Burned data transmission method, electronic equipment and storage medium

Abstract

The invention discloses a burnt data transmission method, electronic equipment and a storage medium, and relates to the technical field of secure communication, the method comprises the following steps: determining a shared key of a target firmware board card, and transmitting the shared key to the target firmware board card; determining a security key according to the target security policy, and encrypting the to-be-burnt data based on the security key to obtain encrypted data; and according to the shared key, encrypting the encrypted data and the target security policy as transmission data, and sending the transmission data to the target firmware board card. According to the method and the device, the shared key is transmitted to the target firmware board card, so that only the authorized target firmware board card can perform decryption, the situation that the data cracking difficulty is increased due to unauthorized decryption and dual encryption of the shared key and the security key is prevented, the confidentiality of the transmission data in the transmission process is further improved, and the security of the transmission data is improved. The target security policy can be flexibly adjusted and defined based on different security requirements, so that the flexibility of the burnt data transmission method is enhanced.

Description

Technical Field

[0001] The present invention relates to the technical field of secure communications, and in particular to a method for burning and transmitting data, an electronic device and a storage medium. Background Art

[0002] In the manufacturing process of integrated circuits, system level test (SLT) is a key system level test link after packaging, which is crucial to ensure the chip yield rate. SLT is usually carried out after chip probe test, final test and automatic test equipment test, and verifies chip performance by simulating the user's real use scenario. However, due to the different functions and application scenarios of chips designed by various chip companies, SLT does not have a unified test specification and process. In order to improve the test efficiency, many chip companies outsource the SLT test process to professional SLT factories. However, since SLT factories are third-party testing organizations, their management systems and quality control methods are independent of chip companies. Therefore, when performing SLT testing, the firmware version management of the test board, firmware security, and the security and confidentiality of the personalized data burned into the chip cannot be fully guaranteed. Therefore, providing a set of technical solutions that can ensure the confidentiality of the burned data and prevent factories or other third parties from obtaining sensitive information has become an urgent problem to be solved in the field of secure communication technology. Summary of the invention

[0003] The invention provides a burning data transmission method, electronic equipment and storage medium, which increase the difficulty of cracking data, improve the confidentiality of the transmitted data during the transmission process, and enhance the flexibility of the burning data transmission method.

[0004] In one aspect of an embodiment of the present invention, a method for transmitting burning data is provided, which is applied to a server and includes:

[0005] Determine the shared key of the target firmware board and transmit the shared key to the target firmware board;

[0006] Determine a security key according to a target security policy, and encrypt the data to be burned based on the security key to obtain encrypted data;

[0007] The encrypted data is encrypted according to the shared key and the target security policy is used for transmission data, and the transmission data is sent to the target firmware board.

[0008] In one aspect of an embodiment of the present invention, another method for transmitting data during burning is provided, which is applied to a firmware board, and includes:

[0009] Get the shared key sent by the server;

[0010] When the transmission data sent by the server is obtained, the encryption data and the target security policy are determined based on the shared key and the transmission data;

[0011] The encrypted data is decrypted based on the target security policy to be burned.

[0012] Another aspect of an embodiment of the present invention provides an electronic device, including:

[0013] at least one processor;

[0014] and a memory communicatively coupled to the at least one processor;

[0015] The memory stores a computer program executable by at least one processor, and the computer program is executed by at least one processor so that the at least one processor can execute any one of the burning data transmission methods in the embodiments of the present invention.

[0016] According to another aspect of the present invention, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the burning data transmission method of any embodiment of the present invention when executed.

[0017] In an embodiment of the present invention, a preset key generation rule or a key generation tool can be obtained on the server side, a shared key can be generated based on the preset key generation rule or the key generation tool, the shared key can be transmitted from the server to the target firmware board, the target security policy and the data to be burned waiting to be written into the target firmware board can be obtained, a key can be generated based on the target security policy, the key can be used as a security key, the data to be burned can be encrypted based on the target security policy using the security key to obtain encrypted data to be burned, the encrypted data to be burned can be used as encrypted data, the encrypted data and the target security policy can be integrated to form a comprehensive data set, the comprehensive data set can be encrypted again using the shared key to obtain an encrypted comprehensive data set, the encrypted comprehensive data set can be used as transmission data and transmitted to the target firmware board, the target firmware board receives the transmission data and continues subsequent operations. The embodiment of the present invention ensures that only the authorized target firmware board can perform decryption by transmitting the shared key to the target firmware board, thereby preventing unauthorized decryption. The data encryption and decryption process is simplified through transmission based on the shared key, and the efficiency of data transmission is improved. The double encryption of the shared key and the security key increases the difficulty of cracking the data, thereby improving the confidentiality of the transmitted data during the transmission process. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings in the following description are only some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative work.

