Design method, system and platform for physical protection of key signals in SSD master control chip
By designing the wiring to the corresponding metal layer according to the security level of the key signals, the problem of insufficient security dependence on software for existing SSD master chips is solved, and physical security and data storage security are improved.
Patent Information
- Application Number
- CN202011243345.1
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2020-11-10
- Publication Date
- 2025-03-11
- Estimated Expiration
- 2040-11-10
AI Technical Summary
The security of existing SSD master chips mainly relies on software implementation, which is prone to hacking and leads to data leakage, and lacks physical security protection.
By determining the number of metal layers based on the security level of the critical signal and designing the traces of the critical signal into the corresponding metal layer, the traces of the high security level are designed to a deeper metal layer, thereby increasing the difficulty of the attacker.
It improves the physical security of the SSD master chip, increases the difficulty of attackers, prevents data leakage, and enhances the security of data storage.
Smart Images
Figure CN112257385B_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the technical field of SSD solid state hard disks, and in particular to a method, system and platform for designing physical protection of key signals in an SSD master control chip. Background Art
[0002] SSD data storage has gradually become the main storage medium for consumer device data storage and cloud storage. For data storage, data security is of great significance, especially for data storage devices related to personal privacy and national security.
[0003] As the brain of SSD storage devices, the security performance of SSD master chip is particularly important. At present, the design of SSD master chip mainly considers performance and power consumption, and the security of the chip is mainly achieved through software. Although the software can resist certain intrusions, it is also very easy to be attacked by hackers and cause data leakage. Therefore, there are certain limitations to achieving the security of SSD master chip through software. Summary of the invention
[0004] In view of this, in order to solve one of the technical problems in the related art to a certain extent, it is necessary to provide a method, system and platform for designing physical protection of key signals in an SSD master control chip to enhance the physical security protection of the SSD master control chip.
[0005] The present invention provides a method for designing physical protection of key signals in an SSD master control chip, the method comprising:
[0006] Determine the number of metal layers according to the security level of key signals related to data security;
[0007] Find the path of the key signal in the SSD chip design netlist and design the routing corresponding to the key signal into the corresponding metal layer according to the security level of the key signal. The routing corresponding to the key signal with a higher security level is designed into a deeper metal layer.
[0008] Through the above scheme, it can be known that the present invention can specially design the routing corresponding to the key signals. The routing corresponding to the key signals with low security levels are designed to the metal layer closer to the surface, and the routing corresponding to the key signals with high security levels are designed to the metal layer closer to the deeper layer. The attacker needs to pass through or cut open the upper metal layer of the multi-layer chip to obtain the deepest routing design. At this time, after reaching the bottom layer, the upper connection structure is almost completely damaged and the chip will fail, thereby increasing the difficulty of attacking the SSD main control chip.
[0009] The present invention provides a method for designing physical protection of key signals in an SSD master control chip, the method comprising:
[0010] According to the security levels of key signals related to data security, a list of key security signals with different security levels is formed, and the design paths where the key signals are located in the RTL code are recorded in the list of key security signals with different security levels;
[0011] Import the RTL code into the logic synthesis tool (Design compiler) to complete circuit synthesis and generate SVF files and SSD chip design netlists. The SVF file records the mapping relationship between the RTL code and the netlist units.
[0012] Output a total list of key safety signal positions according to the path information of key signals in the RTL code recorded in the key safety signal list of different security levels and according to the mapping relationship from the RTL code to the netlist unit recorded in the SVF file, wherein the total list of key safety signal positions records the positions of all key signals in the netlist;
[0013] According to the security level of the critical signal, the total list of critical security signal positions is split into position sub-lists of different security levels according to the security level. Each position sub-list records the position of the signal to be protected at the corresponding security level in the netlist.
[0014] The sublist of locations for each security level is sequentially imported into the chip layout tool;
[0015] The chip layout tool designs the layout of the routing corresponding to the signals in the position sublist according to the metal layers that are allowed to route at each configured security level. The routing corresponding to the critical signals with higher security levels is designed into deeper metal layers.
[0016] It can be seen from the above scheme that the present invention only needs to determine which are the critical signals and the security level of the critical signals, and can automatically design the routing corresponding to the critical signals. The routing corresponding to the critical signals with low security levels is designed to the metal layer closer to the surface, and the routing corresponding to the critical signals with high security levels is designed to the metal layer closer to the deeper layer, which saves a lot of manpower and avoids the risks caused by subjective experience. When an attacker attacks the SSD main control chip, he needs to pass through or cut open the upper metal layer of the multi-layer chip to obtain the deepest routing design. At this time, after reaching the bottom layer, the upper connection structure is almost completely damaged and the chip will fail, thereby increasing the difficulty of the SSD main control chip being attacked. BRIEF DESCRIPTION OF THE DRAWINGS
[0017] Figure 1 This is a flow chart of the first embodiment of the present invention.
