Online data encryption and decryption method, device, equipment and storage medium based on eFlash-XIP mode

Abstract

This application discloses an online data encryption and decryption method, apparatus, device, and storage medium based on the eFlash-XIP mode, relating to the field of data processing technology. The method comprises: obtaining a target key, encryption and decryption enabling information, and the memory size of the data to be encrypted from a first data storage area in a memory; encrypting the data to be encrypted based on the target key and the encryption and decryption enabling information using a target encryption algorithm obtained by improving the SM4 algorithm to obtain encrypted data; creating a second data storage area based on the memory size of the data to be encrypted, and storing the encrypted data in the second data storage area via a preset controller; obtaining the data to be decrypted from the second data storage area via the preset controller, and decrypting the data to be decrypted based on the target decryption algorithm obtained by improving the SM4 algorithm based on the target key and the encryption and decryption enabling information to obtain decrypted data. This enables online data encryption and decryption.

Description

Technical Field

[0001] The present invention relates to the field of data processing technology, and in particular to an online data encryption and decryption method, device, equipment and storage medium based on an eFlash-XIP mode. Background Art

[0002] With the rapid development of the Internet of Things (IoT), edge computing, and artificial intelligence (AI) technologies, the design of smart device hardware systems is becoming increasingly complex. The amount of code and data required to be processed by device controllers is exploding. This trend places increasingly stringent demands on the performance of large-capacity memories in system-on-chips (SoCs). Embedded Flash Memory (EFlash), as a non-volatile storage medium that retains data even after a power outage, has gained widespread adoption in embedded systems. EFlash memory not only stores program code and data, but also, due to its large capacity, high performance, and strong reliability, has become an indispensable component of modern embedded systems. Among EFlash memory applications, FLASH-XIP (eXecute In Place) mode is particularly popular due to its unique advantages. This mode allows the CPU (Central Processing Unit) to fetch and execute instructions directly from non-volatile memory (such as Flash memory), without having to copy the program code to memory. This not only saves valuable memory resources, but also significantly increases program startup speed, thereby improving overall system performance.

[0003] However, as embedded systems become increasingly intelligent, security issues are becoming increasingly prominent. Program code and data stored in EFlash memory are at risk of unauthorized access and tampering. While traditional encryption and decryption methods can provide a certain degree of data security, they typically require decryption before program execution, which increases program startup time and consumes additional memory resources.

[0004] As can be seen from the above, how to realize online data encryption and decryption in the process of data encryption and decryption based on EFlash memory-XIP mode is a problem that needs to be solved urgently. Summary of the Invention

[0005] In view of this, the purpose of the present invention is to provide a method, apparatus, device, and medium for online data encryption and decryption based on the eFlash-XIP mode, which can achieve online data encryption and decryption while maintaining the functions of the eFlash-XIP mode. The specific scheme is as follows:

[0006] In a first aspect, the present application provides an online data encryption and decryption method based on the eFlash-XIP mode, comprising:

[0007] Obtaining a target key, encryption / decryption enabling information, and the memory size of the data to be encrypted from the first data storage area in the eFlash memory; the encryption / decryption enabling information is used to indicate whether the encryption / decryption function is enabled;

[0008] Improve the SM4 algorithm using the first preset algorithm adjustment rule to obtain a target encryption algorithm, and encrypt the data to be encrypted using the target encryption algorithm and based on the target key and the encryption and decryption enabling information to obtain encrypted data;

[0009] Creating a second data storage area based on the memory size corresponding to the data to be encrypted, and storing the encrypted data in the second data storage area in the eFlash memory through a preset controller in the eFlash memory;

[0010] The data to be decrypted is obtained from the second data storage area through a preset controller in the eFlash memory, and the SM4 algorithm is improved using a second preset algorithm adjustment rule to obtain a target decryption algorithm, so as to decrypt the data to be decrypted using the target decryption algorithm and based on the target key and the encryption and decryption enable information to obtain decrypted data.

[0011] Optionally, after obtaining the target key, encryption / decryption enabling information, and the memory size of the data to be encrypted from the first data storage area in the eFlash memory, the method further includes:

[0012] Controlling the central processing unit to obtain the non-protected code, the first data write address corresponding to the non-protected code, and the memory size corresponding to the non-protected code from the third data storage area in the eFlash memory through the central processing unit bus;

[0013] The encryption / decryption enabling information is set to an on state based on the first data write address corresponding to the non-protected code and the memory size corresponding to the non-protected code, and the non-protected code is encrypted so that the encrypted code is stored in the eFlash memory.

[0014] Optionally, the step of improving the SM4 algorithm by using the first preset algorithm adjustment rule to obtain a target encryption algorithm includes:

[0015] Setting a first round function and a second round function in the SM4 algorithm, and setting a first S-box and a second S-box for the first round function and the second round function, respectively, so as to perform a preset data replacement operation on the data to be encrypted in the first S-box and the second S-box;

[0016] Accordingly, the target decryption algorithm is obtained by improving the SM4 algorithm using the second preset algorithm adjustment rule, including:

[0017] A third round function and a fourth round function are set in the SM4 algorithm, and a third S-box and a fourth S-box are set for the third round function and the fourth round function, respectively, so as to perform a preset data replacement operation on the data to be decrypted in the third S-box and the fourth S-box.

[0018] Optionally, encrypting the data to be encrypted using the target encryption algorithm and based on the target key and the encryption / decryption enabling information to obtain encrypted data includes:

[0019] If the encryption / decryption enabling information indicates that the encryption / decryption function is enabled, the target key is split according to a preset bisection rule, and a bitwise exclusive-OR operation is performed on the obtained high-bit portion after the first split and the low-bit portion after the first split to obtain a corresponding first exclusive-OR result;

[0020] Splitting the first XOR result according to a preset bisection rule to obtain a second split high-bit portion and a second split low-bit portion;

[0021] Splitting the data to be encrypted according to the preset bisection rule to obtain a third high-bit portion and a third low-bit portion after splitting, and performing an XOR operation on the third high-bit portion and the second high-bit portion after splitting to obtain a second XOR result;

[0022] replacing data corresponding to a preset number of high bits of the data to be encrypted with data corresponding to a preset number of high bits of the second XOR result in the first S-box to obtain a first replacement result;

[0023] Performing a preset shift operation on the first replacement result, performing a bitwise XOR operation on the obtained first operation result and the first replacement result, and performing an XOR operation on the obtained third XOR result and the high-bit portion after the third split to obtain a fourth XOR result;

[0024] Performing an XOR operation on the fourth XOR result and the second split low-bit portion to obtain a fifth XOR result, and replacing the data corresponding to the preset number of high-bits of the data to be encrypted with the data corresponding to the preset number of high-bits in the fifth XOR result in the second S-box, and then performing a preset shift operation on the obtained second replacement result to obtain a second operation result;

[0025] The second operation result and the second replacement result are subjected to bitwise XOR processing to obtain a sixth XOR result, and the sixth XOR result and the low-bit part after the third split are subjected to XOR processing to obtain a seventh XOR result, and the encrypted data is determined based on the sixth XOR result and the seventh XOR result.

