A decryption method, apparatus and related device

Abstract

The application provides a decryption method, device and related equipment, and belongs to the technical field of communication. The method comprises the following steps: obtaining decryption request data sent by a target host; authenticating a digital signature token by using target hardware; in the case that the digital signature token passes the authentication of the target hardware, decrypting the second ciphertext by using the target hardware according to a root key of the second ciphertext to obtain a data encryption key of the first ciphertext, and storing the data encryption key of the first ciphertext in a first storage area of a static random access memory (SRAM) of the target hardware; then, decrypting the first ciphertext according to the data encryption key of the first ciphertext to obtain plaintext corresponding to the first ciphertext; triggering an erasing instruction of the SRAM by using the target hardware, and injecting a high-entropy noise stream into the first storage area according to the erasing instruction. The method can improve the security of the decryption process.

Description

Technical Field

[0001] This application relates to the field of communication technology, and in particular to a decryption method, apparatus and related equipment. Background Technology

[0002] Currently, a layered encryption system using a key encryption key (KEK) and a data encryption key (DEK) is employed in communication data transmission to encrypt and decrypt business data. The DEK is directly used for encryption and decryption operations. However, in the existing decryption process, the plaintext DEK generated during the decryption phase is temporarily stored in the host's memory. Malicious actors can exploit this by using unauthorized processes to capture memory snapshots and traverse the memory space to obtain the plaintext DEK, resulting in low security during the decryption process. Summary of the Invention

[0003] This application provides a decryption method, apparatus, and related equipment, which can solve the technical problem of low security during the decryption process.

[0004] In a first aspect, embodiments of this application provide a decryption method, the method comprising: Obtain decryption request data sent by the target host. The decryption request data includes a first ciphertext, a second ciphertext, and a digital signature token of the first ciphertext. The second ciphertext is the encrypted ciphertext of the data encryption key of the first ciphertext. The digital signature token is used to verify the validity of the first ciphertext. The digital signature token is authenticated using the target hardware. If the digital signature token is authenticated by the target hardware, the target hardware decrypts the second ciphertext using the root key of the second ciphertext to obtain the data encryption key of the first ciphertext. The data encryption key of the first ciphertext is stored in the first storage area of ​​the static random access memory (SRAM) in the target hardware. The target hardware is a logic circuit that processes the decryption request data. The target hardware is isolated from the target host. The target hardware is used to decrypt the first ciphertext using the data encryption key of the first ciphertext to obtain the plaintext corresponding to the first ciphertext; The target hardware triggers an erase command on the SRAM, and a high-entropy noise stream is injected into the first storage area of ​​the SRAM according to the erase command. The high-entropy noise stream is used to erase the data encryption key of the first ciphertext in the first storage area.

[0005] Optionally, the target hardware further includes: a security controller, a root key array, a key management unit, a cryptographic acceleration engine, and a true random number generator; The security controller is used to authenticate the digital signature token; The root key array is used to store the root key of the second ciphertext; The key management unit is used to read the root key of the second ciphertext in the root key array, decrypt the second ciphertext according to the root key of the second ciphertext to obtain the data encryption key of the first ciphertext, and store the data encryption key of the first ciphertext in the first storage area of ​​the SRAM in the target hardware. The cryptographic acceleration engine is used to decrypt the first ciphertext based on the data encryption key of the first ciphertext; The true random number generator is used to provide a high-entropy noise stream to the first storage area of ​​the SRAM.

[0006] Optionally, the logic circuit of the cryptographic acceleration engine is provided with a status indicator pin at the end; when the first ciphertext is decrypted, the status indicator pin undergoes a level change. The erase instruction of the target hardware on the SRAM is triggered in the next clock cycle after the state change, and the clock cycle is the working clock cycle of the target hardware.

[0007] Optionally, the SRAM includes multiple independent storage regions; the multiple independent storage regions are electrically connected to the cryptographic acceleration engine via their respective control lines; the first storage region is one of the multiple independent storage regions.

[0008] Optionally, the digital signature token is obtained by asymmetric encryption of a first hash value with a preset first key, wherein the first hash value is the hash value of the concatenated concatenation of the second ciphertext, the preset random number and the timestamp of the first ciphertext; The authentication of the digital signature token using the target hardware includes: The security controller is used to authenticate the legality of the source of the digital signature token to obtain a first authentication result. The security controller has a built-in logic circuit for a verification key corresponding to the preset first key. The security controller is used to authenticate the preset random number included in the digital signature token to obtain a second authentication result; The security controller is used to authenticate the current time of the security controller, the timestamp corresponding to the digital signature token, and a preset time drift range to obtain a third authentication result. The preset time drift range is a preset range of the difference between the current time of the security controller and the timestamp corresponding to the first ciphertext. The digital signature token is determined to have passed the authentication of the target hardware based on the first authentication result, the second authentication result, and the third authentication result.

[0009] Optionally, the method further includes: The communication link, built on a point-to-point (P2P) communication protocol or the high-speed serial peripheral interconnect bus PCIe, bypasses the target host and sends the plaintext corresponding to the first ciphertext to the target node.

[0010] Secondly, embodiments of this application provide a decryption device, the device comprising: The acquisition module is used to acquire decryption request data sent by the target host. The decryption request data includes a first ciphertext, a second ciphertext, and a digital signature token of the first ciphertext. The second ciphertext is the encrypted ciphertext of the data encryption key of the first ciphertext. The digital signature token is used to verify the validity of the first ciphertext. The first processing module is used to authenticate the digital signature token using the target hardware. If the digital signature token is authenticated by the target hardware, the target hardware is used to decrypt the second ciphertext according to the root key of the second ciphertext to obtain the data encryption key of the first ciphertext. The data encryption key of the first ciphertext is stored in the first storage area of ​​the static random access memory (SRAM) in the target hardware. The target hardware is a logic circuit that processes the decryption request data. The target hardware is isolated from the target host. The second processing module is used to decrypt the first ciphertext using the target hardware according to the data encryption key of the first ciphertext to obtain the plaintext corresponding to the first ciphertext. The third processing module is used to trigger an erase command on the SRAM using the target hardware, and inject a high-entropy noise stream into the first storage area of ​​the SRAM according to the erase command. The high-entropy noise stream is used to erase the data encryption key of the first ciphertext in the first storage area.

[0011] Thirdly, embodiments of this application provide an electronic device, including: a processor, a memory, and a program stored in the memory and executable on the processor, wherein when the program is executed by the processor, it implements the steps of the decryption method as described in the first aspect.

[0012] Fourthly, embodiments of this application provide a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps of the decryption method as described in the first aspect.

[0013] Fifthly, embodiments of this application provide a computer program product, including computer instructions that, when executed by a processor, implement the steps of the decryption method as described in the first aspect.

