Controller data access method and device, equipment and storage medium

Abstract

The invention discloses a controller data access method, device and equipment and a storage medium, relates to the technical field of data access, is applied to a FLASH controller, the FLASH controller is pre-configured with an encryption algorithm core, and the method comprises the following steps: reading a first encryption key and firmware data in target FLASH equipment based on a first encryption algorithm in the encryption algorithm core to perform initialization verification; obtaining the data access request after the initialization verification is passed, and performing access verification on the data access request based on a register access control mechanism; if the data access request passes the access verification, reading a second encryption key based on a second encryption algorithm in the encryption algorithm core to perform data encryption and decryption processing on the to-be-accessed data to obtain processed data; and inputting the processed data to the target storage position through a preset high-level high-performance bus in the FLASH controller so as to complete the data access operation of the target FLASH equipment. Therefore, the security of data access can be improved.

Description

Technical Field

[0001] The present invention relates to the technical field of data access, and in particular to a controller data access method, device, equipment and storage medium. Background Art

[0002] With the rapid development of information technology, the security of data storage has received increasing attention. Traditional FLASH controllers (a non-volatile memory technology) have the advantages of non-volatility, low power consumption, good reliability and large capacity, and have been widely used in embedded systems, mobile devices, data centers and other fields. However, with the continuous increase in data volume, there is often a lack of sufficient security mechanisms in the data processing process. Data security is vulnerable to various attacks, and sensitive information is easily leaked or maliciously tampered with, resulting in reduced system security and reliability and leakage of key information. Existing FLASH controllers lack advanced security features such as encryption, decryption, and authentication, which makes them vulnerable to malware attacks.

[0003] It can be seen that how to improve the security of FLASH controller data access is a problem that needs to be solved by those skilled in the art. Summary of the invention

[0004] The purpose of the embodiments of the present invention is to provide a controller data access method, device, equipment and storage medium, which can improve the security of FLASH controller data access. The specific scheme is as follows:

[0005] In a first aspect, the present application discloses a controller data access method, which is applied to a FLASH controller, wherein the FLASH controller is pre-configured with an encryption algorithm core, and the method comprises:

[0006] Reading a first encryption key and firmware data in a target FLASH device based on a first encryption algorithm in the encryption algorithm core, and performing initialization verification based on the first encryption key and the target firmware data;

[0007] After the initialization verification is passed, the data access request for the target FLASH device sent by the central processor is obtained, and the data access request is access verified based on the register access control mechanism;

[0008] If the data access request passes the access verification, the second encryption key is read based on the second encryption algorithm in the encryption algorithm core, and the data to be accessed corresponding to the target FLASH device is encrypted and decrypted based on the second encryption key to obtain processed data;

[0009] The processed data is input to the target storage location through the preset advanced high-performance bus in the FLASH controller to complete the data access operation of the target FLASH device.

[0010] Optionally, when the FLASH controller is in a normal working mode, a first encryption key and firmware data in a target FLASH device are read based on a first encryption algorithm in the encryption algorithm core, and initialization verification is performed based on the first encryption key and the target firmware data, including:

[0011] Reading the first encryption key and the length information corresponding to the firmware data in the target FLASH device based on the first encryption algorithm in the encryption algorithm core;

[0012] Reading firmware data from the firmware information storage area corresponding to the target FLASH device in sequence according to the length information, and performing hash value calculation on the firmware data using a first encryption algorithm to obtain a hash calculation result;

[0013] The hash check code is read from the security data storage area corresponding to the target FLASH device, and the hash calculation result is compared with the hash check code to perform initialization verification.

[0014] Optionally, when the FLASH controller is in a debugging working mode, a first encryption key and firmware data in a target FLASH device are read based on a first encryption algorithm in the encryption algorithm core, and initialization verification is performed based on the first encryption key and the target firmware data, including:

[0015] Obtaining firmware configuration information written by the central processor through the editing area of ​​the target FLASH device, and controlling the key generation component in the FLASH controller to generate a first encryption key based on the firmware configuration information;

[0016] Generate corresponding firmware data based on the firmware configuration information, and store the firmware data in a firmware information storage area corresponding to the target FLASH device;

[0017] Using a central processing unit to start the encryption algorithm core through a preset algorithm core startup instruction, so as to read the length information corresponding to the firmware data in the target FLASH device through the first encryption algorithm in the encryption algorithm core;

[0018] Reading the firmware data in sequence based on the length information, and performing hash value calculation on the firmware data using a first encryption algorithm to obtain a hash calculation result;

[0019] The hash check code is read from the security data storage area corresponding to the target FLASH device to compare the hash check code with the hash check code for initialization verification.

[0020] Optionally, obtaining a data access request for a target FLASH device sent by a central processor, and performing access verification on the data access request based on a register access control mechanism, including:

[0021] Obtaining a data access request for a target FLASH device sent by a central processor, and determining an access level for the data access based on user data in the data access request;

[0022] If the access level is characterized as the first user level, the number of incorrect authentications is read from the data access request, and the number of incorrect authentications threshold is read from the preset authentication data area;

[0023] If the number of incorrect authentications is equal to the threshold number of incorrect authentications, sending a user verification request to the target user terminal corresponding to the second user level so that the target user terminal updates the number of incorrect authentications;

[0024] If the number of incorrect authentications is less than the error number threshold, the data access request is parsed to obtain the target data to be authenticated, and the target data to be authenticated is stored in a preset storage area; the preset storage area includes a firmware storage area, an algorithm storage area, and a business storage area set based on preset authentication rules, which are used to store the target data to be authenticated, including the firmware data to be authenticated, the algorithm data to be authenticated, and the business data to be authenticated in the data access process;

[0025] The comparison data corresponding to the target data to be authenticated is read from the preset authentication data area, and the target data to be authenticated is compared with the comparison data to perform access verification on the data access request.