[0026] Optionally, before storing the encrypted data in the second data storage area in the eFlash memory through a preset controller in the eFlash memory, the method further includes:

[0027] The encryption / decryption enabling information is set to a closed state based on the memory size of the encrypted data and a second data write address corresponding to the encrypted data, so as to stop repeatedly encrypting the encrypted data.

[0028] Optionally, decrypting the data to be decrypted using the target decryption algorithm and based on the target key and the encryption / decryption enabling information to obtain decrypted data includes:

[0029] If the encryption / decryption enabling information indicates that the encryption / decryption function is enabled, the target key is split according to a preset bisection rule, and the high-bit portion obtained after the fourth split is bitwise XORed with the low-bit portion obtained after the fourth split, so as to split the eighth XOR result obtained according to the preset bisection rule to obtain the high-bit portion after the fifth split and the low-bit portion after the fifth split;

[0030] Splitting the data to be decrypted according to the preset bisection rule to obtain a sixth split high-bit portion and a sixth split low-bit portion, and performing an XOR operation on the sixth split high-bit portion and the fifth split low-bit portion to obtain a ninth XOR result;

[0031] replacing data corresponding to a preset number of high bits of the data to be decrypted with data corresponding to a preset number of high bits in the ninth XOR result in the third S-box to obtain a third replacement result;

[0032] Performing a preset shift operation on the third replacement result, performing a bitwise XOR operation on the obtained third operation result and the third replacement result, and performing an XOR operation on the obtained tenth XOR result and the high-bit portion after the fifth split to obtain an eleventh XOR result;

[0033] XORing the eleventh XOR result with the high-bit portion after the fifth split, and replacing the data corresponding to the preset number of high-bits of the data to be decrypted with the data corresponding to the preset number of high-bits in the twelfth XOR result in the fourth S-box to obtain a fourth replacement result;

[0034] performing a preset shift operation on the fourth replacement result, and performing a bitwise XOR operation on the obtained fourth operation result and the fourth replacement result to obtain a thirteenth XOR result;

[0035] The thirteenth XOR result is XORed with the low-bit portion after the sixth split to obtain a fourteenth XOR result, and decrypted data is determined based on the fourteenth XOR result and the eleventh XOR result.

[0036] Optionally, the eFlash IP in the eFlash memory includes the first data storage area, the second data storage area and the third data storage area; wherein, the first data storage area is the eFlash NVR storage area, which only supports information reading through hardware logic; the second data storage area is a protected encrypted SDK area; and the third data storage area is a non-protected code storage area.

[0037] In a second aspect, the present application provides an online data encryption and decryption device based on the eFlash-XIP mode, comprising:

[0038] A configuration information reading module is used to obtain a target key, encryption and decryption enabling information, and a memory size of the data to be encrypted from a first data storage area in the eFlash memory; the encryption and decryption enabling information is used to indicate whether the encryption and decryption functions are enabled;

[0039] a data encryption module, configured to improve the SM4 algorithm using a first preset algorithm adjustment rule to obtain a target encryption algorithm, and encrypt the data to be encrypted using the target encryption algorithm and based on the target key and the encryption / decryption enabling information to obtain encrypted data;

[0040] A data storage module, configured to create a second data storage area based on a memory size corresponding to the data to be encrypted, and store the encrypted data in the second data storage area in the eFlash memory through a preset controller in the eFlash memory;

[0041] A data decryption module is used to obtain the data to be decrypted from the second data storage area through a preset controller in the eFlash memory, and use a second preset algorithm adjustment rule to improve the SM4 algorithm to obtain a target decryption algorithm, so as to use the target decryption algorithm and decrypt the data to be decrypted based on the target key and the encryption and decryption enable information to obtain decrypted data.

[0042] In a third aspect, the present application provides an electronic device, comprising:

[0043] Memory, used to store computer programs;

[0044] A processor is used to execute the computer program to implement the aforementioned online data encryption and decryption method based on the eFlash-XIP mode.

[0045] In a fourth aspect, the present application provides a computer-readable storage medium for storing a computer program, wherein the computer program, when executed by a processor, implements the aforementioned online data encryption and decryption method based on the eFlash-XIP mode.

[0046] As can be seen from the above, before performing online data encryption and decryption based on the eFlash-XIP mode, the present application needs to obtain the target key, encryption and decryption enable information and the memory size of the data to be encrypted from the first data storage area in the eFlash memory; the target key is the key for encrypting the data to be encrypted; the encryption and decryption enable information is used to encrypt the data to be encrypted; the SM4 algorithm is improved by using the first preset algorithm adjustment rule to obtain the target encryption algorithm, and the target encryption algorithm is used to encrypt the data to be encrypted based on the target key and the encryption and decryption enable information to obtain encrypted data; a second data storage area is created based on the memory size corresponding to the data to be encrypted, and the encrypted data is stored in the second data storage area in the eFlash memory through the preset controller in the eFlash memory; the data to be decrypted is obtained from the second data storage area through the preset controller in the eFlash memory, and the SM4 algorithm is improved by using the second preset algorithm adjustment rule to obtain the target decryption algorithm, so as to decrypt the data to be decrypted based on the target key and the encryption and decryption enable information to obtain decrypted data.

[0047] As can be seen, the present application obtains the target key, encryption and decryption enable information, and the memory size of the data to be encrypted from the first data storage area in the eFlash memory, then improves the SM4 algorithm using the first preset algorithm adjustment rule to obtain the target encryption algorithm, and uses the target encryption algorithm to encrypt the data to be encrypted based on the target key and the encryption and decryption enable information to obtain encrypted data; then, creates a second data storage area based on the memory size corresponding to the data to be encrypted, and stores the encrypted data to the second data storage area in the eFlash memory through the preset controller in the eFlash memory; finally, obtains the data to be decrypted from the second data storage area through the preset controller in the eFlash memory, and improves the SM4 algorithm using the second preset algorithm adjustment rule to obtain the target decryption algorithm, and uses the target decryption algorithm to decrypt the data to be decrypted based on the target key and the encryption and decryption enable information to obtain decrypted data. In this way, while maintaining the functionality of the eFlash-XIP mode, online encryption and decryption of data is achieved, and the efficiency and security of data encryption and decryption are improved, thereby enhancing the user experience. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are merely embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying any creative work.

