A method for generating an error detection and correction circuit, an error detection and correction system, and a storage medium

Abstract

According to the method for generating the error detection and correction circuit, the error detection and correction system and the storage medium provided by the embodiment of the present application, the data transmitted by the data channel is received, the data includes sensitive data; the configuration file corresponding to the sensitive data is determined according to the attribute of the sensitive data, and the error detection and correction circuit is generated according to the configuration file; so that the error detection and correction circuit corresponding to the sensitive data is generated only when the sensitive data is operated, the error detection and correction circuit is generated through the error detection and correction module, and the multiplexing of the error detection and correction circuit is completed. The problems that different error detection and correction code circuits are configured for each sensitive data in the related art, and each error detection and correction code circuit cannot be multiplexed are solved.

Description

TECHNICAL FIELD

[0001] Embodiments of the present application relate to the field of reading and writing data storage, and in particular, to a method for generating error detection and correction circuit, an error detection and correction system and a storage medium. BACKGROUND

[0002] Cryptographic chips are subject to security threats from various attacks, such as side-channel attacks, fault injection attacks, and physical intrusion attacks. Fault injection attacks involve interfering with the operation of a chip using external stimuli such as lasers, electromagnetic radiation, or voltage, and using the fault state or incorrect operation results to achieve the purpose of attack. In related technologies, to resist fault injection attacks, cryptographic chips often use methods such as adding error detection codes or error correction codes to sensitive data for defense. To resist fault injection attacks, cryptographic security chips often use protection mechanisms such as secure sensors, error detection and correction codes, and redundant operations. Error detection and correction codes are aimed at whether the protected data is placed in error after a fault injection attack, rather than a specific fault injection method, so they are effective against any fault injection attack method. Error detection and correction codes are an important means of preventing fault injection attacks, and are therefore widely used.

[0003] Among them, the error detection code is to add redundant data to the protected sensitive data. These redundant data are generated according to certain error detection rules and exist in the chip's memory or register together with the protected data. For example, the commonly used parity check code. When these protected sensitive data and redundant data are placed in error by fault injection attacks, the newly calculated error detection code will be different from the previously stored error detection code. By comparing the two error detection codes, it can be determined whether the protected sensitive data has been injected by an attack and has changed. Error correction codes can correct sensitive data placed in error by fault injection attacks through certain operation rules to restore normality. At the same time, some error correction codes also have error detection functions.

[0004] As mentioned above, error detection codes and error correction codes can effectively protect against fault injection attacks on sensitive data, and are therefore commonly used protection means for cryptographic security chips. However, in related technologies, when there are many types of sensitive data to be protected, widely distributed and large in quantity, more error detection and correction code circuits and storage space are required, resulting in increased protection costs and power consumption. In particular, for some sensitive intermediate data that need to be protected, these intermediate data only appear and are used in a certain operation stage. If error detection and correction circuits are designed separately for these different types of intermediate data, a large amount of cost will be consumed. At the same time, after the completion of these intermediate operation processes, these error detection and correction circuits cannot be used for other non-intermediate data, resulting in resource waste and affecting system energy consumption.

[0005] In addition, after the design and production of the cryptographic chip are completed, a new fault injection attack method may appear, or a new fault injection device may appear to further improve the strength of the fault injection attack. At this time, the previously designed error detection and correction circuit may not be able to continue to fully guarantee the security of the cryptographic chip, or may not reach the expected security guarantee level. In the related art, the cryptographic chip hardware circuit is difficult to change, and the revision cycle is long, which leads to inconvenience in updating the error detection and correction circuit and the inability to provide sufficient protection. SUMMARY

[0006] The method for generating an error detection and correction circuit, the error detection and correction system, and the storage medium provided by the embodiments of the present application mainly solve the technical problem that when there are many types of sensitive data to be protected, the sensitive data are widely distributed, and the number of the sensitive data is large, a large number of error detection and correction code circuits need to be configured for the sensitive data, and different circuit resources and structures are required for the error detection and correction code circuits; and the error detection and correction code circuits cannot be reused, leading to resource waste; at the same time, a new fault injection attack method appears, or a new fault injection device appears to further improve the strength of the fault injection attack, and the previously designed error detection and correction circuit cannot continue to fully guarantee the security of the cryptographic chip.

[0007] To solve the above technical problem, the embodiments of the present application provide a method for generating an error detection and correction circuit; the method for generating an error detection and correction circuit comprises: receiving data transmitted by a data channel, the data comprising: sensitive data; determining a configuration file corresponding to the sensitive data according to the attribute of the sensitive data, and generating an error detection and correction circuit according to the configuration file;

[0008] Optionally, the attribute of the sensitive data comprises at least one of the following: the type of the sensitive data, the parameter of the sensitive data, and the function of the sensitive data.