[0026] Optionally, when the data access request is a data read request, a second encryption key is read based on a second encryption algorithm in the encryption algorithm core, and data encryption and decryption processing is performed on the to-be-accessed data corresponding to the target FLASH device based on the second encryption key to obtain processed data, including:

[0027] Reading a second encryption key through a second encryption algorithm in the encryption algorithm core, and decrypting the accessed data read from the target FLASH using the second encryption key to obtain decrypted data;

[0028] Accordingly, the processed data is input to the target storage location through the preset advanced high-performance bus in the FLASH controller to complete the data access operation of the target FLASH device, including:

[0029] The decrypted data is input into the local internal buffer area through the preset advanced high-performance bus in the FLASH controller to complete the data read operation of the target FLASH device.

[0030] Optionally, when the data access request is a data write request, a second encryption key is read based on a second encryption algorithm in the encryption algorithm core, and data encryption and decryption processing is performed on the to-be-accessed data corresponding to the target FLASH device based on the second encryption key to obtain processed data, including:

[0031] Determine the data type corresponding to the data to be written;

[0032] If the data type corresponding to the data to be written is the device data type, the second encryption key and the data to be written are read based on the second encryption algorithm in the encryption algorithm core, and the data to be written is encrypted using the second encryption key to obtain encrypted data;

[0033] Accordingly, the processed data is input to the target storage location through the preset advanced high-performance bus in the FLASH controller to complete the data access operation of the target FLASH device, including:

[0034] The encrypted data, the control signal and address information corresponding to the preset advanced high-performance bus in the FLASH controller are sent to the target serial peripheral interface in the FLASH controller to perform data write operation on the target FLASH device.

[0035] Optionally, the encrypted data, a control signal and address information corresponding to a preset advanced high-performance bus in the FLASH controller are sent to a target serial peripheral interface in the FLASH controller to perform a data write operation on the target FLASH device, including:

[0036] Obtain control signals and address information corresponding to a preset advanced high-performance bus in the FLASH controller, and generate an address scrambling key based on a preset one-time programmable key;

[0037] Inputting the address scrambling key and the address information into a preset scrambling equation to obtain a scrambled address; the preset scrambling equation is an equation constructed based on a preset scrambling matrix and an XOR operation;

[0038] The encrypted data, control signal and scrambled address are sent to the target serial peripheral interface in the FLASH controller to perform a data write operation on the target FLASH device.

[0039] In a second aspect, the present application discloses a controller data access device, which is applied to a FLASH controller, and the FLASH controller is pre-configured with an encryption algorithm core, and the device includes:

[0040] A data initialization module, used to read a first encryption key and firmware data in a target FLASH device based on a first encryption algorithm in the encryption algorithm core, and perform initialization verification based on the first encryption key and the target firmware data;

[0041] The request verification module is used to obtain the data access request for the target FLASH device sent by the central processor after the initialization verification is passed, and perform access verification on the data access request based on the register access control mechanism;

[0042] A data processing module, configured to read a second encryption key based on a second encryption algorithm in the encryption algorithm core if the data access request passes the access verification, and perform data encryption and decryption processing on the to-be-accessed data corresponding to the target FLASH device based on the second encryption key to obtain processed data;

[0043] The data access module is used to input the processed data to the target storage location through the preset advanced high-performance bus in the FLASH controller to complete the data access operation of the target FLASH device.

[0044] In a third aspect, the present application discloses an electronic device, comprising:

[0045] Memory, used to store computer programs;

[0046] The processor is used to execute the computer program to implement the aforementioned controller data access method.

[0047] In a fourth aspect, the present application discloses a computer-readable storage medium for storing a computer program, which implements the aforementioned controller data access method when executed by a processor.

[0048] It can be seen that in the present invention, first, the first encryption key and the firmware data in the target FLASH device are read based on the first encryption algorithm in the encryption algorithm core, and an initialization check is performed based on the first encryption key and the target firmware data; after the initialization check is passed, the data access request for the target FLASH device sent by the central processing unit is obtained, and the data access request is access-verified based on the register access control mechanism; if the data access request passes the access verification, the second encryption key is read based on the second encryption algorithm in the encryption algorithm core, and data encryption and decryption processing is performed on the data to be accessed corresponding to the target FLASH device based on the second encryption key to obtain processed data; the processed data is input to the target storage location through the preset advanced high-performance bus in the FLASH controller to complete the data access operation of the target FLASH device.

[0049] It can be seen from the above technical solution that the present application can improve the security of data access by adding an encryption algorithm core to the FLASH controller to support the verification of the data access process and the encryption and decryption of the access data. In addition, by encrypting the firmware and data stored in the FLASH, even if the physical device is disassembled, the plaintext information in the FLASH cannot be directly read, thereby effectively preventing the leakage of sensitive data. In addition, by integrating the national secret algorithm into the FLASH controller, the security burden at the software level can be reduced. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] In order to more clearly illustrate the embodiments of the present invention, the following briefly introduces the drawings required for use in the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0051] Figure 1 A schematic diagram of a FLASH controller architecture provided by the present invention;

[0052] Figure 2 A flow chart of a controller data access method disclosed in the present invention;

[0053] Figure 3 A specific controller initialization verification flow chart disclosed in the present invention;

[0054] Figure 4 A specific key generation method flow chart disclosed in the present invention;

[0055] Figure 5 A specific data access request verification flow chart disclosed in the present invention;

[0056] Figure 6 A flow chart of a specific data writing method disclosed in the present invention;

[0057] Figure 7 A specific data reading and accessing method flow chart disclosed in the present invention;

[0058] Figure 8 A schematic diagram of a specific register type disclosed in the present invention;

[0059] Fig. 9 A schematic diagram of the structure of a controller data access device disclosed in the present invention;

[0060] Fig.10 The present invention is a structural diagram of an electronic device disclosed in the present invention. DETAILED DESCRIPTION

[0061] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0062] The terms "including" and "having" in the specification of the present invention and the above-mentioned drawings, as well as any variations thereof, are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device including a series of steps or units is not limited to the listed steps or units, but may include steps or units that are not listed.

