FPGA bit stream encryption processing method and device, electronic equipment and storage medium
By generating public-private key pairs inside the FPGA chip and encrypting the bitstream key using the key encapsulation mechanism, the problems of key leakage and side channel attacks are solved, and the high security of the bitstream and key update capabilities are achieved.
Patent Information
- Application Number
- CN202310848548.0
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2023-07-11
- Publication Date
- 2025-01-14
AI Technical Summary
The existing FPGA bitstream encryption technology has the risk of key leakage and side channel attack threats, and the key cannot be updated, affecting the security of the bitstream.
The key encapsulation mechanism adopts the cryptographic algorithm, by generating public-private key pairs inside the FPGA chip, encapsulating using public-key keys, and only private keys are saved inside the FPGA chip. Only public key encapsulation is transmitted during communication to ensure that the key is not leaked. , and encrypt the bitstream cipher block through the key update mechanism.
It effectively avoids the leakage of bitstream encryption keys, enhances the security of bitstream, allows the update of the entire bitstream ciphertext, and reduces the risk of side channel attacks.
Smart Images
Figure CN119316118A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the technical field of bit stream encryption, and in particular to a FPGA bit stream encryption processing method and device. Background Art
[0002] With the widespread use of FPGA (Field Programmable Gate Array), the value of FPGA bitstream is becoming increasingly apparent. In order to prevent products from being counterfeited and IP (Intellectual Property) in products from being stolen, the current common protection method is to encrypt the bitstream. The entire ciphertext bitstream is encrypted using a single key, which is stored inside the FPGA chip. The bitstream ciphertext cannot be updated. The bitstream encryption program needs to send the key to the FPGA chip, which means that key transmission occurs during the communication process. This bitstream encryption method requires that the communication process must be in a secure environment, otherwise there is a risk of key leakage; and the bitstream loading process is vulnerable to side channel attacks, which can obtain the bitstream encryption key, threatening the security of the bitstream.
[0003] In the latest FPGA products, FPGA manufacturers have begun to use key update mechanisms to resist side channel attacks. Figure 1 As shown in the figure, in this mechanism, key 1 is stored in the FPGA and used to encrypt the plaintext bitstream to obtain the ciphertext of bitstream ciphertext block 1 and key 2. The ciphertext of key 2 is the result of key 2 being encrypted by key 1, the ciphertext of key 3 is the result of key 3 being encrypted by key 2, and so on. Except for bitstream ciphertext block 1, the remaining ciphertext bitstreams can be updated. This is because key 1 cannot be updated. Both the chip and the bitstream encryption program must know key 1. Once it is stolen or compromised, the bitstream ciphertext can be completely decrypted. Although this key update scheme increases the difficulty of side channel attacks, it also requires key 1 to be written into the FPGA chip, which poses a risk of key leakage; and because key 1 cannot be changed, the FPGA cannot completely update the bitstream encryption key. Summary of the invention
[0004] The embodiment of the present invention provides an FPGA bit stream encryption processing method and device, which can effectively prevent the leakage of the bit stream encryption key and ensure the security of the bit stream.
[0005] To this end, the embodiment of the present invention provides the following technical solutions:
[0006] On the one hand, an embodiment of the present invention provides an FPGA bit stream encryption processing method, the method comprising:
[0007] determining a first key;
[0008] generating a first key package corresponding to the first key through a key encapsulation mechanism, and encrypting a plaintext bit stream file using the first key;
[0009] Generates a bitstream encrypted file.
[0010] Optionally, encrypting the plaintext bitstream file using the first key includes: encrypting a first data block of the plaintext bitstream file using the first key;
[0011] The method further comprises: determining new keys in sequence, generating new key encapsulation corresponding to the new keys through the key encapsulation mechanism, and encrypting other data blocks of the plaintext bitstream using the new key until all plaintext bitstream data blocks are encrypted;
[0012] The generating of the bitstream encrypted file comprises: sequentially connecting each key package and the corresponding bitstream ciphertext block to obtain the bitstream encrypted file.
[0013] Optionally, the method further comprises:
[0014] Generate public and private keys using cryptographic algorithms inside the FPGA chip;
[0015] The key encapsulation mechanism includes: encrypting a secret key using the public key, and encrypting a bit stream using the secret key.
