Data encryption method of storage device, data transmission method and electronic device

Abstract

The invention provides a data encryption method of a storage device, a data transmission method and an electronic device, and belongs to the technical field of storage. The data encryption method of the storage equipment comprises the following steps: determining the row number and the column number of a key matrix according to the specification of a key stored in a hardware register in the storage equipment, and taking a unit matrix with the determined row number and the determined column number as an initial key matrix; arranging a plurality of digits out of order to form an interchange array, and limiting the column number position of an element I in the initial key matrix by the digits in the interchange array to form an intermediate key matrix; performing multiplied elementary row transformation on each row of the intermediate key matrix to obtain a target key matrix, and obtaining a target decryption matrix corresponding to the target key matrix; and encrypting plaintext data by using the target key matrix to form a ciphertext matrix. By means of the data encryption method of the storage device, a concise and safe data encryption method can be provided for a user.

Description

Technical Field

[0001] The present invention belongs to the field of storage technology, and particularly relates to a data encryption method, a data transmission method and an electronic device for a storage device. Background Art

[0002] In Universal Flash Storage (UFS), the UFS Protocol Information Unit (UPIU) is the basic unit for information interaction between a host and a device. Among them, the UFS protocol information units related to data transmission include an outbound UPIU and an inbound UPIU. Among them, the UPIU is generated by the host and sent to the slave, and the UPIU is generated by the slave and sent to the host. Both of these UPIUs are processed by the host controller or the UFS Transport Protocol (UTP) engine, and the host software is not involved.

[0003] During the data transmission process, to ensure the security of data, data needs to be encrypted. And the Universal Flash Storage Host Controller Interface (UFSHCI) protocol provides various encryption algorithms, such as AES-XTS, Microsoft AES-CBC, AES-ECB or ESSIV-AES-CBC algorithms, but these algorithms require high costs during use. Summary of the Invention

[0004] The purpose of the present invention is to provide a data encryption method, a data transmission method and an electronic device for a storage device, which can provide a simple and secure data encryption method defined by users.

[0005] To achieve the above purpose, the present invention provides a data encryption method for a storage device, and the data encryption method for the storage device at least includes the following steps: Determine the number of rows and columns of the key matrix according to the specification of the key stored in the hardware register in the storage device, and use the identity matrix with the determined number of rows and columns as the initial key matrix; Randomly arrange multiple numbers to form an exchange array, and use the numbers in the exchange array to limit the column positions of the elements in the initial key matrix to form an intermediate key matrix; Perform elementary row transformation of adding multiples to each row of the intermediate key matrix to obtain a target key matrix, and obtain the target decryption matrix corresponding to the target key matrix; and Encrypt the plaintext data using the target key matrix to form a ciphertext matrix, and decrypt the ciphertext matrix using the target decryption matrix.

[0006] In an embodiment of the present invention, when forming the swap array, first determine the number and range of elements in the swap array; wherein, the number of elements in the swap array is equal to the number of rows of the key matrix, and the elements in the swap array are natural numbers from 1 to the number of columns.

[0007] In an embodiment of the present invention, after determining the number and range of elements in the swap array, randomly arrange multiple elements in the swap array to form the swap array.

[0008] In an embodiment of the present invention, when limiting the column number position of element 1 in the initial key matrix with the numbers in the swap array, according to the arrangement order of the elements, use each element in the swap array to limit the column number position of element 1 in each row of the initial key matrix to obtain the intermediate key matrix.

[0009] In an embodiment of the present invention, after obtaining the intermediate key matrix, obtain the intermediate decryption matrix corresponding to the intermediate key matrix; and the intermediate decryption matrix is the transpose matrix of the intermediate key matrix.

[0010] In an embodiment of the present invention, obtaining the target key matrix includes the following steps: Randomly generate a multiple array; Use each element in the multiple array to perform elementary row transformation of multiplying by a multiple on each row of the intermediate key matrix to obtain the target key matrix; and Limit the value range of the target key matrix.

[0011] In an embodiment of the present invention, when generating the multiple array, first limit the value range of the elements in the multiple array, and randomly select multiple elements within the limited value range to generate the multiple array; wherein, the number of elements in the multiple array is equal to the number of rows of the intermediate key matrix.

[0012] In an embodiment of the present invention, when using each element in the multiple array to perform elementary row transformation of multiplying by a multiple on each row of the intermediate key matrix, use the elements in the multiple array as multiples, gradually multiply a row of elements in the intermediate key matrix by an element in the multiple array, and add the result after multiplication to another row of elements in the intermediate key matrix to form the target key matrix; and there are two non-zero elements in each row of elements of the formed target key matrix.