[0009] Optionally, generating the error detection and correction circuit according to the configuration file comprises: generating an error detection code circuit according to the configuration file; and / or generating an error correction code circuit according to the configuration file.

[0010] Optionally, the method further comprises: checking the sensitive data by using the error detection and correction circuit.

[0011] Optionally, checking the sensitive data by using the error detection and correction circuit comprises: determining whether the received data contains a first error detection and correction code corresponding to the sensitive data; if not, generating the first error detection and correction code corresponding to the sensitive data by using the error detection and correction circuit, returning the first error detection and correction code through a transmission channel, and stopping the checking.

[0012] Optionally, checking the sensitive data by using the error detection and correction circuit comprises: generating a second error detection and correction code corresponding to the sensitive data according to the error detection and correction circuit; and when the second error detection and correction code is consistent with the first error detection and correction code, determining that the checking is passed.

[0013] Optionally, when the second error detection and correction code is consistent with the first error detection and correction code, the determining that the check passes further comprises: determining whether the sensitive data is subjected to a write operation; and if so, outputting the sensitive data and the second error detection and correction code to a target storage space corresponding to the write operation.

[0014] Optionally, the checking the data by the error detection and correction circuit comprises: generating a second error detection and correction code corresponding to the sensitive data according to the error detection and correction circuit; and when the second error detection and correction code is inconsistent with the first error detection and correction code, determining that the check fails, outputting the second error detection and correction code, and issuing a corresponding alarm.

[0015] Further, the present application also provides an error detection and correction system, comprising: a functional module, an embedded FPGA, an error detection and correction scheme selection module, and a configuration storage module; the configuration storage module is configured to store configuration files corresponding to respective sensitive data; the error detection and correction scheme selection module is configured to receive data transmitted from a data channel, the data comprising sensitive data; determine configuration files corresponding to the sensitive data according to attributes of the sensitive data, and send the configuration files to the embedded FPGA; and the embedded FPGA is configured to generate an error detection and correction circuit, a transmission channel, and a comparator module according to the configuration files.

[0016] Further, the present application also provides a storage medium storing one or more computer programs, which can be executed by one or more processors to implement the steps of the method for generating an error detection and correction circuit according to any one of the above.

[0017] The present application has the following beneficial effects:

[0018] According to the method for generating an error detection and correction circuit, the error detection and correction system, and the storage medium provided by the embodiments of the present application, data transmitted from a data channel is received, the data comprising sensitive data; configuration files corresponding to the sensitive data are determined according to attributes of the sensitive data, and an error detection and correction circuit is generated according to the configuration files; thus, the error detection and correction circuit is multiplexed only when the sensitive data is operated and the required error detection and correction code is different from the current error detection and correction circuit. The above method solves the problems in the related art that when the types of sensitive data to be protected are various, widely distributed, and large in quantity, more error detection and correction circuits need to be configured for different sensitive data, different circuit resources and structures are required for each error detection and correction circuit, each error detection and correction circuit cannot be multiplexed, resulting in resource waste, and the previously designed error detection and correction circuit cannot continue to fully guarantee the security of a cryptographic chip.

[0019] Other features and corresponding advantages of the present application will be set forth in part in the description that follows, and in part will be apparent from the description or can be learned by practice of the application. It is to be understood that both the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the application, as claimed. BRIEF DESCRIPTION OF DRAWINGS

[0020] Figure 1 A basic flowchart of a method for generating a detection and correction circuit is provided for an embodiment of the present application;

[0021] Figure 2 A basic flowchart of another method for generating a detection and correction circuit is provided for an embodiment of the present application;

[0022] Figure 3 A basic structure diagram of a detection and correction system is provided for an embodiment of the present application;

[0023] Figure 4 A basic structure diagram of a functional module is provided for an embodiment of the present application;

[0024] Figure 5 A basic functional structure diagram of an embedded FPGA in an embodiment of the present application. DETAILED DESCRIPTION

[0025] In order to make the objects, technical solutions and advantages of the present application clearer, further detailed description of the embodiments of the present application will be made in conjunction with the drawings. It should be understood that the specific embodiments described herein are only used to explain the present application and do not limit the present application.

[0026] Embodiment one:

[0027] In order to solve the problem that when there are many types of sensitive data to be protected, the sensitive data is widely distributed and the number of sensitive data is large, more detection and correction code circuits need to be configured for each sensitive data, and different circuit resources and structures are required for each detection and correction code circuit; and each detection and correction code circuit cannot be reused, resulting in waste of resources; at the same time, new fault injection attack methods appear, or new fault injection devices further improve the strength of fault injection attacks, and the previously designed detection and correction circuit cannot continue to fully protect the security of the cryptographic chip.

