Secret key storage method and device and electronic equipment

Abstract

The invention provides a key storage method and device and electronic equipment, and relates to the technical field of security, and the method comprises the steps: obtaining a key encryption instruction issued by an application program; calling a random number generation module to generate a key based on the key encryption instruction; storing the secret key to a secret key storage area offset position which is not used currently in a first storage medium, and recording and storing the secret key position of the secret key to a record storage area offset position which is not used currently in a second storage medium; the first storage medium is different from the second storage medium. According to the method, the key and the key position record are stored through different storage media respectively, efficient and rapid key storage and reading are achieved, the device can rapidly find an idle key storage area without traversing all keys, the initialization process of the device is not affected, the overall process of a service is not blocked, and the user experience is improved. Therefore, unpredictable errors are not caused, and meanwhile, the storage efficiency and retrieval efficiency of the secret key can be improved.

Description

Technical Field

[0001] The present invention relates to the field of security technology, and in particular to a key storage method, device and electronic equipment. Background Art

[0002] When developing secure storage products that involve large-volume file encryption, there will be a corresponding large-volume key storage requirement. One file corresponds to an independent key, and the storage of these keys requires an efficient and fast management and storage solution. The key is stored during encryption and read during decryption. To read the key, the key corresponding to the index must be quickly found based on the index.

[0003] In traditional key storage solutions, the ID + key is used for storage and is stored in a storage medium. When the device is powered on, it is necessary to traverse all the keys to determine the unused space in the key storage area for subsequent storage of new keys. However, the more keys are stored, the longer the traversal time is. When the traversal time is high enough, problems may occur that affect the device initialization process, resulting in unforeseen errors. Summary of the invention

[0004] The present invention provides a key storage method, device and electronic device, which are used to solve the defect that the time-consuming traversal affects the device initialization process and causes unforeseen errors.

[0005] The present invention provides a key storage method, comprising: Get the key encryption instruction issued by the application; Based on the key encryption instruction, calling a random number generation module to generate a key; The key is stored in a key storage area offset position that is not currently used in a first storage medium, and the key position record of the key is stored in a record storage area offset position that is not currently used in a second storage medium; the first storage medium and the second storage medium are different.

[0006] According to a key storage method provided by the present invention, the key position record of the key is determined based on the offset position of the currently unused key storage area; each time the key is stored, the offset position of the currently unused key storage area is offset by a first target number; each time the key position record of the key is stored, the offset position of the currently unused record storage area is offset by a second target number.

[0007] According to a key storage method provided by the present invention, the method further includes: Obtaining a key decryption instruction issued by the application; the key decryption instruction carries the value of the key position record of the key; Determining, based on the value of the key position record of the key, an offset position of a key storage area in the first storage medium where the key is stored; Based on the offset position of the key storage area, the key is read.

[0008] According to a key storage method provided by the present invention, before storing the key, the method further includes: Determining, based on the plurality of sectors obtained by dividing the second storage medium, an offset position where a key position record of a newly stored key is located; Based on the offset position, determining the offset position of the most recently stored key; Based on the offset position of the most recently stored key, determining whether it is necessary to restore the offset position of the record storage area missed by the abnormal power failure; In the case where it is necessary to restore the offset position of the record storage area missed due to abnormal power failure, the missed offset position of the record storage area is restored; In the case where there is no need to restore the offset position of the record storage area missed due to abnormal power failure, the missed offset position of the record storage area is not restored.

[0009] According to a key storage method provided by the present invention, the method of determining the offset position of the key position record of the most recently stored key based on the multiple sectors obtained by dividing the second storage medium comprises: Based on any sector among the multiple sectors obtained by dividing the second storage medium, traverse the array corresponding to the sector in units of preset target bytes; If the offset position of the key position record corresponding to the currently traversed target byte is not the offset position of the preset key position record of the latest stored key, repeatedly determine each target byte after the currently traversed target byte until the offset position of the key position record corresponding to the final traversed target byte is the offset position of the preset key position record of the latest stored key; The offset position of the key position record corresponding to the previous target byte of the finally traversed target byte is determined as the offset position of the key position record of the most recently stored key.

[0010] According to a key storage method provided by the present invention, the method further includes: Determine whether the offset position of the current latest key position record is an integer multiple of the preset target number; In the case where the offset position of the current latest key position record is an integer multiple of the preset target number, determining whether the offset position of the key position record of the previous sector is the offset position of the key position record of the preset latest stored key; In a case where the offset position where the key position record of the previous sector is located is not the offset position where the key position record of the preset latest stored key is located, the offset position where the key position record of the previous sector is located is erased.