[0013] In an embodiment of the present invention, a modulo operation is performed on each element in the target key matrix to limit the value range of the target key matrix.

[0014] In an embodiment of the present invention, the target decryption matrix is the inverse matrix of the target key matrix.

[0015] In an embodiment of the present invention, when using the target key matrix to encrypt plaintext data to form a ciphertext matrix, the plaintext data is first split into multiple plaintext matrices, and then the target key matrix is used to encrypt the plaintext matrices to form the ciphertext matrix.

[0016] The present invention also provides a data transmission method for a storage device, which at least includes the following steps: Determine whether the host controller supports encryption operations; When the host controller supports encryption operations, perform an enabling encryption operation on the storage device; Configure the hardware registers in the storage device; When transmitting each piece of plaintext data, generate the target key matrix and the target decryption matrix according to the data encryption method described in any one of the above, and store the target key matrix and the target decryption matrix in the hardware registers; and Use the target key matrix to encrypt the plaintext data and use the target decryption matrix to decrypt the encrypted data.

[0017] The present invention also provides an electronic device, and the electronic device includes: A memory storing program instructions; and A processor that runs the program instructions to implement the data encryption method of the storage device described in any one of the above.

[0018] In summary, the data encryption method, data transmission method and electronic device of a storage device provided by the present invention, in the process of obtaining the target key matrix, since the interchange array and the doubling array are true random numbers rather than pseudo-random numbers, the key matrix formed by the UFS is transformed in each read and write data transmission process, and the transformation is irregular. At this time, it can be avoided that the attacker obtains multiple plaintext matrices and ciphertext matrices at the same time, and the key matrix is ​​cracked by solving the thread equation group. The target key matrix formed by this method can ensure the security of the data. The process of forming the target key matrix is ​​equivalent to first interchanging the unit matrix and then performing the doubling row transformation. The two elementary row transformations are used in combination, so that the encrypted ciphertext matrix is ​​completely unrelated to the plaintext matrix. At the same time, the two elementary row transformations can make each element in the inverse matrix of the target key matrix (i.e., the target decryption matrix) an integer, avoiding the appearance of decimals in the target decryption matrix, so that the decrypted data and the original plaintext data have errors, affecting the accuracy of data transmission. Since each row element of the intermediate key matrix is ​​doubled and transformed, each row element in the target key matrix is ​​provided with other non-zero elements in addition to one element and multiple zero elements in the unit matrix, so that each element in the plaintext matrix will be encrypted, ensuring the integrity of the encryption process. Furthermore, since each row element is only doubled and transformed once, each row element in the target key matrix has only two non-zero elements, so that as many zero elements as possible appear in the target key matrix, reducing the amount of calculation in the data encryption process and decryption process. Therefore, through the data encryption method and data transmission method provided by the present application, when UFS performs operations such as reading and writing that require data transmission, each transaction will dynamically generate a key matrix, and different transaction key matrices are different, so that even if the key is stolen, it is impossible to crack the data of the new transaction. The security of UFS during data transmission is guaranteed. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for describing the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative work.

[0020] Figure 1 It is a structural diagram of a storage device in an embodiment of the present application.

[0021] Figure 2 It is a flow chart of a data encryption method of a storage device in one embodiment of the present application.

[0022] Figure 3 yes Figure 2The flowchart of the method for obtaining the target key matrix in the shown test method process.

[0023] Figure 4 It is the flowchart of the data transmission method of the storage device in an embodiment of the present application.

[0024] Figure 5 It is the schematic structural diagram of the electronic device in an embodiment of the application. Detailed implementation manners

[0025] To facilitate the understanding of the present application, the present application will be described more comprehensively below with reference to the relevant drawings. The preferred embodiments of the present application are shown in the drawings. However, the present application can be implemented in many different forms and is not limited to the embodiments described herein. On the contrary, these embodiments are provided to make the disclosure of the present application more thorough and comprehensive.

[0026] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by those of ordinary skill in the technical field to which this application belongs. The terms used in the description of this application herein are only for the purpose of describing specific embodiments and are not intended to limit this application.

[0027] In the description of the present invention, it should be understood that the orientation or positional relationship indicated by the terms "center", "upper", "lower", "front", "rear", "left", "right", etc. is based on the orientation or positional relationship shown in the drawings, and is only for the convenience of describing the present invention and simplifying the description, rather than indicating or implying that the device or component referred to must have a specific orientation, be constructed and operated in a specific orientation, and thus cannot be understood as a limitation of the present invention. The degrees indicated by "high", "low", etc. are only for the convenience of describing the present invention and simplifying the description, rather than indicating or implying that the device or component referred to must have a high or low degree, and thus cannot be understood as a limitation of the present invention. In addition, the terms "first" and "second" are only used for descriptive purposes and cannot be understood as indicating or implying relative importance.