[0016] Optionally, the cryptographic algorithm includes any one of the following: RSA algorithm, ECC algorithm, post-quantum cryptographic algorithm.
[0017] Optionally, the method further comprises:
[0018] Loading the bitstream encrypted file into the FPGA chip;
[0019] The FPGA decapsulates the private key to obtain the key, and decrypts the bitstream encrypted file according to the key to obtain a bitstream plaintext.
[0020] On the other hand, an embodiment of the present invention further provides an FPGA bit stream encryption processing device, the device comprising:
[0021] A key determination module, used to determine a first key;
[0022] An encryption processing module, used for generating a first key package corresponding to the first key through a key encapsulation mechanism, and encrypting a plaintext bit stream file using the first key;
[0023] The encrypted file generation module is used to generate a bit stream encrypted file.
[0024] Optionally, the encryption processing module encrypts the first data block of the plaintext bitstream file using the first key;
[0025] The key determination module is further used to determine new keys in sequence;
[0026] The encryption processing module is further used to generate a new key package corresponding to the new key through the key package mechanism, and use the new key to encrypt other data blocks of the plaintext bit stream until all plaintext bit stream data blocks are encrypted;
[0027] The encrypted file generation module is specifically used to sequentially connect each key package and the corresponding bit stream ciphertext block to obtain a bit stream encrypted file.
[0028] Optionally, the device further comprises: an FPGA module, configured to generate a public key and a private key using a cryptographic algorithm;
[0029] The encryption processing module generates a first key package corresponding to the first key and a new key package corresponding to the new key using the public key.
[0030] Optionally, the device further comprises: a loading module, configured to load the bit stream encryption file into the FPGA;
[0031] The FPGA module decapsulates the private key to obtain the key, and decrypts the bitstream encrypted file according to the key to obtain the bitstream plaintext.
[0032] On the other hand, an embodiment of the present invention further provides an electronic device, comprising a memory and a processor, wherein the memory stores a computer program that can be run on the processor, and the processor executes the steps of the above-mentioned FPGA bit stream encryption processing method when running the computer program.
[0033] On the other hand, an embodiment of the present invention further provides a computer-readable storage medium, which is a non-volatile storage medium or a non-transient storage medium, on which a computer program is stored, and is characterized in that when the computer program is run by a processor, the steps of the FPGA bit stream encryption processing method described above are executed.
[0034] The FPGA bitstream encryption processing method and device provided by the embodiment of the present invention uses the key encapsulation mechanism of the cryptographic algorithm to encrypt and save the encryption key of each bitstream ciphertext block. The public and private key pairs of the cryptographic algorithm are generated inside the FPGA chip. The bitstream encryption program only needs to obtain the public key, generate the key encapsulation, and then use the key stored in the key encapsulation to encrypt the bitstream plaintext. In this way, the private key is only stored inside the FPGA chip and is not easily leaked. Only the public key of the key encapsulation mechanism appears during the communication process, and the bitstream encryption key does not appear. By using the key encapsulation mechanism, the entire bitstream ciphertext can be updated. BRIEF DESCRIPTION OF THE DRAWINGS
[0035] Figure 1 is a schematic diagram of encrypting a bit stream using a key update mechanism in the prior art;
[0036] Figure 2 It is a flow chart of the FPGA bit stream encryption processing method provided by an embodiment of the present invention;
[0037] Figure 3 is another flow chart of the FPGA bit stream encryption processing method provided by an embodiment of the present invention;
[0038] Figure 4 It is a schematic diagram of the process of encrypting a plaintext bit stream file using the method of the present invention;
[0039] Figure 5 It is a structural schematic diagram of an FPGA bit stream encryption processing device provided by an embodiment of the present invention;
[0040] Figure 6 This is a schematic diagram of a specific application structure of the FPGA bit stream encryption processing device provided in an embodiment of the present application;
[0041] Figure 7 It is a schematic diagram of the hardware structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION
[0042] In order to make the above-mentioned objects, features and beneficial effects of the present invention more obvious and easy to understand, specific embodiments of the present invention are described in detail below with reference to the accompanying drawings.