[0028] Please refer to Figure 1 , Figure 1 A basic flowchart of a method for generating a detection and correction circuit is provided for an embodiment of the present application, the method for generating a detection and correction circuit is applied to a detection and correction system, in some embodiments, the method for generating a detection and correction circuit includes:

[0029] S10, receiving data transmitted from a data channel, the data including sensitive data;

[0030] In some embodiments, inside the cryptographic chip, there are many modules and functions that need to be protected from fault injection attacks, different modules or different functions use or store different sensitive data, and different sensitive data requires different types or strengths of error detection and correction codes; and in the cryptographic chip, the operations of different modules are not always run in parallel, and there is a certain time sequence for the operations of different modules, which occur in sequence according to the time sequence, and the sensitive data that needs to be protected will also be operated in a certain order, wherein the operation of sensitive data includes but is not limited to any of the following: generation of sensitive data, reading of sensitive data, reading and writing of sensitive data. Therefore, the data transmitted by different modules or functions through the data channel has a time sequence, so that the received data transmitted by the data channel has a certain sequence;

[0031] For example, there are functional module 1, functional module 2, and functional module 3 containing sensitive data in the cryptographic chip at the same time, and the error detection and correction circuits required by the sensitive data in each functional module are different. When the cryptographic chip is running, functional module 1, functional module 2, and functional module 3 run in sequence. When functional module 1 runs, functional module 1 transmits the sensitive data currently being operated through the data channel. When functional module 1 runs, functional module 2 runs, and functional module 2 transmits the sensitive data currently being operated through the data channel. When functional module 2 runs, functional module 3 runs, and functional module 3 transmits the sensitive data currently being operated through the data channel; so that the sensitive data received by the data channel has a time sequence relationship. It should be understood that in some embodiments, functional module 1 and functional module 2 run in parallel at the same time, so the data channel can also receive the sensitive data transmitted by functional module 1 and functional module 2 at the same time, and the data channel transmits the data to the error detection and correction scheme selection module and the embedded FPGA respectively. It should be understood that in some embodiments, the data can also be transmitted only to the error detection and correction scheme selection module, and the error detection and correction scheme selection module transmits the data to the embedded FPGA.

[0032] S11, determining a configuration file corresponding to the sensitive data according to the attribute of the sensitive data, and generating an error detection and correction circuit according to the configuration file;

[0033] In some embodiments, the attribute of the sensitive data includes at least one of the following attributes: the type of the sensitive data, the parameter of the sensitive data, and the function of the sensitive data. The type of the sensitive data includes key data, configuration data, plaintext data, etc. The parameter of the sensitive data includes data bit width or length, etc. The function of the sensitive data includes encryption operation, authentication identification, etc.

[0034] In some embodiments, different sensitive data has different attributes, and the sensitive data corresponds to different configuration files, that is, different sensitive data can have the same attribute, and different attributes correspond to different error detection and correction circuit configuration schemes. In some embodiments, the configuration file of the error detection and correction circuit is stored in a separate configuration file storage. The configuration storage module is a non-volatile memory, which has a certain capacity, and the configuration storage module pre-stores configuration files corresponding to different sensitive data. In some embodiments, the configuration file is written into the configuration storage module through a chip test system or other secure interface during the production and manufacturing stage of the cryptographic chip; or an external data access interface of the configuration storage module is set to update and upgrade the data content of the configuration storage module according to actual needs during the use process after the chip production and manufacturing or initialization, so as to realize the upgrade of the error detection and correction configuration file.

[0035] In some embodiments, when the error detection and correction scheme selection module receives data transmitted by any functional module through the data channel, the error detection and correction scheme selector selects the error detection and correction circuit configuration scheme corresponding to the sensitive data according to the attribute of the sensitive data, that is, selects the corresponding configuration file.

[0036] In some embodiments, the error detection and correction scheme selection module sends the configuration file corresponding to the sensitive data to the embedded FPGA, and the embedded FPGA generates an error detection and correction circuit according to the configuration file. It should be understood that the embedded FPGA generates an error detection and correction circuit according to the configuration file includes at least one of the following: the embedded FPGA generates an error detection code circuit according to the configuration file; the embedded FPGA generates an error correction code circuit according to the configuration file. It should be understood that different sensitive data attributes have different corresponding configuration files, that is, the corresponding error detection code circuit and / or error correction code circuit are also different; the security protection strength and the error detection and correction rate of different sensitive data attributes can be different. It should be understood that according to the security protection strength and the error detection and correction rate, the embedded FPGA can generate at least one error detection circuit according to the configuration file, or the embedded FPGA can generate at least one error correction circuit according to the configuration file, or the embedded FPGA can generate at least one error correction circuit and at least one error detection circuit according to the configuration file.

[0037] In some embodiments, as shown in Figure 1 the method of generating an error detection and correction circuit further includes:

[0038] S12, checking the sensitive data through the error detection and correction circuit.