[0019] Figure 1 This is a flow chart of a burning data transmission method applied to a server according to the first embodiment of the present invention;

[0020] Figure 2 This is a flow chart of a method for transmitting data for burning firmware boards provided in accordance with Embodiment 2 of the present invention;

[0021] Figure 3 is a flow chart of another method for transmitting burning data applied to a server according to Embodiment 3 of the present invention;

[0022] Figure 4 is a flow chart of another method for transmitting data for burning firmware boards provided in accordance with a fourth embodiment of the present invention;

[0023] Figure 5 is a server preparation workflow diagram provided according to Embodiment 5 of the present invention;

[0024] Figure 6 This is an encryption strategy representation provided according to Embodiment 5 of the present invention;

[0025] Figure 7 This is a test board preparation workflow diagram provided according to Embodiment 5 of the present invention;

[0026] Figure 8 is a flow chart of another method for burning and transmitting data according to Embodiment 5 of the present invention;

[0027] Fig. 9 It is a schematic diagram of the structure of a device capable of transmitting burning data of an executable server provided by an embodiment of the present invention;

[0028] Fig.10 It is a schematic diagram of the device structure of a method for burning and transmitting data of an executable firmware board provided by an embodiment of the present invention;

[0029] Fig.11 It is a structural schematic diagram of an electronic device for implementing the burning data transmission method of an embodiment of the present invention. DETAILED DESCRIPTION

[0030] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0031] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0032] Embodiment 1

[0033] Figure 1 The present invention provides a flow chart of a method for transmitting data through burning data applied to a server. The present invention is applicable to the following situations. The method can be performed by a device for transmitting data through burning data. The device can be implemented in the form of hardware and / or software. The device can be configured in an electronic device. Figure 1 As shown, the method includes:

[0034] S101, determining a shared key of a server, and transmitting the shared key to a target firmware board.

[0035] Among them, the target firmware board can be understood as a hardware device that needs to be burned with data. For example, the communication interface type of the target firmware board may include: UART interface or SPI interface. The target firmware board can receive the shared key transmitted by the server through the communication interface.

[0036] The shared key can be understood as a key jointly held by the server and the target firmware board, wherein the key can be understood as a data field, and for example, the key can include; a symmetric key or an asymmetric key, etc.

[0037] Specifically, on the server side, a preset key generation rule or a key generation tool can be obtained, a shared key can be generated based on the preset key generation rule or a key generation tool, and the shared key can be transmitted from the server to the target firmware board. At this time, the server and the target firmware board hold the same key, that is, they hold the shared key together.

[0038] For example, the steps of transmitting a shared key from a server to a target firmware board may include: the shared key may be remotely transmitted to a client computer through the server first, the client computer transparently transmits the shared key to the target firmware board via the communication interface of the target firmware board, or the server transmits the shared key to the target firmware board by building a virtual private network.

[0039] S102: Determine a security key according to a target security policy, and encrypt the data to be burned based on the security key to obtain encrypted data.

[0040] The target security policy can be understood as a set of rules selected to ensure data transmission security. For example, the target security policy may include: key generation policy or data encryption policy, etc.

[0041] The security key can be understood as a key generated by a target security policy, which is used to encrypt the data to be burned and ensure the confidentiality of the data to be burned during transmission.

[0042] The data to be burned can be understood as data waiting to be written into the target firmware board. For example, the data types to be burned can include: an upgrade data packet that can guide the target firmware board to upgrade or personalized information that needs to be written into the test chip.

[0043] Encrypted data can be understood as data that has been encrypted. It can be understood that encrypted data can be understood as data to be burned that has been encrypted using a security key. Encrypted data can be transmitted securely, and only a device with a correct security key can decrypt the encrypted data.

[0044] Specifically, the target security policy and the data to be burned that are waiting to be written into the target firmware board are obtained, a key can be generated based on the target security policy, and the key is used as a security key. Using the security key, the data to be burned can be encrypted based on the target security policy to obtain the encrypted data to be burned, and the encrypted data to be burned is used as the encrypted data.

[0045] For example, the step of obtaining the target security policy may include: randomly selecting a security policy from a preset security policy library as the security policy used to ensure data transmission security this time, and using the security policy as the target security policy.

[0046] S103, encrypting the encrypted data according to the shared key and the target security policy for transmission data, and sending the transmission data to the target firmware board.

[0047] The transmission data may be understood as a comprehensive data set. For example, the transmission data may at least include: encrypted data and encrypted target security policy.

[0048] Specifically, the shared key, encrypted data and target security policy are obtained, and the encrypted data and the target security policy can be integrated to form a comprehensive data set. The shared key can be used to encrypt the comprehensive data set again to obtain an encrypted comprehensive data set. The encrypted comprehensive data set can be used as transmission data and transmitted to the target firmware board. The target firmware board receives the transmission data and continues subsequent operations.

[0049] In an embodiment of the present invention, a preset key generation rule or a key generation tool can be obtained on the server side, a shared key can be generated based on the preset key generation rule or the key generation tool, the shared key can be transmitted from the server to the target firmware board, the target security policy and the data to be burned waiting to be written into the target firmware board can be obtained, a key can be generated based on the target security policy, the key can be used as a security key, the data to be burned can be encrypted based on the target security policy using the security key to obtain encrypted data to be burned, the encrypted data to be burned can be used as encrypted data, the encrypted data and the target security policy can be integrated to form a comprehensive data set, the comprehensive data set can be encrypted again using the shared key to obtain an encrypted comprehensive data set, the encrypted comprehensive data set can be used as transmission data and transmitted to the target firmware board, the target firmware board receives the transmission data and continues subsequent operations. The embodiment of the present invention ensures that only the authorized target firmware board can perform decryption by transmitting the shared key to the target firmware board, thereby preventing unauthorized decryption. The data encryption and decryption process is simplified through transmission based on the shared key, and the efficiency of data transmission is improved. The double encryption of the shared key and the security key increases the difficulty of cracking the data, thereby improving the confidentiality of the transmitted data during the transmission process.

[0050] Embodiment 2

[0051] Figure 2 The present invention provides a flowchart of a method for transmitting data for burning firmware boards. The present invention provides a method for transmitting data for burning firmware boards based on the above-mentioned embodiments. Figure 2 As shown, the method includes:

[0052] S201. Obtain a shared key sent by a server.

