An embedded data protection processing system with an external security encryption chip and NVME solid-state storage device

Abstract

The present invention is an embedded data protection processing system that is matched with an external security encryption chip and an NVME solid-state storage device. The patent application of the present invention relates to the field of integrated circuit chips and computer technology, and specifically relates to an embedded data protection processing system that is matched with an external security encryption chip and an NVME solid-state storage device. The method comprises: when receiving data write indication information and write data sent by a host computer device, generating a private key through an external security encryption chip, and responding to the host computer device according to the data write indication information; encrypting the write data through the private key; through the behavior of the host computer device, sending the data write indication information and the encrypted write data to the NVME solid-state storage device, so that the NVME solid-state storage device stores the encrypted write data in response to the data write indication information. The embodiment of the present invention can encrypt the data written to the NVME solid-state storage device through an external security encryption chip without the need for the host computer CPU to control. Technical field: The present application relates to the field of integrated circuit chips and computer technology, and in particular to a data protection processing method, a security encryption chip, an NVME solid-state storage device, an embedded system motherboard and an electronic device.

Description

Technical Field

[0001] The present application relates to the field of integrated circuit chips and computer technology, and in particular to a data protection processing method, a security encryption chip, an NVME solid-state storage device, an embedded system motherboard and an electronic device. Background Art

[0002] In the past, computer data security protection generally included the following two methods: one was to manage user access rights through key management software; the other was to encrypt shared data in solid-state drives and decrypt it during reading.

[0003] The method of managing and controlling user access rights through software is simple, easy to crack, and has poor confidentiality. Therefore, most computer security systems use encryption of data in solid-state drives, namely solid-state drive security encryption systems. The existing NVME solid-state drive security encryption system generally includes a solid-state drive, a key, and an identity authentication system; the solid-state drive includes an encryption and decryption module, a solid-state drive control module, and a storage module; the key and the identity authentication system are stored in the storage module. The method of the existing NVME solid-state drive security encryption system is as follows: first perform identity authentication on the identity authentication system, and then make the following choices: if the identity authentication is correct, proceed to the next step; if the identity authentication is incorrect, return to the identity authentication system; after the identity authentication is correct, the SSD solid-state drive control module loads the built-in key to the encryption and decryption module; the encryption and decryption module encrypts / decrypts the data input / output by the SSD solid-state drive according to the key. However, since the data in the SSD solid-state drive is encrypted and has good security, the data is not easy to be cracked. However, the existing SSD security encryption system also has some defects: First, because the key is also stored in the SSD, it is easy to have problems in the storage, management and transmission of the key. For example, an attacker can illegally obtain the key by attacking the storage medium of the SSD where the key is stored, thereby cracking the ciphertext. Second, the key is unique, which is not conducive to the use of shared data.

[0004] On the other hand, the currently used security encryption chips are all implemented on the host computer device through the computing power of the CPU, such as the traditional TPM (Trusted Platform Module) security chip is implemented on the motherboard level of the server. However, since the encryption chip needs to perform corresponding encryption and decryption calculations through the host computer CPU, the encryption chip can only be used with the CPU using the X86 architecture, and cannot be used with the CPU using other architectures, especially in a wide range of Internet of Things applications, and the encryption chip will be limited by the BIOS (Basic Input Output System) and must be started using the corresponding BIOS driver. In addition, when the security encryption chip is applied, all the networks and storage devices in the server have to use the same set of keys provided by the security encryption chip, which will reduce the robustness of the system security. The above statements only provide background information related to the present invention and do not necessarily constitute the prior art. Summary of the invention

[0005] In view of the above-mentioned deficiencies, the present invention provides an embedded data protection processing system, an external security encryption chip, an NVME solid-state storage device, an embedded motherboard and an electronic device. The embodiments of the present invention can independently encrypt data written into the NVME solid-state storage device without the need for control by a host computer CPU, thereby solving the above-mentioned deficiencies.

[0006] The present invention provides an embedded data protection processing system, the system comprising:

[0007] Independent flash memory space, capable of connecting to main computer storage;

[0008] An independent security encryption chip is used to store the generated private key;

[0009] Ensure that the stored private key cannot be exported outside the hardware;

[0010] The private key in the security encryption chip cannot be directly read from outside;

[0011] The public key and the signature and identity verification of the corresponding algorithm can be exported;

[0012] Support TYPE-C connection;

[0013] Support firmware upgrade;

[0014] Can perform basic management functions, such as key management, reset, upgrade, etc.;

[0015] The present invention provides an embedded data protection processing system, which includes an external security encryption chip, and the encryption chip includes:

[0016] On-chip SM1 / SSF33 algorithm hardware accelerator to achieve high-speed data encryption and decryption;

[0017] On-chip SM2 coprocessor, including RSA / SM2 algorithm engine REAE, to achieve high-speed digital signature and identity verification;

[0018] Support SM3 software implementation;

[0019] On-chip AES / DES / TDES algorithm engine to achieve high-speed data encryption and decryption;

[0020] On-chip RSA / ECC coprocessor to achieve high-speed digital signature and identity verification;

[0021] On-chip SHA algorithm engine;

[0022] On-chip key management (including key generation, key storage, key update, etc.)

[0023] Support multiple interfaces (including USB TYPE-C, high-speed SPI, 7816-3, high-speed UART, etc.);

[0024] On-chip FLASH memory, with a storage capacity of 256KB, can be used as a data buffer;

[0025] On-chip SRAM memory, storage capacity 32KB;

[0026] Support multiple security management controls;

[0027] The present invention provides an embedded data protection processing method. In one embodiment, the method uses an external security encryption chip, which is matched with an NVME solid-state storage device and connected to a host computer device; the method includes:

[0028] When receiving the data writing instruction information and the writing data from the host computer device, responding to the host computer device according to the data writing instruction information through the NVME solid-state storage device;

[0029] The written data is encrypted by generating a private key through an external encryption chip;

[0030] Through the host computer device, the data write indication information and the write data encrypted by the private key generated by the external security encryption chip are sent to the NVME solid-state storage device, so that the NVME solid-state storage device stores the encrypted write data in response to the data write indication information.

[0031] In one embodiment, the method further comprises:

[0032] When receiving the data read instruction information sent by the host computer device, responding to the host computer device according to the data read instruction information through the NVME solid-state storage device;

[0033] Sending data read indication information to the NVME solid-state storage device through the host computer device;

[0034] After obtaining the read data fed back by the NVME solid-state storage device in response to the data read indication information, decrypting the read data using a private key generated by an external security encryption chip;

[0035] The decrypted read data is fed back to the host computer device through the storage device.

[0036] In one embodiment, the step of encrypting the written data using a private key generated by an external security encryption chip includes: running an encryption algorithm of an RSA / SM2 algorithm engine to generate a first private key for encryption, and encrypting the written data according to the first private key.

[0037] In one embodiment, the step of decrypting the read data includes: running an encryption algorithm of an RSA / SM2 algorithm engine to generate a second private key for decryption, and decrypting the read data according to the second private key.

[0038] In one embodiment, the encryption algorithm includes the national encryption algorithm SM2 and / or the international algorithm.

[0039] In one embodiment, the method further includes: receiving a control instruction from a user and updating the encryption algorithm of SM2.