[0028] Please refer to Figure 1As shown, the storage device provided in this application is, for example, a universal flash storage. The universal flash storage includes a central processing unit 101 (CPU), a static random-access memory 102 (SRAM), a universal flash storage interface 103, a flash memory controller 104, and flash memory blocks 105. Among them, the central processing unit 101 is responsible for executing host program instructions and processing data, and communicates with other components in the system through various interfaces. The static random-access memory 102 is usually used as the primary or secondary cache of the central processing unit 101, and can provide fast data access for the central processing unit 101 to improve the overall performance of the system. The universal flash storage interface 103 connects the host and the storage device, allows data to be transferred between the host and the storage device, and supports full-duplex communication, that is, read and write operations are performed simultaneously. The flash memory controller 104 manages the flash memory blocks 105 and processes data read and write requests from the central processing unit 101. The flash memory controller 104 can control the data flow to ensure that data is correctly stored in the flash memory blocks 105 or read from the flash memory blocks 105. The flash memory blocks 105 are non-volatile storage media and can keep data from being lost even when the power is off.

[0029] Please refer to Figure 2 As shown, the present invention provides a data encryption method for a storage device, which is applicable to the encryption process of data transmission between a universal flash storage and a host. Specifically, each time plaintext data is transmitted, the data encryption method of the storage device includes steps S101 to S104.

[0030] Step S101: Determine the number of rows and columns of the key matrix according to the specifications of the key stored in the hardware register in the storage device, and use the identity matrix with the determined number of rows and columns as the initial key matrix.

[0031] Step S102: Randomly arrange a plurality of numbers to form an interchange array, and use the numbers in the interchange array to limit the column positions of the elements in the initial key matrix to form an intermediate key matrix.

[0032] Step S103: Perform elementary row transformation of adding multiples to each row of the intermediate key matrix to obtain a target key matrix, and obtain a target decryption matrix corresponding to the target key matrix.

[0033] Step S104: Encrypt the plaintext data with the target key matrix to form a ciphertext matrix, and decrypt the ciphertext matrix with the target decryption matrix.

[0034] Please refer to Figure 2As shown, in an embodiment of the present invention, in step S101, according to the specifications of the hardware register storing the key in the storage device to determine the number of rows and columns of the key matrix, the hardware register is the hardware register storing the target key matrix and the target decryption matrix. In this embodiment, the hardware register storing the target key matrix and the target decryption matrix is the hardware register in UFSHCI, and it is the x-CRYPTOCFG–Crypto Configuration X register. Among them, bits 511:000 of the x-CRYPTOCFG–Crypto Configuration X register store the key, so the specification for storing the key is that it can store up to 512 bits of data at most. Therefore, the maximum data volume of each key matrix is 512 bits, that is, 64 bytes. And the size of each element of the key matrix is 1 byte, so the key matrix is an 8×8 matrix. Therefore, in this embodiment, the number of rows and columns of the key matrix are both 8. In other embodiments, when the specifications of the hardware register storing the target key matrix and the target decryption matrix are limited, the number of rows and columns of the key matrix will be limited accordingly.

[0035] Please refer to Figure 2 As shown, in an embodiment of the present invention, after determining the number of rows and columns of the key matrix, the unit matrix with the determined number of rows and columns is used as the initial key matrix. In this embodiment, the initial key matrix is an 8×8 unit matrix.

[0036] Please refer to Figure 2 As shown, in an embodiment of the present invention, in step S102, it is necessary to first determine the number and range of elements in the swap array. Among them, the number of elements in the swap array is equal to the number of rows of the key matrix, and the elements in the swap array are natural numbers from 1 to the number of columns. Then in this embodiment, there are 8 elements in the swap array, and they are natural numbers from 1 to 8. That is, the elements in the swap array are 1, 2, 3, 4, 5, 6, 7, and 8.

[0037] Please refer to Figure 2 As shown, in an embodiment of the present invention, in step S102, after determining the number and range of elements in the swap array, multiple elements in the swap array are shuffled to form a swap array. In this embodiment, the srand(time(0)) function can be used to arrange multiple elements. Specifically, the current system time can be used to randomly generate a seed reference value first, and then the rand() function is used to generate random numbers, and then the swap array is generated. In this embodiment, the randomly generated swap array S is, for example, S = [3 5 6 7 1 2 8 4]. In other embodiments, the elements in the swap array can be arranged in any order.

