Online data encryption and decryption method and device based on eFlash-XIP mode, equipment and storage medium

Abstract

The invention discloses an online data encryption and decryption method and device based on an eFlash-XIP mode, equipment and a storage medium, and relates to the technical field of data processing, and the method comprises the steps: obtaining a target key, encryption and decryption enabling information and the memory size of to-be-encrypted data from a first data storage region in a memory; encrypting the to-be-encrypted data based on the target key and the encryption and decryption enabling information by using a target encryption algorithm obtained by improving an SM4 algorithm to obtain encrypted data; creating a second data storage area based on the memory size of the to-be-encrypted data, and storing the encrypted data to the second data storage area through a preset controller; and obtaining the to-be-decrypted data from the second data storage area through the preset controller, and decrypting the to-be-decrypted data based on the target key and the encryption and decryption enabling information by using a target decryption algorithm obtained by improving the SM4 algorithm to obtain decrypted data. Therefore, online data encryption and decryption can be realized.

Description

Technical Field

[0001] The present invention relates to the field of data processing technology, and in particular to an online data encryption and decryption method, device, equipment and storage medium based on an eFlash-XIP mode. Background Art

[0002] With the rapid development of the Internet of Things (IoT), edge computing, and artificial intelligence (AI) technologies, the design of smart device hardware systems has become increasingly complex, and the amount of code that the device master needs to run and the data capacity that it processes have shown explosive growth. This trend has put forward more stringent requirements on the performance of large-capacity memory in the system-on-chip (SOC). As a non-volatile storage medium, embedded Flash Memory (EFlash memory) can keep data from being lost after power failure, so it has been widely used in embedded systems. EFlash memory is not only used to store program code and data, but also has become an indispensable and important part of modern embedded systems due to its large capacity, high performance, and strong reliability. In the application of EFlash memory, FLASH-XIP (eXecute In Place, i.e., execution in chip) mode is favored for its unique advantages. This mode allows the CPU (Central Processing Unit) to fetch instructions and execute them directly from non-volatile memory (such as Flash memory) without copying the program code to the memory. This not only saves valuable memory resources, but also significantly increases program startup speed, thereby improving overall system performance.

[0003] However, as embedded systems become increasingly intelligent, security issues are becoming increasingly prominent. Program code and data stored in EFlash memory face the risk of illegal access and tampering. Although traditional encryption and decryption methods can ensure data security to a certain extent, they usually require decryption operations before program execution, which will undoubtedly increase program startup time and occupy additional memory resources.

[0004] As can be seen from the above, how to realize online data encryption and decryption in the process of data encryption and decryption based on EFlash memory-XIP mode is a problem that needs to be solved urgently. Summary of the invention

[0005] In view of this, the purpose of the present invention is to provide an online data encryption and decryption method, device, equipment and medium based on the eFlash-XIP mode, which can realize online encryption and decryption of data while maintaining the functions of the eFlash-XIP mode. The specific scheme is as follows:

[0006] In a first aspect, the present application provides an online data encryption and decryption method based on the eFlash-XIP mode, comprising:

[0007] Obtaining a target key, encryption and decryption enabling information, and a memory size of the data to be encrypted from a first data storage area in the eFlash memory; the encryption and decryption enabling information is used to indicate whether the encryption and decryption function is enabled;

[0008] Using the first preset algorithm adjustment rule to improve the SM4 algorithm to obtain a target encryption algorithm, and using the target encryption algorithm and based on the target key and the encryption and decryption enabling information to encrypt the data to be encrypted, so as to obtain encrypted data;

[0009] Creating a second data storage area based on the memory size corresponding to the data to be encrypted, and storing the encrypted data in the second data storage area in the eFlash memory through a preset controller in the eFlash memory;

[0010] The data to be decrypted is obtained from the second data storage area through a preset controller in the eFlash memory, and the SM4 algorithm is improved by using a second preset algorithm adjustment rule to obtain a target decryption algorithm, so as to decrypt the data to be decrypted using the target decryption algorithm and based on the target key and the encryption and decryption enable information to obtain decrypted data.

[0011] Optionally, after acquiring the target key, the encryption / decryption enabling information, and the memory size of the data to be encrypted from the first data storage area in the eFlash memory, the method further includes:

[0012] Control the central processor to obtain the non-protected code, the first data write address corresponding to the non-protected code, and the memory size corresponding to the non-protected code from the third data storage area in the eFlash memory through the central processor bus;

[0013] The encryption / decryption enabling information is set to an on state based on the first data write address corresponding to the non-protected code and the memory size corresponding to the non-protected code, and the non-protected code is encrypted so that the encrypted code is stored in the eFlash memory.

[0014] Optionally, the step of improving the SM4 algorithm by using the first preset algorithm adjustment rule to obtain a target encryption algorithm includes:

[0015] Setting a first round function and a second round function in the SM4 algorithm, and setting a first S-box and a second S-box for the first round function and the second round function respectively, so as to perform a preset data replacement operation on the data to be encrypted in the first S-box and the second S-box;

[0016] Accordingly, the use of the second preset algorithm adjustment rule to improve the SM4 algorithm to obtain a target decryption algorithm includes:

[0017] A third round function and a fourth round function are set in the SM4 algorithm, and a third S box and a fourth S box are set for the third round function and the fourth round function respectively, so as to perform a preset data replacement operation on the data to be decrypted in the third S box and the fourth S box.

[0018] Optionally, the using the target encryption algorithm and encrypting the data to be encrypted based on the target key and the encryption / decryption enabling information to obtain encrypted data includes:

[0019] If the encryption / decryption enabling information indicates that the encryption / decryption function is enabled, the target key is split according to a preset equal division rule, and a bitwise XOR is performed on the obtained high-bit portion after the first split and the low-bit portion after the first split to obtain a corresponding first XOR result;

[0020] Splitting the first XOR result according to a preset bisection rule to obtain a second split high-bit portion and a second split low-bit portion;

[0021] Splitting the data to be encrypted according to the preset bisection rule to obtain a third split high-bit portion and a third split low-bit portion, and performing an XOR process on the third split high-bit portion and the second split high-bit portion to obtain a second XOR result;

[0022] In the first S-box, replace the data corresponding to the preset number of high bits of the data to be encrypted with the data corresponding to the preset number of high bits in the second XOR result to obtain a first replacement result;

[0023] Performing a preset shift operation on the first replacement result, performing bitwise XOR processing on the obtained first operation result and the first replacement result, and performing XOR processing on the obtained third XOR result and the high-bit part after the third split, so as to obtain a fourth XOR result;

[0024] XOR processing is performed on the fourth XOR result and the second split low-bit part to obtain a fifth XOR result, and the data corresponding to the preset number of high-bits of the data to be encrypted are replaced in the second S-box with the data corresponding to the preset number of high-bits in the fifth XOR result, and then a preset shift operation is performed on the obtained second replacement result to obtain a second operation result;

[0025] The second operation result and the second replacement result are subjected to bitwise XOR processing to obtain a sixth XOR result, and the sixth XOR result and the low-bit part after the third split are subjected to XOR processing to obtain a seventh XOR result, and the encrypted data is determined based on the sixth XOR result and the seventh XOR result.

