Encryption and decryption method and system based on AES algorithm

Abstract

The invention relates to an encryption and decryption method and system based on an AES algorithm, the system comprises a first processor, and a second processor, an internal memory, an AES module and a data transmission module which are connected with the first processor, the system communicates with the outside through the second processor and responds to user requirements, and the first processor is realized based on an HSM CPU. The second processor only interacts with the internal memory, the AES module and the data transmission module to realize data encryption and decryption without complex peripherals, so that the second processor has certain security, and the second processor has no permission to read the key, so that the key leakage can be avoided. Besides, the encryption and decryption system is realized through cooperative work of the first processor and the second processor, so that the functions of the first processor and the second processor are relatively simple, and the complexity and the cost of a chip can be reduced.

Description

Technical Field

[0001] The present application relates to the field of information security technology, and in particular to an encryption and decryption method and system based on the AES algorithm. Background Art

[0002] With the rapid development of information security technology, the functions and complexity of chips are constantly increasing, and security is also receiving more and more attention. Information security technology is the key to ensuring chip security, among which encryption and decryption algorithms are an important part of information security technology. AES (Advanced Encryption Standard) algorithm is a widely used symmetric encryption algorithm with high efficiency and strong security. Semiconductor device technology is the core of realizing the functions and complexity of security chips, among which CPU (Central Processing Unit) is the core component of semiconductor devices, responsible for executing various instructions and tasks.

[0003] In traditional technology, the security chip only contains one CPU, which makes the CPU function complex. All operations are completed by this CPU, and all sensitive information is also directly accessed by this CPU. Moreover, this CPU directly interacts with the upper layer and has many peripherals and communication interfaces, which leads to the risk of sensitive information leakage. The AES module that stores sensitive information is also at risk of being hacked, posing a huge security risk. Summary of the invention

[0004] Based on this, it is necessary to provide an encryption and decryption method, system, electronic device, readable storage medium and program product based on the AES algorithm that can improve security in response to the above technical problems.

[0005] In a first aspect, the present application provides an encryption and decryption method based on an AES algorithm, the method being applied to a first processor, the method comprising:

[0006] In the case of receiving an information encryption and decryption instruction, determining a key identifier corresponding to the information encryption and decryption instruction; the information encryption and decryption instruction is generated after the second processor obtains the encryption and decryption request;

[0007] Extracting corresponding key content from the internal memory according to the key identifier, and assigning the key content to the AES module;

[0008] The data transmission module is started, and the information to be encrypted and decrypted is read from the external memory through the data transmission module and transmitted to the AES module for encryption and decryption processing, and the data after encryption and decryption processing by the AES module is read and written into the external memory to complete the encryption and decryption processing.

[0009] In one of the embodiments, the information encryption and decryption instruction is issued by the mailbox register after the second processor performs a first configuration on the mailbox register when receiving the encryption and decryption request; determining the key identifier corresponding to the information encryption and decryption instruction includes: parsing the mailbox register according to the information encryption and decryption instruction to obtain the key identifier corresponding to the information encryption and decryption instruction.

[0010] In one of the embodiments, the data transmission module is started, and the information to be encrypted and decrypted is read from the external memory through the data transmission module and transmitted to the AES module for encryption and decryption processing, and the data after the encryption and decryption processing by the AES module is read and written into the external memory to complete the encryption and decryption processing, including: parsing the mailbox register to obtain the original data address and the result storage address corresponding to the information encryption and decryption instruction; starting the data transmission module, and the information to be encrypted and decrypted is read from the external memory based on the original data address through the data transmission module and transmitted to the AES module for encryption and decryption processing; reading the data after the encryption and decryption processing by the AES module is written into the result storage address of the external memory to complete the encryption and decryption processing.

[0011] In one of the embodiments, the method further includes: receiving a completion message sent by the data transmission module indicating completion of the encryption and decryption processing; and feeding back the completion message to the second processor, wherein the completion message is used to instruct the second processor to return a response indicating completion of the encryption and decryption according to the encryption and decryption request.

