CN1859413A - Safety processing device and method for public key operation data - Google Patents

Abstract

The present invention is applicable to the field of information security, and provides a device and method for securely processing public key computing data. The secure processing device includes: a system data interface module, used to receive input data for public key computing on the system bus, and send computing control Signal, output operation result; interface data storage module, used to store the public key operation input data and operation result received by the system data interface module; at least one sub-data interface module, used to receive the public key operation input data of the local bus; At least one sub-interface data storage module, used to store the input data of the public key operation received by the sub-data interface module; and a public key operation processing module, used to read the public key operation data stored in the interface data storage module and the sub-interface data storage module key operation input data, execute public key operation according to the operation control signal, and output operation result. The invention can improve the security of the input data of the public key operation and enhance the application flexibility of the equipment.

Description

A device and method for securely processing public key computing data

technical field

The invention belongs to the field of information security, and in particular relates to a device and method for securely processing public key operation data.

Background technique

In recent years, network security issues have received increasing attention. Since the Internet and most packet-switching networks are built on the Internet Protocol (IP), to solve the security problems of these networks, the security problems of the IP protocol must be solved first. Internet Protocol Security (Internet Protocol Security, IPSec), Secure Socket Layer (Security Socket Layer, SSL) and other protocols are common solutions to solve IP protocol communication security. Internet Key Exchange protocol (Internet Key Exchange protocol, IKE) is also a common scheme for Internet key exchange and negotiation. In the IKE protocol, the public key encryption algorithm RSA (Revest-Shamir-Adleman Algorithm), the key exchange algorithm D-H (a key exchange algorithm designed by Diffie and Hellman) and the digital signature algorithm (Digital Sign Algorithm) are usually used. , DSA) etc. for identity verification and key exchange between the communicating parties.

The security processing chip mainly refers to the IPSec processing chip with the public key acceleration function, the SSL processing chip or the IKE co-processing chip with the public key acceleration function. The structure of an existing IKE co-processing chip with public key acceleration function is shown in FIG. 1 , which includes a system data interface module 101 , an interface data storage module 102 and a public key operation processing module 103 . Among them, the system data interface module 101 completes the input and output of the public key calculation input data, and sends the calculation control signal to the public key calculation processing module 103; the interface data storage module 102 stores the public key calculation input data, output data and intermediate calculation results; The key operation processing module 103 reads the public key operation input data stored in the interface data storage module 102, and completes common public key operations of the IKE protocol according to the operation control signal, including RSA, D-H, and DSA.

The specific data processing process is detailed as follows:

First, the system data interface module 101 stores the received public key operation input data into the interface data storage module 102;

Secondly, the system data interface module 101 sends a start operation instruction and control signals related to operation types to the public key operation processing module 103, such as RSA operation, D-H operation, DSA operation, modular exponentiation operation, and modular addition operation, etc.;

Again, the public key calculation processing module 103 performs corresponding public key calculation on the input data of the public key calculation in the interface data storage module 102 according to the calculation type. After the calculation is completed, the calculation result is written back to the interface data storage module 102 and notified The operation of the system data interface module 101 is completed;

Finally, the system data interface module 101 outputs the operation result stored in the interface data storage module 102 .

In this implementation scheme, the input data of the public key operation input into the security chip will appear on the system bus. Since various applications and remote terminals can access the system bus in some cases, the key public keys appearing on the system bus The input data of the key operation may be stolen, and the security is low. In addition, there is only one data input interface, resulting in low application flexibility of the chip.

Contents of the invention

The purpose of the present invention is to provide a security processing device for public-key computing data, aiming at solving the problem that in the prior art, the public-key computing input data input into the security chip all appear on the system bus, so that the key public-key computing input data exists to be stolen Risks, low security and only one data input interface, resulting in low chip flexibility.

Another object of the present invention is to provide a method for securely processing public key computing data.

The object of the present invention is achieved like this: a kind of security processing device of public key operation data, and described security processing device comprises:

The system data interface module is used to receive the public key calculation input data of the system bus, send the calculation control signal, and output the calculation result;

The interface data storage module is used to store the public key operation input data and operation results received by the system data interface module;

At least one sub-data interface module is used to receive the input data of the public key operation of the local bus;

at least one sub-interface data storage module, configured to store the input data of the public key operation received by the sub-data interface module; and

The public key operation processing module is used to read the input data of the public key operation stored in the interface data storage module and the sub-interface data storage module, execute the public key operation according to the operation control signal, and output the operation result.

