An encryption integrity check chip and method based on prime spectrum manifold topological constraint

Abstract

This invention discloses an encrypted integrity verification chip and method based on prime number spectrum manifold topological constraints, belonging to the field of cryptographic hardware and integrated circuit design technology. This invention embeds a prime number spectrum manifold mapping engine and a topological load calculation unit into the data read / write path. It simultaneously calculates the topological fingerprint during data writing and performs real-time comparison and verification during data reading, achieving real-time integrity protection of "verification upon writing and verification upon reading." The chip has a built-in tamper location engine that can recursively locate the specific location of tampering without decrypting the data (precision configurable up to 64 bytes). This invention is applicable to scenarios such as NVMe SSD data integrity protection, encrypted database storage engines, and blockchain data node verification, with an impact of <5% on host read / write performance.

Description

Technical Field

[0001] This invention belongs to the field of cryptographic hardware and integrated circuit design technology, and is particularly applicable to scenarios such as solid-state drive (SSD) data integrity protection, encrypted database storage engine, blockchain data node verification, cloud storage data auditing, and edge computing device data anti-tampering. Specifically, it relates to a real-time integrity verification chip and method for encrypted data using prime number spectrum manifold topological charge as data fingerprint. Background Technology

[0002] Encrypted data faces the threat of tampering during storage and transmission, and existing data integrity verification schemes have the following inherent limitations: Software verification has a performance bottleneck: Traditional hash verification (such as SHA-256) requires reading the entire data block for calculation. In high-speed storage devices (such as NVMe SSD, with read and write speeds > 7 GB / s), software hash calculation cannot match the data throughput, becoming a system performance bottleneck. Existing hardware accelerators only accelerate hash algorithms: The hash accelerators in existing cryptographic chips are only optimized for specific hash functions (SHA-2, SHA-3). Their computational architecture (iterative compression function) is completely different from the mathematical principles of prime number spectrum manifold topological fingerprint calculation, and cannot be directly used for fast calculation of topological fingerprints. Lack of tamper location capability: Most verification schemes can only determine "whether it has been tampered with", but cannot locate the specific location of the tampered data, requiring additional log or backup mechanisms to assist in the investigation. There is a lack of hardware solutions for integrity verification based on the topological charge of prime number spectrum manifold: RH00205 has proposed an encrypted data integrity verification method based on the topological charge of prime number spectrum manifold, but a chip architecture that can run in real time in the storage controller or data channel has not yet been formed. Separating verification operations from data read / write paths: Existing solutions typically perform verification calculations asynchronously by the CPU after data is written, which has a time window vulnerability (data may be tampered with while it has been written but not yet verified), and cannot achieve real-time protection of "verification upon writing". This invention proposes an encrypted integrity verification chip based on prime number spectrum manifold topological constraints. It hardware-izes the topological fingerprint calculation and embeds it into the data read / write path, simultaneously calculating the topological fingerprint during data writing. It performs real-time comparison during data reading, achieving real-time integrity protection of "verification upon writing and validation upon reading". Summary of the Invention

