CN116502291B - Data security storage equipment and data storage method based on three-dimensional heterogeneous integration - Google Patents

Abstract

The invention discloses a data security storage device and a data storage method based on three-dimensional heterogeneous integration, including: a memory access port module, which communicates with an external processor through an external system bus and is used to receive memory access instructions from the external processor to ensure data security. The storage device is accessed as an external device in the form of memory access instructions; it transmits the information to be identified and pre-encrypted data to the security processing module, and feeds back the encryption identification code, status information and decrypted data to the external processor, and at the same time feeds back to the security processing module Lock the external memory access port after the error message; several security processing modules are respectively connected to the memory access port module, receive write activation instructions, read/write data instructions and pre-encrypted data, and perform secret key generation, identification and data encryption and decryption. , transmit the encrypted data to the storage module; the storage module is connected to each security processing module through a three-dimensional channel and is used to store the encrypted data.

Description

Data security storage device and data storage method based on three-dimensional heterogeneous integration

Technical field

The invention relates to the field of data security storage technology, and in particular to a data security storage device and data storage method based on three-dimensional heterogeneous integration.

Background technique

With the continuous development of big data and information technology, information storage security has become an issue of increasing concern. Compared with the rapid development of software attack protection technology, the development of hardware attack protection and encryption technology directly based on the underlying hardware is still in its infancy. However, with the gradual increase in the importance of data and the cost of software attacks, hardware protection is The frequency of attacks on original weak points is also increasing year by year. Therefore, research on data security storage devices based on hardware protection is also crucial.

Existing data security storage devices are mostly based on two-dimensional planar structures, which have the following problems: First, due to the different processes required for encryption logic and memory, the encryption module will be separated from the storage module during manufacturing. This structure makes the encryption module easier to be physically positioned. , making it easier to implement physical attacks on this module; at the same time, the data transmission path between the encryption module and the storage module is easy to be located and split, and information theft can be carried out. On the other hand, the design of encryption modules with strong confidentiality generally requires a larger chip area, which will affect the overall size of the storage device.

Contents of the invention

In view of the shortcomings of the existing technology, the present invention proposes a data security storage device and data storage method based on three-dimensional heterogeneous integration.

According to the first aspect of the embodiment of the present invention, a data security storage device based on three-dimensional heterogeneous integration is provided, including:

The memory access port module communicates with the external processor through the external system bus and is used to receive memory access instructions from the external processor, so that the data security storage device can be accessed as an external device in the form of memory access instructions; transmission to the security processing module requires identification information and pre-encrypted data, and feeds back the encrypted identification code, status information and decrypted data to the external processor, and at the same time locks the external memory access port after the security processing module feeds back the error information; wherein the memory access instructions include formatting instructions , write activation command, read and write data command and write completion command;

Several security processing modules are respectively connected to the memory access port module, receive write activation instructions, read/write data instructions and pre-encrypted data, perform secret key generation, identification and data encryption and decryption, and transmit the encrypted data to the storage module. ; And feed back the status information of the security processing module to the memory access port module;

The storage module is connected to each security processing module through three-dimensional channels and is used to store encrypted data.

According to a second aspect of the embodiment of the present invention, a data storage method based on a three-dimensional heterogeneous integration-based data security storage device is provided, which is implemented by the above-mentioned three-dimensional heterogeneous integration-based data security storage device. The method includes:

Step S1, format the data security storage device and obtain the write activation identification code _Wi , i=1,...,n;

Step S2: Send the encrypted interval ID and the corresponding activation identification code _Wi to the data security storage device for write activation;

Step S3: After the write activation is determined to be successful, a write request is sent to the data security storage device;

Step S4: Write a write completion command to the data storage device, determine the memory access identification port, and the data storage device feeds back the write completion signal and the corresponding read identification code _Ri ;

Step S5: Send a read request to the data security storage device.

According to a third aspect of the embodiment of the present invention, a computer-readable storage medium is provided. The storage medium stores a computer program. When the computer program is executed by a processor, the above-mentioned data storage method is implemented.

According to a fourth aspect of the embodiment of the present invention, an electronic device is provided, including a memory, the above-mentioned three-dimensional heterogeneous integration-based data security storage device, and a data security storage device based on three-dimensional heterogeneous integration that is stored in the memory and can be stored in the memory. program running on it.

