A data encryption method and device for eMMC storage device

Abstract

The present invention discloses a data encryption method and device for an eMMC storage device, the method comprising the following steps: 1) obtaining encryption features according to the device unlocking information and the hardware device unique ID serial number set for the first time by the authentication module; 2) the encryption features are processed and integrated by the SOC to obtain the feature matrix of the encryption key key; 3) the SOC chip transmits the feature matrix to the encryption bridge chip, and the encryption bridge chip uses the feature matrix as the key for encrypting and decrypting eMMC data transmission; 4) when the user unlocks the device, the SOC generates a new feature matrix according to the unlocking information; 5) the new feature matrix is ​​matched with the feature matrix stored in the encryption bridge chip for similarity, and after verification, the SOC interacts with the eMMC through the bridge chip to write or read data. The encryption, decryption and transmission of eMMC data are performed using the method of the present invention, and the data can only be read normally under the current device, thereby realizing data protection of the device.

Description

Technical Field

[0001] The present invention relates to memory technology, and in particular to a data encryption method and device for an eMMC storage device. Background Art

[0002] eMMC is widely used as a storage unit for various devices due to its advantages such as low cost, high performance, small size, wide range of optional capacity, strong stability, etc. As a data storage unit, eMMC is mainly used to store various data of terminal devices, such as photos, videos, files, operation information records, etc. The data is transmitted through the eMMC protocol, and the data transmission is directly connected to the host. The data on the host side will be directly written into the eMMC without data encryption and protection.

[0003] Due to its wide application in various fields, the update and iteration of electronic devices, and the easy loss of mobile terminals, when the eMMC unit is recycled or lost, electronic devices currently do not have full-link data encryption specifically for eMMC. It is mainly through physical identification units, such as fingerprints, facial information, palm prints, etc. or digital password authentication methods, to encrypt and protect the entire device. Once the eMMC unit is completely removed, the external authentication form will be bypassed, and the data inside the eMMC can still be fully read through devices that support the eMMC protocol. Since there is no encryption form, the data is presented in the same form on different terminals, that is, the original data, which can easily cause data leakage. If the corresponding device stores very important information, it may cause a very serious information security incident, resulting in irreparable losses. Summary of the invention

[0004] The technical problem to be solved by the present invention is to provide a data encryption method and device for an eMMC storage device in view of the defects in the prior art.

[0005] The technical solution adopted by the present invention to solve the technical problem is: a data encryption method for an eMMC storage device,

[0006] The eMMC storage device includes an authentication module, a SOC, an encryption bridge chip and an eMMC; wherein the host-side data of the SOC is connected to the eMMC through the encryption bridge chip;

[0007] The data encryption method includes the following steps:

[0008] 1) Obtain the encryption feature based on the device unlocking information and the unique ID serial number of the hardware device set for the first time by the authentication module;

[0009] 2) The encryption features are processed and fused by SOC to obtain the feature matrix of the encryption key;

[0010] 3) The SOC chip transmits the feature matrix to the encryption bridge chip, which uses the feature matrix as the key for encrypting and decrypting eMMC data transmission. The key is stored in the on-chip Flash resources;

[0011] 4) When the user unlocks the device, the SOC generates a new feature matrix based on the unlock information;

[0012] 5) The new feature matrix is ​​calculated with the feature matrix stored in the encryption bridge chip to match the similarity. When the feature similarity exceeds the set value, the verification is passed, the data path between the encryption bridge chip and the eMMC is opened, and the SOC interacts with the eMMC through the bridge chip to write or read data;

[0013] The data written into the eMMC is hard-encrypted by the encryption bridge chip, and the data read from the eMMC is decrypted by the encryption bridge chip.

[0014] According to the above scheme, in step 1), the unlocking information includes fingerprint information, facial information and digital key;

[0015] The hardware device unique ID serial number includes the hardware's MN, serial number SN and product number PN code.

[0016] According to the above scheme, in step 1), the encryption feature is one of fingerprint information, facial information and digital key, or a combination of one of fingerprint information, facial information and digital key and SN / MN / PN.