[0003] Purpose of the invention This invention aims to provide an encrypted integrity verification chip and method based on prime number spectrum manifold topological constraints. By integrating the prime number spectrum manifold mapping engine and the topological load calculation unit into the data channel, the topological fingerprint is calculated synchronously when data is written and compared in real time when data is read, thereby realizing real-time integrity verification and tamper location of encrypted data, meeting the needs of high-speed storage and real-time security verification. Technical solution This invention is based on the following mathematical principle: in a prime number spectrum manifold Above, any data block is mapped to a path. Its topological load and scale cumulative amount This constitutes a unique "topological fingerprint." Any change to even a single bit of the data will cause... Unpredictable changes can occur. This invention implements the fingerprint calculation in hardware and embeds it into the data read / write path. This chip comprises seven core components: Data stream preprocessing and chunking module: Configured to chunk the input data stream into fixed sizes (e.g., 4KB, 16KB, 64KB) along the data write path, with each data chunk... It serves as an independent verification unit. The block size is configurable to suit different storage media (4KB by default for SSDs, 16KB by default for database pages). Prime number spectrum manifold mapping engine: configured to map each data block The byte sequence is mapped to a prime number spectrum manifold The sequence of coordinate points on ,in , , For the first in the data block An integer value of 1 byte (or word). This is the preset bit width. Topological load and scale cumulant calculation unit: configured to calculate the topological load of the coordinate point sequence. (Phase winding number) and scale accumulation ,generate The tuple serves as the topological fingerprint of the data block. This unit contains two parallel sub-units: a phase difference accumulator and a scale difference accumulator, which are calculated in real time as the data stream passes through, without incurring additional latency. Fingerprint storage management unit: Configured to generate topological fingerprints during data writing. Storing fingerprints in a secure metadata area and associated with a data block address. The fingerprint storage area is physically isolated from the data storage area to prevent attackers from simultaneously tampering with both the data and the fingerprint. Real-time comparison and integrity determination unit: configured to recalculate the topological fingerprint of the current data block during data reading. , with the stored original fingerprint Perform a comparison. If they are completely consistent, the data is considered complete, and a "pass" flag is output; if they are inconsistent, the data is considered to have been tampered with, an "alarm" flag is output, and the tampering location process is triggered. Tampering localization engine: Configured to initiate a binary recursive localization process upon detecting tampering: Divide the data block into two equal halves, calculate the topological fingerprint of each half, compare it with the fingerprint of the corresponding half in the original fingerprint, and recursively perform binary localization to the smallest granularity (configurable). byte or (Bytes). The location result output is the specific offset address of the tampered data. Host interface and alarm output module: Configured to communicate with the host via AXI, AHB or PCIe interface, output verification results (pass / alarm) and tamper location information, and support interrupt notification mechanism. Overall workflow (write path): Host writes data → Data stream preprocessing and segmentation → Prime number spectrum manifold mapping → Topological charge and scale cumulant calculation → Fingerprint storage management unit saving → Data writes to storage medium Overall process (read path): Host reads data → Data is read from storage medium → Data stream preprocessing and segmentation → Prime number spectrum manifold mapping → Topological charge and scale cumulant calculation → Real-time comparison and integrity judgment → If successful, output data; otherwise, trigger tamper location and alarm. Security Features: - The fingerprint storage area is physically isolated from the data storage area, preventing attackers from simultaneously tampering with both data and fingerprints; - Topological fingerprinting The storage employs a write protection mechanism, which can only be set during the initial write and is subsequently locked by hardware write protection; - During the tampering location process, the binary recursive calculation is completed independently on the current data block, without relying on external software, thus preventing the software layer from being bypassed. Tampering with positioning accuracy and speed: - Minimum positioning granularity can be configured to , , Byte-Location Latency: Recursive calculation, Data block size (bytes) / minimum granularity - For a 4KB data block, a 64-byte granularity would require approximately Recursion count, total delay < μs Beneficial effects Topological fingerprinting is embedded in the data read and write path to achieve real-time integrity protection of "verification upon writing and verification upon reading", eliminating time window vulnerabilities; Hardware-accelerated topology fingerprinting (requiring only a few clock cycles per byte) can match the throughput of NVMe SSDs, with an impact of less than 5% on host read and write performance; The tamper location engine can quickly locate the specific location of the tampered data without decrypting it (the accuracy can be configured up to 64 bytes). It is independent of any specific encryption algorithm and can be superimposed on any encryption scheme such as AES, SM4, RSA, and ECC; The fingerprint storage area is physically isolated from the data storage area to prevent attackers from tampering with both data and fingerprints simultaneously. It shares the prime spectrum manifold mapping engine with the RH00400 cryptographic hardware acceleration architecture, enabling hardware resource reuse. Detailed Implementation

[0004] Example 1: Built-in Integrity Verification in NVMe SSD Controller Step N1, Chip Integration: The integrity verification chip of this invention is integrated as a hardware accelerator into the NVMe SSD main controller chip, located on the data path, between the DMA engine and the flash controller. Step N2, Write Path Configuration: Configure the block size to 4KB (matching the SSD page size), and store the topology fingerprint in the SSD's metadata area (out-of-band storage area, OOB), with each data page corresponding to a set. fingerprint. Step N3, Read Path Verification: When the host initiates a read request, the data is read from the flash memory and automatically passes through the verification chip to calculate the topological fingerprint, which is then compared with the pre-stored fingerprint. Only after successful verification is the data returned to the host. If the verification fails, an interrupt is immediately triggered to notify the host. Step N4, Tampering with Location: If the verification fails, the host sends a location command, and the verification chip performs binary recursive location in the background, returning the specific page offset that was tampered with. Technical Results: In a 7 GB / s sequential read / write scenario, the verification calculation latency is < 50 ns / byte, with a total throughput loss of < 3%. The topology fingerprint calculation latency for a 4KB data block (4096 bytes) is approximately 0.5 μs (processing 8 bytes per clock cycle when the pipeline is fully deployed, approximately 1 μs at 500 MHz), far lower than the flash memory read latency (approximately 50 μs), and does not constitute a system bottleneck. Compared to pure software SHA-256 verification (approximately 5 μs / 4KB), the hardware topology fingerprint calculation speed is improved by approximately 5 times. Example 2: Encrypted Database Storage Engine Data Page Verification Step D1, Page Size Configuration: Configure the block size to 16KB (matching the database page size), and store the fingerprint in the secure metadata area of ​​the database system table. Step D2, Write and Verify: When the database writes a data page, the verification chip automatically calculates and stores the topology fingerprint. The application does not need to call the verification function. This process is automatically completed by the storage engine in the write path and does not occupy the application layer CPU time. Step D3, Periodic Integrity Scan: The database background process triggers a full table scan periodically (e.g., hourly), and the verification chip automatically verifies the integrity of each data page and detects silent data corruption. Step D4, Tamper Location Assistance: If a corrupted page is detected, the verification chip locates the specific location of the damage, helping the database administrator to quickly recover the data. Technical Results: Full verification of a 1TB encrypted database takes approximately 8 minutes (parallel processing), can pinpoint specific data pages and page offsets, and has a false alarm rate of less than [missing information]. Compared to a full scan using pure software (approximately 2 hours), the speed is increased by about 15 times. Example 3: Blockchain Full Node Data Integrity Verification Step B1, Block Data Verification: When a blockchain node receives a new block, it inputs the block body data (transaction list) as a data block into the verification chip to verify whether its topological fingerprint is consistent with the fingerprint stored in the block header. Step B2, Status Database Verification: The node is configured to periodically verify the account status data pages in the local status database (LevelDB / RocksDB) to detect storage media damage or malicious tampering. Step B3, Light Node Assisted Verification: Provides Merkle proofs of topological fingerprints for light nodes, enabling them to verify the integrity of specific data without downloading the complete block. Technical effects: Block verification latency is reduced by < 5 μs / block (approximately 1 MB of data), and the data verification communication volume of light nodes is reduced by approximately 80%, allowing data integrity to be verified without downloading the complete block. Terminology Explanation