[0018] Figure 2 This is a flow chart of a second embodiment of the present invention.
[0019] Figure 3 It is a schematic structural diagram of a platform according to one embodiment of the present invention.
[0020] Figure 4 It is a schematic structural diagram of a system according to the first embodiment of the present invention.
[0021] Figure 5 It is a schematic structural diagram of a system according to a second embodiment of the present invention.
[0022] The following specific implementation manner will further illustrate the present invention in conjunction with the above-mentioned drawings. DETAILED DESCRIPTION
[0023] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work belong to the protection scope of the present invention. It is understood that the drawings are only provided for reference and explanation, and are not used to limit the present invention.
[0024] like Figure 1 As shown, the first embodiment of the present invention provides a method for designing physical protection of key signals in an SSD master control chip, comprising the following steps:
[0025] S101: Determine the number of metal layers according to the security level of key signals related to data security.
[0026] The key signals related to data security have different importance according to their functions, and the security level of the key signals is determined according to the importance. Generally, the switch enable switch signal of the chip global security world and the chip root key signal can be used as the highest security level signal, which is the first security level, the random number generated by the chip random number generator is the second security level signal, which is the second security level, the user derived key is the third security level signal, and its level is the third security level, and so on.
[0027] Generally, the number of metal layers is consistent with the security level of the critical signal.
[0028] S102: Find the path of the critical signal in the SSD chip design netlist and design the routing corresponding to the critical signal into the corresponding metal layer according to the security level of the critical signal, wherein the routing corresponding to the critical signal with a higher security level is designed into a deeper metal layer.
[0029] More preferably, this step may also include: designing the routing corresponding to several levels of signals before and after the critical signal into the corresponding metal layer. The higher the security level of the critical signal, the more levels of signals that need to be protected before and after. This can prevent attackers from obtaining the critical signal through the front and back level signals of the critical signal, improve the physical security of the critical signal, and increase the protection range of the critical signal.
[0030] This implementation can specially design the routing corresponding to the key signals. The routing corresponding to the key signals with a low security level is designed to the metal layer closer to the surface, and the routing corresponding to the key signals with a high security level is designed to the metal layer closer to the deeper layer. The attacker needs to pass through or cut open the upper metal layer of the multi-layer chip to obtain the deepest routing design. At this time, after reaching the bottom layer, the upper connection structure is almost completely damaged and the chip will fail, thereby increasing the difficulty of attacking the SSD main control chip.
[0031] like Figure 2 As shown, the method for designing physical protection of key signals in an SSD master control chip provided in the second embodiment of the present invention includes the following steps:
[0032] S201: forming a list of key security signals of different security levels according to the security levels of key signals related to data security, and recording the design paths of the key signals in the RTL code into the list of key security signals of different security levels.
[0033] After completing the RTL code of the SSD master control chip, a list of key security signals with different security levels can be formed according to the security level of key signals related to data security, and the design path of the key signal in the RTL code can be recorded in the list of key security signals with different security levels. The key signal can be a register signal in the RTL design.
[0034] S202: Import the RTL code into a logic synthesis tool (Design compiler) to complete circuit synthesis and generate an SVF file and an SSD chip design netlist, wherein the SVF file records the mapping relationship between the RTL code and the netlist unit.
[0035] S203: Output a total list of critical safety signal locations based on the path information of critical signals in the RTL code recorded in the critical safety signal list of different security levels and based on the mapping relationship from the RTL code to the netlist unit recorded in the SVF file, wherein the total list of critical safety signal locations records the locations of all critical signals in the netlist.
[0036] After this step, it can also include: including several levels of signals before and after the critical signal as safety signals and the safety level of the several levels of signals before and after is consistent with that of the critical signal, and then adding the several levels of signals before and after together with the critical signal to a list of critical safety signals to obtain a total list of signal positions of the signals that ultimately need to be protected in the netlist.
[0037] Specifically, the higher the security level of the critical signal, the more signal levels that need to be protected before and after it, which increases the protection range of the critical signal. This can prevent attackers from obtaining the critical signal through the signals before and after the critical signal, thereby improving the physical security of the critical signal.
[0038] S204: According to the security level to which the critical signal belongs, the total list of critical security signal positions is split into position sub-lists of different security levels according to the security level, and each position sub-list records the position of the signal to be protected of the corresponding security level in the netlist.
[0039] The sublist is divided into a position sublist of the first security level, a position sublist of the second security level, ..., a position sublist of the Nth security level. The position sublist of each security level records the position of the signal that ultimately needs to be protected of the corresponding security level in the netlist.
