Data protection method and device based on chip bus encryption and security chip

Abstract

The invention relates to the technical field of chip security development, and discloses a data protection method based on chip bus encryption, which comprises the following steps: encrypting to-be-protected data of a first data area to obtain encrypted data; writing the encrypted data into a chip bus; reading encrypted data in the chip bus; and calculating a verification value of the encrypted data, and writing the verification value of the encrypted data into the second data area. The to-be-protected data in the first data area is encrypted, so that the to-be-protected data is prevented from being transmitted in a plaintext form on the chip bus. The risk that the to-be-protected data is tampered or leaked due to the exposure of the plaintext is reduced, so that the integrity of the data is ensured. The invention further discloses a data protection device based on chip bus encryption and the security chip.

Description

Technical Field

[0001] The present application relates to the field of chip security development technology, for example, to a data protection method and device based on chip bus encryption, and a security chip. Background Art

[0002] Currently, for sensitive data stored in the memory of microcontroller chips, such as user credentials, key configurations, etc., multi-layered security measures are required to ensure their confidentiality and integrity. Security measures need to prevent unauthorized access and data leakage, detect and prevent data tampering, and resist various software and hardware attacks.

[0003] In order to achieve data integrity protection, the related art discloses a method, which includes: treating the data as a binary polynomial and dividing it with a predefined generator polynomial to generate a remainder of a fixed length as a CRC check value. The check value is then attached to the data for transmission or storage, and the receiver verifies the integrity of the data by re-dividing the polynomial.

[0004] In the process of implementing the embodiments of the present disclosure, it is found that there are at least the following problems in the related art: When data is transmitted between different components or systems, no encryption measures are taken and the data in the transmission process may be intercepted, resulting in the possible exposure of the plain text data.

[0005] It should be noted that the information disclosed in the above background technology section is only used to enhance the understanding of the background of the present application, and therefore may include information that does not constitute the prior art known to ordinary technicians in the field. Summary of the invention

[0006] In order to provide a basic understanding of some aspects of the disclosed embodiments, a brief summary is given below. The summary is not an extensive review, nor is it intended to identify key / critical elements or delineate the scope of protection of these embodiments, but rather serves as a prelude to the detailed description that follows.

[0007] The embodiments of the present disclosure provide a data protection method and device based on chip bus encryption, and a security chip, which reduces the risk of data tampering or leakage.

[0008] In some embodiments, the data protection method based on chip bus encryption includes: encrypting the data to be protected in the first data area to obtain encrypted data; writing the encrypted data into the chip bus; reading the encrypted data in the chip bus; calculating the check value of the encrypted data, and writing the check value of the encrypted data into the second data area.

[0009] Optionally, encrypting the data to be protected in the first data area includes: obtaining an encryption key; and encrypting the data to be protected in the first data area using the encryption key.

[0010] Optionally, obtaining the encryption key includes: taking the address and length of the first data area as input, and obtaining the encryption key through a dispersion algorithm; or, taking a preset random number or a specific value as the encryption key.

[0011] Optionally, the data to be protected in the first data area is encrypted using an encryption key, including: encrypting the data using a data XOR algorithm or a symmetric key algorithm according to the encryption key.

[0012] Optionally, calculating the verification value of the encrypted data includes: performing group calculation on the read encrypted data according to an XOR algorithm; and performing obfuscation processing on the calculation results of the group calculation to obtain the verification value.

[0013] Optionally, writing the encrypted data into the chip bus includes: grouping the encrypted data and writing the grouped data into the chip bus; wherein the data length of the grouped data is greater than or equal to the number of bits of the security chip.

[0014] Optionally, reading the encrypted data in the chip bus includes: reading the encrypted data in the chip bus in groups; wherein the data length of the group is greater than or equal to the number of bits of the security chip.

[0015] Optionally, before encrypting the data to be protected in the first data area, the method further includes: grouping the data to be protected in the first data area.

[0016] In some embodiments, the chip bus encryption-based data protection device includes a processor and a memory storing program instructions, and the processor is configured to execute the chip bus encryption-based data protection method as described above when running the program instructions.

[0017] In some embodiments, the security chip includes: a security chip body; a first data area installed on the security chip body for storing data to be protected; a second data area installed on the security chip body for storing a calculated verification value; and a data protection device based on chip bus encryption as described above, installed on the security chip body.

