A storage security and hardening system and method of implementing the same

Abstract

The application discloses a kind of storage security and reinforcement system and its implementation method, by the binary conversion and file separation of to-be-run program obtains instruction part and data part, after the encryption of instruction part is merged with data part, hamming code coding is carried out and is stored, when fetch instruction, processor finds out instruction part from memory and sequentially hamming code decoding and decryption are obtained to-be-executed instruction, when access memory, processor finds out data part from memory and decodes to obtain to-be-accessed data, simultaneously still can to to-be-accessed data hamming code coding is re-stored in memory after entering.The application overcomes the problems of large performance loss, easy to be destroyed, no actual protection to the instructions in memory and the insufficient error correction ability of traditional hamming code in traditional instruction randomization method, improves the security and reliability of instructions and data in memory, and can be widely applied in the field of data processing technology.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data processing, and in particular to a storage security and reinforcement system and an implementation method thereof. BACKGROUND

[0002] In recent years, with the continuous development of science and technology, the application of electronic products has been very wide, and integrated circuits have thus achieved high-speed development. A chip is generally composed of multiple parts, and the proportion of memory in it is growing, playing a very important role, and thus has attracted widespread attention. The memory stores the instructions and data required by the system, and the correctness of these instructions and data is related to whether the system can operate normally, so storage is often the focus of hackers' attacks, and code injection attack is one of the means. Attackers often use memory destruction type vulnerabilities (such as buffer overflow) or programs that do not verify and filter input data to inject and execute malicious code carefully constructed. These carefully constructed codes often determine according to the characteristics of the instruction set, therefore, instruction set randomization is an effective means to deal with code injection attacks. It can make attackers unable to know the currently used instruction set, so as to effectively exploit vulnerabilities, thereby achieving the effect of defending against code injection. However, most current instruction set randomization is completed based on software, which brings problems such as large performance loss, vulnerability to destruction, and no actual protection for instructions in memory, and many methods simply use the XOR method, which can be easily bypassed by attackers to bypass the defense.

[0003] In addition to external attacks, cosmic rays, solar radiation and other high-energy particle radiation can also interfere with memory devices. Some radiation particles pass through the atmosphere to reach the ground area, so high-energy radiation particles also exist in the low-altitude area, causing random flipping of storage bits, and thus affecting the accuracy of data storage. Especially with the continuous development of integrated circuit technology, the process size has been shrinking, resulting in a decrease in circuit node voltage and node charge, thereby reducing the noise margin of the circuit, and the circuit system is more sensitive to radiation. In order to reduce the probability of error occurrence, error correction and detection coding ECC (Error correction codes) is commonly used at home and abroad, including parity check code, Hamming code, BCH code, Golay code, etc. Among them, Hamming code has fewer redundant check bits, and the encoding and decoding are relatively simple, so it is one of the most commonly used ECC error correction techniques. However, the traditional Hamming code can only correct one bit error, and adding one total parity check bit can correct one bit error and detect two bit errors. This method is useful for single-bit flipping of memory, but cannot solve the problem of multiple-bit flipping, affecting the reliability of data storage. SUMMARY

[0004] In order to solve the above technical problems, the present application aims at providing a safe and reliable storage security and reinforcement system and its implementation method.

[0005] The first technical solution adopted by the present application is:

[0006] A storage security and reinforcement system comprises an instruction encryption module, a Hamming code encoding module, a Hamming code decoding module, an instruction decryption module, a storage and a processor, wherein:

[0007] The instruction encryption module is used to convert a program to be run into a binary file, separate the instruction part from the data part of the binary file, encrypt the instruction part of the binary file to obtain encrypted instructions, and combine the encrypted instructions with the data part of the binary file to generate an encrypted file.

[0008] The Hamming code encoding module is used to encode the encrypted file by Hamming code to obtain an encoded encrypted file, and store the encoded encrypted file in the storage.

[0009] In the instruction fetching stage, the processor is used to find instructions from the corresponding address of the storage, fetch the instruction part of the encoded encrypted file, decode and check the instruction part of the encoded encrypted file by the Hamming code decoding module to obtain the encrypted instructions, and further decrypt the encrypted instructions by the instruction decryption module to obtain the instructions to be executed.

[0010] In the memory access stage, the processor is used to find data from the corresponding address of the storage, fetch the data part of the encoded encrypted file, decode and check the data part of the encoded encrypted file by the Hamming code decoding module to obtain the data to be accessed, further encode the data to be accessed by the Hamming code encoding module to obtain the data part of the encoded encrypted file, and store the data part of the encoded encrypted file in the storage.

