Key generation method, scrambling method for register address, descrambling method, and chip

Abstract

The application provides a key generation method, a register address scrambling method, a descrambling method and a chip. The key generation comprises generating a periodic pseudo-random sequence by using a linear feedback shift register, and generating an index value based on an original address; a sub-sequence is intercepted from the pseudo-random sequence according to the index value, and the bit width of the sub-sequence is the same as that of the original address; and a key is generated according to the sub-sequence and a static seed. The application utilizes a dynamic index mechanism, that is, the low bits of the original address are used as a variable index, to solve the problem of static mode address leakage. In addition, the application also realizes address consistency, that is, the static seed is used to ensure scrambling consistency of chips of the same type, and also realizes low resource consumption. The linear feedback shift register (PRBS) algorithm and the lightweight XOR operation are used, and compared with other complex encryption and hardware-level encryption, low delay and low consumption are brought, and the method is more suitable for register-level access.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of processor security technology, and in particular to a key generation method based on PRBS dynamic index, a scrambling and descrambling method of register address, and a chip. BACKGROUND

[0002] In the field of embedded systems, chips and processor applications, the register address exposed on the bus can be maliciously probed, which may lead to sensitive information leakage or register content tampering. In actual use, the register address needs to be opened to the user to facilitate the user to configure the related functions. In order to avoid the leakage of the register physical address leading to data content tampering, the register address needs to be encrypted. Because the register address is accessed frequently and has high real-time requirements, the encrypted addresses of the same batch of chips must be consistent, so higher requirements are put forward for the encryption algorithm.

[0003] In the prior art, the first is to use address confusion and dynamic mapping to dynamically map the physical register address and the logical address, control the mapping relationship through the key, the second is to use a special encryption circuit integration, embed an encryption unit in the register access path, and encrypt the input address signal in real time to generate an encrypted address to access the register group, and the third is to use a register write protection mechanism to control the access permission of the sensitive address of the register by configuration, and realize permanent protection by combining hardware fusing or key verification.

[0004] The above-mentioned schemes have the following defects, first, using a fixed mask for confusion encryption is easy to be cracked by multiple sampling, and the encryption ability is poor, second, using a complex encryption algorithm for encryption has large encryption delay and high hardware overhead, and third, using a dynamic seed cannot guarantee the consistency of the encryption result. SUMMARY

[0005] The first object of the present application is to provide a key generation method based on PRBS dynamic index.

[0006] The second object of the present application is to provide a scrambling method of register address applying the above-mentioned key generation method.

[0007] The third object of the present application is to provide a descrambling method of register address applying the above-mentioned key generation method.

[0008] The fourth object of the present application is to provide a chip executing the above-mentioned scheme.

[0009] In order to achieve the first object of the present application, the present application provides a key generation method, comprising:

[0010] A linear feedback shift register is used to generate a pseudo-random sequence;

[0011] An index value is generated based on the original address;

[0012] a sub-sequence is cut from the pseudo-random sequence according to the index value, and a bit width of the sub-sequence is same as a bit width of the original address;

[0013] a key is generated according to the sub-sequence and a static seed.

[0014] As can be seen from the above, since the PRBS sequence has very close statistical characteristics to a real random sequence due to its good randomness and periodicity, it is more conducive to implementation of cutting a new sub-sequence from the same long main PRBS sequence as a session key, compared to a simple hash chain index in the prior art, which although seems random, there is strong correlation between the sequences, and cracking one may help subsequent deduction cracking, and using a dynamic index mechanism, a variable index is generated by the original address, solving the problem of static mode address leakage, in addition, address consistency is also achieved, that is, using a static seed to ensure scrambling consistency of the same type of chip, and low resource overhead is also achieved, using linear feedback shift register (PRBS) algorithm operation, relative to other complex encryption and hardware-level encryption, low delay and low consumption are brought, and it is more suitable for register-level access.