[0039] It needs to be understood that after the error detection and correction circuit is generated according to the configuration file corresponding to the sensitive data, the sensitive data can be checked through the error detection and correction circuit; in some embodiments, when the circuit generated according to the attribute of the sensitive data includes an error detection code circuit, it can be judged whether the sensitive data is attacked by fault injection attack, and when the circuit generated according to the attribute of the sensitive data includes an error correction code circuit, the error correction code circuit can be used to correct the error of the sensitive data, repair the error of the sensitive data, and output the repaired sensitive data through the transmission channel.

[0040] In some embodiments, before the sensitive data is checked through the error detection and correction circuit, it further includes: judging whether the received data contains the first error detection and correction code; when the received data does not contain the first error detection and correction code, generating the first error detection and correction code corresponding to the sensitive data through the generated error detection and correction circuit, and returning the first error detection and correction code to the corresponding module through the transmission channel, and stopping the current check; for example, the functional module 1 in the password chip transmits data A through the data channel, which only contains sensitive data and does not include the first error detection and correction code corresponding to the sensitive data, at this time, the first error detection and correction code is generated according to the sensitive data, and the error detection and correction code is returned to the functional module 1 through the transmission channel, so that the functional module 1 can save the first error detection and correction code corresponding to the sensitive data.

[0041] In some embodiments, checking the sensitive data through the error detection and correction circuit includes: generating the second error detection and correction code corresponding to the sensitive data according to the error detection and correction circuit; when the second error detection and correction code is consistent with the first error detection and correction code, it is determined that the check is passed; for example, when the data channel receives the data transmitted by the module, the sensitive data in it is transmitted to the error detection and correction scheme selection module, the error detection and correction scheme selection module selects the corresponding configuration file in the configuration storage module according to the attribute of the sensitive data, and sends the configuration file to the embedded FPGA, the embedded FPGA generates the error detection and correction circuit and the comparator module according to the configuration file corresponding to the sensitive data, calculates the second error detection and correction code corresponding to the sensitive data through the error detection and correction circuit, sends the second error detection and correction code to the comparator module, and also transmits the first error detection and correction code corresponding to the sensitive data to the comparator module, the comparator module compares the first error detection and correction code and the second error detection and correction code corresponding to the sensitive data, and when the first error detection and correction code and the second error detection and correction code corresponding to the sensitive data are consistent, it is determined that the check is passed, and it is determined that the sensitive data is not injected with error during storage and operation by fault injection attack. It needs to be understood that the specific calculation method of generating the first error detection and correction code through the error detection and correction circuit and generating the second error detection and correction code through the error detection and correction circuit is determined by the configuration data, and the specific calculation method is not limited in this embodiment, which includes but is not limited to at least one of the following: parity, cyclic redundancy check (CRC), memory error correction code (ECC).

[0042] In some embodiments, after determining that the second error detection and correction code is consistent with the first error detection and correction code, the method further comprises determining whether the sensitive data is subjected to a write operation; and if so, outputting the sensitive data and the second error detection and correction code to a target storage space corresponding to the write operation. For example, the sensitive data of functional module 1 needs to be written into functional module 2 inside the cryptographic chip, the data channel receives the data transmitted from functional module 1, and determines that the sensitive data in the data is not injected with errors by fault injection attack during the storage and operation of the sensitive data, and at the same time, the chip main processor or other control components determine that the sensitive data is subjected to a write operation and needs to be written into functional module 2. At this time, the sensitive data and the second error detection and correction code are output to functional module 2, so that functional module 2 can store the sensitive data and the corresponding second error detection and correction code, and use the second error detection and correction code as the first error detection and correction code. It should be understood that in some embodiments, the first error detection and correction code corresponding to the sensitive data can be directly output to functional module 2, so that functional module 2 can directly store the sensitive data and the corresponding first error detection and correction code.

[0043] In some embodiments, the verification of the data by the error detection and correction circuit comprises: generating a second error detection and correction code corresponding to the sensitive data by the error detection and correction circuit; when the second error detection and correction code is inconsistent with the first error detection and correction code, determining that the verification fails, outputting the second error detection and correction code, and issuing an alarm. For example, when the data channel receives the data transmitted from the module, the sensitive data is transmitted to the error detection and correction scheme selection module, and the sensitive data and the corresponding first error detection and correction code are sent to the embedded FPGA. The error detection and correction scheme selection module selects the corresponding configuration file in the configuration storage module according to the attribute of the sensitive data, and sends the configuration file to the embedded FPGA. After the embedded FPGA generates the error detection and correction circuit, the comparator module and the transmission channel according to the corresponding configuration file, the second error detection and correction code corresponding to the sensitive data is calculated by the error detection and correction circuit, and the second error detection and correction code is sent to the comparator module. When the first error detection and correction code and the second error detection and correction code corresponding to the sensitive data are inconsistent, it is determined that the verification fails, and it is determined that the sensitive data is injected with errors by fault injection attack during the storage and operation of the sensitive data. At this time, the second error detection and correction code is output by the comparator module through the transmission channel, and an alarm is issued that the sensitive data is injected with errors by fault injection attack during the storage and operation of the sensitive data.