[0038] Please refer to Figure 2As shown, in an embodiment of the present invention, in step S102, when using the elements in the swap array to limit the column number position of element 1 in the initial key matrix, according to the arrangement order of numbers, each element in the swap array is used to limit the column number position of element 1 in each row of the initial key matrix, and an intermediate key matrix is obtained. In this embodiment, when the swap array is S = [3 5 6 7 1 2 8 4], the element 1 in the first row of the initial key matrix is limited to the third column, the element 1 in the second row of the initial key matrix is limited to the fifth column, the element 1 in the third row of the initial key matrix is limited to the sixth column, the element 1 in the fourth row of the initial key matrix is limited to the seventh column, the element 1 in the fifth row of the initial key matrix is limited to the first column, the element 1 in the sixth row of the initial key matrix is limited to the second column, the element 1 in the seventh row of the initial key matrix is limited to the eighth column, and the element 1 in the eighth row of the initial key matrix is limited to the fourth column. At this time, the obtained intermediate key matrix is shown in the following formula: ; where K0 is the intermediate key matrix, and all the elements not filled in the intermediate key matrix K0 are 0.

[0039] Please refer to Figure 2 As shown, in an embodiment of the present invention, the intermediate key matrix is obtained by performing multiple row swaps (or column swaps) on the identity matrix. Therefore, the intermediate key matrix can be expressed by the following formula: K0 = E 13 E 16 E 12 E 15 E 47 E 48 E; where E is the identity matrix; E ij represents the elementary matrix obtained by swapping the i-th row and the j-th row (or the i-th column and the j-th column) of the identity matrix, which is called the swap elementary matrix. And multiplying any matrix on the left by an E ij means performing a corresponding elementary row transformation on the matrix, and multiplying on the right by an E ij means performing a corresponding elementary column transformation. Then the intermediate key matrix K0 is obtained by successively swapping the fourth row and the eighth row of the identity matrix, the fourth row and the seventh row, the first row and the fifth row, the first row and the second row, the first row and the sixth row, and the first row and the third row.

[0040] Please refer to Figure 2As shown, in an embodiment of the present invention, after obtaining the intermediate key matrix, it is also necessary to obtain the intermediate decryption matrix corresponding to the intermediate key matrix. Among them, the decryption matrix is the inverse matrix of the key matrix. In this embodiment, since the intermediate key matrix is an elementary matrix obtained by row swapping of the identity matrix, the intermediate key matrix is an orthogonal matrix, so the following formula holds: K0K0 T =E; Therefore, K0 -1 =K0 T .

[0041] Among them, K0 -1 is the inverse matrix of the intermediate key matrix K0, that is, the intermediate decryption matrix. K0 T is the transpose matrix of the intermediate key matrix K0. In this application, the intermediate decryption matrix is the transpose matrix of the intermediate key matrix K0.

[0042] Please refer to Figure 2 As shown, in an embodiment of the present invention, after obtaining the intermediate key matrix and the intermediate decryption matrix, perform step S103: perform row addition elementary row transformation on each row of the intermediate key matrix to obtain the target key matrix, and obtain the target decryption matrix corresponding to the target key matrix. Among them, the row addition elementary row transformation is to multiply the elements of a row of the intermediate key matrix by a natural number and then add it to the elements of the added row. The target key matrix obtained by performing row addition elementary row transformation on each row of the intermediate key matrix can ensure that in addition to a single one element and multiple zero elements in the identity matrix in the added row, there are also other non-zero elements.

[0043] Please refer to Figures 2 to 3 As shown, in an embodiment of the present invention, performing row addition elementary row transformation on each row of the intermediate key matrix to obtain the target key matrix includes steps S1031 to S1033.

[0044] Step S1031: Randomly generate an addition array.

[0045] In an embodiment of the present invention, when generating the addition array, first limit the value range of the elements in the addition array, and randomly select multiple numbers within the limited value range to form the addition array. Among them, the number of elements in the addition array is equal to the number of rows of the intermediate key matrix, and each element in the addition array can be equal or not equal. In this embodiment, each element in the addition array is set to be not equal. Specifically, the value range of the numbers in the addition array is set, for example, as random integers between 2 and 100, and then the srand(time(0)) function is used to randomly select, for example, 8 numbers within the value range to form the addition array. The generated addition array M is, for example, M = [3 9 2 7 11 4 17 13].

[0046] Step S1032: Use each element in the multiple array to gradually perform elementary row transformation of adding multiples to each row of the intermediate key matrix to obtain the target key matrix.