[0011] According to a key storage method provided by the present invention, the method further includes: Based on the multiple sectors obtained by dividing the second storage medium, sequentially write the key position record of at least one key into a first sector of the multiple sectors; When the first sector is full, the key position records of the remaining keys in each of the keys are sequentially written into the next sector of the first sector, and the key position records are repeatedly written into each sector until each sector is full; When the last sector is fully written, the first sector is written again.

[0012] According to a key storage method provided by the present invention, the method further includes: When the next sector starts writing the key position record, the key position record written in the previous sector is erased.

[0013] The present invention also provides a key storage device, comprising: A first acquisition module, used to acquire a key encryption instruction issued by an application; A generation module, used to call a random number generation module to generate a key based on the key encryption instruction; A storage module is used to store the key to an offset position of a key storage area that is currently not used in a first storage medium, and to store a key position record of the key to an offset position of a record storage area that is currently not used in a second storage medium; the first storage medium and the second storage medium are different.

[0014] The present invention also provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, any of the key storage methods described above is implemented.

[0015] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the key storage method described in any one of the above is implemented.

[0016] The present invention also provides a computer program product, comprising a computer program, wherein when the computer program is executed by a processor, the key storage method described above is implemented.

[0017] The key storage method, device and electronic device provided by the present invention obtain the key encryption instruction issued by the application; based on the key encryption instruction, call the random number generation module to generate the key; store the key to the offset position of the key storage area currently not used in the first storage medium, and store the key position record of the key to the offset position of the record storage area currently not used in the second storage medium; the first storage medium and the second storage medium are different. By storing the key and the key position record respectively through different storage media, when it comes to large-scale file encryption and decryption business, efficient and fast key storage and reading are achieved, and the device can quickly find the idle key storage area without traversing all the keys, which will not affect the device initialization process, will not block the overall business process, and will not cause unforeseen errors. At the same time, it can improve the storage efficiency and retrieval efficiency of the key, greatly improve the competitiveness of the product, and enhance the market prospects of the product. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] In order to more clearly illustrate the technical solutions in the present invention or the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0019] Figure 1 It is a flow chart of the key storage method provided by the present invention.

[0020] Figure 2 It is a schematic diagram of the relationship between the key position record and the key storage area offset position provided by the present invention.

[0021] Figure 3 It is a schematic diagram of the encryption service process provided by the present invention.

[0022] Figure 4 It is a schematic diagram of the decryption service process provided by the present invention.

[0023] Figure 5 It is a schematic diagram of the flow of power failure detection provided by the present invention.

[0024] Figure 6 It is a structural schematic diagram of the key storage device provided by the present invention.

[0025] Figure 7 It is a structural schematic diagram of the electronic device provided by the present invention. DETAILED DESCRIPTION

[0026] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with the drawings of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0027] Combine the following Figure 1-Figure 5 The key storage method of the present invention is described.

[0028] Figure 1 is a flow chart of the key storage method provided by the present invention, such as Figure 1 As shown, the method includes the following steps 101 to 103.

[0029] Step 101: Obtain the key encryption instruction issued by the application.

[0030] It should be noted that the key storage method provided by the present invention can be applied to the scenario of storage and management of large quantities of keys. The executor of the method can be a key storage device, such as an electronic device, or a control module in the key storage device for executing the key storage method.

[0031] Specifically, the application program sends a key encryption instruction, and thus the key encryption instruction sent by the application program can be obtained, wherein the key encryption instruction is used to generate a key.

[0032] Step 102: Based on the key encryption instruction, call a random number generation module to generate a key.

[0033] Specifically, based on the key encryption instruction, the random number generation module of the chip is called to generate a set of 16-byte random numbers, and the random numbers are used as the key.

[0034] Step 103: store the key to an offset position of a key storage area that is not currently used in a first storage medium, and store the key position record of the key to an offset position of a record storage area that is not currently used in a second storage medium; the first storage medium and the second storage medium are different.

[0035] Specifically, after obtaining the key encryption instruction issued by the application, the key (key) is stored in the offset position (g_key_offset) of the key storage area that is currently unused in the first storage medium according to the steps of "write the key first, then write the record", that is, the key is written to the latest unused 16-byte space in the first storage medium, and the key position record (pos) of the key is stored in the offset position (g_pos_offset) of the record storage area that is currently unused in the second storage medium, that is, the key position record is written to the latest unused 4-byte space in the second storage medium; wherein the first storage medium and the second storage medium are different, for example, the first storage medium is nand flash, and the second storage medium is norflash. After the key and the key position record are stored (written), the key and the key position record are returned to the application together.

