Data encryption and decryption processing method and device based on BMC, electronic equipment and storage medium

Abstract

Embodiments of the present application relate to a kind of based on BMC data encryption and decryption processing method, device, electronic equipment and storage medium, comprising: obtaining all discrete data encryption and decryption processing module in BMC, all data encryption and decryption processing module is integrated, obtain data processing function module, data processing function module is used to the target data to be processed is encrypted and decrypted scheduling and encryption and decryption processing;Obtain the target data to be processed and the module state information of each data processing module in data processing function module;Determine the processing strategy for target data based on module state information;Target data is processed based on processing strategy.Therefore, the encryption and decryption computing resources of similar cryptographic algorithm are fused, and the encryption and decryption scheduling of different cryptographic algorithm is realized through unified control module, can effectively utilize hardware resource, expand the application range of data security processing, improve the parallelism and flexibility of data security processing.

Description

Technical Field

[0001] The embodiments of the present invention relate to the field of data processing, and in particular to a data encryption and decryption processing method, apparatus, electronic device and storage medium based on BMC. Background Technology

[0002] The Baseboard Management Controller (BMC) is a standalone chip running on the server motherboard. Its internal architecture is sophisticated, primarily used for server monitoring and management. Because the BMC can directly or indirectly control server operation, its internal security mechanisms are crucial. Secure boot is one of the BMC's main functions, involving signature verification and decryption of relevant boot files via a decryption module. However, secure boot functionality is relatively simple, typically implementing decryption for a few cryptographic algorithms, and has a limited lifespan; after booting, it enters a low-power state, failing to effectively utilize hardware resources. On the other hand, to ensure the security of remote data transmission, some BMC chips also encrypt remotely transmitted data. This encryption module, typically implementing encryption for a few cryptographic algorithms, is coupled to the data processing module, enabling or disabling data transmission encryption based on configuration. Therefore, in secure boot and data transmission encryption, the encryption and decryption functions are relatively independent and separate. Computational resources for similar cryptographic algorithms are repeatedly implemented without simultaneous use, and multiple encryption / decryption algorithms are also implemented but not used concurrently. Furthermore, they are deeply embedded in their respective data processing flows, resulting in inflexibility and resource waste. Summary of the Invention

[0003] In view of this, in order to solve the above-mentioned technical problems or some of the technical problems, the present invention provides a data encryption and decryption processing method, apparatus, electronic device and storage medium based on BMC.

[0004] In a first aspect, embodiments of the present invention provide a data encryption / decryption processing method based on BMC, comprising:

[0005] All discrete data encryption and decryption processing modules in BMC are obtained, and all data encryption and decryption processing modules are integrated to obtain a data processing function module. The data processing function module is used to perform encryption and decryption scheduling and encryption and decryption processing on the target data to be processed.

[0006] Obtain the target data to be processed and the module status information of each data processing module in the data processing function module;

[0007] Based on the module status information, a processing strategy for the target data is determined;

[0008] The target data is encrypted and decrypted based on the processing strategy described above.

[0009] In one possible implementation, the method further includes:

[0010] If the module status information meets the data processing status, then the processing strategy is determined to be to encrypt and decrypt the target data;

[0011] If the module status information does not meet the data processing status, then the processing strategy is determined to be to regulate the target data.

[0012] In one possible implementation, the method further includes:

[0013] The module status information includes at least the idle status of the data processing module, the occupied status of the input buffer path, the idle status of the first-in-first-out queue in the buffer path, and the interrupted status of the input channel.

[0014] If the target data is system security startup data, then the system security startup data is obtained through the first path;

[0015] The system's secure startup data is stored in a first-in-first-out queue in an idle buffer path;

[0016] The secure boot data processing module is invoked to sequentially decrypt and verify the system secure boot data stored in the first-in-first-out queue of the buffer path, thereby completing the system secure boot.

[0017] In one possible implementation, the method further includes:

[0018] If the target data is data to be encrypted or decrypted, then obtain the encryption / decryption algorithm corresponding to the data to be encrypted or decrypted;

[0019] Based on the encryption / decryption algorithm, the corresponding target data processing module is determined, and the occupancy status of the input buffer path of the target data processing module is judged.

[0020] If the input buffer path is not occupied, the data to be encrypted or decrypted is obtained through the input buffer path;

[0021] Obtain the idle state of the target data processing module;

[0022] The target data is processed based on the idle state of the target data processing module.

[0023] In one possible implementation, the method further includes:

[0024] If the target data processing module is in an idle state, the data to be encrypted or decrypted is stored in a first-in-first-out queue in an idle buffer path;

[0025] The target data processing module is invoked to perform encryption and decryption processing on the data to be encrypted and decrypted stored in the first-in-first-out queue in the buffer path, so as to obtain the encrypted and decrypted data.