[0017] According to the above scheme, in step 2), the encryption features are fused to obtain the feature matrix of the encryption key key, which is as follows:

[0018] Perform image biometric feature extraction on facial images or fingerprint images to generate feature images; then fuse the matrix generated by the feature image with the matrix generated by the hardware features SN / MN / PN to obtain the feature matrix of the encryption key key.

[0019] According to the above scheme, in step 2), the encryption features are fused to obtain the feature matrix of the encryption key key, which is as follows:

[0020] 2.1) Obtain encryption features based on unlocking information;

[0021] 2.2) Calibrate the facial image or fingerprint image to obtain key point positioning;

[0022] 2.3) Use the MobileNetV2 lightweight convolutional neural network model to extract image biometric features and generate feature images;

[0023] 2.4) Scale and crop the center of the key point area of ​​the feature image to form a 48×48 square matrix D0;

[0024] Take the first row of D0 as the hardware feature row, and set all the first row of D0 to 0 to get the matrix D1;

[0025] Arrange the corresponding ASCII code values ​​in the order of MN-SN-PN and record them as matrix D2; the number of rows and columns of D2 is 1 row and 48 columns; each element Xascii in matrix D2 is normalized to the range of 0-255,

[0026]

[0027] In the formula, floor is the rounding function;

[0028] Add D1 and D2 to obtain the feature matrix P.

[0029] According to the above scheme, in step 3), the characteristic matrix values ​​and data are transmitted between the encryption bridge chip and the SOC chip via the USB protocol.

[0030] According to the above scheme, in step 3), the characteristic matrix data values ​​are cut and spliced ​​into 48 segments of 48 bytes of hexadecimal data streams, which are transmitted through the encryption algorithm of the encryption chip.

[0031] According to the above scheme, in step 5), the similarity is calculated as follows:

[0032] A string comparison function is used for the matrix data generated by the hardware features SN / MN / PN in the fused feature matrix. When there is a complete match, a similarity factor p1=1 is obtained, and when there is no match, a similarity factor p1=0 is obtained.

[0033] For the matrix part generated by the feature image in the fused feature matrix, the similarity calculation uses the average value of the mean hash algorithm similarity and the difference hash similarity calculation;

[0034] p2=(ahash+phash) / 2;

[0035] Comprehensive similarity ;

[0036] in, and is the introduced weight factor. When P1=1, =0, =1, when p1=0, = =0.

[0037] According to the above solution, in step 5), the encryption bridge chip includes a security engine crypto, and the security engine crypto is used to perform encryption and decryption operations on the data entering the encryption bridge chip.

[0038] The present invention also provides a data encryption device for an eMMC storage device, comprising:

[0039] The eMMC storage device includes an authentication module, a SOC, an encryption bridge chip and an eMMC; wherein the host-side data of the SOC is connected to the eMMC through the encryption bridge chip;

[0040] The data encryption device includes:

[0041] An encryption feature acquisition module, used to acquire encryption features according to the device unlocking information and the hardware device unique ID serial number set for the first time by the authentication module;

[0042] The feature matrix generation module is used to process and fuse the encryption features by SOC to obtain the feature matrix of the encryption key key;

[0043] The key storage module is used to transmit the feature matrix to the encryption bridge chip through the SOC chip. The encryption bridge chip uses the feature matrix as the key for encrypting and decrypting eMMC data transmission. The key is stored in the on-chip Flash resources.

[0044] The unlock information acquisition module is used to acquire the unlock information when the user unlocks the device, and generate a new feature matrix using the feature matrix generation module according to the unlock information;

[0045] The unlocking information verification module is used to perform operations on the new feature matrix and the feature matrix stored in the encryption bridge chip to match the similarity. When the feature similarity exceeds the set value, the verification is passed, the data path between the encryption bridge chip and the eMMC is opened, and the SOC interacts with the eMMC through the bridge chip to write or read data;

[0046] Among them, the data written into the eMMC is hard-encrypted by the encryption bridge chip, and the data read from the eMMC is decrypted by the encryption bridge chip.

[0047] The present invention also provides an electronic device, comprising: one or more processors;

[0048] And a storage device for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors execute the method described in any one of the above solutions.

[0049] The present invention also provides a computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the method described in any one of the above solutions is implemented.

