Data encryption method, and method and device for executing encryption program

Abstract

The invention provides a data encryption method and a method and device for executing an encryption program, and the method comprises the steps: running a safety starting program in an ROM (Read Only Memory) of an embedded system, and reading a to-be-used trimming value produced by a chip in an OTP (One Time Programmable) region of the embedded system; writing the to-be-used trimming value into a register corresponding to the chip to enable the chip to work normally; generating a key according to the to-be-used trimming value; reading the encrypted Flash data in a Flash memory of the embedded system; decrypting the encrypted Flash data by using a key generated by the trimming value to be used; and writing the Flash data obtained by decryption into an RAM (Random Access Memory) of the embedded system so as to run a complete application program in a Flash memory. According to the scheme, the Flash data is encrypted and decrypted by using the unmodifiable security characteristics of the ROM and OTP regions and combining the trimming value produced by the chip, so that the problem that a Flash program is easy to crack is avoided, and the program security is improved.

Description

Technical Field

[0001] The present invention relates to the technical field of embedded systems, and in particular to a data encryption method, a method and a device for executing an encryption program. Background Art

[0002] In embedded systems with limited on-chip resources, programs are usually executed directly from the Flash memory. To improve the security of programs in the Flash memory, the programs are currently usually encrypted by relying on the data of the Flash memory itself and the chip's Universally Unique Identifier (UUID). However, the data of the Flash memory itself is readable, and the chip's UUID is also readable, which makes it easy for the program to be reverse-engineered and copied and tampered on other chips to run normally, resulting in poor program security. Summary of the invention

[0003] In view of this, an embodiment of the present invention provides a data encryption method, a method and an apparatus for executing an encryption program to solve the problem of poor program security in a method of encrypting a program by relying on the data of the Flash memory itself and the UUID of the chip itself.

[0004] To achieve the above objectives, the embodiments of the present invention provide the following technical solutions:

[0005] A first aspect of an embodiment of the present invention discloses a data encryption method, the method comprising:

[0006] Get the chip production trim value of the one-time programmable (OTP) area of ​​the embedded system;

[0007] generating a key according to the adjustment value;

[0008] Encrypting the Flash data using a key generated by the adjustment value;

[0009] The encrypted Flash data is stored in the Flash memory of the embedded system.

[0010] A second aspect of an embodiment of the present invention discloses a method for executing an encryption program, the method comprising:

[0011] Running a secure boot program in a read-only memory ROM of the embedded system, and reading a chip-produced trim value to be used in a one-time programmable (OTP) area of ​​the embedded system;

[0012] Writing the adjustment value to be used into a register corresponding to the chip to enable the chip to work normally;

[0013] generating a key according to the adjustment value to be used;

[0014] Reading the encrypted Flash data in the Flash memory of the embedded system, wherein the encrypted Flash data is encrypted based on the data encryption method disclosed in the first aspect of the embodiment of the present invention;

[0015] Decrypting the encrypted Flash data using a key generated by the adjustment value to be used;

[0016] The decrypted Flash data is written into the random access memory RAM of the embedded system to run the complete application program in the Flash memory.

[0017] Preferably, before decrypting the encrypted Flash data using the key generated by the to-be-used adjustment value, the method further includes:

[0018] Performing data integrity check on the encrypted Flash data;

[0019] If the encrypted Flash data passes the data integrity check, the step of decrypting the encrypted Flash data using a key generated by the to-be-used adjustment value is performed.

[0020] Preferably, performing a data integrity check on the encrypted Flash data includes:

[0021] Reading an encrypted first check value from the Flash memory, the first check value being calculated from the encrypted Flash data, the encrypted first check value being encrypted based on the trimming value produced by the chip;

[0022] Decrypting the encrypted first verification value using a key generated from the adjustment value to be used;

[0023] Calculating a second check value using the encrypted Flash data;

[0024] If the second check value is consistent with the first check value obtained by decryption, it is determined that the encrypted Flash data passes the data integrity check.

[0025] Preferably, generating a key according to the adjustment value to be used includes:

[0026] An XOR operation is performed based on part of the content of the adjustment value to be used to generate a key.

[0027] Preferably, reading the encrypted Flash data in the Flash memory of the embedded system includes:

[0028] Reading the main program in the Flash memory of the embedded system;

[0029] Dynamically adjust the step size according to the size of the main program;

[0030] The encrypted Flash data in the Flash memory is obtained by reading according to the step interval.

