Secure communication methods, devices, systems, electronic devices and storage media

Abstract

This application provides a secure communication method, apparatus, system, electronic device, and storage medium, relating to the field of computer technology. The method includes: generating a shared key based on a public key read from the memory of a bus device; the host and the bus device running the same asymmetric encryption algorithm; generating a first digest based on the shared key and writing the first digest into the memory of the bus device; determining that key negotiation with the bus device has been successful based on an encrypted string read from the memory of the bus device; the encrypted string being generated by the bus device after determining key negotiation with the host based on the first digest; and establishing a secure communication channel with the bus device based on the shared key. The method and apparatus provided in this application improve communication efficiency and simplicity, and realize the establishment of an efficient and secure communication channel between the bus device and the host.

Description

Technical Field

[0001] This application relates to the field of computer technology, and in particular to a secure communication method, apparatus, system, electronic device, and storage medium. Background Technology

[0002] Peripheral Component Interconnect Express (PCIe) is a computer bus standard used to connect external devices, such as graphics cards, network cards, storage controllers, and the central processing unit and main memory on the motherboard. It provides a high-speed data transmission channel, enabling fast and reliable communication between devices and the host. PCIe devices typically refer to external devices connected to the PCIe bus, through which they exchange data with the host. Communication between PCIe devices and the host can be risky because data can be stolen or tampered with during transmission. Furthermore, communication between PCIe devices and the host typically lacks encryption and authentication mechanisms, making it vulnerable to security threats such as man-in-the-middle attacks.

[0003] The related technologies require additional network layer interactions or other complex security mechanisms to achieve authentication and key negotiation, making the communication process between PCIe devices and hosts more complex and less efficient.

[0004] Therefore, how to establish an efficient and secure communication channel between PCIe devices and the host has become a technical problem that the industry urgently needs to solve. Summary of the Invention

[0005] This application provides a secure communication method, apparatus, system, electronic device, and storage medium to solve the technical problem of how to establish an efficient and secure communication channel between a PCIe device and a host.

[0006] This application provides a secure communication method applied to a host, including:

[0007] A shared key is generated based on the public key read from the memory of the bus device; the host and the bus device run the same asymmetric encryption algorithm.

[0008] A first digest is generated based on the shared key, and the first digest is written into the memory of the bus device;

[0009] Based on the encrypted string read from the memory of the bus device, it is determined that the key negotiation with the bus device was successful; the encrypted string is generated by the bus device after determining the key negotiation with the host based on the first digest.

[0010] A secure communication channel is established with the bus device based on the shared key.

[0011] In some embodiments, generating a shared key based on a public key read from the memory of the bus device includes:

[0012] Read the public key and certificate from the memory of the bus device;

[0013] The public key is verified based on the certificate;

[0014] If the public key is deemed trustworthy, a temporary public key is generated based on the public key.

[0015] The shared key is generated based on the public key and the first private key.

[0016] In some embodiments, generating a first digest based on the shared key includes:

[0017] A first digest is generated based on the public key, the temporary public key, and the shared key.

[0018] In some embodiments, determining that the key negotiation with the bus device was successful based on the encrypted string read from the memory of the bus device includes:

[0019] Read the encrypted string from the memory of the bus device;

[0020] The encrypted string is decrypted based on the shared key to generate a decrypted string;

[0021] If the decryption string matches the preset string, the key negotiation with the bus device is considered successful.

[0022] This application provides a secure communication method applied to a bus device, including:

[0023] A first digest and a temporary public key are read from memory; the first digest and the temporary public key are generated by the host based on the public key in memory; the host and the bus device run the same asymmetric encryption algorithm.

[0024] Generate a shared key based on the temporary public key;

[0025] A second digest is generated based on the public key, the temporary public key, and the shared key;

[0026] If the second digest is determined to be consistent with the first digest, a key negotiation is performed with the host to generate an encrypted string; the encrypted string is used to confirm with the host that the key negotiation was successful.

[0027] A secure communication channel is established with the host based on the shared key.

[0028] In some embodiments, generating a shared key based on the temporary public key includes:

[0029] A shared key is generated based on the temporary public key and the second private key.