[0063] In order to enable those skilled in the art to better understand the solution of the present invention, the present invention is further described in detail below in conjunction with the accompanying drawings and specific implementation methods.

[0064] Existing FLASH controllers are used in embedded systems. Traditional FLASH controllers often lack advanced security features such as encryption, decryption, and authentication, which makes them vulnerable to malware attacks. Hackers can exploit FLASH vulnerabilities to execute malicious code, access sensitive information in the user's computer system, and even control the entire computer system. FLASH controllers without security algorithms are weak in data protection and cannot effectively prevent data from being illegally read, tampered with, or deleted. The present invention will specifically disclose a controller data access method that can improve the security of data access.

[0065] See also Figure 1As shown, the embodiment of the present invention discloses a FLASH controller architecture diagram based on the national secret algorithm. Among them, the FLASH security controller is mainly composed of a key generation subunit, a register unit, an SM3 (a cryptographic hash function standard) algorithm core unit, an SM4 (a commercial cryptographic algorithm standard) algorithm core unit, a serial port SPI (Serial Peripheral Interface, i.e., a serial peripheral interface) module and a FLASH data flow control subunit. Among them, the key generation subunit mainly completes: generating SM3 keys and SM4 keys; the register unit mainly completes: algorithm parameter configuration, control class instruction configuration, interrupt class configuration, and operation mode configuration; the SM3 algorithm core subunit mainly completes: SM3 summary value verification of FLASH data; the SM4 algorithm core subunit mainly completes: SM4 encryption and decryption processing of FLASH data; the serial port SPI subunit mainly completes: interface control of AHB bus (Advanced High Performance Bus) and FLASH; the data flow control unit is mainly used to complete the flow control of data between the key generation subunit, SM3 algorithm core subunit, SM4 algorithm core subunit, and serial port SPI subunit, as well as memory access control, scramble the read and write operation addresses, further improve the security storage of stored data, partition access and authentication of FLASH memory, and control the access rights and scope of users of different levels. It should be noted here that the Flash controller in the present invention can be widely used in various embedded systems and information security fields, including but not limited to smart devices, storage devices, Internet of Things devices, cloud computing platforms, etc., to provide strong security protection for data storage in these fields.

[0066] See also Figure 2 As shown, an embodiment of the present invention discloses a controller data access method, which is applied to a FLASH controller, and the FLASH controller is pre-configured with an encryption algorithm core. The method includes:

[0067] Step S11: Read a first encryption key and firmware data in a target FLASH device based on a first encryption algorithm in the encryption algorithm core, and perform an initialization check based on the first encryption key and the target firmware data.

[0068] In this embodiment, first in the working mode, the SM3 and SM4 modules are powered on and started, and are first initialized, configured in four-wire mode, and the SPI register is configured as required by the four-wire I / O (Input / Output) word fast read command. Then the SM3 check is performed. At this time, the FLASH controller is divided into a normal working mode and a debugging working mode.

[0069] In this embodiment, Figure 3As shown, when the FLASH controller is in normal working mode, the first encryption key and the firmware data in the target FLASH device are read based on the first encryption algorithm in the encryption algorithm core, and initialization verification is performed based on the first encryption key and the target firmware data, including: reading the first encryption key and the length information corresponding to the firmware data in the target FLASH device based on the first encryption algorithm in the encryption algorithm core; reading the firmware data from the firmware information storage area corresponding to the target FLASH device in sequence according to the length information, and using the first encryption algorithm to perform hash value calculation on the firmware data to obtain a hash calculation result; reading the hash check code from the security data storage area corresponding to the target FLASH device, and comparing the hash calculation result with the hash check code to perform initialization verification. Specifically, in normal mode, SM3 reads KEY1 (the first encryption key) and the length information corresponding to the firmware data in the target FLASH device. Read the firmware data in sequence according to the length information. Each reading length is 512 bits, and the 256-bit data calculated by SM3 will be used as the key for the next data reading until the basic firmware data is read. Compare the final calculation result with the SM3 check code for initialization verification. The SM3 check code address is located after the firmware program address. If the SM3 check passes, the CPU (Central Processing Unit) reset is released and the CPU performs initialization. Figure 3 In the figure, the left half is the SM3 verification process, and the right half is the FLASH partition representation. From low address to high address, they are: security authentication data storage area, 32-bit basic firmware length information to be verified, 256-bit SM3 verification code, basic firmware program (filled by software), user-defined programming area, and reserved area.

