Data encryption and decryption methods, devices, electronic equipment, storage media and software products

Abstract

This application discloses a data encryption / decryption method, apparatus, electronic device, storage medium, and program product, relating to the field of data storage technology. The method is applied to a memory controller, which includes a hardware data encryption / decryption engine. The method includes receiving memory access requests and user-defined signals from multiple users; determining encryption / decryption identifiers for multiple users based on their user-defined signals; determining the current pending memory access request based on the user-sent memory access requests; determining the target encryption / decryption identifier for the current pending memory access request based on the user-defined identifiers; and processing the current pending memory access request based on the hardware data encryption / decryption engine if the target encryption / decryption identifier indicates that the current pending memory access request requires data encryption / decryption. This solves the technical problem of low efficiency in related technologies and achieves the technical effect of improving data encryption / decryption efficiency.

Description

Technical Field

[0001] This application relates to the field of data storage technology, and in particular to data encryption and decryption methods, apparatuses, electronic devices, storage media, and program products. Background Technology

[0002] In the information age, with the development of new technologies such as mobile payment, cloud computing, and the Internet of Things, data security has become a critical challenge. Memory, as a vital component of digital systems, is crucial for stable system operation and user data protection. Data encryption technology is an important means of ensuring data security. Currently, related technologies typically use independent encryption / decryption chips or dedicated encryption / decryption software, but this method is relatively inefficient. Summary of the Invention

[0003] This application provides data encryption / decryption methods, apparatuses, electronic devices, storage media, and program products to at least solve the problem of low efficiency in data encryption / decryption methods in related technologies.

[0004] This application provides a data encryption / decryption method applied to a memory controller, the memory controller including a hardware data encryption / decryption engine, comprising: Receive memory access requests from multiple users and custom signals from multiple users; Based on custom signals from multiple users, determine the encryption / decryption identifiers for multiple users; Based on memory access requests sent by multiple users, determine the current memory access requests to be processed; Based on the encryption and decryption identifiers of multiple users, determine the target encryption and decryption identifier of the current memory access request to be processed; If the target encryption / decryption identifier indicates that the current pending memory access request requires data encryption / decryption, then the current pending memory access request is processed based on the hardware data encryption / decryption engine.

[0005] This application also provides a data encryption / decryption device applied to a memory controller, the memory controller including a hardware data encryption / decryption engine, comprising: The receiving module is used to receive memory access requests and custom signals from multiple users. The first determining module is used to determine the encryption / decryption identifiers of multiple users based on custom signals from multiple users; The second determining module is used to determine the current memory access request to be processed based on the memory access requests sent by multiple users. The third determination module is used to determine the target encryption / decryption identifier of the current memory access request to be processed based on the encryption / decryption identifiers of multiple users. The processing module is used to process the current memory access request based on the hardware data encryption and decryption engine if the target encryption / decryption identifier indicates that the current memory access request needs to be encrypted or decrypted.

[0006] This application also provides an electronic device, including: a memory for storing a computer program; and a processor for implementing the steps of any of the above data encryption and decryption methods when executing the computer program.

[0007] This application also provides a computer-readable storage medium storing a computer program, wherein when the computer program is executed by a processor, it implements the steps of any of the above-described data encryption and decryption methods.

[0008] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the steps of any of the above-described data encryption and decryption methods.

[0009] This application provides a method applied to a memory controller, which includes a hardware data encryption / decryption engine. The method receives memory access requests and custom signals from multiple users; determines encryption / decryption identifiers for multiple users based on their custom signals; determines the current pending memory access request based on the user-sent requests; and determines the target encryption / decryption identifier for the current pending memory access request based on the user-sent encryption / decryption identifiers. If the target encryption / decryption identifier indicates that the current pending memory access request requires data encryption / decryption, the hardware data encryption / decryption engine processes the request. By integrating the hardware data encryption / decryption engine into the memory controller, both are integrated into a single chip. Furthermore, when a pending memory access request requires data encryption / decryption, the hardware data encryption / decryption engine is used for processing. Therefore, this method solves the technical problem of low efficiency associated with using separate encryption / decryption chips or dedicated encryption / decryption software in related technologies, thereby improving data encryption / decryption efficiency. Attached Figure Description

[0010] To more clearly illustrate the embodiments of this application, the accompanying drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0011] Figure 1 This is a schematic diagram of the structure of a data encryption / decryption system provided in an embodiment of this application; Figure 2 A flowchart illustrating a data encryption / decryption method provided in an embodiment of this application; Figure 3 A flowchart illustrating yet another data encryption / decryption method provided in an embodiment of this application; Figure 4 A flowchart illustrating another data encryption / decryption method provided in an embodiment of this application; Figure 5 This is a schematic diagram illustrating the process of handling memory write requests provided in an embodiment of this application; Figure 6 This is a schematic diagram illustrating the process of handling memory read requests provided in an embodiment of this application; Figure 7 This is a schematic diagram of the structure of a data encryption / decryption device provided in an embodiment of this application; Figure 8 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0012] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the protection scope of this application.

[0013] It should be noted that, in the description of this application, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. The terms "first," "second," etc., in this application are used to distinguish similar objects and are not used to describe a specific order or sequence.

[0014] To enable those skilled in the art to better understand the present application, the present application will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0015] In the information age, with the development of new technologies such as mobile payment, cloud computing, and the Internet of Things, data security faces more challenges. Memory, as a crucial component of digital systems, undertakes functions such as high-speed data transmission and caching. The data it processes includes critical information such as operating system kernel programs and user data; its security is fundamental to the stable operation of digital systems and to protecting users' important data from attacks, tampering, or even loss. Data encryption technology is a vital means of ensuring data security. By encrypting data, it prevents unauthorized access and tampering, thus avoiding irreparable losses for users.

[0016] In related technologies, data encryption and decryption are typically performed using independent encryption / decryption chips or dedicated encryption / decryption software. However, using independent encryption / decryption chips results in significant communication latency and performance degradation because the chip is not on the same chip as the memory, impacting data encryption / decryption efficiency and bandwidth. Using dedicated encryption / decryption software, compared to hardware encryption / decryption engines, also suffers from high performance degradation and low efficiency. In summary, the data encryption and decryption methods in these related technologies are generally inefficient.

[0017] Furthermore, independent encryption and decryption chips occupy additional printed circuit board (PCB) area, resulting in high costs when used in large-scale mass production.