[0012] In one embodiment, the feeding back the completion message to the second processor includes: performing a second configuration on a mailbox register based on the completion message, wherein the second configuration is used to instruct the mailbox register to feed back the completion message to the second processor.

[0013] In a second aspect, the present application provides an encryption and decryption system based on the AES algorithm, the system comprising a first processor and a second processor connected to the first processor, an internal memory, an AES module and a data transmission module;

[0014] The first processor is used to determine the key identifier corresponding to the information encryption and decryption instruction when receiving the information encryption and decryption instruction; the information encryption and decryption instruction is generated after the second processor obtains the encryption and decryption request; the first processor is also used to extract the corresponding key content from the internal memory according to the key identifier, and assign the key content to the AES module; the first processor is also used to start the data transmission module, read the information to be encrypted and decrypted from the external memory through the data transmission module, transmit it to the AES module for encryption and decryption processing, and read the data after the encryption and decryption processing by the AES module and write it into the external memory to complete the encryption and decryption processing.

[0015] In one embodiment, the system further comprises a mailbox register disposed between the first processor and the second processor,

[0016] The second processor is further configured to perform a first configuration on the mailbox register upon receiving the encryption and decryption request;

[0017] The mailbox register is used to send the information encryption and decryption instruction to the first processor based on the first configuration;

[0018] The first processor is further configured to parse the mailbox register according to the information encryption and decryption instruction to obtain a key identifier corresponding to the information encryption and decryption instruction.

[0019] In one embodiment, the first processor is further used to parse the mailbox register, obtain the original data address and result storage address corresponding to the information encryption and decryption instruction, and start the data transmission module;

[0020] The data transmission module is further used to read the information to be encrypted and decrypted from the external memory based on the original data address and transmit it to the AES module;

[0021] The AES module is also used to perform encryption and decryption processing on the information to be encrypted and decrypted;

[0022] The data transmission module is also used to read the data after the encryption and decryption processing by the AES module, and write the result storage address of the external memory to complete the encryption and decryption processing.

[0023] In one of the embodiments, the data transmission module is further used to send a completion message of encryption and decryption processing completion to the first processor;

[0024] The first processor is further configured to receive the completion message and feed back the completion message to the second processor;

[0025] The second processor is further configured to receive the completion message and return a response indicating that the encryption and decryption is completed according to the encryption and decryption request.

[0026] In one embodiment, the system further comprises a mailbox register disposed between the first processor and the second processor,

[0027] The first processor is further configured to perform a second configuration on the mailbox register based on the completion message;

[0028] The mailbox register is further configured to feed back the completion message to the second processor according to the second configuration.

[0029] In a third aspect, the present application provides an electronic device, including a memory and a processor, wherein the memory stores a computer program, and the processor implements the steps of the above method when executing the computer program.

[0030] In a fourth aspect, the present application provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program implements the steps of the above method when executed by a processor.

[0031] In a fifth aspect, the present application provides a computer program product, including a computer program, which implements the steps of the above method when executed by a processor.

[0032] The above-mentioned encryption and decryption method, system, electronic device, readable storage medium and program product based on the AES algorithm, the system includes a first processor and a second processor connected to the first processor, an internal memory, an AES module and a data transmission module, which communicates with the outside and responds to user needs through the second processor, and the first processor is implemented based on the HSM CPU, and only interacts with the internal memory, the AES module and the data transmission module to realize data encryption and decryption, without complex peripherals, so it has a certain security, and the second processor has no authority to read the key, so that the key leakage can be avoided. In addition, the first processor and the second processor work together to realize the encryption and decryption system, so that the functions of the first processor and the second processor are relatively simple, thereby reducing the complexity and cost of the chip. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] In order to more clearly illustrate the technical solutions in the embodiments of the present application or related technologies, the drawings required for use in the embodiments of the present application or related technical descriptions will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0034] Figure 1The structure diagram of an encryption and decryption system based on the AES algorithm in one embodiment;

