Data processing method, computer equipment, storage medium and program product

Abstract

The invention discloses a data processing method, computer equipment, a storage medium and a program product, and relates to the technical field of data processing, and the data processing method comprises the following steps: selecting a mapping key stream in a key stream mapping table from target key streams according to a target position determined by a first random number; and the randomness and the complexity of generating the key stream mapping table are increased. The target encryption vector and the target encryption key are acquired, and the target key stream is generated according to the target encryption vector and the target encryption key, so that the complexity of the target key stream is increased. And encrypting the target data into first encrypted data and then loading the first encrypted data into the cache, wherein the data stored in the cache is not original plaintext data. Even if the cache is attacked, the data acquired by an attacker are encrypted data, and due to the randomness of generation of the key stream mapping table, the attacker is effectively prevented from deducing the key stream mapping table according to historical experience, data leakage is effectively prevented, and the security of the data in the cache is protected.

Description

Technical Field

[0001] The present application relates to the field of data processing technology, and in particular to a data processing method, a computer device, a storage medium and a program product. Background Art

[0002] Cache is a high-speed, small-capacity memory located between the computer's central processing unit (CPU) and main memory, used to store data and instructions that the CPU may frequently access in the near future. Cache can also be called buffer memory. If the cache is attacked, the attacker successfully obtains the data in it, which will lead to data leakage and reduce data security. Summary of the invention

[0003] The present application provides a data processing method, a computer device, a storage medium and a program product to at least solve the problem in the related art that cached data is easily leaked when attacked, resulting in low data security.

[0004] The present application provides a data processing method, comprising: The target data is encrypted according to a pre-acquired key stream mapping table to obtain first encrypted data; the key stream mapping table includes a preset number of group mapping key streams; wherein the preset number of group mapping key streams are selected from a target key stream according to a target position, the target key stream is generated by a target key stream generation operation, the target key stream generation operation includes: obtaining a target encryption vector and a target encryption key, generating a target key stream according to the target encryption vector and the target encryption key, and the target position is determined according to a first random number; The first encrypted data is loaded into the cache.

[0005] The present application also provides a computer device, comprising: a memory for storing a computer program; and a processor for implementing the steps of the above-mentioned data processing method when executing the computer program.

[0006] The present application also provides a computer storage medium, in which a computer program is stored, wherein when the computer program is executed by a processor, the steps of the above-mentioned data processing method are implemented.

[0007] The present application also provides a computer program product, including a computer program, which implements the steps of the above-mentioned data processing method when the computer program is executed by a processor.

[0008] The present application increases the complexity of the target key stream by obtaining a target encryption vector and a target encryption key, and generating a target key stream according to the target encryption vector and the target encryption key. According to the target position determined by the first random number, a mapping key stream in the key stream mapping table is selected from the target key stream. The randomness and complexity of the key stream mapping table generation are increased. The target data is encrypted into the first encrypted data and then loaded into the cache. The data stored in the cache is not the original plaintext data. Even if the cache is attacked, the data obtained by the attacker is also encrypted data. Due to the randomness and complexity of the key stream mapping table generation, it is effectively avoided that the attacker infers the key stream mapping table used by the obtained encrypted data based on historical attack experience, effectively preventing the attacker from successfully decrypting the data, effectively preventing data leakage, and protecting the security of the data in the cache. BRIEF DESCRIPTION OF THE DRAWINGS

[0009] In order to more clearly illustrate the embodiments of the present application, the following is a brief introduction to the drawings required for use in the embodiments. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0010] Figure 1 A schematic diagram of a hardware architecture provided for an embodiment of the present application; Figure 2 A schematic diagram of a data processing method provided in an embodiment of the present application; Figure 3 A schematic diagram of the data structure of target data provided in an embodiment of the present application; Figure 4 A schematic diagram of the data structure of the first encrypted data provided in an embodiment of the present application; Figure 5 A schematic diagram of the structure of a random access memory provided in an embodiment of the present application; Figure 6 A schematic diagram of another data processing method provided in an embodiment of the present application; Figure 7 A schematic diagram of the location for adding the first verification code provided in an embodiment of the present application; Figure 8 A schematic diagram of the structure of a computer device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0011] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0012] It should be noted that, in the description of this application, the terms "include", "comprise" or any other variant thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also includes other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. The terms "first", "second", etc. in this application are used to distinguish similar objects, and are not used to describe a specific order or sequence.

[0013] Among the related technologies, data security protection mainly adopts the following two common methods: Software protection mechanism: Rely on various strategies and algorithms at the software level, such as access control, data encryption software, etc., to ensure that data is not stolen. This method usually performs protection operations at the operating system or application level, and limits illegal access to data by setting permissions, encryption key management, etc.

[0014] Hardware protection mechanism: Use the characteristics of hardware devices to protect data. For example, use algorithms such as the Advanced Encryption Standard (AES) to encrypt and decrypt data in the cache, so that the data stored in the cache exists in ciphertext form to prevent the data from being illegally obtained during the storage process.

[0015] However, the related technology has obvious disadvantages: Limitations of software protection mechanisms: Software protection mechanisms can only provide protection at the upper layer, and their security is highly dependent on the integrity of the system and the confidentiality of the key. Once a system vulnerability occurs, such as malware attack or system configuration error, or key information such as keys is illegally obtained, the software protection mechanism will not be able to effectively protect the data, and attackers can easily bypass the software-level protection measures and obtain sensitive data.

[0016] Defects of hardware protection mechanism: When performing encryption and decryption calculations, the current symmetric encryption algorithms (such as AES) have a large delay in data output due to the complexity of their algorithms, and require multiple clock cycles to complete an encryption or decryption operation. This results in the inability to implement pipeline operations during data processing, that is, the inability to continuously encrypt or decrypt data, which seriously reduces the overall performance of the system. In addition, the encryption and decryption processes each require an independent algorithm core for calculation, which undoubtedly increases the occupation of hardware resources, brings about a large hardware resource overhead, and limits the scalability and cost-effectiveness of the system.