[0026] If the target data processing module is busy, the data to be encrypted or decrypted is cached in the input buffer path, and the data to be encrypted or decrypted is processed when the target data processing module is idle.

[0027] In one possible implementation, the method further includes:

[0028] After the encryption and decryption of the data to be encrypted and decrypted is completed, the encrypted and decrypted data is fed back to the storage address where the data to be encrypted and decrypted was obtained.

[0029] In one possible implementation, the method further includes:

[0030] The corresponding transmission bus is determined based on the target storage address carried by the target data.

[0031] The target data is stored in the target storage address via a defined transmission bus.

[0032] Secondly, embodiments of the present invention provide a data encryption / decryption processing apparatus based on BMC, comprising:

[0033] An integration module is used to acquire all discrete data encryption and decryption processing modules in the BMC, integrate all data encryption and decryption processing modules to obtain a data processing function module, which is used to perform encryption and decryption scheduling and encryption and decryption processing on the target data to be processed.

[0034] The acquisition module is used to acquire the target data to be processed and the module status information of each data processing module in the data processing function module.

[0035] A determination module is used to determine a processing strategy for the target data based on the module status information.

[0036] The processing module is used to encrypt and decrypt the target data based on the processing strategy.

[0037] Thirdly, embodiments of the present invention provide an electronic device, including: a processor and a memory, wherein the processor is configured to execute a BMC-based data encryption / decryption processing program stored in the memory to implement the BMC-based data encryption / decryption processing method described in the first aspect above.

[0038] Fourthly, embodiments of the present invention provide a storage medium, comprising: the storage medium storing one or more programs, the one or more programs being executable by one or more processors to implement the BMC-based data encryption and decryption processing method described in the first aspect above.

[0039] The data encryption / decryption processing scheme based on BMC provided in this invention integrates all discrete data encryption / decryption processing modules in the BMC to obtain a data processing functional module. This module is used for encryption / decryption scheduling and processing of target data; acquiring the target data and module status information of each data processing module within the functional module; determining a processing strategy for the target data based on the module status information; and performing encryption / decryption processing on the target data based on the processing strategy. Compared to existing BMC chips where encryption / decryption and system secure boot functions are independent and separate, resulting in inflexible data processing flows and wasted resources, this scheme analyzes the cryptographic algorithms required during secure boot and data transmission, integrates encryption / decryption computational resources for similar cryptographic algorithms, optimizes data storage before and after encryption / decryption, and uses a unified control module to schedule encryption / decryption for different cryptographic algorithms, forming an independent, dedicated data processing functional module. This decouples the modules from fixed data flows, effectively utilizing hardware resources, expanding the application scope of data security processing, and improving the parallelism and flexibility of data security processing. Attached Figure Description

[0040] Figure 1 This is a schematic diagram of a data encryption and decryption processing architecture based on BMC provided in an embodiment of the present invention;

[0041] Figure 2 This is a flowchart illustrating a data encryption / decryption method based on BMC, as provided in an embodiment of the present invention.

[0042] Figure 3 This is a schematic diagram of the architecture of a data processing functional module provided in an embodiment of the present invention;

[0043] Figure 4 This invention provides a schematic diagram of a data encryption / decryption processing device based on BMC, as provided in an embodiment of the invention.

[0044] Figure 5 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present invention. Detailed Implementation

[0045] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0046] To facilitate understanding of the embodiments of the present invention, further explanations and descriptions will be provided below with reference to the accompanying drawings and specific embodiments. These embodiments do not constitute a limitation on the embodiments of the present invention.

[0047] Figure 1 A schematic diagram of a data encryption / decryption processing architecture based on BMC is provided for an embodiment of the present invention, as shown below. Figure 1 As shown, the discrete data processing modules (encryption / decryption calculation modules) in the BMC are centrally integrated into the data processing functional module (Security module). This reuses encryption and decryption calculation resources for similar algorithms and shares storage resources before and after encryption / decryption. Through time-sharing processing and categorized control of data from different pathways, the security processing requirements of each functional module in the BMC are met. Here, "Server" represents the server side, interconnected with the BMC chip via buses such as LPC, ESPI, and PCIE. In the BMC chip, the bus interconnect module Crossbar enables interactive processing of high-speed bus signal transmission between master and slave modules. The CPU and high-speed peripherals are directly mounted on the Crossbar, while low-speed peripherals are connected through the bus bridging module BusConverter to complete the high- and low-speed bus signal conversion.

