Data processing method and device and related equipment

Abstract

The invention provides a data processing method and device and related equipment, the method is applied to the technical field of computers, and the method comprises the following steps: in response to a first operation performed on data in a data transmitter, determining first target data corresponding to the first operation; the first operation comprises a modification operation and / or a write-in operation; generating encrypted information according to the first target data; and encrypting the first target data according to the encryption information, and storing the encrypted first target data to the data transmitter. Thus, the corresponding encryption information is generated according to the modified and / or written first target data, the uniqueness of the encryption information is improved, the target data is encrypted by using the encryption information, the security of the data is improved, unauthorized access or tampering is prevented, the confidentiality and integrity of the data in the storage and transmission process are ensured, and the security of the data is improved. And data leakage and security risks are reduced.

Description

Technical Field

[0001] The present disclosure relates to the field of computer technology, and in particular to a data processing method, apparatus and related equipment. Background Art

[0002] A solid-state drive is a storage device based on flash memory technology. Its core components include flash memory chips, main control chips, cache, and power management modules. NAND flash chips are the core components of solid-state drives (SSDs, Solid State Disks or Solid State Drives) for storing data. All data is stored in these chips. The main control chip is responsible for managing data read and write operations and storage mapping. The cache is used to store temporary data and accelerate data read and write performance. The power management module is responsible for regulating the voltage and providing stable power to each component. Firmware is embedded software that runs in the main control chip to control data transmission and hard disk management. The interface is a bridge between the hard disk and the host.

[0003] On the server, the Universal Serial Bus (USB) interface is located on the outer edge of the motherboard. The USB interface can be used to connect peripherals (such as mouse, keyboard, and mobile storage such as hard disk). The USB interface is usually connected to the USB control chip of the motherboard through the circuit on the motherboard. The USB controller transmits the decoded signal to the PCH (the integration of the south bridge chip, now the PCH is widely used, and the south bridge chipset is gradually not used), where the data is further classified, scheduled, and transmitted to the central processing unit (CPU) through the high-speed serial computer expansion bus standard (PCIe, peripheral component interconnect express) channel or other buses.

[0004] In the related technology, data encryption technology can be divided into two categories: software encryption and hardware encryption. Software encryption uses encryption software to logically encrypt the data of the storage device. The typical encryption algorithm used includes Advanced Encryption Standard (AES). The common bit number is 128 bits or 256 bits. Users need to install the software and enter the password to unlock or access the data. Software encryption mainly relies on the CPU of the computing device to process encryption operations. Hardware encryption is to encrypt and decrypt data directly at the hardware level, which is faster and safer. Hardware encryption is usually completed by a dedicated encryption chip without relying on the host device; hardware encryption usually uses AES 256-bit encryption.

[0005] When using the above encryption method, the corresponding key must be designed by yourself for each encryption and decryption, and the key needs to be stored in the device, which greatly increases the risk of the key being stolen or reverse engineered. Summary of the invention

[0006] The present disclosure provides a data processing method, apparatus and related equipment to at least solve the above technical problems existing in the prior art.

[0007] The technical solution of the embodiment of the present disclosure is implemented as follows: In a first aspect, an embodiment of the present disclosure provides a data processing method, which is applied to an electronic device, and includes: In response to performing a first operation on the data in the data transmission device, determining first target data corresponding to the first operation; the first operation includes a modification operation and / or a write operation; Generate encryption information according to the first target data; encrypt the first target data according to the encryption information, and save the encrypted first target data to the data transmitter.

[0008] In a second aspect, an embodiment of the present disclosure provides a data processing device, which is applied to an electronic device, and includes: A first processing module, configured to determine first target data corresponding to a first operation performed on data in the data transmitter in response to the first operation being performed on the data in the data transmitter; the first operation includes a modification operation and / or a write operation; A second processing module, used for generating encryption information according to the first target data; The third processing module is used to encrypt the first target data according to the encryption information, and save the encrypted first target data to the data transmitter.

[0009] In the above solution, generating encrypted information according to the first target data includes: Each data frame in the first target data is used as a random stimulus to input into the APUF circuit, and a response corresponding to each of the data frames is obtained as encrypted information.

[0010] In the above solution, encrypting the first target data according to the encryption information includes: Each data frame in the first target data is encrypted according to the response corresponding to each data frame in the encryption information.

[0011] In the above solution, the step of saving the encrypted first target data to the data transmitter includes: adding a random stimulus for determining the encrypted information to a specific field of the encrypted first target data; The first target data after adding the random excitation is saved in the data transmitter.

[0012] In the above scheme, the method comprises: In response to performing a second operation on the data in the data transmitter, determining second target data corresponding to the second operation; the second operation includes a read operation; Determine decryption information according to the second target data; decrypt the second target data according to the decryption information to obtain the decrypted second target data.

[0013] In the above solution, determining the decryption information according to the second target data includes: A random excitation is acquired in a specific field of the second target data.

[0014] In the above solution, decrypting the second target data according to the decryption information includes: Inputting the random stimulus into an APUF circuit to obtain a response corresponding to the random stimulus; The second target data is decrypted according to the response.

[0015] In the above solution, the APUF circuit includes: N switches, an arbitrator, a first circuit and a second circuit; the first circuit and the second circuit are completely symmetrical; N is a positive integer greater than or equal to 1; Taking each data frame in the first target data as a random stimulus and inputting it into the APUF circuit, obtaining a response corresponding to each of the data frames, including: Determine an input signal corresponding to each of the N switches according to the data frame, input the input signal corresponding to each switch to the corresponding switch, and control the first circuit and the second circuit to be directly connected or cross-connected according to the input signal; The arbitrator determines an arrival order of the signal of the first circuit and the signal of the second circuit, and outputs a response according to the arrival order.

[0016] In the above solution, the data transmitter is a mobile storage device connected to the electronic device.