[0044] The method for generating the error detection and correction circuit provided by the embodiment of the present application receives data transmitted by a data channel, the data including sensitive data; determines a configuration file corresponding to the sensitive data according to the attribute of the sensitive data, and generates an error detection and correction circuit according to the configuration file; so that the error detection and correction circuit corresponding to the sensitive data is generated according to the attribute of the sensitive data only when the sensitive data is operated and the required error detection and correction code is different from the current error detection and correction circuit, thereby completing the multiplexing of the error detection and correction circuit; meanwhile, in some embodiments, the sensitive data is verified by the generated error detection and correction circuit, thereby realizing the flexible selection of multiple error detection and correction functions, enriching the error detection and correction functions and flexibly meeting the needs of multiple data fault injection attack prevention; meanwhile, the multiplexing of the error detection and correction circuit is realized, thereby saving the circuit resource occupation. Meanwhile, the function of the error detection and correction circuit can be improved through the upgrade of the configuration file after the chip is put into use, thereby prolonging the life cycle of the safe use of the cryptographic chip, better resisting the threat brought by the new fault injection attack, and reducing the risk and cost of the chip revision.

[0045] Embodiment two:

[0046] For the convenience of understanding, the method for generating the error detection and correction circuit is described by taking a more specific example, as shown in FIG. 1, the method for generating the error detection and correction circuit includes the following steps. Figure 2

[0047] S20, receiving the data transmitted by any functional module through a data channel, the data including sensitive data.

[0048] In some embodiments, there are functional module 1 to functional module n in the cryptographic chip, the functional module 1 to the functional module n are various functional modules containing sensitive data, the number of the functional modules is determined according to the specific cryptographic chip model or specification, and the specifications, quantities and sensitive degrees of the respective sensitive data in these functional modules can be different, so the required error detection and correction circuits for preventing fault injection attacks can also be different; at the same time, only one functional module in the functional module 1 to the functional module n operates the sensitive data in the module; when any functional module operates the sensitive data therein, the functional module transmits the data containing the sensitive data to the error detection and correction scheme selection module and the embedded FPGA through a data channel; wherein the data channel refers to a data transmission path connecting the above functional module and the error detection and correction scheme selection module and connecting the above functional module and the embedded FPGA, the data channel is used for realizing the transmission of the sensitive data and the error detection and correction code, and the data channel can be a data bus of the chip or a special data transmission channel independent of the conventional bus system of the chip.

[0049] S21, the error detection and correction scheme selection module determines the configuration file corresponding to the sensitive data according to the attribute of the sensitive data.

[0050] ​In some embodiments, the error detection and correction scheme selection module receives data from the data channel, and determines a corresponding configuration file according to sensitive data in the data; the configuration file is a configuration file of the error detection and correction circuit, and is stored in a separate configuration file storage; the configuration storage module is a non-volatile memory with a certain capacity, and the configuration storage module pre-stores configuration files corresponding to different sensitive data; in some embodiments, the configuration file is written into the configuration storage module through a chip test system or other secure interface during the production and manufacturing stage of the cryptographic chip; or an external data access interface of the configuration storage module is set to update and upgrade the data content of the configuration storage module according to actual needs during the use process after the chip production and manufacturing or initialization, so as to realize the upgrade of the error detection and correction configuration file.

[0051] In some embodiments, when the error detection and correction scheme selection module receives data from each module through the data channel, the error detection and correction scheme selection module selects a configuration scheme of the error detection and correction circuit corresponding to the sensitive data according to the attribute of the sensitive data, that is, selects a corresponding configuration file; the error detection and correction scheme selection module sends the configuration file corresponding to the sensitive data determined to the embedded FPGA;

[0052] S22, the embedded FPGA generates an error detection and correction circuit according to the configuration file.

[0053] In some embodiments, the embedded FPGA generates a transmission channel, an error detection and correction circuit, and a comparator module according to the configuration file; it should be understood that the embedded FPGA generates an error detection and correction circuit according to the configuration file, including at least one of the following: the embedded FPGA generates an error detection code circuit according to the configuration file; the embedded FPGA generates an error correction code circuit according to the configuration file; it should be understood that different sensitive data attributes correspond to different configuration files, that is, their corresponding error detection code circuits and / or error correction code circuits are also different; the security protection strength and the error detection and correction rate of different sensitive data attributes can be different; it should be understood that according to the security protection strength and the error detection and correction rate, the embedded FPGA can generate at least one error detection circuit according to the configuration file, or the embedded FPGA can generate at least one error correction circuit according to the configuration file, or the embedded FPGA can generate at least one error correction circuit and at least one error detection circuit according to the configuration file.