[0050] The beneficial effects produced by the present invention are:

[0051] 1. The method of the present invention is used to encrypt, decrypt and transmit eMMC data, and the data can be read normally only under the current device, thereby realizing data protection of the device.

[0052] 2. The present invention realizes the encryption of the full-link data of eMMC, with a higher security level. The original data cannot be read without the original hardware environment and authentication.

[0053] 3. The present invention uses an eMMC bridge chip to implement hardware encryption, which does not require complex calculations and firmware optimization of the SOC or eMMC itself, and does not need to improve the computing performance of the original chip itself, and has lower development costs and cycles.

[0054] 4. The present invention uses the feature key composed of biometric information or digital password and SOC unique hardware code as the verification password of the encryption bridge chip, which is strongly bound to the hardware, and has a higher level of security. BRIEF DESCRIPTION OF THE DRAWINGS

[0055] The present invention will be further described below with reference to the accompanying drawings and embodiments, in which:

[0056] Figure 1 is a method flow chart of an embodiment of the present invention;

[0057] Figure 2 is a schematic diagram of an eMMC storage device according to an embodiment of the present invention;

[0058] Figure 3 is a flow chart of a method for generating a characteristic matrix of an encryption key according to an embodiment of the present invention;

[0059] Figure 4 is a schematic diagram of the structure of the crypto module of the security engine of an embodiment of the present invention;

[0060] Figure 5 It is a flow chart of encryption and decryption of data written into eMMC according to an embodiment of the present invention. DETAILED DESCRIPTION

[0061] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention.

[0062] like Figure 1As shown, a data encryption method for an eMMC storage device,

[0063] The eMMC storage device includes an authentication module, a SOC, an encryption bridge chip and an eMMC; wherein the host-side data of the SOC is connected to the eMMC via the encryption bridge chip;

[0064] The encrypted eMMC identified by the authentication module (such as fingerprint, facial information, digital key) or the hardware unique ID serial number (such as MN, SN of the main SOC and other hardware) together with the encryption bridge chip constitutes eMMC encryption; the sensors of the authentication module such as fingerprint, camera, etc. are used to collect identity information and generate a unique feature ID, which has the same ownership level as the digital password and the unique serial number of the machine; the eMMC and the main SOC end use the encryption bridge chip to build a data transmission channel; after the authentication information is authenticated by the SOC main control, the host-side data of the SOC is connected to the eMMC through the bridge chip, thus forming a data link with encryption function as a whole.

[0065] The data encryption method includes the following steps:

[0066] 1) Obtain the encryption feature based on the device unlocking information and the unique ID serial number of the hardware device when the authentication module is first set (or first set after the unlocking information is changed);

[0067] Unlock information includes fingerprint, facial information and digital key;

[0068] The unique ID serial number of the hardware device includes the hardware's MN, serial number SN and product number PN code;

[0069] The encryption feature is one of fingerprint information, facial information and digital key, or a combination of one of fingerprint information, facial information and digital key and SN / MN / PN.

[0070] 2) The encryption features are fused through SOC processing to obtain the feature matrix of the encryption key;

[0071] In this embodiment, it is assumed that the encryption feature is a combination of one of the facial image or the fingerprint image and the hardware feature SN / MN / PN;

[0072] Perform image biometric feature extraction on facial images or fingerprint images to generate feature images; then fuse the matrix generated by the feature image with the matrix generated by the hardware feature SN / MN / PN to obtain the feature matrix of the encryption key. Figure 3 ;

[0073] 2.1) Obtain encryption features based on unlocking information;

[0074] 2.2) Calibrate the facial image or fingerprint image to obtain key point positioning;

[0075] 2.3) Use the MobileNetV2 lightweight convolutional neural network model to extract image biometric features and generate feature images;

[0076] 2.4) Scale and crop the center of the key point area of ​​the feature image to form a 48×48 square matrix D0;

[0077] Take the first row of D0 as the hardware feature row, and set all the first row of D0 to 0 to get the matrix D1;

[0078] Arrange the corresponding ASCII code values ​​in the order of MN-SN-PN and record them as matrix D2; the number of rows and columns of D2 is 1 row and 48 columns; each element Xascii in matrix D2 is normalized to the range of 0-255,

[0079]

[0080] In the formula, floor is the rounding function;

[0081] Add D1 and D2 to obtain the feature matrix P.