[0026] Optionally, before storing the encrypted data in the second data storage area in the eFlash memory through a preset controller in the eFlash memory, the method further includes:

[0027] The encryption / decryption enabling information is set to a closed state based on the memory size of the encrypted data and a second data write address corresponding to the encrypted data to stop repeatedly encrypting the encrypted data.

[0028] Optionally, the decrypting the data to be decrypted by using the target decryption algorithm and based on the target key and the encryption / decryption enabling information to obtain decrypted data includes:

[0029] If the encryption / decryption enabling information indicates that the encryption / decryption function is turned on, the target key is split according to a preset bisection rule, and the high-bit part after the fourth split is obtained and the low-bit part after the fourth split is bitwise XORed, so as to split the eighth XOR result obtained according to the preset bisection rule to obtain the high-bit part after the fifth split and the low-bit part after the fifth split;

[0030] Splitting the to-be-decrypted data according to the preset bisection rule to obtain a sixth split high-bit portion and a sixth split low-bit portion, and performing an XOR process on the sixth split high-bit portion and the fifth split low-bit portion to obtain a ninth XOR result;

[0031] In the third S-box, replace the data corresponding to the preset number of high bits of the data to be decrypted with the data corresponding to the preset number of high bits in the ninth XOR result to obtain a third replacement result;

[0032] Performing a preset shift operation on the third replacement result, performing bitwise XOR processing on the obtained third operation result and the third replacement result, and performing XOR processing on the obtained tenth XOR result and the high-bit part after the fifth split, so as to obtain an eleventh XOR result;

[0033] XOR processing is performed on the eleventh XOR result and the high-bit part after the fifth split, and the data corresponding to the preset number of high-bits of the data to be decrypted are replaced in the fourth S-box with the data corresponding to the preset number of high-bits in the obtained twelfth XOR result to obtain a fourth replacement result;

[0034] Performing a preset shift operation on the fourth replacement result, and performing a bitwise XOR process on the obtained fourth operation result and the fourth replacement result to obtain a thirteenth XOR result;

[0035] The thirteenth XOR result is XOR-ed with the low-bit portion after the sixth split to obtain a fourteenth XOR result, and decrypted data is determined based on the fourteenth XOR result and the eleventh XOR result.

[0036] Optionally, the eFlash IP in the eFlash memory includes the first data storage area, the second data storage area and the third data storage area; wherein the first data storage area is the eFlash NVR storage area, which only supports information reading through hardware logic; the second data storage area is a protected encrypted SDK area; and the third data storage area is a non-protected code storage area.

[0037] In a second aspect, the present application provides an online data encryption and decryption device based on the eFlash-XIP mode, comprising:

[0038] A configuration information reading module is used to obtain a target key, encryption and decryption enabling information, and a memory size of the data to be encrypted from a first data storage area in the eFlash memory; the encryption and decryption enabling information is used to indicate whether the encryption and decryption function is enabled;

[0039] A data encryption module, used to improve the SM4 algorithm by using a first preset algorithm adjustment rule to obtain a target encryption algorithm, and to encrypt the data to be encrypted by using the target encryption algorithm and based on the target key and the encryption and decryption enabling information to obtain encrypted data;

[0040] A data storage module, configured to create a second data storage area based on a memory size corresponding to the data to be encrypted, and store the encrypted data in the second data storage area in the eFlash memory through a preset controller in the eFlash memory;

[0041] A data decryption module is used to obtain the data to be decrypted from the second data storage area through a preset controller in the eFlash memory, and to improve the SM4 algorithm using a second preset algorithm adjustment rule to obtain a target decryption algorithm, so as to decrypt the data to be decrypted using the target decryption algorithm and based on the target key and the encryption and decryption enable information to obtain decrypted data.

[0042] In a third aspect, the present application provides an electronic device, including:

[0043] Memory, used to store computer programs;

[0044] The processor is used to execute the computer program to implement the aforementioned online data encryption and decryption method based on the eFlash-XIP mode.

[0045] In a fourth aspect, the present application provides a computer-readable storage medium for storing a computer program, wherein the computer program, when executed by a processor, implements the aforementioned online data encryption and decryption method based on the eFlash-XIP mode.

[0046] As can be seen from the above, before performing online data encryption and decryption based on the eFlash-XIP mode, the present application needs to obtain the target key, encryption and decryption enable information and the memory size of the data to be encrypted from the first data storage area in the eFlash memory; the target key is the key for encrypting the data to be encrypted; the encryption and decryption enable information is used to encrypt the data to be encrypted; the SM4 algorithm is improved by using the first preset algorithm adjustment rule to obtain the target encryption algorithm, and the target encryption algorithm is used to encrypt the data to be encrypted based on the target key and the encryption and decryption enable information to obtain the encrypted data; a second data storage area is created based on the memory size corresponding to the data to be encrypted, and the encrypted data is stored in the second data storage area in the eFlash memory through the preset controller in the eFlash memory; the data to be decrypted is obtained from the second data storage area through the preset controller in the eFlash memory, and the SM4 algorithm is improved by using the second preset algorithm adjustment rule to obtain the target decryption algorithm, so as to decrypt the data to be decrypted based on the target key and the encryption and decryption enable information to obtain the decrypted data.

[0047] It can be seen that the present application obtains the target key, encryption and decryption enabling information and the memory size of the data to be encrypted from the first data storage area in the eFlash memory, and then improves the SM4 algorithm using the first preset algorithm adjustment rule to obtain the target encryption algorithm, and uses the target encryption algorithm and based on the target key and encryption and decryption enabling information to encrypt the data to be encrypted to obtain the encrypted data; then, creates a second data storage area based on the memory size corresponding to the data to be encrypted, and stores the encrypted data to the second data storage area in the eFlash memory through the preset controller in the eFlash memory; finally, obtains the data to be decrypted from the second data storage area through the preset controller in the eFlash memory, and uses the second preset algorithm adjustment rule to improve the SM4 algorithm to obtain the target decryption algorithm, and uses the target decryption algorithm and based on the target key and encryption and decryption enabling information to decrypt the data to be decrypted to obtain the decrypted data. In this way, while maintaining the function of the eFlash-XIP mode, the online encryption and decryption of data is realized, and the efficiency and security of encryption and decryption of data are improved, which improves the user experience. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying creative work.