[0048] The integrated Security module is more flexible and no longer limited to a single module. It can be extended to support multiple data processing schemes, as follows:

[0049] Direct connection path ①: This path supports direct data connection between the fixed-function data security processing module and the Security module. For example, the secure boot module operates first when the system powers on to ensure system file security. In this embodiment, the secure boot module only retains the system secure boot control logic of traditional applications; the algorithm-related data security processing is integrated into the Security module. In practical applications, the workflow of the secure boot module remains consistent with traditional applications, except that the acquired ciphertext data blocks and key information are transferred to the Security module for processing via path ①. After processing, the result is fed back, completing the secure boot verification. Path ① can be expanded to support the direct connection encryption and decryption function requirements of other peripheral modules.

[0050] Bus Channel ②: This channel supports configuration of encryption and decryption functions for the Security module under various application scenarios via the bus, such as encryption / decryption algorithm function mode, key information, data path mode, DDR path read data start address, return data start address, data length, etc. Configuration information follows a custom configuration frame format. Furthermore, this channel also supports small-scale data to be encrypted / decrypted via bus scheduling. The Security module distinguishes data based on a set tag (e.g., ID value in the AXI bus protocol), and the processing result can be fed back through interrupt triggering or other methods after encryption / decryption is completed.

[0051] DDR Channel ③: This channel supports direct read and write operations by the Security module to data in DDR. The Security module can be considered an accelerator for encryption and decryption security processing on the server side, BMCCPU, or other peripherals that can emulate DDR storage. It can store data to be processed in DDR via DMA mode, configure relevant information through the bus channel, and after processing, the Security module writes the data back to DDR and triggers the corresponding interrupt signal. DMA mode can free up CPU resources when using large amounts of data.

[0052] Network output channel ④: This channel supports direct remote transmission of data encrypted and decrypted by the Security module via EMAC.

[0053] Figure 2 This is a flowchart illustrating a data encryption / decryption method based on BMC, as provided in an embodiment of the present invention. Figure 2 As shown, the method specifically includes:

[0054] S21. Obtain all discrete data encryption and decryption processing modules in BMC, integrate all data encryption and decryption processing modules to obtain a data processing function module, which is used to perform encryption and decryption scheduling and encryption and decryption processing on the target data to be processed.

[0055] In this embodiment of the invention, the discrete data processing modules (encryption / decryption calculation modules) in the BMC are centrally integrated into a data processing functional module (Security module). Encryption and decryption calculation resources for similar algorithms are reused, and storage resources before and after encryption / decryption are shared. Through time-sharing processing and categorized control of data from different pathways, the security processing requirements of each functional module in the BMC are met. Here, "Server" represents the server side, interconnected with the BMC chip via buses such as LPC, ESPI, and PCIE. In the BMC chip, the bus interconnect module Crossbar enables interactive processing of high-speed bus signal transmission between master and slave modules. The CPU and high-speed peripherals are directly mounted on the Crossbar, while low-speed peripherals are connected through the bus bridging module BusConverter to complete the high- and low-speed bus signal conversion.

[0056] To maintain the independence of the Security module and decouple it from unrelated logic, the Security module only includes encryption / decryption function modules for each algorithm and data stream storage control modules. Its architecture is as follows: Figure 3 As shown, the encryption and decryption module integrates the encryption and decryption algorithm functions involved in various modules in traditional solutions, such as ASE and RSA algorithms. The encryption and decryption processes of each algorithm are generally not used simultaneously, and their calculation processes are similar or reversible. Therefore, when implementing the algorithm, each encryption and decryption algorithm can share a set of calculation logic, and multiple encryption and decryption algorithms can share the front and back storage resources, which can significantly reduce resource consumption and reduce chip area.

[0057] The Config module receives and parses the configuration information of the bus channel, providing it to the Data_Ctrl module and the encryption / decryption module. The State module updates and provides feedback on the Security module's status in real time, such as whether each algorithm module is idle, whether the input buffer path is occupied, the empty / full status of the input / output FIFO (first-in-first-out queue in the buffer path), and the interrupt status of the three input channels. The Security module completes data interaction and data processing based on the status information. The input / output FIFO serves as a buffer for data input and output before and after encryption / decryption, and also completes clock conversion and data bit width processing between data interaction and data processing modules. The encryption / decryption module is designed for high-speed data pipeline processing; therefore, the FIFO only needs to buffer a few sets of data as required, without occupying excessive resources. Each input / output FIFO can support secure processing of one channel of data, and multiple paths can support parallel processing of multiple channels of data with different encryption / decryption algorithms. The number of secure processing channels can be set according to the number of security processing algorithms and the encryption / decryption frequency in the actual application. This embodiment of the invention uses a two-channel input / output FIFO for illustration.

[0058] S22. Obtain the target data to be processed and the module status information of each data processing module in the data processing function module.

