Hardware encryption module, chip and encryption method

Abstract

The application provides a hardware encryption module, a chip and an encryption method, which comprise a control unit and a storage unit; the control unit is connected with the storage unit, receives an external instruction, judges an encryption state based on an encryption value in an encryption bit address of the storage unit, generates a control time sequence for controlling the storage unit to be erased based on an external erasing instruction, and generates a control time sequence for controlling the storage unit to be read and written based on the encryption state and an external read-write instruction; wherein, when in an encryption mode, only a program area is encrypted to be read out and a write operation on the encryption bit address is prohibited. All encryption behaviors of the application are only effective for the program area and invalid for a data area; the application prevents a user from forcibly decrypting by directly erasing the encryption bit address and powering on again, and prevents the user from forcibly decrypting by re-writing the encryption bit address and powering on again; the application discards a super read mode, effectively improves the security of the chip, and has high application flexibility and high security.

Description

Technical Field

[0001] This invention relates to the field of integrated circuit design, and in particular to a hardware encryption module, chip, and encryption method. Background Technology

[0002] With the concept of information security being widely mentioned by all sectors of society in recent years, the encryption function of chips has received increasing attention as a direct and effective way for users to protect the security of their product data.

[0003] Software encryption methods are widely used due to their simplicity. Existing software encryption generally involves adding an encryption identifier at a fixed location in the chip's storage area. If the encryption identifier is valid, the programmer either returns the encrypted value directly without performing a reading operation, or it still reads the value but returns the encrypted value. This type of software encryption is very easy to crack, has extremely low security, and also has disadvantages such as slow speed and high storage resource consumption.

[0004] Hardware encryption offers advantages such as high encryption speed, strong hardware security, no storage resource consumption, and ease of use, effectively compensating for the shortcomings of software encryption methods and better protecting the intellectual property rights of software within chips, thus avoiding the risk of plagiarism. However, hardware encryption still carries the risk of being forcibly decrypted and subsequently leaked.

[0005] Therefore, how to enhance the security of hardware encryption has become one of the technical problems that urgently need to be solved by those skilled in the art.

[0006] It should be noted that the above introduction to the technical background is only for the purpose of providing a clear and complete explanation of the technical solutions of this application and facilitating understanding by those skilled in the art. It should not be assumed that these technical solutions are known to those skilled in the art simply because they have been described in the background section of this application. Summary of the Invention

[0007] In view of the shortcomings of the prior art described above, the purpose of this invention is to provide a hardware encryption module, chip and encryption method to solve the problem of insufficient hardware encryption security in the prior art.

[0008] To achieve the above and other related objectives, the present invention provides a hardware encryption module, which includes at least:

[0009] A control unit and a storage unit, wherein the storage unit includes a program area and a data area;

[0010] The control unit is connected to the storage unit and receives external instructions. It determines the encryption status based on the encryption value in the encryption address of the storage unit, generates control timing for erasing the storage unit based on external erase instructions, and generates control timing for reading and writing the storage unit based on the encryption status and external read / write instructions. In the encrypted mode, only the program area is encrypted and read out, and writing to the encryption address is prohibited.

[0011] Optionally, the control unit includes an instruction parsing subunit and a timing generation subunit;

[0012] The instruction parsing subunit is connected to the timing generation subunit, generates a program area erase control signal or a data area erase control signal based on the external erase instruction, and generates a read / write control signal based on the encryption state and the external read / write instruction.

[0013] The timing generation subunit is connected to the storage unit and the instruction parsing subunit. It determines the encryption status based on the encryption value in the encryption bit address and generates the control timing of the storage unit based on the control signal output by the instruction parsing subunit.

[0014] Alternatively, the instruction parsing subunit includes an address determination unit and a control signal generation unit;

[0015] The address determination unit determines the address in the external read / write instruction;

[0016] The control signal generation unit is connected to the output of the address judgment unit and the timing generation subunit. It generates an erase control signal based on an external erase instruction and generates a corresponding read / write control signal based on the external read / write instruction, the judgment result of the address judgment unit, and the encryption state.