[0070] In this embodiment, when the FLASH controller is in the debugging working mode, the first encryption key and the firmware data in the target FLASH device are read based on the first encryption algorithm in the encryption algorithm core, and initialization verification is performed based on the first encryption key and the target firmware data, including: obtaining the firmware configuration information written by the central processor through the editing area of ​​the target FLASH device, and controlling the key generation component in the FLASH controller to generate the first encryption key based on the firmware configuration information; generating corresponding firmware data based on the firmware configuration information, and storing the firmware data in the firmware information storage area corresponding to the target FLASH device; using the central processor to start the encryption algorithm core through the preset algorithm core startup instruction to read the length information corresponding to the firmware data in the target FLASH device through the first encryption algorithm in the encryption algorithm core; reading the firmware data in sequence based on the length information, and using the first encryption algorithm to perform hash value calculation on the firmware data to obtain the hash calculation result; reading the hash check code from the security data storage area corresponding to the target FLASH device, and comparing the hash check code with the hash check code to perform initialization verification. That is, in the debugging mode, the CPU uses the editing area of ​​the FLASH device to write the test firmware to the FLASH, configure the ID (Identity Document, i.e., identity identification), and key information to generate KEY1. Then, the CPU is used to start SM3 (in the present invention, the instruction SM3_EN=1 can be used) to read the firmware length information, and the test firmware data is read in sequence according to the length information to perform SM3 calculation. Finally, the final calculation result is compared with the SM3 check code to perform initialization verification.

[0071] In this embodiment, it should be noted that Figure 4 As shown, the first encryption key (KEY1) of the present application and the second encryption key (KEY2) mentioned in the subsequent steps are generated by the key generation subunit when the chip is powered on. The key generation subunit is designed in the form of byte reorganization and XOR. In normal mode, the source of ID is OTP_ID, and the source of KEYD is OTP_KEYD; in debug mode, the source of ID is register DEBUG_ID, and the source of KEYD is register DEBUG_KEYD. random is a 128-bit random number. Input signal: ID[63:0], KEYD[127:0], random[127:0]; output signal: KEY1[255:0], KEY2[255:0]. Among them, the key generation logic specified in the present invention is as follows:

[0072] KEY1={Permute1(ID),PermuteA(KEYD),Permute2(ID)};

[0073] KEY1={Permute1(ID),PermuteA(KEYD),Permute2(ID)};

[0074] KEY3={Permute3(ID),Permute4(ID)}^ PermuteB(KEYD);

[0075] KEY2={KEY3[127:96]^random[127:96], KEY3[95:64]^random[95:64], KEY3[63:32]^random[63:3 2], KEY3[31:0]^random[31:0], random[127:96], random[95:64], random[63:32], random[31:0]}.

[0076] The reorganized Permute format is shown in Tables 1 and 2 below, and byte replacement is performed in units of bytes.

[0077] Table 1

[0078]

[0079] Table 2

[0080]

[0081] Step S12: after the initialization verification is passed, a data access request for the target FLASH device sent by the central processor is obtained, and access verification is performed on the data access request based on the register access control mechanism.

[0082] In this embodiment, after the initialization check is passed, the data access request for the target FLASH device sent by the central processor is obtained, and after the access request is passed, the corresponding data access operation is performed. Figure 5 As shown in the figure, the register access control mechanism is mainly used for the scenario where the SOC chip (System On Chip) and NORFLASH (a non-volatile flash memory technology) are stacked (packaged together by stacking metal layers, which is a chip packaging technology) to work together. It is a mechanism to authenticate and protect the protected areas in the external NorFlash, which can effectively ensure the security of SOC's access to NORFLASH.

[0083] Before describing the steps, we first give a detailed introduction to NorFlash. First, NorFlash is divided into four areas: authentication data area, security firmware area, algorithm area, and trusted business area. The starting address and size of the authentication data area are fixed. Among them, when the FLASH is in working mode, the relevant data in the authentication data area is written by the CPU transparent transmission method. When the OTP (One Time Password) control bit of the working mode is enabled, the CPU read and write permissions of the authentication data area are closed. The Main Array area of ​​NORFLASH is divided into three areas: security firmware area, algorithm area, and trusted business area. The boundaries of each area can be adjusted by configuring the VERDATA_Boundary register. In VERDATA1, each area has an entry. Each Entry contains four parts (VERDATA_**_VER, VERDATA_**_CTRL, VERDATA_**_CNT, VERDATA_**_LIMIT). The specific authentication data area is shown in Table 3 below:

[0084] Table 3

[0085]

[0086] Among them, after downloading the program required by the user end to the Main Array area, the user end can set the boundary of the firmware area by configuring the VERDATA_Boundary0 register, and then configure the value of the VERDATA_FW_CTRL register (firmware control register) to non-all F to close the firmware area. Then configure VERDATA_FW_VER to a value known only to the user to close the FW Entry permission, because other users do not know the value of VERDATA_FW_VER, and the program stored in NORFLASH is secure. It should be noted here that as long as any register in the Buffer Entry is written, the VERDATA1 area will be erased first, and then the data in the Buffer Entry will be automatically encrypted by SM4 and written back to the VERDATA1 Entry. Therefore, when the power is off, the registers in the Buffer Entry will be stored in the non-volatile VERDATA1, and the data will be automatically written back to the Buffer Entry when the power is on again.

[0087] When the user wants to update the data in the firmware area in NORFLASH, it needs to first configure the FW_VER register to a special value set by the user, and then configure VERDATA_FW_CTRL to 32'hFFFFFFFF, so that the user can regain the permission of the firmware area. After the user completes the update, the permission of the firmware area is closed again through the steps described above.