[0053] Specifically, the firmware board may be responsible for obtaining the shared key transmitted by the server. After the firmware board obtains the shared key, subsequent operations may be performed based on the obtained shared key.

[0054] It is understandable that the server sends the generated shared key to the firmware board, so that the firmware board and the server share a key, which can ensure that the firmware board correctly decrypts the encrypted data transmitted by the server.

[0055] S202: When the transmission data sent by the server is obtained, the encryption data and the target security policy are determined according to the shared key and the transmission data.

[0056] Specifically, the firmware board is responsible for receiving the transmission data sent by the server and obtaining the shared key. After receiving the transmission data, the firmware board can use the shared key to decrypt the transmission data to obtain the encrypted data and the target security policy.

[0057] For example, the steps of using a shared key to decrypt the transmission data to obtain encrypted data and a target security policy may include: after the firmware board receives the transmission data, it can split the transmission data to obtain encrypted data and an encrypted target security policy, and can decrypt the encrypted data and the encrypted target security policy according to the shared key sent by the server to obtain the encrypted data and the target security policy.

[0058] S203: decrypt the encrypted data based on the target security policy to obtain data to be burned.

[0059] Specifically, after the firmware board obtains the target security policy, the encrypted data can be decrypted according to the target security policy to obtain the data to be burned that needs to be written into the firmware board.

[0060] For example, the steps of decrypting encrypted data according to the target security policy may include: querying the corresponding key generation rules and decryption rules from the target security policy, using the key generation rules to generate a security key identical to that on the server side, using the generated security key, and decrypting the encrypted data based on the queried corresponding decryption rules to obtain the data to be burned.

[0061] In the embodiment of the present invention, the firmware board can be responsible for obtaining the shared key and the transmission data transmitted by the server. After the firmware board obtains the shared key and the transmission data, the shared key can be used to decrypt the transmission data to obtain the encrypted data and the target security policy. After the firmware board obtains the target security policy, the encrypted data can be decrypted according to the target security policy to obtain the data to be burned that needs to be written to the firmware board. In the embodiment of the present invention, the data decryption process is simplified by transmission based on the shared key, the complex authentication process is avoided, the decryption efficiency of the data to be burned is improved, the target security policy is decrypted by the shared key, and the data to be burned is obtained by decryption based on the decrypted target security policy, thereby ensuring the security of the data before burning.

[0062] Embodiment 3

[0063] Figure 3 The present invention provides another method for transmitting data through burning program applied to a server. The present invention provides another method for transmitting data through burning program applied to a server based on the above-mentioned embodiment. Figure 3 As shown, the method includes:

[0064] S301. Determine a first key pair based on an asymmetric cryptographic rule, and send first public key information of the first key pair to a target firmware board.

[0065] Among them, the asymmetric cryptographic rule can be understood as an algorithm for encrypting and decrypting data. The asymmetric cryptographic rule uses a pair of keys: a public key and a private key to encrypt and decrypt data. For example, the asymmetric cryptographic rule can include: RSA algorithm or digital signature algorithm, etc.

[0066] The first key pair refers to a pair of keys generated by asymmetric cryptographic rules in the server, wherein the key pair may consist of two related keys. For example, the key pair may include a public key and a private key, wherein the public key can be used to encrypt data and the private key can be used to decrypt data.

[0067] The first public key information refers to the representation of the public key in the first key pair. For example, the transmission format of the first public key information may include: PEM format or DER format, etc.

[0068] Specifically, an asymmetric cryptographic rule for encrypting and decrypting data is obtained, and a pair of keys can be generated using the asymmetric cryptographic rule. The key pair can include: a public key and a private key. The public key part of the above key pair is used as the first public key information and transmitted to the target firmware board. The target firmware board can use the first public key information for subsequent operations.

[0069] S302: Acquire the second public key information uploaded by the target firmware board, wherein the second key pair to which the second public key information belongs is generated by the target firmware board based on asymmetric cryptographic rules.

[0070] Among them, the second key pair is similar to the first key pair, and refers to a pair of keys generated by the target firmware board. For example, the key pair may also include: a public key and a private key. It can be understood that the public key can be used publicly, and the private key is kept confidential by both communicating parties.

[0071] The second public key information refers to the representation form of the public key in the second key pair, and can be used to generate a shared key.

[0072] Specifically, the server can establish a connection with the target firmware version card. Through the established connection, the server can receive the second public key information uploaded by the target firmware version card. It can be understood that the second public key information is included in the second key pair, which is generated by the target firmware version card based on asymmetric cryptographic rules.

[0073] For example, the step in which the server can receive the second public key information uploaded by the target firmware board may include: the target firmware board determines the second key pair based on asymmetric cryptographic rules, and sends the second public key information of the second key pair to the server, and the server is responsible for receiving the second public key information uploaded by the target firmware board.

[0074] S303: Generate a shared key corresponding to the target firmware board card using the second public key information and the first private key information of the first key pair according to the elliptic curve Diffie-Hellman key exchange protocol.

[0075] The first private key information refers to the representation of the private key in the first key pair, which can be used to generate a shared key.

[0076] The Elliptic Curve Diffie–Hellman key exchange protocol can be understood as a key exchange protocol based on elliptic curve mathematics that allows two parties to securely generate a shared secret key without directly transmitting the key itself.