[0017] Alternatively, the timing generation subunit includes an encryption state determination unit and a timing control generation unit;

[0018] The encryption status determination unit is connected to the storage unit and determines the encryption status based on the comparison result between the encrypted value in the encryption bit address and the preset value.

[0019] The control timing generation unit is connected to the output terminal of the instruction parsing subunit, and generates the control timing of the storage unit based on the control signal output by the instruction parsing subunit.

[0020] Optionally, the data area includes a TRIM area and a user area.

[0021] Alternatively, the encryption bit address is located within the program area.

[0022] Alternatively, the encryption bit address is located at the bottom of the program area.

[0023] To achieve the above and other related objectives, the present invention also provides a chip, the chip comprising at least the above-described hardware encryption module.

[0024] To achieve the above and other related objectives, the present invention also provides an encryption method, the encryption method comprising at least:

[0025] After power-on, the encrypted value in the encrypted bit address is obtained, and the encryption status is determined and updated based on the encrypted value in the encrypted bit address;

[0026] When an external erase command is received, a program area erase control signal or a data area erase control signal is generated based on the external erase command, and the entire program area is erased based on the program area erase control signal or the entire data area is erased based on the data area erase control signal.

[0027] When an external write command is received, the encryption status and the address to be written to are determined. If the address to be written to in encryption mode is an encrypted address, then writing is prohibited; otherwise, the write operation is performed on the corresponding address in the storage unit based on the external write command.

[0028] When an external read command is received, the encryption state and the address to be read are determined. If the address to be read in the encryption mode is located in the program area of ​​the storage unit, the encrypted value at the corresponding address is read out; otherwise, the actual value at the corresponding address in the storage unit is read out based on the external read command.

[0029] Alternatively, the encryption bit address is located at the bottom of the program area.

[0030] Optionally, the method for determining the encryption status includes: comparing the encrypted value in the encryption bit address with a preset value; if the two match, the system is in encryption mode; otherwise, it is in decryption mode.

[0031] As described above, the hardware encryption module, chip, and encryption method of the present invention have the following beneficial effects:

[0032] 1. The hardware encryption module, chip and encryption method of the present invention have two modes in the erasure mode: program area erasure and data area erasure. This simplifies the operation process while meeting the user's usage scenarios. At the same time, the encryption bit address is set in the program area. When erasing the encryption bit, the user must erase the entire program at the same time to prevent forced decryption caused by erasing the encryption bit alone.

[0033] 2. In the write mode, the hardware encryption module, chip and encryption method of the present invention determine the encryption status and address. In the encryption state, the user cannot write to the encryption bit address, thus preventing forced decryption by rewriting the encryption bit data.

[0034] 3. In read mode, the hardware encryption module, chip and encryption method of the present invention determine the encryption status and address. The data area is not affected by the encryption status and can read the correct data at any time. The program area can be read correctly in the decryption state, otherwise the encrypted value in the corresponding address is read.

[0035] 4. The hardware encryption module, chip and encryption method of the present invention abandon the super readout mode (the program area and data area can be read correctly regardless of whether it is in encryption mode), which effectively improves the security of the chip.

[0036] 5. All programming instructions (or programming protocols) in the hardware encryption module, chip and encryption method of the present invention can be disclosed, which facilitates users to develop their own programming tools and greatly improves the application flexibility of the product; at the same time, the strict encryption logic can effectively protect the software in the program area and minimize the possibility of it being decrypted and read. Attached Figure Description

[0037] Figure 1 The diagram shown is a structural schematic of a hardware encryption module.

[0038] Figure 2 The diagram shown is a structural schematic of the hardware encryption module of this invention.

[0039] Figure 3 The diagram shown is a structural schematic of the instruction parsing subunit of this invention.

[0040] Figure 4 The diagram shown is a schematic representation of the timing generation subunit of this invention.