[0054] In some embodiments, the method of generating an error detection and correction circuit further comprises:

[0055] S23, the comparator module verifies the sensitive data through the error detection and correction circuit;

[0056] In some embodiments, before the comparator module checks the sensitive data through the error detection and correction circuit, the embedded FPGA further determines whether the received data contains the first error detection and correction code; when the embedded FPGA receives data that does not contain the first error detection and correction code, the comparator module generates the first error detection and correction code corresponding to the sensitive data through the generated error detection and correction circuit, and returns the first error detection and correction code to the corresponding functional module through the transmission channel, and stops the current check; for example, functional module 1 in the password chip transmits data A to the embedded FPGA through the data channel, and the data A only contains sensitive data and does not include the first error detection and correction code corresponding to the sensitive data; at this time, the first error detection and correction code is generated according to the sensitive data, and the error detection and correction code is returned to functional module 1 through the transmission channel, so that functional module 1 can save the first error detection and correction code corresponding to the sensitive data; it should be understood that when the embedded FPGA receives data through the data channel that includes the first error detection and correction code corresponding to the sensitive data, the embedded FPGA directly transmits the first error detection and correction code corresponding to the sensitive data to the generated comparator module.

[0057] In some embodiments, the comparator module checks the sensitive data through the error detection and correction circuit includes: receiving the second error detection and correction code corresponding to the sensitive data generated by the error detection and correction circuit; determining whether the second error detection and correction code is consistent with the first error detection and correction code; when the comparator module determines that the second error detection and correction code is consistent with the first error detection and correction code, the check is passed; for example, after the embedded FPGA generates the error detection and correction circuit according to the configuration file corresponding to the sensitive data, the second error detection and correction code corresponding to the sensitive data is calculated through the error detection and correction circuit, and the second error detection and correction code is sent to the comparator module; the comparator module compares the first error detection and correction code corresponding to the sensitive data with the second error detection and correction code; when the first error detection and correction code corresponding to the sensitive data is consistent with the second error detection and correction code, it is determined that the check is passed, and it is determined that the sensitive data has not been injected with errors by fault injection attack during storage and operation. It should be understood that the specific calculation method of generating the first error detection and correction code through the error detection and correction circuit and generating the second error detection and correction code through the error detection and correction circuit is determined by the configuration data; for example, the specific calculation method includes but is not limited to at least one of the following: parity, cyclic redundancy check (CRC), memory error correction code (ECC).

[0058] In some embodiments, when the comparator module determines that the second error detection and correction code is consistent with the first error detection and correction code, and determines that the check passes, it further includes determining whether the sensitive data is subjected to a write operation; if so, the sensitive data is output to the target storage space corresponding to the write operation together with the second error detection and correction code. For example, the internal of the password chip needs to write the sensitive data of function module 1 to function module 2, the data channel receives the data transmitted from function module 1, and determines that the sensitive data in the data is not injected with errors by fault injection attack during the storage and operation of the sensitive data, at the same time, the chip main processor or other control module determines that the sensitive data is subjected to a write operation and needs to be written into function module 2, then the comparator module outputs the sensitive data to function module 2 together with the second error detection and correction code, so that function module 2 can store the sensitive data and the corresponding second error detection and correction code, and use the second error detection and correction code as the first error detection and correction code; it needs to be understood that in some embodiments, the first error detection and correction code corresponding to the sensitive data can be directly output to function module 2, so that function module 2 can directly store the sensitive data and the corresponding first error detection and correction code.

[0059] In some embodiments, the comparator module checks the data by the error detection and correction circuit includes: generating the second error detection and correction code corresponding to the sensitive data according to the error detection and correction circuit; when the second error detection and correction code is inconsistent with the first error detection and correction code, the comparator module determines that the check fails, outputs the second error detection and correction code, and issues an alarm; for example, when the data channel receives the data transmitted from the module, the sensitive data therein is transmitted to the error detection and correction scheme selection module, and the sensitive data and the corresponding first error detection and correction code are sent to the embedded FPGA, the error detection and correction scheme selection module selects the corresponding configuration file in the configuration storage module according to the attribute of the sensitive data, and sends the configuration file to the embedded FPGA, after the embedded FPGA generates the error detection and correction circuit, the comparator module and the transmission channel according to the corresponding configuration file, the second error detection and correction code corresponding to the sensitive data is calculated by the error detection and correction circuit, and the second error detection and correction code is sent to the comparator module, the comparator module compares the first error detection and correction code corresponding to the sensitive data with the second error detection and correction code, when the first error detection and correction code corresponding to the sensitive data is inconsistent with the second error detection and correction code, it is determined that the check fails, and it is determined that the sensitive data is injected with errors by fault injection attack during the storage and operation of the sensitive data, at this time, the comparator module outputs the second error detection and correction code through the transmission channel, and issues an alarm that the sensitive data is injected with errors by fault injection attack during the storage and operation of the sensitive data.