[0082] If it is a digital password, each row of the matrix D0 corresponds to the data corresponding to the ASCII code of the password and repeats the cycle to fill D0;

[0083]

[0084] Take the first row of D0 as the hardware feature row, and set all the first row of D0 to 0 to get the matrix D1;

[0085] Add D1 and D3 to obtain the feature matrix.

[0086] 3) The SOC chip transmits the feature matrix to the encryption bridge chip, which uses the feature matrix as the key for encrypting and decrypting eMMC data transmission. The key is stored in the on-chip Flash resources;

[0087] The encryption bridge chip and the SOC chip transmit characteristic matrix values ​​and data via the USB protocol. The characteristic matrix data values ​​are cut and spliced ​​into 48 segments of 48 bytes of hexadecimal data streams and transmitted through the encryption chip encryption algorithm.

[0088] 4) When the user unlocks the device, the SOC generates a new feature matrix based on the unlocking information; the generation method is the same as step 2);

[0089] 4.1) Obtaining encryption features based on unlocking information;

[0090] 4.2) If the unlocking information is facial recognition or fingerprint information, calibrate the facial image or fingerprint image to obtain key point positioning;

[0091] 4.3) Use the MobileNetV2 lightweight convolutional neural network model to extract image biometric features and generate feature images;

[0092] 4.4) Scale and crop the center of the key point area of ​​the feature image to form a 48×48 square matrix D0;

[0093] Take the first row of D0 as the hardware feature row, and set all the first row of D0 to 0 to get the matrix D1;

[0094] Arrange the corresponding ASCII code values ​​in the order of MN-SN-PN and record them as matrix D2. The number of rows and columns of D2 is 1 row and 48 columns. Each element Xascii in the matrix is ​​normalized to the range of 0-255.

[0095]

[0096] In the formula, floor is the rounding function;

[0097] Add D1 and D2 to obtain the feature matrix P.

[0098] If the unlocking information is a digital password, the square matrix D0 is generated in the following way: each line of the square matrix D0 corresponds to the data corresponding to the ASCII code of the password and the cycle is repeated to fill D0;

[0099] Take the first row of D0 as the hardware feature row, and set all the first row of D0 to 0 to get the matrix D1;

[0100]

[0101] Add D1 and D3 to obtain the feature matrix.

[0102] 5) The new feature matrix is ​​calculated with the matrix stored in the encryption bridge chip to match the similarity. When the feature similarity exceeds 90%, the verification is passed, the data path between the encryption bridge chip and the eMMC is opened, and the SOC interacts with the eMMC through the bridge chip to write or read data;

[0103] The data written into the eMMC is hard-encrypted by the encryption bridge chip, and the data read from the eMMC is decrypted by the encryption bridge chip.

[0104] The data written into the eMMC by the SOC Host is encrypted by the encryption bridge chip. The specific encryption method is as follows: Figure 2 :

[0105] The encryption bridge chip includes a security engine crypto, which is used to perform encryption and decryption operations on data entering the encryption bridge chip.

[0106] Currently, it supports two symmetric encryption algorithms, SM4 and AES, and four HASH algorithms, SM3, SHA1, SHA224, and SHA256. The two are independent of each other. SM4 and AES data go through the AXI bus, and SM3, SHA1, SHA224, and SHA256 data go through the AHB bus. When the data enters the Crypto module from the AXI SLAVE port, AXI MASTER port, or AHB SLAVE port, the Crypto module register is configured through the AHB bus to select the corresponding function until the encryption and decryption are completed. The structural block diagram is as follows Figure 4 :

[0107] The security engine Crypto automatically switches to DMA mode. In this mode, a MASTER port is used to complete the read and write operations. The Crypto module will fetch data for encryption and decryption according to the configured source address and data length, and then write the encrypted and decrypted data to the corresponding destination address. Crypto in DMA mode is an independent module. When working, it is not connected to the front and back ends, but directly acts on the data buffer in RAM.