[0018] The encryption algorithms used by independent encryption / decryption chips or dedicated encryption / decryption software can be divided into symmetric encryption algorithms and asymmetric encryption algorithms. Among them, the Advanced Encryption Standard (AES) algorithm is currently the most widely used symmetric encryption algorithm, with advantages such as high efficiency, high security, and good compatibility. Asymmetric encryption algorithms result in slower encryption and decryption speeds and are generally not used for data encryption in memory.

[0019] The encryption algorithms used in related technologies have the following drawbacks: 1. Static key risk: Relying on fixed keys or software-configured keys makes them vulnerable to brute-force attacks. Even with obfuscation (obfuscated key = f(fixed key)), the key reuse problem remains unresolved. 2. Lack of hierarchical data management: Encrypting all data leads to decreased energy efficiency. 3. Weak resistance to physical attacks: While address scrambling technology is used, the key is stored in on-chip memory, making it susceptible to side-channel probing (such as power consumption analysis).

[0020] To address the aforementioned problems, this application provides a data encryption / decryption method, apparatus, electronic device, storage medium, and program product. The method is applied to a memory controller, which includes a hardware data encryption / decryption engine. The method includes: receiving memory access requests from multiple users and custom signals from multiple users; determining encryption / decryption identifiers for multiple users based on their custom signals; determining a current pending memory access request based on the memory access requests from multiple users; determining a target encryption / decryption identifier for the current pending memory access request based on the encryption / decryption identifiers from multiple users; and processing the current pending memory access request based on the hardware data encryption / decryption engine if the target encryption / decryption identifier indicates that the current pending memory access request requires data encryption / decryption. The method provided above integrates the hardware data encryption / decryption engine into the memory controller, achieving integration of both into a single chip. Furthermore, when a current pending memory access request requires data encryption / decryption, the hardware data encryption / decryption engine is used for processing. Therefore, it solves the technical problem of low efficiency in related technologies using independent encryption / decryption chips or dedicated encryption / decryption software for data encryption / decryption, thereby improving data encryption / decryption efficiency.

[0021] The specific application environment architecture or specific hardware architecture on which the execution of the data encryption and decryption methods depends is described here.

[0022] The data encryption / decryption methods, apparatuses, electronic devices, storage media, and program products provided in this application are applicable to encrypting and decrypting data in memory. For example... Figure 1 The diagram shows the structure of the data encryption / decryption system upon which this application is based. This system includes a memory controller and memory. The memory controller is integrated into a System on Chip (SOC). This memory can be Dynamic Random Access Memory (DRAM) based on the Double Data Rate (DDR) standard. The memory controller includes a multi-channel parallel cache and arbitration module, a multiplexer (MUX), a first address scrambler, a hardware data encryption / decryption engine, and a controller core.

[0023] The multi-channel parallel caching and arbitration module supports memory access requests from multiple users. Multiple user terminals connect to the multi-channel parallel caching and arbitration module through a multi-channel user bus or a custom high-speed interface. Each user bus is equipped with an independent First-In, First-Out (FIFO) buffer to cache memory access requests transmitted from that user bus, along with the physical address and data carried in the requests. Specifically, when a memory access request is a write request, it carries the physical address to be written and the data to be written; when a memory access request is a read request, it carries the physical address to be read and no data. The user bus can be an Advanced eXtensible Interface 4 (AXI4) bus.

[0024] The multi-channel parallel caching and arbitration module is also used to receive out-of-band signals transmitted from multiple user buses or custom signals transmitted from custom high-speed interfaces. These out-of-band signals or custom signals contain encryption / decryption identifiers from multiple users. Based on these multiple user encryption / decryption identifiers, the encryption / decryption identifier of each user's memory access request is determined. The memory access request, its encryption / decryption identifier, the physical address carried by the memory access request, and the data are then cached together in the corresponding cache area. The out-of-band signal or custom signal can be AxUSER.

[0025] Multiple user terminals can access multiple parallel buffers and arbitration modules through a single user bus. Each user can configure their local registers to select whether data encryption / decryption is required or not, based on the importance of the transmitted data and the sensitivity to data latency. When transmitting out-of-band signals through the user bus, each user terminal can read its local registers to determine whether data encryption / decryption is required and write this selection to a preset valid bit in the out-of-band signal. For example, the preset valid bit can be bit 0, i.e., AxUSER[0]. The other bits of the AxUSER signal, excluding the preset valid bit, can be padded with 0.

[0026] It should be noted that when caching the memory access request, the encryption / decryption identifier of the memory access request, the physical address carried by the memory access request, and the data together into the corresponding cache area, the encryption / decryption identifier AxUSER[0] of the memory access request and the physical address AxADDR[31:0] carried by the memory access request can be concatenated into {AxUSER[0], AxADDR[31:0]} and then cached into the corresponding cache area.

[0027] The multi-path parallel caching and arbitration module is also used to arbitrate memory access requests sent by multiple users to determine which memory access requests can be authorized. In other words, it determines the currently pending memory access requests based on the memory access requests sent by multiple users.

[0028] The path selector is used to select the subsequent processing path based on the encryption / decryption identifier carried by the authorized memory access request. If the encryption / decryption identifier indicates that the current memory access request requires data encryption / decryption, then the current memory access request is sent to the hardware data encryption / decryption engine for processing.

[0029] If the encryption / decryption flag indicates that the current memory access request does not require data encryption / decryption, then, if the current memory access request is a write request, a first virtual address is generated based on the physical address to be written in the current memory access request using a first address scrambler; the controller core then writes the data to be written corresponding to the current memory access request into memory according to the first virtual address. If the current memory access request is a read request, a second virtual address is generated based on the physical address to be read in the current memory access request using a first address scrambler; the controller core then reads the first target data from memory based on the second virtual address; and returns the first target data to the target user terminal corresponding to the current memory access request.

[0030] The hardware data encryption / decryption engine is used to process currently pending memory access requests that require data encryption / decryption. See the detailed description below. It integrates a main encryption / decryption engine, an auxiliary encryption / decryption engine, a second address scrambler, a true random number generator, and a fusion module.

[0031] The controller core is used to generate access commands according to the memory protocol based on the received memory access address (i.e., virtual address) and data, and to complete data writing or reading. The controller core is connected to the physical layer (PHY) of the memory through an interface.

[0032] Understandably, the controller core performs flow control for writing raw data to memory when encryption is not required, writing ciphertext data to memory when encryption is required, and reading data from memory.