[0035] Figure 2 It is a structural diagram of an encryption and decryption system based on the AES algorithm in another embodiment;

[0036] Figure 3 A schematic diagram of a flow chart of an encryption and decryption method based on the AES algorithm in one embodiment;

[0037] Figure 4 FIG. 4 is a diagram showing the internal structure of an electronic device in one embodiment. DETAILED DESCRIPTION

[0038] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0039] In traditional technology, the chip only contains one CPU, which has complex functions and also contains many peripherals, communication interfaces and debugging functions, which further increases the complexity and cost of the chip. When the encryption and decryption functions are realized by integrating the AES module in the CPU, the CPU also needs to read the key from the FLASH according to the key ID, and then configure it to the AES module, and start DMA (Direct Memory Access) to read data from the external memory and transfer it to AES by the CPU, and then read the result from the AES module and write it back to the external memory through the CPU transfer. Since the CPU has the authority to read the key in this process, there may be a risk of key leakage, which poses a security risk. In addition, the data needs to be transferred from the external memory to the AES module through the DMA module, which affects the efficiency. Therefore, the existing technical solutions have certain limitations in terms of security, cost and efficiency.

[0040] Based on this, the embodiment of the present application provides an encryption and decryption system based on the AES algorithm, such as Figure 1 As shown, the system 100 includes a first processor 10, a second processor 11 connected to the first processor 10, an internal memory 12, an AES module 13 and a data transmission module 14, and the data transmission module 14 is also connected to the AES module 13. In the figure, R / W means read and write, specifically, R is the abbreviation of READ, which means "read", and W is the abbreviation of WRITE, which means "write". ENABLE means enable, indicating that only the first processor 10 can enable the AES module 13 to perform encryption and decryption processing.

[0041] Specifically, the second processor 11 is used to respond to user needs and initiate encryption and decryption tasks according to user needs. The second processor 11 can be implemented based on a CPU.

[0042] The first processor 10 can be implemented based on an HSM CPU (Hardware Security Module) to securely generate, store and manage keys. These keys can be used to encrypt and decrypt data, verify digital signatures, and perform other security-related operations. In this embodiment, the first processor 10 is used to respond to encryption and decryption tasks initiated by the second processor 11.

[0043] The internal memory 12 is used to store AES keys, and each AES key includes a corresponding key identifier and key content, wherein the key identifier can be a mark used to uniquely identify a key, for example, it can be an ID (Identity document, number identifier) ​​used to distinguish different keys. The key content is a specific key used to encrypt and decrypt data. In this embodiment, the internal memory 12 is subject to certain protection, and only the first processor 10 is allowed to access it, while the second processor 11 cannot access it. Specifically, the internal memory 12 can be implemented based on non-volatile storage technology. For example, it can be Flash, which can be used to store data, and the data will not be lost even after power failure, thereby enabling secure storage.

[0044] The AES module 13 is used to execute a specific encryption and decryption algorithm to encrypt and decrypt the information to be encrypted and decrypted. In this embodiment, the AES module 13 is also protected to a certain extent, and is started by the first processor 10, while the second processor 11 cannot be started.

[0045] The data transmission module 14 is used to read and write data to the AES module 13, and can be implemented based on a dual-channel DMA. For example, it can write the information to be encrypted and decrypted to the AES module 13 through one channel, and read the encrypted and decrypted data from the AES module 13 through another channel. In this embodiment, the data transmission module 14 is also protected to a certain extent, and is started by the first processor 10, but cannot be started by the second processor 11.