[0014] In this embodiment, decryption request data sent by a target host is obtained. The decryption request data includes a first ciphertext, a second ciphertext, and a digital signature token of the first ciphertext. The second ciphertext is the encrypted ciphertext of the data encryption key of the first ciphertext. The digital signature token is used to verify the validity of the first ciphertext. The target hardware authenticates the digital signature token. If the digital signature token passes the authentication by the target hardware, the target hardware decrypts the second ciphertext using the root key of the second ciphertext to obtain the data encryption key of the first ciphertext. The data encryption key of the first ciphertext is stored in the first storage area of ​​the static random access memory (SRAM) in the target hardware. The target hardware is a logic circuit that processes the decryption request data and is isolated from the target host. The target hardware decrypts the first ciphertext using the data encryption key of the first ciphertext to obtain the plaintext corresponding to the first ciphertext. The target hardware triggers an erase command on the SRAM. According to the erase command, a high-entropy noise stream is injected into the first storage area of ​​the SRAM. The high-entropy noise stream is used to erase the data encryption key of the first ciphertext in the first storage area. The decryption process is completed by performing the following steps in the target hardware: token authentication, decrypting the data encryption key of the first ciphertext, storing the data encryption key of the first ciphertext, decrypting the first ciphertext, and erasing the data encryption key of the first ciphertext.

[0015] Because the target hardware is isolated from the target host, and the decryption process is completed within the target hardware, malicious actors cannot steal the data encryption key of the first ciphertext stored in the target hardware through the target host. This reduces the risk of leakage of the data encryption key of the first ciphertext and improves the security of the decryption process. Simultaneously, since the erase command on the SRAM is directly triggered using the target hardware, malicious actors find it difficult to intercept or skip the erase command by tampering with the target host's memory or hijacking applications. Injecting a high-entropy noise stream into the first storage area of ​​the SRAM based on the difficult-to-intercept or skip erase command can cover the physical traces of the circuitry corresponding to the data encryption key of the first ciphertext, preventing leakage of the data encryption key of the first ciphertext and further improving the security of the decryption process. Attached Figure Description

[0016] To more clearly illustrate the technical solutions of the embodiments of this application, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0017] Figure 1 This is one of the flowcharts of a decryption method provided in the embodiments of this application; Figure 2 This is a schematic diagram of the structure of the target host and target hardware in a decryption method provided in an embodiment of this application; Figure 3 This is a schematic diagram of the state changes of the storage area of ​​the static random access memory in a decryption method provided in an embodiment of this application; Figure 4 This is a second flowchart of a decryption method provided in an embodiment of this application; Figure 5 This is a schematic diagram of the structure of a decryption device provided in an embodiment of this application; Figure 6 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0018] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0019] The terms "first," "second," etc., used in this application are used to distinguish similar objects and not to describe a specific order or sequence. It should be understood that such terms can be used interchangeably where appropriate so that embodiments of this application can be implemented in orders other than those illustrated or described herein, and the objects distinguished by "first" and "second" are generally of the same class, not limited in number; for example, the first object can be one or more. Furthermore, "and / or" in this application indicates at least one of the connected objects. For example, the scope of protection of "A and / or B" covers at least three scenarios: Scenario 1: including A but not B; Scenario 2: including B but not A; Scenario 3: including both A and B. Additionally, the character " / " generally indicates that the preceding and following objects are in an "or" relationship.

[0020] See Figure 1 , Figure 1This is one of the flowcharts of a decryption method provided in the embodiments of this application, such as... Figure 1 As shown, the method includes the following steps: Step 101: Obtain the decryption request data sent by the target host. The decryption request data includes a first ciphertext, a second ciphertext, and a digital signature token of the first ciphertext. The second ciphertext is the encrypted ciphertext of the data encryption key (DEK) of the first ciphertext. The digital signature token is used to verify the validity of the first ciphertext. The target host may include host hardware and a host operating system (which may be referred to as the host system in this application) to implement host functions; for example, the host may be a personal host, a network security host, or a cloud server host. In this application, the target host can be a host whose operating system is compromised; for example, the host operating system has been completely controlled by a hacker, and it can be further assumed that the attacker has the ability to intercept physical bus data, inject voltage glitches, and perform side-channel monitoring using high-precision probes; for details, please refer to [link to relevant documentation]. Figure 2 , Figure 2 This is a schematic diagram of the structure of the target host and target hardware in a decryption method provided in an embodiment of this application, as shown below. Figure 2 As shown: Because the host system has security risks, it is also known as the untrusted domain; the Dynamic Random Access Memory (DRAM) corresponding to the system's main memory is at risk of being captured by malicious entities who can capture memory snapshots and traverse the memory space to obtain data. Because the target hardware described below is isolated from the untrusted domain, the addressing path of the host system's Memory Management Unit (MMU) is blocked; the host system cannot access the memory in the target hardware to steal information from the target hardware; therefore, the target hardware is also referred to as the hardware security domain or the absolutely trusted domain; the target hardware can have its own independent clock and power supply to complete independent operation. The decryption request data described in this application is also referred to as payload data or request payload. The host system writes or transmits the payload to the target hardware in an asynchronous manner. The DEK of the first ciphertext can be generated in a secure offline environment by an external, absolutely trusted key management system (KMS); The decryption request data may also include one or more of the following: a preset random number, a timestamp of the first ciphertext, an initialization vector (IV), and additional authenticated data (AAD); the IV is used to ensure that the same plaintext generates different ciphertexts in different encryptions to prevent pattern analysis; the AAD is additional data that participates in authentication but is not encrypted, and is used for tamper-proof verification. Specifically, the decryption request data can be represented by the following first formula: ; in, This can represent the decryption request data; DEK can represent the second ciphertext; DEK can represent the data encryption key of the first ciphertext. It can represent the first ciphertext; It can represent an initialization vector, used to ensure that the same plaintext produces different ciphertexts in different encryptions; It can represent additional authentication data for tamper-proof verification; A digital signature token that can represent the first ciphertext; This can represent the timestamp of the first ciphertext; It can be a type of preset random number, such as a one-time random number (Number used once); More specifically, the aforementioned KMS can use the asymmetric public key that is publicly available when the target hardware is shipped from the factory. Perform a symmetric envelope encryption operation on the aforementioned DEK to generate a second ciphertext that only the target hardware can decrypt. For details, please refer to the second formula below: ; In the second formula, DEK can represent the second ciphertext; DEK can represent the encryption key for the first ciphertext. It can represent an asymmetric public key, or it can represent the key encryption key (KEK) corresponding to the DEK. It can represent asymmetric encryption functions; In this step, the decryption request data sent by the target host is obtained. The decryption request data includes a first ciphertext, a second ciphertext, and a digital signature token of the first ciphertext, providing a data basis for securely decrypting the first ciphertext.

[0021] Step 102: Authenticate the digital signature token using the target hardware. If the digital signature token is authenticated by the target hardware, decrypt the second ciphertext using the root key of the second ciphertext to obtain the data encryption key of the first ciphertext. Store the data encryption key of the first ciphertext in the first storage area of ​​the static random access memory (SRAM) in the target hardware. The target hardware is a logic circuit that processes the decryption request data. The target hardware is isolated from the target host. Specifically, the digital signature token is authenticated using target hardware, and the validity of the first ciphertext is determined by whether the digital signature token passes the authentication of the target hardware; if the digital signature token fails the authentication of the target hardware, the first ciphertext and the second ciphertext are discarded directly. Please see Figure 2 The payload can be transmitted to the target hardware via a secure mailbox or an asynchronous First In First Out (FIFO) interface. The secure mailbox or asynchronous FIFO interface is responsible for the unique data interaction with the host system. The target host and the target hardware are physically connected through this controlled asynchronous bus interface, but an isolated data interaction channel is formed in the Dual Port Random Access Memory (DPRAM), physically blocking the host system from probing the internal state of the target hardware through Direct Memory Access (DMA) or Bus Snooping. The root key of the second ciphertext is the key used to decrypt the second ciphertext in order to restore the data encryption key of the first ciphertext. The SRAM can be a type of static random access memory, which has the advantages of no need to refresh and low read / write latency; In this step, the digital signature token is authenticated. After successful authentication, the second ciphertext is decrypted based on the root key of the second ciphertext to obtain the data encryption key of the first ciphertext. The data encryption key of the first ciphertext is then stored in the SRAM. Since the target hardware and the target host are isolated from each other, security protection is constructed from three dimensions: token validity, key hierarchical decryption, and isolation of the storage of the data decryption key of the first ciphertext. This can block unauthorized access and data theft paths from the target host and improve the security of decryption.