[0049] Figure 1 This is a flow chart of an online data encryption and decryption method based on the eFlash-XIP mode disclosed in this application;

[0050] Figure 2 A schematic diagram of the hardware circuit architecture of a controller for online data encryption and decryption based on the eFlash-XIP mode disclosed in this application;

[0051] Figure 3 A schematic diagram of a specific encryption and decryption circuit architecture disclosed in this application;

[0052] Figure 4 A specific encryption algorithm flow chart disclosed in this application;

[0053] Figure 5 A specific decryption algorithm flow chart disclosed in this application;

[0054] Figure 6 A flowchart of a specific EFLASH controller disclosed in this application to implement online code encryption and decryption;

[0055] Figure 7 This is a schematic diagram of the structure of an online data encryption and decryption device based on the eFlash-XIP mode disclosed in this application;

[0056] Figure 8 This is a structural diagram of an electronic device disclosed in this application. DETAILED DESCRIPTION

[0057] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0058] As embedded systems become increasingly intelligent, security issues are becoming increasingly prominent. Program code and data stored in EFlash memory face the risk of illegal access and tampering. Although traditional encryption and decryption methods can ensure data security to a certain extent, they usually require decryption operations before program execution, which will undoubtedly increase the startup time of the program and occupy additional memory resources. To this end, the present application provides an online data encryption and decryption method based on the eFlash-XIP mode, which can achieve online encryption and decryption of data while maintaining the functions of the eFlash-XIP mode.

[0059] See also Figure 1 As shown, the embodiment of the present invention discloses an online data encryption and decryption method based on the eFlash-XIP mode, including:

[0060] Step S11, obtaining a target key, encryption / decryption enabling information, and a memory size of the data to be encrypted from a first data storage area in the eFlash memory; the encryption / decryption enabling information is used to indicate whether the encryption / decryption function is enabled.

[0061] In this embodiment, after obtaining the target key, encryption and decryption enabling information, and the memory size of the data to be encrypted from the first data storage area in the eFlash memory, the embodiment of the present application needs to obtain the non-protected code from the third data storage area in the eFlash memory, and encrypt the non-protected code based on the target key and the encryption and decryption enabling information. Specifically, after obtaining the target key, encryption and decryption enabling information, and the memory size of the data to be encrypted from the first data storage area in the eFlash memory, it can also include: controlling the central processor to obtain the non-protected code and the first data write address corresponding to the non-protected code and the memory size corresponding to the non-protected code from the third data storage area in the eFlash memory through the central processor bus; based on the first data write address corresponding to the non-protected code and the memory size corresponding to the non-protected code, the encryption and decryption enabling information is set to the on state, and the non-protected code is encrypted so that the encrypted code is stored in the eFlash memory.

[0062] In this embodiment, Figure 2 As shown, Figure 2 It is an online encryption and decryption controller hardware circuit suitable for eFlash-XIP mode. The functional modules in the online encryption and decryption controller hardware circuit include: Encrypt_engine module (i.e. encryption engine module), Decrypt_engine module (i.e. decryption engine module), Wr_intf module (write interface module), Wr_buff module (write buffer module), Ecc_encode module (ECC encoding module), Rd_intf module (read interface module), Rd_buff module (read buffer module), Ecc_decode module (ECC decoding module), Flash_intf module (Flash interface module), Fmc_init module (FMC initialization module) and Hsm_cfg module (HSM configuration module).

[0063] The Encrypt_engine module is used to encrypt data written by the CPU (Central Processing Unit) using the rootkey and encryption enable configuration read from the FLASH.

[0064] The Decrypt_engine module is used to decrypt the data read from the CPU using the rootkey read from the FLASH and the decryption enable configured on the bus.

[0065] The Wr_intf module is used to adapt the CPU write interface request, the Wr_buff module is used to cache the CPU write interface request sent by the Wr_intf module, and the Ecc_encode module is used to perform ECC calculation on the write data.

[0066] The Rd_intf module is used to adapt the CPU read interface request, the Rd_buff module is used to cache the CPU read interface request sent by the Rd_intf module, and the Ecc_decode module is used to perform ECC decoding and verification on the read data.

[0067] The Flash_intf module is used to convert read and write requests into the FLASH interface protocol.

[0068] The Fmc_init module is used to read the cached key, encryption and decryption enable configuration information, and SDK (Software Development Kit) code size in the EFLASH after power-on. The Hsm_cfg module is used to configure the programming key, encryption and decryption enable, and SDK code size information for the EFLASH.

[0069] It is worth mentioning that the controller hardware circuit working mode mentioned in this embodiment supports encryption mode and non-encryption mode, and reads the encryption and decryption enable configuration information in the EFLASH NVR storage area after power-on, and decides whether to encrypt and decrypt the data based on the encryption and decryption enable configuration information. Among them, the steps performed in the encryption mode are the following three steps: configuring the encryption and decryption keys and key registers in the EFLASH NVR area, encrypting and programming the user source code, and writing the encrypted and programmed source code into the EFLASH MAIN memory, and running the encryption code in the EFLASH-XIP working mode.

[0070] Among them, in the first specific implementation, the process of configuring encryption and decryption keys and key registers in the EFLASH NVR area is as follows: During the FT / CP test phase of the chip, developers can program key configuration values ​​such as encryption and decryption keys, encryption and decryption enable configuration information, user protection segment code space size, product chip ID, and IP calibration data into the EFLASH NVR area through the CPU and HSM_CFG module according to requirements, and set the fixed lock bit. In a specific implementation, if the fixed value configured by the fixed lock bit is 0x0, the configuration value corresponding to the fixed lock bit is locked, and the area attribute is changed to a read-only attribute, which plays a role similar to a one-time programming circuit. It is worth mentioning that in normal working scenarios, each time the SOC (System on Chip) is powered on and started, the FMC_INIT module in the controller will read the keys and related configurations in the NVR area and transmit them to the corresponding logic circuit for data encryption and decryption operations. In normal working mode, the NVR area only supports hardware logic reading and does not support the CPU or JTAG debug interface to directly read the information in the NVR area, thereby ensuring the security of key configuration information such as keys.

[0071] In the second specific implementation, the process of writing the encrypted and programmed source code into the EFLASH MAIN memory is as follows: the user needs to use the key to encrypt the source SDK code into ciphertext, and program the ciphertext into EFLASH through the JTAG debugging interface. That is, the bus encryption and decryption module will decide whether to encrypt the written data based on the configuration and operation address read at power-on to ensure that all data stored in EFLASH are ciphertext. In this way, even if a third party maliciously intrudes and copies the data in FLASH, it will not affect the security of the user program.

[0072] In the third specific implementation, the process of running the encryption code in the EFLASH-XIP working mode is as follows: after power-on, the user can directly read the ciphertext program from the FLASH, and then, in the Decrypt_engine module at the read interface of the bus, the read ciphertext program is restored to the source SDK code in real time and executed. There is no need to decrypt and store it in SRAM (Static Random-Access Memory) first, and then execute it in SRAM. This not only speeds up the program execution rate, but also reduces the consumption of SRAM resources, thereby ensuring the security of the user's SDK program.

