Embedded controller, chip, electronic equipment and keyboard data processing method

Abstract

The embodiment of the invention provides an embedded controller, a chip, electronic equipment and a keyboard data processing method, and the embedded controller comprises a bus interface circuit which is used for communicating with a host processor; the key data protection module is used for acquiring key data and a replay protection monotonic count value, calling the signature module to generate signature information of the key data and the replay protection monotonic count value, and transmitting a key data packet to the host processor through the bus interface circuit; the key data packet may include key data and signature information, or key data and a replay protection monotonic count value and signature information. According to the embodiment, the key data and the signature information of the replay protection monotone count value are generated, so that the host can verify whether the key data is from the embedded controller or not based on the signature information, and the situation that a third party pretends to be the embedded controller to send the key data to the host is avoided.

Description

Technical Field

[0001] The present application relates to the field of data security technology, and in particular to an embedded controller, a chip, an electronic device and a keyboard data processing method. Background Art

[0002] The keyboard that comes with a laptop is a matrix keyboard, which is usually completed by an embedded controller (Embedded Controller, referred to as EC) to complete row and column scanning to identify the key position, and then generate a key scan code (Keyboard Scan Code) and send it to the host through the IO-60 / 64 interface of the Enhanced Serial Peripheral Interface (Enhanced Serial Peripheral Interface, referred to as eSPI) bus. The keyboard driver on the host side receives the key scan code and identifies the key position.

[0003] Since the EC and the host use the standard eSPI IO Cycle protocol to send the standard Scan Code Set-1 to transmit the key status, and the key scan code on the eSPI bus is transmitted in plain text, the key is at risk of being hijacked at the sending end, during the sending, and at the receiving end, causing a third party to pretend to be an EC and send the key scan code to the host. Summary of the invention

[0004] In view of the above problems, the embodiments of the present application provide an embedded controller, a chip, an electronic device and a keyboard data processing method to solve the above technical problems.

[0005] In the first aspect, an embodiment of the present application provides an embedded controller, including: a bus interface circuit for communicating with a host processor; a key data protection module for obtaining key data and a replay protection monotonic count value, calling a signature module to generate signature information of the key data and the replay protection monotonic count value, and transmitting a key data packet to the host processor via the bus interface circuit, wherein the key data packet includes key data and signature information, or key data and a replay protection monotonic count value and signature information. This embodiment generates signature information of key data and a replay protection monotonic count value, so that the host can verify whether the key data comes from the embedded controller based on the signature information and its own replay protection monotonic count value, thereby preventing a third party from pretending to be an embedded controller and sending key data to the host.

[0006] In a second aspect, an embodiment of the present application provides a chip, including an embedded controller provided by an embodiment of the present application. The embodiment generates signature information of key data and a replay protection monotonic count value, so that the host can verify whether the key data comes from the embedded controller based on the signature information and its own replay protection monotonic count value, thereby preventing a third party from pretending to be an EC and sending key data to the host.

[0007] In a third aspect, an embodiment of the present application provides an electronic device, including a device body and an embedded controller or chip as in the above embodiment provided in the device body. In this embodiment, signature information of key data and replay protection monotonic count value is generated, and the host can verify whether the key data of its own replay protection monotonic count value comes from the embedded controller based on the signature information, so as to prevent a third party from pretending to be an EC and sending key data to the host.

[0008] In a fourth aspect, an embodiment of the present application provides a key data processing method, which is applied to an embedded controller, and the method includes: obtaining key data and its own replay protection monotonic count value, wherein the key data is generated based on a key action on a keyboard; calling a signature module to generate signature information of the key data and the replay protection monotonic count value; transmitting a key data packet to the host processor via a bus between the embedded controller and the host processor, wherein the key data packet includes key data and signature information, or key data and replay protection monotonic count value and signature information. In this embodiment, signature information of key data and replay protection monotonic count value is generated, and the host can verify whether the key data comes from the embedded controller based on the signature information and its own replay protection monotonic count value, so as to prevent a third party from pretending to be an EC and sending key data to the host end.

