Data protection method and device based on FPGA
By comparing the target address and the DNA encryption value of the FPGA module, the data protection problem of FPGA storage module is solved, effective control of data access rights is achieved, and the security of important data is ensured.
Patent Information
- Application Number
- CN202411174064.3
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-08-26
- Publication Date
- 2024-12-13
AI Technical Summary
The prior art cannot effectively protect the data in the module built with FPGAs for storing important data, and users can access the risk of data leakage at will.
By obtaining the DNA encryption value of the target address and the DNA encryption value of the FPGA module, access is allowed if it matches, otherwise access requests are denied. The DNA encryption value is generated using SM3 hash algorithm and key operation to ensure data protection.
Effectively determine whether the target address has access rights, prevent unauthorized data access, and ensure the security of important data.
Smart Images
Figure CN119128935A_ABST
Abstract
Description
Technical Field
[0001] The present application relates to the field of data processing technology, and in particular to a data protection method and device based on FPGA. Background Art
[0002] With the rapid development of FPGA in the communication, aerospace, medical and other industries, more and more companies use FPGA to build modules for storing important data. In the prior art, users can access the module built by FPGA to store important data, resulting in the data in the module cannot be effectively protected.
[0003] In summary, how to effectively protect important data in a module for storing important data constructed using FPGA is a problem that those skilled in the art need to solve urgently. Summary of the invention
[0004] In view of this, the present application provides a data protection method and device based on FPGA, aiming to effectively protect important data in a module constructed using FPGA for storing important data.
[0005] In a first aspect, the present application provides a data protection method for an FPGA, comprising:
[0006] In response to a target address's access request to the FPGA module, obtaining a DNA encryption value corresponding to the target address;
[0007] Obtaining a DNA encryption value corresponding to the FPGA module;
[0008] Compare the DNA encryption value corresponding to the target address with the DNA encryption value corresponding to the FPGA module;
[0009] If the DNA encryption value corresponding to the target address is the same as the DNA encryption value corresponding to the FPGA module, an access request to the FPGA module is made through the target address.
[0010] Optionally, before obtaining the DNA encryption value corresponding to the FPGA module, the method further includes:
[0011] Obtaining a DNA value of an FPGA chip in the FPGA module;
[0012] The DNA value of the FPGA chip is encrypted to obtain the DNA encryption value corresponding to the FPGA module.
[0013] Optionally, encrypting the DNA value of the FPGA chip to obtain the DNA encrypted value corresponding to the FPGA module includes:
[0014] Using the SM3 hash algorithm to process the DNA value of the FPGA chip to obtain a processed DNA value;
[0015] The processed DNA value is encrypted using a key operation to obtain a DNA encryption value corresponding to the FPGA module.
[0016] Optionally, in response to the access request of the target address to the FPGA module, obtaining the DNA encryption value corresponding to the target address includes:
[0017] In response to an access request to the FPGA module for the target address, determining a flash chip corresponding to the target address;
[0018] Obtain the DNA encryption value corresponding to the target address from the flash chip corresponding to the target address.
[0019] Optionally, after comparing the DNA encryption value corresponding to the target address with the DNA encryption value corresponding to the FPGA module, the method further includes:
[0020] If the DNA encryption value corresponding to the target address is different from the DNA encryption value corresponding to the FPGA module, the access request of the target address to the FPGA module is rejected.
[0021] In a second aspect, the present application provides a data protection device based on FPGA, comprising:
[0022] A first acquisition unit, configured to acquire a DNA encryption value corresponding to the target address in response to an access request of the target address to the FPGA module;
[0023] A second acquisition unit is used to acquire a DNA encryption value corresponding to the FPGA module;
[0024] A comparison unit, used to compare the DNA encryption value corresponding to the target address with the DNA encryption value corresponding to the FPGA module;
[0025] A passing unit is used to request access to the FPGA module through the target address if the DNA encryption value corresponding to the target address is the same as the DNA encryption value corresponding to the FPGA module.