[0047] In an embodiment of the present invention, after generating the multiple array, use the elements in the multiple array as multiples, gradually multiply an element in a row of the intermediate key matrix by an element in the multiple array, and add the result of the multiplication to the elements in another row (the row of adding multiples) of the intermediate key matrix. During the process of gradually performing elementary row transformation of adding multiples to each row of the intermediate key matrix using each element in the multiple array, the elements in the multiple array, the row elements of the intermediate key matrix multiplied by the elements in the multiple array, and the elements in the row of adding multiples are all non-repetitive. In a specific embodiment, the target key matrix K1 is obtained, for example, through the following formula: K1 = E 81 (13)E 12 (17)E 23 (4)E 34 (11)E 45 (7)E 56 (2)E 67 (9)E 78 (3)K0; where Eij(k) represents an elementary matrix obtained by adding k times of the i-th row of the identity matrix to the j-th row (or adding k times of the j-th column to the i-th column), and is called an elementary matrix of adding multiples. And multiplying any matrix on the left by an Eij(k) represents performing a corresponding elementary row transformation on the matrix, and multiplying on the right by an Eij(k) represents performing a corresponding elementary column transformation. Then the target key matrix K1 is obtained by successively adding three times the elements in the seventh row of the intermediate key matrix K0 to the eighth row, nine times the elements in the sixth row to the seventh row, two times the elements in the fifth row to the sixth row, seven times the elements in the fourth row to the fifth row, eleven times the elements in the third row to the fourth row, four times the elements in the second row to the third row, seventeen times the elements in the first row to the second row, and thirteen times the elements in the eighth row to the first row. The obtained target key matrix K1 is: ; At this time, in addition to the element 1 and the element 0 in each row of the obtained target key matrix, there are other non-zero elements, which can avoid the situation where only one element is 1 and the remaining elements are all 0 in a row or a column of the target key matrix. When only one element is 1 and zero elements in a row or a column of the target key matrix, encrypting the plaintext matrix is equivalent to directly copying the plaintext matrix onto the ciphertext without performing encryption operations, resulting in poor overall encryption effect.

[0048] Step S1033: Limit the value range of the target key matrix.

[0049] In an embodiment of the present invention, when the UFSHCI operates a read / write transaction, it encapsulates a UTP transfer request descriptor (UTRD). The UTRD describes the command to be executed and the data associated therewith. The host software issues a command to the host controller by placing the UTRD in a list and then notifying the host Controller doorbell to view the list. The commands dispatched and executed in sequence by the UFSHCI are placed in the list, even if they may complete out of order. The host controller processes on behalf of the host all data transfer operations related to the management of the command. For the commands to be updated in the list, it will cause a command completion interrupt or the UTRD status field. During the execution of the command, the UFS software may add commands to the list.

[0050] In an embodiment of the present invention, a UTP command descriptor (UCD) is embedded inside the UTRD. The UCD points to a physical region description table (PRDT), that is, the data addresses and byte counts of the outbound UPIU and the inbound UPIU. According to the design of the PRDT, the unit of data transfer is counted in bytes. Therefore, each element in the matrix is designed to be in bytes, and the size range of each element is 0 to 255. After obtaining the target key matrix, it is necessary to limit the value of each element in the target key matrix to be between 0 and 255. In this embodiment, to ensure that the value of each element in the target key matrix is limited to be between 0 and 255, a remainder operation is performed on each element in the target key matrix, and the divisor is 256, that is, the mod256 operation.

[0051] In an embodiment of the present invention, the target key matrix K1 after limiting the range is obtained through the following formula: K1 = E 81 (13)E 12 (17)E 23 (4)E 34 (11)E 45 (7)E 56 (2)E 67 (9)E 78 (3)K0 mod 256; Please refer to Figure 1 As shown, in an embodiment of the present invention, in step S103, after obtaining the target key matrix, it is also necessary to obtain the target decryption matrix corresponding to the target key matrix. The target decryption matrix is the inverse matrix of the target key matrix. In this embodiment, the target decryption matrix is obtained through the following formula: K1 -1=K0 T E 78 (-3)E 67 (-9)E 56 (-2)E 45 (-7)E 34 (-11)E 23 (-4)E 12 (-17)E 81 (-13) mod256。

[0052] Please refer to Figure 2 As shown, in an embodiment of the present invention, in step S104, when encrypting the plaintext data with the target key matrix to form the ciphertext matrix, the plaintext data is first split into multiple plaintext matrices, and then the target key matrix is used to encrypt the plaintext matrix to form the ciphertext matrix. Specifically, in the UFS3.1 protocol, the data structure of the Physical Region Description Table (Data structure for Physical Region Description Table) is defined (4DW format), where the Data Byte Count of DW3 represents that the data size to be transmitted in a transaction should be consistent with that in the UTRD descriptor. According to the limitation of the Common Data Size (CDS) by bits 15:08 in DW2 of the UTRD descriptor, the maximum data specification that can be transmitted in a read / write transaction is 256KB. When the size of the plaintext data is not a multiple of 64, random numbers can be used to pad it so that the data size is a multiple of 64 bytes. The number of plaintext matrices obtained by splitting a piece of plaintext data can be obtained through the following formula: 256KB / 8byte = 256KB×1024byte / 8byte = 32768; That is, a piece of plaintext data of 256KB can be split into 32768 plaintext matrices.