[0046] In this embodiment, after obtaining the encryption and decryption request sent by the user, the second processor 11 generates an information encryption and decryption instruction and sends it to the first processor 10. Among them, the encryption and decryption request is a request initiated by the user to perform an encryption and decryption task, and the encryption and decryption request may carry a key identifier. The information encryption and decryption instruction is an instruction or command generated based on the encryption and decryption request to instruct the first processor 10 to perform encryption and decryption processing. When the first processor 10 receives the information encryption and decryption instruction, it determines the key identifier corresponding to the information encryption and decryption instruction, and extracts the corresponding key content from the internal memory 12 according to the key identifier, assigns the extracted key content to the AES module 13, and then starts the data transmission module 14, reads the information to be encrypted and decrypted from the external memory through the data transmission module 14, transmits it to the AES module 13 for encryption and decryption processing, and reads the data after the encryption and decryption processing of the AES module 13 and writes it to the external memory to complete the encryption and decryption processing. Among them, the external memory can be a storage space specified by the user for storing data.

[0047] The above-mentioned encryption and decryption system based on the AES algorithm includes a first processor and a second processor connected to the first processor, an internal memory, an AES module and a data transmission module. It communicates with the outside through the second processor and responds to user needs. The first processor is implemented based on the HSM CPU and only interacts with the internal memory, the AES module and the data transmission module to realize data encryption and decryption without complex peripherals. Therefore, it has a certain degree of security, and the second processor has no authority to read the key, thereby avoiding key leakage. In addition, the first processor and the second processor work together to realize the encryption and decryption system, so that the functions of the first processor and the second processor are relatively simple, thereby reducing the complexity and cost of the chip.

[0048] In an exemplary embodiment, Figure 2 As shown, the system may further include a mailbox register 15 disposed between the first processor 10 and the second processor 11, wherein the mailbox register 15 is a mechanism for communication between on-chip processors, which obtains information through a set of registers and associated interrupt settings, and establishes a communication channel between the two processors. In this embodiment, the mailbox register 15 is used for information exchange between the first processor 10 and the second processor 11, so that the first processor 10 and the second processor 11 do not communicate directly, thereby further improving security.

[0049] Specifically, when the second processor 11 receives the encryption and decryption request, it can perform a first configuration on the mailbox register 15. Among them, the encryption and decryption request can carry a key identifier, an original data address for storing the information to be encrypted and decrypted, and a storage address for storing the result after the encryption and decryption processing. When the second processor 11 performs the first configuration on the mailbox register 15, it can be configured based on the corresponding key identifier, original data address and result storage address. The mailbox register 15 can send information encryption and decryption instructions to the first processor 10 based on the first configuration. The first processor 10 is also used to parse the mailbox register 15 according to the information encryption and decryption instructions, so as to obtain the key identifier corresponding to the information encryption and decryption instructions. In this embodiment, the first processor 10 and the second processor 11 exchange information through the mailbox register 15, so that the first processor 10 and the second processor 11 do not communicate directly, and the data encryption and decryption processing is independently dominated by the first processor, without the intervention of the second processor, thereby further improving security.

[0050] In an exemplary embodiment, the first processor 10 is also used to parse the mailbox register 15, obtain the original data address and the result storage address corresponding to the information encryption and decryption instruction, and start the data transmission module 14. The data transmission module 14 reads the information to be encrypted and decrypted from the external memory based on the original data address and transmits it to the AES module 13. The AES module 13 is used to encrypt and decrypt the information to be encrypted and decrypted to obtain the encrypted and decrypted data. The data transmission module 14 is also used to read the data after the AES module 13 performs encryption and decryption processing, and writes the result storage address of the external memory to complete the encryption and decryption processing. In this embodiment, since the mailbox register only transmits the address of an external memory, the data transmission module 14 directly reads the data from the external memory based on the transmitted address and directly transmits it to the AES module 13 without transit, which makes the data transmission path shorter and reduces the data transmission time, thereby improving efficiency.

[0051] In an exemplary embodiment, after reading the data after the AES module 13 performs encryption and decryption processing and writing the result storage address of the external memory, the data transmission module 14 can also send a completion message of the encryption and decryption processing to the first processor 10. The first processor 10 is also used to receive the completion message and feedback the completion message to the second processor 11. The second processor 11 is also used to receive the completion message and return a response of encryption and decryption completion according to the encryption and decryption request. In this way, closed-loop processing of encryption and decryption requests is realized, so that users can timely understand the processing status and obtain the data after encryption and decryption processing.