[0073] Step S12: using the first preset algorithm adjustment rule to improve the SM4 algorithm to obtain a target encryption algorithm, and using the target encryption algorithm and based on the target key and the encryption and decryption enabling information to encrypt the data to obtain encrypted data.

[0074] It is worth mentioning that the hardware circuits for encrypting data in the Encrypt_engine module and decrypting data in the Decrypt_engine module are as follows Figure 3 As shown; Figure 3 The upper part is the hardware circuit diagram of the Encrypt_engine module, and the input data is the key and the data to be encrypted; Figure 3 The lower part of the figure is the hardware circuit diagram of the Decrypt_engine module. The input data is the key and the data to be decrypted, and the encryption and decryption algorithm used is the improved SM4 algorithm. The improved SM4 algorithm supports 128-bit keys and 64-bit data inputs. The encryption and decryption process uses two round functions, each of which corresponds to an SBOX. Specifically, the SM4 algorithm is improved by adjusting the first preset algorithm rule to obtain a target encryption algorithm, which may include: setting a first round function and a second round function in the SM4 algorithm, and setting a first S box and a second S box for the first round function and the second round function, respectively, so as to perform a preset data replacement operation on the encrypted data in the first S box and the second S box.

[0075] In this embodiment, if the encryption and decryption enabling information indicates that the encryption and decryption function is turned on, the data to be encrypted is encrypted using the improved SM4 algorithm. Specifically, the target encryption algorithm is used to encrypt the data to be encrypted based on the target key and the encryption and decryption enabling information to obtain the encrypted data, which may include: if the encryption and decryption enabling information indicates that the encryption and decryption function is turned on, the target key is split according to the preset bisection rule, and the high-bit part after the first split is bitwise XORed with the low-bit part after the first split to obtain the corresponding first XOR result; the first XOR result is split according to the preset bisection rule to obtain the high-bit part after the second split and the low-bit part after the second split; the encrypted data is split according to the preset bisection rule to obtain the high-bit part after the third split and the low-bit part after the third split, and the high-bit part after the third split is XORed with the high-bit part after the second split to obtain the second XOR result; in the first S box, the data corresponding to the preset number of high bits of the data to be encrypted is replaced with the data corresponding to the preset number of high bits in the second XOR result. bit to obtain a first replacement result; perform a preset shift operation on the first replacement result, and perform bitwise XOR processing on the first operation result and the first replacement result, and perform XOR processing on the third XOR result and the high-bit part after the third split to obtain a fourth XOR result; perform XOR processing on the fourth XOR result and the low-bit part after the second split to obtain a fifth XOR result, and replace the data corresponding to a preset number of high bits of the data to be encrypted with the data corresponding to a preset number of high bits in the fifth XOR result in the second S box, and then perform a preset shift operation on the second replacement result to obtain a second operation result; perform bitwise XOR processing on the second operation result and the second replacement result to obtain a sixth XOR result, and perform XOR processing on the sixth XOR result and the low-bit part after the third split to obtain a seventh XOR result, and determine the encrypted data based on the sixth XOR result and the seventh XOR result.

[0076] In a specific implementation, the encryption process of the improved SM4 algorithm is as follows: Figure 4 As shown:

[0077] First, the input 128-bit key is split into the upper 64-bit k0 and the lower 64-bit k1, and k0 and k1 are XORed to obtain the corresponding XOR result, and then the XOR result is split into the upper 32-bit rk0 and the lower 32-bit rk1.

[0078] Secondly, the input 64-bit data is split into the high 32-bit X0 and the low 32-bit X1, and X0 is XORed with rk0 to obtain the corresponding XOR result, and the high 8-bit data of the above XOR result is input into SBOX, and the high 8-bit data input into SBOX is used in SBOX to replace the high 8-bit data of the input 64-bit data to obtain the corresponding replacement data.

[0079] Then, a preset left shift operation is performed on the replacement data respectively, and the obtained left shift result is subjected to a bitwise XOR operation with the replacement data to obtain a corresponding XOR result, and the above XOR result is subjected to an XOR operation with X0 to obtain X2, and X2 is subjected to an XOR operation with rk1 to obtain an XOR result.

[0080] Subsequently, the high 8-bit data of the XOR result obtained in the above steps is input into the SBOX, and the high 8-bit data input into the SBOX is used again in the SBOX to replace the high 8-bit data of the input 64-bit data to obtain the corresponding replacement data, and the replacement data is subjected to a preset left shift operation, and the obtained left shift result is subjected to a bitwise XOR operation with the replacement data to obtain the corresponding XOR result.

[0081] Finally, the XOR result obtained in the above steps is XORed with X1 to obtain X3, and X3 and X2 are combined into a 64-bit encrypted ciphertext of size t for output.

[0082] Step S13: create a second data storage area based on the memory size corresponding to the data to be encrypted, and store the encrypted data in the second data storage area in the eFlash memory through a preset controller in the eFlash memory.

[0083] In this embodiment, after obtaining the encrypted data, the embodiment of the present application needs to store the encrypted data in the second data storage area in the eFlash memory, and during the storage process, the encryption and decryption enable information is set to a closed state based on the memory size of the encrypted data and the second data write address corresponding to the encrypted data. Specifically, before the encrypted data is stored in the second data storage area in the eFlash memory through the preset controller in the eFlash memory, it may also include: setting the encryption and decryption enable information to a closed state based on the memory size of the encrypted data and the second data write address corresponding to the encrypted data to stop repeated encryption of the encrypted data.

[0084] Step S14: obtain the data to be decrypted from the second data storage area through the preset controller in the eFlash memory, and use the second preset algorithm adjustment rule to improve the SM4 algorithm to obtain the target decryption algorithm, so as to use the target decryption algorithm and decrypt the data to be decrypted based on the target key and the encryption and decryption enable information to obtain the decrypted data.

[0085] In this embodiment, before decrypting the data to be decrypted, the embodiment of the present application needs to improve the SM4 algorithm so as to use the improved SM4 algorithm to decrypt the data to be decrypted. Specifically, the SM4 algorithm is improved by using the second preset algorithm adjustment rule to obtain a target decryption algorithm, including: setting a third round function and a fourth round function in the SM4 algorithm, and setting a third S box and a fourth S box for the third round function and the fourth round function respectively, so as to perform a preset data replacement operation on the data to be decrypted in the third S box and the fourth S box.