[0009] In a fifth aspect, an embodiment of the present application provides a key data processing method, which is applied to a host processor of an electronic device, wherein the electronic device includes an embedded controller, and the method includes: receiving a key data packet sent by the embedded controller, wherein the key data packet includes key data and signature information, or key data and a replay protection monotonic count value of the embedded controller and signature information, wherein the signature information is generated by signing the key data and the replay protection monotonic count value of the embedded controller; executing a signature algorithm to generate its own replay protection monotonic count value and the signature information of the received key data, wherein the signature algorithm is consistent with the signature algorithm of the embedded controller; and determining that the received key data has been verified if the generated signature information is consistent with the received signature information. In this embodiment, the host can verify whether the key data comes from the embedded controller based on the signature information and its own replay protection monotonic count value, thereby preventing a third party from pretending to be an EC from sending key data to the host.

[0010] The embedded controller, chip, electronic device and keyboard data processing method provided in the embodiments of the present application generate signature information of key data and replay protection monotonic count value. The host can verify whether the key data comes from the embedded controller based on the signature information and its own replay protection monotonic count value, thereby preventing a third party from impersonating an EC to send key data to the host.

[0011] These and other aspects of the present application will become more clearly understood in the description of the following embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For those skilled in the art, other drawings can be obtained based on these drawings without creative work.

[0013] Figure 1 A schematic diagram of an embedded controller provided in an embodiment of the present application is shown.

[0014] Figure 2 A schematic diagram of another embedded controller provided in an embodiment of the present application is shown.

[0015] Figure 3 A schematic diagram of another embedded controller provided in an embodiment of the present application is shown.

[0016] Figure 4 A schematic diagram of another embedded controller provided in an embodiment of the present application is shown.

[0017] Figure 5 A schematic diagram of an electronic device provided in an embodiment of the present application is shown.

[0018] Figure 6 A flow chart of a key data processing method provided in an embodiment of the present application is shown. DETAILED DESCRIPTION

[0019] The embodiments of the present application are described in detail below, and examples of the embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the present application, and cannot be understood as limiting the present application.

[0020] In order to enable those skilled in the art to better understand the solutions of the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without making creative work are within the scope of protection of the present application.

[0021] In the embodiments of the present application, it should be noted that, in this article, relational terms such as first and second, etc. are merely used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations.

[0022] Moreover, the terms "comprises," "comprising," or any other variation thereof are intended to encompass non-exclusive inclusion, such that a process, method, article, or apparatus that includes a list of elements includes not only those elements, but also other elements not explicitly listed, or elements inherent to such process, method, article, or apparatus. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of additional identical elements in the process, method, article, or apparatus that includes the element.

[0023] In the description of the embodiments of the present application, words such as "example" or "for example" are used to indicate examples, illustrations or descriptions. Any embodiment or design described as "example" or "for example" in the embodiments of the present application is not to be interpreted as being more preferred or having more advantages than another embodiment or design. The use of words such as "example" or "for example" is intended to present relative concepts in a clear manner.

[0024] In addition, the "plurality" in the embodiments of the present application refers to two or more than two. In view of this, in the embodiments of the present application, "plurality" can also be understood as "at least two". "At least one" can be understood as one or more, for example, one, two or more. For example, including at least one means including one, two or more, and there is no limit on which ones are included. For example, including at least one of A, B and C, then A, B, C, A and B, A and C, B and C, or A, B and C can be included.

[0025] It should be noted that, in the embodiments of the present application, "and / or" describes the association relationship of the associated objects, indicating that three relationships may exist. For example, A and / or B may represent: A exists alone, A and B exist at the same time, and B exists alone. In addition, the character " / ", unless otherwise specified, generally indicates that the associated objects before and after are in an "or" relationship.

[0026] It should be noted that in the embodiments of the present application, "connection" can be understood as electrical connection, and the connection between two electrical components can be a direct or indirect connection between the two electrical components. For example, the connection between A and B can be either a direct connection between A and B or an indirect connection between A and B through one or more other electrical components.

[0027] The present application embodiment provides an embedded controller, such as Figure 1As shown, the exemplary embedded controller 100 provided in the embodiment of the present application may include: a bus interface circuit 101 and a key data protection module 102. The bus interface circuit 101 is used to communicate with the host processor 201. The key data protection module 102 is used to obtain key data and a replay protection monotonic count value, call the signature module 103 to generate signature information of the key data and the replay protection monotonic count value, and transmit the key data packet to the host processor 201 via the bus interface circuit 101. The key data packet may include key data and signature information, or key data and a replay protection monotonic count value and signature information. By generating signature information of key data and a replay protection monotonic count value, the host can verify whether the key data comes from the embedded controller based on the signature information and its own replay protection monotonic count value, thereby preventing a third party from pretending to be an EC and sending key data to the host.

