Processor, data processing method and related equipment

Abstract

The invention provides a processor, a data processing method and related equipment. The processor comprises a substrate; the processing core particles are arranged on the substrate; the storage unit is arranged on the substrate on one side of the processing core particles; wherein the processing core particle comprises a storage unit controller which is coupled with the storage unit through the substrate; and the password module is coupled with the storage unit controller and is configured to perform data interaction with the storage unit through the storage unit controller. By adopting the technical scheme, the security of the data interaction process can be improved.

Description

Technical Field

[0001] This disclosure relates to the field of computer technology, and in particular to a processor, a data processing method, and related equipment. Background Technology

[0002] To protect the confidentiality, integrity, and availability of data, various encryption technologies and secure storage schemes are widely used. As protocols in the field of quantum computing become increasingly sophisticated, the development of standards in encryption and decryption technologies is attracting more and more attention, and the security of terminal devices containing cryptographic modules is receiving increasing emphasis.

[0003] A dedicated cryptographic module is used in the encryption / decryption process. In addition to providing efficient cryptographic operation capabilities, the cryptographic module also needs to provide certain key management functions, allowing users to store keys internally and not lose them when power is off.

[0004] However, the security of the encryption / decryption process still needs to be improved. Summary of the Invention

[0005] In view of this, the present disclosure provides a processor, a data processing method, and related devices that can improve the security of the data interaction process.

[0006] In a first aspect, embodiments of this disclosure provide a processor, including: substrate; Processing cores are disposed on the substrate; A storage unit is disposed on the substrate on one side of the processing core; The processed core includes: A storage cell controller is coupled to the storage cell via the substrate; The cryptographic module, coupled to the storage unit controller, is configured to interact with the storage unit via the storage unit controller.

[0007] Optionally, the processor satisfies one or more of the following: The processing core includes a central processing unit core; The substrate includes a central processing unit substrate; The storage unit includes non-volatile memory; The storage unit includes flash memory.

[0008] Optionally, the substrate has opposing first and second surfaces; The processing chip and the storage unit are disposed on the first side of the substrate, and the traces for connecting the processing chip and the storage unit pass through the substrate. The second side of the substrate is provided with pins, which are used to connect to the motherboard.

[0009] Optionally, the cryptographic module satisfies one or more of the following: The cryptographic module responds to data processing instructions by reading encrypted data from the storage unit through the storage unit controller and performing decryption processing. In response to a data processing instruction, the cryptographic module writes encrypted data into the storage unit via the storage unit controller.

[0010] Optionally, the cryptographic module has an interface through which the storage unit controller is connected to the cryptographic module.

[0011] Optionally, the processed core also includes: An internal memory, coupled to the cryptographic module, stores the chip root key; The cryptographic module is also configured to generate a derived key based on the chip root key, the derived key being used to encrypt and decrypt data in the storage unit.

[0012] Optionally, the substrate has traces coupling the memory cell controller and the memory cell; The storage unit controller is equipped with a Physically Unclonable Function Acquisition Unit, which is used to obtain the PUF response based on the physical characteristics of the trace. The cryptographic module is also configured to: In the initial stage, the first PUF response obtained by the Physically Unclonable Function Acquisition Unit is received, and a first key and auxiliary data corresponding to the first PUF response are generated based on the first PUF response. During the working phase, the second PUF response obtained by the Physically Unclonable Function Acquisition Unit is received, and the first key is reconstructed based on the second PUF response and the auxiliary data; Based on the reconstructed first key and the chip root key, the derived key is generated through a key derivation function.

[0013] Optionally, the processor further includes a protective cover disposed on the substrate and forming an accommodating space, wherein the processing chip and the storage unit are placed within the accommodating space, and the protective cover is used for signal isolation.

[0014] Optionally, the material of the protective cover is selected from one or more of the following: Metallic materials; Conductive coating materials; Ceramic-polymer composites.

[0015] In a second aspect, embodiments of this disclosure provide a data processing method applied to the processor described in any of the foregoing embodiments, the data processing method comprising: In response to data processing instructions, the cryptographic module interacts with the storage unit via the storage unit controller.

[0016] Optionally, in response to a data processing instruction, the cryptographic module is controlled to interact with the storage unit via the storage unit controller, satisfying one or more of the following: In response to the data processing instruction, encrypted data is read from the storage unit through the storage unit controller and decrypted through the cryptographic module; In response to the data processing instruction, the data written to the storage unit is encrypted by the cryptographic module through the storage unit controller.