[0036] It should be noted that flash memory is usually divided into NOR flash and NAND flash, among which NOR flash has the advantages of fast reading speed and high reliability, but the disadvantages are small capacity and high cost; while NAND flash has large capacity and low cost, but its data reading rate is lower than that of NOR flash. Based on the characteristics of the above different storage media, the present invention adopts a combination of the two, the low-cost and large-capacity NAND flash is used to store the key, and the fast-reading NOR flash is used to store the key location record.

[0037] Optionally, the key position record of the key is determined based on the offset position of the currently unused key storage area; each time the key is stored, the offset position of the currently unused key storage area is offset by a first target number; each time the key position record of the key is stored, the offset position of the currently unused record storage area is offset by a second target number.

[0038] Specifically, the key position record (pos) of the key is determined based on the offset position of the currently unused key storage area (g_key_offset). The value of the key position record (pos) of the key is the key ID, and the key ID is the offset position of the currently unused key storage area (g_key_offset) divided by 16, that is, (g_key_offset / 16). The write positions of the key and key position record are controlled by two global variables (g_key_offset and g_pos_offset), respectively, where g_key_offset represents the unused record storage address offset position corresponding to the current key (key), and g_pos_offset represents the unused storage address offset position corresponding to the current key position record (pos). These two variables are assigned values ​​after the power-off detection process when the device is initialized, and their life cycle runs through the entire device operation process. Each time a key is written, the offset position of the currently unused key storage area is offset by the first target number. For example, the first target number is 16, that is, g_key_offset is incremented by 16. Each time a record is written, the offset position of the currently unused record storage area is offset by the second target number. For example, the first target number is 4, that is, g_pos_offset is incremented by 4.

[0039] Figure 2 Schematic diagram of the relationship between the key position record and the key storage area offset position provided by the present invention, such as Figure 2 As shown, there is no necessary connection between the unused record storage address offset position (g_pos_offset) and the currently unused key storage area offset position (g_key_offset). They are independent offset positions. The only causal connection is the value ID=g_key_offset / 16 stored in the key position record (pos) of the key. That is, the latest pos records the offset position of the latest key, but pos and key are not necessarily strictly one-to-one corresponding. Pos only needs to record the offset position of the latest key, so that the next time the device is powered on, it can quickly find the available key storage area offset. In other words, not every key write needs to be written synchronously to pos, which can be further optimized. For example, in order to reduce the number of writes to nor flash, a timed write to pos or a quantitative write to pos can be designed. Taking quantitative write to pos as an example, a write to pos operation will be triggered every 10 key writes, that is, pos0 stores ID0 and pos1 stores ID9.

[0040] The number of keys that can be written to the device is limited by a prior agreement. When the limit is exceeded, the initiator of the command (i.e. the application) will respond with a key capacity shortage response, indicating that key storage is no longer supported. There is no limit to the number of key location records that can be written, and the actual number of keys shall prevail.

[0041] The key storage method provided by the present invention obtains the key encryption instruction issued by the application; based on the key encryption instruction, calls the random number generation module to generate the key; stores the key to the offset position of the key storage area that is currently not used in the first storage medium, and stores the key position record of the key to the offset position of the record storage area that is currently not used in the second storage medium; the first storage medium and the second storage medium are different. By storing the key and the key position record respectively through different storage media, when it comes to large-scale file encryption and decryption business, efficient and fast key storage and reading are achieved, and the device can quickly find the idle key storage area without traversing all the keys, which will not affect the device initialization process, will not block the overall business process, and will not cause unforeseen errors. At the same time, it can improve the storage efficiency and retrieval efficiency of the key, greatly improve the competitiveness of the product, and enhance the market prospects of the product.

[0042] Figure 3 It is a schematic diagram of the encryption service process provided by the present invention, such as Figure 3 As shown, it includes steps 301 to 306.

[0043] Step 301: The application sends a key encryption instruction.

[0044] Step 302: Call the random number generation module to generate a set of 16-byte random numbers, and use the random numbers as the key.

[0045] Step 303: Write the key into the nand flash corresponding to g_key_offset.

[0046] Step 304, write g_key_offset / 16 into the NOR flash corresponding to g_pos_offset.

[0047] Step 305: Return g_key_offset / 16 and the key to the application.

[0048] Step 306: Each time a key is written, g_key_offset is offset by 16 bytes; each time a key position record is written, g_pos_offset is offset by 4 bytes.

[0049] Optionally, the method further comprises: Obtain a key decryption instruction issued by the application; the key decryption instruction carries the value of the key position record of the key; based on the value of the key position record of the key, determine the offset position of the key storage area in the first storage medium where the key is stored; based on the key storage area offset position, read the key.