[0028] In the embodiment of the present application, when the key data packet includes key data and signature information, the host processing processor 201 generates signature information of the received key data and its own replay protection monotonic count value. If the received signature information is consistent with the signature information generated by itself, it is determined that the key data verification has passed. When the key data packet includes key data, replay protection monotonic count value and signature information key data, the host processor 201 can determine whether the received replay protection monotonic count value is consistent with its own replay protection monotonic count value. If not, it is determined that the received key data verification has failed; if consistent, the signature information is generated in the above manner. If the received signature information is consistent with the generated signature information, it is determined that the key data verification has passed.

[0029] In an embodiment of the present application, the host processor 201 and the key data protection module 102 combine the key data and the replay protection monotonic count value in the same manner to obtain the combined data, and use the same signature algorithm and signature key to generate the signature information of the combined data. Specifically, the key data protection module 102 combines the key data to be sent with its own replay protection monotonic count value to obtain its own combined data, and generates the signature information of the combined data; the host processor 201 combines the received key data with its own replay protection monotonic count value to obtain its own combined data, and uses the same signature algorithm and signature key as the key data protection module 102 to generate the signature information of the combined data. The embodiment of the present application does not limit the combination method of key data and replay protection monotonic count value. Exemplarily, the combined data is key data and replay protection monotonic count value in sequence; or the combined data is replay protection monotonic count value and key data in sequence; or the replay protection monotonic count value is mixed with the key data according to a preset rule.

[0030] For example, the key data protection module 102 can splice the key data with the replay protection monotonic count value, for example, splice the replay protection monotonic count value at the end of the key data, for example, the key data is "0110", the replay protection monotonic count value is "111", and the spliced ​​key data and replay protection monotonic count value are "0110111". The key data protection module 102 calls the signature module 103 to generate signature information of the spliced ​​key data and the replay protection monotonic count value, for example, signing the aforementioned spliced ​​"0110111" to generate its signature information. Correspondingly, the key data received by the host processor 201 is "0110" and its own replay protection monotonic count value is "111", and the key data and replay protection monotonic count value spliced ​​by the host processor 201 are "0110111", for example, signing the spliced ​​"0110111" to generate its signature information.

[0031] As an implementation method, the signature module 103 may use a message authentication code (MAC) algorithm to generate signature information, and the message authentication code (MAC) algorithm may be a hash-based message authentication code (Hash-based Message Authentication Code, referred to as HMAC) algorithm. The present application embodiment does not limit the signature algorithm of the signature module 103.

[0032] In some embodiments, the key data protection module 102 can update the replay protection monotonic count value of the embedded controller 100 when the key data passes the verification of the host processor 201, so as to be used when the keyboard data is sent next time. As an embodiment, when the host processor 201 determines that the received key data passes the verification, it sends a command to the key data protection module 102 to update the replay protection monotonic count value of the embedded controller 100. After receiving the command, the key data protection module 102 updates the replay protection monotonic count value of the embedded controller 100.

[0033] In some embodiments, the host processor 201 can obtain the replay protection monotonic count value from the embedded controller 100 when receiving the key data, and obtain its own replay protection monotonic count value. In other embodiments, the host processor 201 can send a command to the key data protection module 102 to update the replay protection monotonic count value of the embedded controller 100, and then record the updated replay protection monotonic count value to obtain its own replay protection monotonic count value for use in the next keyboard data verification. Both methods can enable the host processor 201 and the embedded controller 100 to hold the same replay protection monotonic count value.

[0034] As an implementation method, the key data protection module 102 can communicate with the host processor 201 via the bus interface circuit 101 in accordance with the replay protection counter (ReplayProtection Monotonic Counter, abbreviated as RPMC) protocol or the eRPMC (RPMC over eSP) protocol. The communication may include: key data packet transmission, updating the replay protection monotonic count value, obtaining the replay protection monotonic count value, etc.