[0077] Specifically, based on the elliptic curve Diffie-Hellman key exchange protocol, the server and the target firmware board can generate a first key pair and a second key pair respectively, the server can exchange public key information with the target firmware board, obtain the second public key information of the target firmware board, and calculate a key based on the obtained second public key information and the first private key information generated by the server itself using the elliptic curve Diffie-Hellman key exchange protocol, and use the key as a shared key between the server and the target firmware board.

[0078] S304, obtaining a first random number generated locally and a second random number generated by a target firmware board.

[0079] The first random number may be understood as a randomly generated numerical sequence, which is generated by a server.

[0080] The second random number can be understood as another randomly generated numerical sequence, which is generated by the target firmware board.

[0081] Specifically, in the server, a numerical sequence can be randomly generated by calling a random number generator or a random number generation algorithm, and the numerical sequence can be used as the first random number. In the target firmware board, another numerical sequence can also be randomly generated by calling a random number generator or a random number generation algorithm, and the numerical sequence can be used as the second random number. The server can receive the second random number uploaded by the target firmware board.

[0082] S305: Combine the first random number and the second random number into a third random number, and search for a target security policy in a security policy library according to the third random number.

[0083] Among them, the third random number can be understood as another randomly generated numerical sequence, which can be formed by combining the first random number and the second random number. For example, the operation of combining the first random number and the second random number may include: an exclusive OR operation or a weighted averaging operation, etc.

[0084] The security policy library can be understood as a database that may contain a series of methods for encrypting and decrypting data.

[0085] Specifically, obtain a first random number and a second random number, obtain a preset security policy library, combine the first random number and the second random number to form a new numerical sequence, use the new numerical sequence as a third random number, and based on the third random number, search the security policy library to obtain a target security policy corresponding to the third random number.

[0086] For example, based on the third random number, a search can be performed in the security policy library, and the step of obtaining the target security policy corresponding to the third random number may include: establishing a unique policy index number for each target security policy in the security policy library, and based on the third random number, searching the security policy library for the policy index number that is the same as the third random number, and taking the security policy corresponding to the policy index number that is the same as the third random number as the target security policy.

[0087] S306: Call the key generation rule of the target security policy to generate a security key.

[0088] Among them, the key generation rule can be understood as a series of standards followed when generating a key. For example, the key generation rule may include: a random number generator generation rule or a hash function generation rule, etc.

[0089] Specifically, after obtaining the target security policy, the target security policy may be extracted to extract the corresponding key generation rule, and a key may be generated based on the key generation rule and used as the security key.

[0090] S307: Encrypt the data to be burned into encrypted data according to the security key and the encryption rule of the target security policy.

[0091] Among them, the encryption rules can be understood as a series of standards followed when encrypting data. For example, the encryption data rules can include: triple data encryption algorithm or ElGamal algorithm, etc.

[0092] Specifically, by obtaining a security key, an encryption rule followed when encrypting data can be extracted from the target security policy. The security key can be used to encrypt the data to be burned based on the encryption rule to obtain encrypted data to be burned. The encrypted data to be burned can be used as encrypted data for subsequent operations.

[0093] S308, encrypting the encrypted data according to the shared key and the target security policy for transmission data, and sending the transmission data to the target firmware board.

[0094] In an embodiment of the present invention, at the server side, an asymmetric cryptographic rule for encrypting and decrypting data is obtained, and a pair of keys can be generated by using the asymmetric cryptographic rule. The key pair can include: a public key and a private key. The public key part of the key pair is used as the first public key information and transmitted to the target firmware board. Based on the elliptic curve Diffie-Hellman key exchange protocol, the server and the target firmware board can generate a first key pair and a second key pair respectively. The server can establish a connection with the target firmware board. Through the established connection, the server can exchange public key information with the target firmware board and obtain the second public key information of the target firmware board. Based on the obtained second public key information and the first private key information generated by the server itself, a key is calculated using the elliptic curve Diffie-Hellman key exchange protocol, and the key is used as the shared key between the server and the target firmware board. The server can receive the second public key information uploaded by the target firmware board. In the server, a random number generator or a random number generation algorithm can be called to randomly generate a numerical sequence, and the numerical sequence is used as the first random number. In the target firmware board, it can also be called A random number generator or a random number generation algorithm is used to randomly generate another numerical sequence, and the numerical sequence is used as a second random number. The server can receive the second random number uploaded by the target firmware board and obtain a preset security policy library. The first random number and the second random number can be combined to form a new numerical sequence, and the new numerical sequence is used as a third random number. Based on the third random number, a search can be performed in the security policy library to obtain a target security policy corresponding to the third random number. After the target security policy is obtained, it can be extracted in the target security policy to extract the corresponding key generation rule. A key can be generated based on the key generation rule and the key can be used as a security key. An encryption rule followed when encrypting data can be extracted from the target security policy. The security key can be used to encrypt the data to be burned based on the encryption rule to obtain the encrypted data to be burned. The encrypted data to be burned can be used as encrypted data. The encrypted data and the target security policy are encrypted according to the shared key. The encrypted encrypted number and the target security policy can be integrated to form transmission data, and the transmission data is sent to the target firmware board. In the embodiment of the present invention, a key mechanism is generated based on the elliptic curve Diffie-Hellman key exchange protocol. The server and the target firmware board can exchange public key information with each other. According to the other party's public key information and its own private key information, the server can calculate the shared key, thereby ensuring the smoothness of the data encryption and decryption process. The introduction of random numbers increases the unpredictability of data transmission and key generation, improves the security of burned data transmission, and can flexibly adjust and define target security policies based on different security requirements. Different random numbers correspond to different target security policies, thereby realizing flexible selection and configuration of security policies.