[0017] Optionally, the processing chip further includes an internal memory coupled to the cryptographic module, wherein the internal memory stores the chip root key; The data processing method further includes: The cryptographic module generates a derived key based on the chip root key, and the derived key is used to encrypt and decrypt data in the storage unit.

[0018] Optionally, the substrate has traces coupling the memory cell controller and the memory cell, the memory cell controller is provided with a physically unclonable function acquisition unit, and the data processing method further includes: In the initial stage, the cryptographic module receives the first PUF response obtained by the Physically Unclonable Function Acquisition Unit, and generates a first key and auxiliary data corresponding to the first PUF response based on the first PUF response. During the working phase, the cryptographic module receives the second PUF response obtained by the Physically Unclonable Function Acquisition Unit, and reconstructs the first key based on the second PUF response and the auxiliary data; The cryptographic module generates the derived key based on the reconstructed first key and the chip root key through a key derivation function.

[0019] Thirdly, embodiments of this disclosure also provide a computer device including a processor as described in any of the foregoing embodiments.

[0020] Optionally, the computer device includes one or more of the following: The physical servers of the cloud platform; Security authentication gateway; Database server.

[0021] Fourthly, embodiments of this disclosure provide a computer device, including a processor and a memory, wherein the memory stores computer program instructions, and the processor invokes the computer program instructions stored in the memory to execute the data processing method as described in any of the foregoing embodiments. Fifthly, embodiments of this disclosure provide a computer-readable storage medium storing computer program instructions that, when executed by a processor, implement the data processing method as described in any of the foregoing embodiments.

[0022] Compared with the prior art, the technical solution of the present disclosure has the following advantages: The processor provided in this embodiment may include a memory cell controller and a cryptographic module. Since the processor and memory cell are integrated on a substrate, the memory cell controller can be coupled to the memory cell through the substrate, and the cryptographic module can then interact with the memory cell through the memory cell controller. This way, the packaged processor does not expose any hardware interface, and the memory cell is integrated within the processor, achieving on-chip data storage. The data interaction process can be completed within the processor, thus improving the security of the data interaction process. Furthermore, since the memory cell is packaged inside the processor, dependence on the motherboard is reduced, and the storage space of the memory cell meets encryption requirements, ensuring that data is always stored within the processor, further enhancing security. Attached Figure Description

[0023] To more clearly illustrate the technical solutions in the embodiments of this disclosure or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of this application. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0024] Figure 1 A schematic diagram of the hardware structure of an external storage unit for a central processing unit is shown. Figure 2 A schematic diagram of the structure of a first processor in an embodiment of this disclosure is shown; Figure 3 A schematic diagram of the structure of a substrate according to an embodiment of the present disclosure is shown; Figure 4 A schematic diagram of the structure of a second processor in an embodiment of this disclosure is shown; Figure 5 A schematic diagram of the structure of a storage unit controller according to an embodiment of the present disclosure is shown; Figure 6A schematic diagram of the structure of a data processing method according to an embodiment of this disclosure is shown; Figure 7 A schematic diagram of the hardware structure of a computer device according to an embodiment of the present disclosure is shown. Detailed Implementation

[0025] As described in the background section, the security of the encryption / decryption process still needs to be improved.

[0026] To enable those skilled in the art to better understand the problems existing in the current solutions, the following provides a brief introduction to the encryption schemes of the existing solutions through examples.

[0027] One approach involves inserting a dedicated cryptographic module externally onto the motherboard to perform encryption / decryption operations. However, because this cryptographic module chip is entirely connected to the central processing unit via an external bus, its exposed surface area is increased, making it vulnerable to bus-based physical attacks and resulting in lower security.

[0028] With the continuous improvement of integration, directly integrating cryptographic modules inside processors (such as CPUs) has become a hot research topic in the industry.

[0029] See Figure 1 The diagram shown illustrates a hardware structure for external memory connected to a central processing unit. Figure 1 As shown, the central processing unit chip 110 has a built-in password module 120, and the central processing unit chip 110 is coupled to the flash memory chip 140 through the motherboard 130.

[0030] Sensitive data (such as keys) in the cryptographic module 120 are stored in the flash memory chip 140.

[0031] In one embodiment, the flash memory chip 140 is an existing flash memory stored in the Basic Input Output System (BIOS) firmware. A certain size of space is allocated on the BIOS Flash as the storage space for the cryptographic module 120, which stores data that needs to be persistently stored, such as keys, in this space.

[0032] During data interaction, the central processing unit chip 110 reads data from the flash memory chip 140 through the bus and the motherboard 130, and outputs the read data to the password module 120 for decryption; or, the data encrypted by the password module 120 is written into the flash memory chip 140 through the motherboard 130 and the bus.