[0035] In some embodiments, Figure 2 As shown, the embedded controller 100 may further include: a storage control module 1041. The key data protection module 102 may access a storage module for storing a replay protection monotonic count value through the storage control module 1041 to update and obtain the replay protection monotonic count value. In this embodiment, the replay protection monotonic count value is stored in a storage module outside the embedded controller 100, and the key data protection module 102 accesses the storage module through the storage control module 1041. The circuit area of ​​the embedded controller 100 can be reduced. In addition, the key data protection module 102 may access a storage module for storing a signature key through the storage control module 1041 to write a signature key to the storage module or read the signature key stored therein. Exemplarily, the signature key may include a root key and a key generated based on the root key. In some implementations, the root key is written to the storage module by the host processor 201.

[0036] In some embodiments, Figure 3 As shown, the embedded controller 100 may further include: a storage module 1042 for storing a replay protection monotonic count value. The key data protection module 102 is used to access the storage module 1042 to update and obtain the replay protection monotonic count value. In this embodiment, the replay protection monotonic count value is stored in the storage module 1042 inside the embedded controller 100, which is more convenient to access and has higher data security. In addition, the storage module 1042 can also store a signature key, and the key data protection module 102 can write a signature key to the storage module 1042 or read the signature key stored therein. Exemplarily, the signature key may include a root key and a key generated based on the root key.

[0037] like Figure 2 and Figure 3As shown, the embedded controller 100 may further include: a processor 105. The processor 105 is connected to the bus interface circuit 101, and the processor 105 can communicate with the host processor 201 via the bus interface circuit 101. In some embodiments, the key data protection module 102 is integrated into the processor 105. In some embodiments, the key data protection module 102 is a program instruction executed by the processor 105. The program instruction may be a firmware program of the embedded controller 100.

[0038] In some embodiments, Figure 2 As shown, the signature module 103 is a circuit module integrated in the processor 105. This embodiment uses hardware to execute the signature algorithm, which can increase the speed of generating signature information and the speed of key data processing.

[0039] In some embodiments, Figure 3 As shown, the signature module 103 is a circuit module integrated in the embedded controller 103 , and the processor 105 is connected to the signature module 103 via an internal bus.

[0040] In some implementations, the signature module 103 is located outside the embedded controller 100 , and the processor 105 is connected to the signature module 103 via an external bus.

[0041] In some implementations, the signature module 103 is a signature algorithm program instruction executed by the processor 105. This implementation implements the signature algorithm through program instructions, which can reduce the hardware cost of the embedded controller 100.

[0042] In some embodiments, Figure 2 and 3 As shown, the embedded controller 100 may further include a keyboard control module 106. The keyboard control module 106 is used to detect a key action and generate key data corresponding to the key action. Exemplarily, the key data may be a key scan code. In some implementations, the key data protection module 102 obtains the key data from the keyboard control module 106.

[0043] As an implementation mode, the key data protection module 102 and the signature module 103 are program instructions executed by the processor 105, and the program instructions may be firmware programs. When the program instructions are executed by the processor 105, the processor 105 performs the following steps: obtaining the key data generated by the keyboard control module 106 and reading the replay protection monotonic count value; executing the signature algorithm to generate signature information of the key data and the replay protection monotonic count value; transmitting the key data packet to the host processor 201 via the bus interface circuit 101. The key data packet may include key data and signature information, or key data and replay protection monotonic count value and signature information. In this implementation mode, key data protection is implemented through program instructions, which can reduce the hardware cost of the embedded controller 100. In addition, in Figure 2 In the example shown, the processor 105 can access the storage module for storing the replay protection monotonic count value through the storage control module 1041 to obtain the replay protection monotonic count value. Figure 3 In the example shown, the processor 105 accesses the storage module 1042 to obtain the replay protection monotonic count value.

