Cryptographic operation method and cryptographic chip

Abstract

An embodiment of the present application discloses a cryptographic operation method and a cryptographic chip, wherein the method is applied to a key management unit in a cryptographic chip, and includes: receiving a key transmission instruction; based on the key transmission instruction, determining a target cryptographic operation module in the cryptographic chip, and determining a target key corresponding to the target cryptographic operation module from a key pool of the key management unit; utilizing a hardware transmission channel to transmit the target key to the target cryptographic operation module; the target cryptographic operation module is used to perform cryptographic operations using the target key based on the cryptographic operation instruction.

Description

Technical Field

[0001] The present application relates to but is not limited to the field of computer vision technology, and in particular to a cryptographic operation method and a cryptographic chip. Background Art

[0002] The cryptographic chip integrates various symmetric and asymmetric algorithms to realize cryptographic operations; the cryptographic chip includes a key management unit, a central processing unit (CPU) and a cryptographic operation module. In the related technology, during the key transmission process, the key plaintext is read by the CPU, sent to the cryptographic operation module and written into the cache area of ​​the cryptographic operation module. The attacker can hijack the CPU by injecting Trojan viruses into the software running on the CPU, so that the CPU can read the key in the key management unit and steal the key, which has low security. Summary of the invention

[0003] In view of this, the embodiments of the present application at least provide a cryptographic operation method and a cryptographic chip.

[0004] The technical solution of the embodiment of the present application is implemented as follows:

[0005] The embodiment of the present application provides a cryptographic operation method, which is applied to a key management unit in a cryptographic chip, including:

[0006] receiving a key transmission instruction;

[0007] Based on the key transmission instruction, determine the target cryptographic operation module in the cryptographic chip, and determine the target key corresponding to the target cryptographic operation module from the key pool of the key management unit;

[0008] The target key is transmitted to the target cryptographic operation module by using the hardware transmission channel; the target cryptographic operation module is used to perform cryptographic operations using the target key based on the cryptographic operation instructions.

[0009] The embodiment of the present application provides a cryptographic chip, which includes a key management unit, a target cryptographic operation module, a processor and a hardware transmission channel; the key management unit is connected to the target cryptographic operation module through the hardware transmission channel;

[0010] The key management unit is used to: receive a key transmission instruction; determine a target cryptographic operation module in the cryptographic chip based on the key transmission instruction, and determine a target key corresponding to the target cryptographic operation module from the key pool of the key management unit; transmit the target key to the target cryptographic operation module using a hardware transmission channel; the target cryptographic operation module is used to perform cryptographic operations using the target key based on the cryptographic operation instruction;

[0011] The target cryptographic operation module is used to perform cryptographic operation based on the cryptographic operation instruction sent by the processor and use the target key to obtain a cryptographic operation result.

[0012] In the embodiment of the present application, according to the received key transmission instruction; the target cryptographic operation module in the cryptographic chip and the target key corresponding to the target cryptographic operation module in the key pool of the key management unit are obtained; the target key is encrypted and transmitted to the target cryptographic operation module through the hardware transmission channel; the target cryptographic operation module is used to perform cryptographic operations based on the cryptographic operation instruction using the target key. In this way, the target key is directly transmitted from the key management unit to the target cryptographic operation module through the hardware transmission channel without passing through the processor. Even if the processor is attacked, the key information will not be leaked, thereby improving the security of key transmission.

[0013] It should be understood that the above general description and the following detailed description are merely exemplary and explanatory, and are not intended to limit the technical solutions of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] The drawings herein are incorporated into the specification and constitute a part of the specification. These drawings illustrate embodiments consistent with the present application and are used together with the specification to illustrate the technical solution of the present application.

[0015] Figure 1 A schematic diagram of the structure of a cryptographic chip provided in an embodiment of the present application;

[0016] Figure 2 A schematic diagram of the implementation process of a cryptographic operation method provided in the embodiment of the present application Figure 1 ;

[0017] Figure 3 A schematic diagram of the implementation process of a cryptographic operation method provided in the embodiment of the present application Figure 2 ;

[0018] Figure 4 A schematic diagram of the structure of a key management unit provided in an embodiment of the present application;

[0019] Figure 5 A schematic diagram of the composition structure of a cryptographic operation module provided in an embodiment of the present application;

[0020] Figure 6 A schematic diagram of data transmission during cryptographic operation provided in an embodiment of the present application;

[0021] Figure 7 A schematic diagram of a specific implementation flow of a cryptographic algorithm provided in an embodiment of the present application;

[0022] Figure 8A transmission schematic diagram of a key management unit provided in an embodiment of the present application using a ciphertext transmission secure channel to transmit a key to a cryptographic algorithm hardware acceleration engine. DETAILED DESCRIPTION

[0023] In order to make the purpose, technical solutions and advantages of the present disclosure clearer, the technical solutions of the present disclosure are further elaborated in detail below in conjunction with the drawings and embodiments. The described embodiments should not be regarded as limiting the present disclosure. All other embodiments obtained by ordinary technicians in the field without making creative work are within the scope of protection of the present disclosure.

[0024] In the following description, reference is made to “some embodiments”, which describe a subset of all possible embodiments, but it will be understood that “some embodiments” may be the same subset or different subsets of all possible embodiments and may be combined with each other without conflict.

[0025] The terms "first / second / third" involved are merely used to distinguish similar objects and do not represent a specific ordering of the objects. It is understandable that "first / second / third" can be interchanged with a specific order or sequence where permitted so that the embodiments of the present disclosure described herein can be implemented in an order other than that illustrated or described herein.

[0026] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by those skilled in the art to which the present disclosure belongs. The terms used herein are only for the purpose of describing the present disclosure and are not intended to limit the present disclosure.

[0027] The embodiment of the present application provides a cryptographic chip, Figure 1 A schematic diagram of the structure of a cryptographic chip provided in an embodiment of the present application is shown in FIG. Figure 1 As shown, the cryptographic chip 100 includes a key management unit 110, a target cryptographic operation module 120, a processor 130 and a hardware transmission channel 140. In the embodiment of the present application, the cryptographic chip 100 implements the following cryptographic operation method.

[0028] The present application provides a cryptographic operation method, which is applied to a key management unit. Figure 2 A schematic diagram of the implementation process of a cryptographic operation method provided in the embodiment of the present application Figure 1 ,like Figure 2 As shown, the method includes the following steps S201 to S203:

[0029] Step S201: receiving a key transmission instruction;

[0030] Here, the key transmission instruction is sent by the processor CPU and is used to instruct the key management unit to transmit the target key to the target cryptographic operation module.

[0031] Step S202: determining a target cryptographic operation module in the cryptographic chip based on the key transmission instruction, and determining a target key corresponding to the target cryptographic operation module from a key pool of the key management unit;

[0032] Here, the target cryptographic operation module is a cryptographic operation module that performs cryptographic operations determined according to the key transmission instruction.

[0033] The target key is a key in the key pool of the key management unit that corresponds to the current cryptographic service of the target cryptographic operation module.