The beneficial effect of the present invention is that the present invention proposes a data security storage device and a data storage method based on three-dimensional heterogeneous integration. Through the three-dimensional heterogeneous integration technology, the integration degree of encryption logic and memory chips is improved, and the chip area is increased. The utilization rate also increases the difficulty of accurately identifying the encryption logic and reduces the risk of the device being cracked by targeted physical attacks. The encryption module and the memory module are closely integrated at the two-dimensional level, which greatly increases the difficulty of separating and positioning the encryption module and the data transmission path. And by taking advantage of the characteristics that each logical module in the three-dimensional integrated structure is only connected to the target memory area through a three-dimensional path, the memory access range is limited and cannot be interacted with, it can realize the function of separate management of different users in the same device, and realize the separation of read and write permission management, further expanding Application scope of this equipment.

Description of the drawings

In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings needed to be used in the description of the embodiments will be briefly introduced below. Obviously, the drawings in the following description are only some embodiments of the present invention. For those of ordinary skill in the art, other drawings can be obtained based on these drawings without exerting any creative effort.

Figure 1 is a schematic diagram of the connection of a data security storage device based on three-dimensional heterogeneous integration in a computing system provided by an embodiment of the present invention;

Figure 2 is a schematic diagram of the internal structure of a data security storage device based on three-dimensional heterogeneous integration provided by an embodiment of the present invention;

Figure 3 is a schematic diagram of a memory access port module provided by an embodiment of the present invention;

Figure 4 is a schematic diagram of a security processing module provided by an embodiment of the present invention;

FIG. 5 is a schematic flowchart of a data storage method based on a three-dimensional heterogeneous integrated data security storage device provided by an embodiment of the present invention.

Detailed ways

In order to make the purpose, technical solutions and advantages of the present invention clearer, the embodiments of the present invention will be described in further detail below with reference to the accompanying drawings. The implementations described in the exemplary embodiments do not represent all implementations consistent with the present application, and the various secure storage device design data used in this example are only used as an example of consistency with some aspects of the present application. In all examples shown and discussed herein, any specific values are to be construed as illustrative only and not as limiting. Accordingly, other examples of the exemplary embodiments may have different values.

The invention proposes a data security storage device based on three-dimensional heterogeneous integration. The connection structure in the computing system is shown in Figure 1. The data secure storage device can be used as an external storage device and connected to an external system bus or an external processor memory access port, so that the access control instructions of the external system bus to the data secure storage device can be implemented in the form of memory access instructions. In this example, it is assumed that the system storage address is expressed as 32 bits, and the physical unclonable function (PUF) module and true random number generator (TRNG) under the security processing module in the data security storage device are The module generates 128-bit data, and the security processing module uses the Advanced Encryption Standard (AES) algorithm for data security encryption. To simplify the description, the system access data bit width is 128 bits. In actual situations, the memory access bit width is smaller. Data can be transferred over multiple cycles. It is assumed that the data security storage device provided by the present invention is divided into eight encryption intervals.

As shown in Figure 2, the data security storage device provided by the present invention includes a memory access port module, several security processing modules and storage modules.

The memory access port module communicates with the external processor through the external system bus, and is used to receive memory access instructions from the external system bus, so that the data security storage device can be accessed as an external device in the form of memory access instructions; transmit to the security processing module The information to be identified and the data before encryption are fed back to the external processor with the encrypted identification code, status information and decrypted data. At the same time, the external memory access port is locked after the security processing module feeds back the error information; wherein, the memory access instruction includes a format ization instructions, write activation instructions, read and write data instructions, and write completion instructions;

The several security processing modules are respectively connected to the memory access port module, receive write activation instructions, read/write data instructions and pre-encrypted data, perform secret key generation, identification and data encryption and decryption, and transmit the encrypted data to storage module; and feed back the status information of the security processing module to the memory access port module;

The storage module is connected to each security processing module through a three-dimensional channel and is used to store encrypted data.

As shown in Figure 3, the memory access port module is composed of a status storage module, a determination module, and a format control module.

The status storage module is used to store the status information of each security processing module, including: the write activation status of the security processing module, the number of identification failures fed back by each security processing module, the number of writing failures fed back by the determination module, and whether the memory access port In a locked state.

The determination module is used to identify the memory access instructions of the external processor, determine the order and area of the memory access instructions, and update the status storage module; obtain feedback error information and determine whether the memory access port is in a locked state; among them, identify the external processor The memory access instructions include: identify write activation instructions, write instructions, key clear instructions, write completion instructions, read instructions, and format instructions.