[0018] The data protection method and device based on chip bus encryption and the security chip provided by the embodiments of the present disclosure can achieve the following technical effects: In the disclosed embodiment, the protected data in the first data area is encrypted to avoid the protected data being transmitted in plain text on the chip bus. In this way, even if the data is intercepted during transmission, the attacker cannot directly read the data content because it is encrypted. The risk of tampering or leakage of the protected data due to plain text exposure is reduced. At the same time, only the data is read in the first storage area of ​​the security chip without any writing or modification operations, which ensures that the data will not be modified in the storage area, thereby ensuring the integrity and originality of the data.

[0019] The above general description and the following description are exemplary and explanatory only and are not intended to limit the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] One or more embodiments are exemplarily described by corresponding drawings, which do not limit the embodiments. Elements with the same reference numerals in the drawings are shown as similar elements, and the drawings do not constitute a scale limitation, and wherein: Figure 1 is a schematic diagram of an implementation environment of a data protection method based on chip bus encryption provided by an embodiment of the present disclosure; Figure 2 is a schematic diagram of a data protection method based on chip bus encryption provided by an embodiment of the present disclosure; Figure 3 is a schematic diagram of obtaining an encryption key provided by an embodiment of the present disclosure; Figure 4 is another schematic diagram of obtaining an encryption key provided by an embodiment of the present disclosure; Figure 5 is a schematic diagram of calculating a check value of encrypted data provided by an embodiment of the present disclosure; Figure 6 is a schematic diagram of another data protection method based on chip bus encryption provided by an embodiment of the present disclosure; Figure 7 It is a schematic diagram of a data protection device based on chip bus encryption provided by an embodiment of the present disclosure. DETAILED DESCRIPTION

[0021] In order to be able to understand the features and technical contents of the embodiments of the present disclosure in more detail, the implementation of the embodiments of the present disclosure is described in detail below in conjunction with the accompanying drawings. The attached drawings are for reference only and are not used to limit the embodiments of the present disclosure. In the following technical description, for the convenience of explanation, a full understanding of the disclosed embodiments is provided through multiple details. However, one or more embodiments can still be implemented without these details. In other cases, to simplify the drawings, well-known structures and devices can be simplified for display.

[0022] The terms "first", "second", etc. in the technical solutions described in the embodiments of the present disclosure are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the terms used in this way can be interchanged where appropriate, so as to describe the embodiments of the present disclosure described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions.

[0023] Unless otherwise stated, the term "plurality" means two or more.

[0024] In the embodiment of the present disclosure, the character " / " indicates that the preceding and following objects are in an "or" relationship. For example, A / B indicates: A or B.

[0025] The term "and / or" is a description of the association relationship between objects, indicating that three relationships can exist. For example, A and / or B means: A or B, or, A and B.

[0026] The term "correspondence" may refer to an association relationship or a binding relationship. The correspondence between A and B means that there is an association relationship or a binding relationship between A and B.

[0027] At present, chip encryption protection technology is in a stage of rapid development. With the rapid advancement of information technology and the growing demand for data security, various innovative encryption technologies are constantly emerging. At the hardware level, devices such as secure chips and dedicated hardware security modules are designed to provide strong physical security protection. By implementing encryption algorithms through hardware, they can effectively resist external attacks such as side channel attacks and physical intrusion attacks. Hardware devices usually integrate complex encryption logic circuits that can perform operations such as key generation, storage, and use, while ensuring the security of keys throughout their life cycle.

[0028] At the software level, as operating systems and applications pay more attention to data protection, software encryption technology is also constantly improving. Modern operating systems generally provide software-based encryption solutions, such as BitLocker, FileVault, etc., which use software algorithms to encrypt data on hard disks to prevent unauthorized access and data leakage.

[0029] Figure 1 Schematic diagram of the implementation environment of the data protection method based on chip bus encryption provided by the embodiment of the present disclosure. Figure 1 As shown, the implementation environment may include a first data area 100 , a second data area 200 , a chip bus encryption module 300 , a chip bus 400 and a check value calculation module 500 .

[0030] The first data area 100 is a data area to be protected by integrity check. The second data area 200 is used to store the calculated check value as the basis for the integrity check of the data in the first data area 100. The chip bus encryption module 300 is used to encrypt the data before the chip bus 400 is transmitted. The encrypted data is transmitted on the chip bus 400; the check value calculation module 500 is used to calculate the check value of the encrypted data after the chip bus 400 is transmitted.