[0015] In addition, the present case adopts multi-level key generation, increases additional randomness and security, and does not need to share the session key in advance, the decrypted information is hidden in the data itself of the original address, a self-contained decryption mechanism, and the change of the low bits of the address causes the encryption key to be different each time, the existence of the static seed ensures that the system is still safe even if the PRBS is cracked, the complex bit operation increases the difficulty of reverse engineering and improves the anti-analysis capability. And in the balance, the number of 0 and 1 is roughly equal, and in the run characteristic, the appearance law of continuous 0 or 1 conforms to the random expectation, and in the autocorrelation characteristic, the present case has a sharp two-value autocorrelation function.

[0016] A further scheme is that the index value is generated based on N-bit data of the original address.

[0017] A further scheme is that the N-bit data is low N-bit data or middle N-bit data of the original address.

[0018] As can be seen from the above, by using the low bits or middle bits of the original address as a variable index, the problem of static mode address leakage is solved, in addition, address consistency is also achieved, that is, using a static seed to ensure scrambling consistency of the same type of chip, and low resource overhead is also achieved.

[0019] A further scheme is that N is between 8 and 16.

[0020] As can be seen from the above, while ensuring the randomness of the index, the operation complexity is controlled, the common embedded system data bit width is adapted, the security and implementation cost are considered, at the same time, additional complexity in calculation caused by too long offset is avoided, or the value range is too small and the change is not enough to be cracked.

[0021] Further, the step of intercepting the sub-sequence from the pseudo-random sequence according to the index value comprises: taking the index value as an intercept start position of the pseudo-random sequence; and intercepting the sub-sequence from the pseudo-random sequence starting from the intercept start position.

[0022] As can be seen from the above, the index value is taken as the intercept start position, and then the randomness of intercepting the sub-sequence is increased, and the intercept rule of the sub-sequence is related to the register address, so that the anti-interference capability is stronger.

[0023] Further, the pseudo-random sequence is generated on a linear feedback shift register through a polynomial.

[0024] As can be seen from the above, compared with a random number generator based on a software algorithm or a complex cryptography primitive, the LFSR has a small hardware implementation area, low power consumption, and high clock frequency. This makes it very suitable for integration into a chip (such as an MCU, SoC) sensitive to cost and power consumption, as a built-in security module, almost without increasing the overall overhead of the system, and by selecting different primitive polynomials (such as PRBS7, PRBS15, PRBS31), the period and randomness intensity of the sequence can be easily adjusted.

[0025] Further, the step of generating the key from the sub-sequence and the static seed comprises: performing an exclusive OR operation on the sub-sequence and the static seed bit by bit to generate a dynamic seed; and performing a position 1 operation on the low N-bit data of the dynamic seed to generate the key.

[0026] As can be seen from the above, through the exclusive OR operation which has a self-inverse operation, the hardware cost is low, the linear operation is used, good security is provided, the system design is simple, the lightweight encryption algorithm brings low delay and low consumption, and the method is more suitable for a register level scenario.

[0027] In order to achieve the second object of the present application, the present application provides a scrambling method of a register address, comprising:

[0028] The key generation method of the above-mentioned scheme is executed.

[0029] An encrypted address is generated according to the key and the original address.

[0030] In order to achieve the third object of the present application, the present application provides a descrambling method of a register address, comprising:

[0031] The low N-bit data of the original address is obtained by extracting the low N-bit data from the encrypted address and performing an exclusive OR operation on the low N-bit data.

[0032] The key generation method of the above-mentioned scheme is executed.

[0033] The original address is generated according to the key and the encryption address.

[0034] As can be seen from the above, the original address can be quickly recovered by using the reduction mechanism corresponding to the scrambling process, the correct index is provided for subsequent key regeneration, the correct start of the descrambling process is ensured, and based on the recovered address, the key consistent with the scrambling stage is dynamically regenerated, the scrambling and descrambling key synchronization is ensured, the safe and reliable information recovery is realized, and through the symmetry of the exclusive or operation, the original address is efficiently and accurately recovered, the chip can correctly perform addressing and data reading and writing, the system function integrity is not sacrificed while the safe transmission is realized.