[0017] In a third aspect, an embodiment of the present disclosure provides a controller, the controller comprising: A processing unit, configured to determine first target data corresponding to a first operation in response to performing a first operation on data in the data transmitter; the first operation includes a modification operation and / or a write operation; an encryption and decryption unit, configured to generate encryption information according to the first target data; The processing unit is further configured to encrypt the first target data according to the encryption information, and save the encrypted first target data to the data transmitter.

[0018] In the above scheme, the encryption and decryption unit includes an APUF circuit; the APUF circuit includes: N switches, an arbitrator, a first circuit and a second circuit; the first circuit and the second circuit are completely symmetrical; N is a positive integer greater than or equal to 1; Each of the N switches is used to control the first circuit and the second circuit, which are completely symmetrical, to be directly connected or cross-connected at the switch; The arbitrator is used to determine the arrival sequence of the signal of the first circuit and the signal of the second circuit, and output a response according to the arrival sequence.

[0019] In the above solution, the processing unit is used to determine the second target data corresponding to the second operation in response to performing a second operation on the data in the data transmitter; the second operation includes a read operation; The encryption and decryption unit is used to determine decryption information according to the second target data; The processing unit is further configured to decrypt the second target data according to the decryption information to obtain the decrypted second target data.

[0020] In a fourth aspect, an embodiment of the present disclosure provides an electronic device, comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute any one of the data processing methods described.

[0021] In a fifth aspect, an embodiment of the present disclosure provides a non-transitory computer-readable storage medium storing computer instructions, wherein the computer instructions are used to enable a computer to execute any of the data processing methods described above.

[0022] The embodiments of the present disclosure have the following beneficial effects: The data processing method, device and related equipment provided by the embodiments of the present disclosure are applied, and the method includes: in response to performing a first operation on the data in the data transmitter, determining the first target data corresponding to the first operation; the first operation includes a modification operation and / or a write operation; generating encryption information according to the first target data; encrypting the first target data according to the encryption information, and saving the encrypted first target data to the data transmitter. In this way, the corresponding encryption information is generated according to the modified and / or written first target data, and the encryption information can be obtained without human design, and the uniqueness of the encryption information is improved. The target data is encrypted using the encryption information, which improves the security of the data, prevents unauthorized access or tampering, ensures the confidentiality and integrity of the data during storage and transmission, and reduces data leakage and security risks.

[0023] It should be understood that the content described in this section is not intended to identify the key or important features of the embodiments of the present disclosure, nor is it intended to limit the scope of the present disclosure. Other features of the present disclosure will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] Figure 1 A flowchart of a data processing method provided by an embodiment of the present disclosure; Figure 2 A schematic diagram of the structure of a controller provided in an embodiment of the present disclosure; Figure 3 A schematic diagram of the structure of an APUF circuit provided in an application embodiment of the present disclosure; Figure 4 A schematic diagram of the principle of an encryption method provided for an application embodiment of the present disclosure; Figure 5 A schematic diagram of the principle of a decryption method provided for an application embodiment of the present disclosure; Figure 6 A schematic diagram of the structure of a data processing device provided in an embodiment of the present disclosure; Figure 7 A schematic diagram of the structure of an electronic device provided in an embodiment of the present disclosure. DETAILED DESCRIPTION

[0025] In order to make the purpose, features, and advantages of the present disclosure more obvious and easy to understand, the technical solutions in the embodiments of the present disclosure will be clearly and completely described below in conjunction with the drawings in the embodiments of the present disclosure. Obviously, the described embodiments are only part of the embodiments of the present disclosure, not all of the embodiments. Based on the embodiments in the present disclosure, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present disclosure.

[0026] In the following description, reference is made to “some embodiments”, which describe a subset of all possible embodiments, but it can be understood that “some embodiments” may be the same subset or different subsets of all possible embodiments and may be combined with each other without conflict.

[0027] If similar descriptions of "first / second" appear in the application documents, the following instructions are added. In the following description, the terms "first\second\third" involved are merely used to distinguish similar objects and do not represent a specific ordering of the objects. It can be understood that "first\second\third" can be interchanged in a specific order or sequence where permitted, so that the embodiments of the present disclosure described herein can be implemented in an order other than that illustrated or described herein.

[0028] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by those skilled in the art to which the present disclosure belongs. The terms used herein are only for the purpose of describing the embodiments of the present disclosure and are not intended to limit the present disclosure.

[0029] Before further describing the embodiments of the present disclosure in detail, the nouns and terms involved in the embodiments of the present disclosure are described. The nouns and terms involved in the embodiments of the present disclosure are subject to the following interpretations.

[0030] 1) In response, it is used to indicate the conditions or states on which the executed operations depend. When the dependent conditions or states are met, one or more operations executed may be in real time or with a set delay. Unless otherwise specified, there is no restriction on the order in which the multiple operations executed are executed.

[0031] 2) Data: refers to information transmitted and processed in a computer system or network. It can be in the form of text, images, audio, video, etc., and usually needs to be processed, stored or transmitted to achieve information communication and sharing.

[0032] Data frame: refers to the unit with a specific structure that data is packaged into during data transmission. In network transmission, especially when the amount of data is large, the data can be divided into multiple smaller parts, called data frames.

[0033] Each data frame contains a portion of the data and necessary control information, such as address, sequence number, checksum, etc. The size of the data frame is usually limited by the network protocol and transmission medium, so big data needs to be split into multiple data frames for transmission.

[0034] 3) Operation: refers to a series of processing processes performed on data, including steps such as reading, modifying and writing.

[0035] The modification operation usually refers to changing part of the existing data, while the write operation is to save the newly generated data to the storage medium. It is not difficult to understand that before performing a modification or write operation, a read operation is usually performed first, so that the user can view and confirm the specific content of the data to ensure the accuracy of the operation.