[0031] A third aspect of an embodiment of the present invention discloses a data encryption device, the device comprising:

[0032] An acquisition unit, used for acquiring a chip production adjustment value of a one-time programmable (OTP) area of ​​an embedded system;

[0033] A generating unit, configured to generate a key according to the adjustment value;

[0034] An encryption unit, used for encrypting the Flash data using a key generated by the adjustment value;

[0035] The storage unit is used to store the encrypted Flash data in the Flash memory of the embedded system.

[0036] A fourth aspect of an embodiment of the present invention discloses a device for executing an encryption program, the device comprising:

[0037] A processing unit, used to run a secure boot program in a read-only memory ROM of the embedded system, and read a chip-produced trim value to be used in a one-time programmable (OTP) area of ​​the embedded system;

[0038] A first writing unit, used for writing the adjustment value to be used into a register corresponding to the chip so that the chip can work normally;

[0039] A generating unit, configured to generate a key according to the adjustment value to be used;

[0040] A reading unit, used for reading the encrypted Flash data in the Flash memory of the embedded system, wherein the encrypted Flash data is encrypted based on the data encryption device disclosed in the third aspect of the embodiment of the present invention;

[0041] A decryption unit, used for decrypting the encrypted Flash data using a key generated by using the adjustment value to be used;

[0042] The second writing unit is used to write the decrypted Flash data into the random access memory RAM of the embedded system to run the complete application program in the Flash memory.

[0043] Preferably, it also includes:

[0044] The verification unit is used to perform a data integrity check on the encrypted Flash data; if the encrypted Flash data passes the data integrity check, the decryption unit is executed.

[0045] Preferably, the verification unit includes:

[0046] A reading subunit, used for reading an encrypted first check value from the Flash memory, the first check value being calculated by the encrypted Flash data, the encrypted first check value being encrypted based on the trimming value produced by the chip;

[0047] a decryption subunit, configured to decrypt the encrypted first verification value using a key generated by the adjustment value to be used;

[0048] A calculation subunit, used to calculate a second check value using the encrypted Flash data;

[0049] The determination subunit is used to determine that the encrypted Flash data passes the data integrity check if the second check value is consistent with the first check value obtained by decryption.

[0050] Based on the data encryption method, method and device for executing encryption program provided by the above-mentioned embodiment of the present invention, the secure boot program in the ROM of the embedded system is run, and the adjustment value to be used produced by the chip in the OTP area of ​​the embedded system is read; the adjustment value to be used is written into the register corresponding to the chip to make the chip work normally; a key is generated according to the adjustment value to be used; the encrypted Flash data in the Flash memory of the embedded system is read; the encrypted Flash data is decrypted using the key generated by the adjustment value to be used; the decrypted Flash data is written into the RAM of the embedded system to run the complete application program in the Flash memory. This solution utilizes the unchangeable security characteristics of the ROM and OTP areas, combined with the adjustment value produced by the chip to encrypt and decrypt the Flash data, avoids the problem that the Flash program is easily cracked, and improves the security of the program. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying creative work.

[0052] Figure 1 A flowchart of a data encryption method provided by an embodiment of the present invention;

[0053] Figure 2 A flowchart of a method for executing an encryption program provided by an embodiment of the present invention;

[0054] Figure 3 Another flow chart of a method for executing an encryption program provided by an embodiment of the present invention;

[0055] Figure 4 A structural block diagram of a data encryption device provided by an embodiment of the present invention;

[0056] Figure 5 A structural block diagram of a device for executing an encryption program provided by an embodiment of the present invention;

[0057] Figure 6 Another structural block diagram of a device for executing an encryption program provided by an embodiment of the present invention;

[0058] Figure 7 Another structural block diagram of a device for executing an encryption program provided by an embodiment of the present invention;

[0059] Figure 8 Another structural block diagram of a device for executing an encryption program provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0060] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0061] In this application, the terms "comprises", "comprising" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the sentence "comprising a ..." does not exclude the presence of other identical elements in the process, method, article or device comprising the element.