[0050] Specifically, the application sends a key decryption instruction, which carries the value of the key position record of the key. Therefore, the key decryption instruction sent by the application can be obtained. Based on the value (ID) of the key position record (pos) of the key, through the ID 16 can determine the key storage area offset position (key_offset) where the key is stored in the first storage medium; then based on the key storage area offset position, the key can be read through the base address + key storage area offset position and applied to the decryption business.

[0051] Figure 4 It is a schematic diagram of the decryption service process provided by the present invention, such as Figure 4 As shown, it includes steps 401 to 404.

[0052] Step 401, obtain the key decryption instruction issued by the application, the key decryption instruction carries the value of the key position record of the key, the value of the key position record of the key is the key ID, the key ID is the offset position of the key storage area corresponding to the key storage area when the key is stored based on the key encryption instruction divided by 16, that is, g_key_offset / 16.

[0053] Step 402: Based on the key ID, determine the offset position key_offset of the key storage area where the key is stored in the first storage medium.

[0054] Step 403: Based on the key storage area offset position key_offset, read the key through the base address + the key storage area offset position key_offset.

[0055] Step 404: configure keys and decrypt service processing.

[0056] Optionally, before storing the key, the method further includes: (1) Based on the plurality of sectors obtained by dividing the second storage medium, determining an offset position where a key position record of a most recently stored key is located.

[0057] It should be noted that in this application, frequent writing to the flash storage is involved. If an abnormal power failure occurs during the writing process, it may cause errors in the data storage process. Based on this defect, this application proposes an abnormal power failure processing solution. The power failure detection is processed during the device initialization period. Because the latest key position (pos) record needs to be found, a large number of flash read operations are involved, which will affect the system startup speed. Therefore, when reading pos, the data of a sector is read in units of sectors instead of a pos line. The data is then stored in the random access memory (Random Access Memory, RAM) in the form of an array, and then logical judgment is performed. This will greatly reduce the number of reads of the nor flash, increase the overall reading rate, and speed up the device initialization process.

[0058] Specifically, the power failure detection process mainly includes the following steps: dividing the second storage medium (nor flash) into multiple sectors, and based on the multiple sectors, determining the offset position (last_pos_offset) of the key position record of the latest stored key.

[0059] (2) Based on the offset position, determine the offset position of the most recently stored key.

[0060] Specifically, based on the offset position, the value of the key position record of the most recently stored key can be read. The value of the key position record of the most recently stored key corresponds to the offset position of the most recently stored key (last_key_offset), that is, the offset position of the most recently written key, and then through last_key_offset 16+ base address can determine the most recently stored key.

[0061] (3) Based on the offset position of the most recently stored key, determine whether it is necessary to restore the offset position of the record storage area missed due to abnormal power failure.

[0062] Specifically, due to the method of writing the key first and then writing the key position record, the following abnormal situation may occur during the writing process: the power is off before the new key and / or the new key position record is written, and the latest POS record found is actually the old mark from the last time, that is, the old key position record. To address this problem, the following strategy is used: based on the offset position of the latest stored key (last_key_offset), query whether the key corresponding to last_key_offset+16 bytes exists, and determine whether it is necessary to restore the offset position of the record storage area missed by the abnormal power failure.

[0063] (4) When it is necessary to restore the offset position of the record storage area that is missed due to abnormal power failure, restore the missed offset position of the record storage area.

[0064] Specifically, if the key exists, it means that there is a POS omission caused by an abnormal power outage, and it is necessary to restore the offset position of the record storage area missed by the abnormal power outage. To restore the offset position of the missed record storage area, continue to traverse the key corresponding to the last_key_offset+16+16 bytes until there is no key at the latest last_key_offset' position, and record the current latest last_key_offset'. At this time, the POS value calculated by the latest last_key_offset' (that is, POS=last_key_offset' / 16) is updated and written to the NOR flash.

[0065] (5) When there is no need to restore the offset position of the record storage area that is missed due to abnormal power failure, the missed offset position of the record storage area is not restored.

[0066] Specifically, if the key does not exist, it means that there is no POS omission caused by abnormal power failure, and there is no need to restore the offset position of the record storage area missed by the abnormal power failure, and the missed record storage area offset position is not restored.

[0067] Optionally, the determining, based on the plurality of sectors obtained by dividing the second storage medium, the offset position of the key position record of the most recently stored key includes: (1-1) Based on any sector among the multiple sectors obtained by dividing the second storage medium, traverse an array corresponding to the sector in units of preset target bytes.

[0068] Specifically, based on any sector among the multiple sectors obtained by dividing the second storage medium, all key position records recorded in the sector are read into an array, and the array corresponding to the sector is traversed in units of preset target bytes. For example, the preset target byte is 4 bytes, that is, the entire array is traversed in units of 4 bytes.