[0059] The target data to be processed is acquired, which carries a target memory address. For example, if the CPU sends data to DDR, the target memory address is the DDR's IP address. After acquiring the target data, the corresponding transmission bus (DDR channel ③) is determined based on the target memory address carried by the target data; the target data is then stored in the target memory address through the determined transmission bus.

[0060] Furthermore, the module status information of each data processing module in the data processing function module (Security module) is obtained. This module status information includes, but is not limited to: the idle status of the data processing module, the occupancy status of the input buffer path, the idle status of the first-in-first-out queue in the buffer path, and the interruption status of the input channel. Based on the module status information, it can be determined whether the target data can be processed.

[0061] S23. Determine the processing strategy for the target data based on the module status information.

[0062] If the module status information meets the data processing requirements, the processing strategy is determined to process the target data. For example, if the data processing module is idle, the input buffer path is not occupied, the first-in-first-out queue in the buffer path is idle, and there is no feedback interruption in the input channel, then the target data can be processed immediately.

[0063] Optionally, if the module status information does not meet the data processing status, the processing strategy is determined to be to regulate the target data. For example, if the data processing module is in a busy state, the input buffer path is occupied, the first-in-first-out queue in the buffer path is full of data, or the input channel feedback is interrupted, the target data can be regulated, including buffering it in the input buffer path or buffering it in the first-in-first-out queue of a buffer path that is not full of data.

[0064] S24. The target data is encrypted or decrypted based on the processing strategy.

[0065] If the target data is system secure startup data, then the system secure startup data is obtained through the first path; the system secure startup data is stored in the first-in-first-out queue in the idle buffer path; the secure startup data processing module is called to sequentially decrypt and verify the system secure startup data stored in the first-in-first-out queue in the buffer path, and the system secure startup is completed.

[0066] Specifically, the Data_Ctrl module receives and allocates data from each channel to the encryption / decryption module for processing based on the configuration information in the Config (e.g., encryption / decryption algorithm function mode, key information, data path mode, DDR path read data start address, return data start address, data length, etc.) and the status information in the State module. When the system powers on, only the secure boot module operates. Data related to secure boot (e.g., information to be verified, including file integrity and signature verification) interacts with the Security module via path ①. At this time, both FIFOs of the Security module are idle, supporting parallel processing. For example, secure boot signature and decryption can proceed in parallel, with sequential decryption and verification results, facilitating rapid system startup. When the system has completed startup and is operating normally, the secure boot function can be in low-power mode. When there is no encryption / decryption requirement, the Security module is idle and can be in low-power mode.

[0067] Optionally, if the target data is data to be encrypted or decrypted, the encryption / decryption algorithm corresponding to the data to be encrypted or decrypted is obtained; the corresponding target data processing module is determined based on the encryption / decryption algorithm, and the occupancy status of the input buffer path of the target data processing module is determined; if the input buffer path is not occupied, the data to be encrypted or decrypted is obtained through the input buffer path.

[0068] Furthermore, the idle state of the target data processing module is obtained; if the target data processing module is in an idle state, the data to be encrypted / decrypted is stored in the first-in-first-out queue of the idle buffer path; the target data processing module is called to process the data to be encrypted / decrypted stored in the first-in-first-out queue of the buffer path to obtain the encrypted / decrypted data;

[0069] Optionally, if the target data processing module is busy, the data to be encrypted or decrypted is cached in the input buffer path, and the data to be encrypted or decrypted is processed when the target data processing module is idle.

[0070] Specifically, when the bus initiates encryption / decryption configuration, the Config module parses the relevant information, the DATA_Ctrl module controls the data to be processed to the idle FIFO input path, and when the input FIFO detects that there is data to be processed, the encryption / decryption module completes the encryption / decryption data processing according to the configuration. The result is buffered in the output FIFO, the status information during the processing is updated in real time, and corresponding interrupts are initiated. After the data to be encrypted / decrypted is processed, the obtained encrypted / decrypted data result is finally written back to DDR, returned to the corresponding peripheral device, read from the bus, or forwarded to EMAC for remote transmission.

[0071] This invention integrates the various encryption and decryption algorithms involved in the discrete data processing modules of traditional solutions into a single, independent security processing module (data processing function module). On the one hand, it can reuse the encryption and decryption computation resources of similar algorithms, optimize and reuse the storage resources before and after encryption and decryption of multiple algorithms, and significantly reduce resource consumption and chip area. On the other hand, it can decouple the various encryption and decryption algorithms from the data flow embedded in each module, and realize the encryption and decryption scheduling of different algorithms through a unified control module, which can expand the application scope of data security processing and improve the parallelism and flexibility of data security processing.