[0053] After that, the ciphertext matrix C is obtained through the following formula: C = K1P mod256; where K1 is the target key matrix after being limited in range, P is the plaintext matrix. After multiplying the final target key matrix and the plaintext matrix, a remainder operation can be performed on the product of the target key matrix and the plaintext matrix, and the divisor is 256, that is, the mod256 operation.

[0054] Among them, each element in the ciphertext matrix C is obtained through the following formula: ; where represents the element in the i-th row and j-th column of the ciphertext matrix C, represents the i-th row element in the target key matrix K1, represents the element of the jth column in the plaintext matrix P, l is a variable ranging from 0 to n. In this embodiment, the number of columns of the target key matrix K1 is equal to the number of rows of the plaintext matrix P, that is, n.

[0055] After receiving the ciphertext matrix on the host side, the ciphertext matrix can be decrypted according to the target decryption matrix to obtain the plaintext matrix. That is: P=K -1 C mod256; ; Among them, p ij represents the element in the i-th row and j-th column of the plaintext matrix P, Represents the target decryption matrix The element of the i-th row of represents the element of the jth column of the ciphertext matrix C, l is a variable ranging from 0 to n. In this embodiment, the target decryption matrix The number of columns is equal to the number of rows of the ciphertext matrix C, which is n.

[0056] See also Figures 2 to 3 As shown, in the present application, in the process of obtaining the target key matrix, since the interchange array and the doubling array are both true random numbers rather than pseudo-random numbers, the key matrix formed by UFS is transformed in each read and write data transmission process, and the transformation is irregular. At this time, it can prevent the attacker from obtaining multiple plaintext matrices and ciphertext matrices at the same time, and use the method of solving the threaded equation group to crack the key matrix. The target key matrix formed by this method can ensure the security of the data.

[0057] See also Figures 2 to 3 As shown, in the present application, the process of forming the target key matrix is ​​equivalent to first interchanging the unit matrix and then performing a doubling row transformation. The combination of these two elementary row transformations makes the encrypted ciphertext matrix completely unrelated to the plaintext matrix. At the same time, these two elementary row transformations can make each element in the inverse matrix of the target key matrix (i.e., the target decryption matrix) an integer, avoiding decimals in the target decryption matrix, causing errors between the decrypted data and the original plaintext data, and affecting the accuracy of data transmission.

[0058] See also Figures 2 to 3As shown, in the present application, since row addition and multiplication transformation is performed on each row element of the intermediate key matrix, there are other non-zero elements in each row element of the target key matrix in addition to a 1 element and multiple zero elements in the identity matrix, so that each element in the plaintext matrix will be encrypted, ensuring the integrity of the encryption process. Moreover, since row addition and multiplication transformation is only performed on each row element once, there are only two non-zero elements in each row element of the target key matrix, so that as many zero elements as possible appear in the target key matrix, reducing the computational amount in the data encryption process and decryption process.

[0059] Please refer to Figure 4 As shown, the present invention also provides a data transmission method for a storage device, which specifically includes steps S201 to S206.

[0060] Step S201: Determine whether the host controller supports encryption operations. If the host controller supports encryption operations, execute step S202. If the host controller does not support encryption operations, end the process.

[0061] Specifically, it is possible to query whether the host controller supports encryption operations by reading the encryption support bit (Crypto Support, CS) of the CAP-Controller Capabilities hardware register. The encryption support bit is, for example, the 28th bit (bit28). If the 28th bit of the CAP-Controller Capabilities hardware register is 1, it means that the host controller supports encryption operations. If the 28th bit of the CAP-Controller Capabilities hardware register is 0, it means that the host controller does not support encryption operations.

[0062] Step S202: Perform an enabling encryption operation on the storage device.

[0063] Specifically, for a transaction with UTRD.CE = 1, performing an enabling encryption operation means setting UTRD.CE = 1 for the transaction to be encrypted. In this embodiment, it is possible to perform an enabling encryption operation by setting bit 01 = 1 of the HCE-Host Controller Enable hardware register.

[0064] Step S203: Configure the hardware registers in the storage device.

[0065] Specifically, the x-CRYPTOCAP-Crypto Capability X register can be configured to support the supported Data Unit Size Bitmask (SDUSB), which describes the data unit specifications supported by this performance and is encoded in a bitmask. Set the Algorithm ID (ALGID) to any value from 80h to FFh to form an identification code for the encryption method. Specifically, the algorithm ID is, for example, 80h.