[0033] However, the encryption scheme using an external flash memory chip 140 typically has the following main drawbacks: When the BIOS Flash is located on the motherboard 130 and connected to the CPU chip via a bus, its large physical exposure surface makes it vulnerable to attacks and results in low security, failing to meet the requirements of high-security scenarios.

[0034] The size and model of the BIOS Flash are different for different motherboards, which increases the design complexity of the password module.

[0035] As can be seen from the above, both the dedicated password module plugged into the motherboard and the encryption scheme using an external Flash chip have low security issues.

[0036] Research has shown that CPU-integrated cryptographic modules, such as Trusted Platform Modules (TPMs) / Trusted Cryptographic Modules (TCMs), are becoming a growing trend. Compared to traditional external cryptographic module chips on motherboards, they offer advantages such as lower cost, higher security, and ease of use. Besides providing cryptographic algorithm support, cryptographic modules typically also offer key management functions, allowing users to store keys internally without data loss during power outages. This necessitates providing a certain amount of non-volatile (NV) storage space for the cryptographic module. For security, this NV needs to guarantee the security of the data stored within it; relevant national cryptographic standards, such as GM / T0028, have set high requirements for this.

[0037] On the other hand, due to technological reasons such as process technology, CPU chips are currently difficult to integrate IP related to eFlash to provide on-chip storage. This issue also needs to be considered when providing the required NV storage space for the CPU's built-in cryptographic module.

[0038] To address the aforementioned technical problems, this disclosure provides a processor whose processing chip may include a memory cell controller and a cryptographic module. Since the processing chip and memory cell are integrated on a substrate, the memory cell controller can be coupled to the memory cell through the substrate, and the cryptographic module can then interact with the memory cell through the memory cell controller. Thus, the packaged processing chip does not expose any external hardware interfaces, and the memory cell is integrated within the processor, achieving on-chip data storage. The data interaction process can be completed within the processor, thereby improving the security of the data interaction process.

[0039] Furthermore, the storage unit is encapsulated inside the processor, reducing reliance on the motherboard. The storage space of the storage unit can meet encryption requirements, ensuring that data is always stored inside the processor, further enhancing security.

[0040] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings.

[0041] See Figure 2 The schematic diagram of the first processor in the embodiment of this disclosure is shown below. Figure 2 As shown, the processor may include: substrate 210; Processing core 220 is disposed on the substrate 210; Storage unit 230 is disposed on substrate 210 on one side of processing core 220; The processed core 220 includes: The storage unit controller 221 is coupled to the storage unit 230 via the substrate 210; The cryptographic module 222, coupled to the storage unit controller 221, is configured to interact with the storage unit 230 via the storage unit controller 221.

[0042] In some embodiments, the substrate 210 can serve as a bridge between the processor and external circuitry to enable interaction between the processor and external circuitry.

[0043] In some embodiments, the substrate 210 may be made of materials such as organic materials, ceramics or silicon, and wiring is provided on the substrate 210 to realize the electrical connection between the processing chip 220 and the memory cell 230.

[0044] In one specific embodiment, substrate 210 may include a central processing unit substrate.

[0045] Combination Figure 2 See Figure 3 The schematic diagram shown below illustrates the structure of a substrate in an embodiment of this disclosure, as follows: Figure 3 As shown, the substrate 210 has a first surface F1 and a second surface F2 facing each other.

[0046] Accordingly, the processing chip 220 and the memory cell 230 are disposed on the first surface F1 of the substrate 210, and the traces for connecting the processing chip 220 and the memory cell 230 penetrate the substrate 210 (e.g., Figure 2 (The dashed line indicates the connection between the storage unit controller 221 and the storage unit 230.)

[0047] By embedding the connection between the processing chip 220 and the storage unit 230 in the substrate 210, the area of ​​the processor exposed can be further reduced, so that data interaction is only within the processor.

[0048] In some embodiments, the second side F2 of the substrate 210 is provided with a pin for connection to the motherboard 300.

[0049] Specifically, the second side F2 of the substrate 210 provides pins of a specific size and quantity. These pins can be connected to sockets on the motherboard 300 to enable information exchange between the processor and the motherboard 300.

[0050] Processor chip 220 is the core of the processor, responsible for performing computing tasks, processing applications, and controlling other hardware components.

[0051] This application mainly relates to the flow and processing of control data in the core 220, including reading data from the storage unit 230 and writing the processed data into the storage unit 230, so that the data storage and encryption process can operate efficiently and securely.

[0052] In one specific embodiment, the processing chip 220 may include a central processing unit (CPU) chip, which may be obtained by dicing a wafer.