[0030] This application provides a secure communication module for use in a host, comprising:

[0031] The first generation module is used to generate a shared key based on the public key read from the memory of the bus device; the host and the bus device run the same asymmetric encryption algorithm;

[0032] The second generation module is used to generate a first digest based on the shared key and write the first digest into the memory of the bus device;

[0033] A key negotiation module is used to determine that key negotiation with the bus device is successful based on an encrypted string read from the memory of the bus device; the encrypted string is generated by the bus device after determining key negotiation with the host based on the first digest;

[0034] The channel establishment module is used to establish a secure communication channel with the bus device based on the shared key.

[0035] This application provides a secure communication module for use in a bus device, comprising:

[0036] The digest reading module is used to read a first digest and a temporary public key from memory; the first digest and the temporary public key are generated by the host based on the public key in memory; the host and the bus device run the same asymmetric encryption algorithm;

[0037] The third generation module is used to generate a shared key based on the temporary public key;

[0038] The fourth generation module is used to generate a second digest based on the public key, the temporary public key, and the shared key;

[0039] The fifth generation module is used to determine, when it is determined that the second digest is consistent with the first digest, to perform key negotiation with the host and generate an encrypted string; the encrypted string is used to confirm with the host that the key negotiation was successful.

[0040] A secure communication module is used to establish a secure communication channel with the host based on the shared key.

[0041] In some embodiments, the memory of the bus device includes a read-only region and a writable region;

[0042] The read-only area is used to store the public key;

[0043] The writable area is used to store the first digest, the temporary public key, and the encrypted string.

[0044] This application provides a secure communication system, including a host and a bus device;

[0045] The host is used to execute the secure communication method described above;

[0046] The bus device is used to execute the secure communication method described above.

[0047] This application provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the secure communication method described above.

[0048] This application provides a non-transitory computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements the aforementioned secure communication method.

[0049] The secure communication method, apparatus, system, electronic device, and storage medium provided in this application generate a shared key based on a public key read from the memory of a bus device; generate a first digest based on the shared key and write the first digest into the memory of the bus device; determine that key negotiation with the bus device is successful based on an encrypted string read from the memory of the bus device; and establish a secure communication channel with the bus device based on the shared key. Since the host and the bus device run the same asymmetric encryption algorithm, key negotiation between the host and the bus device is achieved through reading and writing to the memory of the bus device, without the need for network layer interaction or other complex security mechanisms. This simplifies the communication process, improves communication efficiency and convenience, and enables the establishment of an efficient and secure communication channel between the bus device and the host. Attached Figure Description

[0050] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0051] To more clearly illustrate the technical solutions in this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0052] Figure 1 This is one of the flowcharts illustrating the secure communication method provided in this application.

[0053] Figure 2This is the second flowchart of the secure communication method provided in this application.

[0054] Figure 3 This is one of the structural schematic diagrams of the secure communication device provided in this application.

[0055] Figure 4 This is the second structural schematic diagram of the secure communication device provided in this application.

[0056] Figure 5 This is a schematic diagram of the structure of the bus device memory provided in this application.

[0057] Figure 6 This is a schematic diagram of the secure communication system provided in this application.

[0058] Figure 7 This is the third flowchart of the secure communication method provided in this application.

[0059] Figure 8 This is a schematic diagram of the structure of the electronic device provided in this application. Detailed Implementation

[0060] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present application, and not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative effort should fall within the scope of protection of the present application.

[0061] It should be noted that the terms "first," "second," etc., used in this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or device that comprises a series of steps, units, or modules is not necessarily limited to those explicitly listed, but may include other steps, units, or modules not explicitly listed or inherent to such processes, methods, products, or devices.

[0062] There is no cryptographic protection mechanism between PCIe devices and the host. The PCIe bus itself does not provide encryption or authentication functions, but focuses on high-speed data transmission and device connectivity. Related technologies may achieve authentication and key negotiation through additional network layer interactions or other complex security mechanisms, which results in a complex communication process and low communication efficiency.