[0060] The method for generating error detection and correction circuits provided in this embodiment of the invention involves receiving data sent by various functional modules through a data channel. The data includes sensitive data. An error detection and correction scheme selection module determines a configuration file corresponding to the sensitive data based on its attributes. An error detection and correction module generates an error detection and correction circuit based on the configuration file. A comparator module verifies the sensitive data using the error detection and correction circuit. In this embodiment, the generation of the error detection and correction circuit is implemented using an embedded FPGA, ensuring that the embedded FPGA only generates the circuit based on the sensitive data when the sensitive data is manipulated and the required error detection and correction code differs from the current error detection and correction circuit. The system generates corresponding error detection and correction circuits based on the attributes of sensitive data. Utilizing the non-simultaneous operation of functional modules, time-division multiplexing is achieved. Specifically, embedded FPGAs are used to generate these circuits, enabling their reuse and reconfigurability. In some embodiments, the generated circuits verify the sensitive data, allowing for flexible selection of various error detection and correction functions. This rich functionality effectively meets diverse data injection attack prevention needs. The reuse of these circuits also saves circuit resources. Furthermore, the system's structure and functionality can be modified or added after chip fabrication by upgrading the configuration file, avoiding hardware redesign and improving user experience.

[0061] Example 3

[0062] This embodiment also provides an error detection and correction system, such as Figure 3 As shown, the error detection and correction system includes: a functional module 31, an embedded FPGA 32, a configuration storage module 33, and an error detection and correction scheme selection module 34; as shown... Figure 4 As shown, functional module 31 includes functional modules 1 to n;

[0063] In some embodiments, the error detection and correction scheme selection module 34 is used to receive data transmitted by the functional module 31 through the data channel 35, the data including sensitive data; and determine the configuration file corresponding to the sensitive data according to the attributes of the sensitive data; and send the configuration file to the embedded FPGA 32. It should be understood that the data channel 35 can also send data directly to the embedded FPGA 32; or the data channel 35 can only transmit the sensitive data to the error detection and correction scheme selection module 34, and the error detection and correction scheme selection module 34 will then transmit the sensitive data to the embedded FPGA 32.

[0064] like Figure 5 As shown, the modules generated by the embedded FPGA 32 according to the configuration file include: a transmission channel 320, an error detection and correction circuit 321, and a comparator module 322;

[0065] The error detection and correction circuit 321 is configured to generate the error detection and correction code according to the configuration file.

[0066] The error detection and correction circuit 321 is configured to generate the error detection and correction code according to the configuration file, including generating an error detection code circuit according to the configuration file and / or generating an error correction code circuit according to the configuration file.

[0067] In some embodiments, the error detection and correction system is further configured to check the sensitive data by the error detection and correction circuit.

[0068] In some embodiments, the comparator module 322 is further configured to determine whether the data received by the embedded FPGA 32 contains the first error detection and correction code corresponding to the sensitive data, and if not, generate the first error detection and correction code corresponding to the sensitive data by the error detection and correction circuit 321, return the first error detection and correction code through the transmission channel 320, and stop the checking.

[0069] In some embodiments, the comparator module 322 is further configured to determine that the checking is passed when the second error detection and correction code corresponding to the sensitive data generated by the error detection and correction circuit is consistent with the first error detection and correction code.

[0070] In some embodiments, the comparator module 322 is further configured to output the sensitive data and the second error detection and correction code to the target storage space corresponding to the write operation when the chip main processor or other control module determines that the sensitive data is executed by the write operation.

[0071] In some embodiments, the comparator module 322 is further configured to determine that the checking is failed when the second error detection and correction code corresponding to the sensitive data generated by the error detection and correction circuit is inconsistent with the first error detection and correction code, output the second error detection and correction code, and issue a corresponding alarm.

[0072] The embodiments also provide a storage medium including a volatile or non-volatile, removable or non-removable medium implemented in any method or technology for storage of information such as computer readable instructions, data structures, computer program modules or other data. The storage medium includes, but is not limited to, RAM (Random Access Memory), ROM (Read-Only Memory), EEPROM (Electrically Erasable Programmable read only memory), flash memory or other memory technology, CD-ROM (Compact Disc Read-Only Memory), digital versatile disks (DVD) or other optical disk storage, magnetic cassettes, magnetic tapes, magnetic disk storage or other magnetic storage devices, or any other medium which can be used to store the desired information and which can be accessed by a computer.

[0073] The storage medium in the embodiments can be used to store one or more computer programs, and the one or more computer programs stored therein can be executed by a processor to implement at least one step of the method for generating a detection and correction circuit in the above-mentioned embodiment one and embodiment two.