[0049] Figure 1 This is a flow chart of an online data encryption and decryption method based on the eFlash-XIP mode disclosed in this application;

[0050] Figure 2 This is a schematic diagram of the controller hardware circuit architecture for online data encryption and decryption based on the eFlash-XIP mode disclosed in this application;

[0051] Figure 3 A schematic diagram of a specific encryption and decryption circuit architecture disclosed in this application;

[0052] Figure 4 A specific encryption algorithm flow chart disclosed in this application;

[0053] Figure 5 A specific decryption algorithm flow chart disclosed in this application;

[0054] Figure 6 A flowchart of the workflow for implementing online code encryption and decryption using a specific EFLASH controller disclosed in this application;

[0055] Figure 7 This is a schematic diagram of the structure of an online data encryption and decryption device based on the eFlash-XIP mode disclosed in this application;

[0056] Figure 8 This is a structural diagram of an electronic device disclosed in this application. DETAILED DESCRIPTION

[0057] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0058] As embedded systems become increasingly intelligent, security issues are becoming increasingly prominent. Program code and data stored in EFlash memory are at risk of illegal access and tampering. Although traditional encryption and decryption methods can ensure data security to a certain extent, they usually require decryption operations before program execution, which will undoubtedly increase the startup time of the program and occupy additional memory resources. To this end, the present application provides an online data encryption and decryption method based on the eFlash-XIP mode, which can achieve online encryption and decryption of data while maintaining the functions of the eFlash-XIP mode.

[0059] See also Figure 1 As shown, the embodiment of the present invention discloses an online data encryption and decryption method based on the eFlash-XIP mode, including:

[0060] Step S11: Obtain a target key, encryption / decryption enabling information, and the memory size of the data to be encrypted from the first data storage area in the eFlash memory; the encryption / decryption enabling information is used to indicate whether the encryption / decryption function is enabled.

[0061] In this embodiment, after obtaining the target key, encryption and decryption enable information, and the memory size of the data to be encrypted from the first data storage area in the eFlash memory, the embodiment of the present application needs to obtain the non-protected code from the third data storage area in the eFlash memory, and encrypt the non-protected code based on the target key and the encryption and decryption enable information. Specifically, after obtaining the target key, encryption and decryption enable information, and the memory size of the data to be encrypted from the first data storage area in the eFlash memory, it may also include: controlling the central processing unit to obtain the non-protected code and the first data write address corresponding to the non-protected code and the memory size corresponding to the non-protected code from the third data storage area in the eFlash memory through the central processing unit bus; setting the encryption and decryption enable information to the on state based on the first data write address corresponding to the non-protected code and the memory size corresponding to the non-protected code, and encrypting the non-protected code so that the encrypted code is stored in the eFlash memory.

[0062] In this embodiment, Figure 2 As shown, Figure 2 This is the online encryption and decryption controller hardware circuit for eFlash-XIP mode. The functional modules in the online encryption and decryption controller hardware circuit include: Encrypt_engine module (encryption engine module), Decrypt_engine module (decryption engine module), Wr_intf module (write interface module), Wr_buff module (write buffer module), Ecc_encode module (ECC encoding module), Rd_intf module (read interface module), Rd_buff module (read buffer module), Ecc_decode module (ECC decoding module), Flash_intf module (Flash interface module), Fmc_init module (FMC initialization module), and Hsm_cfg module (HSM configuration module).

[0063] The Encrypt_engine module is used to encrypt data written by the CPU (Central Processing Unit) using the rootkey and encryption enable configuration read from the FLASH.

[0064] The Decrypt_engine module is used to decrypt the data read from the CPU using the rootkey read from the FLASH and the decryption enable configuration on the bus.

[0065] The Wr_intf module is used to adapt to the CPU write interface request, the Wr_buff module is used to cache the CPU write interface request sent by the Wr_intf module, and the Ecc_encode module is used to perform ECC calculation on the write data.

[0066] The Rd_intf module is used to adapt to the CPU read interface request, the Rd_buff module is used to cache the CPU read interface request issued by the Rd_intf module, and the Ecc_decode module is used to perform ECC decoding and verification on the read data.

[0067] The Flash_intf module is used to convert read and write requests into the FLASH interface protocol.

[0068] The fmc_init module reads the cached key, encryption and decryption configuration information, and SDK (Software Development Kit) code size from the EFLASH after power-on. The hsm_cfg module configures the programming key, encryption and decryption configuration, and SDK code size for the EFLASH.

[0069] It's worth noting that the controller hardware circuit operating modes described in this embodiment support both encrypted and non-encrypted modes. Upon power-up, the controller reads the encryption and decryption enable configuration information in the EFLASH NVR storage area and determines whether to encrypt or decrypt data based on this information. The encryption mode involves three steps: configuring encryption and decryption keys and key registers in the EFLASH NVR area, encrypting and programming user source code, writing the encrypted and programmed source code to the EFLASH MAIN memory, and executing the encrypted code in the EFLASH-XIP operating mode.

[0070] In the first specific implementation, the process for configuring encryption and decryption keys and key registers in the EFLASH NVR region is as follows: During the chip's FT / CP testing phase, developers can program key configuration values, such as encryption and decryption keys, encryption and decryption enable configuration information, user protected segment code space size, product chip ID, and IP calibration data, into the EFLASH NVR region as needed through the CPU and HSM_CFG module, and set a fixed lock bit. In one specific implementation, if the fixed lock bit is configured with a fixed value of 0x0, the corresponding configuration value is locked, and the region is changed to read-only, functioning similarly to a one-time programming circuit. It is worth noting that in normal operating scenarios, each time the SoC (System on Chip) is powered on, the FMC_INIT module in the controller reads the keys and related configurations from the NVR region and transmits them to the corresponding logic circuitry for data encryption and decryption operations. In normal operating mode, the NVR region is only accessible through hardware logic and cannot be directly read by the CPU or JTAG debug interface, thereby ensuring the security of key and other critical configuration information.

[0071] In the second specific implementation, the process for writing the encrypted and programmed source code to the EFLASH MAIN memory is as follows: the user uses a key to encrypt the source SDK code into ciphertext and then programs the ciphertext into the EFLASH via the JTAG debug interface. In other words, the bus encryption / decryption module determines whether to encrypt the written data based on the configuration and operation address read at power-up, ensuring that all data stored in the EFLASH is ciphertext. This ensures that even if a third party maliciously intrudes and copies data in the FLASH, the security of the user program is not compromised.

[0072] In the third specific implementation, the process of running the encrypted code in the EFLASH-XIP working mode is as follows: after power-on, the user can directly read the ciphertext program from the FLASH, and then, in the Decrypt_engine module at the read interface of the bus, the read ciphertext program is restored to the source SDK code in real time and executed. There is no need to decrypt and store it in SRAM (Static Random-Access Memory) first, and then execute it in SRAM. This not only speeds up the program execution rate, but also reduces the consumption of SRAM resources, ensuring the security of the user's SDK program.

[0073] Step S12: Improve the SM4 algorithm using the first preset algorithm adjustment rule to obtain a target encryption algorithm, and encrypt the data to be encrypted using the target encryption algorithm based on the target key and the encryption and decryption enabling information to obtain encrypted data.