[0040] In one embodiment, the data write indication information includes a data write command and a data write address; the behavior of the host computer device, the step of sending the data write indication information and the write data encrypted by the private key generated by the external security encryption chip to the NVME solid-state storage device, includes:

[0041] Identifying a command type of a data writing command included in the data writing instruction information;

[0042] When it is determined that the command type of the data write command is a command type that the NVME solid-state storage device can process, the main computing device sends the data write indication information and the encrypted write data to the NVME solid-state storage device;

[0043] When it is determined that the command type of the data write command is not a command type that the NVME solid-state storage device can process, the command type of the data write command is processed into a command type that the NVME solid-state storage device can process, and the host computer device sends the processed data write command, data write address and encrypted write data to the NVME solid-state storage device.

[0044] In one embodiment, the data read indication information includes a data read command and a data read address; the host computer device sends the data read indication information to the NVME solid-state storage device, including: identifying the command type of the data read command included in the data read indication information;

[0045] When it is determined that the command type of the data read command is a command type that the NVME solid-state storage device can process, the host computer device sends the data read indication information to the NVME solid-state storage device;

[0046] When it is determined that the command type of the data read command is not a command type that the NVME solid-state storage device can process, the command type of the data read command is processed into a command type that the NVME solid-state storage device can process, and the host computer device sends the processed data read command and data read address to the NVME solid-state storage device.

[0047] In one embodiment, when receiving data write indication information and write data sent by a host computer device, responding to the host computer device according to the data write indication information through an NVME solid-state storage device; encrypting the write data through a private key generated by an external security encryption chip; sending the data write indication information and the encrypted write data to the NVME solid-state storage device through the host computer device, so that the NVME solid-state storage device stores the encrypted write data in response to the data write indication information, including:

[0048] When receiving the data writing instruction information and the writing data sent by the host computer device, determining that the working mode is the data protection processing mode;

[0049] When it is determined that the working mode is the data protection processing mode, the host computer device is responded to according to the data write indication information through the NVME solid-state storage device; the write data is encrypted by the private key generated by the external security encryption chip; through the behavior of the host computer device, the data write indication information and the encrypted write data are sent to the NVME solid-state storage device, so that the NVME solid-state storage device stores the encrypted write data in response to the data write indication information.

[0050] In one embodiment, when receiving data read indication information sent by a host computer device, responding to the host computer device according to the data read indication information through the behavior of the NVME solid-state storage device; sending the data read indication information to the NVME solid-state storage device through the host computer device; after obtaining the read data fed back by the NVME solid-state storage device in response to the data read indication information, decrypting the read data through a private key generated by an external security encryption chip; and feeding back the decrypted read data to the host computer device through the NVME solid-state storage device, including:

[0051] When receiving the data reading instruction information sent by the host computer device, determining that the working mode is a data protection processing mode;

[0052] When it is determined that the working mode is the data protection processing mode, the host computer device is responded to according to the data reading indication information through the NVME solid-state storage device; the data reading indication information is sent to the NVME solid-state storage device through the host computer device; after obtaining the read data fed back by the NVME solid-state storage device in response to the data reading indication information, the read data is decrypted by a private key generated by an external security encryption chip; and the decrypted read data is fed back to the host computer device through the NVME solid-state storage device.

[0053] In one embodiment, the data write indication information and write data sent by the host computer device and received by the external security encryption chip are sent to the encryption chip by the first encryption chip through the host computer device. The first encryption chip is a chip that is connected in series between the encryption chip and the host computer device and is the same as the encryption chip. The write data is data encrypted by the first encryption chip.

[0054] In one embodiment, the read data fed back by the storage device received by the external security encryption chip is data sent to the encryption chip by the second encryption chip through the NVME solid-state storage device. The second encryption chip is a chip identical to the encryption chip that is connected in series between the encryption chip and the NVME solid-state storage device. The read data is data decrypted by the second encryption chip.

[0055] According to a second aspect, the present invention provides an external security encryption chip. In one embodiment, the encryption chip includes an interface for connecting to a host computer device, an interface for connecting to an NVEM solid-state storage device configured on board, and a data encryption and decryption module;

[0056] The on-chip data encryption and decryption module includes a first data buffer, an encryption and decryption module and a second data buffer;

[0057] A first data buffer, used for, when obtaining data write indication information and write data from a host computer device, the NVME solid-state storage device responds to the host computer device according to the data write indication information, and sends the data write indication information and write data to the encryption and decryption module;

[0058] an encryption and decryption module, configured to, after receiving the data writing indication information and the writing data sent by the first data buffer, encrypt the writing data by using a private key, and send the data writing indication information and the encrypted writing data to the second data buffer;

[0059] The second data buffer is used for the host computer device to send the data write indication information from the encryption and decryption module and the write data encrypted by the private key to the NVME solid-state storage device, so that the NVME solid-state storage device stores the encrypted write data in response to the data write indication information.

[0060] In one embodiment, the first data buffer is further used for, when the data read indication information sent by the host computer device is obtained, the NVME solid-state storage device responds to the host computer device according to the data read indication information, and sends the data read indication information to the encryption and decryption module, so that the encryption and decryption module sends the data read indication information to the second data buffer;

[0061] The second data buffer is also used for the behavior of the host computer device, sending the data reading indication information from the encryption and decryption module to the NVME solid-state storage device, so that the NVME solid-state storage device responds to the data reading indication information and sends the read data to the encryption and decryption module after obtaining the read data fed back by the NVME solid-state storage device;

[0062] The encryption and decryption module is also used to decrypt the read data by generating a private key after receiving the read data sent by the second data buffer, and send the decrypted read data to the first data buffer, so that the NVME solid-state storage device of the first data buffer feeds back the decrypted read data to the main computer device.

[0063] In one embodiment, when the encryption and decryption module is used to encrypt the write data by generating a private key through the encryption chip, it is specifically used to encrypt the write data using the SM2 encryption algorithm; when the encryption and decryption module is used to decrypt the read data by using the private key, it is specifically used to decrypt the read data using the SM2 encryption algorithm.

[0064] In one embodiment, the encryption and decryption module includes a microcontroller processor and a key generator of the RSA / SM2 algorithm engine REAE encryption algorithm;

[0065] When the encryption and decryption module is used to encrypt the written data by the private key, the microcontroller in the encryption chip is used to control the key generator to run the SM2 encryption algorithm to generate a first private key for encryption, and encrypt the written data according to the first private key;

[0066] When the encryption and decryption module is used to decrypt the read data, the built-in microcontroller of the encryption chip is used to control the key generator to run the SM2 encryption algorithm to generate a second private key for decryption, and decrypt the read data according to the second private key.

[0067] In one embodiment, the encryption algorithm includes the national SM2 algorithm and / or the international algorithm.

[0068] In one embodiment, the encryption chip further includes a control port and a special purpose module; the special purpose module is used to receive control instructions from the user through the control port to update the SM2 encryption algorithm.

[0069] In one embodiment, the data write indication information includes a data write command and a data write address; when the encryption and decryption module is used to send the data write indication information and the write data encrypted by the private key to the second data buffer, it is specifically used to:

[0070] Identifying a command type of a data writing command included in the data writing instruction information;

[0071] When it is determined that the command type of the data write command is a command type that can be processed by the NVME solid-state storage device, the data write indication information and the write data encrypted by the private key generated by the encryption chip are sent to the second data buffer;

[0072] When it is determined that the command type of the data write command is not a command type that the NVME solid-state storage device can process, the command type of the data write command is processed as a command type that the NVME solid-state storage device can process, and the data write address, encrypted write data and processed data write command are sent to the second data buffer.