[0043] It should be noted that the terms used in the embodiments of the present invention are only for the purpose of describing specific embodiments and are not intended to limit this specification. The singular forms of "a", "the" and "the" used in the embodiments of the present invention and the appended claims are also intended to include plural forms, unless the context clearly indicates other meanings. In addition, the "plurality" appearing in the embodiments of the present invention refers to two or more.
[0044] In view of the problems existing in the existing bitstream encryption methods, the bitstream encryption method and device provided by the embodiments of the present invention use the key encapsulation mechanism of the cryptographic algorithm to encrypt and save the encryption key of each bitstream ciphertext block. The public and private key pairs of the cryptographic algorithm are generated inside the FPGA chip. The bitstream encryption program only needs to obtain the public key, generate the key encapsulation, and then use the key stored in the key encapsulation to encrypt the bitstream plaintext. In this way, the private key is only stored inside the FPGA chip and is not easily leaked. Only the public key of the key encapsulation mechanism appears during the communication process, and the bitstream encryption key does not appear. By using the key encapsulation mechanism, the entire bitstream ciphertext can be updated.
[0045] like Figure 2FIG. 1 is a flow chart of a method for encrypting an FPGA bit stream provided by an embodiment of the present invention, comprising the following steps:
[0046] Step 201, determine the first key.
[0047] Step 202: Generate a first key package corresponding to the first key through a key package mechanism, and use the first key to encrypt the plaintext bit stream file.
[0048] The key encapsulation mechanism is an encryption technique used to protect the confidentiality and integrity of data. It is a method of encrypting and transmitting keys to the recipient to ensure that only authorized users can access the data.
[0049] The basic principle of the key encapsulation mechanism is to use a public key encryption algorithm to encrypt the key, and then transmit the encrypted key to the recipient. The recipient uses the private key to decrypt the key and then uses the key to decrypt the data. This method ensures that only authorized users can access the data because only authorized users have the correct private key to decrypt the key.
[0050] In an embodiment of the present invention, a public key and a private key pair can be generated inside the FPGA chip using a cryptographic algorithm. The bitstream encryption program only needs to obtain the public key, generate a key package, and then use the key stored in the key package to encrypt the bitstream plaintext.
[0051] The cryptographic algorithm may be, but is not limited to, any one of the following: RSA algorithm, ECC (Elliptic Curves Cryptography) algorithm, PQC (Post Quantum Cryptography) algorithm, etc.
[0052] Constructing the key encapsulation mechanism inside the FGPA chip includes the following steps:
[0053] First, set up the encryption scheme: that is, you need to choose a public key encryption scheme, that is, determine the cryptographic algorithm that generates the public and private keys.
[0054] Then define the specific algorithm of the key encapsulation mechanism. Usually a key encapsulation mechanism consists of the following three parts:
[0055] (1) Generate a pair of public and private keys;
[0056] (2) Use the public key to encapsulate a secret key and generate ciphertext;
[0057] (3) Use the private key to decrypt the ciphertext and restore the key.
[0058] Step 203: Generate a bitstream encrypted file.
[0059] It should be noted that the first key can be used to encrypt the entire bitstream file. Accordingly, the generated bitstream encrypted file includes: the first key encapsulation and the bitstream ciphertext.
[0060] Correspondingly, when the bitstream file needs to be loaded, the bitstream encrypted file is transmitted to the FPGA chip, and the FPGA decrypts the first key package in the bitstream encrypted file according to its own private key to obtain the first key, and then uses the first key to decrypt the bitstream ciphertext to obtain the bitstream plaintext, and then a series of operations can be performed based on the bitstream plaintext.
[0061] The FPGA bitstream encryption processing method provided by the embodiment of the present invention uses the key encapsulation mechanism of the cryptographic algorithm to encrypt and save the encryption key of each bitstream ciphertext block. The public and private key pairs of the cryptographic algorithm are generated inside the FPGA chip. The bitstream encryption program only needs to obtain the public key, generate the key encapsulation, and then use the key stored in the key encapsulation to encrypt the bitstream plaintext. In this way, the private key is only stored inside the FPGA chip and is not easy to leak. Only the public key of the key encapsulation mechanism appears during the communication process, and the bitstream encryption key does not appear. By using the key encapsulation mechanism, the entire bitstream ciphertext can be updated.