[0017] For traditional symmetric encryption algorithms, the key is the key to data security. Once the key is obtained by an attacker, the data in the entire cache will lose security. Because the symmetric encryption algorithm uses the same key for encryption and decryption, the attacker can use the obtained key to easily decrypt all the data in the cache, resulting in data leakage and serious security consequences.

[0018] To this end, the present application designs a data processing method, a computer device, a storage medium and a program product to solve the above-mentioned problems.

[0019] By redesigning the cache architecture, the data storage and access methods are optimized to make it more suitable for encryption processing. At the same time, the encryption and decryption algorithms are improved, and more efficient and faster algorithms are adopted to reduce computing delays and increase data processing speed.

[0020] In terms of key management, this application introduces an update mechanism for encryption keys, encryption vectors, and key stream mapping tables, which can update encryption keys, encryption vectors, or key stream mapping tables regularly or according to specific conditions, increasing the randomness and unpredictability of keys and reducing the risk of keys being cracked. This application implements encryption processing of cache data, which improves data security while generating no additional delays in the cache reading process, ensuring high-performance operation of the system.

[0021] In order to enable those skilled in the art to better understand the present application, the present application is further described in detail below in conjunction with the accompanying drawings and specific implementation methods.

[0022] In conjunction with the specific application environment architecture or the specific hardware architecture on which the execution of the data processing method depends, the specific application environment architecture or the specific hardware architecture is described herein.

[0023] Figure 1 A schematic diagram of a hardware architecture provided in an embodiment of the present application. The technical solution of the present application is applied to Figure 1 The hardware architecture is shown.

[0024] The hardware architecture mainly includes: random number generator, random access memory (RAM), cache, and computing core unit.

[0025] A random number generator is used to generate random numbers; as an example, consider that random number generators include two main types: true random number generators (TRNG) and pseudo random number generators (PRNG). A pseudo random number generator generates random numbers based on a fixed algorithm, while a true random number generator utilizes the randomness of physical processes, such as thermal noise, circuit jitter, or atomic fission, to generate random numbers through these unpredictable and uncontrollable physical phenomena. The random numbers generated by a true random number generator have no definite trend and significant regularity, and are not easy to be predicted and attacked, but at the same time are also not easy to control, and are generally more secure than pseudo random numbers. Therefore, the random number generator in this application is preferably a true random number generator.

[0026] The operation core unit is used to perform a target key stream generation operation, specifically to obtain a target encryption vector IV and a target encryption key KEY, and to generate a target key stream according to the target encryption vector and the target encryption key. As an example, taking the Zu Chongzhi algorithm as an example, the operation core unit can be a Zu Chongzhi algorithm operation core unit, and the Zu Chongzhi algorithm operation core unit can generate a target key stream according to the obtained target encryption vector and target encryption key based on the Zu Chongzhi algorithm.

[0027] The random access memory is used to store the key stream mapping table, and the random access memory is a hardware structure corresponding to the key stream mapping table. In the present application, the target data is allowed to be input only after the key stream mapping table is initialized or updated.

[0028] The cache is used to store the first encrypted data and the first verification code.

[0029] The technical solution of the present application is applicable to existing caches. As an example, the cache specification can be 64 bytes, the depth is 256, the total capacity is 16KB, and the data part of the target data (Cache line) is 512 bits / bit. The data bit width of the random access memory is the length of the data part of the target data, that is, 512 bits. The depth can be set and modified according to actual conditions. In this example, the depth is set to 256, that is, the RAM address is from 0-255. Then writing the key stream mapping table requires a target key stream of 512*256=131072 bits. The key stream mapping table includes a preset number (256) groups of mapped key streams, and each group of mapped key streams includes a 512-bit target key stream.

[0030] In addition, the hardware architecture includes: A check generator is used to determine a first check code according to the first encrypted data.

[0031] The check checker is used to determine a second check code based on the second encrypted data.

[0032] The output control module is used to write a preset number of group mapping key streams selected from the target key stream into the key stream mapping table according to the target position SEL.

[0033] The embodiment of the present application provides a data processing method. Figure 2 A data processing method flow chart provided in an embodiment of the present application is as follows: Figure 2 The execution flow of the data processing method is shown and the data processing method is described in detail.

[0034] S101: Encrypt target data according to a pre-acquired key stream mapping table to obtain first encrypted data.

[0035] In this embodiment, the key stream mapping table includes a preset number of group mapping key streams.

[0036] In this embodiment, a preset number of group mapping key streams are selected from a target key stream based on a target position, and the target key stream is generated by a target key stream generation operation. The target key stream generation operation includes: obtaining a target encryption vector and a target encryption key, and generating a target key stream based on the target encryption vector and the target encryption key. The target position is determined based on a first random number.

[0037] In this embodiment, the first random number can be generated by a random number generator. As an example, the random number generator is a true random number generator. The preset number group mapping key stream in the key stream mapping table is selected from the target key stream according to the target position generated based on the first random number. The first random number generated by the true random number generator ensures the randomness of the target position, and a group of mapping key streams corresponds to a basic data unit (target data), which makes the encryption more random and increases the security of the encryption. Even if the attacker obtains part of the key stream mapping table information, it is difficult to infer the complete key stream mapping table due to the randomness of the target position.

[0038] In this embodiment, instead of writing all of the generated target key stream into the key stream mapping table, a portion of the target key stream is selected and written into the key stream mapping table.

[0039] As an example, the set of all binary numbers stored in the key stream mapping table is composed of the binary number (bit) at the next position of the target position in the target key stream, all binary numbers between the binary number at the first cutoff position, and the binary number at the first cutoff position. The first cutoff position is the target position + the number of binary numbers in the key stream mapping table.

[0040] For example, when the first random number is used as the target position, the first random number is 16, the target position is determined to be the 16th bit in the target key stream, and the binary number of the 17th bit in the target key stream, the binary numbers from the 17th to the 131088th (16+131072)th bits, and the binary number of the 131088th bit are written into the key stream mapping table.