[0073] In one embodiment, the data read indication information includes a data read command and a data read address; when the encryption and decryption module is used to send the data read indication information to the second data buffer, it is specifically used to:

[0074] Identifying a command type of a data read command included in the data read instruction information;

[0075] When it is determined that the command type of the data read command is a command type that can be processed by the NVME solid-state storage device, sending the data read indication information to the second data buffer;

[0076] When it is determined that the command type of the data read command is not a command type that the NVME solid-state storage device can process, the command type of the data read command is processed as a command type that the NVME solid-state storage device can process, and the processed data read command and data read address are sent to the second data buffer.

[0077] In one embodiment, the host computer device includes a host computer central processing unit or a host computer bus adapter.

[0078] In one embodiment, the NVME solid-state storage device includes an SSD NVME solid-state drive.

[0079] In one embodiment, the number of interfaces is at least one; wherein the interface is used to connect to a host computer device, and the interface protocol is USB TYPE-C.

[0080] In one embodiment, when the first data buffer is used to receive the data write indication information and the write data sent by the host computer device, the first data buffer responds to the host computer device according to the data write indication information through the NVME solid-state storage device, encrypts the write data by a private key generated by an external security encryption chip, and sends the data write indication information and the encrypted write data to the NVME solid-state storage device through the host computer device, so that the NVME solid-state storage device stores the write data encrypted by the private key in response to the data write indication information. Specifically, it is used to:

[0081] When receiving the data writing instruction information and the writing data sent by the host computer device, determining that the working mode is the data protection processing mode;

[0082] When it is determined that the working mode is the data protection processing mode, the host computer device is responded to according to the data write indication information through the NVME solid-state storage device; the write data is encrypted by the private key generated by the external security encryption chip; the data write indication information and the write data encrypted by the private key are sent to the NVME solid-state storage device through the host computer device, so that the NVME solid-state storage device stores the write data encrypted by the private key in response to the data write indication information.

[0083] In one embodiment, when the first data buffer is used to receive the data read indication information sent by the host computer device, the first data buffer responds to the host computer device according to the data read indication information through the NVME solid-state storage device, sends the data read indication information to the NVME solid-state storage device through the host computer device, and after obtaining the read data fed back by the NVME solid-state storage device in response to the data read indication information, generates a private key for the read data through an external security encryption chip to decrypt the read data, and feeds back the decrypted read data to the host computer device through the NVME solid-state storage device, specifically used to:

[0084] When receiving the data reading instruction information sent by the host computer device, determining that the working mode is a data protection processing mode;

[0085] When it is determined that the working mode is the data protection processing mode, the host computer device is responded to according to the data reading indication information through the NVME solid-state storage device; the data reading indication information is sent to the NVME solid-state storage device through the host computer device; after obtaining the read data fed back by the NVME solid-state storage device in response to the data reading indication information, the read data is decrypted by a private key generated by an external security encryption chip; and the decrypted read data is fed back to the host computer device through the NVME solid-state storage device.

[0086] In one embodiment, the external security encryption chip further includes a firmware interface, and the encryption and decryption module can receive a user's working mode switching instruction through the firmware interface;

[0087] In one embodiment, the data write indication information and write data sent by the host computer device and received by the external security encryption chip are sent to the encryption chip by the first encryption chip through the host computer device. The first encryption chip is a chip that is connected in series between the encryption chip and the host computer device and is the same as the encryption chip. The write data is data encrypted by the private key generated by the first encryption chip.

[0088] In one embodiment, the read data fed back by the NVME solid-state storage device and received by the external security encryption chip is data sent to the encryption chip by the second encryption chip through the NVME solid-state storage device. The second encryption chip is a chip identical to the encryption chip that is connected in series between the encryption chip and the NVME solid-state storage device. The read data is data decrypted by the private key generated by the second encryption chip.

[0089] The above embodiment of the present invention interacts with the host computer device through the NVME solid-state storage device and the host computer device interacts with the NVME solid-state storage device, so that the external security encryption chip is bidirectionally transparent to the host computer device and the NVME solid-state storage device, so that the encryption chip can be started without writing a corresponding driver for the encryption chip. At this time, the encryption chip can independently encrypt the data to be written into the NVME solid-state storage device by the host computer device without the need for the CPU control of the host computer, so that the external security encryption chip can be used in conjunction with a CPU using any architecture, expanding the scope of application of the encryption chip, and it does not rely on the TPM security chip on the motherboard when encrypting data, and can avoid dependence on a few BIOS suppliers and OEM integrators on the market. Each NVME solid-state storage device is equipped with an external security encryption chip, and each encryption chip uses an independent security key to ensure the security of the data stored in the NVME solid-state storage device, greatly improving the robustness of system security. BRIEF DESCRIPTION OF THE DRAWINGS

[0090] Figure 1 This is a structural block diagram of an embedded data protection processing system in an implementation case of the present invention that is combined with an external security encryption chip and an NVME solid-state storage device.

[0091] Figure 2 Embedded data protection processing encryption data step in the implementation case of the present invention

[0092] Figure 3 Steps for decrypting data for embedded data protection processing in the implementation case of the present invention

[0093] Figure 4 Support functions and response functions in the implementation case of the present invention DETAILED DESCRIPTION

[0094] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0095] The present invention provides an embedded data protection processing system that is combined with an external security encryption chip and an NVME solid-state storage device to solve the problems of the background technology. In one embodiment, the system structure block diagram is as follows: Figure 1In this application environment, an external security encryption chip is arranged between a main computer device and an NVME solid-state storage device, so that data interaction between the main computer device and the NVME solid-state storage device needs to pass through the external security encryption chip, wherein the connection relationship between the external security encryption chip and the main computer device and the NVME solid-state storage device can be that the encryption chip is connected to the main computer device and the NVME solid-state storage device through a USB TYPE-C interface respectively. Among them, the host computer device can be a host computer CPU or a host computer bus adapter (HBA), and the NVME solid-state storage device is an SSD NVME large-capacity solid-state hard disk. The connection of the external security encryption chip requires the host computer device and the NVME solid-state storage device to exchange data through the external security encryption chip. It should be noted that although the host computer device and the NVME solid-state storage device exchange data through the external security encryption chip, the external security encryption chip is bidirectionally transparent to the host computer device and the NVME solid-state storage device, that is, when the host computer device interacts with the external security encryption chip, it will think that it is directly interacting with the NVME solid-state storage device, and when the NVME solid-state storage device interacts with the external security encryption chip, it will think that it is directly interacting with the host computer device, because the external security encryption chip will be based on relevant interface protocols, such as SAS (Serial Attached SCSI, serial SCSI technology), SATA (Serial ATA, also known as serial hard disk), PCIe (peripheral component interconnect express, a high-speed serial computer expansion bus standard), NVMe (a protocol for communication between Host and SSD), and other interface protocols are used for the NVME solid-state storage device to interact with the host computer device (such as exchanging data / commands), and the host computer device interacts with the NVME solid-state storage device based on relevant interface protocols.

[0096] Since the external security encryption chip is transparent to the host computer device, when the system starts, the BIOS can detect the NVME solid-state storage device connected to the external security encryption chip, but will not detect the external security encryption chip separately, so there is no need to write a corresponding driver specifically for the external security encryption chip; also because the external security encryption chip is transparent to the host computer device, the external security encryption chip can be free from the control and intervention of the host computer device and the BIOS, and can independently encrypt the relevant data from the host computer device, such as the data to be written to the NVME solid-state storage device, through the private key generated by the external security encryption chip, and decrypt the relevant data from the NVME solid-state storage device, such as the data read from the NVME solid-state storage device by the host computer device, through the private key generated by the external security encryption chip, so that the external security encryption chip can be used in conjunction with the CPU of the host computer using any architecture, thereby expanding the scope of application of the external security encryption chip. In addition, the external security encryption chip is equipped with a functional module with a built-in SM2 encryption algorithm, so it does not rely on the TPM security chip on the motherboard when encrypting or decrypting data. On the one hand, this can avoid dependence on a few BIOS suppliers and OEM integrators on the market. On the other hand, when applied, each NVME solid-state storage device is equipped with an external security encryption chip. Each external security encryption chip uses an independent security key. In this way, even if the security keys of some NVME solid-state storage devices are stolen or cracked, the data security of other NVME solid-state storage devices is guaranteed, which greatly improves the security and robustness of the entire system. It can be achieved without performance loss. The encryption algorithms such as SM2 / 3 can be embedded in any general NVME solid-state storage device (such as solid-state hard disks, etc.) to provide hardware-level data protection capabilities.