[0052] In an exemplary embodiment, after receiving the completion message, the first processor 10 can also perform a second configuration on the mailbox register 15 based on the completion message, and the second configuration is used to indicate that the encryption and decryption task corresponding to the encryption and decryption request is completed. The mailbox register 15 is also used to feedback the completion message to the second processor 11 according to the second configuration, so that the second processor 11 returns a response to the user that the encryption and decryption is completed. This realizes closed-loop processing of encryption and decryption requests, improves the response speed of the system, and enables users to understand the processing status and obtain the data after encryption and decryption processing in a timely manner. In addition, in this embodiment, information interaction is performed through the mailbox register 15, which can also improve security.

[0053] In one embodiment, the system may further include a random access memory 16, which may be implemented based on SRAM (Static Random-Access Memory). In this embodiment, the random access memory 16 is accessed by the first processor 10 and is used to directly interact with the first processor 10. Since the random access memory 16 has the characteristics of fast writing and reading speed, the processing efficiency of the first processor 10 can be improved.

[0054] Each module in the above-mentioned encryption and decryption system based on the AES algorithm can be implemented in whole or in part by software, hardware, or a combination thereof. Each of the above-mentioned modules can be embedded in or independent of a processor in an electronic device in the form of hardware, or can be stored in a memory in an electronic device in the form of software, so that the processor can call and execute the operations corresponding to each of the above modules.

[0055] Based on the same inventive concept, the embodiment of the present application also provides an encryption and decryption method based on the AES algorithm, which is applied to Figure 1 , Figure 2 The first processor in. Figure 3 As shown, the method may include the following steps:

[0056] Step 302: upon receiving an information encryption / decryption instruction, determining a key identifier corresponding to the information encryption / decryption instruction.

[0057] The information encryption and decryption instruction is generated after the second processor obtains the encryption and decryption request. The encryption and decryption request is a request initiated by the user to perform an encryption and decryption task, and the encryption and decryption request may carry a key identifier. The information encryption and decryption instruction is an instruction or command generated based on the encryption and decryption request to instruct the first processor to perform encryption and decryption processing. In this embodiment, when the first processor receives the information encryption and decryption instruction, it can determine the key identifier corresponding to the information encryption and decryption instruction, and perform encryption and decryption processing based on subsequent steps.

[0058] Step 304: extract the corresponding key content from the internal memory according to the key identifier, and distribute the key content to the AES module.

[0059] Specifically, the first processor extracts the corresponding key content from the internal memory according to the key identifier determined in the above steps, and distributes the key content to the AES module.

[0060] Step 306, start the data transmission module and call the AES module to complete the encryption and decryption process.

[0061] Specifically, the first processor starts the data transmission module, and reads the information to be encrypted and decrypted from the external memory through the data transmission module and transmits it to the AES module for encryption and decryption processing, and reads the data after the AES module is encrypted and decrypted and writes it into the external memory to complete the encryption and decryption processing.

[0062] In the above-mentioned encryption and decryption method based on the AES algorithm, when the first processor receives the information encryption and decryption instruction sent by the second processor, it determines the key identifier corresponding to the information encryption and decryption instruction, extracts the corresponding key content from the internal memory according to the key identifier, and assigns the key content to the AES module, and then starts the data transmission module, and reads the information to be encrypted and decrypted from the external memory through the data transmission module and transmits it to the AES module for encryption and decryption processing, and reads the data after the AES module is encrypted and decrypted and writes it to the external memory to complete the encryption and decryption processing. Because it communicates with the outside and responds to user needs through the second processor, and the first processor only interacts with the internal memory, the AES module and the data transmission module to realize data encryption and decryption, without complex peripherals, it has a certain degree of security, and the second processor has no authority to read the key, so that the key leakage can be avoided. In addition, the first processor and the second processor work together to realize the encryption and decryption system, so that the functions of the first processor and the second processor are relatively simple, thereby reducing the complexity and cost of the chip.