[0053] It should be noted that, firstly, in actual packaging processes, there is often an interposer layer between the substrate and the processed chip. Similar to the substrate, the interposer layer provides the connection between the chips and has better electrical characteristics. For ease of explanation, this application omits the interposer layer and uses the substrate as the sole description.

[0054] Second, with Figure 2 The illustrated number of processing cores is for illustrative purposes only. The number of processing cores can be set according to actual needs, such as multiple processing cores with the same function, or multiple processing cores with different functions.

[0055] Furthermore, in the case where the processor has multiple processing chips, each chip is connected to the substrate and communicates with the substrate.

[0056] Storage unit 230 is used to store persistent encrypted data.

[0057] Specifically, before data is stored in storage unit 230, it is usually encrypted by cryptographic module 222 to ensure the confidentiality and integrity of the data during the storage process.

[0058] In some embodiments, the memory cell 230 is disposed on the substrate 210 on one side of the processing chip 220. The memory cell 230 and the processing chip 220 can be manufactured independently, reducing the need for modification of the processing chip 220, thereby reducing the complexity of the processing chip 220, making the chip design simpler and having a lower implementation cost.

[0059] Furthermore, by placing the storage unit 230 outside the processing core 220, different types and capacities of storage units 230 can be selected according to actual needs, making it easy to expand the storage capacity.

[0060] For example, when more storage space is needed, simply add or replace storage unit 230 without redesigning the entire processing core.

[0061] It should be noted that, Figure 2 The relative positional relationship between the storage unit 230 and the processing core 220 shown is for illustrative purposes only and does not represent the actual position of the storage unit 230 and the processing core 220 in the processor. It is used to illustrate that the storage unit 230 and the processing core 220 are integrated into the processor.

[0062] In some embodiments, the storage unit 230 includes non-volatile memory. Non-volatile memory is non-volatile, ensuring that sensitive data such as keys remain present in application scenarios such as power outages or restarts, without requiring user input or external import, thus reducing the risk of sensitive data being exposed during transmission.

[0063] In one specific embodiment, the storage unit may include flash memory (e.g., NAND Flash, NOR Flash, and eFlash).

[0064] It is understood that the storage cell 230 in this application only needs to have non-volatile characteristics. For example, non-volatile memory may also include RRAM, ReRAM, and MRAM, etc.

[0065] In some embodiments, the storage unit 230 can be a chip or a packaged chip. When the storage unit 230 is a chip, it is stacked and disposed in the same package as the processing chip 220; when the storage unit 230 is a packaged chip, it can be soldered onto the substrate as an independent package.

[0066] In some embodiments, the storage unit 230 is stored within the processor, and the connection between the storage unit 230 and the storage unit controller 221 is not exposed to the outside, reducing the possibility of physical attacks and further improving data security.

[0067] The storage unit controller 221 is a key component for managing and controlling the read and write operations of the storage unit 230, and it serves to connect the cryptographic module 222 with the storage unit 230.

[0068] In some embodiments, the storage unit controller 221 can write data from the processing core 220 to the storage unit 230, or read data from the storage unit 230 and transmit it to the cryptographic module 222, which ensures the security and efficiency of the data storage process.

[0069] In some embodiments, the storage unit controller 221 works with the cryptographic module 222 to ensure that data is encrypted when written to the storage unit 230 or decrypted when read from the storage unit 230.

[0070] Cryptographic module 222 is a hardware security module whose main functions are to provide efficient encryption, key management, and data protection. Its main functions include: Key generation and storage: The cryptographic module generates and stores encryption keys (such as symmetric and asymmetric keys) and ensures that these keys cannot be accessed externally.

[0071] Data encryption and decryption: According to the security protocol, the cryptographic module uses the generated key to encrypt and decrypt the data, ensuring the security of the data during storage and transmission.

[0072] Digital signatures and verification: When authentication is required, the cryptographic module can generate and verify digital signatures to prove the integrity and authenticity of the data.

[0073] In some embodiments, the cryptographic module 222 works with the storage unit controller 221 to ensure data security by encrypting storage and access operations.

[0074] Specifically, the cryptographic module 222 satisfies one or more of the following: in response to a data processing instruction, the cryptographic module 222 reads encrypted data from the storage unit 230 through the storage unit controller 221 and performs decryption processing; in response to a data processing instruction, the cryptographic module 222 writes encrypted data into the storage unit 230 through the storage unit controller 221.

[0075] Therefore, the encryption and decryption processes are executed inside the processor, avoiding the risk of key leakage or tampering during transmission and improving the security of data interaction.