[0062] Side channel attack, also known as side channel cryptographic analysis, is a physical attack method against cryptographic implementations (including cryptographic chips, cryptographic modules, cryptographic systems, etc.). The essence of this attack method is to use the side information generated by the cryptographic implementation in the process of performing cryptographic related operations to recover the key used in the cryptographic implementation. The side information here refers to the information related to the running status of the cryptographic implementation obtained by the attacker through channels other than the main communication channel. Typical side information includes energy consumption, electromagnetic radiation, running time, etc. during the operation of the cryptographic implementation.
[0063] The side channel is relative to the main channel. Encrypted information is transmitted through the main channel. When the cryptographic device processes it, it will leak certain power consumption, electromagnetic, heat, sound, color and other information through the side channel. The leaked information will vary as these devices process data and operate differently. Attackers analyze this difference to obtain sensitive information such as the device's key.
[0064] Side channel information is generally divided into: sound, temperature, power consumption, electromagnetic, color, etc. When the encryption hardware is encrypting, the above information is only the physical quantity generated during the encryption process. Attackers use the collected physical information and combine it with statistical methods or other algorithms to reveal the key used on the hardware.
[0065] The more data encrypted by the same key, the more side channel information will be generated, and the more vulnerable it will be to side channel attacks. To this end, in another non-limiting embodiment of the present invention, a new key can be generated through a key update mechanism, that is, using multiple keys to encrypt different data blocks in the bit stream file respectively. Figure 3 This is explained.
[0066] like Figure 3 FIG. 1 is another flow chart of an FPGA bit stream encryption processing method provided by an embodiment of the present invention, comprising the following steps:
[0067] Step 301, determine the first key.
[0068] Step 302: Generate a first key package corresponding to the first key through a key package mechanism, and use the first key to encrypt a first data block of the plaintext bit stream file.
[0069] Step 303, determine the new key in turn, generate a new key package corresponding to the new key through the key encapsulation mechanism, and use the new key to encrypt other data blocks of the plaintext bit stream until all plaintext bit stream data blocks are encrypted.
[0070] Step 304, sequentially connect each key package and the corresponding bitstream ciphertext block to obtain a bitstream encrypted file.
[0071] It should be noted that there may be one or more new keys, which is not limited in the embodiment of the present invention.
[0072] Reference Figure 4 , Figure 4 The schematic diagram shows the process of encrypting a plaintext bit stream file using the method of the present invention.
[0073] First, determine key 1, encrypt key 1 with the public key to generate key package 1, and encrypt bit stream data block 1 with key 1 to obtain bit stream ciphertext block 1;
[0074] Then, update key 1 to a new key, namely key 2, encrypt key 2 with the public key to generate key package 2, and encrypt bit stream data block 2 with key 2 to obtain bit stream ciphertext block 2;
[0075] And so on, until all bit stream data blocks are encrypted.
[0076] Finally, a bitstream encrypted file is obtained, the structure of which is as follows: Figure 4 As shown, they are arranged in the following order: key encapsulation 1, bit stream ciphertext block 1, key encapsulation 2, bit stream ciphertext block 2, ….
[0077] It should be noted that the above-mentioned initial key (ie, key 1) and the updated key (eg, key 2) may be generated randomly or according to certain rules, which is not limited in the embodiment of the present invention.
[0078] In addition, the data blocks of the plaintext bit stream file can be divided according to a set length, or the number of data blocks can be pre-set and then the length of each data block can be determined. The specific length can be determined according to actual needs, and the embodiment of the present invention does not limit this. However, it should be noted that the number of keys required should be consistent with the number of divided data blocks, that is, different data blocks are encrypted using different keys.
[0079] By dividing the plaintext bitstream file into multiple data blocks and encrypting different data blocks with different keys, the side channel information of the ciphertext generated by the same key can be reduced when the encrypted bitstream file is loaded, thereby effectively increasing the difficulty of side channel attacks and further improving the security of the bitstream file loading process.
[0080] Accordingly, an embodiment of the present invention further provides an FPGA bit stream encryption processing device, such as Figure 5 , which is a schematic diagram of the structure of an FPGA bit stream encryption processing device provided by an embodiment of the present invention.