[0034] A cryptographic chip is a general term for a type of security chip that integrates various symmetric and asymmetric algorithms, as well as post-quantum cryptographic algorithms that are resistant to quantum attacks. It has a high level of security and can ensure that the keys and information data stored inside cannot be illegally read or tampered with.

[0035] In some implementations, cryptographic algorithms are used to implement cryptographic operations. Specifically, cryptographic algorithms are mathematical functions used to implement encryption and decryption, and cryptographic algorithms are the basis of cryptographic protocols. Cryptographic algorithms mainly include stream ciphers, block ciphers, public key ciphers, hash functions, etc., which are used to ensure information security and provide services such as authentication, integrity, and non-repudiation.

[0036] In some embodiments, the target cryptographic operation module can be a cryptographic algorithm hardware acceleration engine, also known as a hardware accelerator, which is a dedicated acceleration chip / module that replaces the processor to complete complex, time-consuming and high-computing operations, and the process does not require or only requires the participation of a small amount of processors.

[0037] In some implementations, a key identifier is determined according to the key transmission instruction, and a corresponding target key is selected from a key pool according to the key identifier. The key identifier is a unique code of the key.

[0038] In some implementations, according to the key transmission instruction, a target address of a cache area storing a key in a target cryptographic operation module and a transmission length of the key are determined.

[0039] Step S203: using a hardware transmission channel to transmit the target key to the target cryptographic operation module; the target cryptographic operation module is used to perform cryptographic operations using the target key based on cryptographic operation instructions.

[0040] Here, the hardware transmission channel is an internal hardware circuit path from the key management unit to the target cryptographic operation module in the cryptographic chip.

[0041] In some implementations, the target key is transmitted from the key management unit to the target hardware processing unit through a hardware transmission channel. The target key is not easily stolen by software and has high security.

[0042] In some implementations, the target key is encrypted, and the encrypted target key is transmitted to the target cryptographic operation module using a hardware transmission channel.

[0043] In some embodiments, during the cryptographic chip design process, a pure hardware routing method is used to randomly layout and route the hardware transmission channel routing, so that the hardware transmission channel routing is scattered in unpredictable locations and circuit levels of the cryptographic chip, is difficult to monitor, and has high security.

[0044] In some implementations, the layout and routing range of the hardware transmission channel is increased as much as possible, and the routing of the hardware transmission channel can be randomly laid out and routed together with other circuits. In this way, even if the internal lines of the cryptographic chip are opened, it is impossible to identify which lines are the routing of the hardware transmission channel, thereby increasing the security of information transmitted by the hardware transmission channel.

[0045] In some implementations, the hardware transmission channel may be a point-to-point information transmission route from the key management unit to the cryptographic operation module. As long as both parties agree on the format of information transmission, transmission can be achieved.

[0046] The hardware transmission channel is a dedicated channel between the key management unit and the target cryptographic operation module. There is no other data export, which ensures the isolation characteristics of the hardware transmission channel.

[0047] In some implementations, the target cryptographic operation module is used to perform cryptographic services such as encryption, decryption, signature verification, etc. using the target key based on the cryptographic operation instruction.

[0048] In some embodiments, the cryptographic operation instructions may be sent by the processor to the target cryptographic operation module; in other embodiments, the cryptographic operation instructions may be sent by the processor to the key management unit, and the key management unit sends the cryptographic operation instructions to the target cryptographic operation module using a hardware transmission channel.

[0049] In some implementations, the target key is transmitted to a specific location of the cryptographic operation module using a hardware transmission channel according to the target address and the transmission length of the key.

[0050] In some embodiments, in the scenario of performing complex cryptographic operations, the key management unit receives multiple key transfer instructions by means of the processor initiating key transfer instructions multiple times according to the cryptographic operation steps, and supports transmitting the target keys corresponding to the multiple key transfer instructions to the target cryptographic operation module using multi-wave encrypted transmission of the hardware transmission channel to the target cryptographic operation module to achieve a complete cryptographic operation.

[0051] In some implementations, the types and quantities of key management units and cryptographic operation modules may be multiple, and the hardware transmission channels of the key management units and cryptographic operation modules may be one-to-many, many-to-one, or many-to-many.

[0052] In some embodiments, a hardware transmission channel is used to transmit the target key to the target cryptographic operation module, thereby reducing the operations of the CPU reading the key from the key management unit through software development and the CPU sending the key to the cryptographic operation module, thereby reducing the workload and difficulty of cryptographic chip software development.

[0053] In the embodiment of the present application, according to the received key transmission instruction; the target cryptographic operation module in the cryptographic chip and the target key corresponding to the target cryptographic operation module in the key pool of the key management unit are obtained; the target key is encrypted and transmitted to the target cryptographic operation module through the hardware transmission channel; the target cryptographic operation module is used to perform cryptographic operations based on the cryptographic operation instruction using the target key. In this way, the target key is directly encrypted and transmitted from the key management unit to the target cryptographic operation module through the hardware transmission channel without passing through the processor. Even if the processor is attacked, the key information will not be leaked, thereby improving the security of key transmission.

[0054] In some embodiments, the above step S202 may include the following steps S211 and S212:

[0055] Step S211: determining the target cryptographic operation module and the key identifier based on the key transmission instruction;

[0056] Here, the key identifier is a unique code of the key, which is used to accurately select a target key in the key pool of the key management unit.

[0057] Step S212: Based on the key identifier, determine the target key corresponding to the target cryptographic operation module from the key pool of the key management unit.

[0058] In some implementations, a plurality of keys are stored in a key pool, each key corresponds to a unique key identifier, and the key identifier can be used to quickly match the corresponding target key.

[0059] In the embodiment of the present application, according to the key transmission instruction, the target cryptographic operation module and the key identifier are determined, and according to the key identifier, the target key corresponding to the target cryptographic operation module is determined from the key pool of the key management unit. In this way, the target key corresponding to the target cryptographic operation module can be accurately and quickly selected from the key pool according to the key identifier.

[0060] In some embodiments, the above step S203 may include at least one of the following steps S221 and S222:

[0061] Step S221: encrypting the target key, and sending the encrypted target key to the target cryptographic operation module using a hardware transmission channel;

[0062] In some implementations, the target key is encrypted before entering the hardware transmission channel, so that the data transmitted in the secure channel is ciphertext, which can resist the attacker's eavesdropping attack on the hardware transmission channel.

[0063] In some implementations, the data to be transmitted in the hardware transmission channel may be encrypted using at least one of a symmetric encryption algorithm, an asymmetric encryption algorithm, etc. The present application does not limit the encryption method.

[0064] After receiving the transmitted data, the target cryptographic operation module decrypts it for use by subsequent target cryptographic operation modules when performing cryptographic operations.

[0065] Step S222: using a hardware transmission channel to send the target key to the target cryptographic operation module; the hardware transmission channel is obtained by randomly wiring between the key management unit and the target cryptographic operation module.