[0011] Further, the instruction encryption module comprises a row displacement unit, a byte substitution unit, a column mixing unit and a first round key addition unit, the instruction encryption module uses the AES encryption algorithm to encrypt the data to be encrypted, when the encryption round is 0, the data to be encrypted is input to the first round key addition unit and only passes through the first round key addition unit, when the encryption round is one round of 1 to 9, the data to be encrypted is input to the byte substitution unit and sequentially passes through the row displacement unit, the column mixing unit and the first round key addition unit, when the encryption round is 10, the data to be encrypted is input to the byte substitution unit and sequentially passes through the row displacement unit and the first round key addition unit.

[0012] Further, the Hamming code encoding module comprises four Hamming code encoders, four 32 bits data successively input into the Hamming code encoding module are combined into one 128 bits data through a serial-to-parallel circuit, and new four 32 bits data are generated through interleaving processing, then the newly generated four 32 bits data are input into the four Hamming code encoders respectively for Hamming code encoding to obtain four 39 bits data, and then the four 39 bits data are combined into one 156 bits data and output to the memory through a parallel-to-serial circuit.

[0013] Further, the Hamming code decoding module comprises four Hamming code decoders, four 39 bits data successively input into the Hamming code decoding module are combined into one 156 bits data through a serial-to-parallel circuit, and new four 39 bits data are generated through interleaving processing, then the newly generated four 39 bits data are input into the four Hamming code decoders respectively for Hamming code decoding to obtain four 32 bits data, and then the four 32 bits data are combined into one 128 bits data and output to the processor or the instruction decryption module.

[0014] Further, the Hamming code decoder is provided with a check matrix, the 39 bits data input into the Hamming code decoder are checked through the check matrix to obtain check information, and the check information is compared with the check bits of the input 39 bits data, if the two are the same, the check is passed, and the decoding is performed, if the two are different, the input 39 bits data is input into an error correction circuit for correction and then decoding.

[0015] Further, the instruction decryption module comprises a reverse row displacement unit, a reverse byte substitution unit, a reverse column confusion unit and a second round key addition unit, after receiving the data to be decrypted, when the decryption round is 0, the data to be decrypted is input into the second round key addition unit and only passes through the second round key addition unit, when the decryption round is one of 1 to 9, the data to be decrypted is input into the reverse row displacement unit and sequentially passes through the reverse byte substitution unit, the second round key addition unit and the reverse column confusion unit, when the decryption round is 10, the data to be decrypted is input into the reverse row displacement unit and sequentially passes through the reverse byte substitution unit and the second round key addition unit.

[0016] Further, the reverse row displacement unit is used to arrange the inputted 128 bits data into a 4*32 bits matrix, and keep the first row data of the matrix not moving, and make the second row data of the matrix right circular one byte, make the third row data of the matrix right circular two bytes, make the fourth row data of the matrix right circular three bytes, and then splice the row-displaced matrix into new 128 bits data.

[0017] Further, a 16*16 byte matrix is pre-set in the reverse byte substitution unit, the 128 bits data inputted into the reverse byte substitution unit is divided into 16 8 bits data, and the new 8 bits data is formed by taking the element from the corresponding position of the byte matrix with the high 4 bits of the 8 bits data as the row value and the low 4 bits as the column value, and then the 16 new 8 bits data is spliced into new 128 bits data.

[0018] Further, a 4*4 bits matrix is pre-set in the reverse column confusion unit, the 128 bits data inputted into the reverse column confusion unit is arranged into a 4*32 bits matrix, and the new 4*32 bits matrix is obtained by multiplying the 4*32 bits matrix with the 4*4 bits matrix from the left, and then the new 4*32 bits matrix is spliced into new 128 bits data.

[0019] Further, a 43*32 bits matrix is pre-set in the second round key addition unit, the 128 bits data inputted into the second round key addition unit is arranged into 4 32 bits data, and the new 4 32 bits data is obtained by performing XOR operation on the 4 32 bits data and the corresponding 4 32 bits key of the 43*32 bits matrix according to the round, and then the new 4 32 bits data is spliced into new 128 bits data.

[0020] The second technical scheme adopted by the application is:

[0021] An implementation method of a storage security and reinforcement system, used for realizing the storage security and reinforcement system, comprising the following steps:

[0022] An inputted program to be run is converted into a binary file by an instruction encryption module, and the instruction part and the data part of the binary file are separated, and then the instruction part of the binary file is encrypted to obtain encrypted instructions, and the encrypted instructions and the data part of the binary file are combined to generate an encrypted file;

[0023] The encrypted file is encoded by a Hamming code encoding module to obtain an encoded encrypted file, and the encoded encrypted file is stored in the memory;

[0024] The processor looks up the instruction part of the encoded encrypted file from the corresponding address of the memory, decodes and checks the instruction part of the encoded encrypted file through the Hamming code decoding module to obtain the encrypted instruction, and then decrypts the encrypted instruction through the instruction decryption module to obtain the to-be-executed instruction.