[0026] Optionally, the device further comprises:
[0027] A second acquisition unit, used to acquire a DNA value of an FPGA chip in the FPGA module;
[0028] The encryption unit is used to encrypt the DNA value of the FPGA chip to obtain the DNA encryption value corresponding to the FPGA module.
[0029] Optionally, the encryption unit includes:
[0030] A processing subunit, used to process the DNA value of the FPGA chip using an SM3 hash algorithm to obtain a processed DNA value;
[0031] The encryption subunit is used to encrypt the processed DNA value using a key operation to obtain a DNA encryption value corresponding to the FPGA module.
[0032] Optionally, the first acquiring unit includes:
[0033] A determination subunit, configured to determine a flash chip corresponding to the target address in response to an access request to the FPGA module for the target address;
[0034] The acquisition subunit is used to obtain the DNA encryption value corresponding to the target address from the flash chip corresponding to the target address.
[0035] Optionally, the device further comprises:
[0036] A rejection unit is used to reject the access request of the target address to the FPGA module if the DNA encryption value corresponding to the target address is different from the DNA encryption value corresponding to the FPGA module.
[0037] The present application provides a data protection method based on FPGA. When executing the method, in response to the access request of the target address to the FPGA module, the DNA encryption value corresponding to the target address is obtained, and then the DNA encryption value corresponding to the FPGA module is obtained, and then the DNA encryption value corresponding to the target address is compared with the DNA encryption value corresponding to the FPGA module. If the DNA encryption value corresponding to the target address is the same as the DNA encryption value corresponding to the FPGA module, the access request to the FPGA module is made through the target address. In this way, by comparing the DNA encryption value corresponding to the target address with the DNA encryption value corresponding to the FPGA module, it can be determined whether the target address has access rights, thereby effectively protecting the important data in the module for storing important data constructed using FPGA. BRIEF DESCRIPTION OF THE DRAWINGS
[0038] In order to more clearly illustrate the technical solutions in this embodiment or the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.
[0039] Figure 1 A flowchart of a data protection method based on FPGA provided in an embodiment of the present application;
[0040] Figure 2 A schematic diagram of the structure of a FPGA-based data protection device provided in an embodiment of the present application. DETAILED DESCRIPTION
[0041] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. The present application provides a data protection method and device based on FPGA, which is used in the field of data processing technology. The above is only an example and does not limit the application field of the method and device provided by the present application.
[0042] With the rapid development of FPGA in the communication, aerospace, medical and other industries, more and more companies use FPGA to build modules for storing important data. In the prior art, users can access the module built by FPGA to store important data, resulting in the data in the module cannot be effectively protected.
[0043] After research, the inventor proposed the technical solution of this application. In response to the target address's access request to the FPGA module, the DNA encryption value corresponding to the target address is obtained, and then the DNA encryption value corresponding to the FPGA module is obtained. Then, the DNA encryption value corresponding to the target address is compared with the DNA encryption value corresponding to the FPGA module. If the DNA encryption value corresponding to the target address is the same as the DNA encryption value corresponding to the FPGA module, the access request to the FPGA module is made through the target address. In this way, by comparing the DNA encryption value corresponding to the target address with the DNA encryption value corresponding to the FPGA module, it can be determined whether the target address has access rights, thereby effectively protecting the important data in the module for storing important data constructed using FPGA.
[0044] Among them, FPGA (Field-Programmable Gate Array) is a field programmable gate array, which is a semi-customized integrated circuit that allows users to change its internal logic structure through programming after manufacturing to achieve specific functions.
[0045] In order to enable those skilled in the art to better understand the present application, the present application is further described in detail below in conjunction with the accompanying drawings and specific implementation methods. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in the field without making creative work are within the scope of protection of the present application. It should be noted that, for ease of description, only the parts related to the relevant invention are shown in the accompanying drawings. In the absence of conflict, the embodiments in the present application and the features in the embodiments can be combined with each other.