[0036] Electronic devices are devices with a human-computer interaction interface that can realize the interaction between people and devices through input and output devices such as display screens, keyboards, and mice. These devices allow users to perform various operations on the devices through the human-computer interaction interface, including data input, display, editing, and storage. The display screen is used to display information, while the keyboard and mouse are used to input instructions and data. Through these interactive devices, users can operate on data to realize information processing and application. Therefore, the modification and writing operations during the operation process, combined with the human-computer interaction function of electronic devices, enable users to efficiently complete data management and task execution.

[0037] 4) Encryption is the process of converting original data (plaintext) into an unreadable format (ciphertext) through a specific algorithm to prevent unauthorized access. The encryption process uses a key to process the data, and only the recipient with the correct key can decrypt and restore the data.

[0038] Common encryption methods include symmetric encryption and asymmetric encryption. The former uses the same key for encryption and decryption, while the latter uses a pair of public and private keys for encryption and decryption.

[0039] Based on the above explanations of the nouns and terms involved in the embodiments of the present disclosure, the data processing method, apparatus and related equipment provided by the embodiments of the present disclosure are described below.

[0040] Figure 1 A flowchart of a data processing method provided by an embodiment of the present disclosure is shown in FIG. Figure 1 As shown, the method is applied to an electronic device, and the method may include: Step 101: In response to performing a first operation on data in a data transmission device, determining first target data corresponding to the first operation; the first operation includes a modification operation and / or a write operation; Step 102: Generate encryption information according to the first target data; encrypt the first target data according to the encryption information, and save the encrypted first target data to the data transmitter.

[0041] In some embodiments, the method can be applied to electronic devices, which can be any intelligent device, such as a server, a computer, a mobile phone, a smart phone, a laptop computer, a digital broadcast receiver, a personal digital assistant (PDA), a tablet computer (PAD), a portable multimedia player (PMP), a wearable device (such as a smart bracelet, a smart watch, etc.), a navigation device, etc.

[0042] The electronic device has an interactive interface, and the interactive interface is used to connect a mobile storage device and a network card. The mobile storage device can be a USB flash drive or other storage devices; the interactive interface can be, for example, a USB interface, a Type-C interface, a Thunderbolt, an eSATA (External SATA), an SD card slot, an M.2 interface, a SATA (Serial ATA), a PCIE interface, etc.

[0043] The above interfaces can be used to connect various storage devices according to different uses and transmission speed requirements.

[0044] In the method provided by the embodiment of the present disclosure, the data transmitter can be connected to the electronic device through any interactive interface, and when the data in the data transmitter is modified or written, the electronic device can identify the first target data corresponding to these operations. Encryption information is generated based on these target data, and the first target data is encrypted using the encryption information, and the encrypted data is finally saved in the data transmitter. In this way, the encryption information can be obtained without artificial design, and the uniqueness of the encryption information is improved, thereby realizing encryption protection of various types of first target data.

[0045] In some embodiments, the first target data may be any editable data type, including but not limited to text, pictures, audio, video, web page data, etc. There is no limitation on the specific data type, which means that the first target data may be any form of editable data according to actual needs.

[0046] Furthermore, the first target data corresponding to the first operation refers to the target data that needs to be modified or written. In other words, whether it is text, pictures, audio, video, or web page data, if they need to update, edit, add or modify the content, they all belong to the category of first target data. Therefore, regardless of the specific form of the data, the mentioned operations can be applied to any data type that needs to be edited or modified, with strong flexibility and applicability.

[0047] In some embodiments, generating encrypted information according to the first target data includes: Each data frame in the first target data is used as a random stimulus to input into the APUF circuit, and a response corresponding to each of the data frames is obtained as encrypted information.

[0048] Here, the first target data is data to be encrypted, usually some original, unencrypted data.

[0049] The data frame may be understood as a small block or unit into which the first target data is divided. The first target data may be divided into a plurality of data frames.

[0050] Here, there is no fixed limit on the size of the data frame, and it can be set according to actual needs. For example, the size of the data frame can be 128 bytes, 256 bytes, etc., or other suitable sizes. The size of the data frame is usually affected by the transmission protocol and the network environment, but its main purpose is to divide large blocks of data into small units suitable for processing.

[0051] Electronic devices have an APUF circuit, which is a special circuit that works by exploiting tiny physical differences in hardware devices that are caused by small variations in the manufacturing process, making them impossible to replicate.

[0052] Specifically, Physical Unclonable Functions (PUF) refers to a hardware security technology that is used to generate unique and uncopyable responses through physical hardware characteristics to authenticate device identity or generate encryption keys. Arbiter PUF (APUF) is a specific implementation of a physical unclonable function and is a physical security mechanism based on circuit delay differences. APUF is a mechanism that uses tiny random differences (such as delays or circuit characteristics) in the hardware manufacturing process to generate a Challenge Response Pair (CRP). These differences are inevitable in the manufacturing process, so each APUF circuit is unique and difficult to copy or forge.

[0053] Here, the APUF circuit is used for key generation. Specifically, the APUF circuit is used to generate encryption information, including: The workflow of the APUF circuit is usually as follows: Receiving an excitation signal: using each data frame in the first target data as an excitation signal; Generate response: The APUF circuit generates a corresponding response based on its unique physical characteristics. Different circuits will generate different responses due to slight physical differences within the circuit.

[0054] Output Response: The APUF circuit outputs a response output based on the stimulus signal. Here the response is unique, unpredictable, and cannot be replicated by other circuits.

[0055] The generated response is used as encryption information for data encryption.

[0056] In this way, corresponding encryption information is generated according to the first target data itself, which improves the uniqueness of the encryption information. The encryption information is used to encrypt the target data, improves the security of the data, prevents unauthorized access or tampering, ensures the confidentiality and integrity of the data during storage and transmission, and reduces data leakage and security risks.

[0057] In some embodiments, encrypting the first target data according to the encryption information includes: Each data frame in the first target data is encrypted according to the response corresponding to each data frame in the encryption information.

[0058] Here, the encryption information actually includes responses to different data frames obtained by the APUF circuit, and therefore, each data frame in the first target data is encrypted respectively using each response of the encryption information.