[0074] It can be seen that all or some steps in the above-disclosed method, functions of the modules / units in the system and the device can be implemented as software (which can be realized by computer program codes executable by a computing device), firmware, hardware and appropriate combinations thereof. In the hardware implementation, the division between the function modules / units mentioned in the above description does not necessarily correspond to the division of physical components; for example, one physical component can have multiple functions, or one function or step can be performed by several physical components in cooperation. Some or all of the physical components can be implemented as software executed by a processor such as a central processing unit, a digital signal processor or a microprocessor, or as hardware, or as an integrated circuit such as an application-specific integrated circuit.

[0075] In addition, it is well known to those skilled in the art that communication media typically includes computer readable instructions, data structures, computer program modules or other data in modulated data signals such as carrier waves or other transport mechanisms, and can include any information delivery media. Therefore, the present application is not limited to any particular hardware and software combination.

[0076] The above is a further detailed description of the embodiments of the present application in combination with specific embodiments, and cannot be deemed as limitation of the specific implementation of the present application to these descriptions. For those skilled in the art to which the present application belongs, without departing from the concept of the present application, a number of simple deductions or replacements can be made, and all of them shall be deemed as falling within the protection scope of the present application.

Claims

1. A method for generating error detection and correction circuits, characterized in that, include: Receive data transmitted through the data channel, the data including: sensitive data; The configuration file corresponding to the sensitive data is determined based on the attributes of the sensitive data. The attributes of the sensitive data include at least one of the type of sensitive data, the parameters of the sensitive data, and the function of the sensitive data. The configuration file is used to indicate the error detection and correction circuit configuration scheme corresponding to the sensitive data. Different attributes of the sensitive data correspond to different error detection and correction circuit configuration schemes. An error detection and correction circuit is generated by an embedded FPGA according to the configuration file. The error detection and correction circuit is used to detect and correct errors in the data transmitted from the data channel. The attributes of the sensitive data include at least one of the following: the type of sensitive data, the parameters of the sensitive data, and the function of the sensitive data; the generation of the error detection and correction circuit by the embedded FPGA according to the configuration file includes: the embedded FPGA generating an error detection code circuit according to the configuration file; and / or, the embedded FPGA generating an error correction code circuit according to the configuration file.

2. The method for generating error detection and correction circuits as described in claim 1, characterized in that, The method further includes: The sensitive data is verified by the error detection and correction circuit.

3. The method for generating error detection and correction circuits as described in claim 2, characterized in that, Before the sensitive data is verified by the error detection and correction circuit, the following steps are included: The determination segment determines whether the received data contains the first error detection and correction code corresponding to the sensitive data; If not, the error detection and correction circuit generates a first error detection and correction code corresponding to the sensitive data, transmits the first error detection and correction code back through the transmission channel, and stops the verification.

4. The method for generating error detection and correction circuits as described in claim 3, characterized in that, The verification of the sensitive data through the error detection and correction circuit includes: The second error detection and correction code corresponding to the sensitive data is generated according to the error detection and correction circuit. When the second error detection and correction code matches the first error detection and correction code, the verification is deemed successful.

5. The method for generating error detection and correction circuits as described in claim 4, characterized in that, When the second error detection and correction code matches the first error detection and correction code, the verification is considered successful, and the following steps are also included: Determine whether the sensitive data has been written to. If so, the sensitive data, together with the second error detection and correction code, is output to the target storage space corresponding to the write operation.

6. The method for generating error detection and correction circuits as described in claim 3, characterized in that, The step of verifying the data through the error detection and correction circuit includes: The second error detection and correction code corresponding to the sensitive data is generated according to the error detection and correction circuit. When the second error detection and correction code is inconsistent with the first error detection and correction code, the verification is determined to be unsuccessful, the second error detection and correction code is output, and a corresponding alarm is issued.

7. An error detection and correction system, characterized in that, include: Functional modules, embedded FPGA, error detection and correction scheme selection module, configuration storage module; The configuration storage module is used to store the configuration files corresponding to each sensitive data. The error detection and correction scheme selection module is used to receive data transmitted from the data channel, the data including sensitive data; and determine the configuration file corresponding to the sensitive data according to the attributes of the sensitive data, and send the configuration file to the embedded FPGA. The attributes of the sensitive data include at least one of the type of sensitive data, the parameters of sensitive data, and the function of sensitive data. The configuration file is used to indicate the error detection and correction circuit configuration scheme corresponding to the sensitive data. Different attributes of the sensitive data correspond to different error detection and correction circuit configuration schemes. The embedded FPGA is used to generate an error detection and correction circuit, a transmission channel, and a comparator module according to the configuration file. The error detection and correction circuit is used to detect and correct errors in data transmitted from the data channel. Generating the error detection and correction circuit by the embedded FPGA according to the configuration file includes: generating an error detection code circuit by the embedded FPGA according to the configuration file; and / or, generating an error correction code circuit by the embedded FPGA according to the configuration file.

8. A storage medium, characterized in that, The storage medium stores one or more computer programs, which can be executed by one or more processors to implement the steps of the method for generating error detection and correction circuits as described in any one of claims 1 to 6.

Images