[0046] See also Figure 1 , Figure 1 A flowchart of a data protection method based on FPGA provided in an embodiment of the present application includes:
[0047] S101: In response to a target address's access request to the FPGA module, obtain a DNA encryption value corresponding to the target address.
[0048] In response to the target address's access request to the FPGA module, the DNA encryption value corresponding to the target address is obtained, wherein the DNA encryption value corresponding to the target address is generally stored in the flash chip corresponding to the target address, and the flash chip is an electronic storage device for storing and reading data, which has the characteristics of non-volatility, erasability, and rewritability, which makes it widely used in the field of data storage. The flash chip can store multiple DNA encryption values according to demand, and multiple flash chips can also be replaced with each other to prevent the loss of a flash chip from causing the FPGA module to be inaccessible.
[0049] S102: Obtain the DNA encryption value corresponding to the FPGA module.
[0050] Before executing step S102, it is necessary to first obtain the DNA value of the FPGA chip in the FPGA module, wherein each FPGA chip corresponds to a unique DNA value, and each DNA value also indicates a unique FPGA chip. The DNA value of the PGA chip is encrypted to obtain the DNA encryption value corresponding to the FPGA module.
[0051] In some embodiments, the DNA value of the FPGA chip is encrypted to obtain the DNA encryption value corresponding to the FPGA module in the following specific manner: first, the DNA value of the FPGA chip is processed using the SM3 hash algorithm to obtain the processed DNA value. Among them, the SM3 hash algorithm is a cryptographic hash algorithm, which is mainly used in scenarios such as digital signatures, generation and verification of message authentication codes, and generation of random numbers in commercial cryptographic applications. A unique 256-bit encryption result can be provided for the DNA code. According to the current use results of the SM3 hash algorithm, there is currently no relevant cracking method for the SM3 hash algorithm, and it has more robust encryption after adding a key. Therefore, the use of this algorithm can effectively prevent the protected module from leaking secrets. Next, the processed DNA value is encrypted using a key operation to obtain the DNA encryption value corresponding to the FPGA module.
[0052] S103: Compare the DNA encryption value corresponding to the target address with the DNA encryption value corresponding to the FPGA module.
[0053] Compare the DNA encryption value corresponding to the target address with the DNA encryption value corresponding to the FPGA module. If the DNA encryption value corresponding to the target address is the same as the DNA encryption value corresponding to the FPGA module, it means that the target address has access rights. If the DNA encryption value corresponding to the target address is different from the DNA encryption value corresponding to the FPGA module, it means that the target address does not have access rights.
[0054] S104: If the DNA encryption value corresponding to the target address is the same as the DNA encryption value corresponding to the FPGA module, an access request to the FPGA module is made through the target address.
[0055] In addition, if the DNA encryption value corresponding to the target address is different from the DNA encryption value corresponding to the FPGA module, the access request of the target address to the FPGA module is rejected.
[0056] In the embodiment of the present application, in response to the target address's access request to the FPGA module, the DNA encryption value corresponding to the target address is obtained, and then the DNA encryption value corresponding to the FPGA module is obtained, and then the DNA encryption value corresponding to the target address is compared with the DNA encryption value corresponding to the FPGA module. If the DNA encryption value corresponding to the target address is the same as the DNA encryption value corresponding to the FPGA module, the access request to the FPGA module is made through the target address. In this way, by comparing the DNA encryption value corresponding to the target address with the DNA encryption value corresponding to the FPGA module, it can be determined whether the target address has access rights, thereby effectively protecting the important data in the module for storing important data constructed using FPGA.
[0057] The above introduces the FPGA-based data protection method provided in the embodiment of the present application. The following is an exemplary description of the FPGA-based data protection method in combination with a specific application scenario.
[0058] More and more equipment manufacturers have developed intellectual property modules with independent intellectual property rights suitable for their own company or industry development. The development process of some complex intellectual property modules will cost a lot of manpower, material resources, financial resources and other resources of the company. Therefore, a complete encryption method is needed to protect the intellectual property modules.