[0063] In an exemplary embodiment, the information encryption and decryption instruction is issued by the mailbox register after the second processor performs a first configuration on the mailbox register when receiving the encryption and decryption request; determining the key identifier corresponding to the information encryption and decryption instruction includes: parsing the mailbox register according to the information encryption and decryption instruction to obtain the key identifier corresponding to the information encryption and decryption instruction.

[0064] In an exemplary embodiment, the data transmission module is started, and the information to be encrypted and decrypted is read from the external memory through the data transmission module and transmitted to the AES module for encryption and decryption processing, and the data after the encryption and decryption processing by the AES module is read and written into the external memory to complete the encryption and decryption processing, including: parsing the mailbox register to obtain the original data address and the result storage address corresponding to the information encryption and decryption instruction; starting the data transmission module, and the information to be encrypted and decrypted is read from the external memory based on the original data address through the data transmission module and transmitted to the AES module for encryption and decryption processing; reading the data after the encryption and decryption processing by the AES module is written into the result storage address of the external memory to complete the encryption and decryption processing.

[0065] In an exemplary embodiment, the method further includes: receiving a completion message sent by the data transmission module indicating completion of the encryption and decryption processing; and feeding back the completion message to the second processor, wherein the completion message is used to instruct the second processor to return the encrypted and decrypted data according to the encryption and decryption request.

[0066] In an exemplary embodiment, feeding back the completion message to the second processor includes: performing a second configuration on a mailbox register based on the completion message, wherein the second configuration is used to instruct the mailbox register to feed back the completion message to the second processor.

[0067] It should be understood that, although the various steps in the flowcharts involved in the above-mentioned embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above-mentioned embodiments can include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0068] In an exemplary embodiment, an electronic device is provided, the internal structure of which can be as shown in FIG. Figure 4As shown. The electronic device includes a processor, a memory, an input / output interface (Input / Output, referred to as I / O) and a communication interface. Among them, the processor, the memory and the input / output interface are connected through a system bus, and the communication interface is connected to the system bus through the input / output interface. Among them, the processor of the electronic device is used to provide computing and control capabilities. The memory of the electronic device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The input / output interface of the electronic device is used to exchange information between the processor and an external device. The communication interface of the electronic device is used to communicate with an external terminal device through a network connection. When the computer program is executed by the processor, an encryption and decryption method based on the AES algorithm is implemented.

[0069] Those skilled in the art will understand that Figure 4 The structure shown in the figure is merely a block diagram of a partial structure related to the scheme of the present application, and does not constitute a limitation on the electronic device to which the scheme of the present application is applied. The specific electronic device may include more or fewer components than shown in the figure, or combine certain components, or have a different arrangement of components.

[0070] In an exemplary embodiment, an electronic device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the steps in the above-mentioned method embodiments when executing the computer program.

[0071] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps in the above-mentioned method embodiments are implemented.

[0072] In one embodiment, a computer program product is provided, including a computer program, which implements the steps in the above method embodiments when executed by a processor.

[0073] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant regulations.

[0074] A person of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment method can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, an artificial intelligence (AI) processor, etc., but are not limited to this.

[0075] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0076] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. An encryption and decryption method based on the AES algorithm, characterized in that: The method is applied to a first processor, and the method includes: In the case of receiving an information encryption and decryption instruction, determining a key identifier corresponding to the information encryption and decryption instruction; the information encryption and decryption instruction is generated after the second processor obtains the encryption and decryption request; Extracting corresponding key content from the internal memory according to the key identifier, and assigning the key content to the AES module; The data transmission module is started, and the information to be encrypted and decrypted is read from the external memory through the data transmission module and transmitted to the AES module for encryption and decryption processing, and the data after encryption and decryption processing by the AES module is read and written into the external memory to complete the encryption and decryption processing.