[0041] As another example, the set of all binary numbers stored in the key stream mapping table is composed of the binary number at the target position in the target key stream, all binary numbers between the binary number at the second cutoff position, and the binary number at the second cutoff position, wherein the second cutoff position is the target position + the number of binary numbers in the key stream mapping table - 1.

[0042] For example, when the first random number + 1 is used as the target position, the first random number is 16, and the target position is determined to be the 17th bit in the target key stream. The binary number of the 17th bit in the target key stream, the binary numbers from the 17th to the 131088th (17+131072-1)th bits, and the binary number of the 131088th bit are written into the key stream mapping table.

[0043] In this embodiment, the target data is a basic data unit (Cache line) for cache storage and data transmission. Figure 3 The data structure diagram of the target data provided in the embodiment of the present application is taken as an example. Figure 3 The data structure of the target data shown includes: VAL: valid bit (valid part), ADDR: address bit (address part), DATA: data bit (data part). Specifically, the address bit includes: tag bit, index bit and offset bit. In this embodiment, the bit widths of different parts of caches of different specifications are different. As an example, the specification of the cache Cache can be 64 bytes, the depth is 256, the total capacity is 16KB, and the data part of the target data (Cache line) is 512 bits / bit. As an example, Figure 4 A schematic diagram of the data structure of the first encrypted data provided in the embodiment of the present application, such as Figure 4 As shown, the data structure of the first encrypted data includes: VAL: valid bit (valid part), ADDR: address bit (address part), DATA_CRYPTO: data bit (data part).

[0044] In this embodiment, the hardware structure corresponding to the key stream mapping table is a random access memory. As an example, Figure 5 A schematic diagram of the structure of a random access memory provided in an embodiment of the present application, as shown in FIG. Figure 5 Taking the structure of the random access memory shown as an example, the depth can be 256, that is, the RAM address is from 0-255, n=255. Then the key stream mapping table includes a preset number (256) groups of mapping key streams, and each group of mapping key streams includes a 512-bit target key stream. In this embodiment, a group of mapping key streams corresponding to the target data can be bitwise XORed with the target data to obtain the first encrypted data. Specifically, a group of mapping key streams corresponding to the target data can be determined from the key stream mapping table according to the address part of the target data, that is, the mapping key stream for encrypting the target data. A group of mapping key streams corresponding to the target data can be bitwise XORed with the data part of the target data to obtain the first encrypted data. A group of mapping key streams and the data part DATA of the target data have the same length. As an example, the length of the data part of the target data and a group of mapping key streams can both be 512 bits, and the length of the corresponding data part DATA_CRYPTO of the first encrypted data is also 512 bits. In this embodiment, considering that the RAM address ranges from 0 to 255, the key stream mapping table includes 256 groups of mapping key streams. Therefore, a group of mapping key streams corresponding to the target data can be determined from the key stream mapping table based on the lower 8 bits of the address part of the target data (ie, ADDR[7:0]).

[0045] The value of ADDR[7:0] is the address of the RAM of the key stream mapping table TABLE. When ADDR[7:0]=0, Z_out(0) is selected. When ADDR[7:0]=2, Z_out(2) is selected, and so on. During encryption operation, the data part DATA in the target data cache line is bitwise XORed with the mapping key stream Z_out to encrypt the data. The address bit and valid bit are not encrypted. The calculation formula is as follows: DATA_CRYPTO=DATA⊕Z_out, where DATA_CRYPTO represents the data part of the first encrypted data, DATA represents the data part of the target data, Z_out represents a set of mapping key streams corresponding to the target data, and ⊕ represents a bitwise XOR operation. The data part of the target data is encrypted using a bitwise XOR operation, which is simple to operate and has high security. The characteristics of the bitwise XOR operation make it possible to decrypt the data only when the target data and the corresponding set of mapping key streams are known at the same time, and the randomness and unpredictability of the mapping key stream ensure the security of the encrypted data. At the same time, the address bits and valid bits are not encrypted, which does not affect the cache's management and positioning functions for data. The computational complexity of the bitwise XOR operation is low, and the encryption of the target data can be completed in a short time without a significant impact on the performance of the system. A set of mapping key streams corresponding to the target data is determined from the RAM through the lower 8 bits of the address part of the target data, thereby achieving fast key search and encryption operations.

[0046] In this embodiment, as an example, taking Zu Chongzhi's algorithm as an example, the target key stream generation operation can be specifically based on Zu Chongzhi's algorithm, and the target key stream can be generated according to the target encryption vector and the target encryption key. Specifically, the target encryption vector and the target encryption key can be input into a linear feedback shift register, and the linear feedback shift register performs a shift operation according to a built-in feedback function. During the shift operation, the state of the linear feedback shift register is updated, and output bits are generated at the same time. The output bits are used as the original data source for generating the target key stream. The output bits of a preset length are extracted from the output bits, and a reorganization operation is performed on them to obtain reorganized data, so that the reorganized data meets the input requirements of the nonlinear function F. The reorganized data is processed by the nonlinear function F to obtain an output result. A part of the output result is output as a component of the target key stream for subsequent encryption or decryption operations. The other part is fed back to the linear feedback shift register to update the state of the linear feedback shift register. Through this feedback mechanism, the state of the linear feedback shift register is continuously adjusted according to the output of the nonlinear function F, thereby generating different output bits and providing new data for subsequent operations. The above process is continuously iterated. The target key stream can be continuously generated with the continuous shifting of the linear feedback shift register, the bit reorganization and the operation of the nonlinear function F. Since the state of the linear feedback shift register, the output bits extracted by the bit reorganization and the input of the nonlinear function F may be different in each iteration, the target key stream finally generated has good randomness and unpredictability. The target key stream generated according to the target key stream generation operation is a continuous key stream sequence.