[0031] Combination Figure 2 As shown, the embodiment of the present disclosure provides another data protection method based on chip bus encryption, including: S201, the security chip encrypts the data to be protected in the first data area to obtain encrypted data.

[0032] S202, the security chip writes the encrypted data into the chip bus.

[0033] S203, the security chip reads the encrypted data in the chip bus.

[0034] S204, the security chip calculates a check value of the encrypted data, and writes the check value of the encrypted data into the second data area.

[0035] By adopting the data protection method based on chip bus encryption provided by the embodiment of the present disclosure, the protected data in the first data area is encrypted to avoid the protected data being transmitted in plain text on the chip bus. In this way, even if the data is intercepted during the transmission process, the attacker cannot directly read the data content because it is encrypted. The risk of tampering or leakage of the protected data due to plain text exposure is reduced. At the same time, only the data is read in the first storage area of ​​the security chip without any writing or modification operations, which ensures that the data will not be modified in the storage area, thereby ensuring the integrity and originality of the data.

[0036] Optionally, encrypting the data to be protected in the first data area includes: obtaining an encryption key; and encrypting the data to be protected in the first data area using the encryption key.

[0037] In the disclosed embodiment, the sensitive data stored in the first data area of ​​the security chip is encrypted to ensure its confidentiality and integrity. After the encryption key is obtained, the key is used to perform encryption operations on the data to be protected in the first data area. This can usually be done by hardware acceleration or a specific encryption coprocessor to reduce the computational burden and improve efficiency. The encryption operation converts the data from plaintext to ciphertext, ensuring that even if the data is accessed without authorization, its content cannot be directly read.

[0038] The encrypted data cannot be deciphered without the corresponding key, thus effectively preventing the risk of data leakage. In addition, even if the data is tampered with, due to the sensitivity of the encrypted data, any change in the data will cause decryption failure, thus triggering the integrity check mechanism to ensure the integrity of the data.

[0039] Optionally, obtaining the encryption key includes: taking the address and length of the first data area as input, and obtaining the encryption key through a dispersion algorithm.

[0040] like Figure 3 As shown, in the embodiment of the present disclosure, a 128-bit encryption key is dynamically generated using a decentralized algorithm by taking the address, fixed data and counter of the first data area as input. The encryption key of each data block is independently generated based on a specific address, preset fixed data and counter value, thereby ensuring the unpredictability and high security of the key.

[0041] Specifically, the decentralized algorithm first obtains the starting address of the data block, and then logically combines the starting address with predefined fixed data, usually including security parameters or constants, to increase the complexity of the key generation process. The algorithm introduces a counter value, which can be a serial number or a specific value related to the data block, to further increase the diversity of the key. Through the combination, the algorithm generates an initial key value, and through a series of mathematical transformations, such as circular shift, XOR operation, modular addition, etc., it generates the final 128-bit encryption key.

[0042] The disclosed embodiment provides a unique encryption key for each data block, greatly improving the security of the data. Even if an attacker is able to intercept the encrypted data, the data cannot be decrypted due to the lack of the correct key. In addition, because the key of each block is independent, even if some keys are leaked, the encrypted data of other data blocks is still safe.

[0043] Optionally, obtaining an encryption key includes: using a preset random number or a specific value as the encryption key like Figure 4 As shown, in the embodiment of the present disclosure, obtaining the encryption key is achieved by using a preset random number or a specific value as the encryption key. The system first generates or selects a random number that is difficult to predict, or uses a specific value generated according to a specific algorithm as the key used in the encryption process. The generation of this encryption key is usually completed by a hardware security module or a security chip.

[0044] Using a preset random number or a specific value as the key ensures that each encryption operation is unique, thereby increasing the difficulty of cracking. In addition, it can also provide key freshness, that is, the key used for each encryption operation is new, and even if the same data is encrypted multiple times, the generated ciphertext will be different, effectively resisting replay attacks.

[0045] Optionally, the data to be protected in the first data area is encrypted using an encryption key, including: encrypting the data using a data XOR algorithm or a symmetric key algorithm according to the encryption key.