[0005] Terminology Meaning Topological fingerprint : Topology load of data block path (Phase winding number) and scale accumulation The resulting binary tuple serves as a unique geometric fingerprint of the data block and is highly sensitive to any data modification. Fingerprint storage area: A secure storage area independent of the data storage area, used to store the topological fingerprint of data blocks. It is physically isolated from the data area to prevent simultaneous tampering. Tampering Location Engine: Hardware logic that quickly locates the specific location of tampered data by calculating the topological fingerprint of data block segments through binary recursion. Attached Figure Description

[0006] Figure 1 This is a block diagram of the chip's overall architecture and data path. Figure 2 Flowchart for generating write path fingerprint; Figure 3 Flowchart for reading path verification and tamper location; Figure 4 The flowchart for the binary recursive process of tampering with the location.

Claims

1. A cryptographic integrity verification chip based on prime number spectrum manifold topological constraints, characterized in that, include: The data stream preprocessing and segmentation module is configured to segment the input data stream into blocks of a fixed size. The prime number spectrum manifold mapping engine is configured to map the byte sequence of each data block to a prime number spectrum manifold. The sequence of coordinate points on ; The topological load and scale cumulant calculation unit is configured to calculate the topological load of the coordinate point sequence. and scale cumulative ,generate The tuple serves as the topological fingerprint of the data block; The fingerprint storage management unit is configured to store the topological fingerprint when writing data and read the topological fingerprint when reading data; the real-time comparison and integrity determination unit is configured to recalculate the topological fingerprint and compare it with the stored fingerprint when reading data to determine data integrity; the tampering location engine is configured to recursively perform binary search to locate the specific location of the tampered data when tampering is detected; and the host interface and alarm output module is configured to output the verification result and tampering location information.

2. The chip according to claim 1, characterized in that, The mapping method of the prime number spectrum manifold mapping engine is as follows: each byte value Mapped to scale coordinates and phase coordinates ,in This is the preset bit width.

3. The chip according to claim 1, characterized in that, The topological load The scale accumulation .

4. The chip according to claim 1, characterized in that, The fingerprint storage management unit stores the topological fingerprint in a secure metadata area that is physically isolated from the data storage area.

5. The chip according to claim 1, characterized in that, The tampering location engine locates the tampered position through binary recursion. The minimum location granularity can be configured as follows: , or byte.

6. The chip according to claim 1, characterized in that, The chip is embedded in an NVMe SSD controller, a database storage engine, or blockchain node hardware.

7. The chip according to claim 1, characterized in that, The host interface is any one of AXI, AHB, or PCIe interfaces.

8. The chip according to claim 1, characterized in that, The chip is decoupled from the encryption algorithm and can be superimposed on any of the encryption schemes such as AES, SM4, RSA, and ECC.

9. A method for verifying encrypted integrity based on prime number spectrum manifold topological constraints, applied to the chip described in claims 1-8, characterized in that... Includes write path and read path: Write path: Host writes data → blocks → maps to prime number spectrum manifold coordinates → calculates topological fingerprint → Store fingerprint and data; Read path: Read data and fingerprint → Block partitioning → Map to prime number spectrum manifold coordinates → Calculate topological fingerprint → Compare and → If they match, output the data; if they don't match, trigger the tampering location and issue an alarm.

10. The method according to claim 9, characterized in that, The tampering location step includes: dividing the data block into two equal halves, calculating the topological fingerprint of each half, comparing it with the fingerprint of the corresponding half in the original fingerprint, recursively performing binary search to locate to the smallest granularity, and outputting the specific offset address that has been tampered with.

Images