[0041] Figure 5 The diagram shown illustrates the principle of the encryption method of this invention.

[0042] Component designation explanation

[0043] 1 Hardware encryption device

[0044] 11 Control Department

[0045] 111 Instruction Parsing Unit

[0046] 112 Timing Generation Unit

[0047] 12 Storage Department

[0048] 121 Program Area

[0049] 122 TRIM Zone

[0050] 123 User Area

[0051] 2 Hardware encryption module

[0052] 21 Control Unit

[0053] 211 Instruction parsing subunit

[0054] 211a Address Judgment Unit

[0055] 211b Control Signal Generation Unit

[0056] 212 Timing Generation Subunit

[0057] 212a Encryption Status Determination Unit

[0058] 212b Control Timing Generation Unit

[0059] 22 storage units

[0060] 221 Program Area

[0061] Data Area 222

[0062] 222a TRIM area

[0063] 222b User Area Detailed Implementation

[0064] The following specific examples illustrate the implementation of the present invention. Those skilled in the art can easily understand other advantages and effects of the present invention from the content disclosed in this specification. The present invention can also be implemented or applied through other different specific embodiments, and various details in this specification can also be modified or changed based on different viewpoints and applications without departing from the spirit of the present invention.

[0065] Please see Figures 1-5 It should be noted that the illustrations provided in this embodiment are only schematic representations of the basic concept of the present invention. Therefore, the drawings only show the components related to the present invention and are not drawn according to the actual number, shape and size of the components in the actual implementation. In the actual implementation, the form, quantity and proportion of each component can be arbitrarily changed, and the layout of the components may also be more complex.

[0066] like Figure 1The diagram shows a hardware encryption device 1, comprising a control unit 11 and a storage unit 12. The control unit 11 includes an instruction parsing unit 111 and a timing generation unit 112. The instruction parsing unit 111 parses externally input instructions; the timing generation unit 112 generates the control timing for the storage unit 12 based on the signals output by the instruction parsing unit 111. The storage unit 12 is divided into a program area 121, a TRIM area 122, and a user area 123, with the encryption bit addresses planned in the TRIM area 122.

[0067] After the chip powers on, the hardware (the control unit 11) immediately reads and determines the encrypted value in the encrypted address. If the encrypted value in the encrypted address matches the encrypted value set during hardware design, the chip is in encrypted mode; otherwise, the chip is in default decryption mode. When executing the erase instruction of the storage unit 12, the timing generation unit 112 generates corresponding timing to erase any address of the storage unit 12. When executing the write instruction of the storage unit 12, the timing generation unit 112 generates corresponding timing to write to any address of the storage unit 12. When executing the read instruction of the storage unit 12, it can be divided into normal mode and super mode. In normal mode, the data read of the storage unit 12 is restricted by the encryption state. When the chip is in the decrypted state, the data in any address of the storage unit 12 can be read normally. When the chip is in the encrypted state, the data in any address of the storage unit 12 cannot be read normally. In super mode, regardless of whether the chip is in the encrypted state, the data in any address of the storage unit 12 can be read correctly. Entering super mode requires a special instruction to be sent from the outside. This mode is designed mainly to meet the special scenario requirements of users still needing to access the TRIM area 122 or the user area 123 when the chip is encrypted.

[0068] The hardware encryption device 1 has the following problems during operation: 1) Users can forcibly decrypt the chip by directly erasing the encrypted value in the encryption bit address and powering it back on. 2) Users can rewrite the encryption bit data by rewriting the encryption bit address and powering it back on, thereby forcibly decrypting the chip. 3) By analyzing the chip's input signals, there is still a chance to obtain the special instructions for entering super mode, thus posing a risk of data leakage. 4) The programming instructions (or programming protocol) of the hardware encryption device 1 cannot be made public (if made public, the encryption function is useless, as the program area can be programmed and the software code in the program area can be read), therefore users cannot perform software and hardware development on the chip, resulting in poor flexibility and hindering the promotion of MCU products.