[0062] In embedded systems with limited on-chip resources, programs are usually executed directly from Flash memory. This method is called XIP (Execute InPlace). However, programs in unencrypted Flash memory are easy to be copied, tampered with, or reverse engineered, which poses certain security risks. Especially when the Flash memory itself does not have hardware encryption function, how to achieve secure encryption of programs without affecting the performance of the embedded system is a problem that needs to be solved urgently.

[0063] The inventor has discovered through research that the existing Flash program encryption method, when there is no hardware encryption module, generally reads the chip's own universally unique identifier (UUID) when burning the program, and writes the UUID into a specific location of the Flash program. Then, when the program starts, the chip's own UUID is directly read and compared with the value stored in the Flash for consistency, thereby determining whether the program is started normally.

[0064] In order to improve the security of the program in the Flash memory, the program is currently usually encrypted by relying on the data of the Flash memory itself and the UUID of the chip itself. However, the data of the Flash memory itself is readable, and the UUID of the chip is also readable, which makes the program easy to be reverse-engineered. The encryption can be cracked by simply modifying the UUID storage data of the Flash, and then it can be copied and tampered on other chips and run normally, resulting in poor program security.

[0065] To solve the above problems, this solution proposes a data encryption method, a method and a device for executing an encryption program, which utilizes the unchangeable security characteristics of the ROM and OTP areas and combines the adjustment values ​​produced by the chip to encrypt and decrypt the Flash data, thereby avoiding the problem that the Flash program is easily cracked and improving the security and non-replicability of the program.

[0066] See also Figure 1 , shows a flow chart of a data encryption method provided by an embodiment of the present invention, the data encryption method comprising:

[0067] Step S101: obtaining a chip production trim value in an OTP area of ​​an embedded system.

[0068] It should be noted that OTP stands for One Time Programmable, and the trim value is the trim value.

[0069] In the specific implementation of step S101, the trimming value produced by the chip in the OTP area of ​​the embedded system is obtained.

[0070] Specifically, the N-word trimming values ​​produced by the chip in the OTP area are read, and the trimming values ​​are unique and random.

[0071] Step S102: Generate a key according to the adjustment value.

[0072] In the specific implementation of step S102 , an XOR operation is performed based on part of the content of the adjustment value to generate a key, which can be used to encrypt and decrypt the Flash data.

[0073] Step S103: Encrypt the Flash data using a key generated by the adjustment value.

[0074] In the specific process of implementing step S103, the Flash data is encrypted using a key generated by the trim value (trim value) to obtain the encrypted Flash data.

[0075] Step S104: storing the encrypted Flash data in the Flash memory of the embedded system.

[0076] In the specific implementation of step S104, the Flash data encrypted by the key generated by the adjustment value is stored in the Flash memory of the embedded system.

[0077] In some specific embodiments, after obtaining the encrypted Flash data, a first check value is calculated based on the encrypted Flash data, and then the first check value is encrypted using a key generated by the adjustment value to obtain an encrypted first check value, and the encrypted first check value is stored in the Flash memory.

[0078] It should be noted that the first check value may be a cyclic redundancy check (CRC) value, for example, the first check value is a CRC32 value.

[0079] In the embodiment of the present invention, the non-modifiable security feature of the ROM and OTP areas is utilized, combined with the trimming value produced by the chip, to encrypt the Flash data, thereby avoiding the problem that the Flash program is easily cracked, and improving the security and non-replicability of the program.

[0080] In the above-mentioned embodiments of the present invention Figure 1 Based on the proposed data encryption method, see Figure 2 , shows a flow chart of a method for executing an encryption program provided by an embodiment of the present invention, the method for executing an encryption program comprising:

[0081] Step S201: Run the secure boot program in the ROM of the embedded system, and read the chip-produced trimming value to be used in the OTP area of ​​the embedded system.

[0082] It should be noted that ROM is a read-only memory.

[0083] In the specific implementation of step S201, a secure boot program (such as a Secure Boot program) in the ROM of the embedded system is run to read the trim value to be used (also referred to as the trim value to be used) produced by the chip in the OTP area.

[0084] Specifically, the N words of trimming values ​​to be used produced by the chip in the OTP area are read, and the trimming values ​​to be used are unique and random.

[0085] It should be noted that the secure boot program is responsible for starting the software program part of the entire embedded system. The secure boot program includes initializing hardware, reading trim values, and writing trim values. It determines whether to start the complete application by judging the validity of the trim value. The trim value produced by each chip is different, that is, the trim value of each chip is unique and cannot be tampered with.

