CN106301774B - Security chip, encryption key generation method and encryption method thereof - Google Patents

Abstract

The present invention provides a kind of safety chip, including primary processor, outer memory module and encryption/decryption module, and the encryption/decryption module includes algoritic module, storage inside module and control module.Dedicated encryption/decryption module is arranged by portion in the chip to manage key and enciphering and deciphering algorithm in the present invention.The encryption/decryption module has hardware random number, by generating unique root key of the random number as chip in production process, is stored in individual storage region, which can only be used by encryption/decryption module, and primary processor can not read the root key.The encryption key generation method and encryption method of safety chip provided by the invention, it requires when subsequent applications generate key using encryption/decryption module, and there is root key to carry out encryption storage to the key of generation automatically, guarantee that the data of every terminal can only be read by the terminal, substantially increases the safety of terminal.

Description

Security chip, encryption key generation method and encryption method thereof

technical field

The invention relates to the field of secure communication, in particular to a security chip, an encryption key generation method and an encryption method thereof.

Background technique

The current privacy and security shortcomings exposed by Apple and Samsung have opened up a potential market for domestic encrypted mobile phones. For a while, security has also become the focus of domestic mobile phone manufacturers' plans to change, and has become a feature of domestic mobile phones. Specifically, it mainly involves two aspects: First, the information security issues exposed by the Android system have been paid more and more attention by people; second, based on national security and network security, some cities require officials to switch to domestic brand smart phones. Mobile phones, which means that more units will join the ranks of mobile phone security in the future. Since foreign manufacturers released security mobile phone strategies one after another, domestic mobile phone manufacturers have turned to upgrade the security level and turn to the security encryption market. This is mainly because the information security of smartphones has attracted more and more attention from users and the industry.

The key to the current secure mobile phone strategy is encryption technology, which can be implemented in two main forms: software encryption and hardware encryption. Software encryption is mainly aimed at the application layer. The password is stored in the application space, and the encryption algorithm is implemented by software. Software encryption is relatively easy to deploy and does not depend on specific hardware. Hardware encryption mainly depends on the hardware algorithm accelerator. The key can be stored in the external storage space or in the eFuse of the chip. The encryption efficiency is relatively high and it depends on the hardware platform.

The root of encryption lies in the protection of passwords. If the passwords are leaked, it will cause immeasurable losses. Currently commercial encrypted terminal keys can be customized by users or generated by hardware random numbers and stored in plaintext on-chip or off-chip memory. If the terminal is rooted, malicious software can easily obtain the key. Therefore, the security of the key of the existing encryption technology is still not high enough, and the phenomenon of malicious software stealing the user's key occurs from time to time.

Contents of the invention

In order to solve the problems existing in the prior art, the present invention provides a security chip, including a main processor, an external storage module and an encryption and decryption module; the encryption and decryption module includes:

An algorithm module, used to generate an initial key for encrypting data according to an encryption algorithm;

an internal storage module containing a root key, said internal storage module being accessible only by the control module;

The control module is used to call the root key to the algorithm module to encrypt the initial key, generate an encryption key and store it in the external storage module; the control module is also used to call the The root key is sent to the algorithm module to decrypt the encrypted key in the external storage module and restore it to the initial key.

Optionally, the initial key includes a public key and a private key, and only the private key is encrypted in the step of encrypting the initial key, and only the private key is encrypted in the step of decrypting the encryption key. key to decrypt.

Optionally, the algorithm module includes an RSA module, and the initial key is generated by the RSA module.

Optionally, the algorithm module includes an AES module, configured to encrypt the initial key according to the root key.

Optionally, the security chip further includes a random number generating module, configured to generate a random number as the root key.

Optionally, the control module includes a status register, which is used to indicate that the root key has been generated by initializing a status flag.

The present invention also provides a method for generating an encryption key for a security chip, comprising the following steps:

The main processor sends an encryption key generation request to the encryption and decryption module;

The control module calls the algorithm module, and the algorithm module generates an initial key;

The control module transmits the root key to the algorithm module, and the algorithm module encrypts the initial key to generate an encryption key and store it in the external storage module.

Optionally, the encryption key is stored in the external storage module through the control module.

The present invention also provides an encryption method for a security chip, comprising

Carry out the above-mentioned encryption key generation step;

The main processor sends the encryption request and the data to be encrypted to the encryption and decryption module;

The control module calls the algorithm module;

The algorithm module reads the root key and the encryption key in the external storage module, decrypts the encryption key, and restores the initial key; and

The algorithm module uses the initial key to encrypt the data.

Optionally, the algorithm module includes a HASH module, configured to calculate a message digest for the encrypted data, and add it to the information header of the encrypted data.

The invention provides a security chip, which includes a main processor, an external storage module and an encryption and decryption module, and manages keys and encryption and decryption algorithms by setting a dedicated encryption and decryption module inside the chip. The encryption and decryption module also has hardware random numbers, which are generated during the production process as the unique root key of the chip and stored in a separate storage area. This root key can only be used by the encryption and decryption module, and the main processor cannot read it. the root key. Subsequent applications need to use encryption and decryption modules to generate keys, and have root keys to automatically encrypt and store the generated keys (or private keys of asymmetric algorithms), ensuring that the data of each terminal can only be read by the terminal , greatly improving the security of the terminal.