[0069] To address the issues of poor security and inflexibility of the aforementioned hardware encryption device 1, this invention proposes a hardware encryption module, chip, and encryption method, the specific solutions of which are described below.

[0070] like Figure 2 As shown, the present invention provides a hardware encryption module 2, the hardware encryption module 2 comprising:

[0071] The control unit 21 and the storage unit 22, wherein the storage unit 22 includes a program area 221 and a data area 222.

[0072] like Figure 2 As shown, the control unit 21 is connected to the storage unit 22 and receives external instructions. It determines the encryption state based on the encryption value in the encryption bit address of the storage unit 22, generates control timing for erasing the storage unit 22 based on external erase instructions, and generates control timing for reading and writing the storage unit 22 based on the encryption state and external read / write instructions. In the encryption mode, only the program area is encrypted and read out, and writing to the encryption bit address is prohibited.

[0073] Specifically, in this embodiment, the external instructions include external erase instructions, external write instructions, and external read instructions; the external erase instructions include the erase area (program area or data area) and erase operation information; the external write instructions include the write address and write operation information; and the external read instructions include the read address and read operation information.

[0074] Specifically, in this embodiment, the control unit 21 includes an instruction parsing subunit 211 and a timing generation subunit 212. The instruction parsing subunit 211 is connected to the timing generation subunit 212, generating a program area erase control signal or a data area erase control signal based on the external erase instruction, and generating read / write control signals (write control signal, read control signal) based on the encryption state and the external read / write instructions (external write instruction, external read instruction). The timing generation subunit 212 is connected to the storage unit 22 and the instruction parsing subunit 211, determining and updating the encryption state based on the encryption value in the encryption bit address after power-on, and generating the control timing of the storage unit 22 based on the control signals output by the instruction parsing subunit 211.

[0075] More specifically, such as Figure 3As shown, as an example, the instruction parsing subunit 211 includes an address judgment unit 211a and a control signal generation unit 211b. The address judgment unit 211a judges the address in the external read / write instruction to distinguish whether the address to be written or read is located in the program area 221 or the data area 222, and outputs a corresponding judgment signal. The control signal generation unit 211b is connected to the output terminals of the address judgment unit 211a and the timing generation subunit 212. It generates an erase control signal based on the external erase instruction. The erase control signal is either a program area erase control signal or a data area erase control signal. The program area erase control signal is used to erase the entire program area 221, and the data area erase control signal is used to erase the entire data area 222. That is, the erase operation can only be performed on the entire area of ​​the program area 221 or the data area 222, and cannot erase a specific address. The control signal generation unit 211b also generates corresponding read / write control signals based on the external read / write instruction, the judgment result of the address judgment unit 211a, and the encryption state.

[0076] More specifically, such as Figure 4 As shown in the figure, as an example, the timing generation subunit 212 includes an encryption state determination unit 212a and a control timing generation unit 212b. The encryption state determination unit 212a is connected to the storage unit 22. It determines the encryption state based on the comparison result between the encrypted value in the encryption bit address and a preset value. When the encrypted value in the encryption bit address matches the preset value (is consistent or satisfies a predetermined relationship), it determines that it is in encryption mode; otherwise, it determines that it is in decryption mode. It outputs a corresponding encryption state signal and feeds it back to the instruction parsing subunit 211. The control timing generation unit 212b is connected to the output terminal of the instruction parsing subunit 211. It generates the control timing of the storage unit 22 based on the control signals (erase control signal, write control signal, or read control signal) output by the instruction parsing subunit 211, thereby completing the read, write, and erase operations of the storage unit 22.

[0077] It should be noted that the encryption status determination unit 212a may be set in the instruction parsing subunit 211 or independently set in the control unit 21 as needed, and is not limited to this embodiment.

[0078] like Figure 2 As shown, the storage unit 22 is controlled by the control unit 21 and is used to store programs and data.

