Storage data encryption/decryption apparatus and method
Embodiments of the disclosure provide a method and apparatus for encrypting and decrypting data. The method for encrypting data in a computer system can include: receiving, by a memory operation module, a first data and a second data for encryption; determining at least one storage area for a first encrypted data corresponding to the first data and a second encrypted data corresponding to the second data; generating at least one key based on the first and second data and the at least one storage area; and encrypting the first data and the second data using the at least one key to generate the first encrypted data and the second encrypted, respectively.
1. A method for encrypting data in an integrated circuit, comprising:
receiving, by a memory operation module, a first data and a second data to be encrypted;
determining at least one storage area for storing a first encrypted data corresponding to the first data and a second encrypted data corresponding to the second data;
generating at least one key based on the first and second data and the at least one storage area, wherein generating the at least one key comprises generating two different keys according to a determination that the first encrypted data and the second encrypted data are to be stored in two different storage areas, respectively, of the integrated circuit; and
encrypting the first data and the second data using the two different keys, respectively, to generate the first encrypted data and the second encrypted data,
wherein the two different keys are stored in a key memory of the integrated circuit, and
wherein the key memory is configured to be cleared in response to a determination that a computer system associated with the integrated circuit is under an attack.
2. The method according to claim 1 , wherein
when the at least one storage area includes a first storage area for the first encrypted data and a second storage area for the second encrypted data and the first storage area is different from the second storage area, the at least one key includes a first key for the first data and a second key, that is different from the first key, for the second data, the first storage area and the second storage area being the two different storage areas and the first key and the second key being the two different keys.
3. The method according to claim 1 , wherein the at least one storage area is included in an off-chip data memory.
4. The method according to claim 1 , wherein the encryption is transparent to software.
5. An apparatus for encrypting data in a computer system, comprising:
a memory operation module having circuitry for receiving a first data and a second data for encryption;
circuitry, configured for determining at least one storage area for storing a first encrypted data corresponding to the first data and a second encrypted data corresponding to the second data;
a true random number generator, configured for generating at least one key based on the first and second data and the at least one storage area, wherein the true random number generator is configured for generating two different keys according to a determination that the first encrypted data and the second encrypted data are to be stored in two different storage areas, respectively, of one integrated circuit; and
a data encryption/decryption module having circuitry for encrypting the first data and the second data using the two different keys, respectively, to generate the first encrypted data and the second encrypted,
wherein the two different keys are stored in a key memory of the integrated circuit, and
wherein the key memory is configured to be cleared in response to a determination that a computer system associated with the integrated circuit is under an attack.
6. The apparatus according to claim 5 , wherein
when the at least one storage area includes a first storage area for the first encrypted data and a second storage area for the second encrypted data and the first storage area is different from the second storage area, the at least one key includes a first key for the first data and a second key, that is different from the first key, for the second data, the first storage area and the second storage area being the two different storage areas and the first key and the second key being the two different keys.
7. The apparatus according to claim 5 , wherein the at least one storage area is included in an off-chip data memory.
8. The apparatus according to claim 5 , wherein the encryption is transparent to software.
9. The method according to claim 1 , wherein the two different keys include a first key associated with a first storage area of the two different storage areas of the integrated circuit and a second key associated with a second storage area of the two different storage areas of the integrated circuit.
10. The apparatus according to claim 5 , wherein the two different keys include a first key associated with a first storage area of the two different storage areas of the one integrated circuit and a second key associated with a second storage area of the two different storage areas of the one integrated circuit.
11. The method according to claim 1 , wherein the key memory being an on-chip memory of the integrated circuit and the two different storage areas being included in an off-chip memory of the integrated circuit, and
the computer system associated with the integrated circuit being under the attack includes the off-chip memory being replaced.
12. The apparatus according to claim 5 , wherein the key memory being an on-chip memory of the integrated circuit and the two different storage areas being included in an off-chip memory of the integrated circuit, and
the computer system associated with the integrated circuit being under the attack includes the off-chip memory being replaced.