[0097] The embedded data protection processing data encryption steps provided in this embodiment are as follows: Figure 2 As shown below, this method is applied to Figure 1 This article takes the external security encryption chip in as an example.

[0098] like Figure 2 As shown, the method comprises the following steps:

[0099] Step 1: When receiving the data write indication information and write data sent by the host computer device, respond to the host computer device according to the data write indication information through the NVME solid-state storage device.

[0100] Step 2: Encrypt the written data using the private key generated by the external encryption chip.

[0101] Step three: Send the data write indication information and the encrypted write data to the NVME solid-state storage device through the host computer device, so that the NVME solid-state storage device stores the encrypted write data in response to the data write indication information.

[0102] In this embodiment, the external security encryption chip interacts with the host computer device through the NVME solid-state storage device, and the host computer device interacts with the NVME solid-state storage device, so that the external security encryption chip is transparent to the host computer device and the NVME solid-state storage device, and then the external security encryption chip can be independent of the intervention of the host computer device and does not rely on the TPM security chip on the motherboard, and independently encrypts the data to be written to the NVME solid-state storage device by the host computer device through the private key generated by the external security encryption chip. Even if the host computer CPU adopts any architecture processor, the external security encryption chip can also encrypt the data to be written to the NVME solid-state storage device by generating a private key. The following introduces the relevant process of encrypting data with the external security encryption chip.

[0103] After receiving the data sent by the main computer device, the external security encryption chip will identify the data from the main computer device that needs to be encrypted (hereinafter referred to as encrypted data) and the data that does not need to be encrypted (hereinafter referred to as non-encrypted data), and then encrypt the encrypted data using the private key generated by the external security encryption chip to obtain encrypted data. After that, the main computer device sends the non-encrypted data and the encrypted data to the NVME solid-state storage device. The NVME solid-state storage device will automatically perform corresponding data storage operations after receiving the non-encrypted data and the encrypted data. In a scenario where the host computer device is to write data into the NVME solid-state storage device, the data from the host computer device obtained by the external security encryption chip may include data write indication information and write data, the data write indication information is data that does not need to be encrypted by the private key generated by the external security encryption chip, and includes a data write command (i.e., a CMD command) and a data write address, and the write data refers to the data that the host computer device wants to write into the NVME solid-state storage device, the external security encryption chip needs to encrypt it by the private key, and the external security encryption chip will send it to the NVME solid-state storage device for storage after encrypting it by the private key, so that the data stored in the NVME solid-state storage device are all encrypted by the private key generated by the external security encryption chip, and the security of the data is guaranteed. Further, since the data written into the NVME solid-state storage device by the host computer device will be encrypted by the private key generated by the external security encryption chip, when the host computer device wants to read data from the NVME solid-state storage device, the external security encryption chip needs to first decrypt the data read from the NVME solid-state storage device by the private key generated by the external security encryption chip and then feed it back to the host computer device.

[0104] The following is an introduction to the process of generating a private key for an external security encryption chip to decrypt and read data.

[0105] The embedded data protection processing decryption data steps in the implementation case of the present invention are as follows: Figure 3 As shown, in a scenario where the host computer device wants to read data from the NVME solid-state storage device, the method further includes the following steps:

[0106] Step 1: When obtaining data reading indication information from the host computer device, the NVME solid-state storage device responds to the host computer device according to the data reading indication information;

[0107] Step 2: The host computer device sends data reading instruction information to the NVME solid-state storage device;

[0108] Step 3: After obtaining the read data fed back by the NVME solid-state storage device in response to the data read indication information, decrypt the read data using a private key generated by an external security encryption chip;

[0109] Step 4: The NVME solid-state storage device feeds back the read data decrypted by the private key generated by the external security encryption chip to the host computer device.

[0110] In a scenario where the host computer device wants to read data from the NVME solid-state storage device, the data from the host computer device obtained by the external security encryption chip may include data read indication information, which is data that does not need to be encrypted by the external security encryption chip, and includes a data read command (i.e., a CMD command for instructing the NVME solid-state storage device to write data) and a data read address. Since the data read indication information is data that does not need to be encrypted, the external security encryption chip does not need to encrypt the data read indication information, and can directly send it to the NVME solid-state storage device through the host computer device. After receiving the data read indication information, the NVME solid-state storage device will feedback to the external security encryption chip the read data obtained according to the data read address in response to the data read command, wherein the read data is the data that the host computer device, which has been encrypted by the private key generated by the external security encryption chip, wants to write into the NVME solid-state storage device. After obtaining the read data fed back by the NVME solid-state storage device, the external security encryption chip first decrypts it using the private key generated by the external security encryption chip, and then feeds back the decrypted read data obtained by the generated private key decryption process to the host computer device through the NVME solid-state storage device to ensure that the host computer device can use the obtained data normally. The decryption process of the read data by the external security encryption chip using the generated private key is also transparent to the host computer device and the NVME solid-state storage device.

[0111] Furthermore, when the external security encryption chip encrypts the written data by the generated private key, the SM2 encryption algorithm is first run to generate a first private key for encryption, and then the written data is encrypted according to the first private key. When the external security encryption chip decrypts the read data, the SM2 encryption algorithm is first run to generate a second private key for decryption, and then the read data is decrypted according to the second private key.

[0112] In the above-mentioned external security encryption chip encrypting written data or decrypting read data, the built-in encryption algorithm used by the encryption chip when encrypting written data by a private key or decrypting read data by a private key can be selected according to the specific application scenario. In this embodiment, the national secret algorithm SM2 algorithm is preferably selected as the encryption algorithm, and an international algorithm such as the DES algorithm can also be selected as the encryption algorithm. The process of encrypting and decrypting data using the encryption algorithm can refer to the instructions for use of the specific encryption algorithm used, and will not be repeated here.

[0113] Furthermore, in the related process of encrypting written data or decrypting read data by the above-mentioned external security encryption chip, the interface protocol used when the external security encryption chip interacts with the host computer device is USB TYPE-C, and the interface protocol used when the external security encryption chip interacts with the NVME solid-state storage device is high-speed SPI or high-speed UART. When the interface type of the NVME solid-state storage device does not meet the system requirements, the external security encryption chip can add a device for converting the interface type to the connected NVME solid-state storage device according to the system requirements (for example, PCIe to high-speed SPI or high-speed UART). This method is a common practice and will not be repeated here.

[0114] When the external security encryption chip receives a command from the host computer device, it converts it into a command that the NVME solid-state storage device can recognize and process. Similarly, when the external security encryption chip receives a command from the NVME solid-state storage device, it converts it into a command that the host computer device can recognize and process.