[0079] Specifically, in this embodiment, the storage unit 22 is flash memory. In actual use, any memory that can implement the present invention is applicable to the present invention, and will not be described in detail here.

[0080] Specifically, the storage unit 22 is divided into a program area 221 and a data area 222; further, in this embodiment, the data area 222 is divided into a TRIM area 222a and a user area 222b. The program area 221 is used to store user-developed programs, the TRIM area 222a is used to store calibration data from the chip manufacturer, and the user area 222b is used to store user-defined data. In actual use, the data area 222 can be divided into different areas as needed to achieve specific storage functions, and is not limited to this embodiment.

[0081] Specifically, in this embodiment, the encryption address is located within the program area 221. Therefore, erasing the encrypted value at the encryption address requires simultaneously erasing other information within the program area 221. Even if decryption is achieved, the information in the program area is no longer available, making it impossible to obtain the information (including but not limited to program code) within the program area 221. This further avoids the risk of leakage and improves security. More specifically, since the program code must be continuous and cannot be interrupted, the encryption address is set at the bottom of the program area 221 to maximize storage space. In practical use, if the space occupied by each piece of program code can be determined, the encryption address can be set at any position in the program area 221 without affecting the operation of the program code, and is not limited to this embodiment.

[0082] like Figure 5 As shown, the present invention also provides an encryption method. In this embodiment, the encryption method is implemented based on the hardware encryption module 2. In actual use, any hardware capable of implementing this method is applicable to the present invention and is not limited to this embodiment. The encryption method includes at least:

[0083] 1) After power-on, obtain the encrypted value in the encrypted bit address, and determine and update the encryption status based on the encrypted value in the encrypted bit address.

[0084] Specifically, after power-on, the encrypted value in the encryption address of the storage unit 22 is read by the control unit 21, and the encrypted value in the encrypted address is compared with a preset value. If the two match (are consistent or satisfy a predetermined relationship), it indicates that the device is in encryption mode; otherwise, it indicates that the device is in decryption mode; and a corresponding encryption status signal is generated.

[0085] More specifically, in this embodiment, the determination of the encryption state is completed by the timing generation subunit 212. In actual use, any circuit that can determine the encryption state based on the encryption value in the read encryption bit address is applicable to the present invention and is not limited to this embodiment.

[0086] 21) When an external erase command is received, a program area erase control signal or a data area erase control signal is generated based on the external erase command, and the entire program area 221 is erased based on the program area erase control signal or the entire data area 222 is erased based on the data area erase control signal.

[0087] Specifically, when the external instruction is an erase instruction, the external instruction contains an erase area and erase operation information. Then, the control unit 21 generates a program area erase control signal or a data area erase control signal based on the external instruction. If a program area erase control signal is generated, the program area 221 is erased based on the corresponding control timing. If a data area erase control signal is generated, the data area 222 is erased based on the corresponding control timing.

[0088] Specifically, in the erasure mode, this invention only sets two methods: program area erasure and data area erasure. Program area erasure only erases all program area addresses, and data area erasure only erases all data in TRIM area 222a and user area 222b. Users cannot arbitrarily set the erasure address, which simplifies the operation process while meeting user usage scenarios. As one implementation of this invention, the encryption bit address is located in the program area 221 (further located at the bottom). Users must erase the entire program while erasing the encryption bit to prevent forced decryption caused by erasing the encryption bit alone.

[0089] 22) When an external write command is received, the encryption status and the address to be written are determined. If the address to be written in the encryption mode is an encrypted address, then writing is prohibited; otherwise, the write operation is performed on the corresponding address in the storage unit 22 based on the external write command.

[0090] Specifically, when the external instruction is a write instruction, the encryption state and the write address are determined respectively. In this embodiment, the encryption state is determined first. If it is in decryption mode, the corresponding address in the storage unit 22 (whether it is the program area or the data area) is written based on the external write instruction. If it is in encryption mode, the address to be written is further determined. If the address to be written is an encrypted address, the write operation is prohibited. If the address to be written is a non-encrypted address, the corresponding address in the storage unit 22 (whether it is the program area or the data area) is written based on the external write instruction.