[0046] In the disclosed embodiment, in the process of encrypting the to-be-protected data in the first data zone using the encryption key, a data XOR algorithm and a symmetric key algorithm are used. For the data XOR algorithm, encryption is achieved by performing an XOR operation on each bit of the data with the corresponding bit of the key. The data XOR algorithm has a fast calculation speed and is suitable for environments with high performance requirements. Symmetric key algorithms, such as the Advanced Encryption Standard, provide a higher level of security. In the symmetric key algorithm, the encryption process uses the encryption key to transform the data block, including operations such as substitution, replacement, and mixing, to ensure the high security of the encrypted data.

[0047] The disclosed embodiment converts plaintext data into ciphertext, thereby protecting the data from unauthorized access. The rapidity of the XOR algorithm is suitable for scenarios with high real-time requirements, while the high security of the symmetric key algorithm is suitable for storing and transmitting sensitive information. The encrypted data cannot be interpreted without the correct key, effectively preventing data leakage and tampering.

[0048] Optionally, calculating the verification value of the encrypted data includes: performing group calculation on the read encrypted data according to an XOR algorithm; and performing obfuscation processing on the calculation results of the group calculation to obtain the verification value.

[0049] like Figure 5 As shown in the figure, in the process of calculating the check value of the encrypted data, the XOR algorithm is used to group the encrypted data, and the check value is obtained by obfuscating the calculation result, thereby ensuring the integrity and consistency of the data. The encrypted data is grouped according to a fixed length, and the group length usually matches the data width of the system. For example, in a 32-bit system, the length of each group of data is 32 bits.

[0050] Each group of data is calculated using an XOR algorithm. The XOR algorithm compresses the entire data group into a check value of a fixed length by performing a bit-by-bit XOR operation on the data in the group. In order to enhance the security of the check value, the check value obtained by the preliminary calculation is obfuscated. Obfuscation can be performed in a variety of ways, such as circular shift, XOR operation, arithmetic operation, etc., which can increase the randomness and complexity of the check value, making it more difficult to predict or forge the check value.

[0051] Through group calculation and obfuscation processing, a unique checksum is generated for the encrypted data. The checksum has the same data width as the original data. Under the protection of the checksum, even if the data is tampered with during transmission or storage, the abnormality can be detected by verifying the checksum.

[0052] Optionally, writing the encrypted data into the chip bus includes: grouping the encrypted data and writing the grouped data into the chip bus; wherein the data length of the grouped data is greater than or equal to the number of bits of the security chip.

[0053] In the disclosed embodiment, writing encrypted data to the chip bus can ensure the security and integrity of the data during transmission, and the encrypted data is grouped according to a specific length, which is designed to be greater than or equal to the number of bits of the security chip, to ensure that the processing power of the chip can be fully utilized when writing data, avoiding performance bottlenecks caused by data length mismatches and reducing delays caused by waiting or buffering.

[0054] Specifically, the encrypted data is analyzed to determine the appropriate packet length. In a 32-bit or 64-bit security chip, the packet length will correspond to the data processing width of the chip. Using hardware logic circuits or dedicated memory access controllers to perform data grouping and transmission can reduce the processor load and improve the efficiency of data transmission.

[0055] Furthermore, during the grouping process, the encrypted data is organized into fixed-length data blocks, and each data block is sent to the target storage area or another processing unit through the chip bus as a transmission unit. This grouping method not only improves the parallelism of data transmission, but also helps to realize error detection and correction during the data transmission process.

[0056] Optionally, reading the encrypted data in the chip bus includes: reading the encrypted data in the chip bus in groups; wherein the data length of the group is greater than or equal to the number of bits of the security chip.

[0057] In the disclosed embodiment, the encrypted data on the chip bus is grouped, wherein the data length of each group is designed to be greater than or equal to the number of bits of the security chip. In this way, it can be ensured that the data can match the data processing capability of the chip when it is read, and the maximum utilization and processing of the data can be achieved.

[0058] Specifically, a hardware controller or a dedicated interface circuit can be used to control the data packet reading process. Data is continuously read from the chip bus according to a predetermined packet length, and then the data is transmitted to the internal buffer of the security chip or directly input to the data processing unit. The packet reading method can reduce the number of accesses to the chip bus and improve the efficiency of data transmission.

[0059] In addition, since the data length of the group is at least greater than or equal to the number of bits of the security chip, the consistency and accuracy of the data during internal processing of the chip can be maintained, avoiding errors caused by truncation or incomplete data.

[0060] Optionally, before encrypting the data to be protected in the first data area, the method further includes: grouping the data to be protected in the first data area.