[0074] It is worth mentioning that the hardware circuits for encrypting data in the Encrypt_engine module and decrypting data in the Decrypt_engine module are as follows: Figure 3 As shown; Figure 3 The upper part is the hardware circuit diagram of the Encrypt_engine module. The input data is the key and the data to be encrypted. Figure 3 The lower half of the figure is the hardware circuit diagram of the Decrypt_engine module. The input data is the key and the data to be decrypted, and the encryption and decryption algorithm used is the improved SM4 algorithm. The improved SM4 algorithm supports 128-bit keys and 64-bit data inputs. The encryption and decryption process uses two round functions, each corresponding to an SBOX. Specifically, improving the SM4 algorithm using the first preset algorithm adjustment rule to obtain the target encryption algorithm can include: setting a first round function and a second round function in the SM4 algorithm, and setting a first S-box and a second S-box for the first round function and the second round function, respectively, so as to perform a preset data replacement operation on the data to be encrypted in the first S-box and the second S-box.

[0075] In this embodiment, if the encryption and decryption enabling information indicates that the encryption and decryption function is turned on, the improved SM4 algorithm is used to encrypt the data to be encrypted. Specifically, the target encryption algorithm is used to encrypt the data to be encrypted based on the target key and the encryption and decryption enabling information to obtain the encrypted data, which may include: if the encryption and decryption enabling information indicates that the encryption and decryption function is turned on, the target key is split according to the preset bisection rule, and the high-bit portion after the first split is XORed with the low-bit portion after the first split to obtain the corresponding first XOR result; the first XOR result is split according to the preset bisection rule to obtain the high-bit portion after the second split and the low-bit portion after the second split; the encrypted data is split according to the preset bisection rule to obtain the high-bit portion after the third split and the low-bit portion after the third split, and the high-bit portion after the third split is XORed with the high-bit portion after the second split to obtain the second XOR result; in the first S box, the data corresponding to the preset number of high bits of the data to be encrypted are replaced with the data corresponding to the preset number of high bits in the second XOR result. The method comprises the following steps: performing a preset shift operation on the first replacement result, performing bitwise XOR processing on the first operation result and the first replacement result, performing XOR processing on the third XOR result and the high-bit part after the third split to obtain a fourth XOR result; performing XOR processing on the fourth XOR result and the low-bit part after the second split to obtain a fifth XOR result, and replacing the data corresponding to a preset number of high bits of the data to be encrypted with the data corresponding to a preset number of high bits in the fifth XOR result in the second S-box, and then performing a preset shift operation on the second replacement result to obtain a second operation result; performing bitwise XOR processing on the second operation result and the second replacement result to obtain a sixth XOR result, and performing XOR processing on the sixth XOR result and the low-bit part after the third split to obtain a seventh XOR result, and determining the encrypted data based on the sixth XOR result and the seventh XOR result.

[0076] In a specific embodiment, the encryption process of the improved SM4 algorithm is as follows: Figure 4 As shown:

[0077] First, the input 128-bit key is split into the upper 64-bit k0 and the lower 64-bit k1, and k0 and k1 are XORed to obtain the corresponding XOR result. The XOR result is then split into the upper 32-bit rk0 and the lower 32-bit rk1.

[0078] Secondly, the input 64-bit data is split into the upper 32-bit X0 and the lower 32-bit X1, and X0 is XORed with rk0 to obtain the corresponding XOR result, and the upper 8-bit data of the above XOR result is input into the SBOX. The upper 8-bit data of the input 64-bit data is replaced in the SBOX with the upper 8-bit data input into the SBOX to obtain the corresponding replacement data.

[0079] Then, a preset left shift operation is performed on the replacement data respectively, and the obtained left shift result is subjected to a bitwise XOR operation with the replacement data to obtain a corresponding XOR result, and the above XOR result is subjected to an XOR operation with X0 to obtain X2, and X2 is subjected to an XOR operation with rk1 to obtain an XOR result.

[0080] Subsequently, the high 8-bit data of the XOR result obtained in the above step is input into the SBOX, and the high 8-bit data input into the SBOX is used again in the SBOX to replace the high 8-bit data of the input 64-bit data to obtain corresponding replacement data, and a preset left shift operation is performed on the replacement data, and a bitwise XOR operation is performed on the obtained left shift result and the replacement data to obtain the corresponding XOR result.

[0081] Finally, the XOR result obtained in the above steps is XORed with X1 to obtain X3, and X3 is combined with X2 to form a 64-bit encrypted ciphertext of size t for output.

[0082] Step S13: creating a second data storage area based on the memory size corresponding to the data to be encrypted, and storing the encrypted data in the second data storage area in the eFlash memory through a preset controller in the eFlash memory.

[0083] In this embodiment, after obtaining the encrypted data, the embodiment of the present application needs to store the encrypted data in the second data storage area of ​​the eFlash memory, and during the storage process, the encryption and decryption enable information is set to a disabled state based on the memory size of the encrypted data and the second data write address corresponding to the encrypted data. Specifically, before storing the encrypted data in the second data storage area of ​​the eFlash memory via a preset controller in the eFlash memory, the embodiment of the present application may further include: setting the encryption and decryption enable information to a disabled state based on the memory size of the encrypted data and the second data write address corresponding to the encrypted data to stop repeated encryption of the encrypted data.

[0084] Step S14: obtain the data to be decrypted from the second data storage area through the preset controller in the eFlash memory, and use the second preset algorithm adjustment rule to improve the SM4 algorithm to obtain a target decryption algorithm, so as to use the target decryption algorithm and decrypt the data to be decrypted based on the target key and the encryption and decryption enable information to obtain decrypted data.

[0085] In this embodiment, before decrypting the data to be decrypted, the SM4 algorithm needs to be improved so that the data to be decrypted can be decrypted using the improved SM4 algorithm. Specifically, the SM4 algorithm is improved using the second preset algorithm adjustment rule to obtain a target decryption algorithm, including: setting a third round function and a fourth round function in the SM4 algorithm, and setting a third S-box and a fourth S-box for the third round function and the fourth round function, respectively, so that the preset data replacement operation can be performed on the data to be decrypted in the third S-box and the fourth S-box.

