Data protection method, data processing system, and storage medium

Abstract

Provided in the present application are a data protection method, a data processing system, and a storage medium. Data encryption and decryption processes are triggered by means of a first instruction and a second instruction, wherein the encryption process mainly comprises grouping data sources and converting same, and obtaining updated data to serve as an encrypted ciphertext for storage. By means of the encryption method provided in the present application, the difference between processed data sources and data stored in a DFlash, and data features can also be effectively cleaned and updated, and actual data content cannot be seen even if others intentionally read back MCU DFlash data, thereby achieving an encryption protection effect on the data stored in the DFlash. Therefore, sensitive information and confidential data can be effectively protected, thereby encrypting, at an MCU end, the data stored in the DFlash, and also ensuring the real-time performance of an MCU. In addition, original data can be recovered by means of decrypting the read-back data, thereby realizing a decryption processing process of MCU DFlash data, improving the data processing efficiency, and ensuring the security of data transmission between a terminal device and a memory.

Description

Data protection method, data processing system and storage medium Technical Field

[0001] The present application relates to the technical field of data encryption and decryption, and in particular to a data protection method, a data processing system and a storage medium. Background Art

[0002] With the rapid development of cloud computing, artificial intelligence, and the Internet of Things (IoT), the demand for storage in terminal products and servers is increasing. Security-critical applications are placing high demands on data reliability. For example, in current smart automotive applications, DFlash is often used to store user information within the MCU chip inside passenger vehicle ECUs. If this information could be read back by others using common tools, it could pose a security risk and lead to information attacks and damage to the passenger vehicle.

[0003] The current practice is to use specialized information security MCU chips, such as MCU chips with SHE (Hardware Security Extension) functions. However, this will inevitably lead to a significant increase in the cost of large-scale existing mature products. In addition, the performance of ordinary automotive MCUs cannot meet the encryption and decryption operations of open source algorithms such as AES, which will seriously undermine the real-time performance of the MCU and cause the MCU to lose its most important attribute in the ECU. Summary of the Invention

[0004] The present application aims to provide a data protection method, a data processing system and a storage medium to solve the current problem of secure storage and reading of server-side data, thereby improving the reliability of end-to-end data transmission between terminal devices and storage devices.

[0005] In a first aspect, the present application provides a data protection method, which is applied to a storage unit on a vehicle-mounted MCU side, wherein the data protection method includes:

[0006] When the first instruction is triggered, the data source on the target device is obtained.

[0007] The data source is divided into multiple arrays according to the data storage length; each of the arrays contains N metadata.

[0008] A first eigenvalue is calculated based on each adjacent metadata in the array; the first eigenvalue is saved in a storage unit, and when a second instruction is triggered, corresponding metadata is extracted based on the first eigenvalue to restore the data source.

[0009] The data source is at least vehicle configuration parameters, user information and verification information.

[0010] Specifically, the first and second instructions trigger the data encryption and decryption processes, respectively. The encryption process primarily groups and converts data sources, obtaining updated data that is stored as encrypted ciphertext. This effectively protects sensitive and confidential data. Even if unauthorized individuals gain access to the information, they cannot directly access the data source. This ensures data confidentiality, integrity, and security, meeting privacy protection, identity verification, and compliance requirements.

[0011] In this application, the data protection method also includes:

[0012] By real-time monitoring of whether the data source on the target device changes within a preset threshold range; if so, automatically jumping to triggering the first instruction to iteratively update the current first characteristic value and the current data source.

[0013] In this application, before triggering the first instruction, the method further includes:

[0014] Detect the available space of the storage unit and determine whether the available space is within a preset ratio; if so, execute the first instruction; otherwise, do not execute the first instruction, and enter the storage space optimization mode after issuing an abnormal prompt signal.

[0015] Before obtaining the data source on the target device, the method further includes:

[0016] A handshake connection is performed on the target device for identity authentication; if the authentication result is still failed after a preset number of authentication attempts, the current authentication failure information is recorded, a security notification prompt is triggered, and preset security measures are taken to prevent access to the target device.

[0017] The first eigenvalue calculated based on each adjacent metadata in the array includes:

[0018] Starting with the first metadata in the array, set its positive and negative values ​​to 0.

[0019] If the next metadata is greater than the previous metadata, the positive or negative value of the next metadata is set to 0; otherwise, it is set to 1.

[0020] The positive and negative values ​​of all metadata in the array are obtained and recorded in the positive and negative recording unit Dv in the storage unit.

[0021] Starting with the first metadata in the array, the difference between the next data unit and the previous data unit is calculated in sequence, and the calculation result is used as the updated data of the next metadata.

[0022] After all metadata in the array are updated, the new array is saved to the data unit D in the storage unit.i , where D i =D1,D2,...,D N , i=1, 2, ..., N.

[0023] Wherein, the first eigenvalue T=data unit D i + positive and negative recording unit Dv, that is, T=D1,D2,...,D N , Dv.