The formatting control module is used to send formatting instructions to all security processing modules when the determination module recognizes the formatting instructions. Realize the formatting of the entire encryption interval, clear all states in the state storage module, and feed back all write activation identification codes and default read identification codes to the external system bus.

Next, the process of the determination module identifying the memory access instructions of the external processor is explained in detail:

It should be noted that based on the access port lock status information obtained in the status storage module, it is determined whether the data security storage device is in a locked state; if it is in a locked state, the determination module does not pass any external instructions except formatting. or update data and information.

(1.1) Identify write activation instructions:

Identify the encrypted interval id from the address bit, whether to force write and whether to use a new read key; read the write activation identification code from the data bit; transmit the write activation command and the above information to the corresponding security processing module; and wait for the security processing The module feeds back the identification results, and updates the status information of the security processing module write activation status and whether the access port is locked based on the feedback identification results stored in the status storage module.

(1.2) Identify write instructions:

Read the write address from the address bit, read and write the data from the data bit; determine whether any security processing module is currently in the write activation state from the write activation status of each security processing module stored in the status storage module. If it is not in the write activation state, Then feedback the write failure to the external processor; if it is in the write activation state, determine whether the obtained write address is in the storage area corresponding to the activated security processing module. If the storage area corresponding to the security processing module is not activated, feedback the write failure to the external processor. device, and update the number of write failures fed back by the judgment module in the status storage module and the write activation status information of each security processing module; if the corresponding storage area of the security processing module has been activated, the write instructions, the obtained write address and the data are transmitted to Corresponds to the security processing module.

(1.3) Identify key clearing instructions:

Identify the encrypted interval ID from the address bit and read the reading identification code from the data bit; determine the activation status. If the activation status is activated, transmit the key clearing command and the obtained reading identification code to the corresponding security processing module; at the same time, wait for the security The processing module feeds back success and failure signals and transmits them to the external processor.

(1.4) Identify write completion instructions:

Identify the encryption interval ID from the address bit; determine the activation status. If the activation status is activated, send a write completion instruction to the corresponding security processing module, and feedback the number of write failures from the determination module in the status storage module and the write activation of each security processing module. The status information is cleared; at the same time, it waits for the reading identification code fed back by the security processing module, and transmits it to the external system through data.

(1.5) Identify read instructions:

Read the read address from the address bit, read the read identification code from the data bit; determine the corresponding security processing module id based on the read address, and transmit the read command and the above information to the corresponding security processing module; at the same time, wait for the security processing module Feed back the recognition results. If the recognition is wrong, then feedback the recognition error information to the external processor, and update the status information stored in the status storage module based on the number of recognition failures fed back by the security processing module and whether the memory access port is locked; if the recognition If correct, the read data of the security processing module is transmitted to external processing, and the number of identification failures stored in the status storage module and fed back by the corresponding security processing module is cleared.

(1.6) Identify formatting instructions:

When the determination module recognizes the formatting instruction, it issues an activation request to activate the formatting control module.

As shown in Figure 4, the security processing module includes a physical unclonable function (PUF) module, a true random number generator (TRNG) module, a secret key management module, an encryption and decryption module, and a data transmission module. Modules and formatting modules.

The physical unclonable function module is used to generate unique and immutable data corresponding to each security processing module; specifically, the physical unclonable function module generates a first random number and a second random number, using advanced encryption standards. The algorithm (Advanced Encryption Stanadard, AES) encrypts the first random number and the second random number to obtain the default read identification code and write activation identification code.

The true random number generator module is used to generate true random numbers multiple times as a key.

The secret key management module is used to feed back the default read identification code and write activation identification code to the memory access port module; receive the write activation command and write identification code, compare the consistency of the write identification code and the write activation identification code, and determine whether the activation is successful. ;

When activation fails, receive the write command and determine whether it is writable. When it is writable, use the physical unclonable function module to generate an encryption identification code, and use the true random number generator module to generate the key and send it to the encryption and decryption module; when it is not writable, When, use the default reading identification code to initiate an encryption request;

When the activation is successful, the write command is received, the physical unclonable function module is used to generate the encryption identification code, and the true random number generator module is used to generate the key and send it to the encryption and decryption module;

When the activation is successful, the key management module also includes: receiving a key clearing instruction, and clearing corresponding records of the received key according to the key clearing instruction.