[0069] Because the initial value of flash storage is all 1, the POS record can be judged based on this feature. When the POS value is 0xFFFFFFFF, it means that there is no POS record here, that is, the previous 4 bytes are the latest POS record. This method can be used to find the latest POS record stored in the array.

[0070] (1-2) When the offset position of the key position record corresponding to the currently traversed target byte is not the offset position of the key position record of the preset latest stored key, each target byte after the currently traversed target byte is repeatedly judged until the offset position of the key position record corresponding to the finally traversed target byte is the offset position of the key position record of the preset latest stored key.

[0071] Specifically, the offset position of the preset key position record of the latest stored key, last_pos_offset=0xFFFFFFFF, indicates the offset position of the key position record of the latest stored key currently traversed, and 0xFFFFFFFF is an illegal value, indicating that the latest pos record has not been found. In the case where the offset position of the key position record corresponding to the currently traversed target byte is not the offset position of the preset key position record of the latest stored key, it means that there is a key position record, but it cannot be said that it is the latest key position record. It is necessary to determine the next target byte after the currently traversed target byte, and repeat the determination of each target byte after the currently traversed target byte until the offset position of the key position record corresponding to the finally traversed target byte is the offset position of the preset key position record of the latest stored key.

[0072] (1-3) Determine the offset position of the key position record corresponding to the previous target byte of the finally traversed target byte as the offset position of the key position record of the most recently stored key.

[0073] Specifically, the offset position where the key position record corresponding to the previous target byte of the target byte finally traversed is located can be determined as the offset position where the key position record of the most recently stored key is located.

[0074] Optionally, when the offset position of the key position record corresponding to the target byte currently traversed is the offset position of the key position record of the preset latest stored key, it means that the key position record is not found in the current sector, that is, the pos record has never been found. In fact, the first target byte (4 bytes) is 0xFFFFFFFF. According to the pos write mechanism, the entire array is all 0xFFFFFFFF, and the remaining 4092 bytes do not need to be traversed again. The 4K data of the next sector can be directly read to update the array and traverse again.

[0075] Optionally, the method further comprises: Determine whether the offset position of the current latest key position record is an integer multiple of a preset target number; if the offset position of the current latest key position record is an integer multiple of the preset target number, determine whether the offset position of the key position record of the previous sector is the offset position of the preset key position record of the latest stored key; if the offset position of the key position record of the previous sector is not the offset position of the preset key position record of the latest stored key, erase the offset position of the key position record of the previous sector.

[0076] Specifically, after writing a sector, that is, 4096 bytes, the pos of the previous sector will be completely erased when writing a new sector. Abnormal power failure will cause a special situation, that is, after the new pos is written to the new sector, the power is lost before the data of the previous sector is erased, resulting in the previous sector being in an unerased state. Unexpected errors will occur when the sector is used next time. Therefore, in the power failure detection, it is necessary to determine whether the offset position last_pos_offset of the current latest key position record is an integer multiple of the preset target number. The preset target number is 4096, that is, to determine whether it is an integer multiple of 4096.

[0077] In the case where the offset position of the current latest key position record is an integer multiple of the preset target number, it indicates that the current record is the first target byte (4 bytes) in the new sector, and it is necessary to determine whether the offset position of the key position record of the previous sector is the offset position of the preset key position record of the latest stored key, that is, whether the offset position of the key position record of the previous sector is 0xFFFFFFFF; in the case where the offset position of the key position record of the previous sector is not the offset position of the preset key position record of the latest stored key, the offset position of the key position record of the previous sector is erased. In the case where the offset position of the key position record of the previous sector is the offset position of the preset key position record of the latest stored key, no processing is required.

[0078] Figure 5 Schematic diagram of the power-off detection process provided by the present invention, such as Figure 5 As shown, it includes steps 501 to 513.

[0079] Step 501: Device initialization.

[0080] Step 502: read the fixed storage area of ​​the NOR flash, divide the NOR flash into multiple sectors and traverse the sectors.

[0081] Step 503: Determine the offset position of the key position record of the most recently stored key.

[0082] Step 504: Based on the offset position, determine the offset position of the most recently stored key.

[0083] Step 505: Based on the offset position of the latest stored key, read the value of the key position record of the latest stored key, and then read the key in the nand flash based on the offset position and base address of the latest stored key corresponding to the value of the key position record of the latest stored key.

[0084] Step 506: Determine whether the key corresponding to last_key_offset+16 bytes exists. If the key corresponding to last_key_offset+16 bytes exists, go to step 507; if the key corresponding to last_key_offset+16 bytes does not exist, go to step 510.

[0085] Step 507: It indicates that there is a POS omission caused by abnormal power failure, and it is necessary to restore the offset position of the record storage area missed by the abnormal power failure.