[0086] Step S202: writing the adjustment value to be used into the register corresponding to the chip to enable the chip to work normally.

[0087] In the specific implementation of step S202, the adjustment value to be used read from the OTP area is written into the register corresponding to the chip to ensure the normal operation of the chip.

[0088] It should be noted that the hardware circuit of the chip itself requires appropriate trim values ​​(trim values) to work normally. Illegal trim values ​​will cause the chip hardware itself to not work; therefore, the process of "writing the trim value to be used into the corresponding register of the chip to ensure the normal operation of the chip" is equivalent to judging whether the trim value to be used is valid. If the trim value to be used is valid, the chip works normally; if the trim value to be used is invalid, the chip operates abnormally.

[0089] Step S203: Generate a key according to the adjustment value to be used.

[0090] In the specific implementation of step S203, an XOR operation is performed based on part of the content of the adjustment value to be used to generate a key, which can be used to encrypt and decrypt the Flash data.

[0091] Specifically, according to the N words of the to-be-used adjustment values ​​read from the OTP area, a part of the contents of the N words of the to-be-used adjustment values ​​is taken to perform an XOR operation, thereby obtaining a corresponding key.

[0092] Step S204: reading the encrypted Flash data in the Flash memory of the embedded system.

[0093] It should be noted that the encrypted Flash data is based on the above embodiment of the present invention. Figure 1 The data encryption method shown is encrypted, that is, firstly using the trim value (trim value) produced by the chip to generate a corresponding key, then using the key to encrypt the Flash data, and storing the encrypted Flash data in the Flash memory.

[0094] In the process of implementing step S204, the main program in the Flash memory of the embedded system is read; the step size is dynamically adjusted according to the size of the main program, wherein the step size is equal to the value after the main program size is divided by N and word-aligned (i.e., word aligned); and the encrypted Flash data in the Flash memory is read according to the step size interval.

[0095] Specifically, the main program in the Flash memory is read, and the step size is dynamically adjusted according to the size of the main program to read a fixed number of N words of encrypted Flash data, where "N words" refers to the number of encrypted Flash data read at the step size interval.

[0096] Step S205: decrypting the encrypted Flash data using a key generated by the adjustment value to be used.

[0097] In the specific implementation of step S205 , the encrypted Flash data is decrypted using the key generated by the adjustment value to be used in step S203 to obtain the decrypted Flash data.

[0098] It should be noted that, in order to ensure data integrity, before executing step S205, it is necessary to perform a data integrity check on the encrypted Flash data. Only when the encrypted Flash data passes the data integrity check, step S205 is executed for decryption.

[0099] In some embodiments, before executing step S205, the encrypted Flash data is checked for data integrity; if the encrypted Flash data passes the data integrity check, step S205 is executed; if the encrypted Flash data does not pass the data integrity check, the process ends and the embedded system is stopped to prevent illegal programs from running.

[0100] In a specific embodiment, the data integrity check of the encrypted Flash data is implemented as follows: reading an encrypted first check value from the Flash memory, the first check value being calculated from the encrypted Flash data, the encrypted first check value being encrypted based on the trimming value produced by the chip; decrypting the encrypted first check value using a key generated from the trimming value to be used; and calculating a second check value using the encrypted Flash data;

[0101] If the second check value is consistent with the first check value obtained by decryption, it is determined that the encrypted Flash data passes the data integrity check; if the second check value is inconsistent with the first check value obtained by decryption, it is determined that the encrypted Flash data fails the data integrity check.

[0102] It should be noted that the first check value and the second check value may be CRC values, for example, the first check value and the second check value may be CRC32 values.

[0103] Specifically, as described in the above embodiment of the present invention Figure 1 As can be seen from the content below step S104, the first check value is calculated in advance using the "N words of encrypted Flash data", and then the first check value is encrypted using a key generated by a trim value (trim value) produced by the chip, and the encrypted first check value is stored in a fixed position of the Flash memory;

[0104] When performing data integrity check on the encrypted Flash data, first read the encrypted first check value from the Flash memory, and then use the key generated by the "to-be-used adjustment value read from the OTP area" to decrypt the encrypted first check value to obtain the plaintext first check value;

[0105] Then, the second check value is calculated using the "N words of encrypted Flash data"; the second check value is compared with the first check value of the plain text obtained by the decryption; if the second check value is consistent with the first check value of the plain text obtained by the decryption, it is determined that the encrypted Flash data passes the data integrity check (the encrypted Flash data is complete);

[0106] If the second check value is inconsistent with the first check value of the plain text obtained by the decryption, it is determined that the encrypted Flash data fails the data integrity check.