[0086] Among them, after obtaining the target decryption algorithm, the embodiment of the present application can use the target decryption algorithm to decrypt the data to be decrypted. Specifically, the target decryption algorithm decrypts the data to be decrypted based on the target key and the encryption and decryption enabling information to obtain the decrypted data, which may include: if the encryption and decryption enabling information indicates that the encryption and decryption function is turned on, the target key is split according to the preset bisection rule, and the high-bit part after the fourth split is bitwise XORed with the low-bit part after the fourth split, so as to split the eighth XOR result obtained according to the preset bisection rule to obtain the high-bit part after the fifth split and the low-bit part after the fifth split; split the data to be decrypted according to the preset bisection rule to obtain the high-bit part after the sixth split and the low-bit part after the sixth split, and XOR the high-bit part after the sixth split with the low-bit part after the fifth split to obtain the ninth XOR result; in the third S box, the data corresponding to the preset number of high bits of the data to be decrypted are replaced with the data corresponding to the preset number of high bits in the ninth XOR result. to obtain a third replacement result; perform a preset shift operation on the third replacement result, and perform bitwise XOR processing on the third operation result and the third replacement result, and perform XOR processing on the tenth XOR result and the high-bit part after the fifth split to obtain an eleventh XOR result; perform XOR processing on the eleventh XOR result and the high-bit part after the fifth split, and replace the data corresponding to a preset number of high bits of the data to be decrypted with the data corresponding to a preset number of high bits in the twelfth XOR result in the fourth S-box to obtain a fourth replacement result; perform a preset shift operation on the fourth replacement result, and perform bitwise XOR processing on the fourth operation result and the fourth replacement result to obtain a thirteenth XOR result; perform XOR processing on the thirteenth XOR result and the low-bit part after the sixth split to obtain a fourteenth XOR result, and determine the decrypted data based on the fourteenth XOR result and the eleventh XOR result.

[0087] In another specific embodiment, the decryption process of the improved SM4 algorithm is as follows: Figure 5 As shown:

[0088] First, the input 128-bit key is split into the upper 64-bit k0 and the lower 64-bit k1, and k0 and k1 are XORed to obtain the corresponding XOR result, which is then split into the upper 32-bit rk0 and the lower 32-bit rk1.

[0089] Secondly, the input 64-bit data is split into the upper 32-bit X0 and the lower 32-bit X1, and X0 is XORed with rk1 to obtain the corresponding XOR result, and the upper 8-bit data of the above XOR result is input into the SBOX. The upper 8-bit data of the input 64-bit data is replaced in the SBOX with the upper 8-bit data input into the SBOX to obtain the corresponding replacement data.

[0090] Then, a preset left shift operation is performed on the replacement data respectively, and the obtained left shift result is subjected to a bitwise XOR operation with the replacement data to obtain a corresponding XOR result, and the above XOR result is subjected to an XOR operation with X0 to obtain X2, and X2 is subjected to an XOR operation with rk0 to obtain an XOR result.

[0091] Subsequently, the high 8-bit data of the XOR result obtained in the above step is input into the SBOX, and the high 8-bit data input into the SBOX is used again in the SBOX to replace the high 8-bit data of the input 64-bit data to obtain corresponding replacement data, and a preset left shift operation is performed on the replacement data, and a bitwise XOR operation is performed on the obtained left shift result and the replacement data to obtain the corresponding XOR result.

[0092] Finally, the XOR result obtained in the above step is XORed with X1 to obtain X3, and X3 is combined with X2 to form a 64-bit encrypted ciphertext for output.

[0093] It is worth mentioning that the eFlash IP in the eFlash memory includes the first data storage area, the second data storage area, and the third data storage area; among them, the first data storage area is the eFlash NVR storage area, which only supports information reading through hardware logic; the second data storage area is the protected encrypted SDK area; and the third data storage area is the unprotected code storage area.

[0094] As can be seen from the above, before performing online data encryption and decryption based on the eFlash-XIP mode, the embodiment of the present application needs to obtain the target key, encryption and decryption enable information, and the memory size of the data to be encrypted from the first data storage area in the eFlash memory; the target key is the key for encrypting the data to be encrypted; the encryption and decryption enable information is used to encrypt the data to be encrypted; the SM4 algorithm is improved by using the first preset algorithm adjustment rule to obtain the target encryption algorithm, and the target encryption algorithm is used to encrypt the data to be encrypted based on the target key and the encryption and decryption enable information to obtain the encrypted data; a second data storage area is created based on the memory size corresponding to the data to be encrypted, and the encrypted data is stored in the second data storage area in the eFlash memory through the preset controller in the eFlash memory; the data to be decrypted is obtained from the second data storage area through the preset controller in the eFlash memory, and the SM4 algorithm is improved by using the second preset algorithm adjustment rule to obtain the target decryption algorithm, and the target decryption algorithm is used to decrypt the data to be decrypted based on the target key and the encryption and decryption enable information to obtain the decrypted data. In this way, while maintaining the functionality of the eFlash-XIP mode, online encryption and decryption of data is achieved.

[0095] To further describe the hardware circuit corresponding to the controller for online encryption and decryption, see Figure 6 As shown, Figure 6 This is a schematic diagram of the hardware circuit of the online encryption and decryption controller suitable for eFlash-XIP mode.

[0096] First, the user can use the CPU configuration interface to write the key, encryption and decryption enable configuration information, and SDK SIZE (that is, the memory size of the SDK code) into the EFLASH NVR area for storage.

[0097] Secondly, users can transfer the SDK code to be protected to the Encrypt_engine module, so that the Encrypt_engine module can encrypt the SDK code to be protected based on the key, encryption and decryption enable configuration information, and SDK SIZE to obtain ciphertext.

[0098] Subsequently, the user can use the CPU to write the above ciphertext into the user protected encrypted SDK area inside the EFLASH through the EFLASH controller, where the size of the user protected encrypted SDK area is consistent with the SDK SIZE. It is worth mentioning that in the process of writing the above ciphertext into the user protected encrypted SDK area, the encryption module of the bus will automatically configure the encryption enable to be turned off according to the data write address to stop re-encrypting the data. For non-protected code, the user can directly write the original code into the EFLASH non-protected code storage area through the CPU, where in the process of writing the code into the EFLASH non-protected code storage area, the encryption module of the bus will automatically set the encryption enable configuration information to the open state according to the data write address to encrypt the non-protected code, further ensuring that all data stored in the EFLASH are ciphertext.

[0099] In this embodiment, after system power-up, the FMC_INIT module uses the EFLASH controller to read the key, encryption / decryption enable configuration information, and the size of the SDK code space in the protected EFLASH segment (i.e., SDK_SIZE) from the EFLASH NVRINFO area. Subsequently, the EFLASH is placed in EFLASH XIP mode, allowing the CPU to directly read and execute decryption instructions in the EFLASH through the XIP interface. It then retrieves encrypted data from the user-protected encrypted SDK area or the EFLASH unprotected code storage area. The bus decryption module then decrypts the encrypted data using the key, encryption / decryption enable configuration information, and SDK_SIZE to obtain the original SDK code, which it then transmits to the CPU for execution.

[0100] It is worth mentioning that in order to ensure the security of program data, only the CPU XIP interface is allowed to use the EFLASH controller to read data, while other debug interfaces are not allowed to read data in the EFLASH through the EFLASH controller. In this way, when the EFLASH storage area is invaded by the outside world or copied by a third party maliciously such as X-ray irradiation, the illegally obtained data is encrypted data, so that the data cannot be illegally read, thereby protecting the security of the user program.