[0095] Embodiment 4

[0096] Figure 4 The present invention provides another method for transmitting data through burning program on firmware boards, based on the above-mentioned embodiments. Figure 4 As shown, the method includes:

[0097] S401. Acquire first public key information sent by a server, wherein a first key pair to which the first public key information belongs is determined by the server based on an asymmetric key rule.

[0098] Specifically, the server can establish a connection with the target firmware board. Through the established connection, the target firmware board can receive the first public key information transmitted by the server. It can be understood that the first public key information is included in the first key pair, which is generated by the server based on asymmetric cryptographic rules.

[0099] For example, the step in which the target firmware board can receive the second public key information transmitted by the server may include: the server determines the first key pair based on asymmetric cryptographic rules, and sends the first public key information of the first key pair to the target firmware board, and the target firmware board is responsible for receiving the second public key information issued by the server.

[0100] S402: Determine a second key pair based on asymmetric cryptographic rules, and send second public key information of the second key pair to the server.

[0101] Specifically, the target firmware board can generate a second key pair based on asymmetric cryptographic rules, the second key pair can include a public key and a private key, the second public key information can be extracted from the second key pair, and the extracted second public key information can be sent to the server.

[0102] S403: Acquire a shared key generated by the server using the second public key information and the first private key information of the first key pair according to the elliptic curve Diffie-Hellman key exchange protocol.

[0103] Specifically, the target firmware board can obtain a shared key generated by the server, where the shared key is generated by the server based on the elliptic curve Diffie-Hellman key exchange protocol using the second public key information and the first private key information.

[0104] S404: When receiving the transmission data sent by the server, call the shared key to decrypt the transmission data to obtain the encrypted data and the target security policy.

[0105] Specifically, the target firmware board can receive the transmission data transmitted by the server. After the target firmware board receives the transmission data transmitted by the server, it can use the shared key sent by the server to decrypt the transmission data to obtain the encrypted data and the target security policy.

[0106] S405: Call the key generation rule of the target security policy to generate a security key.

[0107] Specifically, after obtaining the target security policy, the target security policy may be extracted to extract the corresponding key generation rule, and a key may be generated based on the key generation rule and used as the security key.

[0108] S406: Decrypt the encrypted data into data to be burned according to the security key and the decryption rule of the target security policy.

[0109] Specifically, by obtaining a security key, a decryption rule followed when encrypting data can be extracted from the target security policy. The decryption rule corresponds to the encryption rule followed when encrypting the data. The security key can be used to decrypt the data to be burned based on the decryption rule to obtain the decrypted data to be burned. Subsequent operations can be performed based on the decrypted data to be burned.

[0110] In an embodiment of the present invention, a server can establish a connection with a target firmware board. Through the established connection, the target firmware board can receive first public key information transmitted by the server. It can be understood that the first public key information is included in a first key pair, and the first key pair is generated by the server based on asymmetric cryptographic rules. The target firmware board can generate a second key pair based on the asymmetric cryptographic rules. The second key pair can include a public key and a private key. The second public key information can be extracted from the second key pair, and the extracted second public key information can be sent to the server. Based on the elliptic curve Diffie-Hellman key exchange protocol, the target firmware board and the server can generate the second key pair and the first key pair respectively. The target firmware board can exchange public key information with the server, obtain the first public key information transmitted by the server, and based on the obtained first public key information and the second private key information generated by the target firmware board itself, use the elliptic curve Diffie-Hellman key exchange protocol to generate a second key pair and a private key pair. The key is calculated by the key exchange protocol, and the key is the same as the key generated by the server based on the elliptic curve Diffie-Hellman key exchange protocol. The key is used as a shared key between the server and the target firmware board. The target firmware board can receive the transmission data transmitted by the server. After the target firmware board receives the transmission data transmitted by the server, the transmission data can be decrypted by using the shared key issued by the server to obtain the encrypted data and the target security policy. The target security policy can be extracted to extract the corresponding key generation rule. A key can be generated based on the key generation rule. The key is used as a security key. A decryption rule followed when encrypting data can be extracted from the target security policy. The decryption rule corresponds to the encryption rule followed when encrypting data. The security key can be used to decrypt the data to be burned based on the decryption rule to obtain the decrypted data to be burned. Subsequent operations can be performed based on the decrypted data to be burned. In the embodiment of the present invention, the use of the elliptic curve Diffie-Hellman key exchange protocol ensures that the server can generate a shared key with the target firmware board. The generation of the shared key ensures that the target firmware board can safely decrypt the encrypted data from the server. Through double decryption, that is, decrypting the target security policy with the shared key, the data to be burned is decrypted based on the decrypted target security policy, thereby ensuring the security of the data before burning.

[0111] Based on the above embodiments, S405 and S406 in the embodiments of the present invention can be replaced by the following steps: loading the target security policy into the test chip of the firmware board; generating a security key in the test chip according to the key generation rules of the target security policy; decrypting the encrypted data into the data to be burned according to the decryption rules of the target security policy in the test chip according to the security key.

[0112] Among them, the test chip is similar to the target firmware board and can be understood as another hardware device that requires data burning.