[0040] S205: The location sublists of each security level are sequentially imported into the chip layout tool.
[0041] S206: The chip layout tool performs layout design on the routing corresponding to the signal in the position sublist according to the metal layer that allows routing at each configured security level, wherein the routing corresponding to the critical signal with a higher security level is designed into a deeper metal layer.
[0042] This implementation only needs to determine which are the critical signals and the security level of the critical signals, and can automatically design the routing corresponding to the critical signals. The routing corresponding to the critical signals with low security levels is designed to the metal layer closer to the surface, and the routing corresponding to the critical signals with high security levels is designed to the metal layer closer to the deeper layer, which saves a lot of manpower and avoids the risks caused by subjective experience. If an attacker attacks the SSD main control chip, he needs to pass through or cut open the upper metal layer of the multi-layer chip to obtain the deepest routing design. At this time, after reaching the bottom layer, the upper connection structure is almost completely damaged and the chip will fail, thereby increasing the difficulty of attacking the SSD main control chip.
[0043] Figure 3This is a structural diagram of an embodiment of a platform 100 for designing physical protection of key signals in an SSD master control chip provided by the present invention. The platform 100 may include a processor 10, a storage device 20, and a computer program stored in the storage device 20 and executable on the processor 10, such as a design program.
[0044] A computer program can be stored in the storage device 20 , and the computer program can be executed by the processor 10 to implement the methods described in the first and second embodiments.
[0045] The processor 10 may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor, etc. The processor is the control center of the platform 100, and uses various interfaces and lines to connect various parts of the entire platform 100.
[0046] The storage device 20 can be used to store the computer program and / or module. The processor 10 implements various functions of the platform by running or executing the computer program and / or module stored in the storage device 20 and calling the data stored in the storage device 20. The storage device 20 can mainly include a program storage area and a data storage area, wherein the program storage area can store the operating platform, at least one program required for the function, etc.; the data storage area can store data created according to the use of the mobile phone, etc. In addition, the storage device 20 can include a high-speed random access storage device, and can also include a non-volatile storage device, such as a hard disk, a memory, a plug-in hard disk, a smart memory card, a secure digital card, a flash memory card, at least one disk storage device, a flash memory device, or other non-volatile solid-state storage devices.
[0047] Figure 4 The structural diagram of the first embodiment of the system 200 for designing physical protection of key signals in the SSD master chip provided by the invention, the system 200 for designing physical protection of key signals in the SSD master chip may include a determination module 211 and a wiring module 212.
[0048] The determination module 211 is used to determine the number of metal layers according to the security level of the key signal related to data security;
[0049] The wiring module 212 is used to find the path of the key signal in the SSD chip design netlist and design the routing corresponding to the key signal into the corresponding metal layer according to the security level of the key signal, wherein the routing corresponding to the key signal with a higher security level is designed into a deeper metal layer.
[0050] Furthermore, the wiring module 212 is also used to design the routing lines corresponding to the signals of several levels before and after the key signal into the corresponding metal layer.
[0051] Furthermore, the higher the security level of the critical signal, the more levels of signals before and after it need to be protected.
[0052] Figure 5 The structural schematic diagram of the second embodiment of the system 200 for designing physical protection of key signals in the SSD master control chip provided by the invention, the system 200 for designing physical protection of key signals in the SSD master control chip may include a forming module 221, a reading module, a circuit integration module 222, an output module 223, a splitting module 224, an import module 225, and a wiring module 226.
[0053] The forming module 221 is used to form a list of key security signals of different security levels according to the security levels of key signals related to data security and record the design paths of the key signals in the RTL code into the list of key security signals of different security levels;
[0054] The circuit synthesis module 222 is used to import the RTL code into a logic synthesis tool (Design compiler) to complete circuit synthesis and generate an SVF file and an SSD chip design netlist, wherein the SVF file records the mapping relationship between the RTL code and the netlist unit;
[0055] The output module 223 is used to output a total list of key safety signal positions according to the path information of the key signals recorded in the key safety signal list of different security levels in the RTL code and according to the mapping relationship from the RTL code to the netlist unit recorded in the SVF file, wherein the total list of key safety signal positions records the positions of all key signals in the netlist;
[0056] The splitting module 224 is used to split the total list of key safety signal positions into position sub-lists of different security levels according to the security level of the key signal, each position sub-list records the position of the signal to be protected of the corresponding security level in the netlist;
[0057] The import module 225 is used to import the location sublist of each security level into the chip layout tool in sequence;
[0058] The routing module 226, the chip layout tool, performs layout design on the routing corresponding to the signal in the position sublist according to the metal layer that allows routing at each configured security level, wherein the routing corresponding to the critical signal with a higher security level is designed into a deeper metal layer.