[0088] To prevent the authentication value from being cracked, in the present invention, VERDATA_**_VER and **_VER are both designed to be 2 words wide (64 bits). The VERDATA_**_CNT and VERDATA_**_LIMIT registers are used to limit the number of incorrect authentications. The values ​​of these two registers can only be operated when the corresponding Buffer Entry permissions are obtained. VERDATA_**_LIMIT is the allowed number of incorrect authentications register, and VERDATA_**_CNT is the value of the current number of incorrect authentications. When an incorrect authentication is detected, VERDATA_**_CNT will automatically increase by 1. **_VER can only be operated when VERDATA_**_LIMIT is greater than or equal to VERDATA_**_CNT. Once the verification is successful, the VERDATA_**_CNT of the area will be cleared.

[0089] Among them, obtaining a data access request for a target FLASH device sent by a central processor, and performing access verification on the data access request based on a register access control mechanism, includes: obtaining a data access request for a target FLASH device sent by a central processor, and determining an access level for data access based on user data in the data access request; if the access level is characterized as a first user level, reading the number of error authentications from the data access request, and reading the error number threshold from a preset authentication data area; if the number of error authentications is equal to the error number threshold, sending a user verification request to a target user terminal corresponding to a second user level so that the target user terminal updates the number of error authentications; if the number of error authentications is less than the error number threshold, parsing the data access request to obtain target data to be authenticated, and storing the target data to be authenticated in a preset storage area; the preset storage area includes a firmware storage area, an algorithm storage area, and a business storage area set based on preset authentication rules, and is used to store the target data to be authenticated, including firmware data to be authenticated, algorithm data to be authenticated, and business data to be authenticated in a data access process; reading comparison data corresponding to the target data to be authenticated from the preset authentication data area, and comparing the target data to be authenticated with the comparison data to perform access verification on the data access request.

[0090] It should be noted here that in the present invention, users are divided into two levels, ordinary users (i.e., the first user level mentioned above) and administrator users (i.e., the second user level mentioned above). If the number of incorrect authentications of ordinary users exceeds VERDATA_**_CNT, the area cannot be operated and must be unlocked by the administrator user. The administrator user inputs a password and compares it with VERDATA_VIP_VER. VERDATA_VIP_LIMIT is the number of incorrect authentications allowed for the administrator, and VERDATA_VIP_CNT is the value of the current number of incorrect authentications. When an incorrect authentication is detected, VERDATA_VIP_CNT will automatically increase by 1. If the administrator user passes the verification, all VERDATA_**_CNTs are cleared, and the administrator has the authority to read and write all areas. After passing the read and write permission authentication, the data access request needs to be parsed first to obtain the firmware data to be authenticated, the algorithm data to be authenticated, and the business data to be authenticated, and the firmware data to be authenticated, the algorithm data to be authenticated, and the business data to be authenticated are respectively compared with the authentication data in the authentication data area of ​​Table 3 to determine whether there is error information in the firmware data to be authenticated, the algorithm data to be authenticated, and the business data to be authenticated, so as to access the data access request and pass the verification. If there are any errors, the verification fails.

[0091] Step S13: If the data access request passes the access verification, the second encryption key is read based on the second encryption algorithm in the encryption algorithm core, and the data to be accessed corresponding to the target FLASH device is encrypted and decrypted based on the second encryption key to obtain processed data.

[0092] In this embodiment, there are two data access situations for the to-be-accessed data corresponding to the target FLASH device, one is a data read request, and the other is a data write request.

[0093] Specifically, when the data access request is a data write request, the second encryption key is read based on the second encryption algorithm in the encryption algorithm core, and the data to be accessed corresponding to the target FLASH device is encrypted and decrypted based on the second encryption key to obtain the processed data, including: determining the data type corresponding to the data to be written; if the data type corresponding to the data to be written is the device data type, the second encryption key and the data to be written are read based on the second encryption algorithm in the encryption algorithm core, and the data to be written is encrypted using the second encryption key to obtain the encrypted data. Figure 6As shown, first, after the CPU issues a write request, it determines whether the FLASH can be accessed through storage access control. If it can be accessed, the data type corresponding to the data to be written is determined to determine whether the written data is a command sequence or FLASH data (that is, the device data type mentioned above). If it is FLASH data, SM4 is used to read KEY2 first, and then the FLASH data sent from the AHB bus is read and encrypted by SM4 to obtain the encrypted FLASH data.

[0094] In this embodiment, when the data access request is a data read request, the second encryption key is read based on the second encryption algorithm in the encryption algorithm core, and the data to be accessed corresponding to the target FLASH device is encrypted and decrypted based on the second encryption key to obtain processed data, including: reading the second encryption key through the second encryption algorithm in the encryption algorithm core, and using the second encryption key to decrypt the data to be accessed read from the target FLASH to obtain decrypted data. Figure 7 As shown, after receiving a read operation request from the CPU, the storage access control determines whether the FLASH can be accessed. If it can be accessed, SM4 reads KEY2 first, reads the FLASH data, and uses KEY2 to perform SM4 decryption on the accessed data to obtain the decrypted FLASH data.

[0095] Step S14: inputting the processed data to the target storage location via the preset advanced high-performance bus in the FLASH controller to complete the data access operation of the target FLASH device.

[0096] In this embodiment, when the data access request is a data write request, the processed data is input to the target storage location through the preset advanced high-performance bus in the FLASH controller to complete the data access operation of the target FLASH device, including: sending the encrypted data, the control signal and address information corresponding to the preset advanced high-performance bus in the FLASH controller to the target serial peripheral interface in the FLASH controller to perform the data write operation of the target FLASH device. That is, the control signal, address information and processed data sent by the AHB bus are input into the serial port SPI to complete the FLASH write operation.

