Password chip and scrambling method thereof

Abstract

The present application discloses a cryptographic chip and a scrambling method thereof, wherein the cryptographic chip comprises a processor, a peripheral module, a first memory, a second memory and a scrambling module, wherein: the processor and the first memory, the processor and the peripheral module, and the peripheral module and the second memory are all connected via communication lines, and after the cryptographic chip is powered on, the scrambling password corresponding to each communication line is obtained, and the scrambling module scrambles the plaintext information transmitted on each communication line based on the scrambling password corresponding to each communication line. In this way, by dynamically scrambling the data transmitted on each communication line, the security of the cryptographic chip can be improved.

Description

Technical Field

[0001] The present application relates to the technical field of integrated circuits, and in particular to a cryptographic chip and a scrambling method thereof. Background Art

[0002] With the development of technologies such as cloud computing and the Internet of Things, physical attacks on chips have received more and more attention and research. Chips often contain sensitive data, such as keys and information related to user privacy. The means of physical attacks on chips are becoming more and more abundant, and these sensitive information are obtained through various means. However, in related technologies, when data is transmitted on the communication lines connecting the chip's processor, peripherals, and memory, plaintext data is used for transmission, making the transmitted data unsafe and prone to chip attacks, thereby reducing the security of the chip. Summary of the invention

[0003] The present application proposes a cryptographic chip and a scrambling method, which can improve the security of the cryptographic chip by dynamically scrambling data transmitted on each communication line.

[0004] The technical solution of this application is implemented as follows:

[0005] In a first aspect, an embodiment of the present application provides a cryptographic chip, the cryptographic chip comprising a processor, a peripheral module, a first memory, a second memory and a scrambling module; wherein:

[0006] The processor and the first memory, the processor and the peripheral module, and the peripheral module and the second memory are all connected via communication lines;

[0007] The scrambling module is used to scramble the plaintext information transmitted on each communication line based on the scrambling password corresponding to each communication line obtained when the password chip is powered on.

[0008] In a second aspect, an embodiment of the present application provides a scrambling method for a cryptographic chip, wherein the cryptographic chip includes a processor, a peripheral module, a first memory, a second memory, and a scrambling module, and the processor and the first memory, the processor and the peripheral module, and the peripheral module and the second memory are all connected through a communication line; the scrambling method includes:

[0009] The scrambling module scrambles the plaintext information transmitted on each communication line based on the scrambling password corresponding to each communication line obtained when the password chip is powered on.

[0010] The embodiment of the present application provides a cryptographic chip and a scrambling method thereof, the cryptographic chip includes a processor, a peripheral module, a first memory, a second memory and a scrambling module, wherein: the processor and the first memory, the processor and the peripheral module, and the peripheral module and the second memory are all connected through communication lines, and the scrambling passwords corresponding to each communication line are obtained after the cryptographic chip is powered on, and then during the operation of the security chip, the scrambling module scrambles the plaintext information transmitted on each communication line based on the scrambling passwords corresponding to each communication line. In this way, the security of the cryptographic chip can be improved by dynamically scrambling the data transmitted by the processor to the peripheral modules through the bus or the data written by the processor and / or the peripheral modules to the corresponding memories; and the trusted environment in the operation of the cryptographic chip is constructed by hardware. A secure operating environment, after the trusted environment is constructed, the processor is started again, so that each instruction in the processor is executed in the trusted environment, further improving the security of the cryptographic chip.

[0011] It should be understood that the above general description and the following detailed description are merely exemplary and explanatory, and are not intended to limit the technical solutions of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] Figure 1 A schematic diagram of the composition structure of a cryptographic chip provided in an embodiment of the present application Figure 1 ;

[0013] Figure 2 A schematic diagram of the composition structure of a cryptographic chip provided in an embodiment of the present application Figure 2 ;

[0014] Figure 3 A schematic diagram of the composition structure of a cryptographic chip provided in an embodiment of the present application Figure 3 ;

[0015] Figure 4 A schematic diagram of a processing flow of a bus scrambling module provided in an embodiment of the present application;

[0016] Figure 5 A schematic diagram of a detailed processing flow of a bus scrambling module provided in an embodiment of the present application;

[0017] Figure 6 A detailed structural diagram of a cryptographic chip provided in an embodiment of the present application;

[0018] Figure 7 A schematic diagram of a hardware startup process of a cryptographic chip provided in an embodiment of the present application;

[0019] Figure 8 A schematic diagram of a scrambling method provided in an embodiment of the present application Figure 1 ;

[0020] Fig. 9 A schematic diagram of a scrambling method provided in an embodiment of the present application Figure 2 . DETAILED DESCRIPTION

[0021] In order to enable a more detailed understanding of the features and technical contents of the embodiments of the present application, the implementation of the embodiments of the present application is described in detail below in conjunction with the accompanying drawings. The attached drawings are for reference only and are not used to limit the embodiments of the present application.

[0022] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by those skilled in the art to which this application belongs. The terms used herein are only for the purpose of describing the embodiments of this application and are not intended to limit this application.

[0023] In the following description, reference is made to “some embodiments”, which describe a subset of all possible embodiments, but it will be understood that “some embodiments” may be the same subset or different subsets of all possible embodiments and may be combined with each other without conflict.

[0024] It should also be pointed out that the terms "first\second\third" involved in the embodiments of the present application are only used to distinguish similar objects and do not represent a specific ordering of the objects. It can be understood that "first\second\third" can be interchanged in a specific order or sequence where permitted, so that the embodiments of the present application described here can be implemented in an order other than that illustrated or described here.

[0025] In addition, the reference to "embodiment" herein means that a particular feature, structure, or characteristic described in conjunction with the embodiment may be included in at least one embodiment of the present application. The appearance of the phrase in various locations in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment that is mutually exclusive with other embodiments. It is explicitly and implicitly understood by those skilled in the art that the embodiments described herein may be combined with other embodiments.

[0026] The following is an introduction to the relevant terms and technologies of this application.

[0027] A cryptographic algorithm is a mathematical function used for encryption and decryption. It is the basis of cryptographic protocols. Cryptographic algorithms mainly include stream ciphers, block ciphers, public key ciphers and hash functions, which are used to ensure the security of information and provide services such as identification, integrity and non-repudiation. They complete complex and time-consuming high-computing operations, and the process requires no or only a small amount of central processing unit (CPU) participation.

[0028] The key is the corresponding substitution relationship between the password and the plain text, which is divided into symmetric key and asymmetric key.

[0029] A True Random Number Generator (TRNG) is a device that can generate random numbers based on physical entropy sources (such as electronic noise, chaotic circuits, metastable states of circuits, etc.). These random numbers are unpredictable and cannot be predicted by algorithms.

[0030] With the continuous advancement of informatization, information security has become an important topic related to national security and people's lives. As the infrastructure of electronic information products, chips provide computing, control, security and other services as their main functions, and are increasingly used in various fields of information systems.

[0031] At the same time, physical attacks on chips are receiving more and more attention and research. Chips often contain sensitive data, such as keys and information related to user privacy. The means of physical attacks on chips are becoming more and more abundant, and various means are used to obtain this sensitive information. Physical attacks first remove the chip package, and then peel off the chip layer by layer through physical or chemical methods, which reduces the security of the chip.

[0032] However, when data is transmitted on the transmission bus between the CPU and the peripheral module in the chip, the data transmission line between the peripheral module and the memory connected thereto, and the data transmission line between the CPU module and the memory connected thereto, since data scrambling is not performed when these three types of lines are used for data transmission, the data transmitted through these three types of lines is plain text data. If the transmitted data is stored in the corresponding memory, since the stored data is not scrambled, the password chip is unsafe. In short, in the related art, when data is transmitted on the communication lines connected to the processor, peripherals and memory of the chip, plain text data is used for transmission, which makes the transmitted data unsafe and easily causes the chip to be attacked, thereby reducing the security of the chip.

[0033] Based on this, the embodiment of the present application provides a cryptographic chip and a scrambling method thereof, the cryptographic chip includes a processor, a peripheral module, a first memory, a second memory and a scrambling module, wherein: the processor and the first memory, the processor and the peripheral module, and the peripheral module and the second memory are all connected through communication lines, and the scrambling passwords corresponding to each communication line are obtained after the cryptographic chip is powered on, and then during the operation of the security chip, the scrambling module scrambles the plaintext information transmitted on each communication line based on the scrambling passwords corresponding to each communication line. In this way, the security of the cryptographic chip can be improved by dynamically scrambling the data transmitted by the processor to the peripheral modules through the bus, or the data written by the processor and / or the peripheral modules to their respective corresponding memories; and the trusted environment in the operation of the cryptographic chip is constructed by hardware to ensure a secure operating environment. After the trusted environment is constructed, the processor is started again, so that each instruction in the processor is executed in the trusted environment, further improving the security of the cryptographic chip.

[0034] The present application is further described in detail below through the accompanying drawings and specific embodiments.

[0035] In one embodiment of the present application, Figure 1 The following is a schematic diagram of the structure of a cryptographic chip provided in an embodiment of the present application. Figure 1 As shown, the cryptographic chip 10 includes a processor 101, a peripheral module 102, a first memory 103, a second memory 104 and a scrambling module 105, wherein:

[0036] The processor and the first memory, the processor and the peripheral module, and the peripheral module and the second memory are all connected via communication lines;

[0037] The scrambling module 105 is used to scramble the plaintext information transmitted on each communication line based on the scrambling password corresponding to each communication line obtained when the password chip is powered on.