[0025] The processor looks up the data from the corresponding address of the memory, takes out the data part of the encoded encrypted file, and decodes and checks the data part of the encoded encrypted file through the Hamming code decoding module to obtain the to-be-accessed data.

[0026] The Hamming code encoding module encodes the to-be-accessed data to obtain the data part of the encoded encrypted file, and stores the data part of the encoded encrypted file in the memory.

[0027] The present application provides a storage security and reinforcement system and an implementation method thereof, the system comprising an instruction encryption module, a Hamming code encoding module, a Hamming code decoding module, an instruction decryption module, a memory and a processor. The to-be-run program is converted into a different system and separated into an instruction part and a data part. The instruction part is encrypted, combined with the data part, encoded by Hamming code and stored. When the instruction is fetched, the processor looks up the instruction part from the memory and sequentially decodes and decrypts by Hamming code to obtain the to-be-executed instruction. When the memory is accessed, the processor looks up the data part from the memory and decodes to obtain the to-be-accessed data. The to-be-accessed data can also be encoded by Hamming code and re-stored in the memory. The embodiment of the present application overcomes the problems of the traditional instruction randomization method, such as large performance loss, easy to be destroyed, no actual protection for the instructions in the memory and insufficient error correction ability of the traditional Hamming code, and improves the security and reliability of the instructions and data in the memory. BRIEF DESCRIPTION OF DRAWINGS

[0028] Figure 1 The system block diagram of the storage security and reinforcement system provided by the embodiment of the present application is shown in the figure;

[0029] Figure 2 The flowchart of the instruction encryption and instruction decryption provided by the embodiment of the present application is shown in the figure;

[0030] Figure 3 The encoding mode diagram of the software part of the Hamming code encoding module provided by the embodiment of the present application is shown in the figure;

[0031] Figure 4 The encoding mode diagram of the hardware part of the Hamming code encoding module provided by the embodiment of the present application is shown in the figure;

[0032] Figure 5A decoding mode schematic diagram of the Hamming code decoding module provided by the embodiment of the present application is provided.

[0033] Figure 6 A check flow schematic diagram of the Hamming code decoding module provided by the embodiment of the present application is provided.

[0034] Figure 7 A data transmission flow schematic diagram of the instruction decryption module provided by the embodiment of the present application is provided.

[0035] Figure 8 A data processing logic schematic diagram of the second round key adding unit provided by the embodiment of the present application is provided.

[0036] Figure 9 A data processing logic schematic diagram of the reverse row displacement unit provided by the embodiment of the present application is provided.

[0037] Figure 10 A data processing logic schematic diagram of the reverse byte substitution unit provided by the embodiment of the present application is provided.

[0038] Figure 11 A data processing logic schematic diagram of the reverse column confusion unit provided by the embodiment of the present application is provided.

[0039] Figure 12 A step flow chart of an implementation method of a storage security and reinforcement system provided by the embodiment of the present application is provided. DETAILED DESCRIPTION

[0040] The present application will be further described below in conjunction with the drawings and specific embodiments. For the step numbers in the following embodiments, they are only set for the convenience of description and explanation, and the order between the steps is not limited in any way, and the execution order of each step in the embodiments can be adaptively adjusted according to the understanding of those skilled in the art.

[0041] In the description of the present application, the meaning of multiple is two or more, and if the first and the second are described, it is only for the purpose of distinguishing technical features, and cannot be understood as indicating or implying relative importance or implicitly indicating the number of indicated technical features or implicitly indicating the sequence of indicated technical features. In addition, unless otherwise defined, all technical and scientific terms used herein have the same meaning as understood by those skilled in the art. The terms used in the specification herein are only for the purpose of describing specific embodiments and are not intended to limit the present application.

[0042] Referring to Figure 1 , the embodiment of the present application provides a storage security and reinforcement system, comprising an instruction encryption module, a Hamming code encoding module, a Hamming code decoding module, an instruction decryption module, a memory and a processor, wherein:

[0043] The instruction encryption module is configured to convert the program to be run into a binary file, separate an instruction part from a data part of the binary file, encrypt the instruction part of the binary file to obtain encrypted instructions, and combine the encrypted instructions with the data part of the binary file to generate an encrypted file.

[0044] The Hamming code encoding module is configured to encode the encrypted file by using Hamming codes to obtain an encoded encrypted file, and store the encoded encrypted file in the memory.