[0059] The APUF circuit generates a different response for each different data frame, that is, each data frame has a corresponding, unique encrypted response. Specifically, the encryption information actually includes the response generated by the APUF circuit for each data frame, which is used to encrypt each data frame in the first target data, that is, for each data frame in the first target data, there is a unique encryption key (i.e., the response generated by the APUF response), which is used to encrypt the corresponding data frame.

[0060] For example, if the first target data consists of multiple data frames, each data frame in the first target data is encrypted using the response in the encryption information, and the encryption result of each data frame generates a ciphertext block. Then, these encrypted data frames are combined into a complete encrypted data stream or data block, that is, the encrypted first target data is obtained for transmission or storage.

[0061] In this way, by assigning a unique encryption key to each data frame, the security risks brought by using a unified key can be effectively avoided. The unified key may be at risk of being cracked during the encryption process. Once the key is leaked, the security of all data will be threatened. However, the encryption method using an independent key for each data frame means that even if a key is cracked, the attacker can only obtain the information of the data frame, and the security of other data is still guaranteed, which significantly improves the overall security of encryption.

[0062] In this process, the use of APUF circuits to generate unique encryption keys plays an important role. APUF is a hardware security mechanism whose output is based on the physical characteristics of hardware circuits and is unpredictable and non-replicable. With the keys generated by APUF, each data frame has a unique encryption key that is difficult to predict or copy due to hardware characteristics, further enhancing the security of the encryption process.

[0063] By leveraging the advantages of APUF, the key generation not only ensures the uniqueness of each data frame, but also effectively prevents attacks that may be encountered by traditional software methods, such as key guessing or reuse attacks. Therefore, the encryption scheme combined with the APUF circuit can achieve more secure and efficient data encryption, and ensure data integrity and privacy during information transmission.

[0064] In some embodiments, the step of saving the encrypted first target data to the data transmission device includes: adding a random stimulus for determining the encrypted information to a specific field of the encrypted first target data; The first target data after adding the random excitation is saved in the data transmitter.

[0065] Here, the specific field may be a predefined blank field or blank area in the first target data, which may be specifically used to store the encrypted information. Here, a field of the first target data may be reserved for storing the encrypted information, which can ensure that the information can be stored together with the first target data and verified when needed.

[0066] After obtaining the encrypted first target data, the encryption information used (the response from the APUF circuit) is embedded or inserted into a specific field of the first target data, and after adding the encryption information to the first target data, the first target data containing the encryption information is saved in a data transfer device. This can be any form of removable storage medium, such as a USB flash drive, a mobile storage device, or an SD card.

[0067] In this way, only the circuit with the same hardware characteristics as the encryption process can correctly generate the key and decrypt. If the attacker cannot obtain the same hardware characteristics or key information, the data cannot be decrypted, thereby ensuring the security of the encryption system. In addition, by storing the first target data with encrypted information in the data transmitter, it is ensured that the data and its encrypted information can be easily carried and transmitted while still maintaining encryption and security.

[0068] In some embodiments, the method may further include: In response to performing a second operation on the data in the data transmitter, determining second target data corresponding to the second operation; the second operation includes a read operation; Determine decryption information according to the second target data; decrypt the second target data according to the decryption information to obtain the decrypted second target data.

[0069] Here, the second target data may be any encrypted first target data that carries a random stimulus for determining encryption information; that is, a method for decrypting the encrypted first target data is also provided in an embodiment of the present disclosure.

[0070] Here, generation of the decryption information depends on the key used in the encryption process, which information comes from the stimulus generated by the APUF circuit. Based on the obtained decryption information, the second target data can be decrypted to restore the decrypted second target data.

[0071] Since the decryption information is closely related to the parameters used during encryption (such as the key generated by the APUF), only electronic devices with the same encryption information can correctly decrypt. If the decryption information does not match the original encryption information, the decryption operation will fail and the data cannot be recovered, thus protecting the security of the data. This method ensures that only authorized devices can successfully decrypt, thereby preventing unauthorized access and data leakage.

[0072] In some embodiments, the second operation may be an operation before the modification and / or writing operation, that is, the data may be read first and then modified and / or written. Here, the modification and / or writing of the data may be performed by re-encrypting the data using the method of step 101 and step 102. After re-encryption, the encryption information carried by the second target data may be updated so that it can be read again later. It may also be an operation after the modification and / or writing operation, that is, the data may be re-read later.

[0073] In some embodiments, determining the decryption information according to the second target data includes: A random excitation is acquired in a specific field of the second target data.

[0074] Here, the specific field may be a predefined blank field or part in the second target data, such as a certain position or paragraph in the second target data, which may be specifically used to store the random excitation.

[0075] In some embodiments, decrypting the second target data according to the decryption information includes: Inputting the random stimulus into an APUF circuit to obtain a response corresponding to the random stimulus; The second target data is decrypted according to the response.

[0076] Here, since the encrypted information in the embodiment of the present disclosure is generated based on random excitation and based on the characteristics of the APUF circuit, the output response is unpredictable and unique, which can ensure that even if the data transmitter is accessed by other unauthorized devices, the target data cannot be easily read, thereby enhancing the security and confidentiality of the data.

[0077] Accordingly, during decryption, the response can be re-determined according to the random stimulus (i.e., decryption information that can be used to decrypt the second target data is obtained). The response is used to decrypt the second target data. Since the response of the APUF is unique each time it is calculated, it provides an additional security layer for the decryption process. Only when the correct response is obtained can the data be successfully decrypted.

[0078] In this way, the APUF circuit is used to generate a unique response to enhance the security of the data decryption process. By using the response obtained by the APUF circuit according to the random stimulus to decrypt the second target data, the decryption process can be ensured to be more secure and prevent attackers from obtaining the original data by copying or simulating the decryption process.

[0079] In some embodiments, the data transmitter is a mobile storage device connected to the electronic device.