[0035] In order to realize the fourth object of the present application, the present application provides a chip, when a computer reads and executes a computer program product, so that the method of the above-mentioned scheme is executed. BRIEF DESCRIPTION OF DRAWINGS

[0036] Figure 1 is a system block diagram of an embodiment of the scrambling method of the present application.

[0037] Figure 2 is a flowchart of an embodiment of the scrambling method of the present application.

[0038] Figure 3 is a flowchart of an embodiment of the descrambling method of the present application.

[0039] The present application is further described below in combination with the drawings and embodiments. DETAILED DESCRIPTION

[0040] Referring to Figure 1 and Figure 2 , the present application provides a key generation method based on PRBS dynamic index, which comprises the following steps: first, step S11 is performed, a linear feedback shift register (LFSR) is used to generate a periodic pseudo-random sequence (PRBS), which can use a polynomial x 3 ²+x²²+x²+1 to realize the longest period sequence, the PRBS31 sequence period is 2³²-1≈4.3 billion, which can ensure that the repetition probability is extremely low, of course, other polynomials can also be used according to actual conditions and hardware conditions, for example, when a polynomial x 7 +x³+1 is used, it has the same randomness and period, and the PRBS7 expansion formula is: 00011001 00011110 10110010 00111101 01100010 00111101 01100010 00111101 00011001 00011110 10110010 00111101 01100010 00111101 01100010 00111101

[0045] Through the above steps, the long-period pseudo-random sequence is efficiently generated by using the characteristics of less LFSR hardware resources and high operation efficiency, thereby providing a high-quality randomness basis for subsequent key generation.

[0046] Then, step S12 is performed to obtain the original address of the register, and an index value is generated based on the low N-bit data of the original address, preferably, 8≤N≤16. For example, when the original address of the register is 0x40001008, the low 16 bits of the register address are 0x1008. Since the low bits of the addresses in the same register group change frequently, for example, the low bits of 0x1000-0x101F in the 32-bit address are continuously changed, the mode leakage caused by the long-term fixation of the high bits is avoided. The method extracts the low bit part of the address which changes more frequently, effectively avoids the mode leakage risk caused by the long-term fixation of the high bits, and enhances the anti-analysis capability of the system.

[0047] Further, when data is written to the register, for the same register group, the data written is preferably avoided to be repeatedly written to the same address register, so that the low address of the same register group is different when adjacent multiple data is written to the same register group. In this way, the generated index value is different each time, and the generated key is more secure after subsequent calculation.

[0048] In addition, since the high address of the same register group is the same, if the high address is used to generate the index value, the index value generated for the same register group will be the same, which will affect the security of the key. Therefore, a high address application prohibition rule can be set, for example, in step S12, the high M-bit data of the original address is prohibited to generate the index value. According to the actual situation, the value of M can be 8, 16 or 32.

[0049] Then, step S13 is performed to extract a subsequence from the pseudo-random sequence according to the index value. The bit width of the subsequence is the same as the bit width of the original address. For example, according to the index value, 32 bits of data 0001111010110010 00111101 01100010 after the 8th bit are taken from the above PRBS7 expansion formula to obtain 0x7AC8F588, which is a 32-bit subsequence. The 32-bit subsequence is adapted to the 32-bit bit width of the original address. This step dynamically combines the hardware address and the pseudo-random sequence to ensure that each generated subsequence has uniqueness and unpredictability, thereby enhancing the dynamic random characteristics of the key.

[0050] Then, step S14 is performed to XOR the sub-sequence with the static seed bit by bit and generate a dynamic seed, for example, using the static seed 0x1F6EFF to perform XOR, i.e., 0x1F6EFF 0x7AC8F588 = 0x7AD79B15, thus, the obtained dynamic seed is 0x7AD79B15. This step further enhances randomness by introducing the static seed, so that the generated dynamic seed has both dynamic change and system-specific configuration, improving the system uniqueness and security of the key. Generally, the static seed is pre-set, for example, according to the model of the generated chip, the static seed of a chip is pre-set by the chip manufacturer, thus, for the same chip, the static seed is generally fixed, which can be pre-set when the chip is designed, so that the static seed is associated with the chip, which can ensure the scrambling consistency of the same model chip.