[0076] Furthermore, data does not need to be transferred between the processor and external hardware (such as external encryption modules and storage devices), reducing data transmission latency and improving response speed.

[0077] In some embodiments, the cryptographic module 222 has an interface through which the storage unit controller 221 is connected. This allows for better physical isolation of encryption operations from other tasks of the processor. This isolation ensures that sensitive data (such as keys and encrypted data) remains in a controlled and isolated environment, reducing the risk of malicious access or tampering.

[0078] In some embodiments, the cryptographic module 222 is selected from one or more of the Trusted Cryptography Module (TCM), Trusted Platform Module (TPM), and Trusted Platform Control Module (TPCM).

[0079] In some embodiments, encryption and integrity protection may be implemented to further protect the data security in storage unit 230.

[0080] See Figure 4 The schematic diagram of the second type of processor in the embodiments of this disclosure is shown below. Figure 4 As shown, the processing chip 220 also includes an internal memory 223, which is coupled to the cryptographic module 222, and the internal memory 223 stores the chip root key.

[0081] A chip root key is a hardware-generated, immutable, and protected key that is typically stored in a secure hardware area of ​​the device. The uniqueness and security of the root key form the cornerstone of the entire device's trust chain and are commonly used to protect the security of other keys, perform authentication, and ensure data integrity.

[0082] In some embodiments, each processing chip 220 has a built-in chip root key, and the root keys of different processing chips are different, which ensures the uniqueness of the chip root key.

[0083] The chip root key can be generated by physically unclonable functions (PUFs) or written into the processor's internal FUSE at the factory. The chip root key is only available inside the chip and is not exposed to the outside, thus ensuring security.

[0084] Accordingly, the cryptographic module 222 is also configured to generate a derived key based on the chip root key, the derived key being used to encrypt and decrypt data in the storage unit 230.

[0085] Specifically, when the cryptographic module 222 writes data to the storage unit 230, it uses the chip root key (or a key derived from the chip root key) to encrypt and protect the data's integrity; or, when reading data from the storage unit 230, it decrypts and verifies the data's integrity.

[0086] In this way, the data stored in storage unit 230 is always encrypted, which effectively enhances the security of the data in storage unit 230.

[0087] In some embodiments, data interaction between the storage cell 230 and the processing chip 220 is achieved through traces on the substrate 210.

[0088] Although the traces are manufactured according to design requirements, there are many uncontrollable details in actual production. For example, there may be slight differences in the precise length, local non-uniformity in the dielectric constant of the dielectric material, and variations in the number, shape, and process deviations of vias.

[0089] These differences will result in the following variations under high-frequency signals: differences in propagation delay, different echo shapes, and differences in rising / falling edge jitter, overshoot / undershoot.

[0090] In other words, differences in trace technology, length, and coupling can be measured and quantified as high-dimensional features.

[0091] Based on this, this application utilizes the process differences of the traces on the substrate 210 between the processing chip 220 and the memory cell 230 to construct a board-level PUF structure. By measuring the delay and waveform characteristics of the signal round-trip propagation, a unique and difficult-to-clone characteristic response is generated to further improve data security.

[0092] In other words, by making the processing chip 220, storage unit 230, and substrate 210 a unified entity, data encryption and decryption cannot be performed when any one of them is replaced. Only when the processing chip 220, storage unit 230, and substrate 210 are kept in their original combined state can they be correctly reconstructed, and only then can data encryption and decryption operations be performed.

[0093] More specifically, the substrate 210 has traces that couple the memory cell controller 221 and the memory cell 230.

[0094] Accordingly, see Figure 5 The diagram shown is a structural schematic of a storage unit controller in an embodiment of this disclosure. The storage unit controller 221 is provided with a Physically Unclonable Function Acquisition Unit 2211, which is used to obtain the PUF response based on the physical characteristics of the trace.

[0095] The physical characteristics of the trace include delay, phase, or signal reflection. The Physically Unclonable Function Acquisition Unit 2211 can acquire the PUF response based on the physical characteristics of the trace. Correspondingly, the PUF response can include: delay duration, phase value, or intensity of the reflected signal, wherein the reflected signal can be an echo signal obtained through the trace.

[0096] In this case, the cryptographic module 222 is further configured to: in the initial stage, receive a first PUF response obtained by the Physically Unclonable Function Acquisition Unit 2211, and generate a first key and auxiliary data corresponding to the first PUF response based on the first PUF response; in the working stage, receive a second PUF response obtained by the Physically Unclonable Function Acquisition Unit 2211, and reconstruct the first key based on the second PUF response and the auxiliary data; and generate the derived key through a key derivation function based on the reconstructed first key and the chip root key.