[0066] In some embodiments, during the cryptographic chip design process, the routing of the hardware transmission channel is randomly routed, and the layout and routing of the cryptographic chip is broken up using an electronic design automation (EDA) tool, so that the routing of the hardware transmission channel is unpredictably coupled in different circuits, thereby improving the concealment of the hardware transmission channel. When the cryptographic chip is sliced, the location and circuit hierarchy of the hardware transmission channel are difficult to identify.

[0067] In the embodiment of the present application, the target key is encrypted, and the encrypted target key is sent to the target cryptographic operation module using a hardware transmission channel; and / or the target key is sent to the target cryptographic operation module using a hardware transmission channel; the hardware transmission channel is obtained by randomly wiring between the key management unit and the target cryptographic operation module. In this way, by encrypting the target key and / or randomly wiring the hardware transmission channel, the high-security transmission of the target key is achieved.

[0068] In some embodiments, the circuit layer where the wiring of the hardware transmission channel is located is randomly determined; and / or the wiring path of the wiring of the hardware transmission channel is randomly determined.

[0069] In some implementations, the internal circuit of the cryptographic chip has multiple circuit layers, and the circuit layer where the routing of the hardware transmission channel is located is randomly determined.

[0070] The wiring path of the hardware transmission channel in each circuit layer, that is, the location of the hardware transmission channel is randomly determined.

[0071] In the embodiment of the present application, the circuit layer where the wiring of the hardware transmission channel is located is randomly determined; and / or the wiring path of the wiring of the hardware transmission channel is randomly determined. In this way, since the circuit layer and wiring path where the wiring of the hardware transmission channel is located are randomly determined, the concealment of the hardware transmission channel is improved.

[0072] In some embodiments, the above method may further include the following step S231:

[0073] Step S231: determining a target hardware transmission channel corresponding to the target cryptographic operation module from a plurality of hardware transmission channels.

[0074] In some embodiments, the cryptographic chip includes multiple cryptographic operation modules, and there is a corresponding hardware transmission channel between the key management unit and each cryptographic operation module for data transmission. Therefore, a target hardware transmission channel corresponding to the target cryptographic operation module is determined from the multiple hardware transmission channels, and the target hardware transmission channel is used to realize data transmission between the key management unit and the target cryptographic operation module.

[0075] The above step S203 may include the following step S232:

[0076] Step S232: Utilize the target hardware transmission channel to transmit the target key to the target cryptographic operation module.

[0077] In the embodiment of the present application, a target hardware transmission channel corresponding to a target cryptographic operation module is determined from a plurality of hardware transmission channels; the target hardware transmission channel is used to transmit the target key to the target cryptographic operation module. In this way, the target key is transmitted to the target cryptographic operation module using the target hardware transmission channel, thereby achieving accurate transmission of the target key.

[0078] In some embodiments, the above step S202 may include the following step S241:

[0079] Step S241: Based on the key transmission instruction, determine the target cryptographic operation module in the cryptographic chip and the target address in the cache area of ​​the target cryptographic operation module.

[0080] Here, the target address is a storage area in the cache area of ​​the target cryptographic operation module that stores the target key.

[0081] The above step S203 may include the following steps S242 and S243:

[0082] Step S242: generating a key writing instruction based on the target key and the target address; the key writing instruction is used to instruct the target cryptographic operation module to write the target key into the target address;

[0083] Here, the key write instruction is used to enable the target cryptographic operation module to write the target key into the target address.

[0084] Step S243: encrypt and transmit the key write instruction to the target cryptographic operation module using the hardware transmission channel.

[0085] In some embodiments, according to the key write instruction, the hardware transmission channel directly transmits the target key to the target address in the cache area of ​​the target cryptographic operation module; in other embodiments, the target cryptographic operation module receives the key write instruction and writes the target key to the target address according to the key write instruction.

[0086] In the embodiment of the present application, according to the key transmission instruction, the target cryptographic operation module in the cryptographic chip and the target address in the buffer area of ​​the target cryptographic operation module are determined; according to the target key and the target address, a key writing instruction is generated; the key writing instruction is used to instruct the target cryptographic operation module to write the target key to the target address; the key writing instruction is encrypted and transmitted to the target cryptographic operation module using the hardware transmission channel. In this way, the target key is stored in the target address of the target cryptographic operation module using the key writing instruction.

[0087] In some embodiments, the target cryptographic operation module is used to perform cryptographic operations based on multiple cryptographic operation instructions using the target key corresponding to each of the cryptographic operation instructions;

[0088] The above step S202 may include the following step S251:

[0089] Step S251: Based on the key transmission instructions corresponding to the multiple cryptographic operation instructions, determine the target cryptographic operation module in the cryptographic chip, and determine the target keys corresponding to the target cryptographic operation modules under the multiple cryptographic operation instructions from the key pool of the key management unit.

[0090] In some embodiments, when performing complex cryptographic operations, the processor sends key transmission instructions and cryptographic operation instructions in multiple waves according to the cryptographic operation steps. The key management unit receives multiple key transmission instructions and determines the target cryptographic operation module and the target keys corresponding to the target cryptographic operation module under multiple cryptographic operation instructions.

[0091] The above step S203 may include the following step S252:

[0092] Step S252: using the hardware transmission channel, transmitting the target keys corresponding to the plurality of cryptographic operation instructions to the target cryptographic operation module.

[0093] In some embodiments, the target cryptographic operation module receives target keys corresponding to multiple cryptographic operation instructions sent by the key management unit and multiple cryptographic operation instructions sent by the processor, and uses the target keys corresponding to the multiple cryptographic operation instructions to perform cryptographic operations on the data to be operated corresponding to the multiple cryptographic operation instructions.

[0094] In the embodiment of the present application, the target cryptographic operation module is used to perform cryptographic operations based on multiple cryptographic operation instructions using the target keys corresponding to each cryptographic operation instruction; based on the key transmission instructions corresponding to the multiple cryptographic operation instructions, the target cryptographic operation module in the cryptographic chip is determined, and the target keys corresponding to the target cryptographic operation modules under the multiple cryptographic operation instructions are determined from the key pool of the key management unit. The target keys corresponding to the multiple cryptographic operation instructions are transmitted to the target cryptographic operation module using the hardware transmission channel. In this way, the target cryptographic operation module uses the target keys corresponding to the multiple cryptographic operation instructions to perform cryptographic operations on the data to be operated corresponding to the multiple cryptographic operation instructions, realizes a complete cryptographic operation, and obtains the cryptographic operation result.

[0095] In some embodiments, the above method may further include the following step S261:

[0096] Step S261: Receive a cryptographic operation instruction corresponding to the key transmission instruction.

[0097] In some implementations, the processor sends the cryptographic operation instruction to the key management unit.

[0098] The above step S203 may include the following step S262:

[0099] Step S262: Utilize the hardware transmission channel to transmit the cryptographic operation instruction and the target key to the target cryptographic operation module.

[0100] In some embodiments, the key management unit encrypts the cryptographic operation instructions and the target key and transmits them to the target cryptographic operation module at the same time; in other embodiments, the key management unit first transmits the target key to the target cryptographic operation module, and then encrypts the cryptographic operation instructions and transmits them to the target cryptographic operation module.