[0091] It should be noted that in actual use, there is no absolute order for encryption status judgment and address judgment. Address judgment can be performed first and then encryption status judgment can be performed, or encryption status judgment and address judgment can be performed simultaneously, as long as the final judgment result is obtained and the corresponding control signal is generated. This embodiment is not limited to this.

[0092] Specifically, in write mode, the present invention determines the encryption state and address. In the encryption state, the user cannot write to the encryption bit address, thus preventing forced decryption by rewriting the encryption bit data.

[0093] 23) When an external read instruction is received, the encryption state and the address to be read are determined. If the address to be read in the encryption mode is located in the program area 221 of the storage unit 22, the encrypted value at the corresponding address is read out; otherwise, the actual value at the corresponding address in the storage unit 22 is read out based on the external read instruction.

[0094] Specifically, when the external instruction is a read instruction, the encryption state and the read address are determined respectively. In this embodiment, the address to be read is first determined. If the address to be read is located in the data area 222, the corresponding address in the data area 222 is read based on the external read instruction to obtain the corresponding actual value. If the address to be read is located in the program area 221, the encryption state is further determined. If it is in decryption mode, the corresponding address in the program area 221 is read based on the external read instruction to obtain the corresponding actual value. If it is in encryption mode, the corresponding address in the program area 221 is read based on the external read instruction to obtain the corresponding encrypted value.

[0095] It should be noted that in actual use, there is no absolute order for encryption status judgment and address judgment. Encryption status judgment can be performed first and then address judgment can be performed, or encryption status judgment and address judgment can be performed simultaneously, as long as the final judgment result is obtained and the corresponding control signal is generated. This embodiment is not limited to this.

[0096] Specifically, in read mode, this invention determines the encryption status and address. The data area is unaffected by the encryption status and can always read the correct data. The program area can be read correctly in the decrypted state; otherwise, the encrypted value at the corresponding address is read. This invention abandons the super read mode, effectively improving chip security. All programming instructions (or programming protocols) in this invention are publicly available, allowing users to develop their own programming tools based on these instructions, improving product application flexibility. Simultaneously, because the program area is encrypted, the risk of it being decrypted and read is reduced.

[0097] The present invention also provides a chip, the chip including at least the hardware encryption module 2, the hardware encryption module 2 being used to implement encryption protection for the chip. In practical use, any electronic product requiring encryption protection can use the hardware encryption module 2 of the present invention, which will not be elaborated here.

[0098] In summary, this invention provides a hardware encryption module, chip, and encryption method, comprising: a control unit and a storage unit, wherein the storage unit includes a program area and a data area; the control unit is connected to the storage unit and receives external instructions, determines the encryption state based on the encryption value in the encryption bit address of the storage unit, generates control timing for erasing the storage unit based on an external erase instruction, and generates control timing for reading and writing the storage unit based on the encryption state and external read / write instructions; wherein, in encryption mode, only the program area is encrypted and read, and writing operations to the encryption bit address are prohibited. The hardware encryption module, chip, and encryption method of this invention primarily protect the program; all encryption actions are only effective for the program area and ineffective for the data area; through partition management of the storage unit, users can still access the data area even in encryption mode. The hardware encryption module, chip, and encryption method of this invention prevent users from forcibly decrypting the chip by directly erasing the encryption bit address and powering on; they also prevent users from forcibly decrypting the chip by rewriting the encryption bit address and powering on; the super read mode is abandoned, effectively improving the chip's security; the product offers high application flexibility and high security. Therefore, this invention effectively overcomes the various shortcomings of the prior art and has high industrial application value.

[0099] The above embodiments are merely illustrative of the principles and effects of the present invention and are not intended to limit the invention. Any person skilled in the art can modify or alter the above embodiments without departing from the spirit and scope of the present invention. Therefore, all equivalent modifications or alterations made by those skilled in the art without departing from the spirit and technical concept disclosed in the present invention should still be covered by the claims of the present invention.