[0022] Step 103: Use the target hardware to decrypt the first ciphertext according to the data encryption key of the first ciphertext to obtain the plaintext corresponding to the first ciphertext; In this step, the target hardware is used to decrypt the first ciphertext using the data encryption key of the first ciphertext to obtain the plaintext corresponding to the first ciphertext. Since the target hardware is isolated from the target host, the entire decryption process can be performed without going through the target host, which can reduce the possibility of leakage of the data encryption key of the first ciphertext and further improve the security of decryption.

[0023] Step 104: Use the target hardware to trigger an erase command on the SRAM, and inject a high-entropy noise stream into the first storage area of ​​the SRAM according to the erase command. The high-entropy noise stream is used to erase the data encryption key of the first ciphertext in the first storage area.

[0024] The high-entropy noise stream can be a type of binary random bit stream generated by a physically true random source, statistically unpredictable, and with an entropy value close to full entropy. Essentially, it can be a type of cryptographically secure true random number sequence. The high-entropy noise stream is used to erase (e.g., overwrite) the data encryption key of the first ciphertext in the first storage area. The length of the high-entropy noise stream can be greater than or equal to the length of the data encryption key of the first ciphertext to fully erase the data encryption key of the first ciphertext and prevent the data encryption key of the first ciphertext from being leaked. Because the SRAM has a fast read / write speed, it can quickly complete key writing and high-entropy noise stream overwriting and erasure. As it is an independent on-chip storage area, it can achieve physical isolation of the key, reducing the risk of unauthorized reading. In addition, the SRAM has no residual charge and does not require refreshing. Combined with high-entropy noise stream overwriting, it can completely remove the data encryption key of the first ciphertext, prevent data leakage, and greatly improve the security of the decryption process.

[0025] In this step, the target hardware triggers an erase command on the SRAM. Based on the erase command, a high-entropy noise stream is injected into the first storage area of ​​the SRAM, erasing the encryption key of the first ciphertext in the first storage area. Since the erase command is triggered by hardware, it eliminates the need for system scheduling and software parsing, resulting in faster execution, shorter residence time of the encryption key, reduced exposure window, and improved security of the decryption process. Simultaneously, the hardware-triggered erase command is not controlled by the target host, effectively preventing software tampering, memory sniffing, and malicious hijacking attacks, reducing the risk of key leakage at the execution level. Furthermore, the SRAM's hardware-independent isolation and lack of residual charge, combined with the high-entropy noise stream erasing the first storage area containing the key, completely erases the encryption key of the first ciphertext, resisting cold start attacks and side-channel attacks, further enhancing the security of the decryption process.

[0026] In this embodiment, since the target hardware is isolated from the target host, the decryption process is completed within the target hardware. Malicious actors cannot steal the data encryption key of the first ciphertext stored in the target hardware through the target host, reducing the risk of leakage of the data encryption key of the first ciphertext and improving the security of the decryption process. At the same time, since the erase command on the SRAM is directly triggered by the target hardware, it is difficult for malicious actors to intercept or skip the erase command by tampering with the memory of the target host or hijacking the application. By injecting a high-entropy noise stream into the first storage area of ​​the SRAM according to the erase command that is difficult to intercept or skip, the physical traces of the circuit corresponding to the data encryption key of the first ciphertext can be completely covered, preventing the leakage of the data encryption key of the first ciphertext and further improving the security of the decryption process.

[0027] In some implementations, the target hardware further includes: a security controller, a root key array, a key management unit, a cryptographic acceleration engine, and a true random number generator; The security controller is used to authenticate the digital signature token; The root key array is used to store the root key of the second ciphertext; The key management unit is used to read the root key of the second ciphertext in the root key array, decrypt the second ciphertext according to the root key of the second ciphertext to obtain the data encryption key of the first ciphertext, and store the data encryption key of the first ciphertext in the first storage area of ​​the SRAM in the target hardware. The cryptographic acceleration engine is used to decrypt the first ciphertext based on the data encryption key of the first ciphertext; The true random number generator is used to provide a high-entropy noise stream to the first storage area of ​​the SRAM.

[0028] The security controller, root key array, key management unit, cryptographic acceleration engine, and true random number generator can all be logic circuits that perform the corresponding functions in the target hardware. In this application, the target host may include a conventional central processing unit (CPU) and main memory (typically DRAM), running an untrusted operating system (OS), a hypervisor, and business applications. In this application, the target host is stripped of key management privileges and serves only as a carrier for transporting ciphertext and token data, without the right to initiate addressing operations on the address space of the target hardware.

[0029] The target hardware can be an independent on-chip security subsystem (i.e., an isolated security island within a System on Chip (SoC), such as a fifth-generation Reduced Instruction Set Computer-Five (RISC-V) security core equipped with an independent Memory Management Unit (MMU), or an external independent Hardware Security Module (HSM) chip.

[0030] For details, please see Figure 2 The target hardware also includes: a hardware secure controller (HSC), a root key array, a key management unit (KMU), a cryptographic acceleration engine, and a true random number generator (TRNG). The security controller may include a dedicated gate-level logic state machine; responsible for parsing the request payload sent by the target host, performing cryptographic verification of the digital signature token, and internally maintaining hardware logic circuitry for a time window algorithm to defend against replay attacks.

[0031] The true random number generator can be a hardware entropy source based on silicon transistor thermal noise or a metastable ring oscillator design, used to provide a transient and unpredictable high-entropy noise overlay stream at the end of the key's (e.g., the DEK of the first ciphertext mentioned above) lifetime.

[0032] The SRAM can be a type of partitioned secure SRAM, physically independent of the target host's main memory and not included in the target host's system memory map. The SRAM's internal structure can be divided into multiple parallel storage regions (also referred to as lifetime slots in this application) by a hardware context allocator (which is also a type of logic circuitry and pipeline included in the target hardware for data allocation). The hardware context allocator can perform hard-wired allocation through independent write enable (WE) and chip select (CS) control lines, supporting absolute physical isolation for massive concurrent decryption requests.