[0047] In the above example, the core unit of Zu Chongzhi's algorithm operation may include: a linear feedback shift register, a bit reorganization module, a nonlinear function F module and an iteration module. The linear feedback shift register is used to perform a shift operation according to a built-in feedback function. During the shift operation, the state of the linear feedback shift register is updated and output bits are generated at the same time. The bit reorganization module is used to extract output bits of a preset length from the output bits and perform a reorganization operation on them to obtain reorganized data. The nonlinear function F module is used to process the reorganized data to obtain an output result. The iteration module is used to output a part of the output result as a target key stream for subsequent encryption or decryption operations. The other part is fed back to the linear feedback shift register to continuously generate the target key stream through loop iteration. This loop iteration mechanism makes the state and input in each iteration possibly different, so that the generated target key stream has good randomness and unpredictability. It is difficult for an attacker to predict the subsequent key stream by analyzing the existing key stream, which greatly improves the security of encryption.

[0048] S102: Load the first encrypted data into the cache.

[0049] In this embodiment, each basic data unit (target data) is encrypted by the above-mentioned technical solutions of S101-S102, and the encrypted first encrypted data is loaded into the cache.

[0050] The present application increases the complexity of the target key stream by obtaining a target encryption vector and a target encryption key, and generating a target key stream according to the target encryption vector and the target encryption key. According to the target position determined by the first random number, a mapping key stream in the key stream mapping table is selected from the target key stream. The randomness and complexity of the key stream mapping table generation are increased. The target data is encrypted into the first encrypted data and then loaded into the cache. The data stored in the cache is not the original plaintext data. Even if the cache is attacked, the data obtained by the attacker is also encrypted data. Due to the randomness and complexity of the key stream mapping table generation, it is effectively avoided that the attacker infers the key stream mapping table used by the obtained encrypted data based on historical attack experience, effectively preventing the attacker from successfully decrypting the data, effectively preventing data leakage, and protecting the security of the data in the cache.

[0051] The embodiment of the present application provides another data processing method. Figure 6 A flowchart of another data processing method provided in an embodiment of the present application is shown as follows: Figure 6 The execution flow of the data processing method is shown and the data processing method is described in detail.

[0052] S201: Encrypt the target data according to the pre-acquired key stream mapping table to obtain first encrypted data. For details, refer to the relevant description of S101, which will not be repeated here.

[0053] S202: Load the first encrypted data into the cache. For details, refer to the relevant description of S102, which will not be repeated here.

[0054] S203: Determine a first verification code according to the first encrypted data.

[0055] In this embodiment, the first verification code and the first encrypted data may be stored and loaded into the cache in correspondence. As an example, Figure 7 As shown, the first check code LRC can be added to the end of the first encrypted data. Figure 7 The data structure shown is loaded into the cache.

[0056] In this embodiment, the first check code can be determined according to the data part DATA_CRYPTO of the first encrypted data. Specifically, the data part DATA_CRYPTO of the first encrypted data can be evenly divided into several groups according to the preset data amount. The first check code LRC is determined by performing bitwise XOR operation on the several groups in sequence.

[0057] As an example, taking the length of the data part of the first encrypted data as 512 bits, when the preset data amount is 8 bits / 1 BYTE, DATA_CRYPTO can be evenly divided into 64 groups according to 8 bits: LRC_BYTE[0]=DATA_CRYPTO[7:0].

[0058] LRC_BYTE[1]=DATA_CRYPTO[15:8].

[0059] LRC_BYTE[2]=DATA_CRYPTO[23:16].

[0060] … LRC_BYTE

[63] =DATA_CRYPTO[511:504].

[0061] Perform a bitwise XOR operation on the 64 groups of LRC_BYTE to determine the first check code LRC.

[0062] LRC=LRC_BYTE[0]⊕LRC_BYTE[1]……⊕LRC_BYTE

[63] .

[0063] In this embodiment, the first verification code and the first encrypted data are stored and loaded into the cache correspondingly, which is conducive to improving the access efficiency of data. When these data are needed, they can be directly obtained from the cache, avoiding the overhead of frequently reading data from the storage device, reducing the delay of data processing, and improving the overall performance of the system.

[0064] S204: Read the second encrypted data from the storage location of the first encrypted data, and determine a second verification code according to the second encrypted data.

[0065] In this embodiment, the second encrypted data may be read from the storage location of the first encrypted data in the cache.

[0066] In this embodiment, according to the second encrypted data, determining the second check code specifically includes: evenly dividing the data portion of the second encrypted data into several groups according to the preset data amount. Performing bitwise XOR operations on the several groups in sequence to determine the second check code. Specifically refer to the above-mentioned scheme of evenly dividing the data portion DATA_CRYPTO of the first encrypted data into several groups according to the preset data amount, and performing bitwise XOR operations on the several groups in sequence to determine the first check code LRC, and determining the second check code LRC_RD. Specifically, taking the length of the data portion of the second encrypted data as 512 bits as an example, when the preset data amount is 8 bits / 1BYTE, the data portion DATA_CRYPTO1 of the second encrypted data can be evenly divided into 64 groups according to 8 bits: LRC_BYTE1[0]=DATA_CRYPTO1[7:0].

[0067] LRC_BYTE1[1]=DATA_CRYPTO1[15:8].

[0068] LRC_BYTE1[2]=DATA_CRYPTO1[23:16].

[0069] … LRC_BYTE1

[63] =DATA_CRYPTO1[511:504].

[0070] Perform a bitwise XOR operation on the 64 groups of LRC_BYTE1 to determine the second check code LRC1.

[0071] LRC1=LRC_BYTE1[0]⊕LRC_BYTE1[1]……⊕LRC_BYTE1

[63] .