[0081] In this embodiment, the FPGA bit stream encryption processing device 500 includes:
[0082] The key determination module 501 is used to determine a first key;
[0083] An encryption processing module 502, configured to generate a first key package corresponding to the first key through a key package mechanism, and encrypt a plaintext bit stream file using the first key;
[0084] The encrypted file generation module 503 is used to generate a bit stream encrypted file.
[0085] The FPGA bitstream encryption method provided by the embodiment of the present invention uses the key encapsulation mechanism of the cryptographic algorithm to encrypt and save the encryption key of each bitstream ciphertext block. The public and private key pairs of the cryptographic algorithm are generated inside the FPGA chip. The bitstream encryption program only needs to obtain the public key, generate the key encapsulation, and then use the key stored in the key encapsulation to encrypt the bitstream plaintext. In this way, the private key is only stored inside the FPGA chip and is not easy to leak. Only the public key of the key encapsulation mechanism appears during the communication process, and the bitstream encryption key does not appear. By using the key encapsulation mechanism, the entire bitstream ciphertext can be updated.
[0086] like Figure 6 , which is a schematic diagram of a specific application structure of the FPGA bit stream encryption processing device provided by an embodiment of the present invention.
[0087] In this embodiment, the FPGA bit stream encryption processing device 500 further includes: an FPGA module 601 and a loading module 602. Among them:
[0088] The FPGA module 601 is used to generate a public key and a private key using a cryptographic algorithm. Accordingly, the encryption processing module 502 generates a first key package corresponding to the first key using the public key.
[0089] In this embodiment, the loading module 602 is used to load the bit stream encryption file into the FPGA.
[0090] Correspondingly, the FPGA module 601 can decapsulate according to the private key to obtain the key, and decrypt the bitstream encrypted file according to the key to obtain the bitstream plaintext.
[0091] In order to better prevent side-channel attacks during the transmission of the bitstream encrypted file, in another non-limiting embodiment, the bitstream file can also be encrypted based on the key update mechanism and the key encapsulation mechanism at the same time.
[0092] Specifically, the key determination module 501 not only needs to determine the first key, but also needs to determine new keys in sequence.
[0093] Correspondingly, the encryption processing module 502 needs to generate a first key package corresponding to the first key through a key encapsulation mechanism, and use the first key to encrypt the first data block of the plaintext bit stream file. It also needs to generate a new key package corresponding to the new key through the key encapsulation mechanism in turn, and use the new key to encrypt other data blocks of the plaintext bit stream until all plaintext bit stream data blocks are encrypted.
[0094] Correspondingly, the encrypted file generation module 503 is used to sequentially connect each key package and the corresponding bitstream ciphertext block to obtain a bitstream encrypted file.
[0095] For other related descriptions of the above-mentioned FPGA bit stream encryption processing device 500, please refer to Figures 2 to 4 The relevant description in will not be repeated here.
[0096] The bitstream encrypted file obtained by processing with the scheme of the present invention does not need to transmit the bitstream encryption key during the communication process, which can avoid the leakage of the encryption key and does not require a secure environment; moreover, using the scheme of the present invention, the bitstream encryption key can be completely updated and all keys can be changed.
[0097] In addition, although the key negotiation mechanism can also achieve the goal of not transmitting the bitstream encryption key during communication, the key negotiation mechanism requires the FPGA chip and the bitstream encryption program to interact, while the key encapsulation mechanism does not require interaction and only requires the bitstream encryption program to send the key encapsulation result.
[0098] Correspondingly, an embodiment of the present invention further provides an electronic device, comprising the above-mentioned FPGA bit stream encryption processing device 500.