[0033] Embodiments of this application provide a data encryption / decryption method applied to the aforementioned memory controller. Figure 2 This is a flowchart illustrating the data encryption / decryption method provided in the embodiments of this application, as shown below. Figure 2 As shown, the data encryption / decryption method includes the following steps: Step S201: Receive memory access requests and custom signals from multiple users.

[0034] The custom signal can be the AxUSER signal. It receives memory access requests and AxUSER signals from multiple users through their respective client terminals. Memory access requests include memory write requests and memory read requests.

[0035] Step S202: Determine the encryption / decryption identifiers of multiple users based on their custom signals.

[0036] Step S203: Based on the memory access requests sent by multiple users, determine the current memory access requests to be processed.

[0037] Step S204: Determine the target encryption / decryption identifier for the current pending memory access request based on the encryption / decryption identifiers of multiple users.

[0038] Specifically, based on the encryption / decryption identifiers of multiple users, the encryption / decryption identifiers of memory access requests sent by multiple users are determined. For any given user, if the user's encryption / decryption identifier indicates that the memory access request sent by that user requires data encryption / decryption, then the encryption / decryption identifier of the memory access request sent by that user indicates that data encryption / decryption is required. If the user's encryption / decryption identifier indicates that the memory access request sent by that user does not require data encryption / decryption, then the encryption / decryption identifier of the memory access request sent by that user indicates that data encryption / decryption is not required.

[0039] Step S205: If the target encryption / decryption identifier indicates that the current pending memory access request needs to be encrypted / decrypted, then the current pending memory access request is processed based on the hardware data encryption / decryption engine.

[0040] Understandably, when the current pending memory access request is a write request, the data to be written corresponding to the current pending memory access request is encrypted using the hardware data encryption / decryption engine. When the current pending memory access request is a read request, the data read from memory is decrypted using the hardware data encryption / decryption engine.

[0041] The data encryption and decryption method provided in this application integrates the hardware data encryption and decryption engine into the memory controller, realizing the integration of the two into the same chip. When the current memory access request to be processed requires data encryption and decryption, the hardware data encryption and decryption engine is used for processing. Therefore, it can solve the technical problem of low efficiency in the related technology of using independent encryption and decryption chips or dedicated encryption and decryption software for data encryption and decryption, and achieve the technical effect of improving the efficiency of data encryption and decryption.

[0042] By using encryption / decryption identifiers from multiple users, the target encryption / decryption identifier for the current pending memory access request is determined, thereby determining whether the current pending memory access request needs data encryption / decryption. This achieves hierarchical data management and improves encryption / decryption efficiency.

[0043] An embodiment of this application provides a data encryption / decryption method applied to the aforementioned memory controller. Figure 3 This is a flowchart illustrating the data encryption / decryption method provided in the embodiments of this application, as shown below. Figure 3 As shown, the data encryption / decryption method includes the following steps: Step S301: Receive memory access requests from multiple users and custom signals from multiple users. See details below. Figure 2 Step S201 of the illustrated embodiment will not be described again here.

[0044] Step S302: Determine the encryption / decryption identifiers of multiple users based on the custom signals of multiple users.

[0045] Specifically, step S302 includes: Step S3021: For any user, determine the value of the target bit of the user's custom signal based on the user's custom signal.

[0046] For example, the target bit can be bit 0.

[0047] Step S3022: When the value of the target bit of the user's custom signal is the first value, determine that the user's encryption / decryption identifier indicates that the memory access request sent by the user needs to be encrypted / decrypted.

[0048] Step S3023: When the target bit of the user's custom signal has a second value, determine that the user's encryption / decryption identifier indicates that the memory access request sent by the user does not require data encryption / decryption.

[0049] For example, when AxUSER[0]=1'b0, it is determined that the user's encryption / decryption identifier indicates that the memory access request sent by the user does not require data encryption / decryption. When AxUSER[0]=1'b1, it is determined that the user's encryption / decryption identifier indicates that the memory access request sent by the user requires data encryption / decryption.

[0050] Step S303: Based on the memory access requests sent by multiple users, determine the current memory access requests to be processed.

[0051] Specifically, step S303 includes: Step S3031: Obtain the request processing priority of multiple users.

[0052] This involves pre-setting request processing priorities for multiple users.

[0053] Step S3032: Based on the request processing priorities of multiple users and the memory access requests sent by multiple users, determine the current memory access request to be processed.

[0054] Specifically, the memory access request to be processed is determined from multiple memory access requests sent by users in descending order of request processing priority.

[0055] Step S304: Based on the encryption / decryption identifiers of multiple users, determine the target encryption / decryption identifier for the current memory access request to be processed. For details, please refer to [link to relevant documentation]. Figure 2 Step S204 of the illustrated embodiment will not be described again here.

[0056] Step S305: If the target encryption / decryption identifier indicates that the current memory access request needs data encryption / decryption, then the current memory access request is processed based on the hardware data encryption / decryption engine. The hardware data encryption / decryption engine includes a main encryption / decryption engine, an auxiliary encryption / decryption engine, and a fusion module.

[0057] Specifically, step S305 includes: Step S3051: If the current memory access request to be processed is a memory write request, obtain the first target key corresponding to the current memory access request to be processed based on the main encryption and decryption engine; and generate basic ciphertext based on the first target key and the data to be written corresponding to the current memory access request to be processed using a symmetric encryption algorithm.

[0058] Among them, the symmetric encryption algorithm can be the AES-128 symmetric encryption algorithm.

[0059] Specifically, Cipher_AES1 = AES(Data1, Key1), where Cipher_AES1 is the basic ciphertext, Data1 is the data to be written, i.e., plaintext, and Key1 is the first target key.

[0060] Step S3052: Based on the auxiliary encryption / decryption engine, using a block cipher algorithm, and based on the first target key and the physical address to be written for the current pending memory access request, generate the first ciphertext adjustment amount.

[0061] The block cipher algorithm can be QARMA-128, a lightweight adjustable block cipher algorithm. The QARMA algorithm takes the physical address to be written and the first target key as input (e.g., the lower 12 bits of the physical address [11:0]), and generates an adjustment amount bound to the physical address, i.e., the first ciphertext adjustment amount. Specifically: Adjust1 = QARMA(Key1, physical address [11:0]), where Adjust1 is the first ciphertext adjustment amount and Key1 is the first target key.

[0062] Step S3053: Using the fusion module, the first target ciphertext is generated based on the adjustment amount of the base ciphertext and the first ciphertext.

[0063] The hardware data encryption and decryption engine adopts a dual-engine approach, combining a main encryption and decryption engine and an auxiliary encryption and decryption engine to collaboratively construct a two-layer encryption.