[0072] In this embodiment, the scheme for determining the second check code is consistent with the scheme for determining the first check code, both of which are to evenly group the data parts according to the preset data volume, and then perform bitwise XOR operation on the groups. This unified calculation method is easy to implement and maintain, and there is no need to design different check code calculation logic for different encrypted data, which reduces development costs and complexity. The bitwise XOR operation itself has the characteristics of fast calculation speed, which is particularly suitable for processing large amounts of data. Even if the length of the data part of the second encrypted data reaches 512 bits or even longer, the calculation of the check code can be completed in a short time, which will not bring too much calculation burden to the system, and ensure the high efficiency of data processing.

[0073] S205: When the first verification code and the second verification code are the same, decrypt the second encrypted data according to the key stream mapping table to obtain the target data.

[0074] In this embodiment, the first verification code can be read from the cache to determine whether the first verification code and the second verification code are the same. When the first verification code and the second verification code are the same, it means that the data in the cache has not been tampered with or deleted, and the first encrypted data and the second encrypted data are the same. The second encrypted data can be decrypted according to the key stream mapping table to obtain the target data. The target data obtained after decryption can be passed to the CPU for further processing, such as participating in operations such as calculations and logical judgments. As an example, if the data structure is Figure 7 In the form shown, when the target data obtained after decryption is transmitted to the lower level, the first check code needs to be discarded.

[0075] In this embodiment, when the first check code and the second check code are different, it means that the data in the cache has been tampered with or deleted, the first encrypted data and the second encrypted data are different, there is a data security problem, the second encrypted data needs to be discarded and no longer transmitted backward, and the error is reported through an interrupt, which can prevent the erroneous data from causing the CPU to execute an erroneous instruction. In this case, the data security problem can be promptly informed to the system through the interrupt error reporting, so that the system can take corresponding measures, such as recording error information, notifying the user, performing error recovery operations or stopping related tasks, to prevent the erroneous data from causing further damage to the system. At the same time, the interrupt handler can perform detailed analysis and processing according to the specific error situation, which is helpful for system fault diagnosis and maintenance.

[0076] In this embodiment, decrypting the second encrypted data according to the key stream mapping table to obtain the target data specifically includes: A set of mapping key streams corresponding to the second encrypted data is determined based on the address portion of the second encrypted data.

[0077] A set of mapping key streams corresponding to the second encrypted data is subjected to a bitwise exclusive OR operation with a data portion of the second encrypted data to obtain target data.

[0078] As an example, the length of the data part DATA_CRYPTO1 of the second encrypted data is also 512 bits. In this embodiment, considering that the RAM address is from 0 to 255, the key stream mapping table includes 256 groups of mapping key streams. Therefore, a group of mapping key streams corresponding to the second encrypted data can be determined from the key stream mapping table according to the lower 8 bits (i.e., ADDR[7:0]) of the address part of the second encrypted data.

[0079] The value of ADDR[7:0] is the address of the RAM of the key stream mapping table TABLE. When ADDR[7:0]=0, Z_out(0) is selected. When ADDR[7:0]=2, Z_out(2) is selected, and so on. During the decryption operation, the data part DATA_CRYPTO1 of the second encrypted data is bitwise XORed with the mapping key stream Z_out to achieve data decryption. The address bit and valid bit are not decrypted. The calculation formula is as follows: DATA=DATA_CRYPTO1⊕Z_out1, where DATA_CRYPTO1 represents the data portion of the second encrypted data, DATA represents the data portion of the target data, Z_out1 represents a set of mapping key streams corresponding to the second encrypted data, and ⊕ represents a bitwise XOR operation.

[0080] In an optional implementation, the data processing method further includes: A random number generated by a random number generator and related to a start time of a target key stream generation operation is determined as a first random number.

[0081] As an example, the random number related to the start time of the target key stream generation operation is: a random number closest to the start time of the target key stream generation operation.

[0082] As an example, the random number generated by the random number generator at the start time of the target key stream generation operation can be used as the first random number. Considering that there may be a time difference, the random number generated by the random number generator at the time closest to the start time of the target key stream generation operation can be used as the first random number, for example, 16. The target position is the 16th bit of the generated target key stream, and the target key stream is counted from the start of generation. When the target key stream is generated to the 16th bit, that is, the target position, the 131072-bit target key stream generated after the target position (the 17th bit) is sequentially written into the key stream mapping table / RAM.

[0083] As an example, the selection signal SEL may be determined according to the first random number, and when the total length of the target key stream generated reaches the selection signal SEL, the target key stream of 131072 bits generated thereafter is sequentially written into the key stream mapping table / RAM.

[0084] In the present application, in addition to the above-mentioned method of writing the 131072-bit target key stream generated after the target position (the 17th bit) into the key stream mapping table / RAM in sequence, the preset number of groups of mapped key streams can also be selected from the target key stream according to multiple groups of random numbers. Each group of random numbers includes a first digit and a second digit, the first digit is used to determine the write position, and the second digit is used to determine the write length. Key stream fragments of corresponding lengths can be extracted from the target key stream according to the multiple groups of random numbers and written into the key stream mapping table. The i-th write operation is used to write the target key stream of the write length determined by the second digit in the i-th group of random numbers into the key stream mapping table. The random number generated by the random number generator and related to the start time of the target key stream generation operation is determined as the first digit in the first group of random numbers. The random number generated at the next moment after the first digit in the first group of random numbers is generated is determined as the second digit in the first group of random numbers.

[0085] The random number generated by the random number generator and related to the end time of the i-th write operation is determined as the first digit in the i+1-th group of random numbers, and the random number generated at the next moment after the first digit in the i+1-th group of random numbers is generated is determined as the second digit in the i+1-th group of random numbers.

[0086] For the i-th group of random numbers, the writing position determined by the first digit of the i-th group of random numbers is .in, Represents the first digit of the i-th group of random numbers, Indicates the second digit of the i-th group of random numbers.

[0087] As an example, the first group of random numbers are (20, 30), and the second group of random numbers are (10, 100).

[0088] The write position determined by the first digit in the first group of random numbers is the 21st bit, and the write length is 30 bits.