[0086] Step 508: Read the key from last_key_offset+16 until there is no key at the latest last_key_offset position, and record the latest last_key_offset'.

[0087] Step 509: Update the pos value calculated by the latest last_key_offset' and write it into norflash.

[0088] Step 510: Determine whether the offset position of the key position record corresponding to the target byte currently traversed is an integer multiple of 4096. If the offset position of the key position record corresponding to the target byte currently traversed is an integer multiple of 4096, go to step 511; if the offset position of the key position record corresponding to the target byte currently traversed is not an integer multiple of 4096, go to step 513.

[0089] Step 511: Determine whether the offset position of the key position record of the previous sector is the preset offset position (0xFFFFFFFF) of the key position record of the latest stored key, that is, determine whether the first 4 bytes of the previous sector are 0xFFFFFFFF. If the offset position of the key position record of the previous sector is not the preset offset position of the key position record of the latest stored key, go to step 512; if the offset position of the key position record of the previous sector is the preset offset position of the key position record of the latest stored key, go to step 513.

[0090] Step 512 indicates that the first 4 bytes of the previous sector have a record, and the previous sector is full and not erased, so the offset position where the key position record of the entire previous sector is erased using the previous sector as a unit.

[0091] Step 513: No processing is required, and the normal process is entered.

[0092] Optionally, the method further comprises: Based on the multiple sectors divided by the second storage medium, the key position record of at least one key is written in sequence to the first sector of the multiple sectors; when the first sector is full, the key position records of the remaining keys in each key are written in sequence to the next sector of the first sector, and the writing of the key position records in each sector is repeated until each sector is full; when the last sector is full, the writing of the first sector is re-executed.

[0093] It should be noted that the purpose of setting the 4-byte variable pos to record the key offset position is to facilitate the next time the device is started, the value of the variable can be directly read, and the unused space in the key storage area can be quickly found without traversing the key storage area. However, if the variable is written to a fixed position in the nor flash, because a large number of write operations are involved, a sector of the nor flash will be repeatedly erased and written, and the service life will be greatly reduced compared to other sectors. For this reason, a solution to make the nor flash memory wear leveling is proposed.

[0094] Specifically, based on the multiple sectors obtained by dividing the second storage medium, for example, based on NOR flash, a continuous NOR flash storage space of 1MB is demarcated and divided into 256 4KB sectors for circular use. The key position record of at least one key is sequentially written into the first sector of the multiple sectors. After writing the key position record (POS record), g_pos_offset moves 4 bytes backward until the entire first sector is completely filled. When the first sector is full, the key position records of the remaining keys in each key are sequentially written into the next sector of the first sector, and the key position record is repeatedly written in each sector until each sector is full; when the last sector is full, the first sector is written again, that is, writing is started again from the first sector. This cycle is repeated to a certain extent, and the wear leveling of the POS storage area is achieved. Compared with writing POS at a fixed position, this method can avoid the generation of bad blocks to the greatest extent and increase the service life of the entire product. The above parameters can be flexibly changed according to actual needs and application scenarios.

[0095] Optionally, the method further comprises: When the next sector starts writing the key position record, the key position record written in the previous sector is erased.

[0096] Specifically, when the next sector starts writing the key position record, for example, after the next sector starts writing the first key position record, the key position record written in the previous sector is erased, that is, the entire content of the previous sector is erased.

[0097] It should be noted that the wear leveling strategy is only for the NOR flash storage part, because the NAND flash writes the key in an incremental manner until it reaches the agreed maximum value, and will not be erased and written repeatedly, so no processing is required.

[0098] The present invention proposes a design of wear leveling and power-off detection, which increases the stability and service life of the product, facilitates meeting the needs of customers, enriches the application scenarios of the product, and is conducive to the market promotion of the product.

[0099] The key storage device provided by the present invention is described below. The key storage device described below and the key storage method described above can be referenced to each other.

[0100] Figure 6 Schematic diagram of the structure of the key storage device provided by the present invention. Figure 6 As shown, the key storage device 600 includes: a first acquisition module 601, a generation module 602 and a storage module 603; wherein,

[0101] The first acquisition module 601 is used to acquire the key encryption instruction issued by the application; A generation module 602, configured to call a random number generation module to generate a key based on the key encryption instruction; The storage module 603 is used to store the key to an offset position of a key storage area that is not currently used in a first storage medium, and to store a key position record of the key to an offset position of a record storage area that is not currently used in a second storage medium; the first storage medium and the second storage medium are different.