[0099] Regarding the various modules / units included in the various devices and products described in the above embodiments, they can be software modules / units, or hardware modules / units, or they can be partially software modules / units and partially hardware modules / units. For example, for various devices and products applied to or integrated in a chip, the various modules / units included therein can all be implemented in the form of hardware such as circuits, or at least some of the modules / units can be implemented in the form of software programs, which run on a processor integrated inside the chip, and the remaining (if any) modules / units can be implemented in the form of hardware such as circuits; for various devices and products applied to or integrated in a chip module, the various modules / units included therein can all be implemented in the form of hardware such as circuits, and different modules / units can be located in the same component of the chip module (such as a chip, circuit module, etc.) or in different components, or at least some of the modules / units can be implemented in the form of software programs. It is implemented in the form of a software program, which runs on a processor integrated inside the chip module, and the remaining (if any) modules / units can be implemented in hardware such as circuits; for various devices and products applied to or integrated in the terminal equipment, the various modules / units contained therein can be implemented in hardware such as circuits, and different modules / units can be located in the same component (for example, chip, circuit module, etc.) or in different components in the terminal equipment, or, at least some modules / units can be implemented in the form of a software program, which runs on a processor integrated inside the terminal equipment, and the remaining (if any) modules / units can be implemented in hardware such as circuits.
[0100] The present application also discloses a storage medium, which is a computer-readable storage medium and stores a computer program. When the computer program is executed, Figure 2 or Figure 3 All or part of the steps of the method shown in . The storage medium may include a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, etc. The storage medium may also include a non-volatile memory (non-volatile) or a non-transitory memory, etc.
[0101] An embodiment of the present invention further provides an electronic device, comprising a memory and a processor, wherein the memory stores a computer program that can be run on the processor, and the processor executes a graphic Figure 2 or Figure 3 All or part of the steps of the method.
[0102] The first, second, etc. descriptions appearing in the embodiments of the present application are only used for illustration and distinction of the description objects. There is no order, nor do they indicate any special limitation on the number of devices in the embodiments of the present application, and cannot constitute any limitation on the embodiments of the present application.
[0103] The above embodiments may be implemented in whole or in part by software, hardware, firmware or any other combination thereof. When implemented using software, the above embodiments may be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions or computer programs. When the computer instructions or computer programs are loaded or executed on a computer, the processes or functions described in the embodiments of the present application are generated in whole or in part. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices. The computer instructions may be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer instructions may be transmitted from one website site, computer, server or data center to another website site, computer, server or data center by wired or wireless means.
[0104] Please refer to Figure 7 The embodiment of the present invention also provides a hardware structure diagram of an electronic device. The communication device includes a processor 701, a memory 702 and a transceiver 703.
[0105] Processor 701 may be a general-purpose central processing unit (CPU), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits for controlling the execution of the program of the present application. Processor 701 may also include multiple CPUs, and processor 701 may be a single-core (single-CPU) processor or a multi-core (multi-CPU) processor. The processor here may refer to one or more devices, circuits, or processing cores for processing data (such as computer program instructions).
[0106] The memory 702 may be a ROM or other types of static storage devices that can store static information and instructions, a RAM or other types of dynamic storage devices that can store information and instructions, or an electrically erasable programmable read-only memory (EEPROM), a compact disc read-only memory (CD-ROM) or other optical disc storage, optical disc storage (including compressed optical disc, laser disc, optical disc, digital versatile disc, Blu-ray disc, etc.), a disk storage medium or other magnetic storage device, or any other medium that can be used to carry or store the desired program code in the form of an instruction or data structure and can be accessed by a computer, and the embodiment of the present invention does not impose any restrictions on this. The memory 702 may exist independently (in this case, the memory 802 may be located outside the device or inside the device), or it may be integrated with the processor 701. Among them, the memory 702 may contain a computer program code. The processor 701 is used to execute the computer program code stored in the memory 702, thereby realizing the method provided in the embodiment of the present application.
[0107] The processor 701, the memory 702 and the transceiver 703 are connected via a bus. The transceiver 703 is used to communicate with other devices or a communication network. Optionally, the transceiver 703 may include a transmitter and a receiver. The device used to implement the receiving function in the transceiver 703 can be regarded as a receiver, and the receiver is used to perform the receiving steps in the embodiment of the present application. The device used to implement the sending function in the transceiver 703 can be regarded as a transmitter, and the transmitter is used to perform the steps in the method embodiment of the present application.
[0108] when Figure 7 The schematic diagram of the structure shown in the figure is used to illustrate the structure of the electronic device involved in the above embodiment. The processor 701 is used to control and manage the actions of the electronic device. For example, the processor 701 is used to support the terminal device to execute Figure 2 or Figure 3 The processor 701 may communicate with other network entities via the transceiver 703. The memory 702 is used to store program codes and data of the terminal device.