[0115] For example, in a scenario where a host computer device wants to write data in an NVME solid-state storage device, the steps of an external security encryption chip sending data write indication information and write data encrypted by a private key to the NVME solid-state storage device through the host computer device include: identifying the command type of the data write instruction information included in the data write instruction information; when it is determined that the command type of the data write command is a command type that the NVME solid-state storage device can process, sending the data write indication information and the write data encrypted by the private key to the NVME solid-state storage device through the host computer device; when it is determined that the command type of the data write command is not a command type that the NVME solid-state storage device can process, processing the command type of the data write command into a command type that the NVME solid-state storage device can process, and sending the processed data write command, data write address and write data encrypted by the private key to the NVME solid-state storage device through the behavior of the host computer device.

[0116] For another example, in a scenario where a host computer device wants to read data from an NVME solid-state storage device, the step of sending data read indication information to the NVME solid-state storage device through the host computer device includes: identifying the command type of the data read command included in the data read indication information; when it is determined that the command type of the data read command is a command type that the NVME solid-state storage device can process, sending the data read indication information to the NVME solid-state storage device through the host computer device; when it is determined that the command type of the data read command is not a command type that the NVME solid-state storage device can process, processing the command type of the data read command into a command type that the NVME solid-state storage device can process, and sending the processed data read command and data read address to the NVME solid-state storage device through the host computer device.

[0117] In the above scenario, the interface protocol used by the external security encryption chip for the host computer device is USB TYPE-C, and the interface protocol used for the NVME solid-state storage device is high-speed SPI or high-speed UART. The data write command and data read command sent by the host computer device to the external security encryption chip are generated by it based on the USB TYPE-C interface protocol. The external security encryption chip needs to convert the data write command and data read command into commands that can be processed by the NVME solid-state storage device based on the high-speed SPI or high-speed UART interface protocol, so that the NVME solid-state storage device can successfully respond to the data write command or data read command to perform subsequent storage data or read data related operations. This can improve the compatibility of the system on the one hand, and enhance the independence of the NVME solid-state storage device on the other hand. Its use / deployment is not restricted by the CPU and BIOS manufacturers of the host computer, but is completely provided by the NVME solid-state storage device manufacturer directly to customers using NVME solid-state storage devices, including certain customized services.

[0118] Furthermore, the number of host computer devices and NVME solid-state storage devices connected to the external security encryption chip can be adjusted according to the needs of different application scenarios. For example, an external security encryption chip can be used to connect a host computer device and an NVME solid-state storage device, or to connect multiple host computer devices and an NVME solid-state storage device (for example, two CPUs can be connected in a dual-processor server).

[0119] In another embodiment, the external security encryption chip can have three working modes: full-transmission mode, data protection processing mode and full-lock mode. The relevant processing process in the data protection processing mode of the external security encryption chip is the above content of this embodiment, which will not be repeated here. In the full-transmission mode, the external security encryption chip does not play any encryption and decryption role and becomes a complete path between the main computer device and the NVME solid-state storage device. The main computer device can directly read and write the NVME solid-state storage device. In the full-lock mode, the connection between the main computer device and the NVME solid-state storage device is completely cut off. The full-transmission and full-lock modes can be applied in special scenarios. For example, the full-transmission mode can be used in scenarios where the user (or customer) needs to turn off the encryption / decryption function to directly read and write the memory, such as system debugging, fault diagnosis or using other encryption methods. The full-lock mode can maximize the protection of important data, so it can be used when the user needs to completely block any machine from reading and writing the NVME solid-state storage device, such as when the outside world attempts to maliciously read and write the NVME solid-state storage device, or when transferring or saving the NVME solid-state device.

[0120] Furthermore, in another embodiment, the data write indication information and write data sent by the host computer device and received by the external security encryption chip are sent by the first security encryption chip to the external security encryption chip through the host computer device. The first security encryption chip is a chip that is identical to the external security encryption chip and is connected in series between the external security encryption chip and the host computer device. The write data is data encrypted with a private key generated by the first security encryption chip.

[0121] In another embodiment, the read data fed back by the NVME solid-state storage device and received by the external security encryption chip is data sent to the external security encryption chip by the second security encryption chip through the NVME solid-state storage device. The second security encryption chip is a chip identical to the external security encryption chip and is connected in series between the external security encryption chip and the NVME solid-state storage device. The read data is data decrypted by a private key generated by the second security encryption chip.

[0122] In the case of extremely high requirements for data security, external security encryption chips can be structurally superimposed to achieve multiple encryption. For example, multiple (such as 2, 3, 4, or even more) encryption chips are physically connected in series between the host computer device and the NVME solid-state storage device (the number of chips is not limited in this implementation and can be determined by the user according to actual needs), wherein the working process of each external security encryption chip is the same as the above content of this embodiment, because each external security encryption chip can interact with the NVME solid-state storage device through the host computer device. Therefore, it can be understood that in this case, the data write indication information and write data sent by the host computer device received by the external security encryption chip may not come directly from the host computer device, but are simulated by another external security encryption chip (i.e., the first encryption chip) directly connected in series with it as sent by the host computer device. At this time, the write data is data that has been encrypted with the private key generated by the other encryption chip (please refer to the above content for the encryption process); similarly, the read data fed back by the NVME solid-state storage device received by the external security encryption chip may not come directly from the NVME solid-state storage device, but is sent by another encryption chip directly connected in series with it to simulate an NVME solid-state storage device (i.e., the second encryption chip). At this time, the read data is data that has been decrypted with the private key generated by the other external security encryption chip (please refer to the above content for the decryption process); and, at this time, the encryption algorithms used by different external security encryption chips can be the same or different. If they are different, the security of the data finally written to the NVME solid-state storage device can be further improved.

[0123] Furthermore, the external security encryption chip is compatible with various CPUs including the X86 architecture, and can be used in series with various TPM chips on the existing motherboard to achieve double encryption. In other words, the write data received by any encryption chip at this time is actually data that has been encrypted by the TPM chip (whether the data received by the encryption chip has been encrypted by the TPM chip or other encryption chips will not affect the working process of the encryption chip itself). When the external security encryption chip is used in a superimposed manner, it can also be used in series with the TPM chip to further improve the security of the data. It can be understood that in this scenario, the external security encryption chip does not affect the existing operation mode of the inherent host computer device and NVME solid-state storage device. No additional coordination process is required for superposition. The superimposed external security encryption chip automatically performs multi-layer encryption and decryption on the data stream. This process is as direct as connecting multiple rectifiers in series in a circuit.

[0124] Figure 2 and Figure 3 FIG. 1 is a flow chart of the data processing method in this embodiment. It should be understood that although Figure 2 and Figure 3The steps in the flowchart are shown in sequence as indicated by the arrows, but these steps are not necessarily executed in the order indicated by the arrows. Unless otherwise specified in this document, there is no strict order restriction for the execution of these steps, and these steps can be executed in other orders. Moreover, Figure 2 and Figure 3 At least part of the steps may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily executed at the same time, but can be executed at different times. The execution order of these sub-steps or stages is not necessarily sequential, but can be executed in turn or alternately with other steps or at least part of the sub-steps or stages of other steps.

[0125] In one embodiment, the external security encryption chip is connected to the host computer device and the NVME solid-state storage device through an interface, and the external security encryption chip specifically includes hardware such as a first data buffer, an encryption and decryption module, and a second data buffer. The first data buffer is used to interact with the host computer device through a USB TYPE-C interface, and the second data buffer is used to interact with the NVME solid-state storage device through a high-speed SPI or high-speed UART interface. The encryption and decryption module is used to generate a private key for encryption processing of the write data from the host computer device and to generate a private key for decryption processing of the read data from the NVME solid-state storage device. Among them, the first data buffer can identify the data write indication information (or data read indication information) sent by the host computer device and according to the USB TYPE-C interface protocol, the host computer device thinks that it is directly interacting with the NVME solid-state storage device. Similarly, the second data buffer can identify the data sent by the NVME solid-state storage device and respond to the data sent by the NVME solid-state storage device according to the high-speed SPI or high-speed UART interface protocol, so that the NVME solid-state storage device thinks that it is directly interacting with the host computer device.