[0044] As an implementation mode, the signature module 103 is a hardware circuit, and the key data protection module 102 is a program instruction executed by the processor 105, which may be a firmware program. When the program instruction is executed by the processor 105, the processor 105 performs the following steps: obtaining the key data generated by the keyboard control module 106 and reading the replay protection monotonic count value; calling the signature module 103 to generate signature information of the key data and the replay protection monotonic count value; transmitting the key data packet to the host processor 201 via the bus interface circuit 101. The key data packet may include key data and signature information, or key data and replay protection monotonic count value and signature information. In this implementation mode, key data protection is realized by combining program instructions with hardware modules, which can reduce the hardware cost of the embedded controller 100 and can quickly generate signature information. In addition, in Figure 2 In the example shown, the processor 105 accesses the storage module for storing the replay protection monotonic count value through the storage control module 1041 to obtain the replay protection monotonic count value. Figure 3 In the example shown, the processor 105 accesses the storage module 1042 to obtain the replay protection monotonic count value. Figure 2 In the example shown, the processor 105 can call the signature module 103 integrated therein to generate signature information. Figure 3 In the example shown, the processor 105 is connected to the signature module 103 via an internal bus, and the key data and the replay protection monotonic count value are sent to the signature module 103 via the internal bus. The signature module 103 generates signature information for the key data and the replay protection monotonic count value, and sends the generated signature information to the processor 105 via the internal bus.

[0045] As an implementation method, Figure 4 As shown, the key data protection module 102 is a hardware circuit within the embedded control 100, and the key data protection module 102 is connected to the processor 105 via an internal bus. The key data protection module 102 can obtain key data and replay protection monotonic count value, call the signature module 103 to generate signature information of key data and replay protection monotonic count value, and transmit the key data packet to the processor 105. The processor 105 transmits the key data packet to the host processor 201 via the bus interface circuit 101. The key data packet may include key data and signature information, or key data and replay protection monotonic count value and signature information. In this embodiment, the processor 105 implements communication with the host processor 201, that is, reception and transmission of bus data packets. Exemplarily, as Figure 4 As shown, the signature module 103 is a circuit module integrated in the embedded controller 100 and independent of the processor 105. The signature module 103 is connected to the key data protection module 102 through an internal bus. Figure 4 The embedded controller 100 shown may also include Figure 2 The storage control module 1041 shown. For example, Figure 4 The embedded controller 100 shown may also include Figure 3 Storage module 1042 is shown.

[0046] The present application embodiment provides an electronic device, such as Figure 5 As shown, the electronic device 500 may include an embedded controller 501 and a host processor 502. The embedded controller 501 is described in the foregoing description of the embedded controller 100 in this specification, and will not be described in detail here.

[0047] The host processor 502 is connected to the embedded controller 501 via a bus. In the embodiment of the present application, the bus between the bus host processor 501 and the embedded controller 501 is not limited. For example, the bus may include but is not limited to an LPC (LowPin Count, referred to as LPC) bus, a serial peripheral interface (Serial Peripheral Interface, referred to as SPI) bus, an enhanced serial peripheral interface (Enhanced Serial Peripheral Interface, referred to as eSPI) bus, etc. Correspondingly, the bus interface circuit of the embedded controller 501 may include an LPC slave circuit, an SPI slave circuit, or an eSPI slave circuit; the host processor 502 may include an LPC master circuit, an SPI master circuit, or an eSPI master circuit. When the embedded controller 501 communicates with the host processor 502, bus data packets (for example, LPC data packets, SPI data packets, eSPI data packets, etc.) are transmitted via the bus.

[0048] As an implementation mode, host processor 502 and embedded controller 501 can communicate according to RPMC protocol or eRPMC protocol. For example, embedded controller 501 transmits key data packet based on RPMC protocol or eRPMC protocol, updates replay protection monotone count value, reads replay protection monotone count value, etc. Host processor 502 transmits key data packet based on RPMC protocol or eRPMC protocol, updates replay protection monotone count value, reads replay protection monotone count value, etc.

[0049] refer to Figure 5 As shown, the electronic device 500 may further include a keyboard driver 503, and the keyboard driver 503 is located in the operating system 504. When the keyboard driver 503 is executed by the host processor 502, the host processor 502 performs the following steps: receiving a key data packet sent by the embedded controller 501, which may include key data and signature information; executing a signature algorithm to generate its own replay protection monotonic count value and signature information of the received key data, wherein the signature algorithm is consistent with the signature algorithm of the embedded controller 501, and the replay protection monotonic count value is consistent with the replay protection monotonic count value of the embedded controller 501; when the generated signature information is consistent with the received signature information, determining that the received key data verification is passed.