[0063] In order to address the shortcomings of related technologies, Figure 1 This is one of the flowcharts illustrating the secure communication method provided in this application, such as... Figure 1 As shown, the method is applied to the host and includes steps 110, 120, 130 and 140.

[0064] Step 110: Generate a shared key based on the public key read from the memory of the bus device; the host and the bus device run the same asymmetric encryption algorithm.

[0065] Specifically, the entity executing the secure communication method provided in this application is a secure communication device. This device can be implemented in software, such as a secure communication program running on a host; or it can be a device that executes the secure communication method, such as a mobile terminal, tablet computer, desktop computer, or server.

[0066] A host refers to a computer or server that provides services. A bus device refers to a device that connects to the host via bus communication, such as a graphics card or network card. This application embodiment uses communication between the host and the bus device via a PCIe bus as an example to illustrate a secure communication method. A bus device can also be referred to as a PCIe device.

[0067] Asymmetric encryption algorithms are algorithms that use a pair of keys (public and private keys) to encrypt and decrypt plaintext. The public key is used to encrypt the plaintext (raw text data that has not been encrypted or processed), and the private key is used to decrypt the ciphertext (encrypted text data). In the embodiments of this application, the host and bus devices can be configured and run the same asymmetric encryption algorithm, such as the elliptic curve public key cryptography algorithm (SM2). This algorithm only requires 300 bytes of storage space, and its storage and computational overhead will not affect the normal operation of the device, providing security while ensuring high efficiency.

[0068] The bus device can generate a public key based on an asymmetric encryption algorithm and store it in memory. After the host connects to the bus device, it can read the public key from the bus device's memory.

[0069] The ECDH (Elliptic Curve Diffie-Hellman) protocol is a key exchange protocol based on elliptic curve cryptography used to securely negotiate shared keys without prior sharing. In the secure communication method provided in this application, the host can generate a shared key based on the public key, referring to the relevant content of the ECDH protocol.

[0070] Step 120: Generate a first digest based on the shared key and write the first digest into the memory of the bus device.

[0071] Specifically, a digest is typically used to represent the content of a message or data as a "fingerprint," which can be calculated using a hash function. The main purpose of a digest is to verify data integrity, usually to ensure that data has not been tampered with during transmission or storage. Digests are irreversible; that is, the original data cannot be deduced from the digest. Therefore, they are primarily used for data integrity checks rather than encryption.

[0072] The host can generate a first digest based on the shared key and write the generated first digest into the memory of the bus device.

[0073] Step 130: Based on the encrypted string read from the memory of the bus device, determine that the key negotiation with the bus device was successful; the encrypted string is generated by the bus device after determining the key negotiation with the host based on the first digest.

[0074] Specifically, the bus device can read the first digest from memory. Referring to the relevant content of the ECDH protocol, the bus device generates a shared key using the same asymmetric encryption algorithm configured in the host, and generates a second digest based on the shared key. The device determines whether to perform key negotiation with the host by comparing the second digest with the first digest. If the two digests match, key negotiation with the host can be performed; if they do not match, key negotiation with the host can be avoided.

[0075] If key negotiation with the host is confirmed, the bus device can generate an encrypted string and write it into memory. The encrypted string can be generated by encrypting a preset string using a shared key. The preset string can be a string pre-negotiated between the host and the bus device, used for security verification.

[0076] The host can read the encrypted string from the bus device's memory, decrypt it using the shared key, and obtain the decrypted string. The decrypted string is then compared to a preset string. If they match, the key negotiation with the bus device was successful; otherwise, the key negotiation failed.

[0077] Step 140: Establish a secure communication channel with the bus device based on the shared key.

[0078] Specifically, once the key negotiation with the bus device is successful, the host can establish a secure communication channel with the bus device, which encrypts and decrypts the transmitted data based on the shared key.

[0079] The secure communication method provided in this application generates a shared key based on a public key read from the memory of a bus device; generates a first digest based on the shared key and writes the first digest into the memory of the bus device; determines that key negotiation with the bus device is successful based on an encrypted string read from the memory of the bus device; and establishes a secure communication channel with the bus device based on the shared key. Since the host and the bus device run the same asymmetric encryption algorithm, key negotiation between the host and the bus device is achieved by reading and writing to the memory of the bus device, without the need for network layer interaction or other complex security mechanisms. This simplifies the communication process, improves communication efficiency and convenience, and enables the establishment of an efficient and secure communication channel between the bus device and the host.