[0101] As can be seen from the above, before performing online data encryption and decryption based on the eFlash-XIP mode, the embodiment of the present application needs to obtain the target key, encryption and decryption enable information, and the memory size of the data to be encrypted from the first data storage area in the eFlash memory. Then, the SM4 algorithm is improved using the first preset algorithm adjustment rule to obtain the target encryption algorithm, and the target encryption algorithm is used to encrypt the data to be encrypted based on the target key and the encryption and decryption enable information to obtain encrypted data. Subsequently, a second data storage area is created based on the memory size corresponding to the data to be encrypted, and the encrypted data is stored in the second data storage area in the eFlash memory through the preset controller in the eFlash memory. Finally, the data to be decrypted is obtained from the second data storage area through the preset controller in the eFlash memory, and the SM4 algorithm is improved using the second preset algorithm adjustment rule to obtain the target decryption algorithm. The target decryption algorithm is used to decrypt the data to be decrypted based on the target key and the encryption and decryption enable information to obtain decrypted data. In this way, while maintaining the functionality of the eFlash-XIP mode, online encryption and decryption of data is achieved.

[0102] Accordingly, see Figure 7 As shown, the present application also provides an online data encryption and decryption device based on the eFlash-XIP mode, including:

[0103] A configuration information reading module 11 is configured to obtain a target key, encryption and decryption enabling information, and a memory size of the data to be encrypted from a first data storage area in the eFlash memory; the encryption and decryption enabling information is used to indicate whether the encryption and decryption functions are enabled;

[0104] a data encryption module 12 configured to improve the SM4 algorithm using a first preset algorithm adjustment rule to obtain a target encryption algorithm, and to encrypt the data to be encrypted using the target encryption algorithm based on the target key and the encryption / decryption enabling information to obtain encrypted data;

[0105] A data storage module 13 is configured to create a second data storage area based on a memory size corresponding to the data to be encrypted, and store the encrypted data in the second data storage area in the eFlash memory through a preset controller in the eFlash memory;

[0106] The data decryption module 14 is used to obtain the data to be decrypted from the second data storage area through the preset controller in the eFlash memory, and use the second preset algorithm adjustment rule to improve the SM4 algorithm to obtain a target decryption algorithm, so as to use the target decryption algorithm and decrypt the data to be decrypted based on the target key and the encryption and decryption enable information to obtain decrypted data.

[0107] As can be seen from the above, before performing online data encryption and decryption based on the eFlash-XIP mode, the embodiment of the present application needs to obtain the target key, encryption and decryption enable information, and the memory size of the data to be encrypted from the first data storage area in the eFlash memory. Then, the SM4 algorithm is improved using the first preset algorithm adjustment rule to obtain the target encryption algorithm, and the target encryption algorithm is used to encrypt the data to be encrypted based on the target key and the encryption and decryption enable information to obtain encrypted data. Broken Bones creates a second data storage area based on the memory size corresponding to the data to be encrypted, and stores the encrypted data to the second data storage area in the eFlash memory through the preset controller in the eFlash memory. Finally, the preset controller in the eFlash memory obtains the data to be decrypted from the second data storage area, and improves the SM4 algorithm using the second preset algorithm adjustment rule to obtain the target decryption algorithm, and decrypts the data to be decrypted based on the target key and the encryption and decryption enable information using the target decryption algorithm to obtain decrypted data. In this way, while maintaining the functionality of the eFlash-XIP mode, online encryption and decryption of data is achieved, improving the user experience.

[0108] In some specific implementations, the online data encryption and decryption device based on the eFlash-XIP mode may further include:

[0109] a central processing unit control unit, configured to control the central processing unit to obtain, from a third data storage area in the eFlash memory via a central processing unit bus, a non-protected code, a first data write address corresponding to the non-protected code, and a memory size corresponding to the non-protected code;

[0110] A code storage unit is used to set the encryption and decryption enable information to an on state based on the first data write address corresponding to the non-protected code and the memory size corresponding to the non-protected code, and to encrypt the non-protected code so as to store the encrypted code in the eFlash memory.

[0111] In some specific implementations, the data encryption module 12 may specifically include:

[0112] a first data replacement unit, configured to set a first round function and a second round function in the SM4 algorithm, and set a first S-box and a second S-box for the first round function and the second round function, respectively, so as to perform a preset data replacement operation on the data to be encrypted in the first S-box and the second S-box;

[0113] Accordingly, the data decryption module 14 may specifically include:

[0114] The second data replacement unit is used to set a third round function and a fourth round function in the SM4 algorithm, and set a third S box and a fourth S box for the third round function and the fourth round function, respectively, so as to perform a preset data replacement operation on the data to be decrypted in the third S box and the fourth S box.

[0115] In some specific implementations, the data encryption module 12 may specifically include:

[0116] A first key splitting unit is configured to split the target key according to a preset bisection rule if the encryption / decryption enabling information indicates that the encryption / decryption function is enabled, and perform bitwise exclusive-OR operation on the obtained first split high-bit portion and the first split low-bit portion to obtain a corresponding first exclusive-OR result;

[0117] A result splitting unit, configured to split the first XOR result according to a preset bisection rule to obtain a second split high-bit part and a second split low-bit part;

[0118] a first data splitting unit, configured to split the to-be-encrypted data according to the preset bisection rule to obtain a third high-bit portion after splitting and a third low-bit portion after splitting, and perform an XOR operation on the third high-bit portion after splitting and the second high-bit portion after splitting to obtain a second XOR result;

[0119] a third data replacing unit, configured to replace, in the first S-box, data corresponding to a preset number of high bits of the data to be encrypted with data corresponding to a preset number of high bits in the second XOR result, to obtain a first replacement result;

[0120] a first result shifting unit, configured to perform a preset shift operation on the first replacement result, perform a bitwise XOR operation on the obtained first operation result and the first replacement result, and perform an XOR operation on the obtained third XOR result and the third split high-bit portion to obtain a fourth XOR result;

[0121] a first XOR processing unit, configured to perform an XOR operation on the fourth XOR result and the second split low-bit portion to obtain a fifth XOR result, and replace, in the second S-box, the data corresponding to the preset number of high bits of the data to be encrypted with the data corresponding to the preset number of high bits in the fifth XOR result, and then perform a preset shift operation on the obtained second replacement result to obtain a second operation result;

[0122] The second XOR processing unit is used to perform bitwise XOR processing on the second operation result and the second replacement result to obtain a sixth XOR result, and to perform XOR processing on the sixth XOR result and the low-bit part after the third split to obtain a seventh XOR result, and to determine the encrypted data based on the sixth XOR result and the seventh XOR result.