[0059] Furthermore, the system 200 also includes an inclusion module and a location list module.
[0060] The inclusion module is used to include several levels of signals before and after the critical signal as safety signals before splitting the total list of critical safety signal positions into position sub-lists of different safety levels according to the safety level, and the signals before and after the critical signal have the same safety level as the critical signal;
[0061] The position list module is used to add the previous and next several level signals together with the key signal into the key safety signal list to obtain a total signal position list of the signals that ultimately need to be protected in the netlist.
[0062] Furthermore, the higher the security level of the critical signal, the more levels of signals before and after it need to be protected.
[0063] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present invention should be included in the protection scope of the present invention.
Claims
1. A method for designing physical protection of key signals in an SSD master control chip, characterized in that: The method comprises: According to the security levels of key signals related to data security, a list of key security signals with different security levels is formed, and the design paths where the key signals are located in the RTL code are recorded in the list of key security signals with different security levels; Import the RTL code into the logic synthesis tool Design compiler to complete circuit synthesis and generate SVF files and SSD chip design netlists. The SVF file records the mapping relationship between the RTL code and the netlist units. Output a total list of key safety signal positions according to the path information of key signals in the RTL code recorded in the key safety signal list of different security levels and according to the mapping relationship from the RTL code to the netlist unit recorded in the SVF file, wherein the total list of key safety signal positions records the positions of all key signals in the netlist; According to the security level of the critical signal, the total list of critical security signal positions is split into position sub-lists of different security levels according to the security level. Each position sub-list records the position of the signal to be protected at the corresponding security level in the netlist. The sublist of locations for each security level is sequentially imported into the chip layout tool; The chip layout tool designs the layout of the routing corresponding to the signals in the position sublist according to the metal layers that are allowed to route at each configured security level. The routing corresponding to the critical signals with higher security levels is designed into deeper metal layers.
2. The method for designing physical protection of key signals in an SSD master control chip according to claim 1, characterized in that: Before splitting the total list of key safety signal positions into position sub-lists of different safety levels according to the safety level, the method further includes: The preceding and following signals of the critical signal are included as safety signals, and the safety level of the preceding and following signals is consistent with that of the critical signal; The signals of several previous and subsequent levels are added together with the critical signal into the critical safety signal list to obtain a total list of signal positions of the signals that ultimately need to be protected in the netlist.
3. The method for designing physical protection of key signals in an SSD master control chip according to claim 2, characterized in that: The higher the security level of the critical signal, the more signal levels before and after it need to be protected.
4. A system for designing physical protection of key signals in an SSD main control chip, characterized in that: The system comprises: A forming module, used for forming a list of key security signals of different security levels according to the security levels of key signals related to data security and recording the design paths of the key signals in the RTL code into the list of key security signals of different security levels; The circuit synthesis module is used to import the RTL code into the logic synthesis tool Design compiler to complete the circuit synthesis and generate the SVF file and SSD chip design netlist. The SVF file records the mapping relationship between the RTL code and the netlist unit; An output module, used to output a total list of key safety signal positions according to path information of key signals in the RTL code recorded in the key safety signal list of different security levels and according to a mapping relationship from the RTL code to the netlist unit recorded in the SVF file, wherein the total list of key safety signal positions records the positions of all key signals in the netlist; A splitting module is used to split the total list of key safety signal positions into position sub-lists of different security levels according to the security level to which the key signals belong, and each position sub-list records the position of the signal to be protected at the corresponding security level in the netlist; Import module, the location sublist for each security level is imported into the chip layout tool in turn; In the routing module, the chip layout tool performs layout design on the routing corresponding to the signals in the position sublist according to the metal layers that allow routing at each configured security level. The routing corresponding to the critical signals with higher security levels is designed into deeper metal layers.
5. The system for designing physical protection of key signals in an SSD master control chip according to claim 4, characterized in that: The system further comprises: An inclusion module, used for including several levels of signals before and after the critical signal as safety signals before splitting the total list of critical safety signal positions into position sub-lists of different safety levels according to the safety level, and the signals before and after the critical signal have the same safety level as the critical signal; The position list module is used to add the previous and next several level signals together with the key signal into the key safety signal list to obtain the signal position list of the signal that ultimately needs to be protected in the netlist.
6. A physical protection design platform for key signals in an SSD master control chip, characterized in that: The platform includes: Processor; and A storage device storing a computer program, wherein the computer program, when executed by a processor, is used to execute the steps of a method for designing physical protection for key signals in an SSD master control chip as described in any one of claims 1 to 3.