[0086] Among them, after obtaining the target decryption algorithm, the embodiment of the present application can use the target decryption algorithm to decrypt the data to be decrypted. Specifically, the target decryption algorithm decrypts the data to be decrypted based on the target key and the encryption and decryption enabling information to obtain the decrypted data, which may include: if the encryption and decryption enabling information indicates that the encryption and decryption function is turned on, the target key is split according to the preset bisection rule, and the high-bit part after the fourth split is bitwise XORed with the low-bit part after the fourth split, so as to split the eighth XOR result obtained according to the preset bisection rule to obtain the high-bit part after the fifth split and the low-bit part after the fifth split; split the data to be decrypted according to the preset bisection rule to obtain the high-bit part after the sixth split and the low-bit part after the sixth split, and XOR the high-bit part after the sixth split with the low-bit part after the fifth split to obtain the ninth XOR result; in the third S box, the data corresponding to the preset number of high bits of the data to be decrypted are replaced with the data corresponding to the preset number of high bits in the ninth XOR result. to obtain a third replacement result; perform a preset shift operation on the third replacement result, and perform bitwise XOR processing on the obtained third operation result and the third replacement result, and perform XOR processing on the obtained tenth XOR result and the high-bit part after the fifth split to obtain an eleventh XOR result; perform XOR processing on the eleventh XOR result and the high-bit part after the fifth split, and replace the data corresponding to a preset number of high bits of the data to be decrypted with the data corresponding to a preset number of high bits in the obtained twelfth XOR result in the fourth S-box to obtain a fourth replacement result; perform a preset shift operation on the fourth replacement result, and perform bitwise XOR processing on the obtained fourth operation result and the fourth replacement result to obtain a thirteenth XOR result; perform XOR processing on the thirteenth XOR result and the low-bit part after the sixth split to obtain a fourteenth XOR result, and determine the decrypted data based on the fourteenth XOR result and the eleventh XOR result.

[0087] In another specific implementation, the decryption process of the improved SM4 algorithm is as follows: Figure 5 As shown:

[0088] First, the input 128-bit key is split into the upper 64-bit k0 and the lower 64-bit k1, and k0 and k1 are XORed to obtain the corresponding XOR result, and then the XOR result is split into the upper 32-bit rk0 and the lower 32-bit rk1.

[0089] Secondly, the input 64-bit data is split into the high 32-bit X0 and the low 32-bit X1, and X0 is XORed with rk1 to obtain the corresponding XOR result, and the high 8-bit data of the above XOR result is input into the SBOX, and the high 8-bit data input into the SBOX is used in the SBOX to replace the high 8-bit data of the input 64-bit data to obtain the corresponding replacement data.

[0090] Then, a preset left shift operation is performed on the replacement data respectively, and the obtained left shift result is subjected to a bitwise XOR operation with the replacement data to obtain a corresponding XOR result, and the above XOR result is subjected to an XOR operation with X0 to obtain X2, and X2 is subjected to an XOR operation with rk0 to obtain an XOR result.

[0091] Subsequently, the high 8-bit data of the XOR result obtained in the above steps is input into the SBOX, and the high 8-bit data input into the SBOX is used again in the SBOX to replace the high 8-bit data of the input 64-bit data to obtain the corresponding replacement data, and the replacement data is subjected to a preset left shift operation, and the obtained left shift result is subjected to a bitwise XOR operation with the replacement data to obtain the corresponding XOR result.

[0092] Finally, the XOR result obtained in the above steps is XORed with X1 to obtain X3, and X3 and X2 are combined into a 64-bit encrypted ciphertext for output.

[0093] It is worth mentioning that the eFlash IP in the eFlash memory includes a first data storage area, a second data storage area and a third data storage area; among them, the first data storage area is the eFlash NVR storage area, which only supports information reading through hardware logic; the second data storage area is a protected encrypted SDK area; the third data storage area is a non-protected code storage area.

[0094] As can be seen from the above, before performing online data encryption and decryption based on the eFlash-XIP mode, the embodiment of the present application needs to obtain the target key, encryption and decryption enabling information, and the memory size of the data to be encrypted from the first data storage area in the eFlash memory; the target key is the key for encrypting the data to be encrypted; the encryption and decryption enabling information is used to encrypt the data to be encrypted; the SM4 algorithm is improved by using the first preset algorithm adjustment rule to obtain the target encryption algorithm, and the target encryption algorithm is used to encrypt the data to be encrypted based on the target key and the encryption and decryption enabling information to obtain the encrypted data; a second data storage area is created based on the memory size corresponding to the data to be encrypted, and the encrypted data is stored in the second data storage area in the eFlash memory through the preset controller in the eFlash memory; the data to be decrypted is obtained from the second data storage area through the preset controller in the eFlash memory, and the SM4 algorithm is improved by using the second preset algorithm adjustment rule to obtain the target decryption algorithm, and the target decryption algorithm is used to decrypt the data to be decrypted based on the target key and the encryption and decryption enabling information to obtain the decrypted data. In this way, while maintaining the function of the eFlash-XIP mode, online encryption and decryption of data is achieved.

[0095] To further describe the hardware circuit corresponding to the controller for online encryption and decryption, see Figure 6 As shown, Figure 6 The figure is a schematic diagram of the hardware circuit of the online encryption and decryption controller suitable for eFlash-XIP mode.

[0096] First, the user can write the key, encryption and decryption enable configuration information, and SDK SIZE (that is, the memory size of the SDK code) into the EFLASH NVR area for storage through the CPU configuration interface.

[0097] Secondly, the user can transfer the SDK code to be protected to the Encrypt_engine module, so that the Encrypt_engine module encrypts the SDK code to be protected based on the key, encryption and decryption enable configuration information, and SDK SIZE to obtain the ciphertext.

[0098] Subsequently, the user can use the CPU to write the above ciphertext into the user protected encrypted SDK area inside EFLASH through the EFLASH controller, where the size of the user protected encrypted SDK area is consistent with the SDK SIZE. It is worth mentioning that in the process of writing the above ciphertext into the user protected encrypted SDK area, the encryption module of the bus will automatically configure the encryption enable to be turned off according to the data write address to stop re-encrypting the data. For unprotected code, the user can directly write the original code into the EFLASH unprotected code storage area through the CPU, where in the process of writing the code into the EFLASH unprotected code storage area, the encryption module of the bus automatically sets the encryption enable configuration information to the open state according to the data write address to encrypt the unprotected code, further ensuring that all data stored in EFLASH are ciphertext.

[0099] In this embodiment, after the system is powered on, the FMC_INIT module uses the EFLASH controller to read the key, encryption and decryption enable configuration information, and the size of the SDK code space in the protected segment of the EFLASH (i.e., SDK_SIZE) in the EFLASH NVRINFO area. Subsequently, the EFLASH is in the EFLASH XIP mode, so that the CPU can directly read and execute the decryption instructions in the EFLASH through the XIP interface, and obtain the encrypted data from the user protected encrypted SDK area or the EFLASH unprotected code storage area, so that the bus decryption module can decrypt the encrypted data based on the key, encryption and decryption enable configuration information, and SDK SIZE to obtain the original SDK code, and transmit the original SDK code to the CPU for execution.