[0102] The key storage device provided by the present invention obtains the key encryption instruction issued by the application; based on the key encryption instruction, calls the random number generation module to generate the key; stores the key to the offset position of the key storage area currently not used in the first storage medium, and stores the key position record of the key to the offset position of the record storage area currently not used in the second storage medium; the first storage medium and the second storage medium are different. By storing the key and the key position record respectively through different storage media, when it comes to large-scale file encryption and decryption business, efficient and fast key storage and reading are achieved, and the device can quickly find the idle key storage area without traversing all the keys, which will not affect the device initialization process, will not block the overall business process, and will not cause unforeseen errors. At the same time, it can improve the storage efficiency and retrieval efficiency of the key, greatly improve the competitiveness of the product, and enhance the market prospects of the product.

[0103] Optionally, the key position record of the key is determined based on the offset position of the currently unused key storage area; each time the key is stored, the offset position of the currently unused key storage area is offset by a first target number; each time the key position record of the key is stored, the offset position of the currently unused record storage area is offset by a second target number.

[0104] Optionally, the key storage device 600 further includes: A second acquisition module is used to acquire a key decryption instruction issued by the application; the key decryption instruction carries the value of the key position record of the key; A first determining module, configured to determine, based on a value of a key position record of the key, an offset position of a key storage area in which the key is stored in the first storage medium; A reading module is used to read the key based on the offset position of the key storage area.

[0105] Optionally, the key storage device 600 further includes: A second determining module, configured to determine an offset position of a key position record of a newly stored key based on a plurality of sectors obtained by dividing the second storage medium; A third determining module, configured to determine an offset position of the most recently stored key based on the offset position; A first judgment module, used for judging whether it is necessary to restore the offset position of the record storage area missed by abnormal power failure based on the offset position of the latest stored key; A first recovery module, used for recovering the offset position of the missing record storage area when it is necessary to recover the offset position of the missing record storage area due to abnormal power failure; The second recovery module is used for not recovering the missed offset position of the record storage area when there is no need to recover the missed offset position of the record storage area due to abnormal power failure.

[0106] Optionally, the second determining module is specifically configured to: Based on any sector among the multiple sectors obtained by dividing the second storage medium, traverse the array corresponding to the sector in units of preset target bytes; If the offset position of the key position record corresponding to the currently traversed target byte is not the offset position of the preset key position record of the latest stored key, repeatedly determine each target byte after the currently traversed target byte until the offset position of the key position record corresponding to the final traversed target byte is the offset position of the preset key position record of the latest stored key; The offset position of the key position record corresponding to the previous target byte of the finally traversed target byte is determined as the offset position of the key position record of the most recently stored key.

[0107] Optionally, the key storage device 600 further includes: The second judgment module is used to judge whether the offset position of the latest key position record is an integer multiple of a preset target number; a fourth determination module, for determining whether the offset position of the key position record of the previous sector is the offset position of the key position record of the preset latest stored key when the offset position of the current latest key position record is an integer multiple of the preset target number; The first erasing module is used to erase the offset position of the key position record of the previous sector when the offset position of the key position record of the previous sector is not the offset position of the key position record of the preset latest stored key.

[0108] Optionally, the key storage device 600 further includes: A first writing module, configured to write, based on the plurality of sectors divided by the second storage medium, a key position record of at least one key into a first sector of the plurality of sectors in sequence; A second writing module is used to write the key position records of the remaining keys in each of the keys into the next sector of the first sector in sequence when the first sector is full, and repeatedly write the key position records in each sector until each sector is full; The re-execution module is used to re-execute writing into the first sector when the last sector is fully written.

[0109] Optionally, the key storage device 600 further includes: The second erasing module is used to erase the key position record written in the previous sector when the next sector starts to write the key position record.

[0110] Figure 7 is a schematic diagram of the physical structure of an electronic device provided by the present invention, such as Figure 7 As shown, the electronic device 700 may include: a processor 710, a communication interface 720, a memory 730 and a communication bus 740, wherein the processor 710, the communication interface 720 and the memory 730 communicate with each other through the communication bus 740. The processor 710 may call the logic instructions in the memory 730 to execute the key storage method, which includes: obtaining the key encryption instruction issued by the application; based on the key encryption instruction, calling the random number generation module to generate a key; storing the key in the offset position of the key storage area currently not used in the first storage medium, and storing the key position record of the key in the offset position of the record storage area currently not used in the second storage medium; the first storage medium and the second storage medium are different.

[0111] In addition, the logic instructions in the above-mentioned memory 730 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when it is sold or used as an independent product. Based on this understanding, the technical solution of the present invention can be essentially or partly embodied in the form of a software product that contributes to the prior art. The computer software product is stored in a storage medium, including several instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc. Various media that can store program codes.