[0064] It should be noted that when the current pending memory access request is a memory write request, the steps of the main encryption / decryption engine ("obtaining the first target key corresponding to the current pending memory access request; generating basic ciphertext based on the first target key and the data to be written corresponding to the current pending memory access request using a symmetric encryption algorithm") and the steps of the auxiliary encryption / decryption engine ("generating the first ciphertext adjustment amount based on the first target key and the physical address to be written in the current pending memory access request using a block cipher algorithm") can be executed in parallel, effectively reducing encryption latency. For example, this reduces encryption latency by 40%.

[0065] Step S3054: Write the first target ciphertext into memory.

[0066] The data encryption and decryption method provided in this application directly assigns encryption and decryption identifiers to each independent memory access request from each user in real time at the hardware level, realizing hierarchical management of memory access requests and encrypting only the data that needs to be protected, thereby maximizing system performance while ensuring security.

[0067] By pre-setting differentiated request processing priorities for different users, the system can quickly select the request to be processed based on clear priority rules when faced with concurrent memory access conflicts. This ensures that memory accesses of high real-time tasks or critical security components receive priority responses, thereby optimizing the overall system's service quality and reducing latency jitter for high-priority tasks.

[0068] Through a collaborative encryption mechanism of "master-slave-fusion," an enhanced data protection layer resistant to differential attacks is constructed based on a single dynamic key. The master encryption / decryption engine uses a dynamically generated first target key to perform high-strength encryption on plaintext data, generating basic ciphertext and ensuring the core confidentiality of the data. The slave encryption / decryption engine uses the same key and combines it with a specific physical address to be written to generate a first ciphertext adjustment value. Finally, the fusion module combines the basic ciphertext with this adjustment value to generate the final first target ciphertext written into memory. This improves data security.

[0069] In some optional implementations, the above data encryption and decryption methods further include: Step a1: If the target encryption / decryption identifier indicates that the current memory access request to be processed does not require data encryption / decryption, then if the current memory access request to be processed is a memory write request, a first virtual address is generated based on the physical address to be written in the current memory access request through a first address scrambler.

[0070] The virtual address is obtained from the physical address through an address scrambler, achieving a one-to-one correspondence between the physical address and the virtual address. The first address scrambler and the second address scrambler described below are implemented in hardware, directly generating scrambling codes, i.e., virtual addresses, based on the physical address.

[0071] An address scrambler maps physical addresses to virtual addresses to block address bus sniffing. Its core function is to disrupt the transmission path of physical addresses in real time, preventing attackers from stealing address signals from the bus and reconstructing valid information. An address scrambler includes a first address scrambler and a second address scrambler.

[0072] Step a2: Based on the first virtual address, write the data to be written corresponding to the current pending memory access request into memory.

[0073] In some optional implementations, the above data encryption and decryption methods further include: Step b1: If the target encryption / decryption identifier indicates that the current memory access request does not require data encryption / decryption, then if the current memory access request is a memory read request, a second virtual address is generated based on the physical address to be read in the current memory access request through the first address scrambler.

[0074] Step b2: Read the first target data from memory based on the second virtual address.

[0075] Step b3: Return the first target data to the target user terminal corresponding to the current pending memory access request.

[0076] The first target data is returned to the target user terminal corresponding to the current pending memory access request via the AXI bus.

[0077] In some optional implementations, step S3051 above includes: Step c1: If the current memory access request to be processed is a memory write request, based on the main encryption and decryption engine, a third virtual address is generated through the second address scrambler according to the physical address to be written in the current memory access request.

[0078] Step c2: Generate the first target random number using a true random number generator.

[0079] True random number generators produce random numbers with dynamic randomness and anti-predictability, ensuring that different keys are generated each time the same physical address is accessed. A true random number generator is a device that generates unpredictable random numbers based on physical processes (such as quantum effects and circuit noise), fundamentally different from algorithm-dependent pseudo-random number generators (PRNGs). Its core value lies in its unpredictability and high entropy, and it is widely used in cryptography, secure communication, industrial control, and other fields.

[0080] Step c3: Obtain the target chip identifier of the chip where the memory controller is located.

[0081] The chip containing the memory controller is the same as the SoC chip containing the memory controller. The target chip identifier is a unique device identifier PUF_ID generated based on the Physical Unclonable Function (PUF). Each SoC chip has a unique PUF_ID, which is unclonable, unique, and dynamic, requiring no static storage and avoiding the risk of key leakage.

[0082] Step c4: Based on the third virtual address, the first target random number, and the target chip identifier, generate the first target key corresponding to the current memory access request to be processed.

[0083] The data encryption and decryption method provided in this application ensures the uniqueness, timeliness, and unpredictability of the key through three dynamic elements: First, a "second address scrambler" is used to convert the original "physical address to be written" into a "third virtual address" in real time, binding the key to a "fake address" on the bus and effectively blocking address bus sniffing attacks; Second, a "first target random number" generated by a "true random number generator" is introduced to ensure that even if the same physical address is repeatedly written, the key used each time is completely different, fundamentally solving the risk of key staticization and reuse; Finally, based on the chip's unique physical unclonable identifier (PUF_ID), the key is strongly bound to a specific hardware entity to prevent the key from being cloned or ported to other devices.

[0084] In some alternative implementations, step c4 above includes: Step c41: Based on the first formula, generate the first target key corresponding to the current pending memory access request; the first formula is: Key1 = SM3(PUF_ID ⊕ (Third Virtual Address ⊕ First Target Random Number)) Here, Key1 is the first target key; SM3 is the cryptographic hash algorithm; and PUF_ID is the target chip identifier. It can be understood that ⊕ represents the XOR operation. SM3 is the Commercial Cryptographic Algorithm No. 3.

[0085] In some optional implementations, step S3054 above includes: Step d1: Based on the third virtual address, write the first target ciphertext and the first target random number into memory.

[0086] The data encryption and decryption method provided in this application stores the encrypted data and the dynamic elements (random numbers) necessary for decryption in a unified manner, thereby achieving "integrity and reversibility of encrypted storage".

[0087] In some optional implementations, step S3053 above includes: Step e1: Based on the second formula, generate the first target ciphertext; the second formula is: Final_Cipher1= Cipher_AES1⊕Adjust1 In this context, Final_Cipher1 is the first target ciphertext, Cipher_AES1 is the base ciphertext, and Adjust1 is the adjustment amount for the first ciphertext.