[0061] Combination Figure 6 As shown, the embodiment of the present disclosure provides a data protection method based on chip bus encryption, including: S601: The security chip groups the data to be protected in the first data area.

[0062] S602: The security chip encrypts the data to be protected in the first data area to obtain encrypted data.

[0063] S603, the security chip writes the encrypted data into the chip bus.

[0064] S604, the security chip reads the encrypted data in the chip bus.

[0065] S605, the security chip calculates a check value of the encrypted data, and writes the check value of the encrypted data into the second data area.

[0066] In the disclosed embodiment, data blocks are extracted from a continuous data stream according to a set packet length. The length of the packet is usually consistent with the block size of the encryption algorithm. For example, in the AES (Advanced Encryption Standard) algorithm, the commonly used packet length is 128 bits. If the end of the data area is less than a complete packet, a specific padding mechanism is required to supplement the length to ensure that the data can be processed completely.

[0067] Convert a large data set into a series of smaller data groups, each of which can then be encrypted independently. Multiple data groups can be processed in parallel, which improves the flexibility and efficiency of data processing, thereby speeding up the overall encryption speed. At the same time, grouping also makes the encryption process more modular, simplifies the complexity of error detection and correction, and once a problem occurs, only the affected specific group needs to be reprocessed instead of the entire data set.

[0068] Combination Figure 7As shown, the embodiment of the present disclosure provides a data protection device 70 based on chip bus encryption, including a processor 700 and a memory 701. Optionally, the device 70 may also include a communication interface 702 and a bus 703. Among them, the processor 700, the communication interface 702, and the memory 701 can communicate with each other through the bus 703. The communication interface 702 can be used for information transmission. The processor 700 can call the logic instructions in the memory 701 to execute the data protection method based on chip bus encryption of the above embodiment.

[0069] In addition, the logic instructions in the memory 701 described above may be implemented in the form of software functional units and when sold or used as independent products, may be stored in a computer-readable storage medium.

[0070] The memory 701 is a computer-readable storage medium that can be used to store software programs and computer executable programs, such as program instructions / modules corresponding to the method in the embodiment of the present disclosure. The processor 700 executes functional applications and data processing by running the program instructions / modules stored in the memory 701, that is, the data protection method based on chip bus encryption in the above embodiment is implemented.

[0071] The memory 701 may include a program storage area and a data storage area, wherein the program storage area may store an operating system and an application required for at least one function; the data storage area may store data created according to the use of the terminal device, etc. In addition, the memory 701 may include a high-speed random access memory and may also include a non-volatile memory.

[0072] The disclosed embodiment provides a security chip, including: a security chip body, a first data area, a second data area, and the above-mentioned data protection device 70 based on chip bus encryption. The first data area is installed in the security chip body for storing data to be protected. The second data area is installed in the security chip body for storing the calculated verification value. The data protection device 70 based on chip bus encryption is installed in the security chip body. The installation relationship described here is not limited to placement inside the security chip body, but also includes installation connections with other components of the security chip, including but not limited to physical connections, electrical connections or signal transmission connections. It can be understood by those skilled in the art that the data protection device 70 based on chip bus encryption can be adapted to a feasible security chip body, thereby realizing other feasible embodiments.

[0073] The technical solution of the embodiment of the present disclosure can be embodied in the form of a software product, which is stored in a storage medium and includes one or more instructions for enabling a computer device (which may be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the method described in the embodiment of the present disclosure. The aforementioned storage medium may be a non-transient storage medium, such as: a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a disk or an optical disk, and other media that can store program codes.

[0074] The above description and the accompanying drawings fully illustrate the embodiments of the present disclosure so that those skilled in the art can practice them. Other embodiments may include structural, logical, electrical, process and other changes. The embodiments represent only possible changes. Unless explicitly required, separate components and functions are optional, and the order of operations may vary. Parts and features of some embodiments may be included in or replace parts and features of other embodiments. Moreover, the words used in this application are only used to describe the embodiments and are not used to limit the claims. As used in the description of the embodiments and the claims, unless the context clearly indicates, the singular forms of "a", "an" and "the" are intended to include plural forms as well. Similarly, the term "and / or" as used in this application refers to any and all possible combinations of one or more associated listings. In addition, when used in this application, the term "comprise" and its variants "comprises" and / or comprising refer to the presence of stated features, wholes, steps, operations, elements, and / or components, but do not exclude the presence or addition of one or more other features, wholes, steps, operations, elements, components and / or groups thereof. In the absence of further restrictions, the elements defined by the sentence "including one..." do not exclude the presence of other identical elements in the process, method or device including the elements. In this article, each embodiment may focus on the differences from other embodiments, and the same and similar parts between the embodiments may refer to each other. For the methods, products, etc. disclosed in the embodiments, if they correspond to the method part disclosed in the embodiments, then the relevant parts can refer to the description of the method part.