[0050] In some embodiments, if the key data packet includes key data and the replay protection monotonic count value and signature information of the embedded controller 501, the host processor 502 can determine whether the received replay protection monotonic count value is consistent with its own replay protection monotonic count value. If not, it is determined that the key data verification has failed; if they are consistent, the signature information is generated in the above manner. If the received signature information is consistent with the generated signature information, it is determined that the key data verification has passed.

[0051] As an implementation method, the keyboard driver 503 and the embedded controller 501 can use a message authentication code (MAC) algorithm to generate signature information, and the message authentication code (MAC) algorithm can be a hash-based message authentication code (Hash-based Message Authentication Code, referred to as HMAC) algorithm. The present application embodiment does not limit the signature algorithm. When the HMAC algorithm is used to generate signature information, the key shared by the keyboard driver 503 and the embedded controller 501, that is, the keyboard driver 503 and the embedded controller 501 use the same key.

[0052] In the embodiment of the present application, when it is determined that the received key data has passed the verification, the key data can be provided to the application running in the operating system 504. The application can include but is not limited to instant messaging programs, emails, browsers, word processing software, bank clients, etc., and the embodiment of the present application does not limit the application.

[0053] refer to Figure 5 As shown, the electronic device 500 may further include a keyboard 505. The embedded controller 501 may include a keyboard control module, which may detect a key action on the keyboard 505 and generate key data corresponding to the key action. Exemplarily, the key data may be a key scan code.

[0054] In some implementations, when the host processor 502 determines that the received key data passes verification, it sends a command to the embedded controller 501 to update the replay protection monotonic count value of the embedded controller 501. After receiving the command, the embedded controller 501 updates the replay protection monotonic count value of the embedded controller 501.

[0055] Further, in some embodiments, the host processor 502 may obtain the replay protection monotonic count value from the embedded controller 501 upon receiving the key data to obtain its own replay protection monotonic count value. In other embodiments, the host processor 502 may send a command to the embedded controller 501 to update the replay protection monotonic count value of the embedded controller 501, and then record the updated replay protection monotonic count value to obtain its own replay protection monotonic count value.

[0056] In some embodiments, Figure 5 As shown, the electronic device 500 may further include a first storage module 506. The first storage module 506 may store the replay protection monotonic count value of the embedded controller 501, and the embedded controller 501 accesses the first storage module 506 through the storage control module to read and update the replay protection monotonic count value of the embedded controller 501. In addition, the first storage module 506 may also store the signature key of the embedded controller 501.

[0057] In some embodiments, Figure 5 As shown, the electronic device 500 may further include a second storage module 507. The second storage module 507 may store the replay protection monotonic count value of the keyboard driver 503. When the host processor 502 executes the keyboard driver 503, it accesses the second storage module 506 to read and update the replay protection monotonic count value of the keyboard driver 503. In addition, the second storage module 507 may also store the signature key of the keyboard driver 503. When the host processor 502 executes the keyboard driver 503, it obtains the signature key from the second storage module 507. After sending a command to the embedded controller 501 to update the replay protection monotonic count value of the embedded controller 501, the host processor 502 may store the updated replay protection monotonic count value in the second storage module 507.

[0058] In some embodiments, the embedded controller 501 may encrypt the key data, and further, sign the encrypted key data and its own replay protection monotonic count value to obtain corresponding signature information. The embedded controller 501 sends the encrypted key data and the corresponding signature information to the host processor 502. The host processor 502 may sign the received encrypted key data and its own replay protection monotonic count value to obtain corresponding signature information. When the generated signature information is consistent with the received signature information, the host processor 502 decrypts the received encrypted key data to obtain the key data.

[0059] In some embodiments, the embedded controller 501 signs the key data and its own replay protection monotonic count value to obtain corresponding signature information. The embedded controller 501 can encrypt the key data and send the encrypted key data and corresponding signature information to the host processor 502. The host processor 502 can decrypt the received encrypted key data to obtain the key data, sign the decrypted key data and its own replay protection monotonic count value to obtain corresponding signature information. When the generated signature information is consistent with the received signature information, the host processor 502 confirms that the received key data has passed the verification.

[0060] The electronic device generates key data and signature information of a replay protection monotonic count value through an embedded controller, and a host processor verifies whether the key data comes from the embedded controller based on the signature information, thereby preventing a third party from pretending to be an embedded controller and sending key data to the host processor.