[0038] In the embodiment of the present application, the cryptographic chip 10 is a special chip that integrates cryptographic algorithms and related functions, which is used to perform various cryptographic operations to ensure the security, integrity and authenticity of data. In other words, the cryptographic chip here can provide cryptographic services. Exemplarily, the cryptographic chip 10 can generate, store, distribute and update keys to ensure the security and availability of keys; the cryptographic chip 10 can also use specific keys to encrypt sensitive data to protect it from unauthorized access, and can also decrypt encrypted data to restore the original data. Here, the cryptographic chip can also be called a security chip, which can protect the data security of the chip.

[0039] In the embodiment of the present application, the processor 101 is usually a device responsible for initiating communication and control in the cryptographic chip, for example, the processor 101 is responsible for initiating the communication process with the peripheral module 102 or the memory, including sending instructions, data requests or control signals, etc. In addition, the peripheral module 102 is usually an execution unit that responds to the processor in the cryptographic chip, which provides specific functions or stores sensitive data; the peripheral module 102 includes one or more peripherals, for example, the peripheral can be a cryptographic operation engine module (referred to as "cryptographic module"), or can be a communication module, or can also be an analog circuit (such as an analog-to-digital converter); it can be understood that each peripheral in the peripheral module 102 is an execution unit or execution circuit in the cryptographic chip, and each peripheral in the same cryptographic chip is controlled by the processor in the same cryptographic chip. It should be noted that for each peripheral in the peripheral module 102, it may have a corresponding memory or may not have a corresponding memory, for example, the cryptographic module has a corresponding memory, and the analog circuit does not have a corresponding memory, which is determined according to the actual situation and is not specifically limited to this. The cryptographic module is specifically a variety of cryptographic algorithm modules, which may include encryption modules such as symmetric cryptographic algorithm modules, asymmetric cryptographic algorithm modules, and hash algorithm modules, which may also be referred to as hardware IP modules. Here, the processor may also be referred to as a host, and the peripheral module may also be referred to as a slave.

[0040] In an embodiment of the present application, the scrambling module 105 includes one or more modules, which are connected to each communication line, such as the communication line between the processor 101 and the peripheral module 102. In this way, each communication line can be scrambled using a different scrambling password, which can increase the difficulty of cracking the password chip.

[0041] In this way, in the embodiment of the present application, the security of the cryptographic chip can be improved by dynamically scrambling the data transmitted on each communication line.

[0042] In some embodiments, Figure 2 A schematic diagram of the composition structure of a cryptographic chip provided in an embodiment of the present application Figure 2 .like Figure 2 As shown, the cryptographic chip 10 includes a startup control module 106 and a true random number generation module 107, wherein:

[0043] A true random number generation module 107, used to generate true random numbers corresponding to each communication line after the cryptographic chip 10 is powered on;

[0044] The control module 106 is started to determine the scrambling password corresponding to each communication line based on the true random number corresponding to each communication line, and write the scrambling password corresponding to each communication line into the scrambling module.

[0045] In an embodiment of the present application, the startup control module 108 can be called a hardware startup control module; wherein, the hardware startup control module will uniformly manage and schedule all processes of hardware security startup, and gradually build a secure and trusted operating environment (which can be called a "trusted environment") for the CPU operation of the cryptographic chip. For example, the hardware natively has the underlying security capability to resist attacks, that is, to build the hardware resources such as memory, bus and peripheral modules that the CPU operation depends on, so as to improve the security of the cryptographic chip operation.

[0046] In the embodiment of the present application, the true random number generation module 107 is a TRNG. For the true random numbers generated by the true random number generation module, different true random numbers (can be referred to as random numbers) are used to construct different functions. The true random number generation module can generate multiple true random numbers. For each communication line, a different true random number can be used to determine the scrambling key corresponding to each communication line, which can improve the security of the security chip.

[0047] In some embodiments, the peripheral module 102 may include peripheral A and peripheral B.

[0048] In the embodiment of the present application, the peripheral module includes peripheral A and peripheral B only as an example, and the specific peripherals included in the peripheral module are determined according to actual conditions. It should be noted that for each peripheral, it may have a corresponding second memory or may not have a corresponding memory, for example, peripheral A has a corresponding memory, and peripheral B does not have a corresponding memory, that is, the number of second memories is determined by the peripherals included in the peripheral module, and the second memory here is one only as an example.

[0049] In some embodiments, see Figure 2 The scrambling module includes a bus scrambling module 108, a first memory scrambling module 109 and a second memory scrambling module 110, wherein:

[0050] The bus scrambling module 108 is used to scramble the plaintext information based on the first scrambling key to generate first scrambled information when the processor 101 transmits the plaintext information to the peripheral module 102 through the bus;

[0051] A first memory scrambling module 109, configured to scramble the plaintext information based on a second scrambling key to generate second scrambled information when the processor 101 writes the plaintext information into the first memory 103;

[0052] The second memory scrambling module 110 is used to scramble the plaintext information based on the third scrambling key to generate third scrambled information when the peripheral module 102 writes the plaintext information into the second memory 104 .

[0053] In an embodiment of the present application, if the peripheral module 102 includes multiple peripherals, each peripheral can be connected to a corresponding second memory scrambling module, and the scrambling keys corresponding to each memory scrambling module can be different or the same. In a specific embodiment, the second memory scrambling module includes multiple, and the third scrambling password includes a third scrambling password, ..., a third N scrambling module, and each scrambling password is different, so that the security of the password chip can be increased. Wherein, N is a positive integer.

[0054] In the embodiment of the present application, the bus is also called "chip bus", which is a signal line drawn from the processor, and this bus is used to connect the processor, the first memory and the I peripheral module, etc. Among them, the bus is divided into a data bus, an address bus and a control bus; the data bus is used to transmit data information, and it travels between the processor and the memory and the peripheral module; the address bus is used to transmit address information, and the number of address lines determines the memory range of the processor address selection. The address signal is generally issued by the processor. When the dynamic allocation of memory (Dynamic Allocation of Memory, DAM) method is used to access the memory and peripheral modules, the address signal can also be issued by the DMA controller; the control bus is used to transmit various control signals, and has multiple forms such as bidirectional, unidirectional and dual-state. It is the most flexible, complex and powerful set of buses in the bus.

[0055] In some embodiments, the first memory scrambling module 109 includes a first memory scrambling module A and a first memory scrambling module B, and the second scrambling key includes a second-first scrambling key and a second-second scrambling key; wherein:

[0056] A first memory scrambling module A, configured to scramble the plaintext information based on a second-first scrambling key to generate second-first scrambled information when the processor 101 directly writes the plaintext information into the first memory A;

[0057] The first memory scrambling module B is used to scramble the plaintext information based on the second scrambling key to generate second scrambled information when the processor 101 directly writes the plaintext information into the first memory B through the bus.

[0058] In an embodiment of the present application, the processor 101 can write data into the corresponding memory in two ways. Correspondingly, different scrambling keys can be used to scramble the data written into different memories through different communication lines, so as to increase the difficulty of cracking the cryptographic chip and thereby improve the security of the cryptographic chip.

[0059] In some embodiments, the bus scrambling module 108 includes a bus scrambling module A, a bus scrambling module B, a bus scrambling module C and a bus scrambling module D.

[0060] In an embodiment of the present application, the bus scrambling module A is located at the data output / input end of the processor 101. Through the bus scrambling module A, the plaintext data output by the processor 101 can be scrambled so that the data transmitted on the bus is in ciphertext form. Therefore, the bus scrambling module A can also be called a bus scrambling host. The bus scrambling module B, the bus scrambling module C and the bus scrambling module D are used to descramble the data transmitted on the bus to transmit it to the corresponding modules, such as peripheral A, peripheral B, and the first memory scrambling module B. Therefore, the bus scrambling module B, the bus scrambling module C and the bus scrambling module D can be called bus scrambling slaves. It should be noted that for the number of bus scrambling modules, Figure 2 As just an example, the specific number can be determined according to the actual situation, but it is necessary to set a corresponding bus scrambling module between the processor and the bus, a corresponding bus scrambling module between the bus and the peripheral module, and a corresponding bus scrambling module between the bus and the first memory B. In this way, it can be ensured that the data transmitted on the bus and the data written to the data memory are all ciphertext data, thereby improving the security of the cryptographic chip.

[0061] In an embodiment of the present application, when the processor transmits plaintext information to the first memory B through the bus, the bus scrambling module A scrambles the plaintext data based on the first scrambling key, so that the generated first scrambled information is transmitted on the bus in ciphertext form. Since the bus scrambling method and the memory scrambling method are different, for example, the corresponding keys are different, the bus scrambling module B also needs to descramble the first scrambled information transmitted on the bus, and send the descrambled plaintext information to the first memory scrambling module B. Then the first memory scrambling module B scrambles the plaintext information based on the second scrambling key, so that the second scrambled information is written into the first memory B in ciphertext form. In this way, the data transmitted on the bus is ciphertext data and the data stored in the first memory is also ciphertext data, which can increase the difficulty of cracking the cryptographic chip, thereby improving the security of the cryptographic chip.