[0045] In the instruction fetching stage, the processor is configured to search for instructions from a corresponding address of the memory, fetch the instruction part of the encoded encrypted file, decode and check the instruction part of the encoded encrypted file by using the Hamming code decoding module to obtain encrypted instructions, and further decrypt the encrypted instructions by using the instruction decryption module to obtain instructions to be executed.

[0046] In the memory accessing stage, the processor is configured to search for data from a corresponding address of the memory, fetch the data part of the encoded encrypted file, decode and check the data part of the encoded encrypted file by using the Hamming code decoding module to obtain data to be accessed, further encode the data to be accessed by using the Hamming code encoding module to obtain the data part of the encoded encrypted file, and store the data part of the encoded encrypted file in the memory.

[0047] Specifically, as shown in FIG. 1, the storage security and reinforcement system can be implemented by combining software and hardware. Figure 1 The Hamming code decoding module, the instruction decryption module, and the Hamming code encoding module of the data to be accessed are implemented by hardware modules.

[0048] The system converts the program to be run into a binary file, separates the instruction part from the data part, encrypts the instruction part based on the AES-128 algorithm, and then combines the data part to generate a new binary file; all instructions and data are processed by interleaving in groups of 4, and then the new file is encoded based on the Hamming code (39, 32) and stored in the storage; after the processor is started, the instruction is searched in the corresponding address of the storage in the instruction fetching stage, because AES-128 needs to process four 32-bit instructions at the same time, four 39-bit data are taken out from the storage each time, the four data are first subjected to the Hamming code decoding module, and then subjected to decoding after interleaving processing, which can correct up to 4 bits of data error in 32 bits of data, which is 4 times the traditional Hamming code error correction capability; the data obtained after decoding enters the decryption module, and four 32-bit original instructions are output after ten rounds of decryption; in the memory access stage, when the processor needs to take out data, the data is searched in the corresponding address of the storage, and four 39-bit data are taken out at the same time, and four 32-bit data are output after passing through the Hamming code decoding module; when the processor needs to store data in the storage, four 32-bit data are stored at the same time, and four 39-bit data are obtained after passing through the Hamming code encoding module and stored in the storage.

[0049] Further, as an optional implementation, the instruction encryption module includes a row displacement unit, a byte substitution unit, a column mixing unit, and a first round key addition unit. The instruction encryption module uses the AES encryption algorithm to encrypt the data to be encrypted. When the encryption round is 0, the data to be encrypted is input to the first round key addition unit and only passes through the first round key addition unit. When the encryption round is one of 1 to 9, the data to be encrypted is input to the byte substitution unit and sequentially passes through the row displacement unit, the column mixing unit, and the first round key addition unit. When the encryption round is 10, the data to be encrypted is input to the byte substitution unit and sequentially passes through the row displacement unit and the first round key addition unit.

[0050] Specifically, the running program is converted into an executable file by a compilation tool chain, and the executable file is converted into a binary file by a tool chain, and the specific tool chain is determined by the selected instruction set. The instructions in the binary file are encrypted by C language, and the encryption algorithm is the advanced encryption standard (AES) algorithm, and the encryption process is as shown in the left part of Figure 2

[0051] ​Further as an optional embodiment, the Hamming code encoding module includes four Hamming code encoders, four 32-bit data continuously input into the Hamming code encoding module are combined into one 128-bit data through a serial-to-parallel circuit, and new four 32-bit data are generated through interleaving processing, then the newly generated four 32-bit data are input into the four Hamming code encoders respectively for Hamming code encoding, four 39-bit data are obtained, and then the four 39-bit data are combined into one 156-bit data and output to the memory from low to high through a parallel-to-serial circuit.

[0052] Specifically, the encrypted instruction is combined with the unencrypted data and then encoded, and the software part of the Hamming code encoding module encodes in the manner as shown in Figure 3 The 0-7 bits, 8-15 bits, 16-23 bits, and 24-31 bits of the four 32-bit numbers P, Q, R, and S are respectively grouped into new four 32-bit numbers, the new 32-bit numbers are encoded using Hamming code (39, 32) to generate four 7-bit check codes E0, E1, E2, and E3, then the new four 32-bit numbers are converted into the original four 32-bit data, and the generated four 7-bit check codes are combined with the newly generated four 32-bit data respectively, at positions 32 to 38. The encoded instruction and data are imported into a memory with a bit width of 39 bits.

[0053] As shown in Figure 4 The hardware part of the Hamming code encoding module mainly includes four Hamming code encoders. Four 32-bit data continuously input into the encoding module are combined into one 128-bit data through a serial-to-parallel circuit, the 128-bit data are divided into four 32-bit data and then sent into the encoders. The encoders encode the input data based on Hamming code (39, 32) and generate 39-bit data, wherein 0 to 31 bits are data bits and 32 to 38 bits are check bits. The four 39-bit encoded data are combined into 156-bit data, and then 39-bit data are output from low to high to the memory through a parallel-to-serial circuit.