[0088] The final ciphertext, i.e., the first target ciphertext, is obtained by bitwise XORing the calculation results of the main encryption / decryption engine and the calculation results of the auxiliary encryption / decryption engine.

[0089] In some optional implementations, the hardware data encryption / decryption engine includes a main encryption / decryption engine, a secondary encryption / decryption engine, and a fusion module. Step S305 above includes: Step f1: If the current memory access request to be processed is a memory read request, obtain the second target ciphertext and the second target random number corresponding to the current memory access request to be processed based on the auxiliary encryption and decryption engine; generate the second ciphertext adjustment amount based on the second target random number.

[0090] Step f2: Based on the fusion module, an intermediate decryption result is generated according to the adjustment amount of the second ciphertext and the second target ciphertext.

[0091] Step f3: Based on the main encryption / decryption engine and the intermediate decryption results, determine the second target data corresponding to the current memory access request to be processed.

[0092] Step f4: Return the second target data to the target user terminal corresponding to the current pending memory access request.

[0093] The data encryption and decryption method provided in this application firstly involves an auxiliary encryption / decryption engine using a second target random number read from memory and stored along with the ciphertext to regenerate the same second ciphertext adjustment amount as during encryption, providing elements for reverse obfuscation in the subsequent fusion module. Next, the fusion module uses this adjustment amount to perform an inverse operation on the second target ciphertext read from memory, stripping away the address-related obfuscation layer and restoring the intermediate decryption result (i.e., the basic ciphertext generated by the main encryption / decryption engine). Finally, the main encryption / decryption engine uses the dynamically regenerated same key (based on the same PUF_ID, physical address, and stored random number) to execute the core symmetric decryption algorithm on the intermediate result, ultimately recovering the original plaintext data (second target data) and returning it to the requesting user. This process ensures a perfect closed loop for the dynamic key system on the decryption side, guaranteeing data confidentiality while achieving low-latency data reading through hardware-pipelined inverse operations. This makes the high-strength memory encryption completely transparent to the application, balancing security and access performance.

[0094] In some optional implementations, step f1 above includes: Step f11: If the current pending memory access request is a memory read request, based on the auxiliary encryption / decryption engine, a fourth virtual address is generated by the second address scrambler according to the physical address to be read in the current pending memory access request; based on the fourth virtual address, the second target ciphertext and the second target random number corresponding to the current pending memory access request are obtained from memory.

[0095] The data encryption and decryption method provided in this application embodiment ensures that encryption and decryption strictly correspond in the address space, which is the basis for secure and accurate data restoration.

[0096] In some optional implementations, step f1 above includes: Step g1: Obtain the target chip identifier of the chip where the memory controller is located.

[0097] Step g2: Based on the fourth virtual address, the second target random number, and the target chip identifier, generate the second target key corresponding to the current pending memory access request.

[0098] The method for generating the second target key is similar to that for generating the first target key, and will not be repeated here.

[0099] Step g3: Using a block cipher algorithm, a second ciphertext adjustment is generated based on the second target key and the physical address to be read in the current pending memory access request.

[0100] Specifically, Adjust2 = QARMA(Key2, physical address [11:0]), where Adjust2 is the second ciphertext adjustment amount and Key2 is the second target key.

[0101] The data encryption / decryption method provided in this application first obtains the chip's unique physical identifier (PUF_ID) as the "target chip identifier," ensuring that the key is bound to specific hardware and preventing key portability. Then, combining the correct "second target random number" read from memory and the "fourth virtual address" regenerated by the address scrambler, a "second target key" identical to the one used during encryption is dynamically regenerated using a cryptographic hash algorithm. Finally, using this key and the original "physical address to be read," a "second ciphertext adjustment" is regenerated using a block cipher algorithm. It perfectly replicates all the elements and environment of key and adjustment generation during encryption. Only a requester who knows the correct physical address, possesses a legitimate PUF_ID chip, and can read the correct random number from the corresponding storage location can generate the correct key and adjustment, thus successfully decrypting the data. This effectively resists replay attacks, key guessing, and physical cloning, and is a key step in achieving the goals of "resistant to differential attacks" and "resistant to physical attacks." While providing the highest level of security, all of this is performed in real-time by hardware, ensuring low latency and high performance in decryption.

[0102] In some alternative implementations, step f3 above includes: Step f31: Based on the main encryption / decryption engine, determine the second target data corresponding to the current pending memory access request according to the intermediate decryption result and the second target key.

[0103] In some optional implementations, step f31 above includes: Step f311: Generate the second target data using the third formula; the third formula is: Data=AES - ¹(Cipher_AES2, Key2) Where Data represents the second target data; Cipher_AES2 represents the intermediate decryption result; Key2 represents the second target key; and AES represents the second target key. - ¹ is the decryption function for the symmetric encryption algorithm.

[0104] In some alternative implementations, step f2 above includes: The intermediate decryption result is generated using the fourth formula; the fourth formula is: Cipher_AES2=Final_Cipher2⊕Adjust2 Cipher_AES2 is the intermediate decryption result; Final_Cipher2 is the second target ciphertext; Adjust2 is the adjustment amount of the second ciphertext.

[0105] The embodiments of this application provide a data encryption and decryption method. Figure 4This is a flowchart illustrating the data encryption / decryption method provided in the embodiments of this application, as shown below. Figure 4 As shown, the data encryption / decryption method includes the following steps: The first step is for each user to select whether data encryption or decryption is required through register configuration.

[0106] The second step involves each user initiating a memory access request, accompanied by encryption / decryption identifiers.

[0107] The third step is for the memory controller to cache memory access requests initiated by each user and determine the current memory access requests to be processed.

[0108] Fourth, MUX selects the subsequent processing path based on the target encryption / decryption identifier corresponding to the current pending memory access request.

[0109] Fifth, when the target encryption / decryption flag indicates that the current memory access request requires data encryption / decryption, the hardware data encryption / decryption engine converts the data to be written into ciphertext, or converts the ciphertext to be read into plaintext. The controller core then completes the memory read / write operation, that is, writing the ciphertext into memory or reading the ciphertext to be read from memory.

[0110] When the target encryption / decryption identifier indicates that the current memory access request does not require data encryption / decryption, the controller core completes memory read / write, that is, writes the data to be written to memory or reads the data to be read from memory.

[0111] Figure 5 The flowchart illustrating the processing of memory write requests provided in this application embodiment is as follows: Figure 5 As shown, the process includes: Determine whether a memory write request requires data encryption or decryption.