[0123] In some specific implementations, the online data encryption and decryption device based on the eFlash-XIP mode may further include:

[0124] The enabling information setting unit is configured to set the encryption / decryption enabling information to a closed state based on the memory size of the encrypted data and a second data write address corresponding to the encrypted data, so as to stop repeatedly encrypting the encrypted data.

[0125] In some specific implementations, the data decryption module 14 may specifically include:

[0126] a second key splitting unit, configured to split the target key according to a preset bisection rule if the encryption / decryption enabling information indicates that the encryption / decryption function is enabled, and perform bitwise exclusive-OR on the fourth high-bit portion obtained after splitting and the fourth low-bit portion obtained after splitting, so as to split the eighth exclusive-OR result obtained according to the preset bisection rule to obtain a fifth high-bit portion and a fifth low-bit portion after splitting;

[0127] a second data splitting unit, configured to split the to-be-decrypted data according to the preset bisection rule to obtain a sixth split high-bit portion and a sixth split low-bit portion, and perform an XOR operation on the sixth split high-bit portion and the fifth split low-bit portion to obtain a ninth XOR result;

[0128] a fourth data replacing unit, configured to replace, in the third S-box, data corresponding to a preset number of high bits of the data to be decrypted with data corresponding to a preset number of high bits in the ninth XOR result, to obtain a third replacement result;

[0129] a second result shifting unit, configured to perform a preset shift operation on the third replacement result, perform a bitwise XOR operation on the obtained third operation result and the third replacement result, and perform an XOR operation on the obtained tenth XOR result and the high-bit portion after the fifth split, to obtain an eleventh XOR result;

[0130] a third XOR processing unit, configured to perform XOR processing on the eleventh XOR result and the high-bit portion after the fifth split, and replace, in the fourth S-box, the data corresponding to the preset number of high-bits of the data to be decrypted with the data corresponding to the preset number of high-bits in the obtained twelfth XOR result, to obtain a fourth replacement result;

[0131] a third result shifting unit, configured to perform a preset shift operation on the fourth replacement result, and perform a bitwise XOR operation on the obtained fourth operation result and the fourth replacement result to obtain a thirteenth XOR result;

[0132] The fourth XOR processing unit is used to perform XOR processing on the thirteenth XOR result and the low-bit part after the sixth split to obtain a fourteenth XOR result, and determine the decrypted data based on the fourteenth XOR result and the eleventh XOR result.

[0133] Furthermore, the embodiment of the present application also discloses an electronic device, Figure 8 This is a structural diagram of an electronic device 20 according to an exemplary embodiment. The content in the diagram should not be considered as any limitation on the scope of use of this application. The electronic device 20 may specifically include: at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input / output interface 25, and a communication bus 26. The memory 22 is used to store a computer program, which is loaded and executed by the processor 21 to implement the relevant steps in the online data encryption and decryption method based on the eFlash-XIP mode disclosed in any of the aforementioned embodiments. In addition, the electronic device 20 in this embodiment may specifically be an electronic computer.

[0134] In this embodiment, the power supply 23 is used to provide operating voltage for each hardware device on the electronic device 20; the communication interface 24 can create a data transmission channel between the electronic device 20 and the external device. The communication protocol it follows is any communication protocol that can be applied to the technical solution of this application and is not specifically limited here; the input and output interface 25 is used to obtain external input data or output data to the outside world. Its specific interface type can be selected according to specific application needs and is not specifically limited here.

[0135] In addition, the memory 22, as a carrier for resource storage, can be a read-only memory, random access memory, disk or CD, etc. The resources stored thereon can include an operating system 221, a computer program 222, etc., and the storage method can be temporary storage or permanent storage.

[0136] The operating system 221 is used to manage and control the hardware devices and computer program 222 on the electronic device 20, and can be Windows Server, NetWare, Unix, Linux, etc. In addition to including a computer program capable of implementing the online data encryption and decryption method based on the eFlash-XIP mode executed by the electronic device 20 disclosed in any of the aforementioned embodiments, the computer program 222 may further include a computer program capable of performing other specific tasks.

[0137] Furthermore, this application discloses a computer-readable storage medium for storing a computer program. When executed by a processor, the computer program implements the aforementioned online data encryption and decryption method based on the eFlash-XIP mode. The specific steps of this method can be found in the corresponding content disclosed in the aforementioned embodiments and will not be further described here.

[0138] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from the other embodiments. Reference can be made to the descriptions of the identical or similar parts between the various embodiments. For the devices disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the descriptions are relatively simple, and the relevant parts can be referred to the descriptions of the methods.

[0139] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the above description has generally described the components and steps of each example according to their functions. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0140] The steps of the methods or algorithms described in conjunction with the embodiments disclosed herein may be implemented directly using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in random access memory (RAM), internal memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0141] Finally, it should be noted that, in this document, relational terms such as first and second, etc., are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations. Moreover, the terms "comprises," "comprising," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or device comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or elements inherent to such process, method, article, or device. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of additional identical elements in the process, method, article, or device comprising the element.

[0142] The above is a detailed introduction to the technical solution provided by the present application. Specific examples are used herein to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method of the present application and its core idea. At the same time, for those skilled in the art, according to the ideas of the present application, there may be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as a limitation on the present application.

Claims

1. An online data encryption and decryption method based on eFlash-XIP mode, characterized in that: include: Obtain the target key, encryption and decryption enabling information, and the memory size of the data to be encrypted from the first data storage area in the eFlash memory; The encryption and decryption enabling information is used to indicate whether the encryption and decryption functions are enabled; Improve the SM4 algorithm using the first preset algorithm adjustment rule to obtain a target encryption algorithm, and encrypt the data to be encrypted using the target encryption algorithm and based on the target key and the encryption and decryption enabling information to obtain encrypted data; Creating a second data storage area based on the memory size corresponding to the data to be encrypted, and storing the encrypted data in the second data storage area in the eFlash memory through a preset controller in the eFlash memory; The data to be decrypted is obtained from the second data storage area through a preset controller in the eFlash memory, and the SM4 algorithm is improved using a second preset algorithm adjustment rule to obtain a target decryption algorithm, so as to decrypt the data to be decrypted using the target decryption algorithm and based on the target key and the encryption and decryption enable information to obtain decrypted data.

2. The online data encryption and decryption method based on the eFlash-XIP mode according to claim 1 is characterized in that: After obtaining the target key, encryption / decryption enabling information, and the memory size of the data to be encrypted from the first data storage area in the eFlash memory, the method further includes: Controlling the central processing unit to obtain the non-protected code, the first data write address corresponding to the non-protected code, and the memory size corresponding to the non-protected code from the third data storage area in the eFlash memory through the central processing unit bus; The encryption / decryption enabling information is set to an on state based on the first data write address corresponding to the non-protected code and the memory size corresponding to the non-protected code, and the non-protected code is encrypted so that the encrypted code is stored in the eFlash memory.