[0080] It should be noted that each implementation method of this application can be freely combined, rearranged, or executed individually, and does not need to rely on or depend on a fixed execution order.

[0081] In some embodiments, a shared key is generated based on a public key read from the memory of the bus device, including:

[0082] Read the public key and certificate from the memory of the bus device;

[0083] Trusted verification of public keys based on certificates;

[0084] If the public key is deemed trustworthy, a temporary public key is generated based on the public key.

[0085] Generate a shared key based on the public key and the first private key.

[0086] Specifically, the bus device can generate a public key and a certificate based on an asymmetric encryption algorithm. The certificate can be used to verify the trustworthiness of the public key. The host reads the public key and certificate from memory and verifies the trustworthiness of the public key based on the data in the certificate.

[0087] If the public key is trusted, the host can generate a temporary public key based on the public key and an asymmetric encryption algorithm. For example, the temporary public key in the SM2 algorithm improves the security of key exchange and signature operations by increasing dynamism and randomness, effectively preventing various cryptographic attacks and side-channel attacks.

[0088] The host can also generate a shared key using a key derivation function based on the public key and the first private key. The first private key is also determined based on the asymmetric encryption algorithm running on the host.

[0089] The secure communication method provided in this application generates a shared key based on the public key read from the memory of the bus device, which helps to realize key negotiation between the host and the bus device and simplifies the communication process.

[0090] In some embodiments, generating a first digest based on a shared key includes:

[0091] The first digest is generated based on the public key, temporary public key, and shared key.

[0092] Specifically, the host can generate a first digest using a hash algorithm based on the public key, temporary public key, and shared key.

[0093] The secure communication method provided in this application relies strictly on public keys, temporary public keys, and shared keys in the generation process of the first digest. In this way, tampering and forgery can be prevented, and the privacy and integrity of communication can be protected.

[0094] In some embodiments, determining successful key negotiation with the bus device based on an encrypted string read from the bus device's memory includes:

[0095] Read the encrypted string from the memory of the bus device;

[0096] The encrypted string is decrypted using the shared key to generate a decrypted string;

[0097] If the decrypted string matches the preset string, the key negotiation with the bus device is considered successful.

[0098] Specifically, the host can read the encrypted string generated by the bus device from the bus device's memory, decrypt the encrypted string according to the shared key, generate a decrypted string, and compare the decrypted string with a preset string. If the decrypted string matches the preset string, the host determines that the key negotiation with the bus device has been successful; if the decrypted string does not match the preset string, the host determines that the key negotiation with the bus device has failed.

[0099] The secure communication method provided in this application determines that key negotiation with the bus device is successful based on the encrypted string read from the bus device's memory. By reading and writing to the bus device's memory, key negotiation between the host and the bus device is achieved without the need for network layer interaction or other complex security mechanisms, thus simplifying the communication process.

[0100] Figure 2 This is the second flowchart illustrating the secure communication method provided in this application, as shown below. Figure 2 As shown, the method is applied to a bus device and includes steps 210, 220, 230, 240 and 250.

[0101] Step 210: Read the first digest and temporary public key from memory; the first digest and temporary public key are generated by the host based on the public key in memory; the host and bus devices run the same asymmetric encryption algorithm.

[0102] Specifically, the entity executing the secure communication method provided in this application is a secure communication device. This device can be implemented in software, such as a secure communication program running in a bus device; or it can be a device that executes the secure communication method, such as various bus devices.

[0103] The host and bus devices can be configured and run the same asymmetric encryption algorithm, such as elliptic curve public-key cryptography (SM2). The bus device generates a public key based on the asymmetric encryption algorithm and writes the public key into memory for the host to read.

[0104] The host generates a first digest and a temporary public key based on the read public key, and writes the first digest and the temporary public key into the memory of the bus device.

[0105] Step 220: Generate a shared key based on the temporary public key.