[0112] If a memory write request requires data encryption / decryption, the target chip identifier, random number, and virtual address are obtained, and the target key is calculated. The base ciphertext and ciphertext adjustment are calculated in parallel. The target ciphertext is then calculated. Finally, the target ciphertext and the random number are written to memory.

[0113] If a memory write request does not require data encryption or decryption, the data to be written will be written to memory.

[0114] For details, please refer to the corresponding description above, which will not be repeated here.

[0115] Figure 6 This is a flowchart illustrating the process of handling memory read requests provided in an embodiment of this application, such as... Figure 6 As shown, the process includes: Determine whether a memory read request requires data encryption or decryption.

[0116] If a memory read request requires data encryption / decryption, the following steps are performed: Obtain the target chip identifier, random number, and virtual address; calculate the target key; calculate the ciphertext adjustment; calculate the base ciphertext; decrypt the original data; and return the original data to the corresponding user terminal.

[0117] If the memory read request does not require data encryption or decryption, the data to be read is directly returned to the corresponding user client.

[0118] For details, please refer to the corresponding description above, which will not be repeated here.

[0119] The data encryption / decryption method provided in this application integrates a hardware data encryption / decryption engine with a memory controller into a single SOC, making it particularly suitable for performance-sensitive mass-produced devices (cloud servers / mobile devices, etc.). It employs a physical address-driven dynamic key and a dual-encryption / decryption engine architecture to resist differential attacks. Through hardware-level identification and parallel computing, it achieves automatic identification of sensitive data, reducing resource consumption and computational latency, and improving data encryption / decryption processing speed.

[0120] The data encryption and decryption methods provided in this application can be applied to related fields such as SOC design, IP design, and FPGA design. The technical concept and design architecture of this application have practical significance for data protection of mass-produced chips.

[0121] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods according to the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method.

[0122] Embodiments of this application also provide a data encryption / decryption device applied to a memory controller, such as... Figure 7 As shown, the data encryption / decryption device includes: The receiving module 701 is used to receive memory access requests and custom signals sent by multiple users.

[0123] The first determining module 702 is used to determine the encryption / decryption identifiers of multiple users based on custom signals from multiple users.

[0124] The second determining module 703 is used to determine the current memory access request to be processed based on the memory access requests sent by multiple users.

[0125] The third determining module 704 is used to determine the target encryption / decryption identifier of the current pending memory access request based on the encryption / decryption identifiers of multiple users.

[0126] The processing module 705 is used to process the current memory access request based on the hardware data encryption and decryption engine if the target encryption and decryption identifier indicates that the current memory access request needs to be encrypted and decrypted.

[0127] In some optional implementations, the above-mentioned data encryption / decryption apparatus further includes: The first generation module is used to generate a first virtual address based on the physical address to be written in the current memory access request if the target encryption / decryption identifier indicates that the current memory access request does not require data encryption / decryption, and if the current memory access request is a memory write request.

[0128] The write module is used to write the data to be written corresponding to the current pending memory access request into memory based on the first virtual address.

[0129] In some optional implementations, the above-mentioned data encryption / decryption apparatus further includes: The second generation module is used to generate a second virtual address based on the physical address to be read in the current memory access request if the target encryption / decryption identifier indicates that the current memory access request does not require data encryption / decryption, and if the current memory access request is a memory read request. This is done through a first address scrambler.

[0130] The read module is used to read the first target data from memory based on the second virtual address.

[0131] The return module is used to return the first target data to the target user terminal corresponding to the current pending memory access request.

[0132] In some alternative implementations, the processing module 705 includes: The first generation unit is used to obtain the first target key corresponding to the current memory access request based on the main encryption and decryption engine when the current memory access request to be processed is a memory write request; and to generate basic ciphertext based on the first target key and the data to be written corresponding to the current memory access request using a symmetric encryption algorithm.

[0133] The second generation unit is used to generate the first ciphertext adjustment amount based on the auxiliary encryption / decryption engine, using a block cipher algorithm, and based on the first target key and the physical address to be written for the current pending memory access request.

[0134] The third generation unit is used to generate the first target ciphertext by utilizing the fusion module and adjusting the base ciphertext and the first ciphertext.

[0135] The write unit is used to write the first target ciphertext into memory.

[0136] In some optional implementations, the first generating unit includes: The fourth generation unit is used to generate a third virtual address based on the main encryption / decryption engine and the physical address to be written in the current memory access request, using a second address scrambler, when the current memory access request to be processed is a memory write request.

[0137] The fifth generation unit is used to generate the first target random number through a true random number generator.

[0138] The first acquisition unit is used to acquire the target chip identifier of the chip where the memory controller is located.

[0139] The sixth generation unit is used to generate the first target key corresponding to the current memory access request to be processed, based on the third virtual address, the first target random number and the target chip identifier.

[0140] In some optional implementations, the sixth generation unit includes: The sixth generation subunit is used to generate the first target key corresponding to the current memory access request to be processed, based on the first formula; the first formula is: Key1 = SM3(PUF_ID ⊕ (Third Virtual Address ⊕ First Target Random Number)) Wherein, Key1 is the first target key; SM3 is the cryptographic hash algorithm; and PUF_ID is the target chip identifier.

[0141] In some alternative implementations, the writing unit includes: Write sub-unit, used to write the first target ciphertext and the first target random number into memory based on the third virtual address.

[0142] In some optional implementations, the third generation unit includes: The third generation subunit is used to generate the first target ciphertext based on the second formula; the second formula is: Final_Cipher1= Cipher_AES1⊕Adjust1 In this context, Final_Cipher1 is the first target ciphertext, Cipher_AES1 is the base ciphertext, and Adjust1 is the adjustment amount for the first ciphertext.

[0143] In some alternative implementations, the processing module 705 includes: The seventh generation unit is used to obtain the second target ciphertext and the second target random number corresponding to the current memory access request when the current memory access request to be processed is a memory read request, based on the auxiliary encryption and decryption engine; and to generate the second ciphertext adjustment amount based on the second target random number.

[0144] The eighth generation unit is used to generate intermediate decryption results based on the fusion module, according to the second ciphertext adjustment amount and the second target ciphertext.

[0145] The first determining unit is used to determine the second target data corresponding to the current memory access request to be processed, based on the main encryption / decryption engine and the intermediate decryption results.

[0146] The return unit is used to return the second target data to the target user terminal corresponding to the current pending memory access request.