[0101] In the embodiment of the present application, a cryptographic operation instruction corresponding to a key transmission instruction is received, and the cryptographic operation instruction and the target key are transmitted to the target cryptographic operation module using a hardware transmission channel. In this way, the key management unit transmits the cryptographic operation instruction and the target key to the target cryptographic operation module using the hardware transmission channel, so that the processor only needs to interact with the key management unit, which simplifies the software development logic and improves the integration of instructions.

[0102] The present application embodiment provides a cryptographic operation method, which is applied to a target cryptographic operation module. Figure 3 A schematic diagram of the implementation process of a cryptographic operation method provided in the embodiment of the present application Figure 2 ,like Figure 3 As shown, the method includes the following steps S301 to S303:

[0103] Step S301: receiving a target key and a cryptographic operation instruction; the target key is encrypted and transmitted to the target cryptographic operation module by the key management unit in the cryptographic chip using a hardware transmission channel; the cryptographic operation instruction is generated by a processor in the cryptographic chip;

[0104] In some implementations, a cryptographic operation instruction is received from a key management unit; in other implementations, a cryptographic operation instruction is received from a processor.

[0105] In some implementations, the target key is written to the target address using a hardware transfer channel.

[0106] In some implementations, after receiving the target key, the target key is written to the target address.

[0107] Step S302: based on the cryptographic operation instruction, obtaining data to be operated;

[0108] In some implementations, the cryptographic operation instruction includes invoking a cryptographic algorithm.

[0109] Step S303: using the target key to perform cryptographic operation on the data to be operated to obtain a cryptographic operation result; and sending the cryptographic operation result to the processor.

[0110] In some embodiments, the cryptographic operation includes an encryption operation and a decryption operation; using the target key, an encryption operation is performed on the encrypted data to obtain a cryptographic encryption result; using the target key, a decryption operation is performed on the decrypted data to obtain a cryptographic decryption result.

[0111] In some implementations, before using the target key to perform a cryptographic operation on the data to be operated and obtaining a cryptographic operation result, the target key is retrieved from the target address.

[0112] In some implementations, since the cache memory of the target cryptographic operation module is relatively small, in order to implement cryptographic operations on a larger amount of data to be operated, a dedicated or shared data cache is added, and the cryptographic operation results can be directly read by the processor.

[0113] In some embodiments, in a scenario where complex cryptographic operations are performed, multiple cryptographic operation instructions and target keys corresponding to the multiple cryptographic operation instructions are received; based on the multiple cryptographic operation instructions, cryptographic operations are performed using the target keys corresponding to the multiple cryptographic operation instructions, intermediate operation results are cached, and the current cryptographic operation result is used as the input of the cryptographic operation corresponding to the next cryptographic operation instruction, and multiple iterative operations are performed to obtain the final cryptographic operation result.

[0114] In the embodiment of the present application, the data to be operated is obtained according to the received cryptographic operation instruction, which is generated by the processor in the cryptographic chip; the received target key is used to perform cryptographic operation on the data to be operated to obtain the cryptographic operation result, which is encrypted and transmitted to the target cryptographic operation module by the key management unit using the hardware transmission channel; and the cryptographic operation result is sent to the processor. In this way, the target key is directly encrypted and transmitted from the key management unit to the target cryptographic operation module through the hardware transmission channel without passing through the processor. Even if the processor is attacked, the key information will not be leaked, thereby improving the security of key transmission.

[0115] In some embodiments, the above method may further include the following steps S311 and S312:

[0116] Step S311: receiving the encrypted target key through the hardware transmission channel;

[0117] In some implementations, after the key management unit encrypts the target key, it transmits the encrypted target key to the target cryptographic operation module using a hardware transmission channel.

[0118] In some implementations, the present application does not limit the encryption method of the target key.

[0119] Step S312: decrypt the encrypted target key to obtain a decrypted target key.

[0120] In some implementations, after receiving the encrypted target key, it is decrypted according to the corresponding encryption method to obtain the decrypted target key.

[0121] In the embodiment of the present application, the encrypted target key is received through the hardware transmission channel; the encrypted target key is decrypted to obtain the decrypted target key. In this way, the target key is transmitted in ciphertext in the hardware transmission channel, which improves the security of the target key transmission.

[0122] In some embodiments, the cryptographic operation instruction includes a first cryptographic operation instruction and a second cryptographic operation instruction;

[0123] The above step S303 may include the following steps S321 and S322:

[0124] Step S321: using the target key corresponding to the first cryptographic operation instruction, performing a cryptographic operation on the data to be operated corresponding to the first cryptographic operation instruction to obtain a first result;

[0125] In some implementations, the first result may be automatically cached in a cache area of ​​the target cryptographic operation module.

[0126] In some implementations, the first result may be automatically cached in a shared data cache area.

[0127] Step S322: Use the first result as the data to be operated corresponding to the second cryptographic operation instruction, use the target key corresponding to the second cryptographic operation instruction, perform a cryptographic operation on the data to be operated corresponding to the second cryptographic operation instruction, and obtain a second result; until the cryptographic operations corresponding to multiple cryptographic operation instructions are completed to obtain a cryptographic operation result.

[0128] In some implementations, the first result is used as an input of a cryptographic operation corresponding to the second cryptographic operation instruction, and multiple iterative operations are performed until the complete cryptographic operation is completed to obtain a cryptographic operation result.

[0129] In the embodiment of the present application, the cryptographic operation instruction includes a first cryptographic operation instruction and a second cryptographic operation instruction; using the target key corresponding to the first cryptographic operation instruction, a cryptographic operation is performed on the data to be operated corresponding to the first cryptographic operation instruction to obtain a first result; using the first result as the data to be operated corresponding to the second cryptographic operation instruction, using the target key corresponding to the second cryptographic operation instruction, a cryptographic operation is performed on the data to be operated corresponding to the second cryptographic operation instruction to obtain a second result; until the cryptographic operations corresponding to the multiple cryptographic operation instructions are completed, a cryptographic operation result is obtained. In this way, the target cryptographic operation module uses multiple cryptographic operation instructions to respectively correspond to the target keys to perform cryptographic operations on the data to be operated corresponding to the multiple cryptographic operation instructions, realizes a complete cryptographic operation, and obtains a cryptographic operation result.

[0130] In some embodiments, the above step S303 may include the following step S331:

[0131] Step S331: Store the cryptographic operation result in a target memory, so that the processor reads the cryptographic operation result from the target memory.

[0132] In some implementations, the cache memory of the target cryptographic operation module is small, and a dedicated data cache is added as the target memory to store the cryptographic operation results in the target memory. The processor can read the cryptographic operation results from the target memory.

[0133] In some implementations, the target memory has a large storage space, which can implement cryptographic operations on a large amount of data.

[0134] In the embodiment of the present application, the cryptographic operation result is stored in the target memory, so that the processor reads the cryptographic operation result from the target memory. In this way, cryptographic operation of a large amount of data can be achieved.