[0051] Further, for different models of chips, the pre-set static seed is different, thus, the static seed has the relevance of the chip model, which can reflect the system uniqueness of the specific model chip. Generating a dynamic seed based on a static seed can on the one hand take into account the static seed consistency of the same model chip, so that the address scrambling method of the same model chip has the same place; on the other hand, since the address scrambling method uses a dynamic seed, it can ensure that the generated dynamic seed is basically not the same each time, thereby improving the performance of address scrambling and further improving the security of data storage.

[0052] Finally, step S15 is performed to set the low N bits of the dynamic seed to 1 and generate a key. For example, the dynamic seed generated by step S14 is 0x7AD79B15, and the expression of the set-to-1 operation is: 0x7AD79B15 | (1 << 16-1) = 0x7AD79BFF, which sets all the low 16 bits of the dynamic seed to 1, and then generates the dynamic key 0x7AD79BFF. This step maintains the randomness of the high bits while enhancing the regularity and system adaptability of the key by uniformly setting the low bits, which is convenient for subsequent scrambling and descrambling processing.

[0053] When scrambling the register address, the key generation method described above is first executed, that is, steps S11 to S15 are executed, and then step S21 is executed to perform XOR processing between the key and the original address to obtain the encrypted address. For example, the original address is 0x40001008, and the key generated by the above steps is 0x7AD79BFF. Therefore, the calculation formula of step S21 is: original address 0x40001008 XOR key 0x7AD79BFF = 0x3AD78BF7, and the obtained encrypted address is 0x3AD78BF7. With the execution of step S22, the encrypted address 0x3AD78BF7 is output, and the chip transmits the encrypted address and the data DATA together on the system bus. This step performs real-time scrambling of the address by using a dynamic key, effectively hides the real access address, prevents the address pattern from being intercepted and analyzed by the outside, and enhances the security of the communication process.

[0054] Reference Figure 3 When descrambling the register address, step S31 is first executed to obtain the encrypted address through the bus, and then step S32 is executed to extract the low N-bit data from the encrypted address and perform XOR processing with all 1s to obtain the low N-bit data of the original address. For example, the encrypted address is 0x3AD78BF7, and the low 16-bit data 0x8BF7 is extracted. Then, the original address is calculated, that is, the low 16-bit data of the original address is calculated. For example, original address low 16-bit = encrypted address low 16-bit XOR 0xFFFF. Using the above example, the calculation formula is as follows: 0x8BF7 XOR 0xFFFF = 0x7408, and the low 16-bit data of the original address obtained is 0x7408.

[0055] Then, the key generation method of the above scheme is executed, the PRBS sequence is generated, the index value is generated according to the low 16-bit data of the original address, the subsequence 0x7AC8F588 is obtained from the PRBS7 expansion formula according to the index value, and then the key 0x7AD79BFF is generated according to the key generation method.

[0056] Finally, step S33 is executed to perform XOR processing between the key and the encrypted address to obtain the original address. The encrypted address 0x3AD78BF7 XOR the key 0x7AD79BFF = 0x40001008, so that the original address 0x40001008 is obtained by descrambling. The chip can read and write the data DATA on the original address according to the original address. Through this step, the original address can be efficiently and accurately restored at the receiving end, ensuring that the data can still be correctly addressed and read and written after encrypted transmission, and realizing the unity of security and functional integrity.

[0057] Computer-readable storage medium embodiment:

[0058] A computer readable storage medium, the storage medium stores a computer program or instructions, when the computer program or instructions are executed by a computer, the key generation method, scrambling method, descrambling method are executed. The storage medium can be widely used in embedded systems, chip security modules and communication equipment, and provides reliable support for realizing dynamic encryption and decryption of addresses, and has practicability and universality.

[0059] Chip embodiment:

[0060] A chip, the chip includes a processor, when the processor executes a computer program or instructions, the key generation method, scrambling method, descrambling method are executed.

[0061] Of course, the above scheme is only a preferred embodiment of the present application, in addition to the above embodiment, other ways can also be used to realize the purpose of the present application, for example, for generating a pseudo-random sequence, in addition to using the polynomial of the above embodiment, x 7 + x³ + 1 and other short polynomials have almost equal randomness, but shorter period and lower resource overhead, which are suitable for lightweight application scenarios with less stringent period requirements.