The interface data storage module and the sub-interface data storage module are physical memories independent of each other.

The interface data storage module and the sub-interface data storage module are logical storage spaces independent of each other in a physical memory.

The public key operation input data of the system bus is non-key public key operation input data, and the public key operation input data of the local bus is key public key operation input data.

The operation control signal includes input parameter attribute information, which is used to indicate the storage location of the input data of the public key operation.

A method for securely processing public key computing data, the method comprising:

Receive and store the public key operation input data of the system bus;

Receive and store the public key operation input data of the local bus;

Read the input data of the public key operation of the system bus and the input data of the public key operation of the local bus, execute the public key operation according to the operation control signal, and output the operation result.

The public key operation input data of the system bus and the public key operation input data of the local bus are respectively stored in independent physical memories.

The public-key operation input data of the system bus and the public-key operation input data of the local bus are respectively stored in logical storage spaces independent of each other in a physical memory.

The public key operation input data of the system bus is non-key public key operation input data, and the public key operation input data of the local bus is key public key operation input data.

The operation control signal includes input parameter attribute information, which is used to indicate the storage location of the input data of the public key operation.

The present invention adds a plurality of sub-data interfaces and corresponding storage modules on the basis of the existing security processing chip, so that different public-key operation input data can be input from different data interfaces, thereby improving the security of key public-key operation input data, And the application flexibility of the security processing chip is enhanced.

Description of drawings

FIG. 1 is a structural diagram of an existing security processing chip;

Fig. 2 is a structural diagram of a security processing chip in an embodiment of the present invention;

Fig. 3 is a schematic diagram of an application example of the security processing chip provided by the present invention.

Detailed ways

In order to make the object, technical solution and advantages of the present invention clearer, the present invention will be further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described here are only used to explain the present invention, not to limit the present invention.

The present invention adds multiple sub-data interface modules and corresponding sub-interface data storage modules on the basis of the existing security processing chip, and inputs different public key operation input data into the security processing chip through different data interfaces.

As an embodiment of the present invention, the structure of the security processing chip is described by taking adding a sub-data interface module and a corresponding sub-interface data storage module as an example. As shown in FIG. 2 , in addition to the system data interface module 101 , the interface data storage module 102 and the public key operation processing module 103 , the security processing chip also includes a sub-data interface module 104 and a sub-interface data storage module 105 .

The interface data storage module 102 and the sub-interface data storage module 105 are the same type of on-chip memory, and the implementation method is the same, the difference lies in the security level of the stored data. In the present invention, the non-critical public-key operation input data of the system bus is stored in the interface data storage module 102, and the key public-key operation input data of the local bus, such as key data and identity authentication data, are stored in the sub-interface data storage module 102. In module 105.

In one embodiment of the present invention, the interface data storage module 102 and the sub-interface data storage module 105 can be a physical memory physically, but are two mutually independent storage spaces logically, ensuring that the system data interface module 101 can only To access the data stored in the interface data storage module 102 , the sub-data interface module 104 can only access the data stored in the sub-interface data storage module 105 .

In another embodiment of the present invention, the interface data storage module 102 and the sub-interface data storage module 105 may also be configured as two mutually independent physical memories.

The sub-data interface module 104 is connected to the local bus to provide a channel for the security processing chip to exchange data with the outside world. By converting some general-purpose bus interfaces, such as PCI bus, USB bus and Intel Local Bus bus, etc. to meet the requirements of the sub-interface data storage module 105 The interface, such as the on-chip SRAM interface, receives the input of the key public key operation input data in the public key operation.

Figure 3 shows a typical application of the present invention. Among them, the portable storage device stores key public key calculation input data related to identification or important applications, and the local processor is used to read the key public key calculation input data input from the portable storage device through the local bus, and through the sub-data interface module 104 The data is sent to the sub-interface data storage module 105, and at the same time, the main processor is notified that the data preparation is completed. The public key operation processing module 103 reads the data in the interface data storage module 102 and the sub-interface data storage module 105 according to the operation control signal of the system data interface module 101, and performs public key operation, and stores the operation result in the interface data storage module 102, and is controlled by the system The data interface module 101 outputs.