[0106] Specifically, bus devices can use asymmetric encryption algorithms to generate a shared key based on a temporary public key.

[0107] Step 230: Generate a second digest based on the public key, temporary public key, and shared key.

[0108] Specifically, the bus device can generate a second digest using a hash algorithm based on the public key, temporary public key, and shared key.

[0109] Step 240: If the second digest is consistent with the first digest, determine to perform key negotiation with the host and generate an encrypted string; the encrypted string is used to confirm with the host that the key negotiation was successful.

[0110] Specifically, the bus device compares the second digest with the first digest to determine whether to perform key negotiation with the host. If the two digests match, key negotiation with the host can be performed; if the two digests do not match, key negotiation with the host can be avoided.

[0111] If key negotiation with the host is confirmed, the bus device can generate an encrypted string and write it into memory. The encrypted string can be generated by encrypting a preset string using a shared key. The preset string can be a string pre-negotiated between the host and the bus device, used for security verification.

[0112] The host can read the encrypted string from the bus device's memory, decrypt it using the shared key, and obtain the decrypted string. The decrypted string is then compared to a preset string. If they match, the key negotiation with the bus device was successful; otherwise, the key negotiation failed.

[0113] Step 250: Establish a secure communication channel with the host based on the shared key.

[0114] Specifically, once the key negotiation with the bus device is successful, the host can establish a secure communication channel with the bus device, which encrypts and decrypts the transmitted data based on the shared key.

[0115] The secure communication method provided in this application reads a first digest and a temporary public key from memory; generates a shared key based on the temporary public key; generates a second digest based on the public key, the temporary public key, and the shared key; if the second digest is consistent with the first digest, determines to perform key negotiation with the host and generates an encrypted string; the encrypted string is used to confirm successful key negotiation with the host; and a secure communication channel is established with the host based on the shared key. Since the host and the bus device run the same asymmetric encryption algorithm, key negotiation between the host and the bus device is achieved by reading and writing to the memory of the bus device, without the need for network layer interaction or other complex security mechanisms. This simplifies the communication process, improves communication efficiency and convenience, and enables the establishment of an efficient and secure communication channel between the bus device and the host.

[0116] In some embodiments, generating a shared key based on a temporary public key includes:

[0117] A shared key is generated based on the temporary public key and the second private key.

[0118] Specifically, the bus device can generate a shared key using a key derivation function based on a temporary public key and a second private key. The second private key is determined based on the asymmetric encryption algorithm running in the bus device.

[0119] It should be noted that the temporary public key and the first private key are generated by the host according to the asymmetric encryption algorithm, while the public key and the second private key are generated by the bus device according to the same asymmetric encryption algorithm.

[0120] The secure communication method provided in this application generates a shared key based on a temporary public key and a second private key, which helps to realize key negotiation between the host and the bus device and simplifies the communication process.

[0121] The apparatus provided in the embodiments of this application is described below. The apparatus described below can be referred to in correspondence with the method described above.

[0122] Figure 3 This is one of the structural schematic diagrams of the secure communication device provided in this application, such as... Figure 3 As shown, the device is applied to the host computer and includes:

[0123] The first generation module 310 is used to generate a shared key based on the public key read from the memory of the bus device; the host and the bus device run the same asymmetric encryption algorithm;

[0124] The second generation module 320 is used to generate a first digest based on the shared key and write the first digest into the memory of the bus device;

[0125] The key negotiation module 330 is used to determine that key negotiation with the bus device is successful based on the encrypted string read from the memory of the bus device; the encrypted string is generated by the bus device after determining key negotiation with the host based on the first digest;

[0126] The channel establishment module 340 is used to establish a secure communication channel with the bus device based on a shared key.

[0127] The secure communication device provided in this application generates a shared key based on a public key read from the memory of a bus device; generates a first digest based on the shared key and writes the first digest into the memory of the bus device; determines that key negotiation with the bus device is successful based on an encrypted string read from the memory of the bus device; and establishes a secure communication channel with the bus device based on the shared key. Since the host and the bus device run the same asymmetric encryption algorithm, key negotiation between the host and the bus device is achieved by reading and writing to the memory of the bus device, without the need for network layer interaction or other complex security mechanisms. This simplifies the communication process, improves communication efficiency and convenience, and enables the establishment of an efficient and secure communication channel between the bus device and the host.