[0135] The present application embodiment provides a key management unit in a cryptographic chip, such as Figure 4 As shown, the key management unit 110 includes a first receiving module 111, a first determining module 112, and a first sending module 113, wherein:

[0136] The first receiving module 111 is used to receive a key transmission instruction;

[0137] The first determination module 112 is used to determine the target cryptographic operation module in the cryptographic chip based on the key transmission instruction, and determine the target key corresponding to the target cryptographic operation module from the key pool of the key management unit;

[0138] The first sending module 113 is used to transmit the target key to the target cryptographic operation module by using a hardware transmission channel; the target cryptographic operation module is used to perform cryptographic operations using the target key based on cryptographic operation instructions.

[0139] In some implementations, when the cryptographic chip performs a new cryptographic operation, the processor calls the corresponding cryptographic operation library function, which includes a complete key management unit and cryptographic operation module driver function, as well as complete operation steps.

[0140] In some embodiments, the key transfer instruction is used to instruct the key management unit to transfer the target key to the target cryptographic operation module.

[0141] In some embodiments, the hardware transmission channel is an internal hardware circuit path from the key management unit to the target cryptographic operation module in the cryptographic chip. The target key is encrypted and transmitted to the target hardware processing unit through the hardware transmission channel, and the target key cannot be stolen by software, which has high security.

[0142] In some embodiments, during the cryptographic chip design process, a pure hardware routing method is used to randomly layout and route the hardware transmission channel routing, so that the hardware transmission channel routing is scattered in unpredictable locations and circuit levels of the cryptographic chip, is difficult to monitor, and has high security.

[0143] In the embodiment of the present application, the first receiving module is used to receive the key transmission instruction; the first determining module is used to determine the target cryptographic operation module in the cryptographic chip based on the key transmission instruction, and determine the target key corresponding to the target cryptographic operation module from the key pool of the key management unit; the first sending module is used to transmit the target key to the target cryptographic operation module using the hardware transmission channel; the target cryptographic operation module is used to perform cryptographic operations using the target key based on the cryptographic operation instruction. In this way, the target key is directly encrypted and transmitted from the key management unit to the target cryptographic operation module through the hardware transmission channel without passing through the processor. Even if the processor is attacked, the key information will not be leaked, thereby improving the security of key transmission.

[0144] In some embodiments, the first determining module includes a first determining unit and a second determining unit, wherein:

[0145] A first determining unit, configured to determine the target cryptographic operation module and the key identifier based on the key transmission instruction;

[0146] The second determining unit is used to determine a target key corresponding to the target cryptographic operation module from a key pool of the key management unit based on the key identifier.

[0147] In some embodiments, the first sending module includes at least one of a first sending unit and a second sending unit, wherein:

[0148] A first sending unit, used to encrypt the target key and send the encrypted target key to the target cryptographic operation module using a hardware transmission channel;

[0149] The second sending unit is used to send the target key to the target cryptographic operation module by using a hardware transmission channel; the hardware transmission channel is obtained by random wiring between the key management unit and the target cryptographic operation module.

[0150] In some embodiments, the circuit layer where the wiring of the hardware transmission channel is located is randomly determined; and / or the wiring path of the wiring of the hardware transmission channel is randomly determined.

[0151] In some embodiments, the key management unit further includes a second determination module, wherein:

[0152] A second determination module, used to determine a target hardware transmission channel corresponding to the target cryptographic operation module from a plurality of hardware transmission channels;

[0153] The first sending module includes a third sending unit, wherein:

[0154] The third sending unit is used to transmit the target key to the target cryptographic operation module by using the target hardware transmission channel.

[0155] In some embodiments, the first determining module includes a third determining unit, wherein:

[0156] A third determining unit, configured to determine a target cryptographic operation module in the cryptographic chip and a target address in a buffer area of ​​the target cryptographic operation module based on the key transmission instruction;

[0157] The first sending module includes a generating unit and a fourth sending unit, wherein:

[0158] A generating unit, configured to generate a key writing instruction based on the target key and the target address; the key writing instruction is configured to instruct the target cryptographic operation module to write the target key into the target address;

[0159] The fourth sending unit is used to use the hardware transmission channel to encrypt and transmit the key writing instruction to the target cryptographic operation module.

[0160] In some embodiments, the target cryptographic operation module is used to perform cryptographic operations based on multiple cryptographic operation instructions using the target key corresponding to each of the cryptographic operation instructions;

[0161] The first determining module includes a fourth determining unit, wherein:

[0162] a fourth determining unit, configured to determine a target cryptographic operation module in the cryptographic chip based on the key transmission instructions respectively corresponding to the plurality of cryptographic operation instructions, and determine, from the key pool of the key management unit, target keys respectively corresponding to the target cryptographic operation modules under the plurality of cryptographic operation instructions;

[0163] The first sending module includes a fifth sending unit, wherein:

[0164] The fifth sending unit is used to transmit the target keys corresponding to the multiple cryptographic operation instructions to the target cryptographic operation module by using the hardware transmission channel.

[0165] In some embodiments, the key management unit includes a third receiving module, wherein:

[0166] A third receiving module, used to receive a cryptographic operation instruction corresponding to the key transmission instruction;

[0167] The first sending module includes a sixth sending unit, wherein:

[0168] The sixth sending unit is used to transmit the cryptographic operation instruction and the target key to the target cryptographic operation module by using the hardware transmission channel.

[0169] The present application embodiment provides a target cryptographic operation module in a cryptographic chip, such as Figure 5 As shown, the target cryptographic operation module 120 includes: a second receiving module 121, a data acquisition module 122, a cryptographic operation module 123 and a second sending module 124, wherein:

[0170] The second receiving module is used to receive a target key and a cryptographic operation instruction; the target key is encrypted and transmitted to the target cryptographic operation module by the key management unit in the cryptographic chip using a hardware transmission channel; the cryptographic operation instruction is generated by a processor in the cryptographic chip;

[0171] The data acquisition module is used to acquire the data to be operated based on the cryptographic operation instruction;

[0172] The cryptographic operation module is used to perform a cryptographic operation on the data to be operated using the target key to obtain a cryptographic operation result;

[0173] The second sending module is used to send the cryptographic operation result to the processor.

[0174] In some implementations, the second receiving module receives the target key sent by the key management unit, and the key management unit or the processor sends the cryptographic operation instruction.

[0175] In some embodiments, the cryptographic operation includes an encryption operation and a decryption operation; using the target key, an encryption operation is performed on the encrypted data to obtain a cryptographic encryption result; using the target key, a decryption operation is performed on the decrypted data to obtain a cryptographic decryption result.

[0176] In the embodiment of the present application, the second receiving module receives the target key and the cryptographic operation instruction; the target key is encrypted and transmitted to the target cryptographic operation module by the key management unit in the cryptographic chip using the hardware transmission channel; the cryptographic operation instruction is generated by the processor in the cryptographic chip; the data acquisition module obtains the data to be operated based on the cryptographic operation instruction; the cryptographic operation module uses the target key to perform cryptographic operation on the data to be operated to obtain the cryptographic operation result; the second sending module sends the cryptographic operation result to the processor. In this way, the target key is directly encrypted and transmitted from the key management unit to the target cryptographic operation module through the hardware transmission channel without passing through the processor. Even if the processor is attacked, the key information will not be leaked, thereby improving the security of key transmission.