[0097] In some embodiments, the cryptographic module has a fuzzy extractor that can generate codeword information based on the first PUF response, and then obtain the first key based on the codeword information through preset error correction coding and hash operation.

[0098] Simultaneously, the cryptographic module can also perform operations (such as XOR or synthesis) on the first PUF response and codeword information to generate auxiliary data. This auxiliary data is used to correct errors in the PUF response in subsequent working stages without revealing the first key.

[0099] The auxiliary data may include: error correction information (i.e., error correction codes) and reference information (i.e., the original PUF response).

[0100] Specifically, the PUF response is affected by factors such as environmental noise, and the PUF response obtained from the first measurement usually contains some errors. Auxiliary data is usually generated using error-correcting codes (such as BCH codes, Reed-Solomon codes, and low-density parity-check codes) so that erroneous bits in the PUF response can be corrected subsequently.

[0101] For example, error-correcting codes can be used to transform a PUF response that is significantly affected by noise into a codeword that is closer to the real one (i.e., a standard key output).

[0102] The reference information is used for comparison with the second PUF response.

[0103] During the working phase, the cryptographic module 222 is able to receive the second PUF response measured based on the same path and can read auxiliary data.

[0104] In this way, the target value corresponding to the codeword information can be recovered based on the second PUF response and auxiliary data, and the target value is corrected for errors through error correction decoding to obtain the codeword information. Then, the first key is reconstructed based on the codeword information using the same hash operation as in the initial stage.

[0105] It should be noted that when the deviation between the second PUF response and the first PUF response does not exceed the predetermined error correction capability, the error correction decoding is successful and the first key can be reconstructed.

[0106] Then, based on the reconstructed first key and the chip root key, a derived key is generated through a key derivation function.

[0107] When the deviation between the second PUF response and the first PUF response exceeds the predetermined error correction capability, the error correction decoding fails, resulting in the inability to reconstruct the first key.

[0108] In short, if the hardware environment changes, the reconstruction of the derived key will fail, thus ensuring data security.

[0109] In some embodiments, the Physically Unclonable Function Acquisition Unit obtains the first PUF response and / or the second PUF response by transmitting a test signal on the trace and measuring the propagation characteristics of the test signal.

[0110] In one specific embodiment, the physical non-cloning function acquisition unit may include: An excitation generator is used to output a predefined sequence of test pulses or pseudo-random bit codes on the trace.

[0111] The sampling and measurement circuit is used to sample the echo signal propagating through the trace within a predetermined time window and generate measurement results.

[0112] A feature quantization circuit is used to quantize the measurement result into a first PUF response and / or a second PUF response.

[0113] The quantization process can be briefly summarized as follows: the measurement result is quantized into a binary value by using at least one comparator or time-to-digital converter (TDC). Based on threshold comparison, time measurement, or multi-point signal comparison methods, it is transformed into a stable and repeatable digital response.

[0114] Using the processor in the above example, on the one hand, by adding a storage unit to the substrate, an on-chip storage solution is provided for the cryptographic module built into the processor, which is not lost when power is off; on the other hand, by utilizing the physical characteristics of the wiring, a hard binding between the processing chip, the storage unit and the substrate is achieved, so that the encryption key of the data can only be reconstructed under the original hardware configuration, ensuring the security of the encrypted data.

[0115] See next Figure 4 The processor also includes a protective cover 240, which is disposed on the substrate 210 and forms an accommodating space. The processing chip 220 and the storage unit 230 are placed in the accommodating space. The protective cover 240 is used for signal isolation.

[0116] Specifically, by setting up a protective cover 240, the processing core 220 is located within the space formed by the protective cover 240 and the substrate 210, which reduces electromagnetic interference and improves the stability of the data encryption and decryption process.

[0117] In addition to providing heat dissipation, pollution prevention, and scratch protection, the protective cover 240 also provides physical protection for each processing chip 220 on the substrate and the signal connection between processing chips, eliminating physical exposure surfaces.

[0118] In some embodiments, the material of the protective cover is selected from one or more of the following: metallic materials, conductive coating materials, and ceramic and polymer composite materials.

[0119] In this embodiment, the protective cover is made of metal. Metal has good electrical conductivity and can effectively reflect and absorb electromagnetic waves.

[0120] Accordingly, this disclosure also provides a data processing method.

[0121] See Figure 6 , Figure 6 This is a flowchart of a data processing method according to an embodiment of the present disclosure. This data processing method can be applied to the processor described in any of the foregoing embodiments.