[0072] The data encryption / decryption processing method based on BMC provided in this invention integrates all discrete data encryption / decryption processing modules in the BMC to obtain a data processing functional module. This module is used for encryption / decryption scheduling and processing of target data. It acquires the target data and the module status information of each data processing module within the functional module; determines a processing strategy for the target data based on the module status information; and performs encryption / decryption processing on the target data based on the processing strategy. Compared to existing BMC chips where encryption / decryption and system secure boot functions are independent and separate, resulting in inflexible data processing flows and wasted resources, this method analyzes the cryptographic algorithms required during secure boot and data transmission, integrates encryption / decryption computational resources for similar cryptographic algorithms, optimizes data storage before and after encryption / decryption, and uses a unified control module to schedule encryption / decryption for different cryptographic algorithms, forming an independent, dedicated data processing functional module. This decouples the module from fixed data flows, effectively utilizing hardware resources, expanding the application scope of data security processing, and improving the parallelism and flexibility of data security processing.

[0073] Figure 4 This invention provides a schematic diagram of a data encryption / decryption processing device based on BMC, as shown in the embodiment of the invention. Figure 4 As shown, it specifically includes:

[0074] Integration module 401 is used to obtain all discrete data encryption and decryption processing modules in BMC, integrate all data encryption and decryption processing modules to obtain a data processing function module, which is used to perform encryption and decryption scheduling and encryption and decryption processing on the target data to be processed.

[0075] The acquisition module 402 is used to acquire the target data to be processed and the module status information of each data processing module in the data processing function module;

[0076] The determination module 403 is used to determine a processing strategy for the target data based on the module status information.

[0077] The processing module 404 is used to perform encryption and decryption processing on the target data based on the processing strategy.

[0078] In one possible implementation, the acquisition module 402 is further configured to determine the corresponding transmission bus based on the target storage address carried by the target data; and to store the target data into the target storage address through the determined transmission bus.

[0079] In one possible implementation, the determining module 403 is further configured to determine the processing strategy as encrypting or decrypting the target data if the module status information satisfies the data processing status; and to determine the processing strategy as regulating the target data if the module status information does not satisfy the data processing status.

[0080] In one possible implementation, the processing module 404 is further configured to: if the target data is system secure startup data, obtain the system secure startup data through a first path; store the system secure startup data in a first-in-first-out queue in an idle buffer path; and call the secure startup data processing module to sequentially decrypt and verify the system secure startup data stored in the first-in-first-out queue in the buffer path, thereby completing the system secure startup.

[0081] In one possible implementation, the processing module 404 is further configured to: if the target data is data to be encrypted or decrypted, obtain the encryption / decryption algorithm corresponding to the data to be encrypted or decrypted; determine the corresponding target data processing module based on the encryption / decryption algorithm, and determine the occupancy status of the input buffer path of the target data processing module; if the input buffer path is not occupied, obtain the data to be encrypted or decrypted through the input buffer path; obtain the idle status of the target data processing module; and process the target data based on the idle status of the target data processing module.

[0082] In one possible implementation, the processing module 404 is further configured to: if the target data processing module is in an idle state, store the data to be encrypted / decrypted in a first-in-first-out queue in an idle buffer path; call the target data processing module to perform data encryption / decryption processing on the data to be encrypted / decrypted stored in the first-in-first-out queue in the buffer path to obtain encrypted / decrypted data; if the target data processing module is in a busy state, cache the data to be encrypted / decrypted in an input buffer path, and wait for the target data processing module to be in an idle state before performing data encryption / decryption processing on the data to be encrypted / decrypted.

[0083] In one possible implementation, the processing module 404 is further configured to, after completing the data encryption and decryption processing of the data to be encrypted and decrypted, feed back the obtained encrypted and decrypted data to the storage address where the data to be encrypted and decrypted was obtained.

[0084] The BMC-based data encryption / decryption processing device provided in this embodiment can be as follows: Figure 4 The BMC-based data encryption and decryption processing device shown can perform operations such as... Figure 2 This involves all steps of the BMC-based data encryption and decryption processing method, thereby achieving... Figure 2 The technical effects of the BMC-based data encryption and decryption processing method shown are detailed in the provided text. Figure 2 The relevant descriptions are presented concisely and will not be elaborated upon here.

[0085] Figure 5 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present invention. Figure 5 The illustrated electronic device 500 includes at least one processor 501, a memory 502, at least one network interface 504, and other user interfaces 503. The various components in the electronic device 500 are coupled together via a bus system 505. It is understood that the bus system 505 is used to implement communication between these components. In addition to a data bus, the bus system 505 also includes a power bus, a control bus, and a status signal bus. However, for clarity, ... Figure 5 The general designated all buses as Bus System 505.

[0086] The user interface 503 may include a display, keyboard, or clicking device (e.g., mouse, trackball, touchpad, or touchscreen).