[0177] In some embodiments, the target cryptographic operation module further includes a fourth receiving module and a decryption module, wherein:

[0178] A fourth receiving module, used for receiving the encrypted target key through the hardware transmission channel;

[0179] The decryption module is used to decrypt the encrypted target key to obtain the decrypted target key.

[0180] In some embodiments, the cryptographic operation instruction includes a first cryptographic operation instruction and a second cryptographic operation instruction;

[0181] The cryptographic operation module includes a first cryptographic operation unit and a second cryptographic operation unit, wherein:

[0182] A first cryptographic operation unit, configured to perform a cryptographic operation on the data to be operated corresponding to the first cryptographic operation instruction using a target key corresponding to the first cryptographic operation instruction, to obtain a first result;

[0183] The second cryptographic operation unit is used to use the first result as the data to be operated corresponding to the second cryptographic operation instruction, and use the target key corresponding to the second cryptographic operation instruction to perform a cryptographic operation on the data to be operated corresponding to the second cryptographic operation instruction to obtain a second result; until the cryptographic operations corresponding to multiple cryptographic operation instructions are completed to obtain a cryptographic operation result.

[0184] The second sending module includes a storage unit, wherein:

[0185] The storage unit is used to store the cryptographic operation result in a target memory so that the processor reads the cryptographic operation result from the target memory.

[0186] The present application embodiment provides a cryptographic chip, such as Figure 1As shown, the cryptographic chip 100 includes a key management unit 110, a target cryptographic operation module 120, a processor 130 and a hardware transmission channel 140; the key management unit 110 is connected to the target cryptographic operation module 120 through the hardware transmission channel 140;

[0187] The key management unit 110 is used to: receive a key transmission instruction; determine a target cryptographic operation module in the cryptographic chip based on the key transmission instruction, and determine a target key corresponding to the target cryptographic operation module from the key pool of the key management unit; transmit the target key to the target cryptographic operation module using the hardware transmission channel 140; the target cryptographic operation module is used to perform cryptographic operations using the target key based on the cryptographic operation instruction;

[0188] The target cryptographic operation module 120 is used to perform cryptographic operations using the target key based on the cryptographic operation instructions sent by the processor 130 to obtain cryptographic operation results.

[0189] In some embodiments, the cryptographic chip further includes a target memory;

[0190] The target cryptographic operation module is further used to store the cryptographic operation result in the target memory, so that the processor reads the cryptographic operation result from the target memory.

[0191] In some embodiments, the target cryptographic operation module is further used for at least one of the following:

[0192] Receiving the encrypted target key through the hardware transmission channel; decrypting the encrypted target key to obtain a decrypted target key;

[0193] The target key is received through the hardware transmission channel; the hardware transmission channel is obtained by random wiring between the key management unit and the target cryptographic operation module.

[0194] In some embodiments, the circuit layer where the wiring of the hardware transmission channel is located is randomly determined; and / or the wiring path of the wiring of the hardware transmission channel is randomly determined.

[0195] The following describes the application of the embodiments of the present disclosure in actual scenarios.

[0196] In the related art, during the key transmission process of the cryptographic chip, the key plaintext is read by the processor and written into the cache area of ​​the cryptographic algorithm hardware acceleration engine (corresponding to the target cryptographic operation module in the aforementioned embodiment), which is vulnerable to software attacks by attackers to steal the key and has low security.

[0197] In the embodiment of the present application, the differences in the security levels of key software and hardware and the possible means of attack on the hardware path are fully considered, and a method for implementing a hardware security channel for multiple key transmissions of a complex cryptographic algorithm hardware acceleration engine in a cryptographic chip is proposed, which protects the security of the key by building a high-security key transmission channel. The usability is fully considered to ensure that the key can adapt to the use requirements of the complex cryptographic algorithm hardware acceleration engine while meeting the requirements of high-security transmission.

[0198] Figure 6 A schematic diagram of data transmission during cryptographic operation provided in an embodiment of the present application is shown in FIG. Figure 6 As shown, the cryptographic chip 100 includes a processor 130, a key management unit 110 and a cryptographic algorithm hardware acceleration engine 401. When performing cryptographic operations, the processor 130 sends a key transmission instruction 402 to the key management unit 110; the key management unit 110 determines the key information according to the key transmission instruction 402, and transmits the key information to the cryptographic algorithm hardware acceleration engine 401 through a key transmission hardware security channel 403 (corresponding to the hardware transmission channel in the aforementioned embodiment); the processor 130 sends a cryptographic operation instruction 404 to the cryptographic algorithm hardware acceleration engine 401; the cryptographic algorithm hardware acceleration engine 401 performs cryptographic operations using the key information according to the cryptographic operation instruction 404, obtains a cryptographic operation result 405, and sends the cryptographic operation result 405 to the processor 130.

[0199] In the embodiment of the present application, the specific implementation process of the cryptographic algorithm is as follows: Figure 7 As shown, it may include steps S501 to S507:

[0200] Step S501: the processor starts a new cryptographic operation;

[0201] When the cryptographic chip needs to perform a new cryptographic operation (i.e., completely encrypt the plaintext into the final ciphertext, or completely decrypt the ciphertext into the final plaintext), the processor will call the corresponding cryptographic operation library function, which contains a complete key management unit and cryptographic algorithm hardware acceleration engine driver, as well as complete operation steps.

[0202] The library function is a complete set of processor call instruction sets designed and implemented by cryptographic chip software developers based on standard cryptographic algorithms, using hardware resources such as the key management unit and cryptographic algorithm hardware acceleration engine provided by the cryptographic chip. Through this set of instruction sets, the processor can send instructions to hardware such as the key management unit and cryptographic algorithm hardware acceleration engine multiple times, thereby realizing complete encryption and decryption operations.

[0203] Cryptographic algorithms are mathematical functions used for encryption and decryption and are the basis of cryptographic protocols. Cryptographic algorithms mainly include stream ciphers, block ciphers, public key ciphers, hash functions, etc., which are used to ensure the security of information and provide services such as identification, integrity, and non-repudiation.

[0204] Step S502: The processor sends a key transmission instruction to the key management unit;

[0205] The processor sends a key transfer instruction to the key management unit according to the cryptographic operation steps (i.e., the cryptographic operation steps given in the processor instruction set in the library function). The key transfer instruction includes a key identifier and a target address for the key transfer to the key buffer of the cryptographic algorithm hardware acceleration engine.

[0206] Step S503: The key management unit transmits the key to the cryptographic algorithm hardware acceleration engine through the key transmission hardware security channel;

[0207] According to the key transmission instruction, the key management unit selects the corresponding key from the key pool of the key management unit according to the unique key identifier of each key, and transmits it to the cryptographic algorithm hardware acceleration engine through the key transmission hardware security channel. At the same time, the key management unit also transmits the write control signal (corresponding to the key write instruction in the aforementioned embodiment) and the target address and key length to the key buffer area of ​​the cryptographic algorithm hardware acceleration engine through the key transmission hardware security channel. In the cryptographic algorithm hardware acceleration engine, the key is automatically written to the corresponding address of the key buffer area.