[0128] In some embodiments, the first generation module is specifically used for:

[0129] Read the public key and certificate from the memory of the bus device;

[0130] Trusted verification of public keys based on certificates;

[0131] If the public key is deemed trustworthy, a temporary public key is generated based on the public key.

[0132] Generate a shared key based on the public key and the first private key.

[0133] In some embodiments, the second generation module is specifically used for:

[0134] The first digest is generated based on the public key, temporary public key, and shared key.

[0135] In some embodiments, the key negotiation module is specifically used for:

[0136] Read the encrypted string from the memory of the bus device;

[0137] The encrypted string is decrypted using the shared key to generate a decrypted string;

[0138] If the decrypted string matches the preset string, the key negotiation with the bus device is considered successful.

[0139] Figure 4 This is the second structural schematic diagram of the secure communication device provided in this application, as shown below. Figure 4 As shown, this device is applied to a bus device and includes:

[0140] The digest reading module 410 is used to read the first digest and the temporary public key from memory; the first digest and the temporary public key are generated by the host based on the public key in memory; the host and the bus device run the same asymmetric encryption algorithm;

[0141] The third generation module 420 is used to generate a shared key based on a temporary public key;

[0142] The fourth generation module 430 is used to generate a second digest based on the public key, the temporary public key, and the shared key;

[0143] The fifth generation module 440 is used to determine, when the second digest is consistent with the first digest, to perform key negotiation with the host and generate an encrypted string; the encrypted string is used to confirm with the host that the key negotiation was successful.

[0144] The secure communication module 450 is used to establish a secure communication channel with the host based on a shared key.

[0145] The secure communication device provided in this application reads a first digest and a temporary public key from memory; generates a shared key based on the temporary public key; generates a second digest based on the public key, the temporary public key, and the shared key; if the second digest is consistent with the first digest, it determines to perform key negotiation with the host and generates an encrypted string; the encrypted string is used to confirm successful key negotiation with the host; and a secure communication channel is established with the host based on the shared key. Since the host and the bus device run the same asymmetric encryption algorithm, key negotiation between the host and the bus device is achieved by reading and writing to the memory of the bus device, without the need for network layer interaction or other complex security mechanisms. This simplifies the communication process, improves communication efficiency and convenience, and enables the establishment of an efficient and secure communication channel between the bus device and the host.

[0146] In some embodiments, the third generation module is specifically used for:

[0147] A shared key is generated based on the temporary public key and the second private key.

[0148] In some embodiments, the memory of the bus device includes a read-only region and a writable region;

[0149] The read-only area is used to store the public key;

[0150] The writable area is used to store the first digest, the temporary public key, and the encrypted string.

[0151] Specifically, Figure 5 This is a schematic diagram of the structure of the bus device memory provided in this application, such as... Figure 5 As shown, bus devices can employ Input / Output Memory Management (IOMEM) to utilize a portion of memory for secure communication methods. This memory can be further divided into read-only and writable regions.

[0152] The read-only area is used to store the public key, which prevents the public key from being stolen or tampered with, thus improving security. In addition, it also allows the public key to be stored in memory for a long time.

[0153] The writable area is used to store the first digest, temporary public key, and encrypted string. Key negotiation between the host and the bus device can be achieved by reading and writing to the bus device's memory.

[0154] Figure 6 This is a schematic diagram of the secure communication system provided in this application, such as... Figure 6 As shown, the secure communication system 600 includes a host 610 and a bus device 620.

[0155] The host is used to execute the secure communication method applied to the host in the above embodiments; the bus device is used to execute the secure communication method applied to the bus device in the above embodiments.

[0156] The secure communication system provided in this application embodiment executes corresponding secure communication methods on the host and bus system respectively. Since the host and bus devices run the same asymmetric encryption algorithm, key negotiation between the host and bus devices is achieved by reading and writing to the memory of the bus devices. Key negotiation does not need to be achieved through network layer interaction or other complex security mechanisms, which simplifies the communication process, improves the efficiency and convenience of communication, and realizes the establishment of an efficient secure communication channel between the bus devices and the host.