[0062] It should be noted that, since plaintext information needs to be stored in the peripheral module, when the processor transmits the plaintext information to the peripheral module through the bus, taking peripheral A as an example, at this time, the bus scrambling module A scrambles the plaintext data based on the first scrambling key, so that the generated first scrambled data is transmitted on the bus, and then the bus scrambling module C descrambles the first scrambled information transmitted on the bus, so that the descrambled plaintext information is transmitted to the peripheral A. In this way, the data transmitted on the bus can be ciphertext data, thereby improving the security of the cryptographic chip.

[0063] It should also be noted that, for the first memory and the second memory, both can be random access memory (RAM). In addition, the processor and the multiple peripherals are connected to the corresponding memories with memory scrambling modules to scramble the data written into the corresponding memories, so that the data stored in the memories are ciphertext, thereby improving the security of the cryptographic chip. Here, the first scrambling key can be called a bus scrambling key; the second scrambling key and the third scrambling key can be generally referred to as memory scrambling keys; the first memory and the second memory can be referred to as memory, or referred to as CPU data memory.

[0064] In the embodiment of the present application, plaintext information can be referred to as plaintext data, and ciphertext information can be referred to as ciphertext data. In addition, for the scrambled information, such as the first scrambled information, the second scrambled information and the third scrambled information, all of which exist in ciphertext form, that is, ciphertext data. It should be noted that the bus scrambling module, the memory scrambling module, etc. here can be referred to as the scrambling and descrambling module, that is, it can not only realize the scrambling process, but also realize the descrambling process, and it can also be understood that the descrambling is the reversible scrambling, that is, the encryption and decryption process can be realized. Exemplarily, when the processor reads data from the peripheral 1, the bus scrambling module C scrambles the plaintext data transmitted by the peripheral through the bus, and then the bus scrambling module A descrambles the scrambled data so that the processor 101 reads the plaintext data.

[0065] It should also be noted that Figure 2 As examples of the following three types of lines, Line 1: a transmission bus between a processor and a peripheral module, Line 2: a data transmission line between a peripheral module and a memory connected thereto, Line 3: a data transmission line between a peripheral module and a memory connected thereto. The number of lines of each type is determined based on actual conditions.

[0066] In a specific embodiment, the true random number generation module 107 is used to generate a first true random number, a second true random number and a third true random number after the cryptographic chip is powered on;

[0067] The startup control module 106 is further configured to determine a first scrambling key according to the first true random number, determine a second scrambling key according to the second true random number, and determine a third scrambling key according to the third true random number.

[0068] In the embodiment of the present application, the first scrambling key, the second scrambling key and the third scrambling key can all include address noise, data noise and data key, and the random numbers used for the address noise, data noise and data key are also different. In this way, by using different random numbers for the bus scrambling key and the memory scrambling key, the difficulty of cracking the cryptographic chip can be increased, thereby improving the security of the cryptographic chip.

[0069] In addition, the first scrambling key, the second scrambling key and the third scrambling key are all generated and obtained from the true random number generation module 107 when the cryptographic chip is powered on, so that the scrambling keys obtained for different cryptographic chips are all different, and even for the same cryptographic chip, for this cryptographic chip, each time it is powered on, the first scrambling key, the second scrambling key and the third scrambling key obtained are also different, which increases the difficulty of cracking the cryptographic chip. In this way, even if one cryptographic chip can be cracked, other cryptographic chips cannot be cracked. In addition, even if one cryptographic chip is cracked, the cracking will be invalid after the cryptographic chip is restarted again, thereby increasing the difficulty of cracking the cryptographic chip, and it is difficult to crack the cryptographic chips in batches, further improving the security of the cryptographic chip.

[0070] In some embodiments, the startup control module 106 is also used to obtain a preset random number after the cryptographic chip is powered on; the processor 101 is also used to set the data to be cleared as the preset random number when clearing the data to be cleared generated during the operation of the cryptographic chip.

[0071] In the embodiment of the present application, the startup control module 106 can obtain the true random number generated by the true random number generation module as a preset random number for the data to be cleared for use by the processor. For example, when the processor in the processor needs to clear the sensitive data (i.e., the data to be cleared) in the memory or the peripheral module during operation, the sensitive data is not directly cleared to zero, because it is a known condition that the data after clearing is 0, and the sensitive data before being cleared can be cracked by the electromagnetic signal of the monitoring chip operation, so the sensitive data can be cleared to the preset random number. At this time, if you want to obtain the sensitive data that has been cleared, the known condition that the data after clearing is 0 is missing, thereby increasing the difficulty of cracking the password chip, thereby improving the security of the password chip.

[0072] In some embodiments, continuing as Figure 2 As shown, the cryptographic chip 10 further includes a sensor module 111, wherein:

[0073] The sensor module 111 is used to obtain the collected data of the sensor module 111 when the cryptographic chip 10 is running, and determine whether the operating environment of the cryptographic chip 10 is a trusted environment based on the collected data;

[0074] The collected data includes at least one of the following: operating temperature, operating voltage, clock frequency, power glitch and active protection layer.

[0075] In an embodiment of the present application, the sensor module includes multiple sensors, each sensor can collect corresponding collected data, and determine whether the operating environment of the cryptographic chip is a trusted environment through the collected data. If it is determined that the operating environment of the cryptographic chip is a non-trusted environment based on the collected data, an error message can be issued to enable the cryptographic chip to take protective measures, such as restarting the cryptographic chip.

[0076] In the embodiment of the present application, the operating temperature is the operating temperature of the cryptographic chip (referred to as "temperature"). By monitoring the operating temperature, high and low temperature attacks can be resisted to prevent the cryptographic chip from being placed in a high or low temperature environment, causing the chip to operate abnormally, thereby leaking sensitive information or skipping the permission control node; the operating voltage is the operating voltage of the cryptographic chip (referred to as "voltage"). By monitoring the operating temperature, power supply fault injection attacks can be resisted to prevent the cryptographic chip from being placed in a non-rated voltage environment, causing the cryptographic chip to operate abnormally, thereby leaking sensitive information or skipping the permission control node; the clock frequency is the frequency of the clock module in the cryptographic chip (referred to as "frequency"). By monitoring the clock frequency, Attacks on the clock module can be prevented to prevent attacks on the clock module of the cryptographic chip, causing the cryptographic chip to operate abnormally, thereby leaking sensitive information or skipping the permission control node; by monitoring power supply glitches, it is possible to resist power supply fault injection attacks and prevent instantaneous abnormal voltage from being injected into the cryptographic chip, causing the cryptographic chip to operate abnormally, thereby leaking sensitive information or skipping the permission control node; by monitoring the active protection layer, it is possible to resist chip-slicing attacks. The active protection layer is implemented at the top layer of the cryptographic chip. When the chip is to be sliced ​​for identification or to monitor the circuit of the cryptographic chip, the active protection layer must be destroyed first. If the active protection layer is destroyed, the cryptographic chip can sense it and take measures such as refusing to start to prevent data from being stolen.

[0077] It should be noted that for data collection, it can obtain physical quantities of the operating environment of the cryptographic chip for the sensor module. The embodiments of the present application are not limited to operating temperature, operating voltage, clock frequency, power supply glitches and active protection layer. The required sensors can be added to the sensor module according to actual conditions to obtain the physical quantities of the operating environment of the cryptographic chip. No specific limitation is made to this.

[0078] In some embodiments, continuing as Figure 2 As shown, the cryptographic chip 10 further includes a preset memory 112, wherein:

[0079] The startup control module 106 is also used to write the preset standard data stored in the preset memory 112 into the sensor module 111 after the password chip 10 is powered on;

[0080] The sensor module 111 is also used to send an error message when it is determined that the operating environment of the cryptographic chip 10 is an untrusted environment based on the collected data and the preset standard data.

[0081] In the embodiment of the present application, the preset standard data includes at least one of the following: preset operating temperature, preset operating voltage, preset clock frequency, preset power burr and preset active protection layer. Here, the data stored in the multiple sensors included in the sensor module 111 may not be accurate enough when the password chip is manufactured. Therefore, when the password chip is tested and calibrated, the preset standard data can be written into the preset memory. Here, the preset memory 112 can be an unchangeable non-volatile storage medium, such as a one-time programmable (OTP) memory, that is, once programmed (written), it cannot be erased or rewritten again; the startup control module automatically writes the preset calibration data into the sensor module. This process is implemented by digital hardware and cannot be changed. It can avoid attacks on the startup process, thereby avoiding tampering with the preset calibration data of the sensor module, which makes the sensor module's protection of the password chip ineffective.

[0082] Exemplarily, the startup control module writes the preset calibration data stored in the OTP memory into the corresponding sensors in the sensor module, and enables the sensors in the sensor module to compare the collected data with the preset calibration data to monitor whether the operating environment of the cryptographic chip is attacked or destroyed. When the operating environment of the cryptographic chip is an untrusted environment, the sensor module issues an error message, so that the cryptographic chip can take measures such as resetting and clearing key data to protect the data security in the cryptographic chip.