[0059] In response to the target address's access request to the intellectual property module, the DNA encryption value corresponding to the target address is obtained, and the DNA encryption value corresponding to the target address is stored in the flash chip corresponding to the target address. The DNA encryption value corresponding to the target address is compared with the DNA encryption value corresponding to the intellectual property module. If they are the same, the access request is approved; if they are different, the access request is rejected. The DNA encryption value corresponding to the intellectual property module is generated as follows: the DNA value of the FPGA chip in the intellectual property module is obtained, and the DNA value corresponds to a unique FPGA chip. Then, the DNA value of the FPGA chip is processed using the SM3 hash algorithm to obtain the processed DNA value. Finally, the processed DNA value is encrypted using a key operation to obtain the DNA encryption value corresponding to the FPGA module.
[0060] The above are some specific implementations of the data protection method based on FPGA provided by the embodiment of the present application. Based on this, the present application also provides a corresponding device. The device provided by the embodiment of the present application will be introduced from the perspective of functional modularization.
[0061] See also Figure 2 , Figure 2 The present invention provides a schematic diagram of a data protection device based on FPGA according to an embodiment of the present invention. The data protection device based on FPGA 200 includes:
[0062] A first acquisition unit 210 is used to obtain a DNA encryption value corresponding to the target address in response to an access request of the target address to the FPGA module;
[0063] A second acquisition unit 220 is used to acquire a DNA encryption value corresponding to the FPGA module;
[0064] A comparison unit 230, used to compare the DNA encryption value corresponding to the target address with the DNA encryption value corresponding to the FPGA module;
[0065] Through unit 240, if the DNA encryption value corresponding to the target address is the same as the DNA encryption value corresponding to the FPGA module, then an access request to the FPGA module is made through the target address.
[0066] Optionally, the device 200 further includes:
[0067] A second acquisition unit, used to acquire a DNA value of an FPGA chip in the FPGA module;
[0068] The encryption unit is used to encrypt the DNA value of the FPGA chip to obtain the DNA encryption value corresponding to the FPGA module.
[0069] Optionally, the encryption unit includes:
[0070] A processing subunit, used to process the DNA value of the FPGA chip using an SM3 hash algorithm to obtain a processed DNA value;
[0071] The encryption subunit is used to encrypt the processed DNA value using a key operation to obtain a DNA encryption value corresponding to the FPGA module.
[0072] Optionally, the first acquiring unit 210 includes:
[0073] A determination subunit, configured to determine a flash chip corresponding to the target address in response to an access request to the FPGA module for the target address;
[0074] The acquisition subunit is used to obtain the DNA encryption value corresponding to the target address from the flash chip corresponding to the target address.
[0075] Optionally, the device 200 further includes:
[0076] A rejection unit is used to reject the access request of the target address to the FPGA module if the DNA encryption value corresponding to the target address is different from the DNA encryption value corresponding to the FPGA module.
[0077] The embodiments of the present application also provide corresponding devices and computer storage media for implementing the solutions provided by the embodiments of the present application.
[0078] The device includes a memory and a processor, the memory is used to store instructions or codes, and the processor is used to execute the instructions or codes so that the device executes the method described in any embodiment of the present application.
[0079] The computer storage medium stores codes, and when the codes are executed, a device executing the codes implements the method described in any embodiment of the present application.
[0080] Through the description of the above implementation methods, it can be known that those skilled in the art can clearly understand that all or part of the steps in the above-mentioned embodiment method can be implemented by means of software plus a general hardware platform. Based on such an understanding, the technical solution of the present application can be embodied in the form of a software product, which can be stored in a storage medium, such as a read-only memory (ROM) / RAM, a magnetic disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network communication device such as a router) to execute the methods described in each embodiment of the present application or some parts of the embodiments.
[0081] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.