[0208] The key is the corresponding substitution relationship between the password and the plain text, which is divided into symmetric key and asymmetric key.

[0209] The key transmission hardware security channel is a pure hardware security channel, which is the internal hardware circuit path between the key management unit and the cryptographic algorithm hardware acceleration engine in the cryptographic chip. The key is transmitted from the key management unit to the cryptographic algorithm hardware acceleration engine through the key transmission hardware security channel. The key does not pass through the CPU. Even if the software running on the CPU is attacked, the key information will not be leaked, ensuring that the key can be transmitted with high security.

[0210] In some embodiments, the key management unit utilizes a key transmission hardware security channel to encrypt and transmit the key to a cryptographic algorithm hardware acceleration engine. At the entrance of the key transmission hardware security channel, a symmetric cryptographic algorithm is used to encrypt the data to be transmitted. This ensures that the data transmitted in the key transmission hardware security channel is ciphertext, which can resist attackers' eavesdropping attacks on the long wiring of the chip.

[0211] In some embodiments, the key transmission hardware security channel adopts pure hardware routing, which is scattered in unpredictable positions and circuit levels of the chip after automatic layout and routing by the chip design back-end, so that it is difficult for attackers to find and monitor this key transmission hardware security channel. Even if the chip is sliced, it is difficult to identify the location and circuit level of the key transmission hardware security channel, thereby realizing the security of the key from key management to unit transmission to the cryptographic algorithm hardware acceleration engine.

[0212] In some implementations, the layout and routing range of the key transmission hardware security channel is increased as much as possible, and the routing of the key transmission hardware security channel is unpredictably coupled in different circuits to improve the concealment of the key transmission hardware security channel.

[0213] In some embodiments, the key management unit sends a key to the cryptographic algorithm hardware acceleration engine to write the target address and key transfer length in the key cache area of ​​the cryptographic algorithm hardware acceleration engine to support setting the target address and length of the key transmission, and can accurately transfer the key to a specific location of the cryptographic algorithm hardware acceleration engine for use by the cryptographic algorithm hardware acceleration engine.

[0214] In some implementations, the key transmission hardware security channel is a point-to-point information transmission route from the key management unit to the cryptographic algorithm hardware acceleration engine. As long as both parties agree on the format of the information, the transmission can be achieved.

[0215] Figure 8 A schematic diagram of a key management unit provided in an embodiment of the present application using a ciphertext transmission secure channel to transmit a key to a cryptographic algorithm hardware acceleration engine, such as Figure 8 As shown, the key management unit 110 selects a target key from key 1 to key N in the key pool 601 according to the key identifier 602, and determines the target cryptographic algorithm hardware acceleration engine, and transmits the target key to the target cryptographic algorithm hardware acceleration engine according to the ciphertext transmission security channel corresponding to the target cryptographic algorithm hardware acceleration engine. For example, when the target cryptographic algorithm hardware acceleration engine is the first cryptographic algorithm hardware acceleration engine 621, the key management unit 110 uses the first ciphertext transmission security channel 611 to store the target key in the first key cache area 622, and the first hardware algorithm core 623 performs cryptographic operations using the target key based on the cryptographic operation instructions sent by the CPU; when the target cryptographic algorithm hardware acceleration engine is the second cryptographic algorithm hardware acceleration engine 631, the key management unit 110 uses the second ciphertext transmission security channel 612 to store the target key in the second key cache area 632, and the second hardware algorithm core 633 performs cryptographic operations using the target key based on the cryptographic operation instructions; the target cryptographic algorithm hardware acceleration engine can also be the third cryptographic algorithm hardware acceleration engine 641, and the key management unit 110 uses the third ciphertext transmission security channel 613 to transmit the key.

[0216] In some implementations, the types and quantities of key management units and cryptographic operation modules may be multiple, and the key transmission hardware security channels of the key management units and cryptographic operation modules may be one-to-many, many-to-one, or many-to-many.

[0217] Step S504: the processor sends a cryptographic operation instruction to the cryptographic algorithm hardware acceleration engine;

[0218] After the key is transmitted from the key management unit to the cryptographic algorithm hardware acceleration engine, the processor sends a cryptographic operation instruction to the cryptographic algorithm hardware acceleration engine.

[0219] The processor can also send cryptographic operation instructions to the key management unit. The key management unit uses the key transmission hardware security channel to send cryptographic operation instructions to the cryptographic algorithm hardware acceleration engine, which improves the integration of the processor sending instructions. The processor only needs to communicate with the key management unit, simplifying the software development logic.

[0220] Step S505: the cryptographic algorithm hardware acceleration engine uses the key transmitted by the key management unit to perform cryptographic operations according to the cryptographic operation instructions, and temporarily stores the intermediate results of the operations;

[0221] Step S506: Is the cryptographic operation completed? If yes, proceed to step S502; if no, proceed to step S507;

[0222] The processor determines whether the cryptographic operation is completed based on the complete cryptographic operation steps of the library function. If the complete cryptographic operation is not completed, the processor repeatedly sends instructions to the key management unit and the cryptographic algorithm hardware acceleration engine until the cryptographic algorithm hardware acceleration engine completes the complex cryptographic operation.

[0223] Step S507: The processor reads the complete operation result from the cryptographic algorithm hardware acceleration engine.

[0224] In some implementations, a dedicated or shared data cache is added outside the cryptographic algorithm hardware acceleration engine, and the calculation results are stored in the shared data cache, so that the intermediate or complete calculation results can be directly read.

[0225] In the embodiment of the present application, the design of the key management unit, the cryptographic algorithm hardware acceleration engine and the software library function are comprehensively considered, and each module performs its own duties, which not only ensures the security of the key, but also ensures the availability of the key. The processor can coordinate and command the operation of each cryptographic module from the upper perspective. During operation, the hardware will automatically complete the key transmission and distribution tasks through the hardware security channel in the background, so that the entire cryptographic chip has higher integration and integration, and has extremely high security. The cryptographic algorithm hardware acceleration engine and the key management unit can be regarded as a unit assembly, and multiple assembly and iteration are performed to construct a circuit structure with a high hardware reuse rate. On the basis of greatly saving the chip area cost, complex cryptographic operations such as asymmetric cryptographic algorithms and symmetric cryptographic algorithms can be realized.

[0226] It should be understood that "one embodiment" or "an embodiment" mentioned throughout the specification means that specific features, structures or characteristics related to the embodiment are included in at least one embodiment of the present application. Therefore, "in one embodiment" or "in an embodiment" appearing throughout the specification does not necessarily refer to the same embodiment. In addition, these specific features, structures or characteristics can be combined in one or more embodiments in any suitable manner. It should be understood that in various embodiments of the present application, the size of the serial number of each step / process mentioned above does not mean the order of execution, and the execution order of each step / process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiment of the present application. The serial numbers of the embodiments of the present application mentioned above are for description only and do not represent the advantages and disadvantages of the embodiments.