[0083] Thus, in the embodiment of the present application, the security of the cryptographic chip can be improved by dynamically scrambling the data transmitted by the processor to the peripheral modules through the bus, or the data written by the processor and / or the peripheral modules into their respective corresponding memories; and a trusted environment for the operation of the cryptographic chip is constructed through hardware to create a secure operating environment. After the trusted environment is constructed, the processor is started so that each instruction in the processor is executed in the trusted environment, thereby further improving the security of the cryptographic chip.

[0084] In yet another embodiment of the present application, Figure 3 A schematic diagram of the composition structure of a cryptographic chip provided in an embodiment of the present application Figure 3 .like Figure 3 As shown, the cryptographic chip 10 further includes a first verification module 113 and a second verification module 114, wherein:

[0085] The startup control module 106 is further used to determine the memory assignment data and the corresponding preset verification data of the first memory 103 and the second memory 104 respectively when the cryptographic chip 10 is powered on, and write the memory assignment data and the corresponding preset verification data of the first memory 103 into the first memory 103, and write the memory assignment data and the corresponding preset verification data of the second memory 104 into the second memory 104;

[0086] A first verification module 113 is used to overwrite the memory assignment data of the first memory with the second scrambling information when writing the second scrambling information into the first memory 103, and to determine whether the read verification data corresponding to the second scrambling information is consistent with the preset verification data when reading the second scrambling information from the first memory 103;

[0087] The second verification module 114 is used to overwrite the memory copy data corresponding to the second memory 104 with the third scrambling information when writing the third scrambling information into the second memory 104, and to determine whether the read verification data corresponding to the third scrambling information is consistent with the preset verification data when reading the third scrambling information from the second memory 104.

[0088] In the embodiment of the present application, the first verification module 113 may include one or more, for example, a first verification module A and a first verification module B, which correspond to two communication lines of the processor writing to the processor corresponding memory respectively; the second verification module 114 may include one or more, Figure 3 Only one is taken as an example, and the specific number included is determined according to the type of peripherals included in the peripheral module 102. This is not specifically limited.

[0089] In the embodiment of the present application, after the password chip is powered on, the data in the memory (first memory or second memory) is uncertain. If the uninitialized data is read directly, the verification module (first verification module or second verification module) may report an error. Therefore, after each power-on of the password chip and before the password chip is operated, the startup control module performs a memory initialization process on the memory. Specifically, after the password chip is powered on, the startup control module determines the memory assignment data and the corresponding preset verification data of the memory, and writes the memory assignment data and the corresponding preset verification data into the memory, thus completing the memory initialization process of the memory. Exemplarily, the memory assignment data of the memory can be customized, for example, 1 is written to address 0 in the memory, 2 is written to address 1, ..., and for example, other data can be written to each address in the data memory. There is no specific limitation on this, and it is only necessary that the data in the memory is determined before the password chip is operated.

[0090] In the embodiment of the present application, both the first check module and the second check module can be error correction code (ECC) check modules, which can generate preset check data. Exemplarily, one ECC check code is generated for every 8 bits of transmitted data. In another exemplary embodiment, when writing valid data to the memory, the ECC check module adds a check bit (i.e., preset check data) to the valid data and writes it to the memory together with the valid data. When reading valid data from the memory in the data storage device, the ECC check module automatically determines whether the valid data and its check bit are consistent with the check bit when writing. If they are inconsistent, an error is reported so that the password chip can take protective measures, thereby improving the security of the password chip.

[0091] It should be noted that the first verification module or the second verification module is connected between the corresponding memory scrambling module and the memory, making it difficult to attack the cryptographic chip by changing the data stored in the memory through fault injection, such as letting the CPU get the wrong data and run away and skip the security check. Exemplarily, when the first verification module finds that the stored data in the first memory is inconsistent with the preset verification data written by the first verification module, the first verification module issues an error message and interrupts the CPU operation, thereby protecting the cryptographic chip.

[0092] It should also be noted that before the CPU runs, the memory is automatically initialized by hardware, and the corresponding memory assignment data and the corresponding preset verification data are written to each address in the first memory and the second memory. This can avoid the CPU from participating in the operation of initializing the memory, thereby improving the startup speed of the cryptographic chip. In addition, since the CPU can read the data in the memory without initializing the memory, the first instruction executed by the CPU can also be protected, thereby improving the security of the operation of the cryptographic chip.

[0093] In some embodiments, the cryptographic chip 10 also includes a selection module 115, wherein: the selection module 115 is used to determine that the processor can run when the operating environment of the cryptographic chip is a trusted environment; or, when the operating environment of the cryptographic chip is an untrusted environment, determine to continue building the trusted environment of the cryptographic chip until the operating environment of the cryptographic chip is a trusted environment.

[0094] In the embodiment of the present application, the selection module 115 may be a selector. For example, the selector may output 0 and 1, and output 0 when determining that the operating environment of the cryptographic chip is an untrusted environment; and output 1 when determining that the operating environment of the cryptographic chip is a trusted environment, which is not specifically limited.

[0095] It should be noted that if Figure 3As shown, the selection module 115 may include multiple selection modules, such as selection module A, selection module B and selection module C; here, the data of the selection module may be the same as the data of the memory scrambling module (i.e., the sum of the number of the first memory scrambling module and the second memory scrambling module), which may be determined according to actual conditions and is not specifically limited.

[0096] In some embodiments, the selection module 115 is also used to determine that the cryptographic chip can operate after determining that the memory initialization of the first memory and the second memory is completed; or, after determining that the memory initialization of the first memory and the second memory is not completed, determine to continue to complete the memory initialization steps of the first memory and the second memory until the memory initialization of the first memory and the second memory is completed.

[0097] For example, the selection module A can output 0 and 1. When it is determined that the memory initialization of the first memory is completed, it outputs 1; when it is determined that the memory initialization of the first memory is not completed, it outputs 0. Alternatively, the selector can also output "False" and "Ture", which is not specifically limited.

[0098] In an implementation example of the present application, after the cryptographic chip is powered on, the startup control module writes the first scrambling key into the bus scrambling module, writes the second scrambling key into the first memory scrambling module, and writes the third scrambling key into the second memory scrambling module, the startup control module determines the memory assignment data and the corresponding preset verification data of the first memory and the second memory respectively and writes the memory assignment data and the corresponding preset verification data of the first memory and the second memory respectively into the corresponding memory, and the startup control module writes the preset standard data stored in the preset memory into the sensor module. These three parts can be performed synchronously, and after the startup control module completes the above tasks, it can be considered that the startup control module has built a trusted operating environment for the cryptographic chip to ensure the security of the cryptographic chip during operation, and the parallel processing of these three unrelated threads can also reduce the startup time of the cryptographic chip.

[0099] In some embodiments, continuing as Figure 3 As shown, the cryptographic chip 10 also includes a read-only memory 116, wherein:

[0100] The processor 101 is used to read plaintext information from the read-only memory when the operating environment of the cryptographic chip 10 is a trusted environment, and perform read and write operations on the peripheral module and / or memory according to the plaintext information; wherein the plaintext information includes original data and the original address corresponding to the original data.

[0101] In the embodiment of the present application, the processor 101 may be a CPU, which is used to control and coordinate the peripheral module and / or the memory (the first memory or the second memory), initiate data transmission, and configure the DMA, and the DMA is used to initiate data transmission. In addition, the read-only memory (ROM) may also be referred to as the CPU instruction memory, which may be a memory of an unchangeable medium; the ciphertext information may be referred to as the CPU instruction, which is stored in the CPU instruction memory of an unchangeable medium.

[0102] In an embodiment of the present application, the CPU can read instructions from the CPU instruction memory for execution, and then the CPU will read and write accesses to the peripheral module, the first memory, and the second memory according to the read instructions, thereby providing services for the cryptographic chip.

[0103] In some embodiments, continuing as Figure 3 As shown, the cryptographic chip 10 includes a third verification module 117 and an instruction scrambling module 118, wherein:

[0104] The third verification module 117 is used to transmit the ciphertext information stored in the read-only memory 116 to the instruction scrambling module 118 when the ciphertext information is read and the ciphertext information verification passes;

[0105] The instruction scrambling module 118 is used to descramble the ciphertext information stored in the read-only memory 116 to restore the plaintext information and transmit the plaintext information to the processor 101 .

[0106] In the embodiment of the present application, the ciphertext information in the read-only memory is obtained from the plaintext information input by the manufacturer of the cryptographic chip 10. It should be noted that after the designer of the cryptographic chip inputs the plaintext data, the plaintext information can be scrambled by the instruction scrambling module to obtain the ciphertext information, and then the preset verification data corresponding to the ciphertext information can be obtained by the third verification module, and the ciphertext information and the corresponding preset verification data are written into the read-only memory together when the cryptographic chip is manufactured, so that the data stored in the read-only memory is ciphertext data, which can improve the security of the cryptographic chip.

[0107] It should be noted that after the cryptographic chip is manufactured, the CPU instructions cannot be changed, which can ensure that the instructions run by the CPU are difficult to be attacked. In addition, since the ROM is unchangeable, the ciphertext information stored in it is also unchangeable, so there is no need to use a random number as a key. The key is implemented in the circuit of the cryptographic chip together with the ROM ciphertext information when the cryptographic chip is designed. In addition, the ciphertext information can also be called a ciphertext instruction, and the plaintext information can also be called a plaintext instruction, which includes the original data and the original address, so that the CPU can perform read and write operations according to the plaintext information.