[0100] It is worth mentioning that in order to ensure the security of program data, only the CPU XIP interface is allowed to use the EFLASH controller to read data, and other debugging interfaces are not allowed to read the data in the EFLASH through the EFLASH controller. In this way, when the EFLASH storage area is invaded by the outside and maliciously copied by a third party such as X-ray irradiation, the illegally obtained data is encrypted data, so that the data cannot be illegally read, thereby protecting the security of the user program.

[0101] As can be seen from the above, before performing online data encryption and decryption based on the eFlash-XIP mode, the embodiment of the present application needs to obtain the target key, encryption and decryption enabling information, and the memory size of the data to be encrypted from the first data storage area in the eFlash memory, and then use the first preset algorithm adjustment rule to improve the SM4 algorithm to obtain the target encryption algorithm, and use the target encryption algorithm and encrypt the data to be encrypted based on the target key and the encryption and decryption enabling information to obtain the encrypted data; then create a second data storage area based on the memory size corresponding to the data to be encrypted, and store the encrypted data to the second data storage area in the eFlash memory through the preset controller in the eFlash memory; finally, obtain the data to be decrypted from the second data storage area through the preset controller in the eFlash memory, and use the second preset algorithm adjustment rule to improve the SM4 algorithm to obtain the target decryption algorithm, and use the target decryption algorithm and decrypt the data to be decrypted based on the target key and the encryption and decryption enabling information to obtain the decrypted data. In this way, while maintaining the function of the eFlash-XIP mode, online encryption and decryption of data is achieved.

[0102] Accordingly, see Figure 7 As shown, the present application also provides an online data encryption and decryption device based on the eFlash-XIP mode, including:

[0103] A configuration information reading module 11 is used to obtain a target key, encryption and decryption enabling information, and a memory size of the data to be encrypted from a first data storage area in the eFlash memory; the encryption and decryption enabling information is used to indicate whether the encryption and decryption function is enabled;

[0104] The data encryption module 12 is used to improve the SM4 algorithm by using the first preset algorithm adjustment rule to obtain a target encryption algorithm, and to encrypt the data to be encrypted by using the target encryption algorithm and based on the target key and the encryption and decryption enabling information to obtain encrypted data;

[0105] A data storage module 13, configured to create a second data storage area based on the memory size corresponding to the data to be encrypted, and store the encrypted data in the second data storage area in the eFlash memory through a preset controller in the eFlash memory;

[0106] The data decryption module 14 is used to obtain the data to be decrypted from the second data storage area through the preset controller in the eFlash memory, and use the second preset algorithm adjustment rule to improve the SM4 algorithm to obtain a target decryption algorithm, so as to use the target decryption algorithm and decrypt the data to be decrypted based on the target key and the encryption and decryption enable information to obtain decrypted data.

[0107] As can be seen from the above, before performing online data encryption and decryption based on the eFlash-XIP mode, the embodiment of the present application needs to obtain the target key, encryption and decryption enabling information, and the memory size of the data to be encrypted from the first data storage area in the eFlash memory, and then use the first preset algorithm adjustment rule to improve the SM4 algorithm to obtain the target encryption algorithm, and use the target encryption algorithm and encrypt the data to be encrypted based on the target key and the encryption and decryption enabling information to obtain the encrypted data; the broken bone creates a second data storage area based on the memory size corresponding to the data to be encrypted, and stores the encrypted data to the second data storage area in the eFlash memory through the preset controller in the eFlash memory; finally, the data to be decrypted is obtained from the second data storage area through the preset controller in the eFlash memory, and the SM4 algorithm is improved using the second preset algorithm adjustment rule to obtain the target decryption algorithm, so as to use the target decryption algorithm and decrypt the data to be decrypted based on the target key and the encryption and decryption enabling information to obtain the decrypted data. In this way, while maintaining the function of the eFlash-XIP mode, online encryption and decryption of data is realized, which improves the user experience.

[0108] In some specific implementations, the online data encryption and decryption device based on the eFlash-XIP mode may further include:

[0109] A central processing unit control unit, used to control the central processing unit to obtain a non-protected code and a first data write address corresponding to the non-protected code and a memory size corresponding to the non-protected code from a third data storage area in the eFlash memory through a central processing unit bus;

[0110] A code storage unit is used to set the encryption and decryption enable information to an on state based on a first data write address corresponding to the non-protected code and a memory size corresponding to the non-protected code, and to encrypt the non-protected code so as to store the encrypted code in the eFlash memory.

[0111] In some specific implementations, the data encryption module 12 may specifically include:

[0112] a first data replacement unit, configured to set a first round function and a second round function in the SM4 algorithm, and respectively set a first S-box and a second S-box for the first round function and the second round function, so as to perform a preset data replacement operation on the data to be encrypted in the first S-box and the second S-box;

[0113] Accordingly, the data decryption module 14 may specifically include:

[0114] The second data replacement unit is used to set a third round function and a fourth round function in the SM4 algorithm, and respectively set a third S box and a fourth S box for the third round function and the fourth round function, so as to perform a preset data replacement operation on the data to be decrypted in the third S box and the fourth S box.

[0115] In some specific implementations, the data encryption module 12 may specifically include:

[0116] A first key splitting unit is used to split the target key according to a preset bisection rule if the encryption / decryption enabling information indicates that the encryption / decryption function is enabled, and perform bitwise XOR on the obtained high-bit part after the first split and the low-bit part after the first split to obtain a corresponding first XOR result;

[0117] A result splitting unit, used for splitting the first XOR result according to a preset bisection rule to obtain a second split high bit part and a second split low bit part;

[0118] A first data splitting unit is used to split the to-be-encrypted data according to the preset bisection rule to obtain a third split high-bit portion and a third split low-bit portion, and perform an XOR process on the third split high-bit portion and the second split high-bit portion to obtain a second XOR result;

[0119] a third data replacement unit, configured to replace data corresponding to a preset number of high bits of the data to be encrypted with data corresponding to a preset number of high bits of the second XOR result in the first S-box, so as to obtain a first replacement result;

[0120] a first result shift unit, configured to perform a preset shift operation on the first replacement result, perform a bitwise XOR operation on the obtained first operation result and the first replacement result, and perform a bitwise XOR operation on the obtained third XOR result and the third split high-bit part, so as to obtain a fourth XOR result;

[0121] a first XOR processing unit, configured to perform XOR processing on the fourth XOR result and the second split low-bit portion to obtain a fifth XOR result, and replace the data corresponding to the preset number of high-bits of the data to be encrypted with the data corresponding to the preset number of high-bits in the fifth XOR result in the second S-box, and then perform a preset shift operation on the obtained second replacement result to obtain a second operation result;

[0122] The second XOR processing unit is used to perform bitwise XOR processing on the second operation result and the second replacement result to obtain a sixth XOR result, and to perform XOR processing on the sixth XOR result and the low-bit part after the third split to obtain a seventh XOR result, and to determine the encrypted data based on the sixth XOR result and the seventh XOR result.