[0024] The data source is encrypted as described above. When the second instruction is detected, the decryption process begins: extracting the corresponding data unit based on the first characteristic value to restore the data source, specifically:

[0025] Read the first characteristic value and extract the data unit D in the first characteristic value i and positive and negative recording unit Dv.

[0026] The data unit D i The positive and negative record units Dv are written into the processing table, and the first data unit D i Initially, let the first metadata be equal to the first data unit.

[0027] According to the corresponding positive and negative values ​​in the positive and negative recording unit Dv and the previous metadata, the next metadata is calculated in sequence to obtain all the metadata in the array. After the calculation of multiple arrays is completed, all arrays are merged in order to obtain the data source.

[0028] The next metadata is calculated in sequence according to the corresponding positive and negative values ​​in the positive and negative recording unit Dv and the previous metadata, specifically:

[0029] When the positive and negative value is 0, the next metadata is equal to the previous metadata plus the current data unit D i。

[0030] When the positive and negative value is 1, the next metadata is equal to the previous metadata minus the current data unit D i。

[0031] The data decryption process is equivalent to the inverse of the aforementioned data encryption process. In this application, it is preferred to subtract two metadata, calculate the difference, and save the difference as the updated data. Based on the same inventive concept, other calculation methods can also be used to clean metadata during the data encryption and decryption process, such as dividing two metadata, but the present invention is not limited to this.

[0032] In a second aspect, the present application further provides a data processing system, which includes: a data acquisition unit, a cropping unit, an encryption unit and a decryption unit.

[0033] The data acquisition unit is used to acquire a data source on a target device, and divide the data source into multiple arrays according to data storage length via the clipping unit.

[0034] The encryption unit calculates a first characteristic value for each adjacent metadata in the array and stores the first characteristic value in a storage unit.

[0035] The decryption unit is used to read the first characteristic value, extract the data unit Di and the positive and negative recording unit Dv in the first characteristic value to perform data source restoration processing.

[0036] In this application, the data processing system further includes:

[0037] An adaptive processing unit is used to monitor in real time whether the data source on the target device changes within a preset threshold range; if so, it automatically jumps to trigger the first instruction to iteratively update the current first characteristic value and the current data source.

[0038] It should be noted that the system introduces an adaptive processing unit, which is responsible for monitoring changes in data sources in real time and triggering corresponding operations. The adaptive processing unit uses real-time monitoring technology to detect whether the data source on the target device changes within a preset threshold range.

[0039] In this application, the data acquisition unit also includes:

[0040] An identity authentication unit is used to perform a handshake connection on the target device to perform identity authentication before obtaining the data source on the target device.

[0041] If the authentication result still fails after the preset number of times, the current authentication failure information will be recorded, a security notification prompt will be triggered, and preset security measures will be taken to prevent access to the target device.

[0042] The data encryption unit further includes a first processing module and a second processing module.

[0043] The first processing module is used to determine the positive or negative value of each metadata; the second processing module is used to update each metadata in the array.

[0044] The data decryption unit further includes a third processing module.

[0045] The third processing module is used to read the first characteristic value in the storage unit, extract the data unit D in the first characteristic value i And the positive and negative recording units Dv are used to calculate all the metadata in the array and obtain the final data source.

[0046] The data processing system described in this application can also select a suitable encryption algorithm based on requirements and security standards. Common symmetric encryption algorithms include AES, and asymmetric encryption algorithms include RSA, etc. Based on the selected encryption algorithm, a key suitable for encryption and decryption is generated. The key can be a symmetric key or an asymmetric key. Use the selected encryption algorithm and the generated key to encrypt the data that the MCU needs to store in DFlash. The data can be divided into appropriate blocks and then encrypted block by block. The encrypted data is stored in DFlash. Ensure that the data is appropriately divided and represented in a storable format before storage so that the subsequent decryption process can correctly restore the data, thereby maintaining the security of the encryption key and ensuring that only authorized people or devices can obtain the key.

[0047] When the encrypted data is needed, the data stored in DFlash is decrypted using the same key and encryption algorithm. The decrypted data can be used for normal MCU operation and processing. To further ensure data security, other security mechanisms such as authentication and digital signatures can be added to provide more comprehensive protection.

[0048] This application encrypts data that the MCU needs to store in DFlash. The encrypted data differs in both content and length from the original data. Even if someone intentionally reads back the MCU DFlash data, the actual data content remains undetectable, effectively protecting the data stored in DFlash. Decrypting the readback data also restores the original data. Furthermore, the data processing system in this application can achieve efficient encryption and decryption without incurring any additional costs, meeting the security requirements for MCU-stored DFlash data in certain passenger vehicle ECUs.

[0049] In a third aspect, the present application further provides a computer-readable storage medium, on which computer-readable instructions for encrypting plaintext data are stored, and the computer-readable instructions implement the method described above when executed by one or more processors.