[0109] It should be understood that in the various embodiments of the present application, the size of the serial numbers of the above-mentioned processes does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.
[0110] In the several embodiments provided in the present application, it should be understood that the disclosed methods, devices and systems can be implemented in other ways. For example, the device embodiments described above are merely schematic; for example, the division of the units is only a logical function division, and there may be other division methods in actual implementation; for example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.
[0111] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.
[0112] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may be physically included separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of hardware plus software functional units.
[0113] The above-mentioned integrated unit implemented in the form of a software functional unit can be stored in a computer-readable storage medium. The above-mentioned software functional unit is stored in a storage medium, including a number of instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to perform some steps of the method described in each embodiment of the present application.
[0114] Although the present application is disclosed as above, the present application is not limited thereto. Any person skilled in the art can make various changes and modifications without departing from the spirit and scope of the present application. Therefore, the protection scope of the present application shall be subject to the scope defined by the claims.
Claims
1. A FPGA bit stream encryption processing method, characterized in that: The method comprises: determining a first key; generating a first key package corresponding to the first key through a key encapsulation mechanism, and encrypting a plaintext bit stream file using the first key; Generates a bitstream encrypted file.
2. The method according to claim 1, characterized in that The encrypting the plaintext bitstream file using the first key comprises: Encrypting a first data block of a plaintext bitstream file using the first key; The method further comprises: Determining new keys in sequence, generating new key encapsulation corresponding to the new keys through the key encapsulation mechanism, and encrypting other data blocks of the plaintext bit stream using the new keys until all plaintext bit stream data blocks are encrypted; The generating of the bitstream encrypted file comprises: Each key package and the corresponding bitstream ciphertext block are sequentially connected to obtain a bitstream encrypted file.
3. The method according to claim 2, characterized in that The method further comprises: Generate public and private keys using cryptographic algorithms inside the FPGA chip; The key encapsulation mechanism includes: encrypting a secret key using the public key, and encrypting a bit stream using the secret key.
4. The method according to claim 3, characterized in that The cryptographic algorithm includes any one of the following: RSA algorithm, ECC algorithm, and post-quantum cryptographic algorithm.
5. The method according to claim 3, characterized in that: The method further comprises: Loading the bitstream encrypted file into the FPGA chip; The FPGA decapsulates the private key to obtain the key, and decrypts the bitstream encrypted file according to the key to obtain a bitstream plaintext.
6. An FPGA bit stream encryption processing device, characterized in that: The device comprises: A key determination module, used to determine a first key; An encryption processing module, used for generating a first key package corresponding to the first key through a key encapsulation mechanism, and encrypting a plaintext bit stream file using the first key; The encrypted file generation module is used to generate a bit stream encrypted file.
7. The device according to claim 6, characterized in that The encryption processing module encrypts the first data block of the plaintext bitstream file using the first key; The key determination module is further used to determine new keys in sequence; The encryption processing module is further used to generate a new key package corresponding to the new key through the key package mechanism, and use the new key to encrypt other data blocks of the plaintext bit stream until all plaintext bit stream data blocks are encrypted; The encrypted file generation module is specifically used to sequentially connect each key package and the corresponding bit stream ciphertext block to obtain a bit stream encrypted file.
8. The device according to claim 7, characterized in that The device also includes: An FPGA module for generating public and private keys using cryptographic algorithms; The encryption processing module generates a first key package corresponding to the first key and a new key package corresponding to the new key using the public key.
9. The device according to claim 8, characterized in that The device also includes: A loading module, used for loading the bit stream encrypted file into the FPGA; The FPGA module decapsulates the private key to obtain the key, and decrypts the bitstream encrypted file according to the key to obtain the bitstream plaintext.
10. An electronic device, characterized in that: It comprises a memory and a processor, wherein the memory stores a computer program that can be run on the processor, and is characterized in that when the processor runs the computer program, the steps of the FPGA bit stream encryption processing method described in any one of claims 1 to 5 are executed.
11. A computer-readable storage medium, wherein the computer-readable storage medium is a non-volatile storage medium or a non-transient storage medium, and a computer program is stored thereon, wherein: When the computer program is executed by a processor, the steps of the FPGA bit stream encryption processing method according to any one of claims 1 to 5 are executed.