[0080] Here, the data transfer device can be various types of mobile storage devices, such as USB flash drives, mobile hard disks, etc. Electronic devices can be connected to these storage devices through different types of interfaces, such as USB interfaces, Type-C interfaces, Thunderbolt interfaces, etc. These interfaces make data transmission and storage more convenient and efficient.

[0081] As a carrier of data storage, mobile storage can store various types of data, including text, images, audio files, etc. These stored data may be the first target data or the second target data, depending on the specific application scenario. During the data storage and transmission process, the data may be encrypted, decrypted, etc. to ensure data security and privacy protection.

[0082] For example, when a mobile storage device is used for file transfer, the electronic device is connected to the storage device through an interface to read or write the first target data or the second target data stored therein.

[0083] Here, using the method provided in the embodiment of the present disclosure, the data in the mobile storage can be encrypted and / or decrypted without the need to manually generate encryption and decryption keys each time, nor is there a need to store the keys in the device, which greatly reduces the risk of the keys being stolen or reverse engineered.

[0084] In some embodiments, the APUF circuit includes: N switches, an arbitrator, a first circuit and a second circuit; the first circuit and the second circuit are completely symmetrical; N is a positive integer greater than or equal to 1; Taking each data frame in the first target data as a random stimulus and inputting it into the APUF circuit, obtaining a response corresponding to each of the data frames, including: Determine an input signal corresponding to each of the N switches according to the data frame, input the input signal corresponding to each switch to the corresponding switch, and control the first circuit and the second circuit to be directly connected or cross-connected according to the input signal; The arbitrator determines an arrival order of the signal of the first circuit and the signal of the second circuit, and outputs a response according to the arrival order.

[0085] Here, the switches exist as control elements for regulating signal flow and path selection, and their function is to determine the working state and input path of the first circuit and the second circuit.

[0086] A data frame is a group of data consisting of multiple data units. For example, the size of a data frame can be 16 bytes (128-bit binary string), 32 bytes (256-bit binary string), or larger, such as 64 bytes, 128 bytes, 256 bytes, etc. Each data frame is sent to the APUF circuit as an input signal, that is, these binary strings are input to the circuit for processing. The APUF circuit generates a unique response based on the input data frame, that is, as the key of the data frame, based on the physical characteristics of the circuit, it produces an output that cannot be copied in different environments or conditions.

[0087] Each data frame is sent to the APUF circuit as an input signal, that is, the above binary string. The APUF circuit is used to generate a unique response. It produces an output that cannot be copied in different environments or conditions based on the physical characteristics of the circuit. Here, the binary string is input into the APUF circuit as follows: each binary bit of the binary string is input into each switch in the APUF circuit as input.

[0088] It should be noted that due to different circuit designs, the number of switches in the APUF circuit may not completely match the number of bits in the input binary string. For example, if there are 128 switches in the circuit and a 128-bit binary string is input, each binary bit will correspond to a switch input. However, when a 256-bit binary string is input, 128 switches are not enough to process all the bits at once. In this case, the binary string needs to be input twice: the first 128 bits of the binary bits will first be input into the corresponding 128 switches, and then the subsequent 128 bits of the binary bits will be input into the circuit again, corresponding to each switch. If a 64-bit binary string is input and there are 128 switches in the APUF circuit, then since the number of switches is greater than the number of bits in the input binary string, the remaining switches will be idle and will not be used. In this case, only the first 64 switches will operate according to the input 64-bit binary string. This method ensures that each binary bit can correspond to a switch in the circuit, ensuring that the APUF circuit can work properly and generate a unique response.

[0089] In this process, N switches are associated with the input signal, that is, each switch corresponds to a certain part in the data frame. Each switch determines its state based on the content of the input signal, that is, each switch can decide how to connect the circuit to affect the flow direction of the signal. The connection methods here include direct connection or cross connection. Direct connection means that the signal is directly transmitted from one circuit directly backward. Cross connection means that the signal is transmitted to another circuit in a cross manner. The arbitrator finally outputs a response based on the order in which the signal of the first circuit and the signal of the second circuit arrive.

[0090] In this way, the APUF circuit is used to determine the corresponding encryption information according to the first target data, so that each data frame (that is, each first target data) has its own unique encryption key, avoiding the risks that may be caused by a unified key and improving the security of encryption.

[0091] Figure 2 A schematic diagram of the structure of a controller provided in an embodiment of the present disclosure is shown in FIG. Figure 2 As shown, the controller includes: A processing unit, configured to determine first target data corresponding to a first operation in response to performing a first operation on data in the data transmitter; the first operation includes a modification operation and / or a write operation; an encryption and decryption unit, configured to generate encryption information according to the first target data; The processing unit is further configured to encrypt the first target data according to the encryption information, and save the encrypted first target data to the data transmitter.

[0092] In some embodiments, the processing unit is further configured to encode and / or decode the first target data. The processing unit may be a PHY unit.

[0093] The encryption and decryption unit includes an APUF circuit; the APUF circuit includes: N switches, an arbitrator, a first circuit and a second circuit; the first circuit and the second circuit are completely symmetrical; N is a positive integer greater than or equal to 1; Each of the N switches is used to control the first circuit and the second circuit, which are completely symmetrical, to be directly connected or cross-connected at the switch; The arbitrator is used to determine the arrival sequence of the signal of the first circuit and the signal of the second circuit, and output a response according to the arrival sequence.

[0094] In one example, if Figure 3 As shown, a structural schematic diagram of an APUF circuit is provided. The APUF circuit includes: two completely symmetrical circuits, an arbitrator, and N switches Ci, where N is equal to m+1.