[0054] Further as an optional embodiment, the Hamming code decoding module includes four Hamming code decoders, four 39-bit data continuously input into the Hamming code decoding module are combined into one 156-bit data through a serial-to-parallel circuit, and new four 39-bit data are generated through interleaving processing, then the newly generated four 39-bit data are input into the four Hamming code decoders respectively for Hamming code decoding, four 32-bit data are obtained, and then the four 32-bit data are combined into one 128-bit data and output to the processor or the instruction decryption module.

[0055] Specifically, the Hamming code decoding module mainly includes four Hamming code decoders. As shown inFigure 5 As shown, four 39-bit data points continuously input to the encoding module are processed by a serial-to-parallel converter and rearranged into a 156-bit data point. This 156-bit data point is then divided into four 39-bit data points, each fed into a decoder for decoding. The 32-bit data output from the four decoders is recombined into a 128-bit data point, and the valid signal is set to 1. The integrated data and the valid signal are then output through the Hamming code decoding module.

[0056] As a further optional implementation, the Hamming code decoder is equipped with a check matrix. The 39-bit data input to the Hamming code decoder is checked by the check matrix to obtain check information. The check information is compared with the check bits of the input 39-bit data. If they are the same, the check passes and decoding is performed. If they are different, the input 39-bit data is input to the error correction circuit for correction before decoding.

[0057] Specifically, such as Figure 6 As shown, the decoder contains a 7×39 parity check matrix K. The input data is connected to the parity check matrix to generate parity information l, which is compared with the input parity bit E. If they are the same, it proves that the input data is correct. If they are different, it proves that the input data is wrong. The erroneous data is input to the error correction circuit to correct it into correct data. Finally, the correct 32-bit data is output.

[0058] As a further optional implementation, the instruction decryption module includes a reverse row shifting unit, a reverse byte substitution unit, a reverse column obfuscation unit, and a second-round key addition unit. After receiving the data to be decrypted, when the decryption round is 0, the instruction decryption module inputs the data to be decrypted into the second-round key addition unit and only passes through the second-round key addition unit. When the decryption round is one of rounds 1 to 9, the data to be decrypted is input into the reverse row shifting unit and passes through the reverse byte substitution unit, the second-round key addition unit, and the reverse column obfuscation unit in sequence. When the decryption round is 10, the data to be decrypted is input into the reverse row shifting unit and passes through the reverse byte substitution unit and the second-round key addition unit in sequence.

[0059] Specifically, the instruction decryption module is connected to the Hamming code decoding module. The instruction decryption module mainly consists of a reverse row shifting module, a reverse byte substitution module, a reverse column obfuscation module, and a second-round key addition module. The decryption process is as follows: Figure 2 As shown on the right, after the instruction decryption module receives the data, when the round number is 0, the data is input to the second round key addition module and passes through this module only. When the round number is 1 to 9, the data is input to the reverse row shift module and passes through the reverse row shift module, the reverse byte substitution module, the second round key addition module, and the reverse column obfuscation module in sequence. When the round number is 10, the data is input to the reverse row shift module and passes through the reverse row shift module, the reverse byte substitution module, and the second round key addition module in sequence.

[0060] As shown in Figure 7 , the instruction decryption module determines whether the data to be decrypted is the data output by the decoding module or the data output by the register according to the round: when the round is 0 and valid is 1, the decrypted data is the data output by the decoding module; when the round is 1 to 10, the decrypted data is the data output by the register. The instruction decryption module determines the output of the decrypted data according to the round: when the round is 0 to 9, the decrypted data is output to the register and output in the next clock cycle; when the round is 10, the decrypted data is the output of the decryption module. After decryption, the 128-bit data is output as four 32-bit data from low to high to the processor, and valid is set to 1 during data output, and last is set to 1 when the last data is output.

[0061] The processing logic of the second round key addition unit is as shown in Figure 8 , there is a 43x32 matrix M in the second round key addition unit, and the input 128-bit data is divided into four 32-bit data and connected with the matrix M, and is XORed with the corresponding four 32-bit keys in M, and then spliced into 128-bit data.

[0062] Further, as an optional implementation, the reverse row displacement unit is used to arrange the input 128-bit data into a 4x32-bit matrix, keep the first row data of the matrix not moving, circularly shift the second row data of the matrix to the right by one byte, circularly shift the third row data of the matrix to the right by two bytes, circularly shift the fourth row data of the matrix to the right by three bytes, and then splice the row-displaced matrix into new 128-bit data.