[0089] When the generated length reaches the 20th bit, the key stream fragment from the 21st bit to the 50th bit is written into the key stream mapping table (the first write operation). The random number generated by the random number generator and related to the end time of the first write operation (the time of writing the 50th bit) is determined as the first digit in the second group of random numbers, for example, 10, and the random number generated at the next moment after the first digit in the second group of random numbers is generated is determined as the second digit in the second group of random numbers, for example, 100.

[0090] The write position determined by the first bit in the second group of random numbers is the 61st bit, and the write length determined by the second bit in the second group of random numbers is 100 bits. When the generated length reaches the 60th bit, the key stream fragment from the 61st bit to the 160th bit is written into the key stream mapping table (the second write operation).

[0091] In this embodiment, the write position and write length are determined by a random number generator, so that the randomness and complexity of the key stream mapping table are further improved. It is difficult for an attacker to predict the storage position and length of the key stream fragment, which increases the difficulty of reversely deriving the complete key stream from the key stream mapping table, and effectively improves the security of the key stream. The random number is associated with the start time of the target key stream generation operation and the end time of each write operation, so that the generation of the random number is closely combined with the generation and writing process of the key stream. This dynamic association further enhances the confidentiality of the key stream storage, because even if the attacker obtains part of the mapping table information, it is difficult to restore the complete key stream due to the dependency between the random number and the operation time.

[0092] In an optional implementation, the data processing method further includes: A target encryption vector is determined according to a second random number generated by a random number generator.

[0093] As an example, in the initialization phase of the key stream mapping table, the first set of true random numbers generated when the true random number generator is powered on can be used as the second random number, and the second random number is the target encryption vector.

[0094] As another example, a random number closest to the time when the target encryption vector is determined is used as the second random number, and the second random number is the target encryption vector.

[0095] In this embodiment, for the update phase of the key stream mapping table, a group of true random numbers generated by the true random number generator at the time when the key stream mapping table / random access memory receives the key stream mapping table update request can be used as the second random number. In the case of considering the existence of a time difference, a group of true random numbers generated by the true random number generator at the target time can be used as the second random number. The target time is the time closest to the time when the key stream mapping table / random access memory receives the key stream mapping table update request.

[0096] In an optional implementation, the data processing method further includes: When a key update request is received, an updated encryption key is determined and the updated encryption key is used as a target encryption key.

[0097] In this embodiment, the target encryption key may be a fixed encryption key or an updateable encryption key. When the target encryption key is an updateable encryption key, if a key update request is received, an updated encryption key is determined and the updated encryption key is used as the target encryption key.

[0098] In this embodiment, the target encryption key can be obtained from the system. Taking the hardware structure of the above example as an example, the fixed encryption key is directly transferred to the computing core unit after being obtained, and participates in subsequent operations, and the target encryption key does not change. For the updateable encryption key, the cache is also transferred to the computing core unit after being obtained from the system, and participates in subsequent operations. However, when the target encryption key is updated, the computing core unit needs to regenerate a new target key stream, and then update it to the key stream mapping table to implement the update of the key stream mapping table.

[0099] In this embodiment, the specific update method of the encryption key is not limited. For example, it can be updated according to a random number, and the random number generated at the moment of receiving the key update request is used as the updated encryption key. Alternatively, the old encryption key and other information (such as timestamp, random number) can be processed by a hash function to generate a new encryption key. In this embodiment, a key update request can be periodically generated according to a preset period, and the encryption key can be regularly updated. The encryption key can also be dynamically updated according to system requirements. For example, it can be determined whether the encryption key needs to be updated according to the access frequency of the CPU accessing the Cache. When the access frequency is greater than the preset value, a key update request is generated to update the encryption key. The encryption key can be flexibly adjusted according to the actual operating status of the system. When the system activity is frequent and may face higher security risks, the encryption key is updated in time to enhance the security of the system.

[0100] In this embodiment, a target key stream can be generated according to the updated encryption key and the target encryption vector, thereby realizing the update of the target key stream so as to update the key stream mapping table, thereby avoiding the long-term use of the same key stream mapping table, reducing the potential security risks caused by the reuse of the mapped key stream, and improving data security.

[0101] In an optional implementation, the data processing method further includes: When a key stream mapping table update request is received, the key stream mapping table is updated.

[0102] In this embodiment, as an example, when the random access memory receives a key stream mapping table update request, the random number related to the moment when the random access memory receives the key stream mapping table update request is used as the second random number. As an example, the random number generated by the random number generator at the moment when the random access memory receives the key stream mapping table update request can be used as the second random number, and the target encryption vector is determined. Thereby, the target encryption vector is updated, and then the target mapping stream is regenerated, the target position is re-determined, and finally the key stream mapping table is updated. In this embodiment, the random number generated by the random number generator at the moment when the random access memory receives the key stream mapping table update request is used as the second random number to update the target encryption vector, thereby updating the target key stream, and the target position can be re-determined in the process of regenerating the target key stream, which increases the randomness and complexity of the key stream mapping table update.

[0103] In this embodiment, a key stream mapping table update request can be generated periodically according to a preset period, and the key stream mapping table can be updated regularly. The key stream mapping table can also be dynamically updated according to system requirements. For example, whether the key stream mapping table needs to be updated can be determined based on the access frequency of the CPU accessing the cache. When the access frequency is greater than the preset value, a key stream mapping table update request is generated to update the key stream mapping table. A key stream mapping table update request can be generated to update the key stream mapping table when, for example, hardware is upgraded, software is updated, or the network environment changes. Updating the key stream mapping table regularly or according to requirements can effectively resist attackers' analysis of the key stream. Dynamic updates make it difficult for attackers to accumulate enough information for effective analysis, thereby improving the anti-attack capability of encrypted data.

[0104] The technical solution of the present application relates to an initialization phase of a key stream mapping table and an updating phase of the key stream mapping table.