The secret key management module also includes: when receiving the write completion instruction, feedback the encrypted identification code to the memory access port module; when receiving the read instruction, decode the secret key and determine whether the decoding is successful; if the decoding is unsuccessful, send the The memory access port module feeds back error information; if the decoding is successful, it initiates a decryption request to the encryption and decryption module and transmits the corresponding secret key.

The encryption and decryption module is used to receive the encryption request and the corresponding secret key, encrypt the data transmitted from the memory access port according to the secret key, and transmit the encrypted data to the data transmission module to initiate a write data request; receive The decryption request and the corresponding secret key initiate a read data request to the data transmission module, decrypt the obtained data according to the secret key, and transmit the decrypted data to the memory access port.

The data transmission module initiates a write data request and a read data request to the storage module according to the write data request and read data request issued by the encryption and decryption module, and performs read/write data transmission. It also includes: after the transmission of read/write data is completed, a success signal is fed back to the memory access port module.

The formatting module is used to send write data requests to the data transmission module in sequence when receiving the formatting request until the corresponding storage interval of the security processing module is completely covered, and repeat the above process multiple times. After completion, the formatting module sends write data requests to the data transmission module. The secret key management module feeds back the formatting completion signal.

Next, a detailed description of the secret key management module:

The secret key management module needs to include a key cache module. Assuming that the storage space is 16, 16 keys can be stored, and the access time can be determined. Except for empty items, the ones that have not been accessed for the longest time are written first. Project; the key management module can realize the following functions:

(2.1) When receiving formatting, activate the true random number generator module twice, obtain and store the first random number _TR and the second random number T _w , and activate the physical unclonable function module to obtain the identifier _Pi , with P _i is the key, and the first random number _TR and the second random number T _w are encrypted through the Advanced Encryption Standard (Advanced Encryption Stanadard, AES) algorithm to generate the default reading identification code R _i and the write activation identification code _Wi , and in the format After the formatting module feedback formatting is completed, the default reading identification code _Ri and the write activation identification code _Wi are transmitted to the memory access port module.

(2.2) After receiving the write activation command and the corresponding identification code, use the key _Pi to decrypt it to obtain the number to be identified T _w' . Compare the number to be identified T _w' with the second random number T _w . If they are inconsistent, then If the activation fails, the identification error signal is transmitted to the determination module; if consistent, the activation is successful, the activation success signal is transmitted to the determination module, and whether it is a forced write is stored; if a new identification code needs to be generated, the true random number generator module is activated , obtain and temporarily store the random number T, use _Pi as the key, and obtain and temporarily store the new identification code R through AES algorithm encryption.

(2.3) After receiving the write command, make a judgment based on whether a new identification code is generated; if a new identification code is generated, check whether the current cache is full. If it is full and the status is no forced writing, read the key cache. The project T0 that has not been accessed for the longest time uses _Pi as the key and is encrypted by the AES algorithm to obtain the soon-to-expire identification code R ₀ . It is fed back to the memory access port module and raises the write failure signal to wait for new instructions; if cached If it is not full or the status is forced write, the newly generated key T will be stored in the cache; if a new identification code is not generated, the following encryption process shall be based on the default read key T _R ; the key T or the default read key _TR (hereinafter collectively referred to as _TR ) is transmitted to the encryption and decryption module and initiates an encryption request.

(2.4) When receiving the key clearing instruction, the identification code will be decrypted using the key _Pi to obtain the default read key _TR' , which will be compared with all keys in the key cache. If there is a consistent item, the key will be cleared. item, send a success signal to the memory access port; if inconsistent, send a failure signal to the memory access port.

(2.5) When receiving the write completion command, the new identification code R or the default read key Ri is transmitted to the memory access port module according to the identification code update status.

(2.6) When receiving the read command, the identification code will be decrypted using the key _Pi to obtain the default read key _TR' . Compare it with all keys in the key cache and the default key _TR . If there is a consistent item , transmit the key _Pi to the encryption and decryption module, and initiate a decryption request; if it does not exist, send an identification error signal to the memory access port module.

(2.7) Initiate a format request to the format module when receiving a read command.

As shown in Figure 5, the embodiment of the present invention also provides a data secure storage device and data storage method based on three-dimensional heterogeneous integration. The present invention only describes the steps of initialization-writing-reading to demonstrate the secure storage of data. All functions of the device, and it is assumed that the above operations are only performed on the encrypted interval i, but in actual situations, reading and writing operations can be performed multiple times, and different intervals can be read and written; the method includes the following steps:

Step S1: During system initialization, a formatting instruction is sent to the data security storage device to obtain the write activation identification code _Wi , i=1,...,n; n is a positive real number.