[0095] Here, the function of switch Ci is to control whether two completely symmetrical circuits are directly connected or cross-connected at Ci. The two completely symmetrical circuits ensure that the transmission time of the signals on these two symmetrical circuits is only affected by slight differences at the physical level, and switch Ci will not destroy the symmetry of such circuits. The arbitrator is used to determine the order of arrival of signals on two circuits, and outputs a response based on the order of arrival of the signals on the circuits. In this way, the output response depends only on the physical differences of different circuits caused by different inputs (for example, the extremely small difference in the width of the two circuits caused by manufacturing), making the final output unpredictable and unique.

[0096] Combined with the above example, switch C i The input random excitation is a binary bit in the binary string. i When it is high (1), switch C i Control the two circuits to be directly connected. When the excitation signal C i When it is low level (0), switch C i Controls the cross connection of two circuits.

[0097] For example, the input of the APUF circuit is a data frame, which is a 64-bit binary string, such as 10101...1 (64 bits in total). Assuming N is 64, each binary bit is input to switches C0 to C1. 63 : Position 1 (1): Direct connection; Bit 2 (0): cross connection; Position 3 (1): Direct connection; Bit 4 (0): cross connection; ...and so on, until the 64th position.

[0098] in addition, Figure 3 In the present invention, the pulse can be a fixed pulse, that is, a persistent electrical signal.

[0099] Combination Figure 4 For example, Figure 4 The schematic diagram of the principle of an encryption method provided for the application embodiment of the present disclosure is that a mobile storage device is used as an example of a data transmitter. After the mobile storage device is connected to a server (an example of an electronic device) through a USB interface, the USB controller in the server performs read and write operations on the data in the mobile storage device; through the PHY (Physical, physical layer, a processing unit responsible for signal encoding and decoding) in the USB controller, after the data in the mobile storage device is modified or written by the server (that is, the data comes from the server), the data segment is encrypted and can only be modified and written by the server. However, it does not affect the use of other data by other information devices.

[0100] Specifically, the PHY is connected to an APUF circuit, and when the first target data is encoded and decoded in the PHY, a random response pair (CRP) generated by the APUF circuit encrypts the data.

[0101] When the server modifies or writes the data in the mobile storage, a continuous random stimulus (that is, the modified or written data is given to the PHY and APUF at the same time) causes the APUF power supply to produce a continuous response. When the PHY encodes the signal, it first uses the CRP of the APUF circuit to encrypt each data frame (because the response is continuously generated, the CRP used for each data frame, that is, the response used for encryption, is different). The response here actually plays the role of a key in an encryption algorithm. Then, the random stimulus in the CRP is attached to a field of the data frame. Finally, the first target data is written into the mobile storage. When the mobile storage is connected to other devices, since there is no corresponding response in the CRP in other devices, it is used as a key to decrypt the data. Other data cannot decode the data frame of the data, thereby protecting sensitive data.

[0102] In some embodiments, the processing unit is used to determine second target data corresponding to the second operation in response to performing a second operation on the data in the data transmitter; the second operation includes a read operation; The encryption and decryption unit is used to determine decryption information according to the second target data; The processing unit is further configured to decrypt the second target data according to the decryption information to obtain the decrypted second target data.

[0103] like Figure 5 As shown, Figure 5 A schematic diagram of the principle of a decryption method provided for the application embodiment of the present disclosure, when a server (an example of an electronic device) reads encrypted data (i.e., an example of second target data) of a mobile device, after a PHY (a processing unit responsible for encoding and decoding signals) receives a data frame, the PHY extracts a specific field storing the stimulus data. Then, the data of the specific field is used as an stimulus signal to input to the APUF circuit, and the APUF circuit generates a response and returns it to the PHY, and the PHY uses the response as a key to decrypt the data frame and finally decodes and outputs it.

[0104] Here, the APUF circuit can be used as follows Figure 3 The circuit shown in FIG. 1 includes: N switches, an arbitrator, a first circuit and a second circuit; the first circuit and the second circuit are completely symmetrical; and N is equal to m+1.

[0105] In some embodiments, Figure 1 The electronic device to which the method shown is applied may include a controller, which may be used to determine first target data corresponding to a first operation in response to performing the first operation on data in a data transmitter; generate encryption information based on the first target data; encrypt the first target data based on the encryption information, and save the encrypted first target data to the data transmitter.

[0106] And / or, the controller can be used to determine second target data corresponding to a second operation in response to performing a second operation on data in the data transmitter; determine decryption information based on the second target data; decrypt the second target data based on the decryption information to obtain the decrypted second target data.

[0107] If the interface is a USB interface, the controller may be a USB controller. In the embodiment of the present disclosure, the CRP generated by the unpredictability of the APUF circuit is used as a key to encrypt data passing through the USB interface of the motherboard. The principle of data encryption of the USB controller with integrated data encryption function is to use the random CRP generated by the APUF circuit and use the response of the CRP as a key to encrypt the data.

[0108] The USB controller may also include: main control chip, PHY, interrupt controller, DMA (Direct Memory Access) controller, endpoint, clock management unit, power management unit, etc. Among them, PHY is responsible for the physical transmission layer such as USB signals, and completes the encoding, decoding, modulation and demodulation of signals. The APUF circuit is used to encode and decode data signals.

[0109] The data output from the USB interface is encrypted by the APUF circuit, which can be regarded as the electronic signature of the server to a certain extent. Only the server can read and operate its data. At the same time, the APUF circuit can adopt the same design. Even if it is the same design, the CRP generated by its unique physical properties is different, and it has the conditions for mass production. Finally, since the CRP stimulus is stored in each data frame, it is distributed, and the response data is not stored in any device and is generated by the APUF in real time, which reduces the probability of the protected data being maliciously attacked.

[0110] Figure 6 A schematic diagram of the structure of a data processing device provided in an embodiment of the present disclosure; Figure 6 As shown, the device is applied to an electronic device, and the device includes: A first processing module, configured to determine first target data corresponding to a first operation performed on data in the data transmitter in response to the first operation being performed on the data in the data transmitter; the first operation includes a modification operation and / or a write operation; A second processing module, used for generating encryption information according to the first target data; The third processing module is used to encrypt the first target data according to the encryption information, and save the encrypted first target data to the data transmitter.