2. The method according to claim 1, characterized in that: The information encryption and decryption instruction is issued by the mailbox register after the second processor performs a first configuration on the mailbox register when receiving the encryption and decryption request; the determining of the key identifier corresponding to the information encryption and decryption instruction includes: The mailbox register is parsed according to the information encryption and decryption instruction to obtain a key identifier corresponding to the information encryption and decryption instruction.

3. The method according to claim 2, characterized in that The starting data transmission module reads the information to be encrypted and decrypted from the external memory through the data transmission module and transmits it to the AES module for encryption and decryption processing, and reads the data after the encryption and decryption processing by the AES module and writes it into the external memory to complete the encryption and decryption processing, including: Parsing the mailbox register to obtain the original data address and result storage address corresponding to the information encryption and decryption instruction; Starting a data transmission module, through which the data transmission module reads the information to be encrypted and decrypted from the external memory based on the original data address and transmits it to the AES module for encryption and decryption processing; The data after the encryption and decryption processing by the AES module is read and written into the result storage address of the external memory to complete the encryption and decryption processing.

4. The method according to any one of claims 1 to 3, characterized in that: The method further comprises: Receiving a completion message sent by the data transmission module indicating that the encryption and decryption processing is completed; The completion message is fed back to the second processor, where the completion message is used to instruct the second processor to return a response indicating that encryption and decryption are completed according to the encryption and decryption request.

5. The method according to claim 4, characterized in that The feeding back the completion message to the second processor includes: A second configuration is performed on the mailbox register based on the completion message, where the second configuration is used to instruct the mailbox register to feed back the completion message to the second processor.

6. An encryption and decryption system based on the AES algorithm, characterized in that: The system includes a first processor and a second processor connected to the first processor, an internal memory, an AES module and a data transmission module; The first processor is configured to determine a key identifier corresponding to the information encryption and decryption instruction when receiving the information encryption and decryption instruction; the information encryption and decryption instruction is generated after the second processor obtains the encryption and decryption request; The first processor is also used to extract the corresponding key content from the internal memory according to the key identifier, and assign the key content to the AES module; the first processor is also used to start the data transmission module, read the information to be encrypted and decrypted from the external memory through the data transmission module, transmit it to the AES module for encryption and decryption processing, and read the data after encryption and decryption processing by the AES module and write it into the external memory to complete the encryption and decryption processing.

7. The system according to claim 6, characterized in that The system further includes a mailbox register disposed between the first processor and the second processor, The second processor is further configured to perform a first configuration on the mailbox register upon receiving the encryption and decryption request; The mailbox register is used to send the information encryption and decryption instruction to the first processor based on the first configuration; The first processor is further configured to parse the mailbox register according to the information encryption and decryption instruction to obtain a key identifier corresponding to the information encryption and decryption instruction.

8. The system according to claim 7, characterized in that The first processor is further used to parse the mailbox register, obtain the original data address and result storage address corresponding to the information encryption and decryption instruction, and start the data transmission module; The data transmission module is further used to read the information to be encrypted and decrypted from the external memory based on the original data address and transmit it to the AES module; The AES module is also used to perform encryption and decryption processing on the information to be encrypted and decrypted; The data transmission module is also used to read the data after the encryption and decryption processing by the AES module, and write the result storage address of the external memory to complete the encryption and decryption processing.

9. The system according to any one of claims 6 to 8, characterized in that: The data transmission module is further used to send a completion message of encryption and decryption processing completion to the first processor; The first processor is further configured to receive the completion message and feed back the completion message to the second processor; The second processor is further configured to receive the completion message and return a response indicating that the encryption and decryption is completed according to the encryption and decryption request.

10. The system according to claim 9, characterized in that The system further includes a mailbox register disposed between the first processor and the second processor, The first processor is further configured to perform a second configuration on the mailbox register based on the completion message; The mailbox register is further configured to feed back the completion message to the second processor according to the second configuration.

Images