[0108] Symmetric encryption and decryption functions can be realized by simply passing the data source address, destination address, algorithm parameters, etc. to the corresponding API interface according to regulations. The operation process of this mode is as follows Figure 5 :

[0109] The data in the eMMC is encrypted, decrypted and transmitted in this way, and its data can only be read normally under the current device, thus realizing the data protection of the device.

[0110] In addition, the eMMC selected by the solution of the present invention chooses to convert the eMMC5.1 to USB3.0 protocol, which basically eliminates the performance loss of the eMMC, and the user will not have a difference in performance experience, and the data transmission method can be compatible with more main controllers with USBHOST capabilities. At the same time, only a small eMMC encryption bridge chip needs to be selected, which will basically not affect the design and layout of the mobile device PCB. Without upgrading the soc and eMMC hardware, the production cost and software and hardware development cycle of the equipment manufacturer can be effectively reduced.

[0111] According to the above method, the present invention also provides a data encryption device for an eMMC storage device, comprising:

[0112] The eMMC storage device includes an authentication module, a SOC, an encryption bridge chip and an eMMC; wherein the host-side data of the SOC is connected to the eMMC through the encryption bridge chip;

[0113] The data encryption device includes:

[0114] An encryption feature acquisition module, used to acquire encryption features according to the device unlocking information and the hardware device unique ID serial number set for the first time by the authentication module;

[0115] The feature matrix generation module is used to process and fuse the encryption features by SOC to obtain the feature matrix of the encryption key key;

[0116] The key storage module is used to transmit the feature matrix to the encryption bridge chip through the SOC chip. The encryption bridge chip uses the feature matrix as the key for encrypting and decrypting eMMC data transmission. The key is stored in the on-chip Flash resources.

[0117] The unlock information acquisition module is used to acquire the unlock information when the user unlocks the device, and generate a new feature matrix using the feature matrix generation module according to the unlock information;

[0118] The unlocking information verification module is used to perform operations on the new feature matrix and the feature matrix stored in the encryption bridge chip to match the similarity. When the feature similarity exceeds the set value, the verification is passed, the data path between the encryption bridge chip and the eMMC is opened, and the SOC interacts with the eMMC through the bridge chip to write or read data;

[0119] Among them, the data written into the eMMC is hard-encrypted by the encryption bridge chip, and the data read from the eMMC is decrypted by the encryption bridge chip.

[0120] It should be understood that those skilled in the art can make improvements or changes based on the above description, and all these improvements and changes should fall within the scope of protection of the appended claims of the present invention.

Claims

1. A data encryption method for an eMMC storage device, characterized in that: The eMMC storage device includes an authentication module, a SOC, an encryption bridge chip and an eMMC; wherein the host-side data of the SOC is connected to the eMMC through the encryption bridge chip; The data encryption method includes the following steps: 1) Obtain the encryption feature based on the device unlocking information and the unique ID serial number of the hardware device set for the first time by the authentication module; The unlocking information includes fingerprint information, facial information and digital key; The hardware device unique ID serial number includes the hardware's MN, serial number SN and product number PN code; The encryption feature is one of fingerprint information, facial information and digital key, or a combination of one of fingerprint information, facial information and digital key and SN / MN / PN; 2) The encryption features are processed and fused by SOC to obtain the feature matrix of the encryption key key; the details are as follows: 2.1) Obtain encryption features based on unlocking information; 2.2) Calibrate the facial image or fingerprint image to obtain key point positioning; 2.3) Use the MobileNetV2 lightweight convolutional neural network model to extract image biometric features and generate feature images; 2.4) Scale and crop the center of the key point area of ​​the feature image to form a 48×48 square matrix D0; Take the first row of D0 as the hardware feature row, and set all the first row of D0 to 0 to get the matrix D1; Arrange the corresponding ASCII code values ​​in the order of MN-SN-PN and record them as matrix D2; the number of rows and columns of D2 is 1 row and 48 columns; each element Xascii in matrix D2 is normalized to the range of 0-255, In the formula, floor is the rounding function; Add D1 and D2 to obtain the feature matrix P; 3) The SOC chip transmits the feature matrix to the encryption bridge chip, which uses the feature matrix as the key for encrypting and decrypting eMMC data transmission. The key is stored in the on-chip Flash resources; 4) When the user unlocks the device, the SOC generates a new feature matrix based on the unlock information; 5) The new feature matrix is ​​calculated with the feature matrix stored in the encryption bridge chip to match the similarity. When the feature similarity exceeds the set value, the verification is passed, the data path between the encryption bridge chip and the eMMC is opened, and the SOC interacts with the eMMC through the bridge chip to write or read data; The data written into the eMMC is hard-encrypted by the encryption bridge chip, and the data read from the eMMC is decrypted by the encryption bridge chip.