[0063] Specifically, the processing logic of the reverse row displacement unit is as shown in Figure 9 , the 128-bit data is arranged in the form of A, B, C, and D four columns from right to left, the displacement mode is as shown in the middle of the figure, the first row data is not moved, the second row data is circularly shifted to the right by one byte, the third row data is circularly shifted to the right by two bytes, and the fourth row data is circularly shifted to the right by three bytes, and after the circular shift is completed, the data is as shown in the left of Figure 9 , and the A, B, C, and D four columns are spliced into 128-bit data from low to high in order.

[0064] Further, as an optional implementation, the reverse byte substitution unit is provided with a 16x16 byte matrix in advance, the 128-bit data input into the reverse byte substitution unit is divided into 16 8-bit data, and the new 8-bit data is formed by taking the elements from the corresponding positions of the byte matrix according to the high 4 bits as the row value and the low 4 bits as the column value, and then the 16 new 8-bit data is spliced into new 128-bit data.

[0065] Specifically, the processing logic of the reverse byte substitution unit is as shown in Figure 10 As shown in the figure, there is a 16x16 byte matrix Q in the reverse byte substitution unit, and the 128-bit data is connected to the matrix after being divided into 16 8-bit data, wherein the high 4 bits of the 8-bit data are used as the row value, the low 4 bits are used as the column value, the elements from the corresponding positions of the matrix are taken as the output, and all the 8-bit data output are spliced into 128-bit data.

[0066] Further, as an optional embodiment, a 4x4-bit matrix is provided in the reverse column confusion unit, the 128-bit data input into the reverse column confusion unit is arranged into a 4x32-bit matrix, the 4x32-bit matrix is multiplied by the 4x4-bit matrix to obtain a new 4x32-bit matrix, and the new 4x32-bit matrix is spliced into new 128-bit data.

[0067] Specifically, the processing logic of the reverse column confusion unit is as shown in Figure 11 As shown in the figure, there is a 4x4-bit matrix R in the reverse column confusion unit, and the input data is connected to the matrix for calculation, and the calculation mode is matrix multiplication, P, Q, R and S are respectively multiplied by the matrix R to obtain P', Q', R' and S', and the four 32-bit data are spliced into 128-bit data.

[0068] The above describes the structure and working principle of the digital converter of the embodiment of the present application, and it can be recognized that the embodiment of the present application has the following advantages:

[0069] 1. The embodiment of the present application designs a storage security and reinforcement system based on AES and Hamming code, adopts a combination of software and hardware, improves the security and reliability of storage, and reduces the overall performance loss.

[0070] 2. In the embodiment of the present application, software is used to directly encrypt instructions and hardware is used to decrypt, which effectively reduces the performance loss, avoids the situation that the encryption program is not protected in pure software encryption, and improves the security; at the same time, based on the characteristics of AES, the hardware decryption circuit in the present application reduces the consumption of hardware resources while maintaining the system clock frequency.

[0071] 3. The embodiment of the present application adopts an interleaved coding mode, and based on Hamming code (39, 32), four groups of 32-bit data are coded and decoded, and the error correction capability of 32-bit data is expanded from correcting 1 and detecting 2 to correcting 4 and detecting 8, which effectively improves the reliability of storage under the same resource consumption condition.

[0072] Referring to Figure 12The embodiment of the present application provides an implementation method of a storage security and reinforcement system, and the method comprises the following steps:

[0073] In S101, input the program to be run, convert the program to be run into a binary file through an instruction encryption module, separate the instruction part from the data part of the binary file, encrypt the instruction part of the binary file to obtain encrypted instructions, combine the encrypted instructions with the data part of the binary file, and generate an encrypted file.

[0074] In S102, encode the encrypted file through a Hamming code encoding module to obtain an encoded encrypted file, and store the encoded encrypted file in a memory.

[0075] In S103, find the instructions of the encoded encrypted file through a processor to the corresponding address of the memory, decode and check the instruction part of the encoded encrypted file through a Hamming code decoding module to obtain encrypted instructions, and decrypt the encrypted instructions through an instruction decryption module to obtain to-be-executed instructions.

[0076] In S104, find the data of the encoded encrypted file through a processor to the corresponding address of the memory, decode and check the data part of the encoded encrypted file through a Hamming code decoding module to obtain to-be-accessed data.

[0077] In S105, encode the to-be-accessed data through a Hamming code encoding module to obtain the data part of the encoded encrypted file, and store the data part of the encoded encrypted file in the memory.

[0078] It can be understood that the contents in the above system embodiment are applicable to the method embodiment, the method embodiment specifically implements the same functions as the above system embodiment, and achieves the same beneficial effects as the above system embodiment.