[0107] Step S206: writing the decrypted Flash data into the RAM of the embedded system to run the complete application in the Flash memory.

[0108] It should be noted that RAM stands for Random Access Memory.

[0109] In the specific implementation of step S206, the Flash data decrypted in step S205 is written into the RAM of the embedded system to run the complete application in the Flash memory.

[0110] If the Flash data decrypted in the above step S205 is correct (i.e. the decryption is legal), then the complete application in the Flash memory can be run correctly;

[0111] If the Flash data obtained by decryption in the above step S205 is wrong (ie, the decryption is illegal), then the complete application program in the Flash memory is executed incorrectly.

[0112] It should be noted that the Flash data decrypted in the above step S205 includes Data and Code; the complete application in the Flash memory depends on the partial code and data transferred to the RAM to work properly;

[0113] Therefore, the Flash data (including Data and Code) decrypted in the above step S205 is written into the corresponding position in the RAM of the embedded system. If the decrypted Flash data is correct, the complete application in the Flash memory can run normally, and the "switch from the secure boot program (such as the Secure Boot program) to the complete application in the Flash memory" is completed.

[0114] In the embodiment of the present invention, the non-modifiable security feature of the ROM and OTP areas is utilized in combination with the trimming value produced by the chip to decrypt the Flash data, thereby avoiding the problem that the Flash program is easily cracked and improving the security and non-replicability of the program.

[0115] To better understand the above embodiments of the present invention Figure 2 The following is from the perspective of practical application, combined with Figure 3 A flowchart of a method for executing an encryption program is shown as an example. Figure 3 The steps include:

[0116] Step S301: Read the chip production trim value to be used in the OTP area.

[0117] Step S302: writing the adjustment value to be used into the register corresponding to the chip.

[0118] Step S303: determine whether the adjustment value to be used is valid; if the adjustment value to be used is invalid, the chip operates abnormally; if the adjustment value to be used is valid, execute step S304.

[0119] Step S304: Generate a key according to the adjustment value to be used.

[0120] Step S305: decrypt the encrypted CRC32_1 stored in the Flash memory according to the key.

[0121] It should be noted that CRC32_1 is the first check value.

[0122] Step S306: Read the encrypted Flash data in the Flash memory and calculate CRC32_2 based on the encrypted Flash data.

[0123] It should be noted that CRC32_2 is the second check value.

[0124] Step S307: Determine whether CRC32_1 is equal to CRC32_2; if not, the chip operates abnormally; if equal, execute step S308.

[0125] Step S308: decrypt the encrypted Flash data in the Flash memory according to the key, and transfer the decrypted Flash data to the RAM.

[0126] Step S309: Jump from the Secure Boot program to the complete application program in the Flash memory.

[0127] Step S310: Check whether the decrypted Flash data is legal; if the decryption is legal, the chip operates normally; if the decryption is illegal, the chip operates abnormally.

[0128] It should be noted that the execution principle of step S301 to step S310 can be found in the above embodiment of the present invention. Figure 2 The content will not be repeated here.

[0129] From the contents of the above embodiments, it can be seen that this solution, without adding a hardware encryption module, combines ROM and Flash, utilizes the Secure Boot program in the solidified ROM and the OTP data (trim value) tightly coupled with the chip, and avoids the unsafe characteristics of the existing Flash that is readable and modifiable, thereby realizing secure encryption of the program of the embedded system, improving the security of the embedded system, and preventing the program from being copied, tampered with and reverse engineered.

[0130] Corresponding to a data encryption method provided by the above embodiment of the present invention, see Figure 4, the embodiment of the present invention also provides a structural block diagram of a data encryption device, the data encryption device includes: an acquisition unit 401, a generation unit 402, an encryption unit 403 and a storage unit 404;

[0131] An acquisition unit 401 is used to acquire a chip production adjustment value of an OTP area of ​​an embedded system;

[0132] The generating unit 402 is used to generate a key according to the adjustment value.