[0050] Compared with the prior art, this application has at least the following beneficial effects:

[0051] By cutting the data source into multiple arrays and then performing encryption calculation on the metadata in each data, we can obtain the data unit D i The corresponding ciphertext is generated by the positive and negative recording unit Dv. This allows the data that the MCU needs to store in DFlash to be encrypted, meeting the requirements of existing ordinary automotive MCUs for encryption and decryption of algorithms such as AES, ensuring the real-time performance of the MCU.

[0052] Furthermore, the encryption and decryption methods provided in this application effectively cleanse and update the differences between the processed data source and the data stored on the DFlash, as well as the data characteristics. Even if someone intentionally reads back the MCU DFlash data, the actual data content cannot be revealed, thus providing encryption and protection for the DFlash-stored data. Furthermore, the original data can be restored by decrypting the readback data, thus implementing the encryption and decryption process for the MCU DFlash data, improving data processing efficiency and ensuring the security of data transmission between the terminal device and the storage. BRIEF DESCRIPTION OF THE DRAWINGS

[0053] FIG1 is a flow chart of a data protection method according to the present application.

[0054] FIG2 is a schematic diagram of the data encryption process shown in this application.

[0055] FIG3 is a schematic diagram of the data decryption process shown in this application.

[0056] FIG4 is a schematic diagram of the data protection system structure shown in this application. DETAILED DESCRIPTION

[0057] The following will be combined with the drawings in the embodiments of this application to clearly and completely describe the technical solutions in the embodiments of this application. Obviously, the embodiments described are only part of the embodiments of this application, not all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of this application.

[0058] Example 1:

[0059] Please refer to Figure 1, which is a flow chart of a data protection method provided in an embodiment of the present application. The data encryption and decryption processing methods used in the data protection of the embodiment of the present application can be applied to computer devices, including but not limited to vehicle-mounted terminals, smart phones, physical servers, and cloud servers.

[0060] As shown in FIG1 , the data protection method of this embodiment includes: data encryption and data decryption processes.

[0061] The data encryption process is implemented as follows, as shown in Figure 2:

[0062] Step 1: triggering a first instruction, where the first instruction is a data storage or write instruction.

[0063] It should be noted that, in this embodiment, before triggering the first instruction, the following steps are also included:

[0064] Detect the available space of the storage unit and determine whether the available space is within a preset ratio; if so, execute the first instruction; otherwise, do not execute the first instruction, and enter the storage space optimization mode after issuing an abnormal prompt signal.

[0065] Preferably, the preset ratio can be customized to be greater than 20%. For example, if the available space is detected to be 54%, the operation of triggering the first instruction will continue. If the available space is detected to be 18%, a warning or abnormality can be first issued or recorded, such as through a text reminder on the display end or a voice prompt on the audio speaker end, and then the storage space cleaning or optimization operation will be automatically executed to ensure sufficient space for the operations required by the data protection method. Optimization and cleaning can also be manually selected, and the present invention is not limited to this.

[0066] Preferably, the storage space optimization mode may include clearing temporary data, compressing stored data, etc., to release storage space or improve storage efficiency.

[0067] The above-described embodiments can effectively ensure the rational use of storage space and prevent excessive use of storage resources. By detecting and determining available space, the system ensures that sufficient storage resources are available before performing data storage or write operations. Determining whether available space is within a preset ratio helps prevent excessive use of storage resources and enables the system to utilize storage space more intelligently. When entering storage space optimization mode, the system can respond in real time to insufficient storage space and take appropriate measures to ensure the normal operation of the system. In storage space optimization mode, the system can automatically perform optimization operations, improving the system's ability to automatically manage storage resources.

[0068] Through timely storage space management and exception handling, the system can run more stably and avoid data storage failure or system crash caused by insufficient storage space.

[0069] In this embodiment, before obtaining the data source on the target device, the method further includes:

[0070] A handshake connection is performed on the target device for identity authentication; if the authentication result is still failed after a preset number of authentication attempts, the current authentication failure information is recorded, a security notification prompt is triggered, and preset security measures are taken to prevent access to the target device.

[0071] Preferably, the handshake connection may be implemented in the following ways, but is not limited thereto.

[0072] SSL / TLS handshake: Uses Secure Sockets Layer (SSL) or Transport Layer Security (TLS) to establish a secure connection and verify the identities of both parties using certificates.

[0073] Digital certificates: The target device and the system each hold their own digital certificates. During the handshake process, both parties exchange and verify the certificates to ensure the legitimacy of their identities.

[0074] API Key: An encrypted API key is pre-shared between the two parties. During the handshake process, both parties use this key for authentication.

[0075] This embodiment can effectively prevent unauthorized access by ensuring the safety and reliability of the handshake process.

[0076] It should be noted that each time identity verification fails, the system records the number of failures and compares it with a preset number of failures. If the number of failures does not reach the preset number, the system continues to allow identity verification. The preset number of failures can be, but is not limited to, three.