[0122] The processor includes a substrate, a processing chip, and a storage unit. The processing chip includes a storage unit controller and a cryptographic module. The cryptographic module interacts with the storage unit through the storage unit controller.

[0123] Accordingly, the data processing methods include: S601, in response to data processing instructions, controls the cryptographic module to interact with the storage unit via the storage unit controller.

[0124] In some embodiments, step S601 may satisfy one or more of the following: In response to the data processing instruction, encrypted data is read from the storage unit through the storage unit controller and decrypted through the cryptographic module; In response to the data processing instruction, the data written to the storage unit is encrypted by the cryptographic module through the storage unit controller.

[0125] This means that the encryption and decryption processes are performed inside the processor, avoiding the risk of keys being leaked or tampered with during transmission and improving the security of data interaction.

[0126] Furthermore, data does not need to be transferred between the processor and external hardware (such as external encryption modules and storage devices), reducing data transmission latency and improving response speed.

[0127] In some embodiments, the substrate has traces that couple the memory cell controller and the memory cell. Based on the process differences of the traces, a board-level PUF structure is constructed. By measuring the delay and waveform characteristics of the signal round-trip propagation, a unique and difficult-to-clone characteristic response is generated to further improve data security.

[0128] Accordingly, the storage unit controller is equipped with a Physically Unclonable Function (PUF) acquisition unit, and the data processing method further includes: in an initial stage, the cryptographic module receives a first PUF response obtained by the PUF acquisition unit, and generates a first key and auxiliary data corresponding to the first PUF response based on the first PUF response; in an operational stage, the cryptographic module receives a second PUF response obtained by the PUF acquisition unit, and reconstructs the first key based on the second PUF response and the auxiliary data; the cryptographic module generates the derived key through a key derivation function based on the reconstructed first key and the chip root key.

[0129] This disclosure also provides a computer device that includes the processor described in any of the foregoing embodiments.

[0130] In this embodiment of the disclosure, the computer device implements the data processing method provided in this embodiment by loading a program.

[0131] The computer device exists in various forms, including but not limited to: physical servers of cloud platforms, security authentication gateways, and database servers.

[0132] In some specific applications disclosed herein, the embedded cryptographic module in the central processing unit has been deployed on a large scale in key areas such as cloud computing platforms. In scenarios where the server central processing unit has an embedded cryptographic module, the embedded cryptographic module can be used as a cryptographic computing power base to replace the role of the cryptographic machine.

[0133] A security authentication gateway is a product that uses digital certificates to provide application systems with services such as user management, identity authentication, single sign-on, transmission encryption, and access control, enabling the provision of a multi-layered network security protection system. In one specific embodiment, the security authentication gateway may comply with the GM / T 0026 cryptographic industry standard, which specifies the requirements for security authentication gateway products.

[0134] Database servers can use a cryptographic module embedded in the central processing unit to encrypt and store the keys, ensuring that the keys are in ciphertext and preventing the keys from appearing in plaintext throughout the business system.

[0135] This disclosure also provides a computer device, including a processor and a memory, wherein the memory stores computer program instructions, and the processor invokes the computer program instructions stored in the memory to execute the data processing method as described in any of the foregoing embodiments.

[0136] See Figure 7 , Figure 7 This is a schematic diagram of the hardware structure of a computer device according to an embodiment of this disclosure.

[0137] Figure 7 The terminal shown includes a memory 701, a processor 702, and a communication interface 703. The processor 702 is coupled to the memory 701 and the communication interface 703. The memory 701 can be located inside or outside the terminal. The memory 701, processor 702, and communication interface 703 can be connected via a communication bus. The communication interface 703 is used to communicate with other devices or communication networks.

[0138] The communication interface 703 can be a transmitter. The memory 701 stores a computer program that can run on the processor 702. When the processor 702 runs the computer program, the communication interface 703 executes the steps in the data processing method provided in the above embodiments.

[0139] This disclosure also provides a computer-readable storage medium storing a computer program thereon. When the computer program is run by a computer, the above-described data processing method is executed. The storage medium may include read-only memory (ROM), random access memory (RAM), a magnetic disk, or an optical disk, etc. The storage medium may also include non-volatile memory or non-transitory memory, etc.

[0140] This disclosure also provides a computer program product, including a computer program / instructions that, when executed by a processor, implement the steps of the data processing method described above.

[0141] It should be understood that in the embodiments of this disclosure, the processor can be a central processing unit (CPU), or it can be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor can be a microprocessor or any conventional processor.