[0111] In some embodiments, the second processing module is used to use each data frame in the first target data as a random stimulus input into an arbiter physical unclonable function APUF circuit to obtain a response corresponding to each of the data frames as encrypted information.

[0112] In some embodiments, the third processing module is used to encrypt each data frame in the first target data according to the response corresponding to each data frame in the encryption information.

[0113] In some embodiments, the third processing module is used to add a random stimulus for determining the encryption information to a specific field of the encrypted first target data; The first target data after adding the random excitation is saved in the data transmitter.

[0114] In some embodiments, the first processing module is further used to determine second target data corresponding to the second operation in response to performing a second operation on the data in the data transmitter; the second operation includes a read operation; The second processing module is further used to determine decryption information according to the second target data; The third processing module is further configured to decrypt the second target data according to the decryption information to obtain the decrypted second target data.

[0115] In some embodiments, the second processing module is used to obtain random excitation in a specific field of the second target data.

[0116] In some embodiments, the third processing module is used to input the random stimulus into the APUF circuit to obtain a response corresponding to the random stimulus; The second target data is decrypted according to the response.

[0117] In some embodiments, the APUF circuit includes: N switches, an arbitrator, a first circuit and a second circuit; the first circuit and the second circuit are completely symmetrical; N is a positive integer greater than or equal to 1; Taking each data frame in the first target data as a random stimulus and inputting it into the APUF circuit, obtaining a response corresponding to each of the data frames, including: Determine an input signal corresponding to each of the N switches according to the data frame, input the input signal corresponding to each switch to the corresponding switch, and control the first circuit and the second circuit to be directly connected or cross-connected according to the input signal; The arbitrator determines an arrival order of the signal of the first circuit and the signal of the second circuit, and outputs a response according to the arrival order.

[0118] In some embodiments, the data transmitter is a mobile storage device connected to the electronic device.

[0119] It is understandable that, when the data processing device provided in the above embodiment implements the corresponding data processing method, the above processing can be assigned to different program modules as needed to complete all or part of the above-described processing. In addition, the device provided in the above embodiment and the embodiment of the corresponding method belong to the same concept, and the specific implementation process is detailed in the method embodiment, which will not be repeated here.

[0120] The embodiment of the present disclosure provides a computer program product or a computer program, which includes computer instructions, which are stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the computer device executes a data processing method.

[0121] An embodiment of the present disclosure provides a computer-readable storage medium storing executable instructions, wherein the executable instructions are stored. When the executable instructions are executed by a processor, the processor will be caused to execute the data processing method provided by the embodiment of the present disclosure.

[0122] In some embodiments, the computer-readable storage medium may be a memory such as FRAM, ROM, PROM, EPROM, EEPROM, flash memory, magnetic surface storage, optical disk, or CD-ROM; or it may be various devices including one or any combination of the above memories.

[0123] In some embodiments, executable instructions may be in the form of a program, software, software module, script or code, written in any form of programming language (including compiled or interpreted languages, or declarative or procedural languages), and may be deployed in any form, including as a stand-alone program or as a module, component, subroutine or other unit suitable for use in a computing environment.

[0124] As an example, executable instructions may, but need not, correspond to a file in a file system, may be stored as part of a file storing other programs or data, such as in one or more scripts in a HyperText Markup Language (HTML) document, in a single file dedicated to the program in question, or in multiple coordinated files (e.g., files storing one or more modules, subroutines, or code portions).

[0125] By way of example, executable instructions may be deployed to be executed on one computing device, or on multiple computing devices located at one site, or on multiple computing devices distributed across multiple sites and interconnected by a communication network.

[0126] Figure 7 A schematic diagram of the structure of an electronic device provided in an embodiment of the present disclosure; Figure 7 As shown, the electronic device 70 includes: a processor 701, and a memory 702 communicatively connected to the processor 701; the memory 702 stores instructions that can be executed by the processor 701.

[0127] The instruction is executed by the processor 701 so that the processor 701 can perform: in response to a first operation performed on data in a data transmitter, determine first target data corresponding to the first operation; the first operation includes a modification operation and / or a write operation; generate encryption information based on the first target data; encrypt the first target data based on the encryption information, and save the encrypted first target data to the data transmitter.

[0128] The electronic device provided in the above embodiment and the corresponding method embodiment belong to the same concept, and the specific implementation process is detailed in the method embodiment, which will not be repeated here.

[0129] In actual application, the electronic device 70 may further include: at least one network interface 703. The various components in the electronic device 70 are coupled together via a bus system 704. It is understood that the bus system 704 is used to achieve connection and communication between these components. In addition to the data bus, the bus system 704 also includes a power bus, a control bus, and a status signal bus. However, for the sake of clarity, Figure 7 In the figure, various buses are marked as bus system 704. There may be at least one processor 701 and at least one memory 702. The network interface 703 is used for wired or wireless communication between the electronic device 70 and other devices.

[0130] The memory 702 in the embodiment of the present disclosure is used to store various types of data to support the operation of the electronic device 70 .

[0131] The method disclosed in the above embodiment of the present disclosure can be applied to the processor 701, or implemented by the processor 701. The processor 701 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by the hardware integrated logic circuit in the processor 701 or the instruction in the form of software. The above processor 701 may be a general processor, a digital signal processor (DSP, DiGital Signal Processor), or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, etc. The processor 701 can implement or execute the methods, steps and logic block diagrams disclosed in the embodiment of the present disclosure. The general processor may be a microprocessor or any conventional processor, etc. The steps of the method disclosed in the embodiment of the present disclosure can be directly embodied as a hardware decoding processor to execute, or the hardware and software modules in the decoding processor can be combined to execute. The software module can be located in a storage medium, which is located in the memory 702. The processor 701 reads the information in the memory 702 and completes the steps of the above method in combination with its hardware.