Claims

1. A hardware encryption module, characterized in that, The hardware encryption module includes at least: A control unit and a storage unit, wherein the storage unit includes a program area and a data area; The control unit is connected to the storage unit and receives external instructions. It determines the encryption state based on the encryption value in the encryption address of the encryption bit within the program area of ​​the storage unit. It generates a control timing sequence for erasing the storage unit based on an external erase instruction. When an external erase instruction is received, it generates a program area erase control signal or a data area erase control signal based on the external erase instruction, and erases the entire program area based on the program area erase control signal or the entire data area based on the data area erase control signal. It also generates a control timing sequence for reading and writing the storage unit based on the encryption state and external read / write instructions. Specifically, in encryption mode, only the information in the program area is encrypted and read out, and writing to the encryption address is prohibited.

2. The hardware encryption module according to claim 1, characterized in that: The control unit includes an instruction parsing subunit and a timing generation subunit; The instruction parsing subunit is connected to the timing generation subunit, generates a program area erase control signal or a data area erase control signal based on the external erase instruction, and generates a read / write control signal based on the encryption state and the external read / write instruction. The timing generation subunit is connected to the storage unit and the instruction parsing subunit. It determines the encryption status based on the encryption value in the encryption bit address and generates the control timing of the storage unit based on the control signal output by the instruction parsing subunit.

3. The hardware encryption module according to claim 2, characterized in that: The instruction parsing subunit includes an address determination unit and a control signal generation unit; The address determination unit determines the address in the external read / write instruction; The control signal generation unit is connected to the output of the address judgment unit and the timing generation subunit. It generates an erase control signal based on an external erase instruction and generates a corresponding read / write control signal based on the external read / write instruction, the judgment result of the address judgment unit, and the encryption state.

4. The hardware encryption module according to claim 2, characterized in that: The timing generation subunit includes an encryption state judgment unit and a control timing generation unit; The encryption status determination unit is connected to the storage unit and determines the encryption status based on the comparison result between the encrypted value in the encryption bit address and the preset value. The control timing generation unit is connected to the output terminal of the instruction parsing subunit, and generates the control timing of the storage unit based on the control signal output by the instruction parsing subunit.

5. The hardware encryption module according to claim 1, characterized in that: The data area includes the TRIM area and the user area.

6. The hardware encryption module according to any one of claims 1-5, characterized in that: The encrypted address is located within the program area.

7. The hardware encryption module according to claim 6, characterized in that: The encryption bit address is located at the bottom of the program area.

8. A chip, characterized in that, The chip includes at least the hardware encryption module as described in any one of claims 1-7.

9. An encryption method, characterized in that, The encryption method includes at least: After power-on, the encrypted value in the encrypted bit address in the program area is obtained, and the encryption status is determined and updated based on the encrypted value in the encrypted bit address; When an external erase command is received, a program area erase control signal or a data area erase control signal is generated based on the external erase command, and the entire program area is erased based on the program area erase control signal or the entire data area is erased based on the data area erase control signal. When an external write command is received, the encryption status and the address to be written to are determined. If the address to be written to in encryption mode is an encrypted address, then writing is prohibited; otherwise, the write operation is performed on the corresponding address in the storage unit based on the external write command. When an external read command is received, the encryption state and the address to be read are determined. If the address to be read in the encryption mode is located in the program area of ​​the storage unit, the encrypted value at the corresponding address is read out; otherwise, the actual value at the corresponding address in the storage unit is read out based on the external read command.

10. The encryption method according to claim 9, characterized in that: The encryption bit address is located at the bottom of the program area.

11. The encryption method according to claim 9 or 10, characterized in that: The method for determining the encryption status includes: comparing the encrypted value in the encrypted bit address with a preset value; if the two match, the system is in encryption mode; otherwise, it is in decryption mode.

Images