[0061] The present application also provides a key data processing method, which is applied to an electronic device including an embedded controller and a host processor, for example, Figure 5 The electronic device 500 is shown. Figure 6 As shown, the process includes steps S601 to S608.

[0062] In step S601, the embedded controller obtains key data and its own replay protection monotonic count value. The key data is generated based on the key action on the keyboard. Before step S601, the embedded controller can detect the key action on the keyboard 505 and generate key data corresponding to the key action. Exemplarily, the key data can be a key scan code.

[0063] Step S602: The embedded controller generates signature information of the key data and the replay protection monotonic count value.

[0064] Step S603: The embedded controller transmits the key data packet to the host processor via the bus between the embedded controller and the host processor. The key data packet may include key data and signature information, or key data and replay protection monotonic count value and signature information.

[0065] Step S604: the host processor receives the key data packet sent by the embedded controller.

[0066] Step S605: The host processor executes a signature algorithm to generate its own replay protection monotonic count value and signature information of the received key data. The signature algorithm executed by the host processor is consistent with the signature algorithm of the embedded controller. The replay protection monotonic count value is consistent with the replay protection monotonic count value of the embedded controller.

[0067] In some embodiments, the key data packet may include key data and the replay protection monotonic count value and signature information of the embedded controller. Before step S605, the host processor may determine whether the received replay protection monotonic count value is consistent with its own replay protection monotonic count value. If not, it is determined that the key data verification fails; if consistent, step S605 is entered to generate signature information.

[0068] Step S606: When the generated signature information is consistent with the received signature information, the host processor determines that the received key data has passed verification.

[0069] Step S607: the host processor notifies the embedded controller to update its own replay protection monotonic count value.

[0070] In some implementations, the host processor also records the updated replay protection monotonic count value to obtain the host processor's own replay protection monotonic count value for use the next time a keyboard data packet is received.

[0071] Step S608: The embedded controller updates its own replay protection monotonic count value.

[0072] The key data processing method generates signature information of key data and replays the monotonic count value to protect the host. The host can verify whether the key data comes from the embedded controller based on the signature information, thereby preventing a third party from pretending to be the embedded controller to send key data to the host.

[0073] In some embodiments, the embedded controller can encrypt the key data, and further, sign the encrypted key data and its own replay protection monotonic count value to obtain corresponding signature information. The embedded controller sends the encrypted key data and the corresponding signature information to the host processor. The host processor can sign the received encrypted key data and its own replay protection monotonic count value to obtain corresponding signature information. When the generated signature information is consistent with the received signature information, the host processor decrypts the received encrypted key data to obtain the key data.

[0074] In some embodiments, the embedded controller signs the key data and its own replay protection monotonic count value to obtain corresponding signature information. The embedded controller can encrypt the key data and send the encrypted key data and corresponding signature information to the host processor. The host processor can decrypt the received encrypted key data to obtain the key data, sign the decrypted key data and its own replay protection monotonic count value to obtain corresponding signature information. The host processor confirms that the received key data has passed the verification when the generated signature information is consistent with the received signature information.

[0075] The embodiment of the present application also provides a chip, which includes the above-mentioned embedded controller. The chip is also called an integrated circuit (IC), and the chip can be, but is not limited to, a SOC (System on Chip) chip or a SIP (system in package) chip. The chip generates signature information of key data and replays the monotonic count value, and the host can verify whether the key data comes from the embedded controller based on the signature information, thereby preventing a third party from pretending to be an embedded controller and sending key data to the host.

[0076] An embodiment of the present application also provides an electronic device, which includes a device body and a chip as described above disposed in the device body. The electronic device may be, but is not limited to, a car central control screen, a car, a smart wearable device, a mobile terminal, and a smart home device. Smart wearable devices include, but are not limited to, smart watches and smart bracelets. Mobile terminals include, but are not limited to, smart phones, laptops, tablet computers, and POS (point of sales terminal). Smart home devices include, but are not limited to, smart rice cookers and smart sweepers. The electronic device generates signature information of key data and replay protection monotonic count values ​​through an embedded controller, and the host side verifies whether the key data comes from the embedded controller based on the signature information to prevent a third party from pretending to be an embedded controller and sending key data to the host side.