[0105] Embodiment 1, for the initialization phase of the key stream mapping table, taking Zu Chongzhi's algorithm as an example, the technical solution of this application is: Get the target encryption key; Specifically, the target encryption key may be obtained from the system through the cache. As an example, the system may be an operating system, a communication system, etc.

[0106] Generate a target encryption vector; Specifically, in the initialization phase, the first set of true random numbers generated by the random number generator after power-on can be used as the target encryption vector.

[0107] Inputting the target encryption key and the target encryption vector into the computing core unit; Specifically, the Zu Chongzhi algorithm operation core unit performs a target key stream generation operation based on the Zu Chongzhi algorithm to generate a target key stream.

[0108] According to the target position, a part (a preset number of group mapping key streams) is selected from the target key stream and written into the key stream mapping table; Specifically, if the hardware structure corresponding to the key stream mapping table is a random access memory, the data bit width of the random access memory is the length of the data part of the target data, that is, 512 bits, and the depth can be set and modified according to the actual situation. In this example, the depth is set to 256, that is, the RAM address is from 0 to 255. Then writing the key stream mapping table requires a target key stream of 512*256=131072 bits.

[0109] Specifically, the random number generated by the random number generator, specifically the true random number generator, at the time when the target key stream generation operation starts to be executed can be used as the first random number; the target position is determined according to the first random number. When the first random number is 16, after the length of the target key stream generation reaches 16 bits of the target position, the 131072-bit key stream generated after the 16th bit is written into the empty key stream mapping table to complete the initialization of the key stream mapping table.

[0110] Embodiment 2, for the update phase of the key stream mapping table, taking Zu Chongzhi's algorithm, the key stream mapping table / random access memory receives a key stream mapping table update request as an example, the technical solution of the present application is: Get the target encryption key; Specifically, the target encryption key may be obtained from the system through the cache. As an example, the system may be an operating system, a communication system, etc.

[0111] updating the encryption vector and using the updated encryption vector as the target encryption vector; Specifically, for the update phase, a group of true random numbers generated by a random number generator at a target time can be used as the second random number, and the second random number is a target encryption vector. The target time is the time closest to the time when the key stream mapping table / random access memory receives a key stream mapping table update request. As an example, a group of true random numbers generated by a true random number generator at the time when the key stream mapping table / random access memory receives a key stream mapping table update request can be used as the second random number.

[0112] Inputting the target encryption key and the target encryption vector (the updated encryption vector) into the computing core unit; Specifically, the Zu Chongzhi algorithm operation core unit performs a target key stream generation operation based on the Zu Chongzhi algorithm; the target key stream generation operation is used to obtain a target encryption vector (an updated encryption vector) and a target encryption key, and the key stream is regenerated according to the target encryption vector (an updated encryption vector) and the target encryption key, and the regenerated key stream is used as the target key stream.

[0113] At the time when the target key stream generation operation starts to be executed, the random number generated by the random number generator is used as the first random number; the position is updated according to the first random number, and the updated position is used as the target position.

[0114] According to the target position (updated position), a part (a preset number of group mapping key streams) is selected from the target key stream and written into the key stream mapping table to complete the update of the key stream mapping table. When the first random number is 20, after the length of the target key stream generated reaches 20 bits of the target position, the 131072-bit key stream generated after the 20th bit is written into the key stream mapping table to complete the update of the key stream mapping table.

[0115] Embodiment 3, for the update phase of the key stream mapping table, taking Zu Chongzhi's algorithm, receiving a key update request as an example, the technical solution of this application is: When a key update request is received, an updated encryption key is determined and the updated encryption key is used as a target encryption key.

[0116] Get the target encryption vector; Specifically, for the first update in the initialization phase, the target encryption vector is the first set of true random numbers generated after the random number generator is powered on.

[0117] Inputting the target encryption key (updated encryption key) and the target encryption vector into the computing core unit; The Zu Chongzhi algorithm operation core unit performs a target key stream generation operation based on the Zu Chongzhi algorithm, regenerates the key stream, and uses the regenerated key stream as the target key stream.

[0118] At the time when the target key stream generation operation starts to be executed, the random number generated by the random number generator is used as the first random number; the position is updated according to the first random number, and the updated position is used as the target position.

[0119] According to the target position (updated position), a part (a preset number of group mapping key streams) is selected from the target key stream (regenerated key stream) and written into the key stream mapping table to complete the update of the key stream mapping table. When the first random number is 30, after the length of the target key stream generation reaches 30 bits of the target position, the 131072-bit key stream generated after the 30th bit is written into the key stream mapping table to complete the update of the key stream mapping table.

[0120] In this embodiment, the cache is temporarily not allowed to be used during the initialization or update phase of the key stream mapping table. The cache function can only be used after the key stream mapping table is initialized or updated. This ensures that the data stored and processed in the cache is always based on the latest and correct key stream mapping table, avoiding data encryption or decryption errors caused by inconsistent key stream mapping table status.

[0121] During the keystream mapping table update process, the target encryption key KEY may or may not be updated, which is determined by the system architecture. However, the target encryption vector IV and the target position (or the selection signal SEL) must be updated, which ensures that the mapped keystream in the keystream mapping table will change significantly, ensuring the security of the system. The update of the target encryption vector introduces new variation factors into the generation of the keystream, so that each generated target keystream has different characteristics. The update of the target position ensures that the starting point of the mapped keystream selected from the target keystream changes, further increasing the randomness and unpredictability of the keystream mapping table. This design makes it difficult for attackers to infer the current or future keystream by analyzing the historical keystream mapping table, greatly improving the system's ability to resist attacks.

[0122] When encrypting or decrypting the target data, it only needs to perform an XOR operation with the mapping key stream in the previously calculated key stream mapping table. This operation process is fast, has very little hardware overhead, and does not produce additional processing delays. Therefore, it will not block the cache reading process, ensuring that the cache operation performance is not affected. Traditional encryption methods will consume multiple additional clock cycles during encryption processing, which will block the data reading and writing process to a certain extent, resulting in a decrease in cache performance.