[0113] Specifically, after the target firmware board obtains the target security policy, the target security policy can be loaded into the test chip, and the test chip can extract the key generation rules and decryption rules in the target security policy, and generate a security key based on the extracted key generation rules. The target security policy can be decrypted based on the shared key to obtain the decryption rules, and the encrypted data can be decrypted based on the security key and the decrypted decryption rules to obtain the data to be burned, and the data to be burned can be transmitted to the target firmware board to complete the burning of the data to be burned.

[0114] Embodiment 5

[0115] On the basis of the above-mentioned embodiment, a burning data transmission system can also be constructed in the embodiment of the present invention. The system can be composed of three parts: a server, a client, and a system level test (System Level Test, SLT) test board. Figure 5 As shown, the preparation work of the server may include developing a firmware upgrade and distribution software. The software needs to integrate encryption algorithms such as symmetric and asymmetric encryption algorithms or HASH digest algorithms, and can complete the functions of data encryption and decryption, digest and signature verification. It also needs to have the function of generating keys. The server network communication interface can interact with the client software through the network port for data. The server is also responsible for developing a security policy library, which is mainly used to maintain encryption and decryption security policies. The library consists of N multiple encryption policy tables with similar structures, such as Figure 6 As shown, the encryption policy table is used to describe the information of the algorithm needed to encrypt and decrypt data; the server can also generate a key pair through the encryption algorithm, and the key pair is responsible for encrypting the data. The client is responsible for developing a data transmission software, which needs to have the function of exchanging data with the host server through the network port, and needs to have the function of communicating locally with the client and the system level test (System Level Test, SLT) test board through the serial port, I2C, USB or other low-speed interface. The preparation work of the SLT test board may include: Figure 7 As shown: Develop a firmware upgrade module. The microcontroller unit or central processing unit of the SLT test board needs to develop a firmware upgrade module. The basic logic of this module should have the following points: software version upgrade management, only supporting upward iteration of the version number, and not allowing rollback; supporting data encryption and decryption and HASH summary decryption, signature verification function; supporting plaintext upgrade and ciphertext upgrade selection; supporting binding with peripherals; supporting identity authentication based on binding; supporting program integrity verification when upgrading the program.

[0116] like Figure 8As shown, the burning data transmission system can execute a burning data transmission method, which may include: the server can use the transplanted ECC256 algorithm to generate a set of key pairs ECC_KEY1, generate a random number RND1, and then send the public key p_key1 and RND1 in ECC_KEY1 to the client as the content of the upgrade or write data request. After the factory client receives the command, it transparently transmits the data to the SLT test board. After the test board receives the command, it uses the transplanted ECC256 algorithm to generate a set of key pairs ECC_KEY2, generates a random number RND2, and then uploads the public key p_key2 and RND2 in ECC_KEY2 to the server through the client. After the server receives the data, it uses the ECDH algorithm to generate a line shared key s_key according to p_key2 and ECC_KEY1. The server uses RND1 and RND2 to perform an XOR operation to obtain a new random number RND3. The server uses RND3 as an index number to search the corresponding encryption policy table in the security policy library. The server generates a key according to the key in the encryption policy table. Strategy, temporarily generate an encryption key t_key, you can use the timestamp as t_key, attach it to the end of the encryption policy table to form a new encryption policy table, you can also customize the key generation logic according to user requirements, use t_key as the key, treat the upgrade program or data M1 according to the requirements of the data encryption policy table to generate ciphertext C1, use s_key to encrypt the encryption policy table to generate ciphertext C2, the server forwards C1 and C2 to the SLT test board through the client, the SLT board uses ECC_KEY2 and p_key1 to generate a shared key s_key according to the ECDH algorithm, the key value here is the same as the key value on the server side, the SLT board uses s_key to perform AES256 algorithm decryption operation on C2 to restore the plaintext encryption policy table, the SLT board parses the encryption policy table, restores the key generation strategy g1, data encryption strategy g2, the SLT board finds t_key at the end of the encryption policy table according to g1, the SLT board uses t_key as the data decryption key, and decrypts and restores C1 according to the requirements of encryption strategy g2,If the policy g2 is a custom non-standard algorithm, it cannot be directly transplanted to the board or server side during the deployment phase, and needs to be dynamically loaded for temporary encryption and decryption calculations: the SLT board will load the encryption algorithm policy data in the encryption policy table into the chip to be burned, let the chip program pointer jump to the address, move the data to the memory and start running, and then decrypt C1 to restore the plaintext M1. The SLT board upgrades the SLT board or writes data to the chip according to the data decrypted by the chip and the instructions issued by the server. The server uses the same method to encrypt the subsequent data. For subsequent chip burning, just repeat the above steps to complete the burning. When it is found that some algorithms are not strong enough, the security is outdated, or the algorithm policy g1 and g2 are leaked, it is necessary to upgrade the security policy library software or generate a new security policy library file. ,

[0117] The embodiment of the present invention ensures that only the authorized target firmware board can perform decryption by transmitting the shared key to the target firmware board, thereby preventing unauthorized decryption. The double encryption of the shared key and the security key increases the difficulty of cracking data, thereby improving the confidentiality of the transmitted data during the transmission process. The target security policy can be flexibly adjusted and defined based on different security requirements, thereby enhancing the flexibility of the burning data transmission method. The target security policy can be flexibly adjusted and defined based on different security requirements, thereby enhancing the flexibility of the burning data transmission method. The burning data can be encrypted and transmitted by remotely connecting to a server, thereby achieving the beneficial effect of enhancing the security of the transmitted data during the transmission and burning process.