[0142] It should also be understood that the memory in the embodiments of this disclosure may be volatile memory or non-volatile memory, or may include both volatile and non-volatile memory. Non-volatile memory may be ROM, programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), or flash memory. Volatile memory may be random access memory (RAM), which is used as an external cache. By way of example, but not limitation, many forms of RAM are available, such as static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous linked dynamic random access memory (SLDRAM), and direct rambus RAM (DRRAM).

[0143] The above embodiments can be implemented, in whole or in part, by software, hardware, firmware, or any other combination thereof. When implemented using software, the above embodiments can be implemented, in whole or in part, as a computer program product. The computer program product includes one or more computer instructions or computer programs. When the computer instructions or computer program are loaded or executed on a computer, all or part of the processes or functions described in the embodiments of this disclosure are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer program can be stored in a computer-readable storage medium or transferred from one computer-readable storage medium to another; for example, the computer program can be transferred from one website, computer, server, or data center to another website, computer, server, or data center via wired or wireless means.

[0144] While this specification discloses the invention as described above, the invention is not limited thereto. Any person skilled in the art can make various modifications and alterations without departing from the spirit and scope of the invention; therefore, the scope of protection of this invention should be determined by the scope defined in the claims.

Claims

1. A processor, characterized in that, include: substrate; Processing cores are disposed on the substrate; A storage unit is disposed on the substrate on one side of the processing core; The processed core includes: A storage cell controller is coupled to the storage cell via the substrate; The cryptographic module, coupled to the storage unit controller, is configured to interact with the storage unit via the storage unit controller.

2. The processor according to claim 1, characterized in that, Meet one or more of the following: The processing core includes a central processing unit core; The substrate includes a central processing unit substrate; The storage unit includes non-volatile memory; The storage unit includes flash memory.

3. The processor according to claim 1, characterized in that, The substrate has a first side and a second side facing each other; The processing chip and the storage unit are disposed on the first side of the substrate, and the traces for connecting the processing chip and the storage unit pass through the substrate. The second side of the substrate is provided with pins, which are used to connect to the motherboard.

4. The processor according to claim 1, characterized in that, The cryptographic module satisfies one or more of the following: The cryptographic module responds to data processing instructions by reading encrypted data from the storage unit through the storage unit controller and performing decryption processing. In response to a data processing instruction, the cryptographic module writes encrypted data into the storage unit via the storage unit controller.

5. The processor according to claim 1, characterized in that, The cryptographic module has an interface, and the storage unit controller is connected to the cryptographic module through the interface.

6. The processor according to claim 1, characterized in that, The processed core also includes: An internal memory, coupled to the cryptographic module, stores the chip root key; The cryptographic module is also configured to generate a derived key based on the chip root key, the derived key being used to encrypt and decrypt data in the storage unit.

7. The processor according to claim 1, characterized in that, Also includes: A protective cover is disposed on the substrate and forms an accommodating space, in which the processing chip and the storage unit are placed, and the protective cover is used for signal isolation.

8. The processor according to claim 7, characterized in that, The material of the protective cover is selected from one or more of the following: Metallic materials; Conductive coating materials; Ceramic-polymer composites.

9. A data processing method, characterized in that, The data processing method, applied to the processor according to any one of claims 1 to 8, comprises: In response to data processing instructions, the cryptographic module interacts with the storage unit via the storage unit controller.

10. The data processing method according to claim 9, characterized in that, In response to data processing instructions, the storage unit controller controls the cryptographic module to interact with the storage unit, satisfying one or more of the following: In response to the data processing instruction, encrypted data is read from the storage unit through the storage unit controller and decrypted through the cryptographic module; In response to the data processing instruction, the data written to the storage unit is encrypted by the cryptographic module through the storage unit controller.

11. The data processing method according to claim 10, characterized in that, The processing chip further includes an internal memory coupled to the cryptographic module, and the internal memory stores the chip root key; The data processing method further includes: The cryptographic module generates a derived key based on the chip root key, and the derived key is used to encrypt and decrypt data in the storage unit.

12. A computer device, characterized in that, Includes the processor as described in any one of claims 1 to 8.

13. The computer device according to claim 12, characterized in that, Includes one or more of the following: The physical servers of the cloud platform; Security authentication gateway; Database server.

14. A computer device comprising a processor and a memory, characterized in that, The memory stores computer program instructions, and the processor invokes the computer program instructions stored in the memory to execute the data processing method as described in any one of claims 9 to 11.

15. A computer-readable storage medium, characterized in that, The storage medium stores computer program instructions, which, when executed by a processor, implement the data processing method as described in any one of claims 9 to 11.

16. A computer program product, characterized in that, The computer program product includes computer program instructions that, when executed by a processor, implement the data processing method as described in any one of claims 9 to 11.

Images