[0132] In some embodiments, the electronic device 70 may be implemented by one or more application specific integrated circuits (ASICs), DSPs, programmable logic devices (PLDs), complex programmable logic devices (CPLDs), field programmable gate arrays (FPGAs), general-purpose processors, controllers, microcontrollers (MCUs), microprocessors, or other electronic components to execute the aforementioned method.

[0133] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps recorded in this disclosure can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solutions disclosed in this disclosure can be achieved, and this document does not limit this.

[0134] In the above description, reference is made to “some embodiments”, which describe a subset of all possible embodiments, but it can be understood that “some embodiments” may be the same subset or different subsets of all possible embodiments and may be combined with each other without conflict.

[0135] Unless otherwise defined, all technical and scientific terms used in this disclosure have the same meaning as those commonly understood by those skilled in the art to which this disclosure belongs. The terms used in this disclosure are only for the purpose of describing the embodiments of this disclosure and are not intended to limit this disclosure.

[0136] It should be understood that in the various embodiments of the present disclosure, the size of the serial number of each implementation process does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present disclosure.

[0137] In addition, the terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include at least one of the features. In the description of the present disclosure, the meaning of "plurality" is two or more, unless otherwise clearly and specifically defined.

[0138] The above is only a specific embodiment of the present disclosure, but the protection scope of the present disclosure is not limited thereto. Any person skilled in the art who is familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the present disclosure, which should be included in the protection scope of the present disclosure. Therefore, the protection scope of the present disclosure should be based on the protection scope of the claims.

Claims

1. A data processing method, characterized in that: The method is applied to an electronic device, and the method comprises: In response to performing a first operation on the data in the data transmission device, determining first target data corresponding to the first operation; the first operation includes a modification operation and / or a write operation; Generate encryption information according to the first target data; encrypt the first target data according to the encryption information, and save the encrypted first target data to the data transmitter.

2. The method according to claim 1, characterized in that The step of generating encrypted information according to the first target data comprises: Each data frame in the first target data is used as a random stimulus to input into an arbiter physical unclonable function APUF circuit, and a response corresponding to each of the data frames is obtained as encrypted information.

3. The method according to claim 1, characterized in that The encrypting the first target data according to the encryption information includes: Each data frame in the first target data is encrypted according to the response corresponding to each data frame in the encryption information.

4. The method according to claim 1, characterized in that: The step of saving the encrypted first target data to the data transmission device comprises: adding a random stimulus for determining the encrypted information to a specific field of the encrypted first target data; The first target data after adding the random excitation is saved in the data transmitter.

5. The method according to claim 1, characterized in that The method comprises: In response to performing a second operation on the data in the data transmitter, determining second target data corresponding to the second operation; the second operation includes a read operation; Determine decryption information according to the second target data; decrypt the second target data according to the decryption information to obtain the decrypted second target data.

6. The method according to claim 5, characterized in that The determining the decryption information according to the second target data comprises: A random excitation is acquired in a specific field of the second target data.

7. The method according to claim 6, characterized in that The decrypting the second target data according to the decryption information includes: Inputting the random stimulus into an APUF circuit to obtain a response corresponding to the random stimulus; The second target data is decrypted according to the response.

8. The method according to claim 2 or 7, characterized in that The APUF circuit comprises: N switches, an arbitrator, a first circuit and a second circuit; the first circuit and the second circuit are completely symmetrical; N is a positive integer greater than or equal to 1; Taking each data frame in the first target data as a random stimulus and inputting it into the APUF circuit, obtaining a response corresponding to each of the data frames, including: Determine an input signal corresponding to each of the N switches according to the data frame, input the input signal corresponding to each switch to the corresponding switch, and control the first circuit and the second circuit to be directly connected or cross-connected according to the input signal; The arbitrator determines an arrival order of the signal of the first circuit and the signal of the second circuit, and outputs a response according to the arrival order.

9. The method according to claim 1, characterized in that: The data transmitter is a mobile storage device connected to the electronic device.

10. A controller, characterized in that: The controller comprises: A processing unit, configured to determine first target data corresponding to a first operation performed on data in the data transmitter in response to the first operation being performed on the data in the data transmitter; the first operation includes a modification operation and / or a write operation; an encryption and decryption unit, configured to generate encryption information according to the first target data; The processing unit is further configured to encrypt the first target data according to the encryption information, and save the encrypted first target data to the data transmitter.

11. The controller according to claim 10, characterized in that: The encryption and decryption unit includes an APUF circuit; the APUF circuit includes: N switches, an arbitrator, a first circuit and a second circuit; the first circuit and the second circuit are completely symmetrical; N is a positive integer greater than or equal to 1; Each of the N switches is used to control the first circuit and the second circuit, which are completely symmetrical, to be directly connected or cross-connected at the switch; The arbitrator is used to determine the arrival sequence of the signal of the first circuit and the signal of the second circuit, and output a response according to the arrival sequence.

12. The controller according to claim 10, characterized in that: The processing unit is used to determine second target data corresponding to the second operation in response to performing a second operation on the data in the data transmitter; the second operation includes a read operation; The encryption and decryption unit is used to determine decryption information according to the second target data; The processing unit is further configured to decrypt the second target data according to the decryption information to obtain the decrypted second target data.

13. A data processing device, characterized in that: The device is applied to electronic equipment, and the device comprises: A first processing module, configured to determine first target data corresponding to a first operation performed on data in the data transmitter in response to the first operation being performed on the data in the data transmitter; the first operation includes a modification operation and / or a write operation; A second processing module, used for generating encryption information according to the first target data; The third processing module is used to encrypt the first target data according to the encryption information, and save the encrypted first target data to the data transmitter.

14. An electronic device, characterized in that: include: at least one processor; and, a memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the method according to any one of claims 1 to 9.

15. A non-transitory computer-readable storage medium storing computer instructions, characterized in that: The computer instructions are used to make a computer execute the method according to any one of claims 1 to 9.

Images