[0097] Among them, it should be noted that the present invention supports scrambling address information through the FLASH data flow control subunit. In addition, the data flow control unit is mainly used to complete the flow control of data between the key generation subunit, the SM3 algorithm core subunit, the SM4 algorithm core subunit, and the serial port SPI subunit and the memory access control, scramble the read and write operation addresses, further improve the security storage of stored data, partition access and authentication of the FLASH memory, and control the access rights and scope of users of different levels.

[0098] Specifically, the encrypted data, the control signal and address information corresponding to the preset advanced high-performance bus in the FLASH controller are sent to the target serial peripheral interface in the FLASH controller to perform the data write operation of the target FLASH device, including: obtaining the control signal and address information corresponding to the preset advanced high-performance bus in the FLASH controller, and generating the address scrambling key based on the preset one-time programmable; inputting the address scrambling key and address information into the preset scrambling equation to obtain the scrambled address; the preset scrambling equation is an equation constructed based on the preset scrambling matrix and the XOR operation; the encrypted data, control signal and scrambled address are sent to the target serial peripheral interface in the FLASH controller to perform the data write operation of the target FLASH device. It should be noted here that when the data SM4 is decrypted and written back to the SOC memory (such as DDR (Double Data Rate, i.e., double-rate synchronous dynamic random access memory)) and when performing authentication, the address scrambling key AddrKey is stored in OTP, the normal mode AddrKey is equal to OTP_ADDRKEY, and the debug mode AddrKey is equal to the value of the register DEBUG_ADDRKEY. When address information is scrambled, the internal address is scrambled with 128 bits as the minimum unit. First, the address information is XORed with AddrKey, and then the XOR result is multiplied with the reversible random constant matrix M with a specification of n×n (n is the bit width of the scrambled address) on GF(2) (from the perspective of matrix data storage and scrambling strength, the matrix has about 50% "1") to achieve linear transformation and obtain the scrambled result. For example, assuming that the scrambled input is X (n×1 bit vector), the scrambling matrix is ​​M (n×n bit matrix), the scrambling key is AddrKey, and the scrambled output is Y (n×1 bit vector), the scrambling equation can be obtained as follows:

[0099] ;

[0100] in, is an XOR operation. In order to ensure the security of the address information, in addition to the above-mentioned method of scrambling the address information, the randomness of the signal can also be increased by superimposing simulated random information on the address information signal, or a random sequence can be generated by channel coding to scramble the address signal. Accordingly, a corresponding data storage device needs to be set on the FLASH controller to store the scrambled information.

[0101] In this embodiment, when the data access request is a data read request, the processed data is input to the target storage location through the preset advanced high-performance bus in the FLASH controller to complete the data access operation of the target FLASH device, including: the decrypted data is input to the local internal cache area through the preset advanced high-performance bus in the FLASH controller to complete the data read operation of the target FLASH device. That is, the decrypted FLASH data is written back to the internal cache of the chip such as DDR (Double Data Rate, i.e., double rate synchronous dynamic random access memory) through the AHB bus. Then the interrupt informs the CPU that the sensitive information is decrypted and written back to the internal cache of the chip. It should be noted here that because the address information of the data to be written is scrambled when the data write operation is performed on the data to be written, then when the data to be accessed is read, the address information corresponding to the data to be accessed is the scrambled information. Therefore, before reading the data to be accessed, the scrambled information needs to be descrambled to obtain the real data address corresponding to the data to be accessed, and then the data to be accessed is read according to the real data address.

[0102] In addition, the present invention relies on the registers in the FLASH controller to implement data configuration, such as Figure 8 As shown, the register interface is an AHB Slave interface, which is used for parameter configuration, instruction configuration, status reading, interrupt reading, mode configuration, etc. The types of registers include parameter registers: used to configure the parameters required by the key generation unit and to transfer the initial vector parameters of the SM4 algorithm; control registers: used to control the system operation and control key generation; interrupt registers: including interrupt mask, interrupt clear, and interrupt status registers, which are used by the CPU to determine whether the current working state of the FLASH controller is completed; status registers: used for the CPU to read the working state of the controller; flag registers: used to display the initialization completion flag, SM3 verification / completion flag, SM4 and authentication preparation in progress / completion flag, security firmware area authentication success flag, algorithm area authentication result flag, etc.; mode registers: used to configure normal mode and debug mode.

[0103] It can be seen that in the present invention, first, the first encryption key and the firmware data in the target FLASH device are read based on the first encryption algorithm in the encryption algorithm core, and an initialization check is performed based on the first encryption key and the target firmware data; after the initialization check is passed, the data access request for the target FLASH device sent by the central processing unit is obtained, and the data access request is access-verified based on the register access control mechanism; if the data access request passes the access verification, the second encryption key is read based on the second encryption algorithm in the encryption algorithm core, and data encryption and decryption processing is performed on the data to be accessed corresponding to the target FLASH device based on the second encryption key to obtain processed data; the processed data is input to the target storage location through the preset advanced high-performance bus in the FLASH controller to complete the data access operation of the target FLASH device.

[0104] It can be seen from the above technical solution that the present application can improve the security of data access by adding an encryption algorithm core to the FLASH controller to support the verification of the data access process and the encryption and decryption of the access data. In addition, by encrypting the firmware and data stored in the FLASH, even if the physical device is disassembled, the plaintext information in the FLASH cannot be directly read, thereby effectively preventing the leakage of sensitive data. In addition, by integrating the national secret algorithm into the FLASH controller, the security burden at the software level can be reduced. And, in this way, by supporting access to the FLASH partition, the stored data is authenticated and verified, and the access rights and scope of users of different levels are controlled.