[0126] The following introduces the interaction process between the first data buffer, the encryption and decryption module and the second data buffer in different scenarios.

[0127] In the scenario where the host computer device wants to write data in the NVME solid-state storage device, the interaction process between the first data buffer, the encryption and decryption module and the second data buffer:

[0128] The first data buffer is used to respond to the host computer device according to the data write indication information and the write data from the host computer device through the NVME solid-state storage device, and send the data write indication information and the write data to the encryption and decryption module; (for the description of the data write indication information and the write data, please refer to the relevant description in the above embodiment, which will not be repeated here)

[0129] An encryption and decryption module, configured to generate a private key for encrypting the written data after receiving the data writing indication information and the written data sent by the first data buffer, and send the data writing indication information and the encrypted written data to the second data buffer;

[0130] The second data buffer is used to send the data write indication information from the encryption and decryption module and the write data encrypted by the private key to the NVME solid-state storage device through the main computer device, so that the NVME solid-state storage device stores the encrypted write data in response to the data write indication information.

[0131] In this embodiment, the first data buffer interacts with the host computer device and the second data buffer interacts with the NVME solid-state storage device, so that the encryption and decryption module is transparent to the host computer device and the NVME solid-state storage device. Both the host computer device and the NVME solid-state storage device think that they are directly interacting with each other. Therefore, the encryption and decryption module can be independent of the intervention of the host computer device and does not rely on the TPM security chip on the motherboard. The data to be written to the NVME solid-state storage device by the host computer device is encrypted by a private key. The host computer CPU adopts any processor architecture, and the external security encryption chip can also encrypt the data to be written to the NVME solid-state storage device by a private key. In the scenario where the host computer device wants to read data from the NVME solid-state storage device, the interaction process between the first data buffer, the encryption and decryption module and the second data buffer is:

[0132] The first data buffer is further used to respond to the host computer device according to the data reading instruction information through the NVME solid-state storage device when obtaining the data reading instruction information sent by the host computer device, and send the data reading instruction information to the encryption and decryption module, so that the encryption and decryption module sends the data reading instruction information to the second data buffer;

[0133] The second data buffer is further used to send the data reading indication information from the encryption and decryption module to the NVME solid-state storage device through the host computer device, so that the NVME solid-state storage device responds to the data reading indication information and sends the read data to the encryption and decryption module after obtaining the read data fed back by the NVME solid-state storage device; (for the description of the data reading indication information and the read data, please refer to the relevant description in the above embodiment, which will not be repeated here)

[0134] The encryption and decryption module is also used to decrypt the read data using the generated private key after receiving the read data sent by the second data buffer, and send the decrypted read data to the first data buffer, so that the first data buffer feeds back the decrypted read data to the main computer device through the NVME solid-state storage device.

[0135] In this embodiment, since the data read indication information is data that does not need to be encrypted by generating a private key through an external security encryption chip, the encryption and decryption module does not need to encrypt the data read indication information, and can be directly sent to the second data buffer, which is sent to the NVME solid-state storage device by the second data buffer. After receiving the data read indication information, the NVME solid-state storage device will feedback the read data obtained according to the data read address in response to the data read command to the second data buffer. After receiving the read data, the second data buffer can respond to the NVME solid-state storage device according to the protocol for data interaction with the NVME solid-state storage device, and then send the read data to the encryption and decryption module. After obtaining the read data, the encryption and decryption module first decrypts it by generating a private key, and then sends the decrypted read data obtained by the decryption process to the first data buffer, which is fed back to the host computer device by the first data buffer to ensure that the host computer device can use the data obtained normally.

[0136] Furthermore, when the encryption and decryption module is used to encrypt write data by generating a private key, it is specifically used to encrypt write data using the SM2 encryption algorithm; when it is used to decrypt read data by generating a private key, it is specifically used to decrypt read data using the SM2 encryption algorithm.

[0137] The following is a further introduction to the data encryption / decryption process of the encryption / decryption module.

[0138] The encryption and decryption module includes a microcontroller unit (MCU) and a key generator with a built-in encryption algorithm, and the key generator is used to generate a private key for encryption or decryption. When the encryption and decryption module is used to encrypt the written data by generating a private key, the microcontroller unit is used to control the key generator to run the encryption algorithm to generate a first private key for encryption, and encrypt the written data according to the first private key; when the encryption and decryption module is used to decrypt the read data, the microcontroller unit is used to control the key generator to run the encryption algorithm to generate a second private key for decryption, and decrypt the read data according to the second private key.

[0139] After the encryption / decryption module receives data write indication information or data read indication information from the first data buffer, it sends it directly to the second data buffer without processing it. When receiving write data from the first data buffer or read data from the second data buffer, the control key generator generates a private key for encryption or decryption and sends it to the data path, and encrypts the write data or decrypts the read data using the generated private key in the data path, and then sends the encrypted write data to the second data buffer or sends the decrypted read data to the first data buffer.

[0140] Furthermore, the encryption algorithm used by the encryption and decryption module to encrypt written data or decrypt read data can be selected according to the specific application scenario. In this embodiment, the national encryption algorithm SM2 is selected as the encryption algorithm, and an international algorithm such as the DES algorithm can also be selected as the encryption algorithm. The process of encrypting and decrypting data using the encryption algorithm can refer to the instructions for use of the specific encryption algorithm used, which will not be repeated here.

[0141] Furthermore, in a scenario where the USB TYPE-C interface protocol and the high-speed SPI or high-speed UART interface protocol are different, the encryption and decryption module converts the data write command and the data read command into commands that the NVME solid-state storage device can process.

[0142] In a scenario where a host computer device wants to write data in an NVME solid-state storage device, the encryption and decryption module, when used to send data write indication information and write data encrypted by generating a private key to a second data buffer, is specifically used to: identify the command type of the data write command included in the data write indication information; when it is determined that the command type of the data write command is a command type that the NVME solid-state storage device can process, send the data write indication information and the write data encrypted by generating a private key to the second data buffer; when it is determined that the command type of the data write command is not a command type that the NVME solid-state storage device can process, process the command type of the data write command into a command type that the NVME solid-state storage device can process, and send the data write address, the encrypted write data and the processed data write command to the second data buffer.

[0143] In a scenario where the host computer device wants to read data from the NVME solid-state storage device, the encryption and decryption module, when used to send the data read indication information to the second data buffer, is specifically used to: identify the command type of the data read command included in the data read indication information; when it is determined that the command type of the data read command is a command type that the NVME solid-state storage device can process, send the data read indication information to the second data buffer; when it is determined that the command type of the data read command is not a command type that the NVME solid-state storage device can process, process the command type of the data read command into a command type that the NVME solid-state storage device can process, and send the processed data read command and data read address to the second data buffer.

[0144] In the above scenario, the USB TYPE-C interface protocol is different from the high-speed SPI or high-speed UART interface protocol. The data write command and data read command sent by the host computer device are generated according to the USB TYPE-C interface protocol. The NVME solid-state storage device cannot process the data write command and data read command. Therefore, the encryption and decryption module in the encryption chip converts the data write command and data read command into commands that the NVME solid-state storage device can process according to the high-speed SPI or high-speed UART interface protocol, so that the NVME solid-state storage device can successfully respond to the data write command or data read command to perform subsequent operations related to storing or reading data. This can improve the compatibility of the system on the one hand, and enhance the independence of the NVME solid-state storage device on the other hand. Its use / deployment is not restricted by the CPU and BIOS manufacturers of the host computer, but is completely provided by the NVME solid-state storage device manufacturer directly to customers using NVME solid-state storage devices, including certain customized services.