[0087] It is understood that the memory 502 in the embodiments of the present invention can be volatile memory or non-volatile memory, or may include both volatile and non-volatile memory. The non-volatile memory can be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), or flash memory. The volatile memory can be random access memory (RAM), which is used as an external cache. By way of example, but not limitation, many forms of RAM are available, such as Static Random Access Memory (SRAM), Dynamic Random Access Memory (DRAM), Synchronous DRAM (SDRAM), Double Data Rate SDRAM (DDRSDRAM), Enhanced Synchronous DRAM (ESDRAM), Synchronous Link DRAM (SLDRAM), and Direct Rambus RAM (DRRAM). The memory 502 described herein is intended to include, but is not limited to, these and any other suitable types of memory.

[0088] In some implementations, memory 502 stores elements, executable units or data structures, or subsets thereof, or extended sets thereof: operating system 5021 and application program 5022.

[0089] The operating system 5021 includes various system programs, such as the framework layer, core library layer, and driver layer, used to implement various basic business functions and handle hardware-based tasks. The application program 5022 includes various applications, such as a media player and a browser, used to implement various application functions. The program implementing the method of this embodiment can be included in the application program 5022.

[0090] In this embodiment of the invention, by calling the program or instructions stored in memory 502, specifically the program or instructions stored in application program 5022, processor 501 executes the method steps provided in each method embodiment, including, for example:

[0091] All discrete data encryption / decryption processing modules in the BMC are obtained, and all data encryption / decryption processing modules are integrated to obtain a data processing function module. The data processing function module is used to schedule and process encryption / decryption of the target data to be processed. The target data to be processed and the module status information of each data processing module in the data processing function module are obtained. Based on the module status information, a processing strategy for the target data is determined. The target data is then encrypted / decrypted based on the processing strategy.

[0092] In one possible implementation, if the module status information meets the data processing status, the processing strategy is determined to be to encrypt and decrypt the target data; if the module status information does not meet the data processing status, the processing strategy is determined to be to regulate the target data.

[0093] In one possible implementation, the module status information includes at least the idle status of the data processing module, the occupied status of the input buffer path, the idle status of the first-in-first-out queue in the buffer path, and the interruption status of the input channel. If the target data is system secure startup data, the system secure startup data is obtained through the first path; the system secure startup data is stored in the first-in-first-out queue in the idle buffer path; the secure startup data processing module is invoked to sequentially decrypt and verify the system secure startup data stored in the first-in-first-out queue in the buffer path, thereby completing the system secure startup.

[0094] In one possible implementation, if the target data is data to be encrypted or decrypted, then the encryption / decryption algorithm corresponding to the data to be encrypted or decrypted is obtained; based on the encryption / decryption algorithm, the corresponding target data processing module is determined, and the occupancy status of the input buffer path of the target data processing module is determined; if the input buffer path is not occupied, then the data to be encrypted or decrypted is obtained through the input buffer path; the idle status of the target data processing module is obtained; and the target data is processed based on the idle status of the target data processing module.

[0095] In one possible implementation, if the target data processing module is idle, the data to be encrypted / decrypted is stored in a first-in-first-out queue in an idle buffer path; the target data processing module is then invoked to perform data encryption / decryption processing on the data to be encrypted / decrypted stored in the first-in-first-out queue in the buffer path to obtain encrypted / decrypted data; if the target data processing module is busy, the data to be encrypted / decrypted is cached in an input buffer path, waiting for the target data processing module to be idle before performing data encryption / decryption processing on the data to be encrypted / decrypted.

[0096] In one possible implementation, after the encryption and decryption of the data to be encrypted and decrypted is completed, the obtained encrypted and decrypted data is fed back to the storage address where the data to be encrypted and decrypted was obtained.

[0097] In one possible implementation, a corresponding transmission bus is determined based on the target storage address carried by the target data; the target data is then stored in the target storage address via the determined transmission bus.

[0098] The methods disclosed in the above embodiments of the present invention can be applied to or implemented by processor 501. Processor 501 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by the integrated logic circuit of the hardware in processor 501 or by instructions in the form of software. The processor 501 may be a general-purpose processor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. It can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of the present invention. The general-purpose processor may be a microprocessor or any conventional processor. The steps of the methods disclosed in the embodiments of the present invention can be directly embodied in the execution of a hardware decoding processor, or executed by a combination of hardware and software units in the decoding processor. The software units may be located in random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, registers, or other mature storage media in the art. The storage medium is located in memory 502. Processor 501 reads the information in memory 502 and, in conjunction with its hardware, completes the steps of the above method.

[0099] It is understood that the embodiments described herein can be implemented in hardware, software, firmware, middleware, microcode, or a combination thereof. For hardware implementation, the processing unit can be implemented in one or more application-specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field-programmable gate arrays (FPGAs), general-purpose processors, controllers, microcontrollers, microprocessors, other electronic units for performing the functions described herein, or combinations thereof.