[0077] If the number of failures reaches the preset number, the system will record the details of the current authentication failure, including the time of failure, the source of authentication, etc. The system will trigger a security notification to notify the relevant security team or system administrator so that they can respond to the authentication failure in a timely manner.

[0078] Preferably, in the event of identity verification failure, the system will take pre-set security measures, such as:

[0079] Temporarily lock access to the target device, preventing further authentication attempts. Trigger further authentication processes, such as requiring user confirmation via alternative authentication methods. Actively disconnect the target device to ensure secure isolation.

[0080] By recording failure information, triggering security notifications, and taking security measures, this embodiment enhances the system's defenses against malicious authentication attempts and reduces unauthorized access. The triggering of security notifications enables system administrators to understand authentication failures in real time, enabling them to quickly take necessary countermeasures. This limits the number of authentication failures, effectively preventing brute-force password cracking attacks and improving system security.

[0081] Taking pre-defined security measures, such as locking the device or requiring additional authentication, helps proactively prevent potential malicious access. Logging details of authentication failures facilitates subsequent audits and analysis to identify potential security threats and vulnerabilities.

[0082] Step 2: Get the data source on the target device.

[0083] Data sources may include vehicle configuration data such as vehicle model, vehicle identification number (VIN), vehicle configuration options, etc.; user data such as seat adjustment, audio settings, air conditioning settings, etc. according to user personal preferences; security-related data such as vehicle anti-theft settings, security policies, etc.

[0084] In passenger vehicle ECUs (electronic control units), the MCU (microcontroller unit) chip typically uses DFlash (Data Flash) to store user information. DFlash is a non-volatile memory that maintains data integrity even in power-off situations and is often used to store critical information and configuration data. DFlash offers fast write and erase speeds, making it suitable for frequently modified data.

[0085] Step 3: Divide the data source into multiple arrays according to the data storage length; each array contains N metadata;

[0086] Specifically: First, determine the length of the stored data, len, and the number of differences to generate, i. Calculate the difference size, diff. You can also determine it based on specific needs: diff = len / i. Create a uint8 array of length i and fill the array with the difference diff. For example, in Python, you can use the following code:

[0087] result = []

[0088] diff = len / i

[0089] for j in range(i):

[0090] result.append(diff).

[0091] Thus, i identical differences will be stored in the result array.

[0092] In this embodiment, the length of the result array can also be determined to be (len / 8+i). If len and i are integer types, integer division and addition operations can be directly performed to obtain the length of the result array, and a uint8 array with a length of (len / 8+i) is created to store the difference. For example, in Python, the following code can be used to create and initialize the array:

[0093] result = [0] * (int(len / 8) + i).

[0094] Based on the specific difference algorithm and data source, the difference is calculated and filled into the result array.

[0095] If the required difference is fixed, you can use a loop or direct calculation to fill the array. For example, you can use the following code to fill the fixed difference into the array:

[0096] diff = 10 # Assume the difference is 10

[0097] for j in range(len(result)):

[0098] result[j] = diff.

[0099] Finally, the resulting array is returned or processed further.

[0100] Step 4: Calculate a first eigenvalue based on each adjacent metadata in the array; and save the first eigenvalue to a storage unit.

[0101] The entire data encryption process is thus completed. When the first characteristic value stored in the storage unit is used to trigger the second instruction, the corresponding metadata is extracted according to the first characteristic value to restore the data source, that is, the data decryption process is entered.

[0102] In this embodiment, the data protection method may further include:

[0103] By real-time monitoring of whether the data source on the target device changes within a preset threshold range; if so, automatically jumping to triggering the first instruction to iteratively update the current first characteristic value and the current data source.

[0104] It's important to note that the system uses real-time monitoring technology to continuously detect changes in the data source on the target device. This can be done by comparing the current data source with previously saved data sources. If a change is detected and falls within a preset threshold, the system determines that the data source needs to be updated.

[0105] Next, the first instruction is automatically triggered, performing a data storage or write operation to obtain the latest data source. During the data source reacquisition process, the system recalculates the first feature value to ensure it reflects the latest data structure and content. The newly acquired data source replaces the original one, ensuring the system uses the most up-to-date data.

[0106] Through real-time monitoring and iterative updates, this embodiment enables the system to protect data on target devices in real time, promptly responding to data changes and enhancing the system's dynamic adaptability. By iteratively updating the current data source, the system ensures data consistency and prevents the use of outdated data for encryption and protection operations. Timely data source updates reduce errors and delays caused by data lag, improving the accuracy of data protection methods.

[0107] In dynamic environments, such as those with in-vehicle MCUs, data sources can change frequently. Real-time monitoring and iterative updates enable the system to better adapt to dynamic changes and improve system robustness. By automatically triggering the first instruction and update process, the system automates data protection operations, reducing the burden of manual intervention on administrators.