[0033] The key management unit (KMU) can be a type of hardware-level logic circuit used to read the root key of the second ciphertext in the root key array, decrypt the second ciphertext according to the root key of the second ciphertext to obtain the data encryption key of the first ciphertext, and store the data encryption key of the first ciphertext in the first storage area of ​​the SRAM in the target hardware. The root key array can be a type of tamper-proof hardware; for example, it can be an embedded one-time fuse (eFuse) array or a physically unclonable function (PUF) array directly programmed and embedded in a chip (such as the aforementioned key management unit) using semiconductor manufacturing processes. The output pins of this array can be hard-wired directly to the KMU's decryption pipeline, making it absolutely unreadable from the outside (such as the aforementioned target host). The KMU is the only underlying logic block authorized to perform asymmetric decryption of the second ciphertext based on the root key.

[0034] A high-speed cryptographic acceleration engine can be a type of logic circuit, specifically a hardware-embedded authentication encryption / decryption pipeline; for example, the high-speed cryptographic acceleration engine is an Advanced Encryption Standard Galois / Counter Mode (AES-GCM) engine; more specifically, the high-speed cryptographic acceleration engine is a fully expanded 256-bit Advanced Encryption Standard - 256-bit - Galois / Counter Mode (AES-256-GCM) operator logic gate array, which can be directly connected to... Figure 2The Secure SRAM in the memory is connected to an internal high-speed data bus, enabling high-concurrency processing of multiple bytes per clock cycle.

[0035] The KMU can be electrically connected to the security controller, the root key array, the cryptographic acceleration engine, and the SRAM. The KMU can push the DEK of the first ciphertext into a dedicated slot of the SRAM. For example, the target hardware may also include logic circuitry that performs secure mailbox or asynchronous FIFO interface functions to obtain the payload sent by the target host and send the payload to the security controller and the cryptographic acceleration engine; In this embodiment, the target hardware completes the entire decryption process through a logic circuit consisting of the security controller, the root key array, the key management unit, the cryptographic acceleration engine, and the true random number generator. On the one hand, the relevant logic circuit is isolated from the target host, preventing the target host from participating in the decryption process or accessing the SRAM storage area, thus improving the security of the decryption process. On the other hand, the entire decryption process is independently triggered and executed by the hardware logic circuit, reducing software intervention and effectively preventing software tampering and hijacking, further enhancing the security of the decryption process.

[0036] In some implementations, after the payload enters the target hardware, the target hardware can use a hardware context allocator (which is also a type of logic circuitry and pipelines for data allocation included in the target hardware) to search for slots marked as IDLE in the SRAM (i.e., a storage area of ​​a certain SRAM, such as the first storage area mentioned above); and mark the slots as... This slot can include three physically independent sets of micro registers: The first micro register group (which can be denoted as...) This can be used as a dedicated DEK to store the first ciphertext, which is only read-only to the cryptographic engine and completely cuts off external bus read and write operations; The second micro register set (which can be denoted as...) This can be used to contain the first ciphertext, the second ciphertext, the initialization vector in the payload, other data included in the payload, and the plaintext after the first ciphertext is decrypted. The third micro register set (which can be denoted as...) The control register can be a type of state machine used to maintain the current slot (the slot's state can include: idle, allocated, key filled, decrypting, and overwriting / destroying). In this embodiment, by splitting and isolating different register groups in the slot, it is ensured that the control flow and data flow are also isolated from each other within the target hardware, which can further reduce the risk of leakage of the data encryption key of the first ciphertext and further improve the security of the decryption process.

[0037] In some implementations, the logic circuit of the cryptographic acceleration engine is provided with a status indicator pin at the end; when the first ciphertext is decrypted, the status indicator pin undergoes a level change. The erase instruction of the target hardware on the SRAM is triggered in the next clock cycle after the state change, and the clock cycle is the working clock cycle of the target hardware.

[0038] Specifically, the logic circuit of the cryptographic acceleration engine may include a decryption pipeline, which decrypts the first ciphertext according to its DEK; a hardwired status indicator pin is led out from the end of the decryption pipeline; and the level of the status indicator pin is set when the first ciphertext is decrypted. A state change occurs (e.g.) From low (e.g., from 0) to high (e.g., from 1)), in The strict next clock rising edge that jumps to a high level does not require waiting for any CPU instructions or software callbacks. The flip-flop in the target hardware directly drives the KMU's clear-discharge circuit, sending a signal to the first memory region (e.g., the one mentioned above) via the aforementioned TRNG. Sends high-voltage pulses and overwrite streams; the equivalent operation script for its microarchitecture underlying instructions is: ; In the equivalent operation script, "This can represent a direct physical level discharge or overwrite operation without bus arbitration; in order to completely eliminate data-dependent charge residues on the SRAM transistors (which effectively prevents the hysteresis effect of detecting historical levels by highly sensitive electromagnetic probes); this application does not simply write a fixed sequence of all zeros, but rather uses the aforementioned true random number generator to generate in real time a high-entropy random noise stream with a length L completely equal to the ciphertext encryption key of the first ciphertext." A violent flushing process is performed. Within an extremely short timeframe of a few nanoseconds, the physical charge traces that once existed in the ciphertext encryption key of the first ciphertext are instantly and completely submerged in thermal noise, and the slot state immediately returns to idle (IDLE). This achieves true microarchitectural-level "read-and-burn" functionality, completely ending the key's lifecycle.

[0039] For details, please see Figure 3 , Figure 3 This is a schematic diagram illustrating the state changes of the storage area of ​​a static random access memory in a decryption method provided in an embodiment of this application, as shown below. Figure 3 As shown: During the decryption process described above, the initial state of the storage area (slot) is idle. Upon receiving the payload (in the case of multiple concurrent requests, i.e., multiple requests for decrypted data arriving, the slot is allocated through the target hardware), the slot switches to the locked allocation state. If authentication fails, it returns to the idle state. If authentication succeeds (e.g., Auth_OK=1), the DEK of the first ciphertext in plaintext form is pushed into the slot, and the slot switches to the key-filled state. The cryptographic acceleration engine can read the key in parallel to complete the decryption of the corresponding first ciphertext. At this time, the slot switches to the Authenticated Encryption with Associated Data (AEAD) decryption state. In this case, the rising edge triggers an erase command, at which point the slot switches to a high-entropy noise forced overwrite state (ZEROIZING). Perform a violent flush to return to the idle state (IDLE). The operating clock cycle of the target hardware can be a fixed cycle under an independent clock domain within the hardware, and is not affected by the clock of the target host.

[0040] In this embodiment, the logic circuit of the cryptographic acceleration engine is provided with a status indicator pin at its end. The erase command of the target hardware to the SRAM is triggered by the change in the level of the status indicator pin. Since the erase command of the SRAM is triggered by the change in the level of the hardware, it can not only avoid software interference and tampering, but also speed up the erase speed of the first storage area, and further improve the security of the decryption process.

[0041] In some implementations, the SRAM includes multiple independent storage regions; the multiple independent storage regions are electrically connected to the cryptographic acceleration engine via their respective control lines; the first storage region is one of the multiple independent storage regions.

[0042] In this embodiment, since the SRAM includes multiple independent storage areas, and these multiple independent storage areas are electrically connected to the cryptographic acceleration engine via their respective control lines, this can prevent sensitive keys from interfering with each other when concurrent decryption request data occurs. In addition, it can prevent malicious entities from stealing keys across regions by taking advantage of vulnerabilities, thereby improving the security of the decryption process.