3. The online data encryption and decryption method based on the eFlash-XIP mode according to claim 1 is characterized in that: The method of improving the SM4 algorithm by using the first preset algorithm adjustment rule to obtain a target encryption algorithm includes: Setting a first round function and a second round function in the SM4 algorithm, and setting a first S-box and a second S-box for the first round function and the second round function, respectively, so as to perform a preset data replacement operation on the data to be encrypted in the first S-box and the second S-box; Accordingly, the target decryption algorithm is obtained by improving the SM4 algorithm using the second preset algorithm adjustment rule, including: A third round function and a fourth round function are set in the SM4 algorithm, and a third S-box and a fourth S-box are set for the third round function and the fourth round function, respectively, so as to perform a preset data replacement operation on the data to be decrypted in the third S-box and the fourth S-box.

4. The online data encryption and decryption method based on the eFlash-XIP mode according to claim 3 is characterized in that: The step of encrypting the data to be encrypted by using the target encryption algorithm and based on the target key and the encryption / decryption enabling information to obtain encrypted data includes: If the encryption / decryption enabling information indicates that the encryption / decryption function is enabled, the target key is split according to a preset bisection rule, and a bitwise exclusive-OR operation is performed on the obtained high-bit portion after the first split and the low-bit portion after the first split to obtain a corresponding first exclusive-OR result; Splitting the first XOR result according to a preset bisection rule to obtain a second split high-bit portion and a second split low-bit portion; Splitting the data to be encrypted according to the preset bisection rule to obtain a third high-bit portion and a third low-bit portion after splitting, and performing an XOR operation on the third high-bit portion and the second high-bit portion after splitting to obtain a second XOR result; replacing data corresponding to a preset number of high bits of the data to be encrypted with data corresponding to a preset number of high bits of the second XOR result in the first S-box to obtain a first replacement result; Performing a preset shift operation on the first replacement result, performing a bitwise XOR operation on the obtained first operation result and the first replacement result, and performing an XOR operation on the obtained third XOR result and the high-bit portion after the third split to obtain a fourth XOR result; Performing an XOR operation on the fourth XOR result and the second split low-bit portion to obtain a fifth XOR result, and replacing the data corresponding to the preset number of high-bits of the data to be encrypted with the data corresponding to the preset number of high-bits in the fifth XOR result in the second S-box, and then performing a preset shift operation on the obtained second replacement result to obtain a second operation result; The second operation result and the second replacement result are subjected to bitwise XOR processing to obtain a sixth XOR result, and the sixth XOR result and the low-bit part after the third split are subjected to XOR processing to obtain a seventh XOR result, and the encrypted data is determined based on the sixth XOR result and the seventh XOR result.

5. The online data encryption and decryption method based on the eFlash-XIP mode according to any one of claims 1 to 4, characterized in that: Before storing the encrypted data in the second data storage area in the eFlash memory through the preset controller in the eFlash memory, the method further includes: The encryption / decryption enabling information is set to a closed state based on the memory size of the encrypted data and a second data write address corresponding to the encrypted data, so as to stop repeatedly encrypting the encrypted data.

6. The online data encryption and decryption method based on the eFlash-XIP mode according to claim 3 is characterized in that: Decrypting the data to be decrypted using the target decryption algorithm and based on the target key and the encryption / decryption enabling information to obtain decrypted data includes: If the encryption / decryption enabling information indicates that the encryption / decryption function is enabled, the target key is split according to a preset bisection rule, and the high-bit portion obtained after the fourth split is bitwise XORed with the low-bit portion obtained after the fourth split, so as to split the eighth XOR result obtained according to the preset bisection rule to obtain the high-bit portion after the fifth split and the low-bit portion after the fifth split; Splitting the data to be decrypted according to the preset bisection rule to obtain a sixth split high-bit portion and a sixth split low-bit portion, and performing an XOR operation on the sixth split high-bit portion and the fifth split low-bit portion to obtain a ninth XOR result; replacing data corresponding to a preset number of high bits of the data to be decrypted with data corresponding to a preset number of high bits in the ninth XOR result in the third S-box to obtain a third replacement result; Performing a preset shift operation on the third replacement result, performing a bitwise XOR operation on the obtained third operation result and the third replacement result, and performing an XOR operation on the obtained tenth XOR result and the high-bit portion after the fifth split to obtain an eleventh XOR result; XORing the eleventh XOR result with the high-bit portion after the fifth split, and replacing the data corresponding to the preset number of high-bits of the data to be decrypted with the data corresponding to the preset number of high-bits in the twelfth XOR result in the fourth S-box to obtain a fourth replacement result; performing a preset shift operation on the fourth replacement result, and performing a bitwise XOR operation on the obtained fourth operation result and the fourth replacement result to obtain a thirteenth XOR result; The thirteenth XOR result is XORed with the low-bit portion after the sixth split to obtain a fourteenth XOR result, and decrypted data is determined based on the fourteenth XOR result and the eleventh XOR result.

7. The online data encryption and decryption method based on the eFlash-XIP mode according to claim 2 is characterized in that: The eFlash IP in the eFlash memory includes the first data storage area, the second data storage area, and the third data storage area; wherein the first data storage area is the eFlash NVR storage area, which only supports information reading through hardware logic; the second data storage area is the protected encrypted SDK area; and the third data storage area is the unprotected code storage area.

8. An online data encryption and decryption device based on eFlash-XIP mode, characterized in that: include: A configuration information reading module is used to obtain a target key, encryption and decryption enabling information, and a memory size of the data to be encrypted from a first data storage area in the eFlash memory; the encryption and decryption enabling information is used to indicate whether the encryption and decryption functions are enabled; a data encryption module, configured to improve the SM4 algorithm using a first preset algorithm adjustment rule to obtain a target encryption algorithm, and encrypt the data to be encrypted using the target encryption algorithm and based on the target key and the encryption / decryption enabling information to obtain encrypted data; A data storage module, configured to create a second data storage area based on a memory size corresponding to the data to be encrypted, and store the encrypted data in the second data storage area in the eFlash memory through a preset controller in the eFlash memory; A data decryption module is used to obtain the data to be decrypted from the second data storage area through a preset controller in the eFlash memory, and use a second preset algorithm adjustment rule to improve the SM4 algorithm to obtain a target decryption algorithm, so as to use the target decryption algorithm and decrypt the data to be decrypted based on the target key and the encryption and decryption enable information to obtain decrypted data.

9. An electronic device, characterized in that: include: Memory, used to store computer programs; A processor is used to execute the computer program to implement the steps of the online data encryption and decryption method based on the eFlash-XIP mode as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that Used to store a computer program, wherein when the computer program is executed by a processor, the steps of the online data encryption and decryption method based on the eFlash-XIP mode according to any one of claims 1 to 7 are implemented.

Images