Description of drawings

FIG. 1 is a schematic structural diagram of a security chip according to an embodiment of the present invention.

Fig. 2 is a schematic diagram of a method for generating an encryption key combined with the structure of the security chip according to an embodiment of the present invention.

Fig. 3 is a schematic diagram of an encryption method combined with the security chip structure according to an embodiment of the present invention.

Detailed ways

The present invention will be described in further detail below in conjunction with the accompanying drawings and specific embodiments. Advantages and features of the present invention will be apparent from the following description and claims. It should be noted that the drawings are all in a very simplified form and use imprecise ratios, which are only used to facilitate and clearly assist the purpose of illustrating the embodiments of the present invention.

As shown in Figure 1, the security chip of the present invention includes a main processor 100, an external storage module 200 and an encryption and decryption module 300; the encryption and decryption module 300 includes:

An algorithm module 320, configured to generate an initial key for encrypting data according to an encryption algorithm;

An internal storage module 330, including a root key, the internal storage module 330 can only be accessed by the control module 310;

The control module 310 is used to call the root key to the algorithm module 320 to encrypt the initial key, generate an encryption key and store it in the external storage module 200; the control module 310 also uses Then call the root key to the algorithm module 320 to decrypt the encrypted key in the external storage module 200 and restore it to the initial key.

There may be multiple specific encryption algorithms in the algorithm module 320 , such as the RSA module 322 , and the initial key is generated through the RSA module 322 . At this time, the initial key generated by the RSA module 322 is a key pair, including a public key and a private key. In the step of encrypting the initial key, only the private key is encrypted, and the encrypted key is decrypted. In the step, only the private key is decrypted.

The algorithm module 320, for example, further includes an AES module 325, configured to encrypt the initial key according to the root key to generate an encryption key. As mentioned above, in this embodiment, only the private key is encrypted in the step of encrypting the initial key.

When the security chip of the present invention is produced, the encryption and decryption module 300 will be initialized to generate the root key and stored in the internal storage module 330 . Wherein, the control module 310 includes a status register, which is used to indicate that the root key has been generated and stored in the internal storage module 330 through an initialization status identifier; the control module 310 also includes a random number generation module (RNG module 321), Used to generate a random number as the root key.

The specific initialization steps of the encryption and decryption module 300 are as follows:

(1) The main processor 100 sends instructions to the encryption and decryption module 300, reads the state register (state_register) of the control module 310 and inquires whether the encryption and decryption module 300 has been initialized, if the initialization has been completed, then enter (4), otherwise enter (2) ;

(2) The encryption and decryption control module triggers the RNG module 321 to generate a random number of specified digits as the unique root key (RootKey) of the chip, which is stored in the internal storage module 330, and the internal storage module 330 can only be accessed by the control module 310.

(3) Write the state register (state_register) to initialize the state flag, which can only be written once.

(4) Return an initialization end flag to the main processor 310, and end.

The present invention also provides an encryption key generation method for the above security chip, including

The main processor 100 sends an encryption key generation request to the encryption and decryption module 300;

The control module 310 calls the algorithm module 320, so that the algorithm module 320 generates an initial key;

The control module 310 transmits the root key to the algorithm module 320 , and the algorithm module 320 encrypts the initial key to generate an encryption key and store it in the external storage module 200 .

Wherein, the above encryption key is stored in the external storage module 200 through the control module 310 .

When the security chip is applied to a specific electronic device such as a mobile phone, it is controlled through an application program of the mobile phone. The encryption key generation method of this security chip is described in detail below with an embodiment, in conjunction with the arrow direction in Figure 2, the steps of the encryption key generation method include:

(1) The application program sends a command requesting to generate a key, and sets the type of the generated key and the parameters stored on-chip or off-chip;

(2) The driver program encapsulates the data according to the encryption key generation request instruction of the application program, and sends it to the encryption and decryption control module 200 through the main processor 100;

(3) The control module 310 receives the request instruction, parses the instruction, and judges that the format of the request key calls the corresponding algorithm module, such as an RSA key pair, then calls the RSA module 322;

(4) The RSA module 322 generates a key pair: public key (public_key) and private key (private_kes), and the key pair is returned to the control module 310

(5) The control module 310 receives the key pair, calls the AES module 325, and reads the root key (root_key) from the internal storage module 330 and passes it to the AES module 325, and the AES module 325 uses the root key (root_key) to privately The key (private_key) is encrypted, and the encrypted key is returned to the control module 310.

(6) The control module 310 stores the generated public key and the encrypted private key in the external storage module 200, and returns the request result to the main processor 100, notifying the main processor 100 to read the public key and the encrypted private key.

The present invention also provides an encryption method for the above-mentioned security chip, comprising

First perform the above-mentioned encryption key generation steps;

Afterwards, the main processor 100 sends the encryption request and the data to be encrypted to the encryption and decryption module 300;

The control module 310 calls the algorithm module 320;

The algorithm module 320 reads the root key and the encryption key in the external storage module 200, decrypts the encryption key, and restores the initial key;

The algorithm module 320 encrypts the data with the initial key.