[0043] In some implementations, the digital signature token is obtained by asymmetric encryption of a first hash value with a preset first key, wherein the first hash value is the hash value of the concatenated result of the second ciphertext, the preset random number and the timestamp of the first ciphertext; The authentication of the digital signature token using the target hardware includes: The security controller is used to authenticate the legality of the source of the digital signature token to obtain a first authentication result. The security controller has a built-in logic circuit for a verification key corresponding to the preset first key. The security controller is used to authenticate the preset random number included in the digital signature token to obtain a second authentication result; The security controller is used to authenticate the current time of the security controller, the timestamp corresponding to the digital signature token, and a preset time drift range to obtain a third authentication result. The preset time drift range is a preset range of the difference between the current time of the security controller and the timestamp corresponding to the digital signature token. The digital signature token is determined to have passed the authentication of the target hardware based on the first authentication result, the second authentication result, and the third authentication result.

[0044] The first key can be generated from the second key preset in the KMS (e.g., from the high-privilege private key of the KMS). (Generate), or you can directly use the second key. As the first key; The digital signature token can be generated with reference to the following third formula: ; In the third formula, This can represent the digital signature token; It can represent an asymmetric signature function, used to determine the signature based on... Encrypt the hash value of the cascaded concatenation result; This can represent the first key mentioned above; This can represent a cryptographic digest algorithm with collision-resistant properties, such as the 384-bit Secure Hash Algorithm (SHA-384); "It can represent a concatenation symbol, which can concatenate and join binary data blocks; This can represent the result of concatenating the timestamps of the second ciphertext, a preset random number, and the first ciphertext. As can be understood from the third formula above, the digital signature token cryptographically binds the "protected key envelope," the "unique request identifier," and the "request time boundary." The token possesses extremely high specificity: it can only be used to unlock a specific envelope and is valid only within a specific time window.

[0045] The timestamp corresponding to the digital signature token can be the timestamp of the first ciphertext; The authentication of the digital signature token's source legitimacy using the security controller, and the equivalent verification script of the logic circuit corresponding to the preset first key and the verification key, can be: ;in ， It can indicate that through right Functions for performing authentication and verification; This can represent the first key mentioned above; This can represent the aforementioned digital authentication token; The step of using the security controller to authenticate the preset random number included in the digital signature token to obtain a second authentication result can be represented by the following Boolean logic gate equivalent script: ;in, It can represent a preset random number; It can represent a random array that has already been used, not stored in memory as a software array, but as a high-speed anti-collision cache circuit designed based on a Bloom filter inside the controller of the target hardware.

[0046] The authentication process, which utilizes the security controller's current time, the timestamp corresponding to the digital signature token, and a preset time drift range to obtain a third authentication result, can be represented by the following Boolean logic gate equivalent script: ;in, This can represent the current time of the security controller; It can represent the timestamp of the first ciphertext; It can represent a preset time drift range, the specific size of which can be set as needed by those skilled in the art; The second authentication result and the third authentication result can be combined as follows: ; This can be a tamper-proof hardware real-time clock (RTC) powered independently deep within the chip. If an attacker replays old data packets like a recorder, the timestamp will be outdated. If the serial number has been cached and recorded by the hardware, the hardware logic gate will directly output a low-level enable signal (Enable=0), discarding the data directly at the microarchitecture level without throwing out any obvious abnormal signals to the target host, thereby effectively thwarting side-channel probing.

[0047] The step of determining whether the digital signature token passes the authentication of the target hardware based on the first authentication result, the second authentication result, and the third authentication result can be as follows: if all three authentication results indicate that the authentication verification is passed, the digital signature token is determined to have passed the authentication of the target hardware; if any one of the three authentication results fails the authentication verification, the digital signature token is determined to have failed the authentication of the target hardware.

[0048] In this embodiment, the first authentication result, the second authentication result, and the third authentication result are obtained from three aspects: the legality of the source of the digital signature token by the security controller, the preset random number included in the digital signature token, and the difference between the timestamp corresponding to the digital signature token and the current time of the security controller. This determines whether the digital signature token has passed the authentication of the target hardware, which can improve the accuracy of digital token authentication, reduce unauthorized access initiated by malicious entities using illegal tokens, and further improve the security of the decryption process.

[0049] In some embodiments, the method further includes: A communication link built on a peer-to-peer (P2P) communication protocol or a high-speed serial peripheral interconnect bus (PCIe) bypasses the target host and sends the plaintext corresponding to the first ciphertext to the target node.

[0050] The target hardware may further include a trusted output routing module, which is responsible for taking over the plaintext corresponding to the first ciphertext; The communication link built on the P2P communication protocol or PCIe can be the communication link of the trusted output routing module in the target hardware; the plaintext corresponding to the first ciphertext can be pushed to the downstream trusted node (e.g., the frame buffer of the graphics card) through the communication link built on the P2P communication protocol or PCIe, thereby completely bypassing the main memory area of ​​the target host.

[0051] In this embodiment, the communication link built based on the P2P communication protocol or PCIe bypasses the target host and sends the plaintext corresponding to the first ciphertext to the target node. This can reduce the chance of malicious entities stealing the plaintext corresponding to the first ciphertext through the target host and further improve the security of the decryption process.

[0052] In some implementations, please refer to Figure 4 , Figure 4 This is a second flowchart of a decryption method provided in an embodiment of this application, such as... Figure 4 As shown, the decryption method may include the following steps: Step 0: Initialization and Trusted Key Provisioning; An external, absolutely trusted Key Management System (KMS) generates a high-entropy business data encryption key plaintext DEK (i.e., the DEK of the first ciphertext mentioned above) in a secure offline environment. Subsequently, the KMS uses the asymmetric public key publicly available at the time of manufacture of the target hardware to perform an asymmetric envelope encryption operation, generating a key envelope that only the target hardware can decrypt (i.e., the second ciphertext mentioned above). The equivalent operation script for generating the cryptographic envelope can be found in the second formula mentioned above. Meanwhile, to achieve precise control over decryption permissions and strict replay protection, KMS generates a replay protection serial number (Nonce) and an absolute timestamp (Timestamp), and uses its high-privilege private key to generate a digital signature token from the hash value of the concatenated key parameters. The equivalent operation script for digital signature tokens can be found in the third formula. Step 1: The host system initiates a decryption request with authentication parameters. The business process in the host system obtains the ciphertext data Ciphertext, the initialization vector IV, and the additional authentication data AAD (used for anti-tampering verification) and assembles the payload. The equivalent script of the payload format can refer to the first formula above. The host system does not need to (and cannot) understand the specific content of the token. It only acts as a channel deliveryman for the payload, pushing the data to the underlying layer unchanged.

[0053] Step 2: Physical Channel Isolation Transmission and Concurrent Hardware Slot Allocation. The host system injects the payload data stream into the receive FIFO of the secure mailbox via the driver. At this time, the internal hardware scheduler is awakened by a hardware interrupt, scans the current SRAM array, dynamically maps and locks an idle physical slot for this concurrent request. The state of the slot control register immediately transitions, achieving microarchitecture-level concurrent context isolation and completely cutting off the possibility of memory overlap with other decryption tasks.