[0105] refer to Fig. 9 The embodiment of the present application also discloses a controller data access device, which is applied to a FLASH controller, and the FLASH controller is pre-configured with an encryption algorithm core. The device includes:

[0106] The data initialization module 11 is used to read the first encryption key and the firmware data in the target FLASH device based on the first encryption algorithm in the encryption algorithm core, and perform initialization verification based on the first encryption key and the target firmware data;

[0107] The request verification module 12 is used to obtain the data access request for the target FLASH device sent by the central processor after the initialization verification is passed, and perform access verification on the data access request based on the register access control mechanism;

[0108] The data processing module 13 is used for reading the second encryption key based on the second encryption algorithm in the encryption algorithm core if the data access request passes the access verification, and performing data encryption and decryption processing on the to-be-accessed data corresponding to the target FLASH device based on the second encryption key to obtain processed data;

[0109] The data access module 14 is used to input the processed data to the target storage location through a preset advanced high-performance bus in the FLASH controller to complete the data access operation of the target FLASH device.

[0110] It can be seen that in this embodiment, by adding an encryption algorithm core to the FLASH controller to support the verification of the data access process and the encryption and decryption of the access data, the security of data access can be improved. In addition, by encrypting the firmware and data stored in the FLASH, even if the physical device is disassembled, the plaintext information in the FLASH cannot be directly read, thereby effectively preventing the leakage of sensitive data. In addition, by integrating the national encryption algorithm into the FLASH controller, the security burden at the software level can be reduced.

[0111] Furthermore, the present application also discloses an electronic device. Fig.10 It is a structural diagram of an electronic device according to an exemplary embodiment, and the content in the figure cannot be regarded as any limitation on the scope of use of this application. The electronic device may specifically include: at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input / output interface 25, and a communication bus 26. Among them, the memory 22 is used to store a computer program, and the computer program is loaded and executed by the processor 21 to implement the relevant steps in the controller data access method disclosed in any of the aforementioned embodiments. In addition, the electronic device in this embodiment may specifically be an electronic computer.

[0112] In this embodiment, the power supply 23 is used to provide working voltage for each hardware device on the electronic device; the communication interface 24 can create a data transmission channel between the electronic device and the external device, and the communication protocol it follows is any communication protocol that can be applied to the technical solution of the present application, and is not specifically limited here; the input and output interface 25 is used to obtain external input data or output data to the outside world, and its specific interface type can be selected according to specific application needs and is not specifically limited here.

[0113] In addition, the memory 22, as a carrier for storing resources, can be a read-only memory, a random access memory, a disk or an optical disk, etc. The resources stored thereon can include an operating system 221, a computer program 222, etc., and the storage method can be temporary storage or permanent storage.

[0114] The operating system 221 is used to manage and control various hardware devices on the electronic device and the computer program 222, which can be Windows Server, Netware, Unix, Linux, etc. In addition to including a computer program that can be used to complete the controller data access method executed by the electronic device disclosed in any of the aforementioned embodiments, the computer program 222 can further include a computer program that can be used to complete other specific tasks.

[0115] Furthermore, the present application also discloses a computer-readable storage medium for storing a computer program; wherein the computer program, when executed by a processor, implements the controller data access method disclosed above. For the specific steps of the method, reference may be made to the corresponding contents disclosed in the above embodiments, and no further description will be given here.

[0116] Furthermore, the present application also discloses a computer program product, including a computer program / instruction; wherein the computer program / instruction, when executed by a processor, implements the aforementioned disclosed alarm aggregation method. For the specific steps of the method, reference may be made to the corresponding contents disclosed in the aforementioned embodiments, and no further description will be given here.

[0117] In this specification, each embodiment is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can be referred to each other. For the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part.

[0118] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0119] The steps of the method or algorithm described in conjunction with the embodiments disclosed herein may be implemented directly using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0120] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0121] The technical solution provided by the present application is introduced in detail above. Specific examples are used in this article to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method of the present application and its core idea. At the same time, for general technicians in this field, according to the idea of ​​the present application, there will be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as a limitation on the present application.

Claims

1. A controller data access method, characterized in that: Applied to a FLASH controller, the FLASH controller is pre-configured with an encryption algorithm core, the method comprises: Reading a first encryption key and firmware data in a target FLASH device based on a first encryption algorithm in the encryption algorithm core, and performing initialization verification based on the first encryption key and the target firmware data; After the initialization check is passed, a data access request for the target FLASH device sent by the central processor is obtained, and access verification is performed on the data access request based on a register access control mechanism; If the data access request passes the access verification, a second encryption key is read based on the second encryption algorithm in the encryption algorithm core, and data encryption and decryption processing is performed on the to-be-accessed data corresponding to the target FLASH device based on the second encryption key to obtain processed data; The processed data is input to a target storage location via a high-level high-performance bus preset in the FLASH controller to complete a data access operation of the target FLASH device.

2. The controller data access method according to claim 1, characterized in that: When the FLASH controller is in a normal working mode, the first encryption algorithm in the encryption algorithm core is used to read a first encryption key and firmware data in a target FLASH device, and initialization verification is performed based on the first encryption key and the target firmware data, including: Reading a first encryption key and length information corresponding to firmware data in a target FLASH device based on a first encryption algorithm in the encryption algorithm core; Reading the firmware data from the firmware information storage area corresponding to the target FLASH device in sequence according to the length information, and performing hash value calculation on the firmware data using the first encryption algorithm to obtain a hash calculation result; A hash check code is read from a security data storage area corresponding to the target FLASH device, and the hash calculation result is compared with the hash check code to perform an initialization check.