[0062] In addition, in addition to the index value based on the low N-bit data of the original address in the above embodiment, the index value can also be generated based on the middle N-bit data, such as the middle bit [10:4] of the address, which can avoid the pattern repetition caused by the frequent change of the low address bit, and use the relatively stable part of the address as the index to enhance the pattern concealment.

[0063] Furthermore, in addition to using the exclusive or operation, a modulo addition operation can also be used for generation, for example, the address in the above embodiment is 32 bits, so a modulo 2³² operation can be used to generate the key, and correspondingly, a modulo subtraction operation is needed for restoration during descrambling. And a permutation layer can also be added in seed generation, such as exclusive or constant or cyclic shift, which can improve the anti-algebraic attack ability, increase the complexity of seed generation, and enhance the robustness of the overall scheme through multi-layer confusion.

[0064] As can be seen from the above, the present application uses a dynamic index mechanism, that is, the low bits of the original address are used as a variable index to solve the problem of static mode address leakage, and also realizes the consistency of encrypted addresses, that is, using a static seed to ensure the consistency of scrambling for chips of the same type, and also realizes low resource overhead, using linear feedback shift register (PRBS) algorithm and lightweight exclusive or operation, which brings low delay and low consumption compared with other complex encryption and hardware-level encryption, and is more suitable for register-level access.

[0065] And use with the low bit of the scrambling process symmetry restoration mechanism, fast recovery of the original address low bit, for subsequent key regeneration provides the correct index, ensure the correct start of the scrambling process, and based on the recovered address low bit, re-dynamic generation and scrambling phase consistent key, ensure the key synchronization, realize safe, reliable information recovery, and through the symmetry of the XOR operation, efficient, accurate recovery of the original address, to ensure that the chip can correctly address and data read and write, in the realization of secure transmission while not sacrificing the integrity of the system function.

[0066] The method steps in the embodiments of the present application can be realized by hardware or by the way of executing software instructions by a processor. The software instructions can be composed of corresponding software modules, and the software modules can be stored in a random access memory, a flash memory, a read-only memory, a programmable read-only memory, an erasable programmable read-only memory, an electrically erasable programmable read-only memory, a register, a hard disk, a mobile hard disk, a CD-ROM or any other form of storage medium well known in the art. An exemplary storage medium is coupled to the processor, so that the processor can read information from the storage medium and write information to the storage medium. Of course, the storage medium can also be an integral part of the processor. The processor and the storage medium can be located in an ASIC. In addition, the ASIC can be located in a base station or a terminal. Of course, the processor and the storage medium can also exist as discrete components in the base station or the terminal.

[0067] It can be understood that the processor in the embodiments of the present application can be a central processing unit (CPU), and can also be other general-purpose processors, digital signal processors (DSP), application specific integrated circuits (ASIC), field programmable gate arrays (FPGA) or other programmable logic devices, transistor logic devices, hardware components or any combination thereof. The general-purpose processor can be a microprocessor, or any conventional processor.

[0068] The method steps in the embodiments of the present application can be implemented by hardware or by a processor executing software instructions. The software instructions can be composed of corresponding software modules, which can be stored in a random access memory, a flash memory, a read-only memory, a programmable read-only memory, an erasable programmable read-only memory, an electrically erasable programmable read-only memory, a register, a hard disk, a mobile hard disk, a CD-ROM, or any other form of storage medium well known in the art. An exemplary storage medium is coupled to the processor, so that the processor can read information from the storage medium and write information to the storage medium. Of course, the storage medium can also be an integral part of the processor. The processor and the storage medium can be located in an ASIC. In addition, the ASIC can be located in a base station or a terminal. Of course, the processor and the storage medium can also exist as discrete components in the base station or the terminal.