[0145] In one embodiment, the external security encryption chip is also provided with a control port, and the encryption and decryption module also includes a special purpose module, which is a control module based on the SPI (Serial Peripheral interface) interface protocol (the module may also adopt the GPIO interface protocol or other types of special protocols customized by the manufacturer), which is used for key management and user authentication. As long as the host computer device such as the CPU or other types of Host devices have a public key, it can access the NVME solid-state storage device and decrypt the data in the NVME solid-state storage device. It can also be used to accept and execute special control instructions issued by the user through the control port (for example, it may include but is not limited to control instructions for regenerating a key pair, control instructions for obtaining a newly generated public key, control instructions for providing a user's public key, control instructions for updating firmware, control instructions for updating encryption algorithms, etc.).

[0146] In another embodiment, possible usage of the external security encryption chip is introduced. For ease of use, the external security encryption chip can be integrated into the NVME solid-state storage device before the NVME solid-state storage device leaves the factory, such as directly integrating the external security encryption chip into the hard disk PCBA (Printed Circuit Board Assembly) by the original storage product manufacturer, so that when using it, you only need to connect the USB TYPE-C interface of the encryption chip with the relevant interface of the host computer device; the USB TYPE-C interface of the external security encryption chip can be integrated into the PCBA circuit board where the interface protocol adapter chip is located in the motherboard, so that you can avoid changing the SSD solid-state hard disk device itself, and when using it, you only need to directly connect the GPIO interface of the encryption chip with the relevant interface of the storage device on the board.

[0147] In one embodiment, the external security encryption chip can have three working modes: full-transmission mode, data processing mode and full-lock mode. A firmware interface provided to the user can be set in the external security encryption chip, so that the encryption and decryption module can receive the user's working mode switching instruction through the firmware interface, and switch the currently effective working mode to the working mode corresponding to the working mode switching instruction. Specifically, the information recording the currently effective working mode can be recorded in a designated recorder set in the microcontroller. The switching instruction can be directly sent to the microcontroller, so that the microcontroller updates the relevant information in the designated recorder to achieve the switching of the working mode. For other descriptions of each mode, please refer to the embodiment. It can be seen from the above embodiments that the external security encryption chip can be used in a superimposed structure, and / or used in series with the existing TPM chip on the motherboard, that is, multiple encryption is used. Please refer to the embodiment for specific implementation details.

[0148] The present invention provides an NVME solid-state storage device. In one implementation of this embodiment, an external security encryption chip is integrated in the NVME solid-state storage device (the number of encryption chips can be multiple, and the encryption chips are connected in series). When the encryption chip is connected to a host computer device, the steps of the data protection processing method provided in the above embodiment are implemented.

[0149] The present invention provides an embedded electronic device (such as an embedded server, an Internet of Things NPC or other computing device). In one implementation of the present embodiment, the embedded electronic device includes a host computer device, an NVME solid-state storage device and an external security encryption chip, wherein the NVME solid-state storage device is connected to the host computer device through the external security encryption chip, or the external security encryption chip is integrated on the NVME solid-state storage device and connected to the host computer device; the external security encryption chip includes a memory, a 32-bit RISC embedded processor and a ROM memory, and an SM2 private key generation and SM2 encryption and decryption algorithm program that can be run on the ROM memory and on the processor supports Figure 4 Function and response function shown.

[0150] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. As an illustration and not limitation, RAM is available in many forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM).

[0151] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0152] The above-mentioned embodiments only express the implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the invention patent. It should be pointed out that, for ordinary technicians in this field, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the patent of the present application shall be subject to the attached claims.

Claims

1. An embedded data protection processing system with an external security encryption chip and an NVME solid-state storage device, characterized in that: The system is applied to an external security encryption chip; the encryption chip is matched with a data protection processing method for connecting an NVME solid-state storage device; the method comprises: (1) upon receiving the data write indication information and write data sent by the host computer, the NVME solid-state storage device responds to the host computer device according to the data write indication information through the behavior of the NVME solid-state storage device; the data write indication information includes a data write command and a data write address; a private key is generated for the write data through the external security encryption chip; it is ensured that the stored private key cannot be exported to the outside of the hardware; the data write indication information and the write data encrypted by the private key are sent to the NVME solid-state storage device through the behavior of the host computer device, so that the The NVME solid-state storage device stores the encrypted write data in response to the data write indication information; the data write indication information and the write data encrypted by the private key are sent to the NVME solid-state storage device through the behavior of the host computer device, including: identifying the command type of the data write command included in the data write indication information; when it is determined that the command type of the data write command is a command type supported by the NVME solid-state storage device, the host computer device sends the data write indication information and the encrypted write data to the NVME solid-state storage device; when it is determined that the command type of the data write command is not a command type that the NVME solid-state storage device can process, the table (1) when receiving the data read indication information sent by the host computer device, respond to the host computer device according to the data read indication information through the behavior of the NVME solid-state storage device; send the data read indication information to the NVME solid-state storage device through the host computer device; and after obtaining the response of the NVME solid-state storage device to the data read indication information, the host computer device sends the data read indication information to the NVME solid-state storage device. After receiving the read data fed back by the data read indication information, decrypting the read data; feeding back the decrypted read data to the host computer device through the behavior of the NVME solid-state storage device, wherein the data read indication information includes a data read command and a data read address; the step of sending the data read indication information to the NVME solid-state storage device through the host computer device includes: identifying the command type of the data read command included in the data read indication information; when determining that the command type of the data read command is a command type that the NVME solid-state storage device can process, the behavior of the host computer device sends the data read indication information to the NVME solid-state storage device;When it is determined that the command type of the data read command is not a command type that the NVME solid-state storage device can process, the command type of the data read command is processed into a command type that the NVME solid-state storage device can process, and the host computer device sends the processed data read command and the data read address to the NVME solid-state storage device. ; 2. An embedded data protection processing system as claimed in claim 1, which is combined with an external security encryption chip and an NVME solid-state storage device, characterized in that The external security encryption chip used includes an integrated 256KB independent flash memory space on the chip; multiple on-chip interfaces (USB TYPEC, high-speed SPI, 7816-3 and high-speed UART, etc.) connect the host computer and the NVME solid-state storage device; ensure that the stored private key cannot be exported to the outside of the entire system hardware; the private key in the security encryption chip cannot be directly read externally; the public key and the signature of the corresponding algorithm can be output; on-chip key management (including key generation, key storage, key update, etc.); the on-chip SM2 coprocessor supports the SM2 key pair generation algorithm, high-speed digital signature algorithm and identity authentication; supports low power consumption mode; the NVME solid-state storage device is a large-capacity NVME solid-state storage hard disk, and the hard disk chip includes: SSD storage control chip, S SD storage particle chip, DDR3 dynamic storage chip, power management chip (PMU), etc.; the step of encrypting the written data includes: the security encryption chip starts the RSA / SM2 algorithm engine, first generates a private key for storage, and encrypts the written data according to the private key; the step of decrypting the read data includes: running the RSA / SM2 algorithm to generate a private key for decryption, and decrypting the read data according to the private key; the encryption algorithm includes the national secret algorithm SM2 and / or the international algorithm; the method also includes: receiving the user's control instruction to update the encryption algorithm.