3. The controller data access method according to claim 1, characterized in that: When the FLASH controller is in the debugging working mode, the first encryption algorithm in the encryption algorithm core is used to read the first encryption key and the firmware data in the target FLASH device, and the initialization verification is performed based on the first encryption key and the target firmware data, including: Obtaining firmware configuration information written by the central processor through the editing area of ​​the target FLASH device, and controlling the key generation component in the FLASH controller to generate a first encryption key based on the firmware configuration information; Generate corresponding firmware data based on the firmware configuration information, and store the firmware data in a firmware information storage area corresponding to the target FLASH device; Using the central processing unit to start the encryption algorithm core through a preset algorithm core startup instruction, so as to read the length information corresponding to the firmware data in the target FLASH device through the first encryption algorithm in the encryption algorithm core; Reading the firmware data in sequence based on the length information, and performing hash value calculation on the firmware data using the first encryption algorithm to obtain a hash calculation result; A hash check code is read from a security data storage area corresponding to the target FLASH device to compare the hash check code with the hash check code to perform an initialization check.

4. The controller data access method according to claim 1, characterized in that: The obtaining of a data access request for the target FLASH device sent by the central processor and performing access verification on the data access request based on a register access control mechanism includes: Obtaining a data access request for the target FLASH device sent by a central processor, and determining an access level of the data access based on user data in the data access request; If the access level is characterized as the first user level, reading the number of incorrect authentications from the data access request, and reading the number of incorrect authentications threshold from a preset authentication data area; If the number of incorrect authentications is equal to the threshold number of incorrect authentications, sending a user verification request to a target user terminal corresponding to the second user level so that the target user terminal updates the number of incorrect authentications; If the number of incorrect authentications is less than the error number threshold, the data access request is parsed to obtain the target data to be authenticated, and the target data to be authenticated is stored in a preset storage area; the preset storage area includes a firmware storage area, an algorithm storage area, and a business storage area set based on preset authentication rules, which are used to store the target data to be authenticated, including the firmware data to be authenticated, the algorithm data to be authenticated, and the business data to be authenticated in the data access process; The comparison data corresponding to the target data to be authenticated is read from the preset authentication data area, and the target data to be authenticated is compared with the comparison data to perform access verification on the data access request.

5. The controller data access method according to any one of claims 1 to 4, characterized in that: When the data access request is a data read request, the second encryption key is read based on the second encryption algorithm in the encryption algorithm core, and data encryption and decryption processing is performed on the to-be-accessed data corresponding to the target FLASH device based on the second encryption key to obtain processed data, including: Reading a second encryption key through a second encryption algorithm in the encryption algorithm core, and using the second encryption key to decrypt the accessed data read from the target FLASH to obtain decrypted data; Accordingly, the processed data is input to a target storage location through a preset advanced high-performance bus in the FLASH controller to complete a data access operation of the target FLASH device, including: The decrypted data is input into a local internal buffer area through a preset advanced high-performance bus in the FLASH controller to complete a data read operation of the target FLASH device.

6. The controller data access method according to any one of claims 1 to 4, characterized in that: When the data access request is a data write request, the second encryption key is read based on the second encryption algorithm in the encryption algorithm core, and data encryption and decryption processing is performed on the to-be-accessed data corresponding to the target FLASH device based on the second encryption key to obtain processed data, including: Determine the data type corresponding to the data to be written; If the data type corresponding to the data to be written is a device data type, reading a second encryption key and the data to be written based on a second encryption algorithm in the encryption algorithm core, and encrypting the data to be written using the second encryption key to obtain encrypted data; Accordingly, the processed data is input to a target storage location through a preset advanced high-performance bus in the FLASH controller to complete a data access operation of the target FLASH device, including: The encrypted data, the control signal and address information corresponding to the preset advanced high-performance bus in the FLASH controller are sent to the target serial peripheral interface in the FLASH controller to perform a data write operation on the target FLASH device.

7. The controller data access method according to claim 6, characterized in that: The step of sending the encrypted data, the control signal and the address information corresponding to the preset advanced high-performance bus in the FLASH controller to the target serial peripheral interface in the FLASH controller to perform the data writing operation on the target FLASH device includes: Obtaining control signals and address information corresponding to a preset advanced high-performance bus in the FLASH controller, and generating an address scrambling key based on a preset one-time programmable key; Inputting the address scrambling key and the address information into a preset scrambling equation to obtain a scrambled address; the preset scrambling equation is an equation constructed based on a preset scrambling matrix and an XOR operation; The encrypted data, the control signal and the scrambled address are sent to a target serial peripheral interface in the FLASH controller to perform a data write operation on the target FLASH device.

8. A controller data access device, characterized in that: Applied to a FLASH controller, the FLASH controller is pre-configured with an encryption algorithm core, and the device comprises: A data initialization module, used to read a first encryption key and firmware data in a target FLASH device based on a first encryption algorithm in the encryption algorithm core, and perform initialization verification based on the first encryption key and the target firmware data; A request verification module, used for obtaining a data access request for the target FLASH device sent by the central processing unit after the initialization verification is passed, and performing access verification on the data access request based on a register access control mechanism; a data processing module, configured to read a second encryption key based on a second encryption algorithm in the encryption algorithm core if the data access request passes the access verification, and perform data encryption and decryption processing on the to-be-accessed data corresponding to the target FLASH device based on the second encryption key to obtain processed data; The data access module is used to input the processed data to a target storage location through a preset advanced high-performance bus in the FLASH controller to complete the data access operation of the target FLASH device.

9. An electronic device, characterized in that: include: Memory for storing computer programs; A processor, configured to execute the computer program to implement the steps of the controller data access method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the controller data access method according to any one of claims 1 to 7 are implemented.

Images