[0077] The above are only preferred embodiments of the present application, and are not intended to limit the present application in any form. Although the present application has been disclosed as above with preferred embodiments, it is not intended to limit the present application. Any technical personnel in the field can make some changes or modify the technical contents disclosed above into equivalent embodiments without departing from the scope of the technical solution of the present application. However, any brief modifications, equivalent changes and modifications made to the above embodiments based on the technical essence of the present application without departing from the content of the technical solution of the present application are still within the scope of the technical solution of the present application.

Claims

1. An embedded controller, characterized in that: include: a bus interface circuit for communicating with a host processor; A key data protection module is used to obtain key data and a replay protection monotonic count value, call a signature module to generate signature information of the key data and the replay protection monotonic count value, and transmit a key data packet to the host processor via the bus interface circuit. The key data packet includes the key data and the signature information, or the key data, the replay protection monotonic count value and the signature information.

2. The embedded controller according to claim 1, wherein: The key data protection module is further used to update the replay protection monotonic count value when the key data is verified by the host processor.

3. The embedded controller according to claim 1 or 2, characterized in that: Also includes: Storage control module; wherein the key data protection module is used to access the storage module used to store the replay protection monotonic count value through the storage control module to update and obtain the replay protection monotonic count value.

4. The embedded controller according to claim 1 or 2, characterized in that: Also includes: A storage module is used to store the replay protection monotonic count value; wherein the key data protection module is used to access the storage module to update and obtain the replay protection monotonic count value.

5. The embedded controller according to claim 1, wherein: Also includes: Processor, the key data protection module is integrated into the processor, or the key data protection module is a program instruction executed by the processor.

6. The embedded controller according to claim 5, characterized in that: The signature module is integrated inside the processor.

7. The embedded controller according to claim 5, characterized in that: The signature module is integrated inside the embedded controller, and the processor is connected to the signature module via an internal bus.

8. The embedded controller according to claim 5, wherein: The signature module is a signature algorithm program instruction executed by the processor.

9. The embedded controller according to claim 1, wherein: Also includes: The keyboard control module is used to detect key actions and generate key data corresponding to the key actions.

10. A chip, characterized in that: The embedded controller comprises any one of claims 1 to 9.

11. An electronic device, characterized in that: The invention comprises a device body and an embedded controller as claimed in any one of claims 1 to 9 arranged on the device body.

12. The electronic device according to claim 11, characterized in that: Also included is a keyboard driver, which, when executed by a host processor, causes the host processor to perform the following steps: Receiving a key data packet sent by the embedded controller, wherein the key data packet includes key data and signature information corresponding to the key data, or the key data and a replay protection monotonic count value of the embedded controller and the signature information; Execute a signature algorithm to generate its own replay protection monotonic count value and signature information of the received key data, wherein the signature algorithm is consistent with the signature algorithm of the embedded controller; When the generated signature information is consistent with the received signature information, it is determined that the received key data has passed the verification.

13. The electronic device according to claim 12, characterized in that: The steps executed by the host processor also include: updating the replay protection monotonic count value of the embedded controller when it is determined that the received key data has passed the verification.

14. A key data processing method, characterized in that: The method is applied to an embedded controller, and the method comprises: Acquire key data and its own replay protection monotonic count value, wherein the key data is generated based on a key action on a keyboard; Calling a signature module to generate signature information of the key data and the replay protection monotonic count value; A key data packet is transmitted to the host processor via a bus between the embedded controller and the host processor, wherein the key data packet includes the key data and the signature information, or the key data and the replay protection monotonic count value and the signature information.

15. A key data processing method, characterized in that: The method is applied to a host processor of an electronic device, wherein the electronic device includes an embedded controller, and the method includes: Receive a key data packet sent by the embedded controller, wherein the key data packet includes key data and signature information corresponding to the key data, or the key data and a replay protection monotonic count value of the embedded controller and the signature information, and the signature information is generated by signing the key data and the replay protection monotonic count value of the embedded controller; Execute a signature algorithm to generate its own replay protection monotonic count value and signature information of the received key data, wherein the signature algorithm is consistent with the signature algorithm of the embedded controller, and the replay protection monotonic count value is consistent with the replay protection monotonic count value of the embedded controller; When the generated signature information is consistent with the received signature information, it is determined that the received key data has passed the verification.

Images