[0075] Those skilled in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software may depend on the specific application and design constraints of the technical solution. The technicians may use different methods for each specific application to implement the described functions, but such implementations should not be considered to exceed the scope of the embodiments of the present disclosure. The technicians may clearly understand that, for the convenience and simplicity of description, the specific working processes of the systems, devices and units described above may refer to the corresponding processes in the aforementioned method embodiments, and will not be repeated here.

[0076] In the embodiments disclosed herein, the disclosed methods and products (including but not limited to devices, equipment, etc.) can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units can be only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the coupling or direct coupling or communication connection between each other shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms. The units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the units may be selected according to actual needs to implement this embodiment. In addition, each functional unit in the embodiment of the present disclosure may be integrated in a processing unit, or each unit may exist physically alone, or two or more units may be integrated in one unit.

[0077] The flowchart and block diagram in the accompanying drawings show the possible architecture, function and operation of the system, method and computer program product according to the embodiment of the present disclosure. In this regard, each box in the flowchart or block diagram can represent a module, a program segment or a part of the code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. In some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two consecutive boxes can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, which can depend on the functions involved. In the description corresponding to the flowchart and the block diagram in the accompanying drawings, the operations or steps corresponding to different boxes can also occur in a different order from the order disclosed in the description, and sometimes there is no specific order between different operations or steps. For example, two consecutive operations or steps can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, which can depend on the functions involved. Each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, may be implemented by a dedicated hardware-based system that performs the specified functions or actions, or may be implemented by a combination of dedicated hardware and computer instructions.

Claims

1. A data protection method based on chip bus encryption, characterized in that: include: Encrypting the data to be protected in the first data area to obtain encrypted data; Write the encrypted data into the chip bus; Read the encrypted data in the chip bus; A check value of the encrypted data is calculated, and the check value of the encrypted data is written into the second data area.

2. The data protection method according to claim 1, characterized in that: Encrypting the data to be protected in the first data area includes: Get the encryption key; The data to be protected in the first data area is encrypted using the encryption key.

3. The data protection method according to claim 2, characterized in that: Get the encryption key, including: Using the address and length of the first data area as input, an encryption key is obtained through a distributed algorithm; or, Use a preset random number or specific value as an encryption key.

4. The data protection method according to claim 2, characterized in that: Encrypting the data to be protected in the first data area using the encryption key includes: Data encryption is performed using a data XOR algorithm or a symmetric key algorithm based on the encryption key.

5. The data protection method according to claim 1, characterized in that: Calculate the checksum of the encrypted data, including: According to the XOR algorithm, the encrypted data read is grouped and calculated; The calculation results of the group calculation are obfuscated to obtain the check value.

6. The data protection method according to any one of claims 1 to 5, characterized in that: Write encrypted data to the chip bus, including: The encrypted data is grouped and written into the chip bus; wherein the data length of the grouping is greater than or equal to the number of bits of the security chip.

7. The data protection method according to any one of claims 1 to 5, characterized in that: Read the encrypted data in the chip bus, including: The encrypted data in the chip bus is read in groups; wherein the data length of the group is greater than or equal to the number of bits of the security chip.

8. The data protection method according to any one of claims 1 to 5, characterized in that: Before encrypting the data to be protected in the first data area, the method further includes: The data to be protected in the first data area is grouped.

9. A data protection device based on chip bus encryption, comprising a processor and a memory storing program instructions, characterized in that: The processor is configured to execute the data protection method based on chip bus encryption as described in any one of claims 1 to 8 when running the program instructions.

10. A security chip, characterized in that: include: Security chip body; The first data area is installed in the security chip body and is used to store data to be protected; The second data area is installed in the security chip body and is used to store the calculated check value; The data protection device based on chip bus encryption as described in claim 9 is installed in the security chip body.

Images