[0079] It should be appreciated that the embodiments of the present application can be realized or implemented by computer hardware, a combination of hardware and software, or through computer instructions stored in a non-transitory computer readable storage medium. The above method can be implemented in a computer program using standard programming techniques, including a non-transitory computer readable storage medium configured with a computer program, wherein the storage medium thus configured causes a computer to operate in a specific and predefined manner according to the methods described in the specific embodiments and the accompanying drawings. Each program can be implemented in a high-level procedural or object-oriented programming language to communicate with a computer system. However, if necessary, the program can be implemented in assembly or machine language. In any case, the language can be a compiled or interpreted language. In addition, the program can be run on a programmed application-specific integrated circuit for this purpose.

[0080] Furthermore, operations of the processes described herein can be performed in any suitable order unless otherwise indicated herein or otherwise clearly contradicted by context. The processes described herein (or variations and / or combinations thereof) can be implemented under the control of one or more computer systems configured with executable instructions (e.g., computer programs, one or more computer programs, or one or more applications), by hardware, or combinations thereof. The computer programs mentioned above include machine language code that can be executed by one or more processors.

[0081] Further, the methods described above can be implemented in any suitable type of computing platform that is operatively connected to, including but not limited to, a personal computer, a mini-computer, a mainframe, a workstation, a network or distributed computing environment, a stand-alone or integrated computer platform, or in communication with a charged particle tool or other imaging device, and the like. Aspects of the present invention can be implemented in machine readable code stored on a non-transitory storage medium or device, whether removable or integrated into a computing platform, such as a hard disk, an optically readable and / or writable storage medium, RAM, ROM, and the like, such that it can be read by a programmable computer to configure and operate the computer to perform the processes described herein when the storage medium or device is read by the computer. Furthermore, the machine readable code, or portions thereof, can be transmitted over wired or wireless networks. The present invention includes these and other different types of non-transitory computer readable storage media when such media include instructions or programs that implement the steps described above in conjunction with a microprocessor or other data processor. The present invention also includes the computer itself when programmed in accordance with the methods and techniques described herein.

[0082] The computer programs can be applied to input data to perform the functions described herein to transform the input data to generate output data that is stored to non-volatile memory. The output information can also be applied to one or more output devices, such as a display. In preferred embodiments of the present invention, the transformed data represents a physical and tangible object, including a particular visual depiction of a physical and tangible object produced on a display.

[0083] The above description is only preferred embodiments of the present invention, the present invention is not limited to the above-described embodiments, as long as the same means achieve the technical effects of the present invention, any modification, equivalent replacement, improvement, etc. made within the spirit and principles of the present invention shall be included in the scope of protection of the present invention. The technical solutions and / or embodiments of the present invention can have various modifications and changes within the scope of protection.

Claims

1. A storage security and hardening system, characterized in that, It includes an instruction encryption module, a Hamming code encoding module, a Hamming code decoding module, an instruction decryption module, a memory, and a processor, wherein: The instruction encryption module is used to convert the program to be run into a binary file, separate the instruction part and the data part of the binary file, encrypt the instruction part of the binary file to obtain encrypted instructions, and then merge the encrypted instructions with the data part of the binary file to generate an encrypted file. The Hamming code encoding module is used to encode the encrypted file using Hamming code to obtain an encoded encrypted file, and to store the encoded encrypted file in the memory; During the instruction fetching stage, the processor searches for the instruction at the corresponding address in the memory, retrieves the instruction portion of the encoded encrypted file, decodes and verifies the instruction portion of the encoded encrypted file through the Hamming code decoding module to obtain the encrypted instruction, and then decrypts the encrypted instruction through the instruction decryption module to obtain the instruction to be executed. During the memory access phase, the processor is used to look up data at the corresponding address in the memory, retrieve the data portion of the encoded encrypted file, and decode and verify the data portion of the encoded encrypted file through the Hamming code decoding module to obtain the data to be accessed. It is also used to encode the data to be accessed through the Hamming code encoding module to obtain the data portion of the encoded encrypted file, and store the data portion of the encoded encrypted file into the memory.

2. The storage security and hardening system according to claim 1, characterized in that: The instruction encryption module includes a row shift unit, a byte substitution unit, a column obfuscation unit, and a first-round key addition unit. The instruction encryption module uses the AES encryption algorithm to encrypt the data to be encrypted. When the encryption round is 0, the data to be encrypted is input to the first-round key addition unit and passes through the first-round key addition unit only. When the encryption round is one of rounds 1 to 9, the data to be encrypted is input to the byte substitution unit and passes through the row shift unit, the column obfuscation unit, and the first-round key addition unit in sequence. When the encryption round is 10, the data to be encrypted is input to the byte substitution unit and passes through the row shift unit and the first-round key addition unit in sequence.