Step S2: Send the encrypted interval ID and the corresponding activation identification code _Wi to the data security storage device for write activation;

Specifically, the step S2 specifically includes the following sub-steps:

Step S201, the external processor sends a write activation instruction to the data security storage device through the external system bus. The address interval contains the encryption interval id, whether to force write and whether to use a new read key information, and the data interval transmission corresponds to the activation identification code _Wi .

Step S202: The memory access port module in the data security storage device transmits the write activation command and the corresponding address range to the corresponding security processing module i.

Step S203: The security processing module determines whether the activation identification code _Wi is correct.

When the write activation identification code _Wi is correct, write activation is performed on the data security storage device; the instruction information is stored and the read identification code is generated as required, and a completion signal is fed back; the memory access port module receives the completion signal and clears the feedback identification of the corresponding security processing module Number of failures to transmit completion signal to external processor.

When the write activation identification code _Wi is wrong, a recognition error signal will be fed back, and the number of feedback recognition failures of the corresponding security processing module will be +1. If the number of recognition errors after the update exceeds the threshold (in this example, assuming the threshold is 3 times), After the lock state is raised and the external memory access port is locked, the security processing module does not respond to any instructions other than the formatting instruction.

If the write activation command includes the use of a new read key, the security processing module regenerates the read key and the corresponding identification code R _i' ; if not, the default read key and the corresponding identification code R _i are used.

Step S3: After the write activation determination is successful, a write request is sent to the data security storage device.

Specifically, the step S3 includes the following sub-steps:

Step S301: The external processor sends a write instruction, a write request target area, and write data to the data secure storage device.

Step S302: The memory access port module determines whether the write request target area is consistent with the activated area of the security processing module.

When the areas are inconsistent, the number of failures is recorded. When the number of failures is greater than the threshold (in this example, assuming the threshold is 3 times), the activation status of the security processing module is cleared.

When the areas are consistent, the write instructions and write data are transmitted to the security processing module according to the write request target area.

Step S303: The security processing module encrypts the written data.

Specifically, the security processing module determines whether it is currently writable based on the identification code update and forced writing. If it is not writable, it feeds back the writing failure signal and the invalid key; if it is writable, it updates the key cache module and checks the write The incoming data is encrypted and transmitted to the storage module.

At the same time, the security processing module determines whether the write is successful based on the write command. If no forced write is performed, if the stored write record is full and includes the use of a new read key, it will feedback write failure and the next overwrite record information; if the record If it is not full or forced writing is performed, the security processing module will encrypt the written data and feedback success information after completion; at the same time, the external controller system will send a write clear command to the data security storage device, and the security processing module will clear it according to the received write clear command. Record accordingly.

Step S4: After the write instruction is executed, the external controller writes the write completion instruction to the data storage device, determines the memory access identification port, and the data storage device feeds back the write completion signal and the corresponding read identification code _Ri to the external controller.

Step S5: Send a read request to the data security storage device.

Specifically, the step S5 includes the following sub-steps:

Step S501: The external processor sends a read instruction to the data security storage device, reads the address, and transmits the reading identification code Ri _{' in the data interval.}

Step S502: The memory access port module determines the corresponding security processing module according to the read address, and transmits the read instruction and the read identification code Ri _' to the corresponding security processing module.

Step S503, the security processing module decrypts the read identification code into a key and compares it with the stored key; if the key is inconsistent with the stored key, a recognition error signal is fed back and the number of recognition errors is recorded. When the number of recognition errors is greater than the threshold (in In this example, assuming the threshold is 3 times), the external memory access port is locked; if the key is consistent with the storage key, a read request is sent to the storage module, and the obtained data is decrypted using the key and transferred to the access port. Store the port module and feedback the read completion signal.

The memory access port module processes the read completion signal fed back by the security processing module. When the read completion signal is obtained, it clears the number of identification errors corresponding to the security processing module feedback, and transmits the read completion signal and decryption data to the external processor.