2. The data encryption method for an eMMC storage device according to claim 1, wherein: In the step 3), the encryption bridge chip and the SOC chip transmit characteristic matrix values ​​and data via the USB protocol.

3. The data encryption method for an eMMC storage device according to claim 1, characterized in that: In step 5), the similarity is calculated as follows: A string comparison function is used for the matrix data generated by the hardware features SN / MN / PN in the fused feature matrix. When there is a complete match, a similarity factor p1=1 is obtained, and when there is no match, a similarity factor p1=0 is obtained. For the matrix part generated by the feature image in the fused feature matrix, the similarity calculation uses the average value of the mean hash algorithm similarity and the difference hash similarity calculation; p2=(ahash+phash) / 2; Comprehensive similarity ; in, and is the introduced weight factor. When P1=1, =0, =1, when p1=0, = =0.

4. A data encryption device for an eMMC storage device, characterized in that: include: The eMMC storage device includes an authentication module, a SOC, an encryption bridge chip and an eMMC; wherein the host-side data of the SOC is connected to the eMMC through the encryption bridge chip; The data encryption device includes: The encryption feature acquisition module is used to obtain the encryption feature according to the device unlocking information and the unique ID serial number of the hardware device set for the first time by the authentication module; the unlocking information includes fingerprint information, facial information and digital key; the unique ID serial number of the hardware device includes the MN, serial number SN and product number PN code of the hardware; The encryption feature is one of fingerprint information, facial information and digital key, or a combination of one of fingerprint information, facial information and digital key and SN / MN / PN; The feature matrix generation module is used to fuse the encryption features processed by SOC to obtain the feature matrix of the encryption key key; Get the characteristic matrix of the encryption key key; the details are as follows: 1) Obtain encryption features based on unlocking information; 2) Calibrate the facial image or fingerprint image to obtain key point positioning; 3) Use the MobileNetV2 lightweight convolutional neural network model to extract image biometric features and generate feature images; 4) Scale and crop the center of the key point area of ​​the feature image to form a 48×48 square matrix D0; Take the first row of D0 as the hardware feature row, and set all the first row of D0 to 0 to get the matrix D1; Arrange the corresponding ASCII code values ​​in the order of MN-SN-PN and record them as matrix D2; the number of rows and columns of D2 is 1 row and 48 columns; each element Xascii in matrix D2 is normalized to the range of 0-255, In the formula, floor is the rounding function; Add D1 and D2 to obtain the feature matrix P; The key storage module is used to transmit the feature matrix to the encryption bridge chip through the SOC chip. The encryption bridge chip uses the feature matrix as the key for encrypting and decrypting eMMC data transmission. The key is stored in the on-chip Flash resources. The unlock information acquisition module is used to acquire the unlock information when the user unlocks the device, and generate a new feature matrix using the feature matrix generation module according to the unlock information; The unlocking information verification module is used to perform operations on the new feature matrix and the feature matrix stored in the encryption bridge chip to match the similarity. When the feature similarity exceeds the set value, the verification is passed, the data path between the encryption bridge chip and the eMMC is opened, and the SOC interacts with the eMMC through the bridge chip to write or read data; Among them, the data written into the eMMC is hard-encrypted by the encryption bridge chip, and the data read from the eMMC is decrypted by the encryption bridge chip.

5. An electronic device, characterized in that: include: one or more processors; as well as a storage device for storing one or more programs, When the one or more programs are executed by the one or more processors, the one or more processors are caused to execute the method according to any one of claims 1 to 4.

6. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the method according to any one of claims 1 to 4 is implemented.

Images