] A computer readable medium can include a propagated data signal with computer program code embodied therein, for example, in baseband or as part of a carrier wave. Such a propagated signal can take a variety of forms, including, but not limited to, electro-magnetic, optical, or any suitable combination thereof. Computer readable medium can be any computer readable medium except for a transitory, propagating signal per se. A computer readable medium can include an ordered listing of computer program code embodied thereon, which can be executed by a processor, a controller, a microcontroller, a microprocessor, or any suitable combination thereof. The computer program code embodied on the computer readable medium can be propagated through any suitable medium including, but not limited to, wireless, wireline, optical fiber cable, RF, or any suitable combination thereof.

[0060] Similarly, it is to be noticed that the term "comprising", used in the description, is not intended to exclude other features but to comprise them. Other expressions, such as "containing" or "including", shall be construed in a like manner. Furthermore, it is to be noted that the use of the singular herein, such as "an" or "the", does not exclude the plural and vice versa. It is further noted that the description uses the term "comprising" to mean "including" or "consisting of". It is to be understood that the terms "comprising", "including", "containing", "having" and "characterized by" are to be construed in a non- limiting sense. The description is not intended to be limited to the aspects described herein, but it will be understood that it extends to whatever falls within the scope of the claims.

[0061] Although the application has been described with reference to current embodiments, it will be understood by those skilled in the art that various equivalent changes in form and details can be made therein without departing from the spirit and scope of the application. Accordingly, the disclosed embodiments are to be considered as illustrative and not restrictive, and the scope of the application is to be determined not by the foregoing description but by the following claims.

Claims

1. A secret key data read-write method of an electronic device, comprising: creating two or more secret key data storage files with the same data structure and storing them in the memory of the electronic device, each of the secret key data storage files comprising file header data, file body data and file tail data, the file header data comprising file write operation count data and secret key validity flag data, and the file tail data comprising first check data generated based on the file header data and the file body data; detecting whether encrypted secret key data encrypted by an encryption tool is received at a first time interval; if new encrypted secret key data is received, performing a decryption-then-encryption operation on the encrypted secret key data using a local secret key; selecting a secret key data storage file corresponding to the maximum value of the file write operation count data, and reading it into the memory of the electronic device as a service use secret key, and recording a first to-be-written file; updating and writing the secret key data after the decryption-then-encryption operation to the file body data of the first to-be-written file in the memory, and performing overall write update on the file write operation count data, the secret key validity flag data and the first check data of the file header data and the file tail data of the first to-be-written file; storing a secret key data storage file formed by the overall write update based on the first to-be-written file back into the memory.

2. The secret key data read / write method of an electronic device according to claim 1, wherein, Further comprising: when encrypted secret key data is received again after the first time interval, selecting a secret key data storage file with the second largest file write operation count data from the two or more secret key data storage files, and reading it into the memory of the electronic device as a second to-be-written file; performing secret key data update and write operation and file overall write update on the second to-be-written file, and storing a secret key data storage file formed by the overall write update back into the memory.

3. The method of claim 2, wherein the secret key data is read from the electronic device by the electronic device, and the secret key data is written into the electronic device by the electronic device. Further comprising: when encrypted secret key data is received subsequently, updating and storing the remaining secret key data storage files in the two or more secret key data storage files back into the memory in sequence based on the size of the file write operation count data of the file header data.

4. The method of claim 1, wherein the secret key data is read from the electronic device by a user. The bit width of the secret key validity flag data of the file header data corresponds to the number of secret key data of the file body data.

5. The method of claim 1, wherein the secret key data is read from the electronic device by a user. Further comprising: when the electronic device is powered off and then powered on again, detecting whether the first check data of the two or more secret key data storage files is abnormal; performing secret key data update and write operation and file overall write update on the secret key data storage file whose first check data is determined to be normal through detection, preferentially.

6. The method of claim 1, wherein the secret key data is read from and written to the electronic device by using a key input device. The secret key data comprises a serial number, data length, data body and check data bits.