To sum up, the present invention connects the encryption logic and the storage module through a three-dimensional path, uses the PUF and TRNG modules to generate keys and identification codes in the encryption module, and realizes hardware-level data encryption and storage. The present invention improves the integration of encryption logic and storage chips through three-dimensional heterogeneous integration technology, improves chip area utilization, increases the difficulty of accurately identifying the encryption logic, and reduces the risk of the device being cracked by targeted physical attacks. , and by taking advantage of the characteristics that each logical module in the three-dimensional integrated structure is only connected to a specific memory interval through a three-dimensional path, the memory access range is limited and cannot be interacted with, it realizes the function of separate management of different users in the same device, and realizes the separation of read and write permission management, further Expand the application range of this equipment.

Correspondingly, the present invention also provides a computer-readable storage medium on which computer instructions are stored. When the instructions are executed by a processor, the above-mentioned data storage method based on a three-dimensional heterogeneous integrated data security storage device is implemented. The computer-readable storage medium may be an internal storage unit of any device with data processing capabilities as described in any of the foregoing embodiments, such as a hard disk or a memory. The computer-readable storage medium may also be an external storage device, such as a plug-in hard disk, a smart memory card (Smart Media Card, SMC), an SD card, a flash card (FlashCard), etc. equipped on the device. Furthermore, the computer-readable storage medium may also include an internal storage unit of any device with data processing capabilities and an external storage device. The computer-readable storage medium is used to store the computer program and other programs and data required by any device with data processing capabilities, and can also be used to temporarily store data that has been output or is to be output.

Correspondingly, the present invention also provides an electronic device, which is characterized in that it includes a memory, the above-mentioned data security storage device based on three-dimensional heterogeneous integration, and a data security storage device based on three-dimensional heterogeneous integration that is stored in the memory and can be stored in the memory. program running on it.

Other embodiments of the present application will be readily apparent to those skilled in the art from consideration of the specification and practice of the disclosure herein. This application is intended to cover any variations, uses, or adaptations of this application that follow the general principles of this application and include common knowledge or customary technical means in the technical field that are not disclosed in this application. . The specification and examples are to be considered as illustrative only.

It is to be understood that the present application is not limited to the precise structures described above and illustrated in the accompanying drawings, and that various modifications and changes may be made without departing from the scope thereof.

Claims (10)