[0082] It should also be noted that the various embodiments in this specification are described in a progressive manner, and the same and similar parts between the various embodiments can refer to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the equipment and device embodiments, since they are basically similar to the method embodiments, the description is relatively simple, and the relevant parts can refer to the partial description of the method embodiment. The device embodiments described above are merely schematic, in which the units described as separate components may or may not be physically separated, and the components prompted as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules can be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.
[0083] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any changes or substitutions that can be easily thought of by a person skilled in the art within the technical scope disclosed in the present application should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.
Claims
1. A data protection method based on FPGA, characterized in that: include: In response to a target address's access request to the FPGA module, obtaining a DNA encryption value corresponding to the target address; Obtaining a DNA encryption value corresponding to the FPGA module; Compare the DNA encryption value corresponding to the target address with the DNA encryption value corresponding to the FPGA module; If the DNA encryption value corresponding to the target address is the same as the DNA encryption value corresponding to the FPGA module, an access request to the FPGA module is made through the target address.
2. The method according to claim 1, characterized in that Before obtaining the DNA encryption value corresponding to the FPGA module, the method further includes: Obtaining a DNA value of an FPGA chip in the FPGA module; The DNA value of the FPGA chip is encrypted to obtain the DNA encryption value corresponding to the FPGA module.
3. The method according to claim 2, characterized in that The step of encrypting the DNA value of the FPGA chip to obtain the DNA encryption value corresponding to the FPGA module includes: Using the SM3 hash algorithm to process the DNA value of the FPGA chip to obtain a processed DNA value; The processed DNA value is encrypted using a key operation to obtain a DNA encryption value corresponding to the FPGA module.
4. The method according to claim 1, characterized in that: The step of obtaining the DNA encryption value corresponding to the target address in response to the target address's access request to the FPGA module includes: In response to an access request to the FPGA module for the target address, determining a flash chip corresponding to the target address; Obtain the DNA encryption value corresponding to the target address from the flash chip corresponding to the target address.
5. The method according to claim 1, characterized in that After comparing the DNA encryption value corresponding to the target address with the DNA encryption value corresponding to the FPGA module, the method further includes: If the DNA encryption value corresponding to the target address is different from the DNA encryption value corresponding to the FPGA module, the access request of the target address to the FPGA module is rejected.
6. A data protection device based on FPGA, characterized in that: include: A first acquisition unit, configured to acquire a DNA encryption value corresponding to the target address in response to an access request of the target address to the FPGA module; A second acquisition unit is used to acquire a DNA encryption value corresponding to the FPGA module; A comparison unit, used to compare the DNA encryption value corresponding to the target address with the DNA encryption value corresponding to the FPGA module; A passing unit is used to request access to the FPGA module through the target address if the DNA encryption value corresponding to the target address is the same as the DNA encryption value corresponding to the FPGA module.
7. The device according to claim 6, characterized in that The device also includes: A second acquisition unit, used to acquire a DNA value of an FPGA chip in the FPGA module; The encryption unit is used to encrypt the DNA value of the FPGA chip to obtain the DNA encryption value corresponding to the FPGA module.
8. The device according to claim 7, characterized in that The encryption unit comprises: A processing subunit, used to process the DNA value of the FPGA chip using an SM3 hash algorithm to obtain a processed DNA value; The encryption subunit is used to encrypt the processed DNA value using a key operation to obtain a DNA encryption value corresponding to the FPGA module.
9. The device according to claim 6, characterized in that The first acquisition unit includes: A determination subunit, configured to determine a flash chip corresponding to the target address in response to an access request to the FPGA module for the target address; The acquisition subunit is used to obtain the DNA encryption value corresponding to the target address from the flash chip corresponding to the target address.
10. The device according to claim 6, characterized in that The device also includes: A rejection unit is used to reject the access request of the target address to the FPGA module if the DNA encryption value corresponding to the target address is different from the DNA encryption value corresponding to the FPGA module.