[0108] In yet another embodiment of the present application, Figure 4 A processing flow diagram of a bus scrambling module provided in an embodiment of the present application. Figure 4 As shown, the first scrambling key includes a first address noise, a first data noise and a first data key, and the bus scrambling module includes a first processing module 401, a second processing module 402 and a scrambling submodule 403, wherein:

[0109] The first processing module 401 is used to scramble the first address noise and the original address to generate a first scrambled address;

[0110] The second processing module 402 is used to process the first data noise and the original data to generate first processed data;

[0111] The scrambling submodule 403 is used to scramble the first scrambled address, the first processed data and the first data key to generate first scrambled data;

[0112] The first scrambling information includes a first scrambling address and first scrambling data.

[0113] In the embodiment of the present application, the startup control module obtains the first true random from the TRNG as the first scrambling key. The first scrambling key includes the first address noise, the first data noise and the first data key. The plaintext information is scrambled by the first scrambling key to obtain the first scrambled information, so that the first scrambled information is transmitted on the bus in the form of ciphertext, thereby improving the security of the cryptographic chip.

[0114] In addition, different true random numbers can be used to scramble the original address and the original data, that is, the first scrambling number noise, the first data noise and the data key are different true random numbers, thus avoiding the coupled scrambling of the address and data and increasing the difficulty of cracking the cryptographic chip.

[0115] In some embodiments, continuing as Figure 4 As shown, the scrambling submodule 403 includes a third processing module 4031, a data conversion module 4032 and a fourth processing module 4033, wherein:

[0116] The third processing module 4031 is used to process the first scrambled address and the first processed data to generate second processed data;

[0117] The data conversion module 4032 is used to perform a preset number of shift and replacement processes on the second processed data to obtain third processed data;

[0118] The fourth processing module 4033 is used to process the third processed data and the data key to generate first scrambled data.

[0119] In an embodiment of the present application, the data conversion module of the bus scrambling module may include shifting and permuting, and the input data is shifted and permuted a preset number of times to obtain processed data, for example, the preset number of times is 8, or it can be 9, and there is no specific limitation on this. Among them, permutation is a predetermined one-to-one nonlinear function, which can nonlinearly permute the input data to a certain output data. It should be noted that the operation of shift and permutation operations can be repeated for multiple rounds, and the more rounds are repeated, the greater the scrambling strength, but the longer the operation delay, at this time, the frequency required for the cryptographic chip is lower, and the performance of the cryptographic chip is reduced). Here, the number of repeated rounds can be determined according to the security level requirements and operating frequency requirements of the cryptographic chip, and there is no specific limitation on this.

[0120] In the embodiment of the present application, the first processing module, the second processing module, the third processing module and the fourth processing module can all be XOR gate circuits. In some embodiments, Figure 5 A detailed processing flow diagram of a bus scrambling module provided in an embodiment of the present application. Figure 5 In FIG. 5 , 501 represents the process of the bus scrambling module, and 502 represents the first scrambled information obtained after the plain text information is scrambled. Figure 5 As shown in FIG. 1 , the bus scrambling module includes four XOR gate circuits, shift operations, and permutation operations. Figure 5 , the bus scrambling process is explained in detail:

[0121] (1) The startup control module obtains a first true random number from the TRNG as a first scrambling key (including a first address noise, a first data noise and a first data key); (2) The first address noise is XORed with the original address through an XOR gate circuit to obtain a first scrambled address; (3) The first data noise is XORed with the original data through an XOR gate circuit, and then XORed with the first scrambled address through an XOR gate circuit to obtain data containing address and data information; (4) Multiple rounds of shift and permutation operations are performed on the data containing address and data information to obtain transformed data; (5) The data after the operation is XORed with the data key through an XOR gate circuit to obtain first scrambled data.

[0122] In the embodiments of the present application, Figure 5 Taking a certain data in 502 as an example, the original data A0 that should be stored in address 0 is transformed and stored in address 1, and the original data A0 that should be stored is actually stored with the first scrambled data a0 after being scrambled by the true random number. When reading, the same true random number is used for inverse transformation, and a0 can be obtained in address 1 according to address 0, and then the same true random number is used for inverse transformation of a0 to obtain the original data A0.

[0123] In the embodiment of the present application, the bus is scrambled in sections, that is, in different address blocks, the addresses are only changed one-to-one within the current block (for example Figure 5 The scrambled blocks A and B shown in the figure) will not be transformed to other address blocks. In this way, the number of iterations of the scrambling circuit can be simplified, and the circuit timing can be optimized, so that the cryptographic chip can run at a higher frequency to improve performance. And the larger the memory block, the higher the security, but the frequency may become slower and the performance weaker, and vice versa, the stronger the performance; here, the size of the memory block can be determined according to the use scenario and security level requirements of the cryptographic chip, or a specific scrambled block space (i.e., block) size can be defined, and no specific limitation is made on this.

[0124] In some embodiments, the second scrambling key includes a second address noise, a second data noise and a second data key, and the first memory scrambling module includes a fifth processing module, a sixth processing module and a scrambling submodule, wherein: the fifth processing module is used to scramble the second address noise and the original address to generate a second scrambled address; the sixth processing module is used to process the second data noise and the original data to generate fourth processed data; the scrambling submodule is used to scramble the second scrambled address, the fourth processed data and the second data key to generate second scrambled data; wherein the second scrambling information includes the second scrambled address and the second scrambled data.

[0125] In a specific embodiment, the scrambling submodule in the first memory scrambling module includes a seventh processing module, a data conversion module and an eighth processing module, wherein: the seventh processing module is used to process the second scrambling address and the fourth processing data to generate fifth processing data; the data conversion module is used to perform a preset number of shift and permutation processing on the fifth processing data to obtain sixth processing data; the eighth processing module is used to process the sixth processing data with a data key to generate second scrambled data.

[0126] In the embodiment of the present application, the operation process of the fifth processing module is the same as that of the first processing module, the processing method of the sixth processing module is the same as that of the second processing module, the operation process of the scrambling submodule and the bus scrambling submodule in the first memory scrambling module is the same, the processing method of the seventh processing module is the same as that of the third processing module, the processing method of the eighth processing module is the same as that of the fourth processing module, and the processing method of the data conversion module in the first memory scrambling module is the same as that of the data conversion module in the bus scrambling module. In other words, the processing methods of the first memory scrambling module and the bus scrambling module are the same, and no further elaboration is given here.

[0127] In an embodiment of the present application, the third scrambling key includes a third address noise, a third data noise and a third data key. The composition structure of the second memory scrambling module is similar to that of the first memory scrambling module. In other words, the processing methods of the first memory scrambling module and the second memory scrambling module and the bus scrambling module are the same, which will not be elaborated here.

[0128] In another embodiment of the present application, based on the cryptographic chip of the above embodiment, Figure 6 The detailed structural diagram of a cryptographic chip provided in the embodiment of the present application is shown in FIG. Figure 6 As shown, the cryptographic chip 10 includes TRNG, hardware startup control module, OTP, sensor module, CPU, bus scrambling host, chip bus, bus scrambling slave, selector, memory scrambling host, EEC, CPU data memory, CPU instruction memory, ROM scrambling host, peripheral A and peripheral B. Among them, Figure 6 There are two selectors in it, and the module circled by the dotted box is the selector.

[0129] In the embodiment of the present application, the CPU is the processor in the above embodiment, the bus scrambling host is the bus scrambling module A in the above embodiment, the three bus scrambling slaves are respectively the bus scrambling module B, the bus scrambling module C and the bus scrambling module C in the above embodiment, the chip bus is the bus in the above embodiment, the peripheral A and the peripheral B are the peripheral modules in the above embodiment, the two selectors are the selection module B and the selection module C in the above embodiment, the two CPU data memories are divided into the above-mentioned first memory B and the second memory, the two memory scrambling hosts are the first memory scrambling module B and the second memory scrambling module in the above embodiment, the two ECCs connected to the CPU data memory are respectively the first verification module B and the second verification module in the above embodiment, the CPU instruction memory is the read-only memory in the above embodiment, the ECC connected to the CPU instruction memory is the third verification module in the above embodiment, the ROM scrambling host is the instruction scrambling module in the above embodiment, the OTP is the preset memory in the above embodiment, the hardware startup control module is the startup control module in the above embodiment, and the TRNGA is the true random number generation module in the above embodiment.

[0130] In the embodiment of the present application, for Figure 6 ①~⑦ in the figure are the hardware startup process of the password chip. Figure 7 A schematic diagram of the hardware startup process of a cryptographic chip provided in an embodiment of the present application. Figure 7 As shown, ① is to start TRNG and obtain true random numbers, ② is to initialize memory, ③ is to configure bus scrambling key, ④ is to configure memory scrambling key, ⑤ is to enable bus scrambling and memory scrambling, ⑥ is to initialize sensors, and ⑦ is to complete the hardware startup and start CPU operation.

[0131] In the embodiment of the present application, it can be seen that ①, ② and ⑥ can be performed synchronously, so as to avoid the problem of multi-process serial startup, which causes the startup time to be long due to the lack of clear order of chip startup, thereby reducing the startup time. It should be noted that Figure 6 The vertical line ⑦ pointing to the CPU indicates that the startup is complete and the CPU starts running. The horizontal line ⑦ pointing to the CPU indicates that the CPU is searching for instructions during operation. The instructions are stored in the CPU instruction memory. After the instructions are obtained and scrambled by the ECC and ROM host, the plain text information can be obtained.