1. A data security storage device based on three-dimensional heterogeneous integration, which is characterized by including: The memory access port module communicates with the external processor through the external system bus and is used to receive memory access instructions from the external processor, so that the data security storage device can be accessed as an external device in the form of memory access instructions; transmission to the security processing module requires identification information and pre-encrypted data, and feeds back the encrypted identification code, status information and decrypted data to the external processor, and at the same time locks the external memory access port after the security processing module feeds back the error information; wherein the memory access instructions include formatting instructions , write activation command, read and write data command and write completion command; Several security processing modules are respectively connected to the memory access port module, receive write activation instructions, read/write data instructions and pre-encrypted data, perform key generation, identification and data encryption and decryption, and transfer the encrypted data to the storage module ; And feed back the status information of the security processing module to the memory access port module; The storage module is connected to each security processing module through three-dimensional channels and is used to store encrypted data. 2. The data security storage device based on three-dimensional heterogeneous integration according to claim 1, characterized in that the memory access port module includes: The status storage module is used to store the status information of each security processing module, including the write activation status of the security processing module, the number of identification failures fed back by each security processing module, the number of writing failures fed back by the judgment module, and whether the memory access port is locked. state; The determination module is used to identify the memory access instructions of the external processor, determine the order and area of the memory access instructions, and update the status storage module; obtain feedback error information and determine whether the memory access port is in a locked state; among them, identify the external processor The memory access instructions include: identification of write activation instructions, write instructions, key clear instructions, write completion instructions, read instructions, and format instructions; The formatting control module is used to send formatting instructions to all security processing modules when the determination module recognizes the formatting instructions. 3. The data security storage device based on three-dimensional heterogeneous integration according to claim 1, characterized in that the security processing module includes: Physical unclonable function module, used to generate default read identification code and write activation identification code; True random number generator module, used to generate true random numbers as keys multiple times; The key management module is used to feed back the default read identification code and write activation identification code to the memory access port module; receive the write activation command and write identification code, compare the consistency of the write identification code and the write activation identification code, and determine whether the activation is successful. ; When activation fails, receive the write command and determine whether it is writable. When it is writable, use the physical unclonable function module to generate an encryption identification code, and use the true random number generator module to generate the key and send it to the encryption and decryption module; when it is not writable, When, use the default reading identification code to initiate an encryption request; When the activation is successful, the write command is received, the physical unclonable function module is used to generate the encryption identification code, and the true random number generator module is used to generate the key and send it to the encryption and decryption module; The encryption and decryption module is used to receive the encryption request and the corresponding key, encrypt the data, transfer the encrypted data to the data transmission module, and initiate a write data request; receive the decryption request and the corresponding key, and decrypt the data. , and transmit the decrypted data to the data transmission module and initiate a read data request; The data transmission module, according to the write data request and read data request issued by the encryption and decryption module, initiates a write data request and a read data request to the storage module to transmit read/write data; The formatting module is used to send write data requests to the data transmission module in sequence when receiving the formatting request until the corresponding storage area of the security processing module is completely covered. 4. The data security storage device based on three-dimensional heterogeneous integration according to claim 3, characterized in that the key management module further includes: When receiving the write completion command, the encrypted identification code is fed back to the memory access port module; When the read command is received, the key is decoded and whether the decoding is successful; if the decoding is unsuccessful, error information is fed back to the memory access port module; if the decoding is successful, a decryption request is initiated to the encryption and decryption module and the corresponding key is transmitted. 5. A data storage method based on a three-dimensional heterogeneous integration data security storage device, characterized in that it is implemented by a three-dimensional heterogeneous integration-based data security storage device according to any one of claims 1-4, the method include: Step S1, format the data security storage device and obtain the write activation identification code _Wi , i=1,...,n; Step S2: Send the encrypted interval ID and the corresponding write activation identification code _Wi to the data security storage device for write activation; Step S3: After the write activation is determined to be successful, a write request is sent to the data security storage device; Step S4: Write a write completion command to the data storage device, determine the memory access identification port, and the data storage device feeds back the write completion signal and the corresponding read identification code R _i; Step S5: Send a read request to the data security storage device. 6. The data storage method of data security storage device based on three-dimensional heterogeneous integration according to claim 5, characterized in that the step S2 specifically includes the following sub-steps: Step S201: Send the write activation instruction and the corresponding address interval to the data secure storage device, including: the write activation identification code _Wi corresponding to the address interval and data interval transmission; Step S202, the memory access port module in the data security storage device transmits the write activation command and the corresponding address range to the corresponding security processing module; Step S203, the security processing module determines whether the write activation identification code _Wi is correct; When the write activation identification code _Wi is correct, perform write activation on the data security storage device; When the write activation identification code _Wi is wrong, a recognition error signal is fed back. When the number of recognition errors exceeds the threshold, the external memory access port is locked. 7. The data storage method of a three-dimensional heterogeneous integrated data security storage device according to claim 5, characterized in that step S3 specifically includes the following sub-steps: Step S301, the external processor sends a write instruction, a write request target area, and write data to the data security storage device; Step S302: The memory access port module determines whether the write request target area is consistent with the activated area of the security processing module; When the areas are inconsistent, the number of failures is recorded. When the number of failures is greater than the threshold, the activation status of the security processing module is cleared; When the areas are consistent, the write instructions and write data are transmitted to the security processing module according to the write request target area; Step S303: The security processing module encrypts the written data. 8. The data storage method of data security storage device based on three-dimensional heterogeneous integration according to claim 5, characterized in that the step S5 specifically includes the following sub-steps: Step S501, the external processor sends a read instruction, read address, and read identification code to the data security storage device; Step S502: The memory access port module determines the corresponding security processing module according to the read address, and transmits the read instruction and read identification code to the corresponding security processing module; Step S503, the security processing module decrypts the read identification code into a key and compares it with the stored key; When the key is inconsistent with the storage key, a recognition error signal is fed back and the number of recognition errors is recorded. When the number of recognition errors is greater than the threshold, the external memory access port is locked; If the key is consistent with the storage key, a read request is sent to the storage module, and the obtained data is decrypted using the key, transmitted to the memory access port module, and a read completion signal is fed back. 9. A computer-readable storage medium, characterized in that the storage medium stores a computer program, and when the computer program is executed by a processor, the data storage method according to any one of claims 5-8 is implemented. 10. An electronic device, characterized in that it includes a memory, a three-dimensional heterogeneous integration-based data security storage device as claimed in any one of claims 1 to 4, and a three-dimensional heterogeneous integration-based data storage device stored in the memory and capable of being stored in the memory. Programs running on devices where data is securely stored.