[0100] For software implementation, the techniques described herein can be implemented by units that perform the functions described herein. The software code can be stored in memory and executed by a processor. The memory can be implemented in the processor or external to the processor.

[0101] The electronic device provided in this embodiment may be as follows: Figure 5 The electronic device shown can perform the following: Figure 2 This involves all steps of the BMC-based data encryption and decryption processing method, thereby achieving... Figure 2 The technical effects of the BMC-based data encryption and decryption processing method shown are detailed in the provided text. Figure 2 The relevant descriptions are presented concisely and will not be elaborated upon here.

[0102] This invention also provides a storage medium (computer-readable storage medium). This storage medium stores one or more programs. The storage medium may include volatile memory, such as random access memory; the memory may also include non-volatile memory, such as read-only memory, flash memory, hard disk, or solid-state drive; the memory may also include combinations of the above types of memory.

[0103] When one or more programs in the storage medium can be executed by one or more processors to implement the BMC-based data encryption and decryption processing method executed on the electronic device side.

[0104] The processor is used to execute a BMC-based data encryption / decryption processing program stored in the memory to implement the following steps of the BMC-based data encryption / decryption processing method executed on the electronic device side:

[0105] All discrete data encryption / decryption processing modules in the BMC are obtained, and all data encryption / decryption processing modules are integrated to obtain a data processing function module. The data processing function module is used to schedule and process encryption / decryption of the target data to be processed. The target data to be processed and the module status information of each data processing module in the data processing function module are obtained. Based on the module status information, a processing strategy for the target data is determined. The target data is then encrypted / decrypted based on the processing strategy.

[0106] In one possible implementation, if the module status information meets the data processing status, the processing strategy is determined to be to encrypt and decrypt the target data; if the module status information does not meet the data processing status, the processing strategy is determined to be to regulate the target data.

[0107] In one possible implementation, the module status information includes at least the idle status of the data processing module, the occupied status of the input buffer path, the idle status of the first-in-first-out queue in the buffer path, and the interruption status of the input channel. If the target data is system secure startup data, the system secure startup data is obtained through the first path; the system secure startup data is stored in the first-in-first-out queue in the idle buffer path; the secure startup data processing module is invoked to sequentially decrypt and verify the system secure startup data stored in the first-in-first-out queue in the buffer path, thereby completing the system secure startup.

[0108] In one possible implementation, if the target data is data to be encrypted or decrypted, then the encryption / decryption algorithm corresponding to the data to be encrypted or decrypted is obtained; based on the encryption / decryption algorithm, the corresponding target data processing module is determined, and the occupancy status of the input buffer path of the target data processing module is determined; if the input buffer path is not occupied, then the data to be encrypted or decrypted is obtained through the input buffer path; the idle status of the target data processing module is obtained; and the target data is processed based on the idle status of the target data processing module.

[0109] In one possible implementation, if the target data processing module is idle, the data to be encrypted / decrypted is stored in a first-in-first-out queue in an idle buffer path; the target data processing module is then invoked to perform data encryption / decryption processing on the data to be encrypted / decrypted stored in the first-in-first-out queue in the buffer path to obtain encrypted / decrypted data; if the target data processing module is busy, the data to be encrypted / decrypted is cached in an input buffer path, waiting for the target data processing module to be idle before performing data encryption / decryption processing on the data to be encrypted / decrypted.

[0110] In one possible implementation, after the encryption and decryption of the data to be encrypted and decrypted is completed, the obtained encrypted and decrypted data is fed back to the storage address where the data to be encrypted and decrypted was obtained.

[0111] In one possible implementation, a corresponding transmission bus is determined based on the target storage address carried by the target data; the target data is then stored in the target storage address via the determined transmission bus.

[0112] Those skilled in the art will further recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of this invention.

[0113] The steps of the methods or algorithms described in conjunction with the embodiments disclosed herein can be implemented in hardware, a software module executed by a processor, or a combination of both. The software module can be located in random access memory (RAM), main memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disk, removable disk, CD-ROM, or any other form of storage medium known in the art.