[0147] In some optional implementations, the seventh generation unit includes: The ninth generation unit is used to generate a fourth virtual address based on the physical address to be read in the current memory access request, using the auxiliary encryption and decryption engine and the second address scrambler, when the current memory access request to be processed is a memory read request; and to obtain the second target ciphertext and the second target random number corresponding to the current memory access request to be processed from memory based on the fourth virtual address.

[0148] In some optional implementations, the seventh generation unit includes: The second acquisition unit is used to acquire the target chip identifier of the chip where the memory controller is located.

[0149] The tenth generation unit is used to generate the second target key corresponding to the current memory access request to be processed, based on the fourth virtual address, the second target random number and the target chip identifier.

[0150] The eleventh generation unit is used to generate a second ciphertext adjustment based on the second target key and the physical address to be read in the current pending memory access request using a block cipher algorithm.

[0151] In some optional implementations, the first determining unit includes: The first determining subunit is used to determine the second target data corresponding to the current memory access request to be processed, based on the main encryption / decryption engine, the intermediate decryption result, and the second target key.

[0152] In some alternative implementations, the first determining subunit includes: The twelfth generation unit is used to generate the second target data using the third formula; the third formula is: Data=AES - ¹(Cipher_AES2, Key2) Where Data represents the second target data; Cipher_AES2 represents the intermediate decryption result; Key2 represents the second target key; and AES represents the second target key. - ¹ is the decryption function for the symmetric encryption algorithm.

[0153] In some optional implementations, the eighth generation unit includes: The eighth generation subunit is used to generate intermediate decryption results using the fourth formula; the fourth formula is: Cipher_AES2=Final_Cipher2⊕Adjust2 Cipher_AES2 is the intermediate decryption result; Final_Cipher2 is the second target ciphertext; Adjust2 is the adjustment amount of the second ciphertext.

[0154] In some alternative implementations, the first determining module 702 includes: The second determining unit is used to determine the value of the target bit of the user's custom signal based on the user's custom signal for any given user.

[0155] The third determining unit is used to determine, when the value of the target bit of the user's custom signal is the first value, that the user's encryption / decryption identifier indicates that the memory access request sent by the user needs to be encrypted / decrypted.

[0156] The fourth determining unit is used to determine, when the value of the target bit of the user's custom signal is the second value, that the user's encryption / decryption identifier indicates that the memory access request sent by the user does not require data encryption / decryption.

[0157] In some alternative implementations, the second determining module 703 includes: The third acquisition unit is used to acquire the request processing priority of multiple users.

[0158] The fifth determining unit is used to determine the current memory access request to be processed based on the request processing priorities of multiple users and the memory access requests sent by multiple users.

[0159] For a description of the features in the embodiments corresponding to the data encryption / decryption device, please refer to the relevant descriptions in the embodiments corresponding to the data encryption / decryption method, which will not be repeated here.

[0160] Embodiments of this application also provide an electronic device, such as... Figure 8 As shown, it includes a processor 801 and a memory 802, in which a computer program is stored. The processor 801 is configured to run the computer program to perform the steps in any of the above-described data encryption / decryption method embodiments.

[0161] Embodiments of this application also provide a computer-readable storage medium storing a computer program, wherein the computer program is configured to execute the steps in any of the above-described data encryption / decryption method embodiments at runtime.

[0162] In one exemplary embodiment, the aforementioned computer-readable storage medium may include, but is not limited to, various media capable of storing computer programs, such as a USB flash drive, read-only memory (ROM), random access memory (RAM), portable hard disk, magnetic disk, or optical disk.

[0163] Embodiments of this application also provide a computer program product, which includes a computer program that, when executed by a processor, implements the steps in any of the above-described data encryption / decryption method embodiments.

[0164] Embodiments of this application also provide another computer program product, including a non-volatile computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps in any of the above-described data encryption / decryption method embodiments.

[0165] Those skilled in the art will further recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0166] The foregoing has provided a detailed description of a data encryption / decryption method, apparatus, electronic device, storage medium, and program product provided in this application. Specific examples have been used to illustrate the principles and implementation methods of this application. The descriptions of the embodiments above are only intended to aid in understanding the method and core ideas of this application. It should be noted that those skilled in the art can make various improvements and modifications to this application without departing from its principles, and these improvements and modifications also fall within the protection scope of the claims of this application.

Claims

1. A data encryption and decryption method, characterized by, Applied to a memory controller, the memory controller including a hardware data encryption / decryption engine, comprising: Receive memory access requests from multiple users and custom signals from multiple users; Based on the custom signals of the multiple users, the encryption / decryption identifiers of the multiple users are determined; Based on the memory access requests sent by the multiple users, determine the current memory access requests to be processed; Based on the encryption / decryption identifiers of the multiple users, determine the target encryption / decryption identifier of the current memory access request to be processed. If the target encryption / decryption identifier indicates that the current pending memory access request requires data encryption / decryption, then the current pending memory access request is processed based on the hardware data encryption / decryption engine.

2. The method according to claim 1, characterized in that, The method further includes: If the target encryption / decryption identifier indicates that the current memory access request to be processed does not require data encryption / decryption, then in the case that the current memory access request to be processed is a memory write request, a first virtual address is generated based on the physical address to be written of the current memory access request to be processed through a first address scrambler. Based on the first virtual address, the data to be written corresponding to the current pending memory access request is written into memory.

3. The method according to claim 1, characterized in that, The method further includes: If the target encryption / decryption identifier indicates that the current memory access request to be processed does not require data encryption / decryption, then in the case that the current memory access request to be processed is a memory read request, a second virtual address is generated based on the physical address to be read in the current memory access request to be processed through a first address scrambler. Based on the second virtual address, read the first target data from memory; The first target data is returned to the target user terminal corresponding to the current pending memory access request.

4. The method according to claim 1, characterized in that, The hardware data encryption / decryption engine includes a main encryption / decryption engine, an auxiliary encryption / decryption engine, and a fusion module. The processing of the current pending memory access request based on the hardware data encryption / decryption engine includes: If the current pending memory access request is a memory write request, the first target key corresponding to the current pending memory access request is obtained based on the main encryption and decryption engine; and a basic ciphertext is generated based on the first target key and the data to be written corresponding to the current pending memory access request using a symmetric encryption algorithm. Based on the auxiliary encryption / decryption engine, using a block cipher algorithm, a first ciphertext adjustment amount is generated based on the first target key and the physical address to be written for the current pending memory access request; Using the fusion module, a first target ciphertext is generated based on the base ciphertext and the adjustment amount of the first ciphertext; Write the first target ciphertext into memory.