3. The storage security and hardening system according to claim 1, characterized in that: The Hamming code encoding module includes four Hamming code encoders. Four consecutive 32-bit data inputs to the Hamming code encoding module are merged into a 128-bit data through a serial-to-parallel converter, and then interleaved to generate four new 32-bit data. The four newly generated 32-bit data are then input into the four Hamming code encoders respectively for Hamming code encoding to obtain four 39-bit data. The four 39-bit data are then merged into a 156-bit data and then output into the memory in ascending order through a parallel-to-serial converter.

4. The storage security and hardening system according to claim 1, characterized in that: The Hamming code decoding module includes four Hamming code decoders. Four consecutive 39-bit data inputs to the Hamming code decoding module are combined into a 156-bit data through a serial-to-parallel converter, and then interleaved to generate four new 39-bit data. The four newly generated 39-bit data are then input into the four Hamming code decoders respectively for Hamming code decoding to obtain four 32-bit data. Finally, the four 32-bit data are combined into a 128-bit data and output to the processor or the instruction decryption module.

5. A storage security and hardening system according to claim 4, characterized in that: The Hamming code decoder is equipped with a check matrix. The 39-bit data input to the Hamming code decoder is checked by the check matrix to obtain check information. The check information is compared with the check bits of the input 39-bit data. If they are the same, the check passes and decoding is performed. If they are different, the input 39-bit data is input to the error correction circuit for correction before decoding.

6. A storage security and hardening system according to claim 2, characterized in that: The instruction decryption module includes a reverse row shift unit, a reverse byte substitution unit, a reverse column obfuscation unit, and a second-round key addition unit. After receiving the data to be decrypted, when the decryption round is 0, the instruction decryption module inputs the data to be decrypted into the second-round key addition unit and only passes through the second-round key addition unit. When the decryption round is one of rounds 1 to 9, the data to be decrypted is input into the reverse row shift unit and passes through the reverse byte substitution unit, the second-round key addition unit, and the reverse column obfuscation unit in sequence. When the decryption round is 10, the data to be decrypted is input into the reverse row shift unit and passes through the reverse byte substitution unit and the second-round key addition unit in sequence.

7. A storage security and hardening system according to claim 6, characterized in that: The reverse row shifting unit is used to arrange the input 128-bit data into a 4×32-bit matrix, keeping the data in the first row of the matrix unchanged, rotating the data in the second row of the matrix one byte to the right, rotating the data in the third row of the matrix two bytes to the right, rotating the data in the fourth row of the matrix three bytes to the right, and then concatenating the matrix after row shifting to form a new 128-bit data.

8. A storage security and hardening system according to claim 6, characterized in that: The reverse byte replacement unit is pre-set with a 16×16 byte matrix. The 128 bits of data input to the reverse byte replacement unit are divided into 16 8 bits of data. The high 4 bits of the 8 bits of data are used as the row value and the low 4 bits are used as the column value. Elements are taken from the corresponding positions of the byte matrix to form new 8 bits of data. Then, the 16 new 8 bits of data are concatenated to form a new 128 bits of data.

9. A storage security and hardening system according to claim 6, characterized in that: The reverse column obfuscation unit is pre-configured with a 4×4-bit matrix. The 128-bit data input to the reverse column obfuscation unit is arranged into a 4×32-bit matrix, and the 4×32-bit matrix is ​​multiplied on the left by the 4×4-bit matrix to obtain a new 4×32-bit matrix. The new 4×32-bit matrix is ​​then concatenated to form a new 128-bit data.

10. A method for implementing a storage security and hardening system, used to implement the storage security and hardening system as described in any one of claims 1 to 9, characterized in that, Includes the following steps: Input the program to be run, convert the program to be run into a binary file through the instruction encryption module, separate the instruction part and the data part of the binary file, encrypt the instruction part of the binary file to obtain the encrypted instruction, and then merge the encrypted instruction with the data part of the binary file to generate an encrypted file; The encrypted file is encoded using a Hamming code encoding module to obtain an encoded encrypted file, which is then stored in a memory. The processor searches for the instruction at the corresponding address in the memory, retrieves the instruction portion of the encoded encrypted file, decodes and verifies the instruction portion of the encoded encrypted file using a Hamming code decoding module to obtain the encrypted instruction, and then decrypts the encrypted instruction using an instruction decryption module to obtain the instruction to be executed. The processor searches for data at the corresponding address in the memory, retrieves the data portion of the encoded encrypted file, and decodes and verifies the data portion of the encoded encrypted file through the Hamming code decoding module to obtain the data to be accessed. The Hamming code encoding module encodes the data to be accessed to obtain the data portion of the encoded encrypted file, and then stores the data portion of the encoded encrypted file into the memory.

Images