[0108] In summary, the real-time monitoring and iterative update mechanism of this embodiment makes the data protection method more intelligent and real-time, and ensures that the system can effectively protect data in a dynamic environment.

[0109] In this embodiment, the data source is at least vehicle configuration parameters, user information and verification information.

[0110] In this embodiment, the encryption process primarily groups and converts data sources, obtaining updated data that is stored as encrypted ciphertext. This effectively protects sensitive and confidential data. Even if unauthorized individuals gain access to the information, they cannot directly access the data source, ensuring data confidentiality, integrity, and security to meet privacy protection, identity verification, and regulatory compliance requirements.

[0111] In this embodiment, the first eigenvalue calculated based on each adjacent metadata in the array includes:

[0112] Starting with the first metadata in the array, set its positive and negative values ​​to 0.

[0113] If the next metadata is greater than the previous metadata, the positive and negative values ​​of the next metadata are set to 0.

[0114] If the next metadata is less than or equal to the previous metadata, the positive and negative values ​​of the next metadata are set to 1.

[0115] The positive and negative values ​​of all metadata in the array are obtained and recorded in the positive and negative recording unit Dv in the storage unit.

[0116] Starting with the first metadata in the array, the difference between the next data unit and the previous data unit is calculated in sequence, and the calculation result is used as the updated data of the next metadata.

[0117] After all metadata in the array are updated, the new array is saved to the data unit D in the storage unit. i , where D i =D1,D2,...,D N , i=1, 2, ..., N;

[0118] Wherein, the first eigenvalue T=data unit D i + positive and negative recording unit Dv, that is, T=D1,D2,...,DN , Dv.

[0119] In this embodiment, for better illustration of the encryption process, for example:

[0120] S1: Generate a difference positive and negative recording unit Dv according to the length of the stored data:

[0121] The length of the stored data is len, and a (uint8) difference positive and negative recording unit Dv with a length of (len / 8 + i) is created.

[0122] If (len%8) is 0, set i = 0.

[0123] If (len%8) is not 0, set i = 1.

[0124] S2: Process the first data D1:

[0125] Do not process D1, obtain D[1], and record 0 in the first bit1 of the difference positive and negative recording unit.

[0126] S3: Process the second data D2:

[0127] If (D2 >= D1), perform (D2 - D1) processing, obtain D[2], and record 0 in the second bit2 of the difference positive and negative recording unit.

[0128] If (D2 < D1), perform (D1 - D2) processing, obtain D[2], and record 1 in the second bit2 of the difference positive and negative recording unit.

[0129] Sn: Process the nth data Dn (n = len):

[0130] If (Dn >= Dn-1), perform (Dn - Dn-1) processing, obtain D[n], and record 0 in the nth bitn of the difference positive and negative recording unit.

[0131] If (Dn < Dn-1), perform (Dn-1 - Dn) processing, obtain D[n], and record 1 in the nth bitn of the difference positive and negative recording unit.

[0132] After encrypting the stored data (D1 ~ Dn; n = len) through the above steps, the encrypted data (D[1]~D[n]~ Dv; length = len + (len / 8 + i)) is obtained.

[0133] After completing the encryption of the data source through the above steps, when the second instruction is detected, it enters the decryption process: extract the corresponding data unit according to the first eigenvalue to restore the data source. Specifically, as shown in Figure 3:

[0134] The first step: Read the first eigenvalue.

[0135] Step 2: Extract the data unit D in the first eigenvalue i and positive and negative recording unit Dv.

[0136] Step 3: The data units D i The positive and negative record units Dv are written into the processing table, and the first data unit D i Initially, let the first metadata be equal to the first data unit.

[0137] Step 4: Calculate the next metadata in sequence according to the corresponding positive and negative values ​​in the positive and negative recording unit Dv and the previous metadata to obtain all metadata in the array.

[0138] Step 5: After the calculation of the plurality of arrays is completed, all the arrays are merged in order to obtain the data source.

[0139] The next metadata is calculated in sequence according to the corresponding positive and negative values ​​in the positive and negative recording unit Dv and the previous metadata, specifically:

[0140] When the positive and negative value is 0, the next metadata is equal to the previous metadata plus the current data unit D i；

[0141] When the positive and negative value is 1, the next metadata is equal to the previous metadata minus the current data unit D i。

[0142] In this embodiment, in order to better illustrate the encryption process, for example:

[0143] S1: Read back data from DFlash according to the length = len + (len / 8+i), where D[1]~D[len] are encrypted data, and D[len+1] to D[len+(len / 8+i)] are the data of the difference positive and negative recording unit Dv.

[0144] If (len%8) is 0, treat i=0.

[0145] If (len%8) is not 0, treat i=1.

[0146] S2: Processing of the first data D[1]:

[0147] D[1] is not processed, and D1 is obtained.

[0148] S3: Processing of the second data D[2]:

[0149] If the second bit 2 of the difference positive or negative recording unit is 0, perform D[1]+D[2] processing to obtain D2.