[0123] In some specific implementations, the online data encryption and decryption device based on the eFlash-XIP mode may further include:

[0124] The enabling information setting unit is used to set the encryption and decryption enabling information to a closed state based on the memory size of the encrypted data and the second data writing address corresponding to the encrypted data, so as to stop repeatedly encrypting the encrypted data.

[0125] In some specific implementations, the data decryption module 14 may specifically include:

[0126] A second key splitting unit is used for splitting the target key according to a preset bisection rule if the encryption / decryption enabling information indicates that the encryption / decryption function is turned on, and performing bitwise XOR on the fourth split high-bit part and the fourth split low-bit part, so as to split the eighth XOR result according to the preset bisection rule to obtain a fifth split high-bit part and a fifth split low-bit part;

[0127] a second data splitting unit, configured to split the to-be-decrypted data according to the preset bisection rule to obtain a sixth split high-bit portion and a sixth split low-bit portion, and perform an XOR process on the sixth split high-bit portion and the fifth split low-bit portion to obtain a ninth XOR result;

[0128] a fourth data replacement unit, configured to replace data corresponding to a preset number of high bits of the data to be decrypted with data corresponding to a preset number of high bits of the ninth XOR result in the third S-box, so as to obtain a third replacement result;

[0129] a second result shifting unit, configured to perform a preset shift operation on the third replacement result, perform a bitwise XOR operation on the obtained third operation result and the third replacement result, and perform an XOR operation on the obtained tenth XOR result and the high-bit part after the fifth split, so as to obtain an eleventh XOR result;

[0130] a third XOR processing unit, configured to perform XOR processing on the eleventh XOR result and the high-bit portion after the fifth split, and replace the data corresponding to the preset number of high-bits of the data to be decrypted with the data corresponding to the preset number of high-bits of the obtained twelfth XOR result in the fourth S-box, so as to obtain a fourth replacement result;

[0131] A third result shifting unit is used to perform a preset shift operation on the fourth replacement result, and perform a bitwise XOR process on the obtained fourth operation result and the fourth replacement result to obtain a thirteenth XOR result;

[0132] The fourth XOR processing unit is used to perform XOR processing on the thirteenth XOR result and the low-bit part after the sixth split to obtain a fourteenth XOR result, and determine the decrypted data based on the fourteenth XOR result and the eleventh XOR result.

[0133] Furthermore, the present application also discloses an electronic device. Figure 8 It is a structural diagram of an electronic device 20 shown according to an exemplary embodiment, and the content in the figure cannot be regarded as any limitation on the scope of use of this application. The electronic device 20 may specifically include: at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input / output interface 25, and a communication bus 26. Among them, the memory 22 is used to store a computer program, and the computer program is loaded and executed by the processor 21 to implement the relevant steps in the online data encryption and decryption method based on the eFlash-XIP mode disclosed in any of the aforementioned embodiments. In addition, the electronic device 20 in this embodiment may specifically be an electronic computer.

[0134] In this embodiment, the power supply 23 is used to provide working voltage for each hardware device on the electronic device 20; the communication interface 24 can create a data transmission channel between the electronic device 20 and the external device, and the communication protocol it follows is any communication protocol that can be applied to the technical solution of the present application, and is not specifically limited here; the input and output interface 25 is used to obtain external input data or output data to the outside world, and its specific interface type can be selected according to specific application needs and is not specifically limited here.

[0135] In addition, the memory 22, as a carrier for storing resources, can be a read-only memory, a random access memory, a disk or an optical disk, etc. The resources stored thereon can include an operating system 221, a computer program 222, etc., and the storage method can be temporary storage or permanent storage.

[0136] The operating system 221 is used to manage and control the hardware devices and computer program 222 on the electronic device 20, which can be Windows Server, Netware, Unix, Linux, etc. In addition to including a computer program that can be used to complete the online data encryption and decryption method based on the eFlash-XIP mode executed by the electronic device 20 disclosed in any of the aforementioned embodiments, the computer program 222 can further include a computer program that can be used to complete other specific tasks.

[0137] Furthermore, the present application also discloses a computer-readable storage medium for storing a computer program; wherein, when the computer program is executed by a processor, the online data encryption and decryption method based on the eFlash-XIP mode disclosed above is implemented. The specific steps of the method can refer to the corresponding contents disclosed in the above embodiments, and will not be repeated here.

[0138] In this specification, each embodiment is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can be referred to each other. For the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part.

[0139] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0140] The steps of the method or algorithm described in conjunction with the embodiments disclosed herein may be implemented directly using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0141] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0142] The technical solution provided by the present application is introduced in detail above. Specific examples are used in this article to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method of the present application and its core idea. At the same time, for general technicians in this field, according to the idea of ​​the present application, there will be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as a limitation on the present application.

Claims

1. An online data encryption and decryption method based on eFlash-XIP mode, characterized in that: include: Acquire the target key, encryption / decryption enabling information, and the memory size of the data to be encrypted from the first data storage area in the eFlash memory; The encryption and decryption enabling information is used to indicate whether the encryption and decryption function is enabled; Using the first preset algorithm adjustment rule to improve the SM4 algorithm to obtain a target encryption algorithm, and using the target encryption algorithm and based on the target key and the encryption and decryption enabling information to encrypt the data to be encrypted, so as to obtain encrypted data; Creating a second data storage area based on the memory size corresponding to the data to be encrypted, and storing the encrypted data in the second data storage area in the eFlash memory through a preset controller in the eFlash memory; The data to be decrypted is obtained from the second data storage area through a preset controller in the eFlash memory, and the SM4 algorithm is improved by using a second preset algorithm adjustment rule to obtain a target decryption algorithm, so as to decrypt the data to be decrypted using the target decryption algorithm and based on the target key and the encryption and decryption enable information to obtain decrypted data.

2. The online data encryption and decryption method based on the eFlash-XIP mode according to claim 1 is characterized in that: After obtaining the target key, encryption / decryption enabling information, and the memory size of the data to be encrypted from the first data storage area in the eFlash memory, the method further includes: Control the central processor to obtain the non-protected code, the first data write address corresponding to the non-protected code, and the memory size corresponding to the non-protected code from the third data storage area in the eFlash memory through the central processor bus; The encryption / decryption enabling information is set to an on state based on the first data write address corresponding to the non-protected code and the memory size corresponding to the non-protected code, and the non-protected code is encrypted so that the encrypted code is stored in the eFlash memory.