[0123] The hardware architecture of the secure and high-performance cache realizes the encryption processing of cache data and improves security by redesigning the hardware architecture of the cache, optimizing the encryption and decryption algorithms, updating the target encryption key and target encryption vector, randomizing the target key stream, and mapping the key stream. At the same time, there is no additional delay in the cache reading process, ensuring the unchanged performance. In terms of hardware architecture, the storage structure and data transmission path of the cache are optimized to better support the storage and access of the key stream mapping table. The optimization of the encryption and decryption algorithms is reflected in the use of more efficient XOR operations and Zu Chongzhi's algorithm, which reduces the computational complexity and processing time. In addition, by introducing technologies such as true random number generators, the randomization of the target key stream and the mapping key stream is realized, further enhancing the security of encryption. During the operation of the entire system, whether it is data encryption or decryption operations, it can be completed quickly without affecting the cache reading performance, providing users with efficient and secure data storage.

[0124] Through the description of the above implementation methods, those skilled in the art can clearly understand that the method according to the above embodiment can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method.

[0125] Figure 8 The embodiment of the present application also provides a computer device, such as Figure 8 As shown, it includes a memory 10 and a processor 20, the memory 10 stores a computer program, and the processor 20 is configured to run the computer program to execute the steps in any of the above data processing method embodiments.

[0126] An embodiment of the present application further provides a computer storage medium, in which a computer program is stored, wherein the computer program is configured to execute the steps of any of the above data processing method embodiments when running.

[0127] In an exemplary embodiment, the computer storage medium may include, but is not limited to, various media that can store computer programs, such as a USB flash drive, a read-only memory (ROM), a random access memory, a mobile hard disk, a magnetic disk, or an optical disk.

[0128] An embodiment of the present application further provides a computer program product, which includes a computer program. When the computer program is executed by a processor, the steps in any of the above data processing method embodiments are implemented.

[0129] An embodiment of the present application further provides another computer program product, including a non-volatile computer storage medium, wherein the non-volatile computer storage medium stores a computer program, and when the computer program is executed by a processor, the steps in any of the above-mentioned data processing method embodiments are implemented.

[0130] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0131] The above is a detailed introduction to a data processing method, computer device, storage medium and program product provided by the present application. Specific examples are used herein to illustrate the principles and implementation methods of the present application, and the description of the above embodiments is only used to help understand the method and core ideas of the present application. It should be pointed out that for ordinary technicians in this technical field, without departing from the principles of the present application, several improvements and modifications can be made to the present application, and these improvements and modifications also fall within the scope of protection of the claims of the present application.

Claims

1. A data processing method, characterized in that: include: Encrypting the target data according to the pre-acquired key stream mapping table to obtain first encrypted data; The key stream mapping table includes a preset number of group mapping key streams; wherein the preset number of group mapping key streams are selected from a target key stream according to a target position, the target key stream is generated by a target key stream generation operation, the target key stream generation operation includes: obtaining a target encryption vector and a target encryption key, generating a target key stream according to the target encryption vector and the target encryption key, and the target position is determined according to a first random number; The first encrypted data is loaded into the cache.

2. The data processing method according to claim 1, characterized in that: The method further comprises: Determine a first verification code according to the first encrypted data; Reading the second encrypted data from the storage location of the first encrypted data, and determining a second check code based on the second encrypted data; When the first verification code and the second verification code are the same, the second encrypted data is decrypted according to the key stream mapping table to obtain the target data.

3. The data processing method according to claim 1, characterized in that: The method further comprises: A random number generated by a random number generator and related to a start time of a target key stream generation operation is determined as the first random number.

4. The data processing method according to claim 1, characterized in that: The method further comprises: A target encryption vector is determined according to a second random number generated by a random number generator.

5. The data processing method according to claim 1, characterized in that: The method further comprises: When a key update request is received, an updated encryption key is determined and the updated encryption key is used as a target encryption key.

6. The data processing method according to claim 1, characterized in that: The method further comprises: When a key stream mapping table update request is received, the key stream mapping table is updated.

7. The data processing method according to claim 1, characterized in that: The step of encrypting the target data according to the pre-acquired key stream mapping table to obtain the first encrypted data comprises: Determining a set of mapped key streams corresponding to target data from the key stream mapping table; The target data is encrypted according to a set of mapping key streams corresponding to the target data to obtain first encrypted data.

8. The data processing method according to claim 7, characterized in that: The step of encrypting the target data according to a set of mapping key streams corresponding to the target data to obtain first encrypted data comprises: A set of mapping key streams corresponding to the target data is subjected to a bitwise XOR operation with the target data to obtain first encrypted data.

9. The data processing method according to claim 2, characterized in that: The determining a first verification code according to the first encrypted data comprises: A first check code is determined based on the data portion of the first encrypted data.

10. The data processing method according to claim 9, characterized in that: The determining a first verification code according to the data portion of the first encrypted data comprises: evenly dividing the data portion of the first encrypted data into a plurality of groups according to a preset data amount; The first check code is determined by performing a bitwise exclusive OR operation on the plurality of groups in sequence.

11. The data processing method according to claim 10, characterized in that: The step of determining the second verification code according to the second encrypted data comprises: evenly dividing the data portion of the second encrypted data into a plurality of groups according to a preset data amount; The second check code is determined by performing a bitwise XOR operation on the plurality of groups in sequence.

12. The data processing method according to claim 2, characterized in that: The method further includes: when the first verification code and the second verification code are different, discarding the second encrypted data.

13. A computer device, characterized in that: include: Memory for storing computer programs; A processor, configured to implement the steps of the data processing method according to any one of claims 1 to 12 when executing the computer program.

14. A computer storage medium, characterized in that: The computer storage medium stores a computer program, wherein the computer program, when executed by a processor, implements the steps of the data processing method according to any one of claims 1 to 12.

15. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the data processing method according to any one of claims 1 to 12 are implemented.

Images