5. The method according to claim 4, characterized in that, When the current pending memory access request is a memory write request, obtaining the first target key corresponding to the current pending memory access request based on the main encryption / decryption engine includes: If the current pending memory access request is a memory write request, based on the main encryption / decryption engine, a third virtual address is generated by the second address scrambler according to the physical address to be written in the current pending memory access request. Generate the first target random number using a true random number generator; Obtain the target chip identifier of the chip where the memory controller is located; Based on the third virtual address, the first target random number, and the target chip identifier, a first target key corresponding to the current pending memory access request is generated.

6. The method according to claim 5, characterized in that, The step of generating the first target key corresponding to the current memory access request to be processed based on the third virtual address, the first target random number, and the target chip identifier includes: Based on the first formula, a first target key corresponding to the current pending memory access request is generated; the first formula is: Key1 = SM3(PUF_ID ⊕ (Third Virtual Address ⊕ First Target Random Number)) Wherein, Key1 is the first target key; SM3 is the cryptographic hash algorithm; and PUF_ID is the target chip identifier.

7. The method according to claim 5, characterized in that, The step of writing the first target ciphertext into memory includes: Based on the third virtual address, the first target ciphertext and the first target random number are written into memory.

8. The method according to claim 4, characterized in that, The step of generating a first target ciphertext using the fusion module based on the base ciphertext and the first ciphertext adjustment amount includes: The first target ciphertext is generated based on the second formula; the second formula is: Final_Cipher1= Cipher_AES1⊕Adjust1 Wherein, Final_Cipher1 is the first target ciphertext, Cipher_AES1 is the base ciphertext, and Adjust1 is the adjustment amount of the first ciphertext.

9. The method according to claim 1, characterized in that, The hardware data encryption / decryption engine includes a main encryption / decryption engine, an auxiliary encryption / decryption engine, and a fusion module. The processing of the current pending memory access request based on the hardware data encryption / decryption engine includes: If the current pending memory access request is a memory read request, the second target ciphertext and the second target random number corresponding to the current pending memory access request are obtained based on the auxiliary encryption / decryption engine; and a second ciphertext adjustment amount is generated based on the second target random number. Based on the fusion module, an intermediate decryption result is generated according to the second ciphertext adjustment amount and the second target ciphertext; Based on the main encryption / decryption engine, and according to the intermediate decryption results, the second target data corresponding to the current pending memory access request is determined; The second target data is returned to the target user terminal corresponding to the current pending memory access request.

10. The method according to claim 9, characterized in that, When the current pending memory access request is a memory read request, the method of obtaining the second target ciphertext and the second target random number corresponding to the current pending memory access request based on the auxiliary encryption / decryption engine includes: When the current pending memory access request is a memory read request, based on the auxiliary encryption / decryption engine, a fourth virtual address is generated by the second address scrambler according to the physical address to be read in the current pending memory access request; based on the fourth virtual address, the second target ciphertext and the second target random number corresponding to the current pending memory access request are obtained from memory.

11. The method according to claim 10, characterized in that, The step of generating a second ciphertext adjustment based on the second target random number includes: Obtain the target chip identifier of the chip where the memory controller is located; Based on the fourth virtual address, the second target random number, and the target chip identifier, generate the second target key corresponding to the current memory access request to be processed; Using a block cipher algorithm, a second ciphertext adjustment is generated based on the second target key and the physical address to be read in the current pending memory access request.

12. The method according to claim 11, characterized in that, The step of determining the second target data corresponding to the current pending memory access request based on the main encryption / decryption engine and the intermediate decryption results includes: Based on the main encryption / decryption engine, the second target data corresponding to the current pending memory access request is determined according to the intermediate decryption result and the second target key.

13. The method according to claim 12, characterized in that, The step of determining the second target data corresponding to the current pending memory access request based on the main encryption / decryption engine, the intermediate decryption result, and the second target key includes: The second target data is generated using a third formula; the third formula is: Data = AES - 1 (Cipher_AES2, Key2) Wherein, Data is the second target data; Cipher_AES2 is the intermediate decryption result; Key2 is the second target key; AES - ¹ is a decryption function of a symmetric encryption algorithm.

14. The method according to claim 9, characterized in that, The step of generating intermediate decryption results based on the fusion module, according to the second ciphertext adjustment amount and the second target ciphertext, includes: The intermediate decryption result is generated using the fourth formula; the fourth formula is: Cipher_AES2=Final_Cipher2⊕Adjust2 Where Cipher_AES2 is the intermediate decryption result; Final_Cipher2 is the second target ciphertext; Adjust2 is the adjustment amount of the second ciphertext.

15. The method according to claim 1, characterized in that, The step of determining the encryption / decryption identifiers of the multiple users based on their custom signals includes: For any given user, determine the value of the target bit of that user's custom signal based on that user's custom signal; When the target bit of the user's custom signal is the first value, the user's encryption / decryption flag indicates that the memory access request sent by the user needs to be encrypted or decrypted. When the target bit of the user's custom signal has the second value, the user's encryption / decryption identifier indicates that the memory access request sent by the user does not require data encryption / decryption.

16. The method according to claim 1, characterized in that, The step of determining the current pending memory access request based on the memory access requests sent by the multiple users includes: Get the request processing priority of multiple users; The current pending memory access request is determined based on the request processing priorities of multiple users and the memory access requests sent by the multiple users.

17. A data encryption / decryption device, characterized in that, Applied to a memory controller, the memory controller including a hardware data encryption / decryption engine, comprising: The receiving module is used to receive memory access requests and custom signals from multiple users. The first determining module is used to determine the encryption / decryption identifiers of the multiple users based on the user-defined signals of the multiple users; The second determining module is used to determine the current memory access request to be processed based on the memory access requests sent by the multiple users. The third determining module is used to determine the target encryption / decryption identifier of the current memory access request to be processed based on the encryption / decryption identifiers of the multiple users. The processing module is used to process the current memory access request based on the hardware data encryption and decryption engine if the target encryption / decryption identifier indicates that the current memory access request needs to be encrypted or decrypted.

18. An electronic device, characterized in that, include: Memory, used to store computer programs; A processor, configured to implement the steps of the data encryption / decryption method as described in any one of claims 1 to 16 when executing the computer program.

19. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program, wherein when the computer program is executed by a processor, it implements the steps of the data encryption / decryption method as described in any one of claims 1 to 16.

20. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the data encryption / decryption method as described in any one of claims 1 to 16.

Images