3. The online data encryption and decryption method based on the eFlash-XIP mode according to claim 1 is characterized in that: The method of improving the SM4 algorithm by using the first preset algorithm adjustment rule to obtain a target encryption algorithm includes: Setting a first round function and a second round function in the SM4 algorithm, and setting a first S-box and a second S-box for the first round function and the second round function respectively, so as to perform a preset data replacement operation on the data to be encrypted in the first S-box and the second S-box; Accordingly, the use of the second preset algorithm adjustment rule to improve the SM4 algorithm to obtain a target decryption algorithm includes: A third round function and a fourth round function are set in the SM4 algorithm, and a third S box and a fourth S box are set for the third round function and the fourth round function respectively, so as to perform a preset data replacement operation on the data to be decrypted in the third S box and the fourth S box.

4. The online data encryption and decryption method based on the eFlash-XIP mode according to claim 2 is characterized in that: The step of encrypting the data to be encrypted by using the target encryption algorithm and based on the target key and the encryption / decryption enabling information to obtain encrypted data includes: If the encryption / decryption enabling information indicates that the encryption / decryption function is enabled, the target key is split according to a preset equal division rule, and a bitwise XOR is performed on the obtained high-bit portion after the first split and the low-bit portion after the first split to obtain a corresponding first XOR result; Splitting the first XOR result according to a preset bisection rule to obtain a second split high-bit portion and a second split low-bit portion; Splitting the data to be encrypted according to the preset bisection rule to obtain a third split high-bit portion and a third split low-bit portion, and performing an XOR process on the third split high-bit portion and the second split high-bit portion to obtain a second XOR result; In the first S-box, replace the data corresponding to the preset number of high bits of the data to be encrypted with the data corresponding to the preset number of high bits in the second XOR result to obtain a first replacement result; Performing a preset shift operation on the first replacement result, performing bitwise XOR processing on the obtained first operation result and the first replacement result, and performing XOR processing on the obtained third XOR result and the high-bit part after the third split, so as to obtain a fourth XOR result; XOR processing is performed on the fourth XOR result and the second split low-bit part to obtain a fifth XOR result, and the data corresponding to the preset number of high-bits of the data to be encrypted are replaced in the second S-box with the data corresponding to the preset number of high-bits in the fifth XOR result, and then a preset shift operation is performed on the obtained second replacement result to obtain a second operation result; The second operation result and the second replacement result are subjected to bitwise XOR processing to obtain a sixth XOR result, and the sixth XOR result and the low-bit part after the third split are subjected to XOR processing to obtain a seventh XOR result, and the encrypted data is determined based on the sixth XOR result and the seventh XOR result.

5. The online data encryption and decryption method based on the eFlash-XIP mode according to any one of claims 1 to 4, characterized in that: Before storing the encrypted data in the second data storage area in the eFlash memory through the preset controller in the eFlash memory, the method further includes: The encryption / decryption enabling information is set to a closed state based on the memory size of the encrypted data and a second data write address corresponding to the encrypted data to stop repeatedly encrypting the encrypted data.

6. The online data encryption and decryption method based on eFlash-XIP mode according to claim 2 is characterized in that: The decrypting the data to be decrypted by using the target decryption algorithm and based on the target key and the encryption / decryption enabling information to obtain decrypted data includes: If the encryption / decryption enabling information indicates that the encryption / decryption function is turned on, the target key is split according to a preset bisection rule, and the high-bit part after the fourth split is obtained and the low-bit part after the fourth split is bitwise XORed, so as to split the eighth XOR result obtained according to the preset bisection rule to obtain the high-bit part after the fifth split and the low-bit part after the fifth split; Splitting the to-be-decrypted data according to the preset bisection rule to obtain a sixth split high-bit portion and a sixth split low-bit portion, and performing an XOR process on the sixth split high-bit portion and the fifth split low-bit portion to obtain a ninth XOR result; In the third S-box, replace the data corresponding to the preset number of high bits of the data to be decrypted with the data corresponding to the preset number of high bits in the ninth XOR result to obtain a third replacement result; Performing a preset shift operation on the third replacement result, performing bitwise XOR processing on the obtained third operation result and the third replacement result, and performing XOR processing on the obtained tenth XOR result and the high-bit part after the fifth split, so as to obtain an eleventh XOR result; XOR processing is performed on the eleventh XOR result and the high-bit part after the fifth split, and the data corresponding to the preset number of high-bits of the data to be decrypted are replaced in the fourth S-box with the data corresponding to the preset number of high-bits in the obtained twelfth XOR result to obtain a fourth replacement result; Performing a preset shift operation on the fourth replacement result, and performing a bitwise XOR process on the obtained fourth operation result and the fourth replacement result to obtain a thirteenth XOR result; The thirteenth XOR result is XOR-ed with the low-bit portion after the sixth split to obtain a fourteenth XOR result, and decrypted data is determined based on the fourteenth XOR result and the eleventh XOR result.

7. The online data encryption and decryption method based on eFlash-XIP mode according to claim 2 is characterized in that: The eFlash IP in the eFlash memory includes the first data storage area, the second data storage area and the third data storage area; wherein the first data storage area is the eFlash NVR storage area, which only supports information reading through hardware logic; the second data storage area is the protected encrypted SDK area; and the third data storage area is the non-protected code storage area.

8. An online data encryption and decryption device based on eFlash-XIP mode, characterized in that: include: A configuration information reading module is used to obtain a target key, encryption and decryption enabling information, and a memory size of the data to be encrypted from a first data storage area in the eFlash memory; the encryption and decryption enabling information is used to indicate whether the encryption and decryption function is enabled; A data encryption module, used to improve the SM4 algorithm by using a first preset algorithm adjustment rule to obtain a target encryption algorithm, and to encrypt the data to be encrypted by using the target encryption algorithm and based on the target key and the encryption and decryption enabling information to obtain encrypted data; A data storage module, configured to create a second data storage area based on a memory size corresponding to the data to be encrypted, and store the encrypted data in the second data storage area in the eFlash memory through a preset controller in the eFlash memory; A data decryption module is used to obtain the data to be decrypted from the second data storage area through a preset controller in the eFlash memory, and to improve the SM4 algorithm using a second preset algorithm adjustment rule to obtain a target decryption algorithm, so as to decrypt the data to be decrypted using the target decryption algorithm and based on the target key and the encryption and decryption enable information to obtain decrypted data.

9. An electronic device, characterized in that: include: Memory, used to store computer programs; A processor is used to execute the computer program to implement the steps of the online data encryption and decryption method based on the eFlash-XIP mode as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: Used to store a computer program, wherein when the computer program is executed by a processor, the steps of the online data encryption and decryption method based on the eFlash-XIP mode as described in any one of claims 1 to 7 are implemented.

Images