[0066] Step S204: When transmitting each piece of plaintext data, generate a target key matrix and a target decryption matrix.

[0067] Specifically, when transmitting each piece of plaintext data, use the method in steps S101 to S104 to generate a target key matrix and a target decryption matrix.

[0068] Step S205: Store the target key matrix and the target decryption matrix in the hardware register.

[0069] Specifically, first, fill the target key matrix and the target decryption matrix into the position of CRYPTOKEY [511:0] in the x-CRYPTOCFG–CryptoConfiguration X register. Secondly, the target key matrix is essentially an 8×8 matrix. Set the Configuration Enable (CFGE) bit to 1, and then this encryption configuration is used by the host software. Finally, set the corresponding relationship between the encryption configuration and the plaintext data, that is, set UTRD.CCI = x. The Crypto Configuration Index (CCI) field in the UTP transmission request descriptor, which is the coefficient x of the current encryption configuration in the array. Among them, the Crypto Capability Index (CAPIDX) can indicate the coefficient of the encryption performance (Crypto Capability) used by this encryption configuration, and the valid value range of the coefficient of the encryption performance is between 0 and 127. If CAPIDX = x, then the corresponding x-CRYPTOCAP-Crypto Capability X register can be found.

[0070] Step S206: Encrypt the plaintext data using the target key matrix and decrypt the encrypted data using the target decryption matrix.

[0071] Specifically, as described in steps S101 to S104, each piece of plaintext data can be divided into a ciphertext matrix C. Each segment of the plaintext data is divided into 64 bytes. When the size of the plaintext data is not a multiple of 64, random numbers can be used to pad it so that the data size is a multiple of 64 bytes.

[0072] Please refer to Figure 5 As shown, an electronic device provided by an embodiment of the present application includes a processor 201, a memory 202, and a program stored in the memory and executable on the processor. The processor executes to implement the data encryption method and data transmission method of the above storage device.

[0073] Please refer to Figure 5 As shown, the memory 202 includes at least one type of readable storage medium. The readable storage medium includes flash memory, mobile hard disk, multimedia card, card-type memory (such as SD or DX memory, etc.), magnetic memory, magnetic disk, optical disk, etc. The memory can be an internal storage unit of the electronic device in some embodiments, such as the mobile hard disk of the electronic device. The memory can also be an external storage device of the electronic device in other embodiments, such as a plug-in mobile hard disk, a Smart Media Card (SMC), a Secure Digital (SD) card, a Flash Card, etc. equipped on the electronic device. Further, the memory can also include both the internal storage unit and the external storage device of the electronic device. The memory can be used not only to store application software installed on the electronic device and various types of data, but also to temporarily store data that has been output or will be output.

[0074] Please refer to Figure 5 As shown, the processor 201 can be composed of integrated circuits in some embodiments. For example, it can be composed of a single packaged integrated circuit, or can be composed of multiple integrated circuits with the same or different functions, including a combination of one or more central processors, microprocessors, digital processing chips, graphics processors, and various control chips, etc. The processor is the control core (Control Unit) of the vehicle-mounted device, connecting various components of the entire vehicle-mounted device through various interfaces and lines, and by running or executing programs or modules stored in the memory, and calling data stored in the memory, to perform various functions of the vehicle-mounted device and process data.

[0075] The processor executes the operating system of the vehicle-mounted device and various installed application programs. The processor executes the application programs to implement the steps in the above method embodiments.

[0076] Exemplarily, the program can be divided into one or more modules which are stored in the memory and executed by the processor to implement the present invention. The one or more modules can be a series of program instruction segments capable of accomplishing specific functions, and these instruction segments are used to describe the execution process of the program in the processor.

[0077] The integrated unit implemented in the form of software functional modules as described above can be stored in a computer-readable storage medium. The above-mentioned software functional modules stored in a storage medium include several instructions for causing a computer device (which can be a personal computer, a computer device, or a network device, etc.) or a processor to execute some functions of the data encryption method and the data transmission method in various embodiments of the present invention.

[0078] In summary, a data encryption method, a data transmission method, and an electronic device for a storage device. The data encryption method for the storage device includes determining the number of rows and columns of a key matrix according to the specification of storing a key in a hardware register in the storage device, and using an identity matrix with the determined number of rows and columns as an initial key matrix; arranging a plurality of numbers in a disordered manner to form a swap array, and using the numbers in the swap array to define the column positions of elements one in the initial key matrix to form an intermediate key matrix; performing elementary row transformation of adding multiples on each row of the intermediate key matrix to obtain a target key matrix, and obtaining a target decryption matrix corresponding to the target key matrix; and encrypting plaintext data using the target key matrix to form a ciphertext matrix. Through the data encryption method for the storage device provided by the present invention, a simple and secure data encryption method can be provided for users.