[0054] Step 3: Completely decouple the underlying authentication and state machine replay protection from host intervention, triggering the hardware terminal to extract authentication parameters. The pure hardware gate array in the security controller takes over the data and performs rigorous dual logical checks: legitimacy tamper-proof verification (verifying whether the signature originates from a trusted KMS): Freshness verification (underlying anti-packet capture and replay core): Hardware-level signature verification and Bloom filters are used to prevent malicious entities from reusing old data packets. Step 4: Physical closed-loop decapsulation of the DEK of the first ciphertext in secure memory. After successful authentication (e.g., Auth_OK=1), the KMU module (Security Gate Controller, also referred to as the Security Controller in this application) reads the absolutely unextractable root key from the eFuse array through internal proprietary hardwiring, decapsulates the second ciphertext, and pushes the DEK of the first ciphertext into the corresponding slot. Since the decrypted plaintext DEK is directly pushed into the key-specific register allocated in Step 2 by hardware instructions only, the address bus of the register set is not open to the outside, and the host's memory management unit (MMU) cannot establish any page table mapping. Even system processes with root privileges cannot cross this silicon-based boundary, achieving true "absolute zero visibility".

[0055] Step 5: Nanosecond-level high-speed AEAD authentication, decryption, and authentication. The cryptographic acceleration engine can read the DEK plaintext, ciphertext, and authentication parameters in the slots in parallel via an internal dedicated data bus with throughput of up to hundreds of GB / s, performing authenticated symmetric decryption operations in pure hardware operators. For example, the original tag carried in the first ciphertext... Compared with locally calculated If a bit flip occurs (meaning the ciphertext has been maliciously tampered with in an untrusted external storage location), the engine will directly block the output and trigger a security exception interrupt. If the verification is completely consistent, the plaintext corresponding to the first ciphertext is temporarily stored in the internal output security register.

[0056] Step 6: Clock-cycle-level instantaneous forced physical overwrite (Zeroization); The decryption pipeline of the code acceleration engine has a hardwired status indicator pin at its end, defined as... The pin level rises from low (0) to high (1) the instant the operation is completed and plaintext is generated; The strict next clock rising edge, which jumps to a high level, does not require waiting for any CPU instructions or software callbacks. The hardware flip-flop directly drives the KMU's clearing and discharging circuit, overwriting the first memory area in the next clock cycle. In traditional security models, after decryption, the system relies on the operating system's garbage collection mechanism or sends specific software instructions to erase the memory. This significant delay in software-level scheduling leaves a fatal exposure window for memory side-channel attacks and cold-start probes. Directly triggering the overwrite instruction through hardware reduces this exposure window and improves the security of the decryption process. Step 7: Decrypting Plaintext with Security Degradation Routing and Trusted P2P Straight-Through Prevention. After the target hardware confirms that the DEK in the target slot has been completely physically destroyed without any residue, the trusted output routing module takes over the destination of the plaintext data. For routine business calculations, the plaintext is pushed into the secure mailbox's send FIFO and returned to the host. For confidential computing streams with extremely high anti-theft requirements (such as decrypting sensitive medical images for artificial intelligence inference calculations), an end-to-end protection strategy can be adopted (such as through P2P straight-through to downstream devices). Through PCIe Transaction Layer Packet (TLP) straight-through technology, plaintext data is directly injected into the secure coprocessor (such as the protected area of ​​a specific graphics processing unit (GPU) memory), making the host's central processing unit and system memory completely "blind spots," achieving closed-loop defense across the entire link and greatly improving the security of the decryption process.

[0057] In some implementations, to verify the security of the decryption method, simulations can be performed against two typical physical attack methods: (1) Cold Boot Attack Simulation: If an attacker freezes the motherboard by spraying liquid nitrogen and forces a restart to read residual physical memory, under the protection of the application, since the DEK plaintext only exists in the SRAM of the Level 1 Cache (L1) inside the SoC chip, and has been decrypted within a few nanoseconds, it is already read by the aforementioned... High-entropy noise completely washes away the data. Even if a liquid nitrogen attack successfully freezes the external DRAM, all that is extracted is meaningless random data.

[0058] (2) Differential Power Analysis (DPA) and Voltage Glitching Inference: If an attacker attempts to reduce the chip's power supply voltage to create operational faults and bypass authentication, the independent voltage monitoring unit built into the hardware security domain in this application can trigger a global non-maskable interrupt (NMI) with the highest priority once it detects a slight threshold fluctuation. Before power failure, it uses the residual power of the backup capacitor to concurrently execute global noise injection leveling instructions for all SRAM storage areas, completely blocking any attempt to extract data using faults.

[0059] In some implementations, to further illustrate the feasibility of the decryption method provided in this application and its flow mechanism in complex business scenarios, the following application examples can be referenced: Suppose a multi-tenant confidential database service is deployed on a cloud server (where the cloud server is the target host, constituting an untrusted domain). Tenants A and B's highly sensitive business data are stored in encrypted form on the cloud drive. The cloud service provider, acting as an untrusted environment, only provides computing power and storage and does not possess any plaintext keys. When tenants A and B simultaneously initiate high-concurrency database field query requests, the cloud concurrently receives tens of thousands of data entries with different encryption keys. and The request decrypts the data. Upon receiving a massive number of requests, the cloud server hardware security chip (i.e., the target hardware, such as a cloud-based smart network interface card (DPU) with integrated HSM or a confidential computing enclave within the central processing unit) implementing the decryption method immediately utilizes a parallel SRAM slot mechanism to simultaneously activate hundreds of SRAM slots. In that instant, each decryption request, within its own independent miniature physical vacuum slot, undergoes a high-speed, uninterrupted lifecycle of "hardware authentication, derivation of a proprietary plaintext DEK, ultra-fast decryption, and clock-level random noise overwriting and destruction." By eliminating the cumbersome operating system kernel / user mode switching (Context Switch) and the extremely time-consuming software memory garbage collection overhead, this database's concurrent throughput (expressed as Queries Per Second, QPS) and response latency are significantly superior to traditional pure software confidential computing solutions. More importantly, even if a malicious high-level administrator within the cloud service provider collaborates with hackers to perform a full memory dump of the entire cloud server with the highest system privileges, or employs a memory probe-based hardware attack, they will absolutely be unable to capture any plaintext DEK keys that have exceeded address limits or remained due to failure to destroy them in time, greatly improving the security of the decryption process.

[0060] It should be noted that the decryption method described above in this application can be executed by an electronic device, that is, all the steps included in the above method are executed by the electronic device, which can be an independent chip, hardware in a server, or a computer or other electronic device.

[0061] See Figure 5 , Figure 5 This is a schematic diagram of the structure of a decryption device provided in an embodiment of this application, as shown below. Figure 5 As shown, the decryption device 500 includes: The acquisition module 501 is used to acquire decryption request data sent by the target host. The decryption request data includes a first ciphertext, a second ciphertext, and a digital signature token of the first ciphertext. The second ciphertext is the encrypted ciphertext of the data encryption key of the first ciphertext. The digital signature token is used to verify the validity of the first ciphertext. The first processing module 502 is used to authenticate the digital signature token using the target hardware. If the digital signature token is authenticated by the target hardware, the target hardware is used to decrypt the second ciphertext according to the root key of the second ciphertext to obtain the data encryption key of the first ciphertext. The data encryption key of the first ciphertext is stored in the first storage area of ​​the static random access memory (SRAM) in the target hardware. The target hardware is a logic circuit that processes the decryption request data. The target hardware is isolated from the target host. The second processing module 503 is used to decrypt the first ciphertext using the target hardware according to the data encryption key of the first ciphertext to obtain the plaintext corresponding to the first ciphertext. The third processing module 504 is used to trigger an erase command on the SRAM using the target hardware, and inject a high-entropy noise stream into the first storage area of ​​the SRAM according to the erase command. The high-entropy noise stream is used to erase the data encryption key of the first ciphertext in the first storage area.