[0150] If the second bit2 of the difference positive or negative recording unit is set to 1, perform D[1]-D[2] processing to obtain D2.

[0151] Sn: Processing of the nth data Dn (n=len):

[0152] If the nth bit n of the difference recording unit is 0, perform D[n-1]+D[n] processing to obtain Dn.

[0153] If the difference is positive or negative, the nth bit n of the recording unit is recorded as 1, and D[n-1]-D[n] is processed to obtain Dn.

[0154] After the above steps, the read-back data is decrypted and the decrypted data (D1~Dn; length = len) is obtained.

[0155] The data decryption process is equivalent to the inverse of the aforementioned data encryption process. In this application, it is preferred to subtract two metadata, calculate the difference, and save the difference as the updated data. Based on the same inventive concept, other calculation methods can also be used to clean metadata during the data encryption and decryption process, such as dividing two metadata, but the present invention is not limited to this.

[0156] Example 2:

[0157] 4 , the present invention further provides a data processing system, the data processing system comprising: a data acquisition unit, a cropping unit, an encryption unit and a decryption unit;

[0158] The data acquisition unit is used to acquire a data source on a target device, and divide the data source into a plurality of arrays according to a data storage length via the cropping unit;

[0159] The encryption unit calculates a first characteristic value for each adjacent metadata in the array and stores the first characteristic value in the storage unit;

[0160] The decryption unit is configured to read the first eigenvalue and extract the data unit Di and the positive and negative record unit Dv from the first eigenvalue to restore the data source. The calculation and storage of the first eigenvalue can be used to verify the integrity of the data, ensuring that the data has not been tampered with or damaged during transmission or storage.

[0161] The entire system processes and protects data on the target device. Through the processes of clipping, encryption, and decryption, data security is ensured, and data can be restored when needed. The encryption unit calculates the first eigenvalue of adjacent elements in each array and stores it in encrypted form, effectively protecting data from unauthorized access and information leakage.

[0162] By dividing the data source into multiple arrays using the cropping unit, larger data can be processed in blocks, improving data processing efficiency. The decryption unit, on the other hand, reads the stored first eigenvalue and extracts the data units and positive and negative record units to restore the data source. During the encryption and decryption process, sensitive information such as the data units Di and positive and negative record units Dv is processed only within the decryption unit, enhancing data privacy protection.

[0163] In this embodiment, the data processing system may further include:

[0164] An adaptive processing unit is used to monitor in real time whether the data source on the target device changes within a preset threshold range; if so, it automatically jumps to trigger the first instruction to iteratively update the current first characteristic value and the current data source.

[0165] It should be noted that the system introduces an adaptive processing unit, which is responsible for monitoring changes in data sources in real time and triggering corresponding operations. The adaptive processing unit uses real-time monitoring technology to detect whether the data source on the target device changes within a preset threshold range.

[0166] If a change in the data source is detected and the change is within a preset threshold, the adaptive processing unit determines that the data source needs to be updated. The adaptive processing unit automatically triggers the first instruction, performing a data storage or write operation, to obtain the latest data source. During the process of reacquiring the data source, the adaptive processing unit recalculates the first eigenvalue to ensure it reflects the latest data structure and content. The newly acquired data source replaces the original data source, ensuring that the system uses the most up-to-date data.

[0167] In this embodiment, the adaptive processing unit makes the system more dynamically adaptable, automatically adjusting and updating according to real-time changes in data sources, enhancing the system's flexibility. Through the adaptive processing unit's real-time monitoring and iterative updates, the system can promptly respond to changes in data on target devices, achieving real-time data protection. The introduction of the adaptive processing unit reduces the burden of manual intervention on administrators, allowing the system to autonomously perform data protection operations.

[0168] In dynamic environments, data sources can change frequently. The adaptive processing unit improves the system's robustness to these dynamic changes, ensuring the effectiveness of data protection methods. The adaptive processing unit's automatic triggering makes the data processing system more automated, helping to address complex data protection needs.

[0169] In summary, the introduction of the adaptive processing unit into the data processing system makes the system more intelligent and flexible, and can better adapt to the dynamic changes of the data source on the target device.

[0170] In this embodiment, the data acquisition unit further includes:

[0171] An identity authentication unit is used to perform a handshake connection on the target device to perform identity authentication before obtaining the data source on the target device.

[0172] If the authentication result still fails after the preset number of times, the current authentication failure information will be recorded, a security notification prompt will be triggered, and preset security measures will be taken to prevent access to the target device.

[0173] It should be noted that the authentication unit first performs a handshake connection with the target device to establish a communication channel. This can use a security protocol or encryption algorithm to ensure the confidentiality and integrity of the communication.

[0174] After a successful handshake connection, the authentication unit will perform the authentication process. This may involve exchanging encryption keys, certificate verification, or other security mechanisms to ensure that the target device has the legitimate identity.