[0114] The specific embodiments described above further illustrate the purpose, technical solution, and beneficial effects of the present invention. It should be understood that the above description is only a specific embodiment of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A data encryption / decryption method based on BMC, characterized in that, include: All discrete data encryption and decryption processing modules in BMC are obtained, and all data encryption and decryption processing modules are integrated to obtain a data processing function module. The data processing function module is used to perform encryption and decryption scheduling and encryption and decryption processing on the target data to be processed. Obtain the target data to be processed and the module status information of each data processing module in the data processing function module; Based on the module status information, a processing strategy for the target data is determined; The target data is encrypted and decrypted based on the processing strategy described above. The step of determining the processing strategy for the target data based on the module status information includes: If the module status information meets the data processing status, then the processing strategy is determined to be to encrypt and decrypt the target data; If the module status information does not meet the data processing status, then the processing strategy is determined to be to regulate the target data; The module status information includes at least the idle status of the data processing module, the occupied status of the input buffer path, the idle status of the first-in-first-out queue in the buffer path, and the interrupted status of the input channel. The module status information that satisfies the data processing status includes the following scenarios: the data processing module is in an idle state, the input buffer path is not occupied, the first-in-first-out queue in the buffer path is in an idle state, and there is no feedback interruption in the input channel; the module status information that does not satisfy the data processing status includes the following scenarios: the data processing module is in a busy state, the input buffer path is occupied, the first-in-first-out queue in the buffer path is full of data, and there is an input channel feedback interruption.

2. The method according to claim 1, characterized in that, The encryption and decryption processing of the target data based on the processing strategy includes: If the target data is system security startup data, then the system security startup data is obtained through the first path; The system's secure startup data is stored in a first-in-first-out queue in an idle buffer path; The secure boot data processing module is invoked to sequentially decrypt and verify the system secure boot data stored in the first-in-first-out queue of the buffer path, thereby completing the system secure boot.

3. The method according to claim 2, characterized in that, The encryption and decryption processing of the target data based on the processing strategy includes: If the target data is data to be encrypted or decrypted, then obtain the encryption / decryption algorithm corresponding to the data to be encrypted or decrypted; Based on the encryption / decryption algorithm, the corresponding target data processing module is determined, and the occupancy status of the input buffer path of the target data processing module is judged. If the input buffer path is not occupied, the data to be encrypted or decrypted is obtained through the input buffer path; Obtain the idle state of the target data processing module; The target data is processed based on the idle state of the target data processing module.

4. The method according to claim 3, characterized in that, The processing of the target data based on the idle state of the target data processing module includes: If the target data processing module is in an idle state, the data to be encrypted or decrypted is stored in a first-in-first-out queue in an idle buffer path; The target data processing module is invoked to perform encryption and decryption processing on the data to be encrypted and decrypted stored in the first-in-first-out queue in the buffer path, so as to obtain the encrypted and decrypted data. If the target data processing module is busy, the data to be encrypted or decrypted is cached in the input buffer path, and the data to be encrypted or decrypted is processed when the target data processing module is idle.

5. The method according to claim 4, characterized in that, The method further includes: After the encryption and decryption of the data to be encrypted and decrypted is completed, the encrypted and decrypted data is fed back to the storage address where the data to be encrypted and decrypted was obtained.

6. The method according to claim 1, characterized in that, After acquiring the target data to be processed, the method further includes: The corresponding transmission bus is determined based on the target storage address carried by the target data. The target data is stored in the target storage address via a defined transmission bus.

7. A data encryption / decryption processing device based on BMC, characterized in that, include: An integration module is used to acquire all discrete data encryption and decryption processing modules in the BMC, integrate all data encryption and decryption processing modules to obtain a data processing function module, which is used to perform encryption and decryption scheduling and encryption and decryption processing on the target data to be processed. The acquisition module is used to acquire the target data to be processed and the module status information of each data processing module in the data processing function module. A determination module is used to determine a processing strategy for the target data based on the module status information. The processing module is used to encrypt and decrypt the target data based on the processing strategy. The determining module is further configured to determine the processing strategy as encrypting / decrypting the target data if the module status information satisfies the data processing status; and to determine the processing strategy as regulating the target data if the module status information does not satisfy the data processing status. The module status information includes at least the idle status of the data processing module, the occupied status of the input buffer path, the idle status of the first-in-first-out queue in the buffer path, and the interrupted status of the input channel. The module status information that satisfies the data processing status includes the following scenarios: the data processing module is in an idle state, the input buffer path is not occupied, the first-in-first-out queue in the buffer path is in an idle state, and there is no feedback interruption in the input channel; the module status information that does not satisfy the data processing status includes the following scenarios: the data processing module is in a busy state, the input buffer path is occupied, the first-in-first-out queue in the buffer path is full of data, and there is an input channel feedback interruption.

8. An electronic device, characterized in that, include: A processor and a memory, the processor being configured to execute a BMC-based data encryption / decryption processing program stored in the memory to implement the BMC-based data encryption / decryption processing method according to any one of claims 1 to 6.

9. A storage medium, characterized in that, The storage medium stores one or more programs, which can be executed by one or more processors to implement the BMC-based data encryption and decryption processing method according to any one of claims 1 to 6.

Images