[0062] Optionally, the target hardware further includes: a security controller, a root key array, a key management unit, a cryptographic acceleration engine, and a true random number generator; The security controller is used to authenticate the digital signature token; The root key array is used to store the root key of the second ciphertext; The key management unit is used to read the root key of the second ciphertext in the root key array, decrypt the second ciphertext according to the root key of the second ciphertext to obtain the data encryption key of the first ciphertext, and store the data encryption key of the first ciphertext in the first storage area of ​​the SRAM in the target hardware. The cryptographic acceleration engine is used to decrypt the first ciphertext based on the data encryption key of the first ciphertext; The true random number generator is used to provide a high-entropy noise stream to the first storage area of ​​the SRAM.

[0063] Optionally, the logic circuit of the cryptographic acceleration engine is provided with a status indicator pin at the end; when the first ciphertext is decrypted, the status indicator pin undergoes a level change. The erase instruction of the target hardware on the SRAM is triggered in the next clock cycle after the state change, and the clock cycle is the working clock cycle of the target hardware.

[0064] Optionally, the SRAM includes multiple independent storage regions; the multiple independent storage regions are electrically connected to the cryptographic acceleration engine via their respective control lines; the first storage region is one of the multiple independent storage regions.

[0065] Optionally, the digital signature token is obtained by asymmetric encryption of a first hash value with a preset first key, wherein the first hash value is the hash value of the concatenated concatenation of the second ciphertext, the preset random number and the timestamp of the first ciphertext; The authentication of the digital signature token using the target hardware includes: The security controller is used to authenticate the legality of the source of the digital signature token to obtain a first authentication result. The security controller has a built-in logic circuit for a verification key corresponding to the preset first key. The security controller is used to authenticate the preset random number included in the digital signature token to obtain a second authentication result; The security controller is used to authenticate the current time of the security controller, the timestamp corresponding to the digital signature token, and a preset time drift range to obtain a third authentication result. The preset time drift range is a preset range of the difference between the current time of the security controller and the timestamp corresponding to the first ciphertext. The digital signature token is determined to have passed the authentication of the target hardware based on the first authentication result, the second authentication result, and the third authentication result.

[0066] Optionally, the decryption device 500 further includes a fourth processing module; The fourth processing module is used to bypass the target host and send the plaintext corresponding to the first ciphertext to the target node through a communication link built on a point-to-point P2P communication protocol or a high-speed serial peripheral interconnect bus PCIe.

[0067] The decryption device 500 can implement each process of each embodiment of the above decryption method, with one-to-one correspondence of technical features and can achieve the same technical effect. To avoid repetition, it will not be described again here.

[0068] This application also provides an electronic device, including: a processor, a memory, and a program stored in the memory and executable on the processor. When the program is executed by the processor, it implements the various processes of the above-described decryption method embodiments and achieves the same technical effect. To avoid repetition, it will not be described again here.

[0069] For details, see Figure 6 This application also provides an electronic device, including a bus 601, a transceiver 602, an antenna 603, a bus interface 604, a processor 605, and a memory 606.

[0070] The transceiver 602 is used to acquire decryption request data sent by the target host. The decryption request data includes a first ciphertext, a second ciphertext, and a digital signature token of the first ciphertext. The second ciphertext is the encrypted ciphertext of the data encryption key of the first ciphertext. The digital signature token is used to verify the validity of the first ciphertext. The processor 605 is used to authenticate the digital signature token using the target hardware. If the digital signature token is authenticated by the target hardware, the processor uses the target hardware to decrypt the second ciphertext according to the root key of the second ciphertext to obtain the data encryption key of the first ciphertext. The processor then stores the data encryption key of the first ciphertext in the first storage area of ​​the static random access memory (SRAM) in the target hardware. The target hardware is a logic circuit that processes the decryption request data. The target hardware is isolated from the target host. The target hardware is used to decrypt the first ciphertext using the data encryption key of the first ciphertext to obtain the plaintext corresponding to the first ciphertext; The target hardware triggers an erase command on the SRAM, and a high-entropy noise stream is injected into the first storage area of ​​the SRAM according to the erase command. The high-entropy noise stream is used to erase the data encryption key of the first ciphertext in the first storage area.

[0071] Optionally, the target hardware further includes: a security controller, a root key array, a key management unit, a cryptographic acceleration engine, and a true random number generator; The security controller is used to authenticate the digital signature token; The root key array is used to store the root key of the second ciphertext; The key management unit is used to read the root key of the second ciphertext in the root key array, decrypt the second ciphertext according to the root key of the second ciphertext to obtain the data encryption key of the first ciphertext, and store the data encryption key of the first ciphertext in the first storage area of ​​the SRAM in the target hardware. The cryptographic acceleration engine is used to decrypt the first ciphertext based on the data encryption key of the first ciphertext; The true random number generator is used to provide a high-entropy noise stream to the first storage area of ​​the SRAM.

[0072] Optionally, the logic circuit of the cryptographic acceleration engine is provided with a status indicator pin at the end; when the first ciphertext is decrypted, the status indicator pin undergoes a level change. The erase instruction of the target hardware on the SRAM is triggered in the next clock cycle after the state change, and the clock cycle is the working clock cycle of the target hardware.

[0073] Optionally, the SRAM includes multiple independent storage regions; the multiple independent storage regions are electrically connected to the cryptographic acceleration engine via their respective control lines; the first storage region is one of the multiple independent storage regions.

[0074] Optionally, the digital signature token is obtained by asymmetric encryption of a first hash value with a preset first key, wherein the first hash value is the hash value of the concatenated concatenation of the second ciphertext, the preset random number and the timestamp of the first ciphertext; The authentication of the digital signature token using the target hardware includes: The security controller is used to authenticate the legality of the source of the digital signature token to obtain a first authentication result. The security controller has a built-in logic circuit for a verification key corresponding to the preset first key. The security controller is used to authenticate the preset random number included in the digital signature token to obtain a second authentication result; The security controller is used to authenticate the current time of the security controller, the timestamp corresponding to the digital signature token, and a preset time drift range to obtain a third authentication result. The preset time drift range is a preset range of the difference between the current time of the security controller and the timestamp corresponding to the first ciphertext. The digital signature token is determined to have passed the authentication of the target hardware based on the first authentication result, the second authentication result, and the third authentication result.

[0075] Optionally, the processor 605 is further configured to bypass the target host and send the plaintext corresponding to the first ciphertext to the target node via a communication link constructed based on a point-to-point (P2P) communication protocol or a high-speed serial peripheral interconnect bus (PCIe).