[0175] This embodiment also provides a preset number of authentication attempts, allowing a certain number of authentication attempts. If authentication succeeds within the preset number of attempts, data source acquisition is allowed to proceed; if authentication fails, the failure is recorded. If authentication fails after the preset number of attempts, the authentication unit triggers a security notification. This can be an alarm, log entry, or other form of notification to inform relevant personnel or system administrators of a potential security issue.

[0176] At the same time, the authentication unit will take preset security measures, such as blocking access to the target device or taking other restrictive measures to ensure the security of the system.

[0177] The authentication unit in this embodiment improves system security through a handshake connection and an effective authentication mechanism, preventing unauthorized devices from accessing sensitive data. The preset number of authentications and security notification prompt mechanism help to promptly detect authentication anomalies. By recording failure information and triggering security notifications, the system can take timely responses. The preset security measures of the authentication unit can prevent malicious attacks, such as brute force authentication attempts. Blocking access to the target device can effectively mitigate potential threats. Recording authentication failure information facilitates security audits and investigations to understand potential security issues and take corrective measures.

[0178] In summary, the authentication unit plays a key role in the entire data protection process, ensuring that only devices with valid authentication can access and operate sensitive data sources.

[0179] The data encryption unit further includes a first processing module and a second processing module;

[0180] The first processing module is used to determine the positive or negative value of each metadata;

[0181] The second processing module is used to update each metadata in the array.

[0182] The data decryption unit further includes a third processing module;

[0183] The third processing module is used to read the first eigenvalue in the storage unit, extract the data unit Di and the positive and negative recording unit Dv in the first eigenvalue, so as to calculate all metadata in the array and obtain the final data source.

[0184] This application encrypts data that the MCU needs to store in DFlash. The encrypted data differs in both content and length from the original data. Even if someone intentionally reads back the MCU DFlash data, the actual data content remains undetectable, effectively protecting the data stored in DFlash. Decrypting the readback data also restores the original data. Furthermore, the data processing system in this application can achieve efficient encryption and decryption without incurring any additional costs, meeting the security requirements for MCU-stored DFlash data in certain passenger vehicle ECUs.

[0185] Example 3:

[0186] The present invention also provides a computer-readable storage medium, on which computer-readable instructions for encrypting plaintext data are stored. When the computer-readable instructions are executed by one or more processors, the method described above is implemented.

[0187] The computer-readable storage medium can be configured in any computer device, which can be a computing device such as a smart phone, tablet computer, desktop computer and cloud server, and can also be a vehicle-mounted terminal or control system, for example, and can also include input and output devices, network access devices, etc.

[0188] The processor may be a central processing unit (CPU), other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor. The memory is used to store an operating system, application programs, a boot loader, data, and other programs, such as the program code of the computer program. The memory may also be used to temporarily store data that has been output or is about to be output.

[0189] The data processing system described in the present invention can also select a suitable encryption algorithm according to needs and security standards. Common symmetric encryption algorithms include AES, while asymmetric encryption algorithms include RSA, etc. Based on the selected encryption algorithm, a key suitable for encryption and decryption is generated. The key can be a symmetric key or an asymmetric key. Use the selected encryption algorithm and the generated key to encrypt the data that the MCU needs to store in DFlash. The data can be divided into appropriate blocks and then encrypted block by block. The encrypted data is stored in DFlash. Ensure that the data is properly divided and represented in a storable format before storage so that the subsequent decryption process can correctly restore the data, thereby maintaining the security of the encryption key and ensuring that only authorized people or devices can obtain the key. When the encrypted data needs to be used, the same key and encryption algorithm are used to decrypt the data stored in DFlash. The decrypted data can be used for normal operation and processing of the MCU. In order to further ensure the security protection of the data, other security mechanisms such as identity authentication, digital signatures, etc. can also be added to provide more comprehensive protection.

[0190] In several embodiments provided in the present application, it is understood that each box in the flow chart or block diagram can represent a part of a module, program segment or code, and the part of the module, program segment or code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in an order different from that marked in the accompanying drawings. For example, two consecutive boxes can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, which depends on the functions involved.

[0191] If the functions are implemented in the form of software function modules and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes a number of instructions for enabling a computer device to execute all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, and other media that can store program codes.

[0192] The specific embodiments described above further illustrate the objectives, technical solutions, and beneficial effects of this application. It should be understood that the above descriptions are merely specific embodiments of this application and are not intended to limit the scope of protection of this application. In particular, it should be noted that any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of this application by those skilled in the art should be included within the scope of protection of this application.

Claims

1. A data protection method, characterized in that: The data protection method for the storage unit applied to the vehicle MCU includes: Trigger the first instruction to obtain the data source on the target device; Dividing the data source into a plurality of arrays according to the data storage length; each of the arrays contains N metadata; A first eigenvalue is calculated according to each adjacent metadata in the array; the first eigenvalue is saved in a storage unit, and when a second instruction is triggered, corresponding metadata is extracted according to the first eigenvalue for restoring the data source.