[0157] Figure 7 This is the third flowchart illustrating the secure communication method provided in this application, as shown below. Figure 7 As shown, this method is applicable to both host devices and bus devices (PCIe devices).

[0158] Before secure communication, the bus device generates a public key and requests an authentication certificate from a trusted third party, storing it in a readable area of ​​memory. Furthermore, an asymmetric encryption algorithm (SM2) is configured in both the bus device and the host, requiring only 300 bytes of space.

[0159] The specific process of secure communication methods includes:

[0160] Step 1: The host reads the public key from the read-only area of ​​the bus device's memory via the PCIe bus. and its certificates.

[0161] Step 2: Host verifies certificate Is it trustworthy? Then generate a temporary public key. And calculate the shared key according to the ECDH protocol. and first summary : , .in, For key derivation functions, For hash functions; public key and the first private key All are temporary public keys generated based on the SM2 algorithm. It was also generated based on the SM2 algorithm.

[0162] Step 3: The host transmits the temporary public key via the PCIe bus. and first summary Write to the writable area in the memory of the bus device.

[0163] Step 4: The bus device reads the temporary public key from memory. and first summary .

[0164] Step 5: Bus devices calculate shared keys. Calculate the second summary ,verify If the condition is met, then a key negotiation with the host is initiated. This involves the second private key. It was generated based on the SM2 algorithm.

[0165] Step 6: Bus device calculates the encrypted string. This is written to a writable area of ​​memory. For the preset string, This is an encryption function.

[0166] Step 7: The host reads the encrypted string from the writable area of ​​memory.

[0167] Step 8: The host uses the shared key Decryption Obtain plaintext ,like If the negotiation is successful, the host and bus devices establish a connection. This is a secure channel for the key.

[0168] The secure communication method provided in this application has the following beneficial effects:

[0169] (1) It provides encryption and authentication protection for communication between the host and bus devices, ensuring data security; (2) It adopts the SM2 algorithm, which only requires 300 bytes of space. The storage and computing overhead will not affect the normal operation of the device, providing security while ensuring high efficiency; (3) It simplifies the communication process by communicating directly in the device memory. Authentication and key negotiation can be completed by simply reading and writing to the device memory, which improves the efficiency and convenience of communication.

[0170] Figure 8 This is a schematic diagram of the structure of the electronic device provided in this application, such as... Figure 8 As shown, the electronic device may include a processor 810, a communications interface 820, a memory 830, and a communications bus 840, wherein the processor 810, the communications interface 820, and the memory 830 communicate with each other via the communications bus 840. The processor 810 can call logical commands stored in the memory 830 to execute the methods described in the above embodiments, for example:

[0171] A shared key is generated based on the first public key read from the bus device's memory; the host and the bus device run the same asymmetric encryption algorithm; a first digest is generated based on the shared key and written into the bus device's memory; based on the encrypted string read from the bus device's memory, it is determined that key negotiation with the bus device was successful; the encrypted string is generated by the bus device after determining key negotiation with the host based on the first digest; a secure communication channel is established with the bus device based on the shared key.

[0172] Alternatively, the first digest and temporary public key are read from memory; the first digest and temporary public key are generated by the host based on the first public key in memory; the host and bus devices run the same asymmetric encryption algorithm; a shared key is generated based on the temporary public key; a second digest is generated based on the first public key, the temporary public key, and the shared key; if the second digest is determined to be consistent with the first digest, a key negotiation is initiated with the host to generate an encrypted string; the encrypted string is used to confirm successful key negotiation with the host; a secure communication channel is established with the host based on the shared key.

[0173] Furthermore, the logical commands in the aforementioned memory can be implemented as software functional units and sold or used as independent products, and can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several commands to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0174] The processor in the electronic device provided in this application embodiment can call logical instructions in the memory to implement the above method. Its specific implementation method is the same as the aforementioned method implementation method and can achieve the same beneficial effect, which will not be repeated here.