[0133] The encryption unit 403 is used to encrypt the Flash data using a key generated by the adjustment value.

[0134] The storage unit 404 is used to store the encrypted Flash data into the Flash memory of the embedded system.

[0135] In the embodiment of the present invention, the non-modifiable security feature of the ROM and OTP areas is utilized, combined with the trimming value produced by the chip, to encrypt the Flash data, thereby avoiding the problem that the Flash program is easily cracked, and improving the security and non-replicability of the program.

[0136] Corresponding to the method for executing an encryption program provided by the above embodiment of the present invention, see Figure 5 , the embodiment of the present invention also provides a structural block diagram of a device for executing an encryption program, the device comprising: a processing unit 501, a first writing unit 502, a generating unit 503, a reading unit 504, a decryption unit 505 and a second writing unit 506;

[0137] The processing unit 501 is used to run the secure boot program in the ROM of the embedded system and read the chip-produced trimming value to be used in the OTP area of ​​the embedded system.

[0138] The first writing unit 502 is used to write the adjustment value to be used into the register corresponding to the chip so that the chip can work normally.

[0139] The generating unit 503 is used to generate a key according to the adjustment value to be used.

[0140] In a specific implementation, the generating unit 300 is specifically used to perform an XOR operation according to a part of the content of the adjustment value to be used to generate a key.

[0141] The reading unit 504 is used to read the encrypted Flash data in the Flash memory of the embedded system. The encrypted Flash data is based on the above-mentioned embodiment of the present invention. Figure 4 The data is encrypted by the provided data encryption device.

[0142] The decryption unit 505 is used to decrypt the encrypted Flash data using a key generated by the adjustment value to be used.

[0143] The second writing unit 506 is used to write the decrypted Flash data into the RAM of the embedded system to run the complete application program in the Flash memory.

[0144] In the embodiment of the present invention, the non-modifiable security feature of the ROM and OTP areas is utilized in combination with the trimming value produced by the chip to decrypt the Flash data, thereby avoiding the problem that the Flash program is easily cracked and improving the security and non-replicability of the program.

[0145] Preferably, combined Figure 5 , see Figure 6 , shows another structural block diagram of a device for executing an encryption program provided by an embodiment of the present invention, the device also includes:

[0146] The verification unit 507 is used to perform a data integrity check on the encrypted Flash data; if the encrypted Flash data passes the data integrity check, the decryption unit 505 is executed.

[0147] Preferably, combined Figure 6 , see Figure 7 , shows another structural block diagram of a device for executing an encryption program provided by an embodiment of the present invention, wherein the verification unit 507 includes:

[0148] The reading subunit 5071 is used to read the encrypted first verification value from the Flash memory, the first verification value is calculated by the encrypted Flash data, and the encrypted first verification value is encrypted based on the trimming value produced by the chip.

[0149] The decryption subunit 5072 is used to decrypt the encrypted first verification value using a key generated by the adjustment value to be used.

[0150] The calculation subunit 5073 is used to calculate the second check value using the encrypted Flash data.

[0151] The determination subunit 5074 is configured to determine that the encrypted Flash data passes the data integrity check if the second check value is consistent with the first check value obtained by decryption.

[0152] Preferably, combined Figure 7 , see Figure 8 , shows another structural block diagram of a device for executing an encryption program provided by an embodiment of the present invention, wherein the reading unit 504 includes:

[0153] The first reading subunit 5041 is used to read the main program in the Flash memory of the embedded system.

[0154] The adjustment subunit 5042 is used to dynamically adjust the step size according to the size of the main program.

[0155] The second reading subunit 5043 is used to read the encrypted Flash data in the Flash memory according to the step interval.

[0156] In summary, the embodiments of the present invention provide a data encryption method, a method and a device for executing an encryption program, which utilize the unchangeable security characteristics of the ROM and OTP areas and combine the adjustment values ​​produced by the chip to encrypt and decrypt the Flash data, thereby avoiding the problem that the Flash program is easily cracked and improving the security of the program.

[0157] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can refer to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system or system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can refer to the partial description of the method embodiment. The system and system embodiments described above are merely schematic, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.