[0112] On the other hand, the present invention also provides a computer program product, which includes a computer program, and the computer program can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute the key storage method provided by the above methods, and the method includes: obtaining a key encryption instruction issued by an application; based on the key encryption instruction, calling a random number generation module to generate a key; storing the key to an offset position of a key storage area that is not currently used in a first storage medium, and storing the key position record of the key to an offset position of a record storage area that is not currently used in a second storage medium; the first storage medium and the second storage medium are different.

[0113] On the other hand, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, is implemented to execute the key storage method provided by the above-mentioned methods, the method comprising: obtaining a key encryption instruction issued by an application; based on the key encryption instruction, calling a random number generation module to generate a key; storing the key to an offset position of a key storage area that is not currently used in a first storage medium, and storing a key position record of the key to an offset position of a record storage area that is not currently used in a second storage medium; the first storage medium and the second storage medium are different.

[0114] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.

[0115] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0116] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A key storage method, characterized in that: include: Get the key encryption instruction issued by the application; Based on the key encryption instruction, calling a random number generation module to generate a key; The key is stored in a key storage area offset position that is not currently used in a first storage medium, and the key position record of the key is stored in a record storage area offset position that is not currently used in a second storage medium; the first storage medium and the second storage medium are different.

2. The key storage method according to claim 1, characterized in that: The key position record of the key is determined based on the offset position of the currently unused key storage area; each time the key is stored, the offset position of the currently unused key storage area is offset by a first target number; each time the key position record of the key is stored, the offset position of the currently unused record storage area is offset by a second target number.

3. The key storage method according to claim 1, characterized in that: The method further comprises: Obtaining a key decryption instruction issued by the application; the key decryption instruction carries the value of the key position record of the key; Determining, based on the value of the key position record of the key, an offset position of a key storage area in the first storage medium where the key is stored; Based on the offset position of the key storage area, the key is read.

4. The key storage method according to any one of claims 1 to 3, characterized in that: Before storing the key, the method further comprises: Determining, based on the plurality of sectors obtained by dividing the second storage medium, an offset position where a key position record of a newly stored key is located; Based on the offset position, determining the offset position of the most recently stored key; Based on the offset position of the most recently stored key, determining whether it is necessary to restore the offset position of the record storage area missed by the abnormal power failure; In the case where it is necessary to restore the offset position of the record storage area missed due to abnormal power failure, the missed offset position of the record storage area is restored; In the case where there is no need to restore the offset position of the record storage area missed due to abnormal power failure, the missed offset position of the record storage area is not restored.

5. The key storage method according to claim 4, characterized in that: The determining, based on the plurality of sectors obtained by dividing the second storage medium, the offset position of the key position record of the most recently stored key includes: Based on any sector among the multiple sectors obtained by dividing the second storage medium, traverse the array corresponding to the sector in units of preset target bytes; If the offset position of the key position record corresponding to the currently traversed target byte is not the offset position of the preset key position record of the latest stored key, repeatedly determine each target byte after the currently traversed target byte until the offset position of the key position record corresponding to the final traversed target byte is the offset position of the preset key position record of the latest stored key; The offset position of the key position record corresponding to the previous target byte of the finally traversed target byte is determined as the offset position of the key position record of the most recently stored key.

6. The key storage method according to claim 5, characterized in that: The method further comprises: Determine whether the offset position of the current latest key position record is an integer multiple of the preset target number; In the case where the offset position of the current latest key position record is an integer multiple of the preset target number, determining whether the offset position of the key position record of the previous sector is the offset position of the key position record of the preset latest stored key; In a case where the offset position where the key position record of the previous sector is located is not the offset position where the key position record of the preset latest stored key is located, the offset position where the key position record of the previous sector is located is erased.

7. The key storage method according to claim 4, characterized in that: The method further comprises: Based on the multiple sectors obtained by dividing the second storage medium, sequentially write the key position record of at least one key into a first sector of the multiple sectors; When the first sector is full, the key position records of the remaining keys in each of the keys are sequentially written into the next sector of the first sector, and the key position records are repeatedly written into each sector until each sector is full; When the last sector is fully written, the first sector is written again.

8. The key storage method according to claim 7, characterized in that: The method further comprises: When the next sector starts writing the key position record, the key position record written in the previous sector is erased.

9. A key storage device, characterized in that: include: A first acquisition module, used to acquire a key encryption instruction issued by an application; A generation module, used to call a random number generation module to generate a key based on the key encryption instruction; A storage module is used to store the key to an offset position of a key storage area that is not currently used in a first storage medium, and to store a key position record of the key to an offset position of a record storage area that is not currently used in a second storage medium; the first storage medium and the second storage medium are different.

10. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the computer program, the key storage method according to any one of claims 1 to 8 is implemented.

Images