[0069] In the above embodiments, the implementation can be wholly or partially by software, hardware, firmware, or any combination thereof. When implemented by software, the implementation can be wholly or partially in the form of a computer program product. The computer program product includes one or more computer programs or instructions. When the computer programs or instructions are loaded and executed on a computer, the processes or functions of the embodiments of the present application are wholly or partially performed. The computer can be a general-purpose computer, a special-purpose computer, a computer network, a network device, a user equipment, or other programmable devices. The computer programs or instructions can be stored in a computer-readable storage medium or transferred from one computer-readable storage medium to another, for example, the computer programs or instructions can be transferred from one website, computer, server, or data center to another by wired or wireless means. The computer-readable storage medium can be any available medium accessible by the computer or data storage device such as a server, data center, etc. integrated with one or more available media. The available media can be a magnetic medium, for example, a floppy disk, a hard disk, a magnetic tape; an optical medium, for example, a digital video disc; or a semiconductor medium, for example, a solid-state disk. The computer-readable storage medium can be a volatile or non-volatile storage medium, or can include both volatile and non-volatile storage media.

[0070] In various embodiments of the present application, the terms and / or descriptions of different embodiments are consistent and can be mutually referred to if there is no special description and no logical conflict. The technical features in different embodiments can be combined to form new embodiments according to their inherent logical relationship.

[0071] Those skilled in the art will appreciate that embodiments of the present application can be readily used as a method, a system or a computer program product. Accordingly, the present application can take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment combining software and hardware aspects. Furthermore, the present application can take the form of a computer program product on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage etc.) embodying computer readable program code.

[0072] The present application is described in reference to the flow diagrams and / or block diagrams of the methods, apparatus (systems) and computer program products according to this application. It will be understood that each block of the flow diagrams and / or block diagrams, and combinations of blocks in the flow diagrams and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions specified in the flow diagrams and / or block diagrams block or blocks. Figure 1 one or more functions specified in one or more of the flow diagram or block diagram block or blocks. Figure 1 one or more functions specified in one or more of the flow diagram or block diagram block or blocks.

[0073] These computer program instructions can also be stored in a computer- readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instructions which implement the flow diagram or block diagram block or blocks. Figure 1 one or more functions specified in one or more of the flow diagram or block diagram block or blocks. Figure 1 one or more functions specified in one or more of the flow diagram or block diagram block or blocks.

[0074] It will be apparent to those skilled in the art that various modifications and variations can be made to the present application without departing from the scope of the application. Thus, it is intended that the present application cover the modifications and variations of this application provided they come within the scope of the appended claims and their equivalents.

Claims

1. A key generation method, characterized in that, include: A pseudo-random sequence is generated using a linear feedback shift register, wherein the pseudo-random sequence is generated by a polynomial on the linear feedback shift register; An index value is generated based on the original address. The index value is generated based on N bits of data from the original address, where the N bits are either the lower N bits or the middle N bits of data from the original address. A subsequence is extracted from the pseudo-random sequence based on the index value, wherein the bit width of the subsequence is the same as the bit width of the original address; A key is generated based on the subsequence and the static seed.

2. The key generation method according to claim 1, characterized in that: The value of N is between 8 and 16.

3. The key generation method according to claim 1, characterized in that: The step of extracting a subsequence from the pseudo-random sequence based on the index value includes: The index value is used as the starting position for truncating the pseudo-random sequence; The subsequence is extracted from the pseudo-random sequence starting from the extraction start position.

4. The key generation method according to any one of claims 1 to 3, characterized in that: The step of generating a key from the subsequence and the static seed includes: The subsequence is XORed with the static seed bitwise to generate a dynamic seed; The low N bits of the dynamic seed are set to 1, and a key is generated.

5. A method for scrambling a register address, characterized in that, include: Perform the key generation method according to any one of claims 1 to 4 above; An encrypted address is generated based on the key and the original address.

6. A method for descrambling register addresses, characterized in that, include: Obtain the encrypted address; Perform the key generation method according to any one of claims 1 to 4 above; The original address is generated based on the key and the encrypted address.

7. A chip, characterized in that, The chip includes a processor that, when the processor executes a computer program or instructions, causes the method as described in any one of claims 1 to 6 to be performed.

Images