[0076] exist Figure 6 In this document, a bus architecture (represented by bus 601) is used. Bus 601 may include any number of interconnected buses and bridges, linking various circuits including one or more processors represented by processor 605 and memory represented by memory 606. Bus 601 may also link various other circuits such as peripheral devices, voltage regulators, and power management circuits, which are well known in the art and therefore will not be described further herein. Bus interface 604 provides an interface between bus 601 and transceiver 602. Transceiver 602 may be a single element or multiple elements, such as multiple receivers and transmitters, providing a unit for communicating with various other devices over a transmission medium. Data processed by processor 605 is transmitted over a wireless medium via antenna 603, which further receives data and transmits data to processor 605.

[0077] Processor 605 manages bus 601 and general processing, and also provides various functions, including timing, peripheral interface, voltage regulation, power management, and other control functions. Memory 606 can be used to store data used by processor 605 during operation.

[0078] Optionally, the processor 605 may be a central processing unit (CPU), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or a complex programmable logic device (CPLD).

[0079] This application also provides a computer-readable storage medium storing a computer program. When executed by a processor, the computer program implements the various processes of the above-described decryption method embodiments and achieves the same technical effect. To avoid repetition, it will not be described again here. The computer-readable storage medium may be a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk, etc.

[0080] This application also provides a computer program product, including computer instructions. When executed by a processor, the computer instructions implement the various processes of the above-described decryption method embodiments and achieve the same technical effect. To avoid repetition, these will not be described again here.

[0081] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element. Furthermore, it should be noted that the scope of the methods and apparatuses in the embodiments of this application is not limited to performing functions in the order discussed, but may also include performing functions substantially simultaneously or in the reverse order, depending on the functions involved. For example, the described methods may be performed in a different order than described, and various steps may be added, omitted, or combined. Additionally, features described with reference to certain examples may be combined in other examples.

[0082] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) and includes several instructions to cause a terminal (which may be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in the various embodiments of this application.

[0083] The embodiments of this application have been described above with reference to the accompanying drawings. However, this application is not limited to the specific embodiments described above. The specific embodiments described above are merely illustrative and not restrictive. Those skilled in the art can make many other forms under the guidance of this application without departing from the spirit and scope of the claims, and all of these forms are within the protection scope of this application.

Claims

1. A decryption method, characterized in that, The method includes: Obtain decryption request data sent by the target host. The decryption request data includes a first ciphertext, a second ciphertext, and a digital signature token of the first ciphertext. The second ciphertext is the encrypted ciphertext of the data encryption key of the first ciphertext. The digital signature token is used to verify the validity of the first ciphertext. The digital signature token is authenticated using the target hardware. If the digital signature token is authenticated by the target hardware, the target hardware decrypts the second ciphertext using the root key of the second ciphertext to obtain the data encryption key of the first ciphertext. The data encryption key of the first ciphertext is stored in the first storage area of ​​the static random access memory (SRAM) in the target hardware. The target hardware is a logic circuit that processes the decryption request data. The target hardware is isolated from the target host. The target hardware is used to decrypt the first ciphertext using the data encryption key of the first ciphertext to obtain the plaintext corresponding to the first ciphertext; The target hardware triggers an erase command on the SRAM, and a high-entropy noise stream is injected into the first storage area of ​​the SRAM according to the erase command. The high-entropy noise stream is used to erase the data encryption key of the first ciphertext in the first storage area.

2. The method according to claim 1, characterized in that, The target hardware also includes: a security controller, a root key array, a key management unit, a cryptographic acceleration engine, and a true random number generator; The security controller is used to authenticate the digital signature token; The root key array is used to store the root key of the second ciphertext; The key management unit is used to read the root key of the second ciphertext in the root key array, decrypt the second ciphertext according to the root key of the second ciphertext to obtain the data encryption key of the first ciphertext, and store the data encryption key of the first ciphertext in the first storage area of ​​the SRAM in the target hardware. The cryptographic acceleration engine is used to decrypt the first ciphertext based on the data encryption key of the first ciphertext; The true random number generator is used to provide a high-entropy noise stream to the first storage area of ​​the SRAM.

3. The method according to claim 2, characterized in that, The cryptographic acceleration engine has a status indicator pin at the end of its logic circuit; when the first ciphertext is decrypted, the status indicator pin undergoes a level change. The erase instruction of the target hardware on the SRAM is triggered in the next clock cycle after the state change, and the clock cycle is the working clock cycle of the target hardware.

4. The method according to claim 2, characterized in that, The SRAM includes multiple independent storage regions; the multiple independent storage regions are electrically connected to the cryptographic acceleration engine via their respective control lines; the first storage region is one of the multiple independent storage regions.

5. The method according to any one of claims 2 to 4, characterized in that, The digital signature token is obtained by asymmetric encryption of a first hash value with a preset first key. The first hash value is the hash value of the concatenated concatenation of the second ciphertext, the preset random number and the timestamp of the first ciphertext. The authentication of the digital signature token using the target hardware includes: The security controller is used to authenticate the legality of the source of the digital signature token to obtain a first authentication result. The security controller has a built-in logic circuit for a verification key corresponding to the preset first key. The security controller is used to authenticate the preset random number included in the digital signature token to obtain a second authentication result; The security controller is used to authenticate the current time of the security controller, the timestamp corresponding to the digital signature token, and a preset time drift range to obtain a third authentication result. The preset time drift range is a preset range of the difference between the current time of the security controller and the timestamp corresponding to the first ciphertext. The digital signature token is determined to have passed the authentication of the target hardware based on the first authentication result, the second authentication result, and the third authentication result.

6. The method according to any one of claims 1 to 4, characterized in that, The method further includes: The communication link, built on a point-to-point (P2P) communication protocol or the high-speed serial peripheral interconnect bus PCIe, bypasses the target host and sends the plaintext corresponding to the first ciphertext to the target node.

7. A decryption method apparatus, characterized in that, The device includes: The acquisition module is used to acquire decryption request data sent by the target host. The decryption request data includes a first ciphertext, a second ciphertext, and a digital signature token of the first ciphertext. The second ciphertext is the encrypted ciphertext of the data encryption key of the first ciphertext. The digital signature token is used to verify the validity of the first ciphertext. The first processing module is used to authenticate the digital signature token using the target hardware. If the digital signature token is authenticated by the target hardware, the target hardware is used to decrypt the second ciphertext according to the root key of the second ciphertext to obtain the data encryption key of the first ciphertext. The data encryption key of the first ciphertext is stored in the first storage area of ​​the static random access memory (SRAM) in the target hardware. The target hardware is a logic circuit that processes the decryption request data. The target hardware is isolated from the target host. The second processing module is used to decrypt the first ciphertext using the target hardware according to the data encryption key of the first ciphertext to obtain the plaintext corresponding to the first ciphertext. The third processing module is used to trigger an erase command on the SRAM using the target hardware, and inject a high-entropy noise stream into the first storage area of ​​the SRAM according to the erase command. The high-entropy noise stream is used to erase the data encryption key of the first ciphertext in the first storage area.

8. An electronic device, characterized in that, include: A processor, a memory, and a program stored in the memory and executable on the processor, wherein the program, when executed by the processor, implements the steps of the method as described in any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the steps of the method as described in any one of claims 1 to 6.

10. A computer program product, characterized in that, Includes computer instructions that, when executed by a processor, implement the steps of the method as described in any one of claims 1 to 6.

Images