[0132] In some embodiments, in combination Figure 6 and Figure 7 , elaborate on ①~⑦:

[0133] ① After the cryptographic chip is powered on, the hardware startup control module starts running. The hardware startup control module will uniformly manage and schedule all processes of hardware security startup, gradually run the CPU of the cryptographic chip, and build a secure and trusted operating environment (i.e., a trusted environment), that is, build the hardware resources such as memory, bus, and peripherals that the CPU operation depends on; here, the trusted operating environment is the underlying security capability of the hardware to resist attacks, as follows:

[0134] a. The hardware scrambles the data written by the CPU to the memory (i.e., the CPU data memory) before writing it. When the CPU reads the data from the memory, the hardware will automatically descramble the data to obtain the plaintext information and then send it to the CPU for use. In this way, the data stored in the memory is ciphertext data. Since it is ciphertext data, even if the static data stored in the memory is obtained by slicing and cracking the cryptographic chip, it cannot be used; while the plaintext data (i.e., plaintext information) is dynamic and will only appear temporarily in the digital circuit of the CPU. These digital circuits are disorganized after the automatic layout and wiring during the production of the cryptographic chip, and the CPU discards the data after using it. If you want to obtain the dynamic plaintext data in the digital circuit of the CPU, it is much more difficult than obtaining the static data in the memory. In this way, the use of hardware automatic scrambling method can increase the difficulty of cracking the security chip, thereby improving the security of the security chip.

[0135] b. The wiring between the CPU and the peripherals (i.e. the chip bus) is usually long and regular, and the transmitted data is easy to be monitored. Therefore, the hardware (i.e. the bus scrambling master) first scrambles the data at the CPU data exit and transmits the ciphertext. When the data reaches the peripheral, it is descrambled by the hardware (bus scrambling slave) and the plaintext data is sent to the peripheral, thereby ensuring the security of the wiring.

[0136] c. The keys used for bus scrambling and memory scrambling are obtained from TRNG when the security chip is powered on. The scrambling keys of different chips can be different, and the scrambling keys of the same chip at different power-ons are also different, which further increases the ability to crack the security chip. In this way, even if one security chip can be cracked, other security chips cannot be cracked. Even if one security chip is cracked, the cracking will be invalid after the security chip is restarted. This can increase the difficulty of cracking the cryptographic chip and make it difficult to crack the cryptographic chip in batches, thereby improving the security of the cryptographic chip.

[0137] d. As mentioned above Figure 5 , the scrambling of the bus and memory is essentially the scrambling of the address and data. This transformation uses true random numbers for scrambling, and different transformation combinations can appear according to different true random numbers; specifically, the hardware startup control module obtains true randomness from TRNG as the scrambling key (including address noise, data noise and data key, and then XORs the address noise with the original address to obtain the scrambled address, and then XORs the data noise with the original data and then XORs with the scrambled address to obtain data containing address and data information, and performs multiple rounds of shift and permutation operations on the data containing address and data information to obtain the transformed data, and finally XORs the operated data with the data key to obtain the scrambled data. In this way, the data that originally needs to be stored in the 0 address is transformed and stored in the 1 address, and the A0 data that originally needs to be stored is actually stored after the true random number scrambling transformation. When reading, the same true random number is used for inverse transformation, and the ciphertext a0 data can be obtained in the 1 address according to the 0 address, and the a0 data is then inversely transformed using the same true random number to obtain the A0 data.

[0138] In the embodiment of the present application, different true random numbers are used for address and data scrambling to avoid address and data coupling scrambling, which increases the difficulty of cracking the password chip; and the bus and memory are scrambled in segments, that is, in different address blocks, the address is only transformed one-to-one in the current block, and will not be transformed to other address blocks, which can simplify the number of iterations of the scrambling circuit and optimize the circuit timing, so that the password chip can run at a higher frequency to improve performance. It should be noted that the larger the block, the higher the security, but the frequency may become slower and the performance may become weaker, and vice versa, the stronger the performance. For the size of the block, you can flexibly choose according to the use scenario and security level of the password chip in terms of performance and security.

[0139] In addition, the shift and permutation operations can be repeated for multiple rounds. The more rounds are repeated, the greater the scrambling strength and the longer the operation delay. However, the frequency of the cryptographic chip is required to be lower, which will also reduce the performance of the cryptographic chip. Here, the number of repeated rounds can be flexibly determined according to the security level requirements and operating frequency requirements of the cryptographic chip.

[0140] It should be noted that after the hardware startup control module starts running, the first step is to start TRNG and obtain true random numbers for the subsequent trusted operating environment construction. The requirement for the obtained true random numbers is that different functions should be constructed with different true random numbers as much as possible, for example, the random number used for the bus scrambling key is different from the random number used for the memory scrambling key, and the random numbers used for address scrambling and data scrambling are different. In addition, the random number for clearing sensitive data can be obtained for use by the CPU; when the CPU needs to clear sensitive data in the memory or peripheral operation process, do not clear it directly, because the cleared data is 0 as a known condition, and the electromagnetic signal of the password chip can be monitored to crack the data before being cleared. Instead, the sensitive data is cleared to random numbers. If sensitive data needs to be cracked, the known condition that the cleared data is 0 is missing, which increases the difficulty of cracking, thereby improving the security of the password chip.

[0141] ②In Figure 6 In order to improve security, the embodiment of the present application adds ECC between the memory scrambling host and the memory to ensure data integrity, making it difficult to change the data in the memory by fault injection to attack the password chip, such as the CPU getting the wrong data and running away, thereby skipping the security check. When ECC finds that the data in the memory is inconsistent with the ECC check code, it will report an error and interrupt the CPU operation, thereby protecting the password chip. Among them, the ECC working principle is: when writing to the memory, ECC adds a check bit to the valid data in the memory and writes it to the memory together with the valid data. When reading data from the memory, ECC automatically determines whether the data and its check bit are consistent, and reports an error if they are inconsistent. Moreover, after the password chip is powered on, the data in the memory is uncertain. If it is read directly without writing, ECC will report an error. Therefore, the embodiment of the present application adds a memory initialization process. After the password chip is powered on, the hardware automatically initializes the memory, and writes the ECC matching data and check code to each address, which can save the subsequent CPU initialization memory operation, improve the startup speed of the password chip, and the CPU can directly read the memory without initialization.

[0142] It should be noted that the bus or memory scrambling host is integrated on the side close to the CPU. When the CPU writes data to the memory or peripheral, the host is responsible for scrambling. When the CPU reads data from the memory or peripheral, the host is responsible for descrambling. The bus scrambling slave is integrated on the side close to the peripheral. When the CPU writes data to the peripheral, the slave is responsible for descrambling the ciphertext data sent by the scrambling host and sending it to the peripheral. When the CPU reads data from the peripheral, the slave is responsible for descrambling and transmitting it to the host. Because the ciphertext needs to be stored in the memory, there is no need for a memory scrambling slave.

[0143] It should also be noted that a selector is connected in front of the memory scrambling host, and the selector corresponds to two outputs, 0 means that the initialization is not completed, and 1 means that the initialization is completed; when the initialization is not completed, the selector outputs 0 and continues to complete step ②. After the initialization is completed, the selector outputs 1 to perform the memory scrambling operation of writing the plaintext data into the memory.

[0144] ③. The hardware startup control module writes the first true random number obtained in ① into the bus scrambling module for use as a bus scrambling key.

[0145] ④. The hardware startup control module writes the second true random number obtained in ① and the second true random number into their respective corresponding memory scrambling modules for use as memory scrambling keys.

[0146] ⑤. After the hardware startup control module waits for ①②③④⑤ and ② to be completed, the bus scrambling function of the bus scrambling module is enabled, and the memory scrambling function of the memory scrambling module is enabled.

[0147] ⑥. The hardware startup control module writes the initial information of the calibration value stored in the OTP (i.e., the preset calibration data) into each sensor of the sensor module and enables it. Among them, the sensor is used to monitor whether the operating environment of the cryptographic chip is attacked or destroyed. When the operating environment is untrusted (i.e., an untrusted environment), an error message is issued so that the cryptographic chip can take measures such as resetting and clearing key data to protect the data security of the cryptographic chip. It should be noted that the sensor may not be accurate enough when the chip is manufactured, and it needs to be calibrated during chip testing, and the calibration value is written into an unchangeable non-volatile storage medium, such as OTP; the hardware startup control module automatically writes these calibration values ​​into the sensor. This process is implemented by digital hardware and cannot be changed. It can avoid attacks during the startup process. For example, tampering with the calibration value of the sensor makes the sensor's protection of the cryptographic chip invalid.

[0148] In the embodiment of the present application, the physical quantities (i.e., collected data) of the cryptographic chip operating environment protected by the sensor module include chip operating temperature, operating voltage, clock frequency, power burrs, and active protection layer. It should be noted that a corresponding sensor is required to obtain each physical quantity of the operating environment. The specific meaning of the collected data obtained by the sensor module is explained below:

[0149] a. Chip operating temperature: It can resist high and low temperature attacks and prevent the chip from being placed in a high or low temperature environment, causing the chip to operate abnormally, thereby leaking sensitive information or skipping the permission control node.