7. The method of claim 1, wherein the secret key data is read from and written to the electronic device by using a key input device. The first check data comprises check data generated based on the file header data and the file body data by a hash algorithm.

8. The method of claim 5, wherein the secret key data is read from the electronic device by a user. The file header data comprises second header check data; when the first check data of the two or more secret key data storage files is all abnormal, verifying the second header check data of the two or more secret key data storage files; The key data storage file determined to have no abnormality in the second header check data is preferentially subjected to a key data update write operation and a file overall write update operation.

9. The method of claim 5, wherein the secret key data is read and written by using a function of the electronic device. Further comprising: The key data storage file determined to have abnormality in the first check data is subjected to a file repair operation; The file repair operation includes a piece-by-piece check operation on the key data in the file body data.

10. The method of claim 9, wherein the secret key data is read from the electronic device by the electronic device. The key data includes a serial number, a data length, a data body, and a check data bit; The piece-by-piece check operation on the key data includes checking each piece of the key data based on the check data bit of the key data, retaining the key data that passes the check, and deleting the key data that fails the check to form updated file body data; Based on the updated file body data, the header data area and the file tail data of the key data storage file are subjected to an overall write update.

11. The method of claim 8, wherein the secret key data is read from the electronic device by a user. The second header check data includes check data generated based on the file header data by a first cyclic redundancy check algorithm.

12. The method of claim 8, wherein the secret key data is read and written by using a key management server. When the second header check data of the two or more key data storage files are all abnormal, the two or more key data storage files are cleared, and a new key data storage file is created.

13. The method of claim 1, wherein the secret key data is read and written by using a key management server. The key data included in the file body data is used for a corresponding business data processing operation of an application program running on the electronic device.

14. The method of claim 1, wherein the secret key data is read and written by using a function of a secure kernel. The encryption conversion operation is performed by a specially designed security processor, and the decryption key of the security processor corresponds to the encryption key of the encryption tool.

15. The method of claim 1, wherein the secret key data is read and written by using a function of a secure kernel of the electronic device. The electronic device includes a POS machine and a self-service checkout device.

16. A key data read-write system of an electronic device, comprising a processor, a memory, and a storage, the system being configured to perform the following operations: Two or more key data storage files with the same data structure are created and stored in the storage of the electronic device, each of the key data storage files including file header data, file body data, and file tail data, the file header data including file write operation count data and key validity flag bit data, and the file tail data including first check data generated based on the file header data and the file body data; Whether encrypted key data encrypted by an encryption tool is received is detected at a first time interval, and if new encrypted key data is received, the encrypted key data is subjected to a decryption-then-encryption conversion operation; A key data storage file corresponding to the maximum value of the file write operation count data is selected and read into the memory of the electronic device as a first file to be written; The key data subjected to the conversion operation is updated and written to the file body data of the first file to be written in the memory, and the file write operation count data, the key validity flag bit data, and the first check data of the file header data and the file tail data of the first file to be written are subjected to an overall write update; A key data storage file formed based on the first file to be written and subjected to the overall write update is stored in the storage again.

17. The system according to claim 16, wherein The system is further configured to perform the following operations: When the encrypted key data is received again after the first time interval, the key data storage file with the second largest file write operation count data is selected from the two or more key data storage files and read into the memory of the electronic device as a second to-be-written file; The second to-be-written file is subjected to a key data update and a file overall update, and the key data storage file formed after the overall update is stored in the memory again.

18. The secret key data read-write system of an electronic device according to claim 17, wherein, The system is further configured to perform the following operations: When the encrypted key data is received again after the first time interval, the key data storage file with the second largest file write operation count data is selected from the two or more key data storage files and read into the memory of the electronic device as a second to-be-written file; The second to-be-written file is subjected to a key data update and a file overall update, and the key data storage file formed after the overall update is stored in the memory again.

Images