[0158] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

[0159] The above description of the disclosed embodiments enables those skilled in the art to implement or use the present invention. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the scope of the present invention. Therefore, the present invention will not be limited to the embodiments shown herein, but rather to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A data encryption method, characterized in that: The method comprises: Get the chip production trim value of the one-time programmable (OTP) area of ​​the embedded system; generating a key according to the adjustment value; Encrypting the Flash data using a key generated by the adjustment value; The encrypted Flash data is stored in the Flash memory of the embedded system.

2. A method for executing an encryption program, characterized in that: The method comprises: Running a secure boot program in a read-only memory ROM of the embedded system, and reading a chip-produced trim value to be used in a one-time programmable (OTP) area of ​​the embedded system; Writing the adjustment value to be used into a register corresponding to the chip to enable the chip to work normally; generating a key according to the adjustment value to be used; Reading the encrypted Flash data in the Flash memory of the embedded system, wherein the encrypted Flash data is encrypted based on the data encryption method according to claim 1; Decrypting the encrypted Flash data using a key generated by the adjustment value to be used; The decrypted Flash data is written into the random access memory RAM of the embedded system to run the complete application program in the Flash memory.

3. The method according to claim 2, characterized in that Before decrypting the encrypted Flash data using the key generated by the to-be-used adjustment value, the method further includes: Performing data integrity check on the encrypted Flash data; If the encrypted Flash data passes the data integrity check, the step of decrypting the encrypted Flash data using a key generated by the to-be-used adjustment value is performed.

4. The method according to claim 3, characterized in that Performing a data integrity check on the encrypted Flash data includes: Reading an encrypted first check value from the Flash memory, the first check value being calculated from the encrypted Flash data, the encrypted first check value being encrypted based on the trimming value produced by the chip; Decrypting the encrypted first verification value using a key generated from the adjustment value to be used; Calculating a second check value using the encrypted Flash data; If the second check value is consistent with the first check value obtained by decryption, it is determined that the encrypted Flash data passes the data integrity check.

5. The method according to any one of claims 2 to 4, characterized in that: Generating a key according to the adjustment value to be used includes: An XOR operation is performed based on part of the content of the adjustment value to be used to generate a key.

6. The method according to any one of claims 2 to 4, characterized in that: Reading the encrypted Flash data in the Flash memory of the embedded system includes: Reading the main program in the Flash memory of the embedded system; Dynamically adjust the step size according to the size of the main program; The encrypted Flash data in the Flash memory is obtained by reading according to the step interval.

7. A data encryption device, characterized in that: The device comprises: An acquisition unit, used for acquiring a chip production adjustment value of a one-time programmable (OTP) area of ​​an embedded system; A generating unit, configured to generate a key according to the adjustment value; An encryption unit, used for encrypting the Flash data using a key generated by the adjustment value; The storage unit is used to store the encrypted Flash data in the Flash memory of the embedded system.

8. A device for executing an encryption program, characterized in that: The device comprises: A processing unit, used to run a secure boot program in a read-only memory ROM of the embedded system, and read a chip-produced trim value to be used in a one-time programmable (OTP) area of ​​the embedded system; A first writing unit, used for writing the adjustment value to be used into a register corresponding to the chip so that the chip can work normally; A generating unit, configured to generate a key according to the adjustment value to be used; A reading unit, used for reading the encrypted Flash data in the Flash memory of the embedded system, wherein the encrypted Flash data is encrypted based on the data encryption device according to claim 7; A decryption unit, used for decrypting the encrypted Flash data using a key generated by using the adjustment value to be used; The second writing unit is used to write the decrypted Flash data into the random access memory RAM of the embedded system to run the complete application program in the Flash memory.

9. The device according to claim 8, characterized in that Also includes: A verification unit, used for performing data integrity verification on the encrypted Flash data; If the encrypted Flash data passes the data integrity check, the decryption unit is executed.

10. The device according to claim 9, characterized in that The verification unit comprises: A reading subunit, used for reading an encrypted first check value from the Flash memory, the first check value being calculated by the encrypted Flash data, the encrypted first check value being encrypted based on the trimming value produced by the chip; a decryption subunit, configured to decrypt the encrypted first verification value using a key generated by the adjustment value to be used; A calculation subunit, used to calculate a second check value using the encrypted Flash data; The determination subunit is used to determine that the encrypted Flash data passes the data integrity check if the second check value is consistent with the first check value obtained by decryption.

Images