[0150] b. Operating voltage: It can resist power failure injection attacks and prevent the chip from being placed in a non-rated voltage environment, causing the chip to operate abnormally, thereby leaking sensitive information or skipping permission control nodes.

[0151] c. Clock frequency: It can resist attacks on the clock module and prevent hackers from attacking the chip's clock module, causing the chip to operate abnormally, thereby leaking sensitive information or skipping permission control nodes.

[0152] d. Power glitch: It can resist power failure injection attacks and prevent hackers from injecting instantaneous abnormal voltage into the cryptographic chip, causing the chip to operate abnormally, thereby leaking sensitive information or skipping the permission control node.

[0153] e. Active protection layer: It can resist chip-slicing attacks. The active protection layer is implemented at the top layer of the chip. When you want to slice and identify or monitor the chip's circuit, you must first destroy the active protection layer. When the active protection layer is destroyed, the cryptographic chip can sense it and take measures such as refusing to start up to prevent data from being stolen.

[0154] ⑦ When the above steps are completed, a trusted operating environment is provided for the CPU operation of the cryptographic chip. At this time, the hardware startup control module will start the CPU and let the CPU run. Then the CPU can read instructions from the CPU instruction memory for operation. The CPU will read and write to the peripherals and memory according to the read instructions, thereby providing services for the cryptographic chip. It should be noted that the CPU instructions of the embodiment of the present application are stored in a CPU instruction memory with an unchangeable medium such as ROM. After the cryptographic chip is manufactured, the instructions cannot be changed, which can ensure that the instructions running by the CPU are difficult to be attacked. In addition, since ROM is a memory of an unchangeable medium, the ciphertext instructions (i.e., ciphertext information) stored in the CPU instruction memory are also unchangeable, so the ROM scrambling host does not need to use a random number as a key. When the key is designed by the cryptographic chip, it is implemented in the cryptographic chip circuit together with the ciphertext data of the ROM.

[0155] In the embodiment of the present application, a hardware architecture applied to a cryptographic chip and a hardware startup method based on the architecture are specifically provided. The architecture systematically considers the weak points that may be attacked in the cryptographic chip, and provides corresponding protection measures for these weak points. The purpose of each protection measure is clear and echoes each other, and together provides a high level of security protection for the cryptographic chip; and based on the architecture, the embodiment of the present application also provides a multi-process orderly concurrent hardware startup method, which fully improves the startup speed of the cryptographic chip, and fully integrates the various components of the hardware architecture to build a cryptographic chip trusted operating environment with strong anti-attack capabilities. That is to say, the software and hardware security requirements of the cryptographic chip are integrated to build a trusted and secure operating environment at the bottom of the cryptographic chip, and the environment is implemented by pure hardware and cannot be tampered with. After the trusted environment is built, the CPU is started again, so that every instruction of the software is executed in a trusted environment. In addition, according to the data flow of the CPU operation, the bus, memory, and chip operating environment (temperature, voltage, frequency, etc.) are fully protected, and the use of multiple means and multi-level organic combination can enhance the anti-attack capability of the cryptographic chip.

[0156] In addition, in the embodiment of the present application: the transmission bus between the CPU and the hardware IP module or peripheral in the cryptographic chip, the data transmission line between each hardware IP module (or peripheral) and the corresponding memory module (i.e., CPU data storage device), and the data transmission line between the CPU and the corresponding memory module (i.e., CPU data storage device) and the data stored in the memory are dynamically scrambled, that is, the hardware of the cryptographic chip does not preset the same fixed key for each chip; when the cryptographic chip is started, the hardware automatically obtains different true random numbers as scrambling keys for different lines. By the above two steps, it can be achieved that each chip corresponds to a different scrambling key, and the scrambling keys corresponding to different power-ons of the same chip are also different. In this way, even if one cryptographic chip is conquered, other cryptographic chips cannot be conquered, and after the conquered cryptographic chip is powered on and restarted again, the previous attack will be invalidated, making the security of the cryptographic chip very high.

[0157] The embodiment of the present application provides a cryptographic chip, specifically a scheme for dynamically encrypting three types of lines of the cryptographic chip and data stored in the memory based on true random numbers. The above embodiment is used to elaborate on the specific implementation of the above embodiment. It can be seen that by running the non-dependent processes at the same time, the startup time of the cryptographic chip can be improved. For example, when initializing the memory, TRNG is started to configure the memory and bus scrambling keys at the same time, and the sensor is initialized at the same time; and for mutually dependent processes, serial startup is ensured to ensure security. For example, after obtaining the true random number, the bus scrambling key and the memory scrambling key are configured, and then the bus scrambling function and the memory scrambling function are started, and after the sensor is initialized and the startup monitoring is completed, the CPU is started again, so that the first instruction executed by the CPU is protected, so that the operating environment of the cryptographic chip is safe and reliable. In addition, memory scrambling, bus scrambling and ECC are all implemented by hardware combination logic, and the operation is completed within a chip clock cycle. The speed is fast, does not affect the chip operation steps, and does not require software development. That is to say, on the basis of not increasing the requirements for software development of the cryptographic chip, the trusted operating environment of the cryptographic chip can be guaranteed by pure hardware, thereby improving the security of the cryptographic chip.

[0158] In another embodiment of the present application, based on the cryptographic chip of the aforementioned embodiment, Figure 8 A schematic diagram of a scrambling method provided in an embodiment of the present application Figure 1 .like Figure 8 As shown, the scrambling method may include:

[0159] S801, the scrambling module scrambles the plaintext information transmitted on each communication line based on the scrambling password corresponding to each communication line obtained when the cryptographic chip is powered on.

[0160] In an embodiment of the present application, the scrambling method is applied to a cryptographic chip described in any one of the above embodiments. The cryptographic chip includes a processor, a peripheral module, a first memory, a second memory, and a scrambling module, and the processor and the first memory, the processor and the peripheral module, and the peripheral module and the second memory are all connected through a communication line. It should be noted that the scrambling method provided here is a dynamic scrambling method, and is implemented by hardware, which can improve the security of the cryptographic chip.

[0161] In some embodiments, the scrambling passwords corresponding to the various communication lines obtained when the password chip is powered on are as follows: Fig. 9 As shown, the method may include:

[0162] S901, after the cryptographic chip is powered on, the true random number generation module generates true random numbers corresponding to each communication line.

[0163] S902, the start control module determines the scrambling password corresponding to each communication line based on the true random number corresponding to each communication line, and writes the scrambling password corresponding to each communication line into the scrambling module.

[0164] In the embodiment of the present application, the true random number corresponding to the scrambling key corresponding to each communication line is different, that is, the scrambling key corresponding to each communication line is different; and for each scrambling key, it includes address noise, data noise, etc., and the random numbers used by the three are also different. In this way, the key for bus scrambling and the key for memory scrambling are different, which increases the difficulty of cracking the cryptographic chip and improves the security of the cryptographic chip.

[0165] In some embodiments, the scrambling module scrambles the plaintext information transmitted on each communication line based on the scrambling password corresponding to each communication line obtained when the cryptographic chip is powered on, including: when the processor transmits the plaintext information to the peripheral module through the bus, the bus scrambling module scrambles the plaintext information based on the first scrambling key to generate the first scrambled information; when the processor writes the plaintext information to the first memory, the first memory scrambling module scrambles the plaintext information based on the second scrambling key to generate the second scrambled information; when the peripheral module writes the plaintext information to the second memory, the second memory scrambling module scrambles the plaintext information based on the third scrambling key to generate the third scrambled information.

[0166] In some embodiments, the scrambling method may further include: when the cryptographic chip is powered on, determining the memory assignment data and corresponding preset verification data of each of the first memory and the second memory by starting the control module, and writing the memory assignment data and the corresponding preset verification data of the first memory into the first memory, and writing the memory assignment data and the corresponding preset verification data of the second memory into the second memory; when writing the second scrambling information into the first memory, the first verification module uses the second scrambling information to overwrite the memory assignment data of the first memory, and when reading the second scrambling information from the first memory, determines whether the read verification data corresponding to the second scrambling information is consistent with the preset verification data; when writing the third scrambling information into the second memory, the second verification module uses the third scrambling information to overwrite the memory copy data corresponding to the second memory, and when reading the third scrambling information from the second memory, determines whether the read verification data corresponding to the third scrambling information is consistent with the preset verification data.

[0167] In some embodiments, the method further includes: after the cryptographic chip is powered on, starting the control module to obtain a preset random number; when clearing the data to be cleared generated during the operation of the cryptographic chip, the processor sets the data to be cleared to the preset random number.

[0168] In some embodiments, the method may also include: when the operating environment of the cryptographic chip is a trusted environment, reading plaintext information from a read-only memory through a processor, and performing read and write operations on the peripheral module and / or memory according to the plaintext information; wherein the plaintext information includes the original data and the original address corresponding to the original data.

[0169] In some embodiments, the processor reads plaintext information from a read-only memory, including: when the ciphertext information stored in the read-only memory is read by a third verification module and the ciphertext information verification passes, the ciphertext information is transmitted to an instruction scrambling module; the instruction scrambling module descrambles the ciphertext information stored in the read-only memory to restore the plaintext information, and transmits the plaintext information to the processor.