At this time, the algorithm module 320 includes a HASH module 323, configured to calculate a message digest for the encrypted data, and add it to the information header of the encrypted data.

The encryption method of this security chip is described in detail below with an embodiment, in conjunction with the arrow direction in Fig. 3, the specific steps of encryption method include:

(1) The application program sends an encryption request for data (file);

(2) The driver program receives the request and encapsulates the data, and sends the encryption request to the control module 310 through the main processor 100;

(3) The control module 310 parses the encryption request, and receives the previously generated encryption key and data (file) information;

(4) Call the AES module 325, and read the root key (root_key) of the internal storage module 330, decrypt the received key, and restore the generated private key (private_key)

(5) call the RSA module 322, use the restored private key (private_key) to encrypt the data (file), generate encrypted data information, and ensure the confidentiality of the data;

(6) Call the HASH module 323 to calculate the message digest for the data (file) according to the request information, add it to the header of the encrypted data information, and ensure the integrity of the data.

(7) Return the data encryption result to the main processor 100 .

This invention designs a security mechanism by improving the existing chip. The chip has a dedicated encryption and decryption module inside, which manages keys and encryption and decryption algorithms. The encryption and decryption module also has hardware random numbers, which are generated during the production process as the unique root key of the chip and stored in a separate storage area. This root key can only be used by the encryption and decryption module, and the main processor cannot read it. the root key. Subsequent applications need to use encryption and decryption modules to generate keys, and have root keys to automatically encrypt and store the generated keys (or private keys of asymmetric algorithms), ensuring that the data of each terminal can only be read by the terminal , greatly improving the security of the terminal.

The core of the present invention is a dedicated encryption and decryption module for unified management of keys and encryption algorithms, each chip has a unique root key, and the generated keys are encrypted and stored by the root key to ensure the confidentiality of the key. At the same time, automatic encryption technology is used to protect the key to prevent malicious software attacks; at the same time, in the present invention, both data encryption and message summary calculation are completed inside the special encryption and decryption module, which strengthens the security of data.

The encryption strategy of the security chip of the present invention is compared with the existing encryption strategy as follows:

In summary, using the encryption method of the security chip of the present invention, the key and the encryption algorithm are managed by a dedicated encryption and decryption module, which can greatly improve the security of the key and prevent malicious software from stealing the user key.

Obviously, those skilled in the art can make various changes and modifications to the invention without departing from the spirit and scope of the invention. Thus, if these modifications and variations of the present invention fall within the scope of the claims of the present invention and equivalent technologies thereof, the present invention also intends to include these modifications and variations.

Claims (10)

1. a kind of safety chip, which is characterized in that including primary processor, outer memory module and encryption/decryption module；Described plus solution Close module includes:

Algoritic module, to generate the initial key for being encrypted to data according to Encryption Algorithm；

Storage inside module, includes root key, and the storage inside module is only capable of controlled molding block access；

Control module generates and adds for calling the root key to the algoritic module to encrypt to the initial key Key is simultaneously stored in the outer memory module；The control module is also used to call the root key to the algorithm mould Block is reduced to the initial key so that the encryption key in the outer memory module to be decrypted.

2. safety chip as described in claim 1, which is characterized in that the initial key includes public key and private key, to described Only the private key is encrypted in the step of initial key encrypts, the step of to the encryption key decryption in only to the private Key is decrypted.

3. safety chip as described in claim 1, which is characterized in that the algoritic module includes RSA module, by described RSA module generates the initial key.

4. safety chip as described in claim 1, which is characterized in that the algoritic module includes AES module, for according to institute Root key is stated to encrypt the initial key.

5. safety chip as described in claim 1, which is characterized in that it further include random number generation module, it is random for generating Number is using as the root key.

6. safety chip as described in claim 1, which is characterized in that the control module includes status register, for leading to Crossing init state mark indicates that the root key has generated.

7. a kind of encryption key generation method of safety chip as claimed in any one of claims 1 to 6, which is characterized in that packet It includes

Primary processor sends encryption key and generates request to encryption/decryption module；

Control module calls algoritic module, and the algoritic module generates initial key；

Control module transmits root key to the algoritic module, and the algoritic module encrypts the initial key, generates encryption Key is simultaneously stored in the outer memory module.

8. the encryption key generation method of safety chip as claimed in claim 7, which is characterized in that the encryption key passes through The control module is stored in the outer memory module.

9. a kind of encryption method of safety chip, which is characterized in that including

Carry out the encryption key generation step as described in claim 7-8 any one；

Primary processor sends CIPHERING REQUEST and be-encrypted data to encryption/decryption module；

Control module calls algoritic module；

The algoritic module reads the encryption key in the root key and the outer memory module, to the encryption key into Row decryption, restores the initial key；And

Algoritic module encrypts data using initial key.

10. the encryption method of safety chip as claimed in claim 9, which is characterized in that the algoritic module includes HASH mould Block for calculating message digest to the data of encryption, and is added to the information heading of the encryption data.