[0227] It should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the existence of other identical elements in the process, method, article or device including the element.

[0228] In the several embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. The device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as: multiple units or components can be combined, or can be integrated into another system, or some features can be ignored or not executed. In addition, the coupling, direct coupling, or communication connection between the components shown or discussed can be through some interfaces, and the indirect coupling or communication connection of the devices or units can be electrical, mechanical or other forms.

[0229] The units described above as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units; they may be located in one place or distributed on multiple network units; some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0230] In addition, all functional units in the embodiments of the present application may be integrated into one processing unit, or each unit may be a separate unit, or two or more units may be integrated into one unit; the above-mentioned integrated units may be implemented in the form of hardware or in the form of hardware plus software functional units.

[0231] A person skilled in the art can understand that: all or part of the steps of implementing the above method embodiment can be completed by hardware related to program instructions, and the aforementioned program can be stored in a computer-readable storage medium. When the program is executed, it executes the steps of the above method embodiment; and the aforementioned storage medium includes: various media that can store program codes, such as mobile storage devices, read-only memories (ROM), magnetic disks or optical disks.

[0232] Alternatively, if the above-mentioned integrated unit of the present application is implemented in the form of a software function module and sold or used as an independent product, it can also be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application can essentially or in other words, the part that contributes to the relevant technology can be embodied in the form of a software product, which is stored in a storage medium and includes a number of instructions for a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the methods described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as mobile storage devices, ROMs, magnetic disks, or optical disks.

[0233] The above is only an implementation method of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application.

Claims

1. A cryptographic operation method, characterized in that: A key management unit applied to a cryptographic chip, the method comprising: receiving a key transmission instruction; the key transmission instruction is sent by a processor; Based on the key transmission instruction, determine the target cryptographic operation module in the cryptographic chip, and determine the target key corresponding to the target cryptographic operation module from the key pool of the key management unit; The target key is transmitted to the target cryptographic operation module by using a hardware transmission channel; the target cryptographic operation module is used to perform cryptographic operation by using the target key based on the cryptographic operation instruction; The step of determining a target cryptographic operation module in the cryptographic chip based on the key transmission instruction, and determining a target key corresponding to the target cryptographic operation module from the key management unit includes: Based on the key transmission instruction, determining the target cryptographic operation module and the key identifier; Based on the key identifier, a target key corresponding to the target cryptographic operation module is determined from a key pool of the key management unit.

2. The method according to claim 1, characterized in that The use of a hardware transmission channel to transmit the target key to the target cryptographic operation module includes at least one of the following: Encrypting the target key and sending the encrypted target key to the target cryptographic operation module using a hardware transmission channel; The target key is sent to the target cryptographic operation module by using a hardware transmission channel; the hardware transmission channel is obtained by randomly wiring between the key management unit and the target cryptographic operation module.

3. The method according to claim 2, characterized in that The circuit layer where the routing of the hardware transmission channel is located is randomly determined; and / or, The wiring path of the hardware transmission channel is randomly determined.

4. The method according to any one of claims 1 to 3, characterized in that The method further comprises: Determining a target hardware transmission channel corresponding to the target cryptographic operation module from a plurality of hardware transmission channels; The method of transmitting the target key to the target cryptographic operation module by using a hardware transmission channel includes: The target key is transmitted to the target cryptographic operation module using the target hardware transmission channel.

5. The method according to any one of claims 1 to 3, characterized in that The step of determining a target cryptographic operation module in the cryptographic chip based on the key transmission instruction includes: Based on the key transmission instruction, determining a target cryptographic operation module in the cryptographic chip and a target address in a buffer area of ​​the target cryptographic operation module; The method of transmitting the target key to the target cryptographic operation module by using a hardware transmission channel includes: Based on the target key and the target address, a key writing instruction is generated; the key writing instruction is used to instruct the target cryptographic operation module to write the target key into the target address; The key write instruction is transmitted to the target cryptographic operation module by utilizing the hardware transmission channel.

6. The method according to any one of claims 1 to 3, characterized in that The target cryptographic operation module is used to perform cryptographic operations based on multiple cryptographic operation instructions using the target key corresponding to each of the cryptographic operation instructions; The step of determining a target cryptographic operation module in the cryptographic chip based on the key transmission instruction, and determining a target key corresponding to the target cryptographic operation module from a key pool of the key management unit includes: Based on the key transmission instructions respectively corresponding to the plurality of cryptographic operation instructions, determining a target cryptographic operation module in the cryptographic chip, and determining target keys respectively corresponding to the target cryptographic operation modules under the plurality of cryptographic operation instructions from the key pool of the key management unit; The method of transmitting the target key to the target cryptographic operation module by using a hardware transmission channel includes: The target keys corresponding to the plurality of cryptographic operation instructions are transmitted to the target cryptographic operation module by utilizing the hardware transmission channel.

7. The method according to any one of claims 1 to 3, characterized in that The method further comprises: Receiving a cryptographic operation instruction corresponding to the key transmission instruction; The method of transmitting the target key to the target cryptographic operation module by using a hardware transmission channel includes: The cryptographic operation instruction and the target key are transmitted to the target cryptographic operation module by using the hardware transmission channel.

8. A cryptographic chip, characterized in that: The cryptographic chip includes a key management unit, a target cryptographic operation module, a processor and a hardware transmission channel; the key management unit is connected to the target cryptographic operation module through the hardware transmission channel; The key management unit is used to: receive a key transmission instruction; determine a target cryptographic operation module in the cryptographic chip based on the key transmission instruction, and determine a target key corresponding to the target cryptographic operation module from the key pool of the key management unit; transmit the target key to the target cryptographic operation module using a hardware transmission channel; the target cryptographic operation module is used to perform cryptographic operations using the target key based on the cryptographic operation instruction; the key transmission instruction is sent by the processor; The target cryptographic operation module is used to perform cryptographic operation using the target key based on the cryptographic operation instruction sent by the processor to obtain a cryptographic operation result; The key management unit is also used to: determine the target cryptographic operation module and the key identifier based on the key transmission instruction; and determine the target key corresponding to the target cryptographic operation module from the key pool of the key management unit based on the key identifier.

9. The cryptographic chip according to claim 8, characterized in that: The cryptographic chip also includes a target memory; The target cryptographic operation module is further used to store the cryptographic operation result in the target memory, so that the processor reads the cryptographic operation result from the target memory.

10. The cryptographic chip according to claim 8, characterized in that: The target cryptographic operation module is also used for at least one of the following: Receiving the encrypted target key through the hardware transmission channel; decrypting the encrypted target key to obtain a decrypted target key; Receiving the target key through the hardware transmission channel; The hardware transmission channel is obtained by randomly wiring between the key management unit and the target cryptographic operation module.

11. The cryptographic chip according to claim 10, characterized in that: The circuit layer where the routing of the hardware transmission channel is located is randomly determined; and / or, The wiring path of the hardware transmission channel is randomly determined.

Images