[0175] This application also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, is implemented to perform the methods provided in the above embodiments.

[0176] The specific implementation method is the same as the aforementioned method implementation method and can achieve the same beneficial effects, so it will not be repeated here.

[0177] This application provides a computer program product, including a computer program that, when executed by a processor, implements the method described above.

[0178] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0179] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0180] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application.

Claims

1. A secure communication method, characterized in that, Applied to the host, including: A shared key is generated based on the public key read from the memory of the bus device; the host and the bus device run the same asymmetric encryption algorithm. A first digest is generated based on the shared key, and the first digest is written into the memory of the bus device; Based on the encrypted string read from the memory of the bus device, it is determined that the key negotiation with the bus device was successful; the encrypted string is generated by the bus device after determining the key negotiation with the host based on the first digest. A secure communication channel is established with the bus device based on the shared key.

2. The secure communication method according to claim 1, characterized in that, The process of generating a shared key based on the public key read from the memory of the bus device includes: Read the public key and certificate from the memory of the bus device; The public key is verified based on the certificate; If the public key is deemed trustworthy, a temporary public key is generated based on the public key. The shared key is generated based on the public key and the first private key.

3. The secure communication method according to claim 2, characterized in that, The generation of the first digest based on the shared key includes: A first digest is generated based on the public key, the temporary public key, and the shared key.

4. The secure communication method according to claim 1, characterized in that, The step of determining successful key negotiation with the bus device based on the encrypted string read from the memory of the bus device includes: Read the encrypted string from the memory of the bus device; The encrypted string is decrypted based on the shared key to generate a decrypted string; If the decryption string matches the preset string, the key negotiation with the bus device is considered successful.

5. A secure communication method, characterized in that, Applied to bus devices, including: A first digest and a temporary public key are read from memory; the first digest and the temporary public key are generated by the host based on the public key in memory; the host and the bus device run the same asymmetric encryption algorithm. Generate a shared key based on the temporary public key; A second digest is generated based on the public key, the temporary public key, and the shared key; If the second digest is determined to be consistent with the first digest, a key negotiation is performed with the host to generate an encrypted string; the encrypted string is used to confirm with the host that the key negotiation was successful. A secure communication channel is established with the host based on the shared key.

6. The secure communication method according to claim 5, characterized in that, The generation of a shared key based on the temporary public key includes: A shared key is generated based on the temporary public key and the second private key.

7. A secure communication module, characterized in that, Applied to the host, including: The first generation module is used to generate a shared key based on the public key read from the memory of the bus device; the host and the bus device run the same asymmetric encryption algorithm. The second generation module is used to generate a first digest based on the shared key and write the first digest into the memory of the bus device; A key negotiation module is used to determine that key negotiation with the bus device is successful based on an encrypted string read from the memory of the bus device; the encrypted string is generated by the bus device after determining key negotiation with the host based on the first digest; The channel establishment module is used to establish a secure communication channel with the bus device based on the shared key.

8. A secure communication module, characterized in that, Applied to bus devices, including: The digest reading module is used to read a first digest and a temporary public key from memory; the first digest and the temporary public key are generated by the host based on the public key in memory; the host and the bus device run the same asymmetric encryption algorithm; The third generation module is used to generate a shared key based on the temporary public key; The fourth generation module is used to generate a second digest based on the public key, the temporary public key, and the shared key; The fifth generation module is used to determine, when it is determined that the second digest is consistent with the first digest, to perform key negotiation with the host and generate an encrypted string; the encrypted string is used to confirm with the host that the key negotiation was successful. A secure communication module is used to establish a secure communication channel with the host based on the shared key.

9. The secure communication module according to claim 8, characterized in that, The memory of the bus device includes a read-only area and a writable area; The read-only area is used to store the public key; The writable area is used to store the first digest, the temporary public key, and the encrypted string.

10. A secure communication system, characterized in that, Includes host and bus devices; The host is used to execute the secure communication method according to any one of claims 1 to 4; The bus device is used to perform the secure communication method as described in claim 5 or 6.

11. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the secure communication method according to any one of claims 1 to 6.

12. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the secure communication method according to any one of claims 1 to 6.

Images