3. The embedded data protection processing system of claim 1, which is combined with an external security encryption chip and an NVME solid-state storage device, is characterized in that: (1) upon receiving the data write indication information and write data sent by the host computer device, responding to the host computer device according to the data write indication information through the NVME solid-state storage device; encrypting the write data through the private key generated by the RSA / SM2 algorithm engine REAE algorithm of the external security encryption chip; sending the data write indication information and the encrypted write data to the NVME solid-state storage device through the host computer device, so that the NVME solid-state storage device stores the encrypted write data in response to the data write indication information, including: upon receiving the data write indication information and write data sent by the host computer device, determining that the effective working mode is the data protection processing mode; upon determining that the current effective working mode is the data protection processing mode, responding to the host computer device according to the data write indication information through the NVME solid-state storage device; encrypting the write data through the private key; sending the data write indication information and the encrypted write data to the NVME solid-state storage device through the behavior of the host computer device, so that the NVME solid-state storage device stores the encrypted write data in response to the data write indication information; (2) The method comprises: when receiving the data read indication information sent by the host computer device, responding to the host computer device according to the data read indication information through the NVME solid-state storage device; sending the data read indication information to the NVME solid-state storage device through the host computer device; after obtaining the read data fed back by the NVME solid-state storage device in response to the data read indication information, decrypting the read data through the private key provided by the external security encryption chip; and feeding back the decrypted read data to the host computer device through the NVME solid-state storage device, including: when receiving the data read indication information sent by the host computer device, determining the data processing mode; when determining that the working mode is the data processing mode, responding to the host computer device according to the data read indication information through the NVME solid-state storage device; sending the data read indication information to the NVME solid-state storage device through the behavior of the host computer device; after obtaining the read data fed back by the NVME solid-state storage device in response to the data read indication information, decrypting the read data through the private key generated by the external security encryption chip; and feeding back the decrypted read data to the host computer device through the NVME solid-state storage device.

4. The embedded data protection processing system of claim 1, which is combined with an external security encryption chip and an NVME solid-state storage device, is characterized in that: The key is stored on an external medium of the NVME solid-state storage device, and the system includes an NVME solid-state storage system, a key and an identity authentication system; the NVME solid-state storage system includes an encryption and decryption processing unit; A read-only storage area is provided in the NVME solid-state storage device, and the identity authentication system is stored in the read-only storage area of ​​the NVME solid-state storage device; after the host computer is powered on, the NVME solid-state storage device will first start the identity authentication system; the NVME solid-state storage device includes one or more user storage areas, and the private key can be one or more; one user storage area corresponds to one or more private keys, or one private key corresponds to one or more user areas.

5. The embedded data protection processing system of claim 1, which is combined with an external security encryption chip and an NVME solid-state storage device, is characterized in that: The data write indication information and write data sent by the main computing device and received by the external security encryption chip are sent to the encryption chip by the first security encryption chip through the main computer device. The first external security encryption chip is a chip that is connected in series between the external security encryption chip of the embedded system and the main computer device, and is the same as the external security encryption chip. The write data is data encrypted by the private key generated by the first security encryption chip; the read data fed back by the NVME solid-state storage device and received by the external security encryption chip is data sent to the encryption chip by the second security encryption chip through the NVME solid-state storage device. The second security encryption chip is a chip that is connected in series between the external security encryption chip and the NVME solid-state storage device, and is the same as the external security encryption chip. The read data is data decrypted by the private key generated by the second security encryption chip; the write data sent by the main computer device is data encrypted by one or more external security encryption chips integrated on the motherboard where the main computer device is located.

6. The external security encryption chip as claimed in claim 1, characterized in that: The external security encryption chip includes private key generation, RSA / SM2 algorithm engine REAE, SM1 / SSF33 and AES / DES / TDES algorithm hardware accelerators that can realize high-speed data encryption and decryption, SM2 coprocessor and RSA / ECC coprocessor that can realize high-speed digital signature and identity authentication, support SM3 software implementation, on-chip SHA engine, interface for connecting to the host computer device and interface for connecting to NVME solid-state storage device inside the embedded system; the data encryption and decryption module includes a first data buffer, an encryption and decryption module and a second data buffer; the first data buffer is used to receive the data write indication information and write data sent by the host computer device, The NVME solid-state storage device responds to the host computer device according to the data write indication information, and sends the data write indication information and the write data to the encryption and decryption module; the data write indication information includes a data write command and a data write address; the encryption and decryption module is used to encrypt the write data by a private key after receiving the data write indication information and the write data sent by the first data buffer, and send the data write indication information and the encrypted write data to the second data buffer; the second data buffer is used to send the data write indication information and the encrypted write data from the encryption and decryption module to the NVME solid-state storage device through the host computer device. The NVME solid-state storage device stores the encrypted write data in response to the data write indication information; the encryption / decryption module is used to send the data write indication information and the encrypted write data to the second data buffer, specifically to: identify the command type of the data write command included in the data write indication information; when determining that the command type of the data write command is a command type that the NVME solid-state storage device can process, send the data write indication information and the encrypted write data to the second data buffer; when determining that the command type of the data write command is not a command type that the NVME solid-state storage device can process, The first data buffer is further configured to respond to the host computer device according to the data read indication information through the behavior of the NVME solid-state storage device when receiving the data read indication information sent by the host computer device, and send the data read indication information to the encryption and decryption module, so that the encryption and decryption module sends the data read indication information to the second data buffer;The second data buffer is also used to send the data read indication information from the encryption / decryption module to the NVME solid-state storage device through the host computer device, so that the NVME solid-state storage device responds to the data read indication information for feedback, and sends the read data to the encryption / decryption module after obtaining the read data fed back by the NVME solid-state storage device; the encryption / decryption module is also used to decrypt the read data after receiving the read data sent by the second data buffer, and send the decrypted read data to the first data buffer, so that the first data buffer feeds back the decrypted read data to the host computer device through the behavior of the NVME solid-state storage device; the encryption / decryption module is used to generate a private key for the write data When the encryption key is used for encryption, it is specifically used to encrypt the written data using the RSA / SM2 algorithm; when the encryption / decryption module is used for decrypting the read data, it is specifically used to decrypt the read data using the RSA / SM2 algorithm; the encryption / decryption module includes an on-chip microcontroller unit and a key generator with the SM2 algorithm built in; when the encryption / decryption module is used for encrypting the written data, the on-chip microcontroller unit is used to control the key generator to run the SM2 algorithm to generate a first private key, and encrypt the written data according to the first private key; when the encryption / decryption module is used for decrypting the read data, the on-chip microcontroller unit is used to control the key generator to run the SM2 algorithm to generate a second private key, and decrypt the read data according to the second private key. ; 7. The external security encryption chip as claimed in claim 6, characterized in that: The encryption algorithm includes a national encryption algorithm and / or an international algorithm; the encryption chip also includes a control port and a special purpose module; the special purpose module is used to receive user control instructions through the control port to update the preset SM2 algorithm.

8. The embedded data protection processing system of claim 1, which is combined with an external security encryption chip and an NVME solid-state storage device, is characterized in that: The host computer device includes a host computer central processing unit or a host computer bus adapter.

9. The embedded data protection processing system of claim 1, which is combined with an external security encryption chip and an NVME solid-state storage device, is characterized in that: The NVME solid-state storage device includes an SSD NVME solid-state storage hard disk.

10. The embedded data protection processing system of claim 1, which is combined with an external security encryption chip and an NVME solid-state storage device, is characterized in that: The interfaces include USB Type C, high-speed SPI, 7816-3, high-speed UART, etc.

Images