2. The data protection method according to claim 1, characterized in that: The data protection method further includes: Only when the data source on the target device changes within a preset threshold range through real-time monitoring, it automatically jumps to trigger the first instruction to iteratively update the current first characteristic value and the current data source.

3. The data protection method according to claim 2, characterized in that: Before triggering the first instruction, the method further includes: detecting the available space of the storage unit, and determining whether the available space is within a preset ratio; If so, the first instruction is executed; otherwise, the first instruction is not executed, and the storage space optimization mode is entered after an abnormal prompt signal is issued.

4. A data protection method according to claim 3, characterized in that: Before obtaining the data source on the target device, the method further includes: Performing a handshake connection with the target device for identity authentication; If the authentication result is still failed after a preset number of identity authentication attempts, the current identity authentication failure information will be recorded, a security notification prompt will be triggered, and preset security measures will be taken to prevent access to the target device.

5. A data protection method according to claim 4, characterized in that: The first eigenvalue is calculated according to each adjacent metadata in the array, comprising: Starting with the first metadata in the array, set its positive and negative values ​​to 0; If the next metadata is greater than the previous metadata, the positive and negative values ​​of the next metadata are set to 0; otherwise, they are set to 1; The positive and negative values ​​of all metadata in the array are obtained and recorded in the positive and negative recording unit Dv in the storage unit.

6. A data protection method according to claim 5, characterized in that: The first eigenvalue calculated according to each adjacent metadata in the array further includes: Starting with the first metadata in the array, the difference between the next data unit and the previous data unit is calculated in sequence, and the calculation result is used as the updated data of the next metadata; After all metadata in the array is updated, the new array is saved to the data unit Di in the storage unit, where Di=D1, D2, ..., DN, i=1, 2, ..., N; The first characteristic value T=data unit Di+positive and negative recording unit Dv.

7. A data protection method according to claim 6, characterized in that: The extracting of the corresponding data unit according to the first characteristic value for restoring the data source is specifically: Reading the first characteristic value, extracting the data unit Di and the positive and negative recording unit Dv in the first characteristic value; Write the data unit Di and the positive and negative record units Dv into the processing table respectively, starting from the first data unit Di in the array, and set the first metadata equal to the first data unit; According to the corresponding positive and negative values ​​in the positive and negative recording unit Dv and the previous metadata, the next metadata is calculated in sequence to obtain all the metadata in the array. After the calculation of multiple arrays is completed, all arrays are merged in order to obtain the data source.

8. A data protection method according to claim 7, characterized in that: The next metadata is calculated in sequence according to the corresponding positive and negative values ​​in the positive and negative recording unit Dv and the previous metadata, specifically: When it is determined that the positive and negative value is 0, the next metadata is equal to the previous metadata plus the current data unit Di; When it is determined that the positive and negative value is 1, the next metadata is equal to the previous metadata minus the current data unit Di.

9. A data protection method according to claim 8, characterized in that: The data source is at least vehicle configuration parameters, user information and verification information.

10. A data processing system, characterized in that: The data processing system comprises: a data acquisition unit, a cropping unit, an encryption unit and a decryption unit; The data acquisition unit is used to acquire a data source on a target device, and divide the data source into a plurality of arrays according to a data storage length via the clipping unit; The encryption unit calculates a first characteristic value for each adjacent metadata in the array and stores the first characteristic value in the storage unit; The decryption unit is used to read the first characteristic value, extract the data unit Di and the positive and negative recording unit Dv in the first characteristic value to perform data source restoration processing.

11. The data processing system according to claim 10, characterized in that: The data processing system further comprises: An adaptive processing unit, the adaptive processing unit is used to monitor in real time whether the data source on the target device changes within a preset threshold range; If so, the process automatically jumps to triggering the first instruction to iteratively update the current first characteristic value and the current data source.

12. The data processing system according to claim 11, characterized in that: The data acquisition unit also includes: An identity authentication unit, the identity authentication unit being used to perform a handshake connection on the target device for identity authentication before acquiring the data source on the target device; If the authentication result is still failed after a preset number of identity authentication attempts, the current identity authentication failure information will be recorded, a security notification prompt will be triggered, and preset security measures will be taken to prevent access to the target device.

13. The data processing system according to claim 12, characterized in that: The data encryption unit also includes a first processing module and a second processing module; The first processing module is used to determine the positive and negative values ​​of each metadata; The second processing module is used for updating each metadata in the array.

14. The data processing system according to claim 13, characterized in that: The data decryption unit also includes a third processing module; The third processing module is used to read the first eigenvalue in the storage unit, extract the data unit Di and the positive and negative recording unit Dv in the first eigenvalue, so as to calculate all metadata in the array and obtain the final data source.

15. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-readable instructions for encrypting plaintext data, and when the computer-readable instructions are executed by one or more processors, the method according to any one of claims 1 to 9 is implemented.

Images