[0118] Embodiment 6

[0119] Fig. 9 The present invention provides a schematic diagram of a structure of a burning data transmission device applied to a server. Fig. 9 As shown, the device comprises:

[0120] The key determination module 501 is used to determine the shared key of the target firmware board and transmit the shared key to the target firmware board;

[0121] The data acquisition module 502 is used to determine the security key according to the target security policy, and encrypt the data to be burned based on the security key to obtain encrypted data;

[0122] The data transmission module 503 is used to encrypt the encrypted data according to the shared key and the target security policy, and send the transmission data to the target firmware board.

[0123] In an embodiment of the present invention, a preset key generation rule or a key generation tool can be obtained on the server side, a shared key can be generated based on the preset key generation rule or the key generation tool, the shared key can be transmitted from the server to the target firmware board, the target security policy and the data to be burned waiting to be written into the target firmware board can be obtained, a key can be generated based on the target security policy, the key can be used as a security key, the data to be burned can be encrypted based on the target security policy using the security key to obtain encrypted data to be burned, the encrypted data to be burned can be used as encrypted data, the encrypted data and the target security policy can be integrated to form a comprehensive data set, the comprehensive data set can be encrypted again using the shared key to obtain an encrypted comprehensive data set, the encrypted comprehensive data set can be used as transmission data and transmitted to the target firmware board, the target firmware board receives the transmission data and continues subsequent operations. The embodiment of the present invention ensures that only the authorized target firmware board can perform decryption by transmitting the shared key to the target firmware board, thereby preventing unauthorized decryption. The data encryption and decryption process is simplified through transmission based on the shared key, and the efficiency of data transmission is improved. The double encryption of the shared key and the security key increases the difficulty of cracking the data, thereby improving the confidentiality of the transmitted data during the transmission process.

[0124] On the basis of the above-mentioned embodiments, the data acquisition module 502 of the embodiment of the present invention is specifically used to determine a first key pair based on asymmetric cryptographic rules, and send the first public key information of the first key pair to the target firmware board; obtain the second public key information uploaded by the target firmware board, wherein the second key pair to which the second public key information belongs is generated by the target firmware board based on the asymmetric cryptographic rules; and generate a shared key corresponding to the target firmware board using the second public key information and the first private key information of the first key pair according to the elliptic curve Diffie-Hellman key exchange protocol.

[0125] On the basis of the above-mentioned embodiment, the key determination module 501 of the embodiment of the present invention is specifically used to obtain a first random number generated locally and a second random number generated by a target firmware board; combine the first random number and the second random number into a third random number, and search the target security policy in the security policy library according to the third random number; call the key generation rule of the target security policy to generate a security key; encrypt the data to be burned into encrypted data according to the security key and the encryption rule of the target security policy.

[0126] Embodiment 7

[0127] Fig.10 The present invention provides a schematic diagram of a device for transmitting data for burning target firmware boards. Fig.10 As shown, the device comprises:

[0128] The key acquisition module 601 is used to obtain the shared key sent by the server;

[0129] The data acquisition module 602 is used to determine the encryption data and the target security policy according to the shared key and the transmission data when the transmission data sent by the server is acquired;

[0130] The data decryption module 603 is used to decrypt the encrypted data into data to be burned based on the target security policy.

[0131] In the embodiment of the present invention, the firmware board can be responsible for obtaining the shared key and the transmission data transmitted by the server. After the firmware board obtains the shared key and the transmission data, the shared key can be used to decrypt the transmission data to obtain the encrypted data and the target security policy. After the firmware board obtains the target security policy, the encrypted data can be decrypted according to the target security policy to obtain the data to be burned that needs to be written to the firmware board. In the embodiment of the present invention, the data decryption process is simplified by transmission based on the shared key, the complex authentication process is avoided, the decryption efficiency of the data to be burned is improved, the target security policy is decrypted by the shared key, and the data to be burned is obtained by decryption based on the decrypted target security policy, thereby ensuring the security of the data before burning.

[0132] On the basis of the above embodiments, in an embodiment of the present invention, the key acquisition module 601 is specifically used to obtain first public key information sent by the server, wherein the first key pair to which the first public key information belongs is determined by the server based on an asymmetric key rule; determine a second key pair based on an asymmetric cryptographic rule, and send the second public key information of the second key pair to the server; obtain a shared key generated by the server using the second public key information and the first private key information of the first key pair according to the elliptic curve Diffie-Hellman key exchange protocol.

[0133] The data acquisition module 602 is specifically used to, when receiving the transmission data sent by the server, call the shared key to decrypt the transmission data to obtain the encrypted data and the target security policy.

[0134] The data decryption module 603 is specifically used to call the key generation rule of the target security policy to generate a security key; and decrypt the encrypted data into data to be burned according to the security key and the decryption rule of the target security policy.

[0135] On the basis of the above-mentioned embodiments, in an embodiment of the present invention, the data decryption module 603 can also be used to load the target security policy into the test chip of the firmware board; generate a security key in the test chip according to the key generation rule of the target security policy; and decrypt the encrypted data into the data to be burned according to the decryption rule of the target security policy in the test chip according to the security key.

[0136] Embodiment 8

[0137] Fig.11 A schematic diagram of an electronic device that can be used to implement an embodiment of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device may also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown in the embodiments of the present invention, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the embodiments of the present invention described and / or required herein.