The specific data processing process is detailed as follows:

First, the sub-data interface module 104 reads the key public-key calculation input data input from the external portable storage device via the local bus, and stores it in the sub-interface data storage module 105, and then the system data interface module 101 transfers the received The key public key operation input data is stored in the interface data storage module 102;

Secondly, after receiving the data preparation completion signal from the sub-interface data storage module 105 sent by the local processor, the system data interface module 101 sends an operation control signal to the public key operation processing module 103, that is, the start operation instruction, operation type, and input parameters attributes and other information. The input parameter attribute is used to indicate the storage location of the input data of the public key operation, for example, 1 represents the interface data storage module 102, 2 represents the sub-interface data storage module 105, etc.;

Again, the public key operation processing module 103 performs corresponding public key operations on the input data in the interface data storage module 102 and the sub-interface data storage module 105 according to the operation type and input parameter attributes, and writes back the operation results to the interface data after the operation is completed. storage module 102, and notify the system data interface module 101 that the operation is completed;

Finally, the system data interface module 101 outputs the operation result stored in the interface data storage module 102 from the chip.

It should be noted that in practical applications, according to the environment and application needs, the storage location of the input data of the public key operation can be flexibly arranged to improve the application flexibility of the chip. At the same time, the key key data can be scheduled through the sub-data interface module to Improve the security of the system and reduce the risk of key public key operation input data being stolen.

In the present invention, more sub-data interface modules and corresponding interface data storage modules can also be set in the security processing chip to respectively receive and store public key calculation input data of different security levels or different applications, and the specific implementation is the same as above ,No longer.

The above descriptions are only preferred embodiments of the present invention, and are not intended to limit the present invention. Any modifications, equivalent replacements and improvements made within the spirit and principles of the present invention should be included in the protection of the present invention. within range.

Claims (10)

1. A security processing device for public key computing data, characterized in that the security processing device includes: The system data interface module is used to receive the public key calculation input data of the system bus, send the calculation control signal, and output the calculation result; The interface data storage module is used to store the public key operation input data and operation results received by the system data interface module; At least one sub-data interface module is used to receive the input data of the public key operation of the local bus; at least one sub-interface data storage module, configured to store the input data of the public key operation received by the sub-data interface module; and The public key operation processing module is used to read the input data of the public key operation stored in the interface data storage module and the sub-interface data storage module, execute the public key operation according to the operation control signal, and output the operation result. 2. The security processing device according to claim 1, wherein the interface data storage module and the sub-interface data storage module are physical memories independent of each other. 3. The security processing device according to claim 1, wherein the interface data storage module and the sub-interface data storage module are logical storage spaces independent of each other in a physical memory. 4. The security processing device according to claim 1, wherein the input data of the public key operation of the system bus is non-key public key operation input data, and the input data of the public key operation of the local bus is a key public key Compute input data. 5. The security processing device according to claim 1, wherein the operation control signal includes input parameter attribute information, which is used to indicate the storage location of the input data of the public key operation. 6. A method for securely processing public key computing data, characterized in that the method comprises: Receive and store the public key operation input data of the system bus; Receive and store the public key operation input data of the local bus; Read the input data of the public key operation of the system bus and the input data of the public key operation of the local bus, execute the public key operation according to the operation control signal, and output the operation result. 7. The security processing method according to claim 4, characterized in that, the input data of the public key operation of the system bus and the input data of the public key operation of the local bus are respectively stored in independent physical memories. 8. The security processing method according to claim 4, characterized in that, the input data of the public key operation of the system bus and the input data of the public key operation of the local bus are respectively stored in a logical storage space independent of each other in a physical memory. 9. The security processing method according to claim 4, wherein the input data of the public key operation of the system bus is non-key public key operation input data, and the public key operation input data of the local bus is a key public key Compute input data. 10. The security processing method according to claim 4, wherein the operation control signal includes input parameter attribute information, which is used to indicate the storage location of the input data of the public key operation.

Images