[0079] The embodiments of the present invention disclosed above are only used to help explain the present invention. The embodiments do not describe all the details in detail, nor do they limit the invention to the specific embodiments described. Obviously, many modifications and variations can be made according to the content of this specification. These embodiments are selected and specifically described in this specification to better explain the principle and practical application of the present invention, so that those skilled in the art in the relevant technical field can well understand and utilize the present invention. The present invention is only limited by the claims and their full scope and equivalents.

Claims

1. A data encryption method for a storage device, characterized in that, At least include the following steps: Determine the number of rows and columns of the key matrix according to the specification of storing keys in the hardware register in the storage device, and use the identity matrix with the determined number of rows and columns as the initial key matrix; Arrange multiple numbers in a disordered manner to form an exchange array, and use the elements in the exchange array to limit the column positions of the elements 1 in the initial key matrix to form an intermediate key matrix; Perform elementary row transformation of adding multiples on each row of the intermediate key matrix to obtain a target key matrix, and obtain the target decryption matrix corresponding to the target key matrix; And Use the target key matrix to encrypt the plaintext data to form a ciphertext matrix, and use the target decryption matrix to decrypt the ciphertext matrix.

2. The data encryption method for a storage device according to claim 1, wherein When forming the exchange array, first determine the number and range of the elements in the exchange array; wherein, the number of elements in the exchange array is equal to the number of rows of the key matrix, and the elements in the exchange array are natural numbers from 1 to the number of columns.

3. A data encryption method for a storage device according to claim 2, wherein After determining the number and range of the elements in the exchange array, arrange the multiple elements in the exchange array in a disordered manner to form the exchange array.

4. A data encryption method for a storage device according to claim 1, characterized in that, When using the numbers in the exchange array to limit the column positions of the elements 1 in the initial key matrix, in accordance with the arrangement order of the elements, use each element in the exchange array to limit the column positions of the elements 1 in each row of the initial key matrix to obtain the intermediate key matrix.

5. A data encryption method for a storage device according to claim 1, characterized in that, After obtaining the intermediate key matrix, obtain the intermediate decryption matrix corresponding to the intermediate key matrix; and the intermediate decryption matrix is the transpose matrix of the intermediate key matrix.

6. A data encryption method for a storage device according to claim 1, characterized in that, Obtaining the target key matrix includes the following steps: Randomly generate an adding multiple array; Use each element in the adding multiple array to perform elementary row transformation of adding multiples on each row of the intermediate key matrix to obtain the target key matrix; and Limit the value range of the target key matrix.

7. A data encryption method for a storage device according to claim 6, characterized in that, When generating the adding multiple array, first limit the value range of the elements in the adding multiple array, and randomly select multiple elements within the limited value range to generate the adding multiple array; wherein, the number of elements in the adding multiple array is equal to the number of rows of the intermediate key matrix.

8. The data encryption method of a storage device according to claim 6, wherein When using each element in the adding multiple array to perform elementary row transformation of adding multiples on each row of the intermediate key matrix, use the elements in the adding multiple array as multiples, gradually multiply the elements of one row of the intermediate key matrix by an element in the adding multiple array, and add the result after multiplication to another row of elements in the intermediate key matrix to form the target key matrix; and there are two non-zero elements in each row of elements of the formed target key matrix.

9. A data encryption method for a storage device according to claim 6, characterized in that, Perform a remainder operation on each element in the target key matrix to limit the value range of the target key matrix.

10. A data encryption method for a storage device according to claim 1, characterized in that, The target decryption matrix is the inverse matrix of the target key matrix.

11. A data encryption method for a storage device according to claim 1, characterized in that, When using the target key matrix to encrypt the plaintext data to form a ciphertext matrix, first split the plaintext data into multiple plaintext matrices, and then use the target key matrix to encrypt the plaintext matrices to form the ciphertext matrix.

12. A data transmission method for a storage device, characterized in that, At least include the following steps: Judge whether the host controller supports encryption operations; When the host controller supports encryption operations, enable the encryption operation for the storage device; Configure the hardware registers within the storage device; When transmitting each piece of plaintext data, generate the target key matrix and the target decryption matrix according to the data encryption method described in any one of claims 1 to 11, and store the target key matrix and the target decryption matrix in the hardware registers; And Encrypt the plaintext data using the target key matrix, and decrypt the encrypted data using the target decryption matrix.

13. An electronic device, characterized in that, The electronic device includes: A memory storing program instructions; and A processor that runs the program instructions to implement the data encryption method for the storage device described in any one of claims 1 to 11.

Images