[0138] like Fig.11 As shown, the electronic device includes at least one processor 11, and a memory connected to the at least one processor 11, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 11 can perform various appropriate actions and processes according to the computer program stored in the ROM 12 or the computer program loaded from the storage unit 18 to the RAM 13. In the RAM 13, various programs and data required for the operation of the electronic device 10 can also be stored. The processor 11, the ROM 12, and the RAM 13 are connected to each other through a bus 14. The input / output (I / O) interface 15 is also connected to the bus 14.

[0139] A number of components in the electronic device are connected to the I / O interface 15, including: an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a disk, an optical disk, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0140] The processor 11 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit, a graphics processing unit, various special artificial intelligence computing chips, various processors running machine learning model algorithms, digital signal processors, and any appropriate processors, controllers, microcontrollers, etc. The processor 11 performs the various methods and processes described above, for example, the burning data transmission method.

[0141] In some embodiments, the burning data transmission method can be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 18. In some embodiments, part or all of the computer program can be loaded and / or installed on the electronic device via the ROM 12 and / or the communication unit 19. When the computer program is loaded into the RAM 13 and executed by the processor 11, one or more steps of the burning data transmission method can be performed. Alternatively, in other embodiments, the processor 11 can be configured as the burning data transmission method in any other appropriate manner (for example, by means of firmware).

[0142] Various implementations of the systems and techniques described above in the embodiments of the present invention may be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays, application specific integrated circuits, application specific standard products, systems on a chip, load programmable logic devices, computer hardware, firmware, software, and / or combinations thereof. These various implementations may include: being implemented in one or more computer programs, which may be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general programmable processor, which may receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0143] The computer programs for implementing the methods of the embodiments of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer programs are executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer programs may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0144] In the context of an embodiment of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by an instruction execution system, device or equipment or used in combination with an instruction execution system, device or equipment. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a RAM, a ROM, an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0145] To provide interaction with a user, the systems and techniques described herein may be implemented on an electronic device having: a display device (e.g., a cathode ray tube or a liquid crystal display monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or a trackball) through which the user can provide input to the electronic device. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including: acoustic input, voice input, or tactile input).

[0146] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: local area networks, wide area networks, blockchain networks, and the Internet.

[0147] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The client and server relationship is generated by computer programs running on the respective computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and virtual private server services.

[0148] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0149] The above specific implementations do not constitute a limitation on the protection scope of the embodiments of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A method for transmitting data through burning, characterized in that: Applied to a server, the method comprises: Determine a shared key of a target firmware board and transmit the shared key to the target firmware board; Determine a security key according to a target security policy, and encrypt the data to be burned based on the security key to obtain encrypted data; The encrypted data is encrypted according to the shared key and the target security policy is transmission data, and the transmission data is sent to the target firmware board.

2. The method according to claim 1, characterized in that: The step of determining a shared key of a target firmware board and transmitting the shared key to the target firmware board includes: Determine a first key pair based on an asymmetric cryptographic rule, and send first public key information of the first key pair to a target firmware board; Acquire the second public key information uploaded by the target firmware board, wherein the second key pair to which the second public key information belongs is generated by the target firmware board based on asymmetric cryptographic rules; The second public key information and the first private key information of the first key pair are used to generate a shared key corresponding to the target firmware board according to the elliptic curve Diffie-Hellman key exchange protocol.

3. The method according to claim 1, characterized in that: The step of determining a security key according to a target security policy, and encrypting the data to be burned based on the security key to obtain encrypted data includes: Obtain a first random number generated locally and a second random number generated by the target firmware board; Combining the first random number and the second random number into a third random number, and searching for the target security policy in a security policy library according to the third random number; Invoking the key generation rule of the target security policy to generate the security key; The data to be burned is encrypted into the encrypted data according to the security key and the encryption rule of the target security policy.

4. A burning data transmission method, characterized in that: Applied to a firmware board, the method comprises: Get the shared key sent by the server; When the transmission data sent by the server is obtained, the encryption data and the target security policy are determined according to the shared key and the transmission data; The encrypted data is decrypted based on the target security policy to obtain data to be burned.

5. The method according to claim 4, characterized in that: The step of obtaining the shared key sent by the server includes: Acquire first public key information sent by the server, wherein a first key pair to which the first public key information belongs is determined by the server based on an asymmetric key rule; Determine a second key pair based on an asymmetric cryptographic rule, and send second public key information of the second key pair to the server; Obtain a shared key generated by the server using the second public key information and the first private key information of the first key pair according to the elliptic curve Diffie-Hellman key exchange protocol.

6. The method according to claim 4, characterized in that: When the transmission data sent by the server is obtained, the encryption data and the target security policy are determined according to the shared key and the transmission data, including: When the transmission data sent by the server is received, the shared key is called to decrypt the transmission data to obtain the encrypted data and the target security policy.

7. The method according to claim 4, characterized in that: The decrypting the encrypted data based on the target security policy to obtain data to be burned includes: Invoking the key generation rule of the target security policy to generate a security key; The encrypted data is decrypted into the data to be burned according to the security key and the decryption rule of the target security policy.

8. The method according to claim 4, characterized in that: The decrypting the encrypted data based on the target security policy to obtain data to be burned includes: Loading the target security policy into a test chip of a firmware board; Generate a security key on the test chip according to the key generation rule of the target security policy; The encrypted data is decrypted according to the security key and the decryption rule of the target security policy in the test chip to obtain the data to be burned.

9. An electronic device, characterized in that: The electronic device comprises: at least one processor; and a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the burning data transmission method according to any one of claims 1 to 8.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the burning data transmission method according to any one of claims 1 to 8 when executed.

Images