[0170] In some embodiments, the first scrambling key includes a first address noise, a first data noise and a first data key, the bus scrambling module includes a first processing module, a second processing module and a scrambling submodule, and the method further includes: scrambling the first address noise and the original address by the first processing module to generate a first scrambled address; processing the first data noise and the original data by the second processing module to generate first processed data; scrambling the first scrambling address, the first processed data and the first data key by the scrambling submodule to generate first scrambled data; wherein the first scrambling information includes the first scrambled address and the first scrambled data.

[0171] In some embodiments, the scrambling submodule of the bus scrambling module includes a third processing module, a data conversion module and a fourth processing module; the first scrambling address, the first processed data and the first data key are scrambled by the scrambling submodule to generate the first scrambled data, including: the first scrambling address and the first processed data are processed by the third processing module to generate the second processed data; the second processed data is shifted and permuted a preset number of times by the data conversion module to obtain the third processed data; the third processed data and the data key are processed by the fourth processing module to generate the first scrambled data.

[0172] In the embodiment of the present application, the first processing module, the second processing module, the third processing module and the fourth processing module are all XOR gate circuits.

[0173] In some embodiments, the cryptographic chip also includes a sensor module, and the scrambling method also includes: when the cryptographic chip is running, acquiring collected data through the sensor module, and determining whether the operating environment of the cryptographic chip is a trusted environment based on the collected data; wherein the collected data includes at least one of the following: operating temperature, operating voltage, clock frequency, power supply glitches, and active protection layer.

[0174] In some embodiments, the scrambling method also includes: after the cryptographic chip is powered on, writing the preset standard data stored in the preset memory into the sensor module through the startup control module; when the sensor module determines that the operating environment of the cryptographic chip is an untrusted environment based on the collected data and the preset standard data, an error message is issued.

[0175] The description of the above method embodiment is similar to the description of the above password chip embodiment, and has similar beneficial effects as the same embodiment. For technical details not disclosed in the method embodiment of this application, please refer to the description of the password chip embodiment of this application for understanding.

[0176] An embodiment of the present application provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by at least one processor, the steps of the method described in any one of the aforementioned embodiments are implemented.

[0177] An embodiment of the present application also provides a computer program product, including a computer program or instructions, which, when executed by a processor, implements the steps of the method described in any of the aforementioned embodiments.

[0178] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, devices, equipment, or computer program products. Therefore, the present application may take the form of hardware embodiments, software embodiments, or embodiments combining software and hardware. Moreover, the present application may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage and optical storage, etc.) containing computer-usable program codes.

[0179] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0180] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0181] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0182] It should be noted that, in this application, the terms "include", "comprises" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, product or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, product or device. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the existence of other identical elements in the process, method, product or device including the element.

[0183] The serial numbers of the above-mentioned embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments.

[0184] The methods disclosed in several method embodiments provided in this application can be arbitrarily combined without conflict to obtain new method embodiments.

[0185] The features disclosed in several product embodiments provided in this application can be arbitrarily combined without conflict to obtain new product embodiments.

[0186] The features disclosed in several method or device embodiments provided in this application can be arbitrarily combined without conflict to obtain new method embodiments or device embodiments.

[0187] The above description is only a specific implementation manner of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application.

Claims

1. A cryptographic chip, characterized in that: The cryptographic chip includes a processor, a peripheral module, a first memory, a second memory and a scrambling module, wherein: The processor and the first memory, the processor and the peripheral module, and the peripheral module and the second memory are all connected via a communication line; The scrambling module is used to scramble the plaintext information transmitted on each communication line based on the scrambling password corresponding to each communication line obtained when the cryptographic chip is powered on; The scrambling module includes a bus scrambling module, a first memory scrambling module and a second memory scrambling module; the bus scrambling module is used to scramble the plaintext information based on a first scrambling key to generate first scrambling information when the processor transmits the plaintext information to the peripheral module through a bus; the first memory scrambling module is used to scramble the plaintext information based on a second scrambling key to generate second scrambling information when the processor writes the plaintext information into the first memory; the second memory scrambling module is used to scramble the plaintext information based on a third scrambling key to generate third scrambling information when the peripheral module writes the plaintext information into the second memory.

2. The cryptographic chip according to claim 1, characterized in that: The cryptographic chip includes a startup control module and a true random number generation module, wherein: The true random number generation module is used to generate true random numbers corresponding to each communication line after the cryptographic chip is powered on; The startup control module is used to determine the scrambling password corresponding to each communication line based on the true random number corresponding to each communication line, and write the scrambling password corresponding to each communication line into the scrambling module.

3. The cryptographic chip according to claim 2, characterized in that: The cryptographic chip further includes a first verification module and a second verification module, wherein: The startup control module is further used to determine the memory assignment data and corresponding preset verification data of each of the first memory and the second memory when the password chip is powered on, and write the memory assignment data and corresponding preset verification data of the first memory into the first memory, and write the memory assignment data and corresponding preset verification data of the second memory into the second memory; The first verification module is configured to overwrite the memory assignment data corresponding to the first memory with the second scrambling information when writing the second scrambling information into the first memory, and to determine whether the read verification data corresponding to the second scrambling information is consistent with the preset verification data when reading the second scrambling information from the first memory; The second verification module is configured to, when writing the third scrambling information into the second memory, overwrite the memory assignment data corresponding to the second memory with the third scrambling information, and when reading the third scrambling information from the second memory, determine whether the read verification data corresponding to the third scrambling information is consistent with the preset verification data.

4. The cryptographic chip according to claim 2, characterized in that: The startup control module is also used to obtain a preset random number after the cryptographic chip is powered on; The processor is further used to set the data to be cleared as the preset random number when clearing the data to be cleared generated during the operation of the password chip.

5. The cryptographic chip according to claim 2, characterized in that: The password chip also includes a read-only memory, wherein: The processor is used to read the plaintext information from the read-only memory when the operating environment of the cryptographic chip is a trusted environment, and perform read and write operations on the peripheral module and / or memory according to the plaintext information; The plaintext information includes original data and an original address corresponding to the original data.

6. The cryptographic chip according to claim 5, characterized in that: The cryptographic chip further includes a third verification module and an instruction scrambling module, wherein: The third verification module is used to transmit the ciphertext information stored in the read-only memory to the instruction scrambling module when the ciphertext information is read and the ciphertext information is verified to pass; The instruction scrambling module is used to descramble the ciphertext information stored in the read-only memory to restore the plaintext information, and transmit the plaintext information to the processor.

7. The cryptographic chip according to claim 5, characterized in that: The first scrambling key includes a first address noise, a first data noise and a first data key, and the bus scrambling module includes a first processing module, a second processing module and a scrambling submodule, wherein: The first processing module is used to scramble the first address noise and the original address to generate a first scrambled address; The second processing module is used to process the first data noise and the original data to generate first processed data; The scrambling submodule is used to scramble the first scrambling address, the first processed data and the first data key to generate first scrambled data; The first scrambling information includes the first scrambling address and the first scrambling data.

8. The cryptographic chip according to claim 7, characterized in that: The scrambling submodule includes a third processing module, a data conversion module and a fourth processing module, wherein: The third processing module is used to process the first scrambled address and the first processed data to generate second processed data; The data conversion module is used to perform a preset number of shift and permutation processes on the second processed data to obtain third processed data; The fourth processing module is used to process the third processed data and the data key to generate the first scrambled data.

9. The cryptographic chip according to any one of claims 2 to 8, characterized in that: The cryptographic chip further includes a sensor module, wherein: The sensor module is used to obtain the collected data of the sensor module when the cryptographic chip is running, and determine whether the operating environment of the cryptographic chip is a trusted environment based on the collected data; The collected data includes at least one of the following: operating temperature, operating voltage, clock frequency, power glitch and active protection layer.

10. The cryptographic chip according to claim 9, characterized in that: The startup control module is further used to write the preset standard data stored in the preset memory into the sensor module after the password chip is powered on; The sensor module is also used to send an error message when it is determined that the operating environment of the cryptographic chip is an untrusted environment based on the collected data and the preset standard data.

11. A scrambling method for a cryptographic chip, characterized in that: The cryptographic chip includes a processor, a peripheral module, a first memory, a second memory and a scrambling module, and the processor and the first memory, the processor and the peripheral module, and the peripheral module and the second memory are all connected through a communication line; the scrambling method includes: The scrambling module scrambles the plaintext information transmitted on each communication line based on the scrambling password corresponding to each communication line obtained when the cryptographic chip is powered on; The scrambling module includes a bus scrambling module, a first memory scrambling module and a second memory scrambling module; the scrambling module scrambles the plaintext information transmitted on each communication line based on the scrambling password corresponding to each communication line obtained when the cryptographic chip is powered on, including: when the processor transmits the plaintext information to the peripheral module through the bus, the bus scrambling module scrambles the plaintext information based on the first scrambling key to generate the first scrambling information; when the processor writes the plaintext information to the first memory, the first memory scrambling module scrambles the plaintext information based on the second scrambling key to generate the second scrambling information; when the peripheral module writes the plaintext information to the second memory, the second memory scrambling module scrambles the plaintext information based on the third scrambling key to generate the third scrambling information.

Images