Chip encryption method and device, chip verification method and device

Abstract

The embodiments of the present disclosure provide a chip encryption method and device, a chip verification method and device, and relate to the field of data security technology. The chip encryption method includes: obtaining a random key; obtaining the original electronic signature of the original chip; performing a first encryption process on the original electronic signature according to the random key to obtain a ciphertext file; storing the random key and the ciphertext file in the original chip to obtain a target chip. The technical solution provided by the embodiments of the present disclosure can reduce the additional cost expenditure of the chip processing process, reduce the dependence on external hardware, improve the versatility and portability of the chip, increase the difficulty of cracking the user program in the chip, and improve the security of the chip.

Description

Technical Field

[0001] The present invention relates to the field of data security technology, and in particular to a chip encryption method and device, and a chip verification method and device. Background Art

[0002] During the use of general-purpose MCU products, users can crack and steal software program files stored in the chip by uploading them, resulting in lower chip security. Summary of the invention

[0003] The main purpose of the embodiments of the present disclosure is to provide a chip encryption method and device, a chip verification method and device, which can improve the security of the chip.

[0004] To achieve the above purpose, a first aspect of an embodiment of the present disclosure proposes a chip encryption method, including:

[0005] Get a random key;

[0006] Get the original electronic signature of the original chip;

[0007] Performing a first encryption process on the original electronic signature according to the random key to obtain a ciphertext file;

[0008] The random key and the ciphertext file are stored in the original chip to obtain a target chip.

[0009] In some embodiments, the method further comprises:

[0010] Obtaining constant address information of the original electronic signature;

[0011] Performing variable conversion processing on the constant address information to obtain variable address information;

[0012] The constant address information is updated with the variable address information.

[0013] In some embodiments, performing a first encryption process on the original electronic signature according to the random key to obtain a ciphertext file includes:

[0014] Get the algorithm library;

[0015] Get algorithm random number;

[0016] Performing random selection processing in the algorithm library according to the algorithm random number to obtain a target algorithm;

[0017] The first encryption process is performed on the original electronic signature according to the target algorithm to obtain the ciphertext file.

[0018] In some embodiments, storing the random key and the ciphertext file in the original chip to obtain the target chip includes:

[0019] Get the fixed key;

[0020] Performing a second encryption process on the random key and the ciphertext file according to the fixed key to obtain a random sub-key and a ciphertext sub-file;

[0021] The random sub-key and the ciphertext sub-file are stored in the original chip to obtain the target chip.

[0022] To achieve the above-mentioned purpose, a second aspect of an embodiment of the present disclosure proposes a chip verification method, comprising:

[0023] Obtaining a random key and a ciphertext file in a target chip obtained according to the method described in the first aspect above;

[0024] Obtaining the original electronic signature of the target chip;

[0025] Decrypting the ciphertext file according to the random key to obtain a target electronic signature;

[0026] The original electronic signature and the target electronic signature are verified to obtain a verification result.

[0027] In some embodiments, obtaining the original electronic signature of the target chip includes:

[0028] Get variable address information;

[0029] Performing constant conversion processing on the variable address information to obtain constant address information;

[0030] The original electronic signature of the target chip is obtained according to the constant address information.

[0031] To achieve the above object, the third aspect of the present disclosure provides a chip encryption device, comprising:

[0032] A random key acquisition module, used to acquire a random key;

[0033] The original chip signature acquisition module is used to obtain the original electronic signature of the original chip;

[0034] A first encryption processing module, used to perform a first encryption processing on the original electronic signature according to the random key to obtain a ciphertext file;

[0035] The target chip generation module is used to store the random key and the ciphertext file in the original chip to obtain the target chip.

[0036] To achieve the above-mentioned purpose, a fourth aspect of the present disclosure provides a chip verification device, comprising:

[0037] A ciphertext file acquisition module, used to acquire the random key and ciphertext file in the target chip obtained according to the method described in the first aspect above;

[0038] An original electronic signature acquisition module, used to acquire the original electronic signature of the target chip;

[0039] A target electronic signature acquisition module is used to decrypt the ciphertext file according to the random key to obtain a target electronic signature;

[0040] The verification module is used to verify the original electronic signature and the target electronic signature to obtain a verification result.

[0041] To achieve the above objective, a fifth aspect of the present disclosure provides an electronic device, including:

[0042] at least one memory;

[0043] at least one processor;

[0044] at least one program;

[0045] The program is stored in the memory, and the processor executes at least one program to implement the present disclosure:

[0046] The method according to the first aspect above;

[0047] or,

[0048] As the method according to the second aspect above.

[0049] To achieve the above objective, the sixth aspect of the present disclosure provides a storage medium, which is a computer-readable storage medium, wherein the computer-readable storage medium stores computer-executable instructions, and the computer-executable instructions are used to enable a computer to execute:

[0050] The method according to the first aspect above

[0051] or,

[0052] As the method according to the second aspect above.

[0053] The chip encryption method and device, and the chip verification method and device proposed in the embodiments of the present disclosure obtain a random key and the original electronic signature of the original chip, and perform a first encryption process on the original electronic signature according to the random key to obtain a ciphertext file, and then store the random key and the ciphertext file in the original chip to obtain a target chip, thereby completing the encryption process of the original chip. The technical solution provided by the embodiments of the present disclosure can improve the security of the chip. BRIEF DESCRIPTION OF THE DRAWINGS

[0054] Figure 1 It is a flow chart of the chip encryption method provided by the embodiment of the present disclosure.

[0055] Figure 2 It is a partial flow chart of a chip encryption method provided by another embodiment of the present disclosure.

[0056] Figure 3 yes Figure 1 Flowchart of step S130 in .

[0057] Figure 4 yes Figure 1 Flowchart of step S140 in .

[0058] Figure 5 It is a flowchart of the chip verification method provided by the embodiment of the present disclosure.

[0059] Figure 6 yes Figure 5 Flowchart of step S520 in .

[0060] Figure 7 It is a module block diagram of the chip encryption device provided in an embodiment of the present disclosure.

[0061] Figure 8 It is a module block diagram of the chip verification device provided in an embodiment of the present disclosure.

[0062] Fig. 9 It is a schematic diagram of the hardware structure of the electronic device provided by the embodiment of the present disclosure.

[0063] Figure numerals: random key acquisition module 710, original chip signature acquisition module 720, first encryption processing module 730, target chip generation module 740, ciphertext file acquisition module 810, original electronic signature acquisition module 820, target electronic signature acquisition module 830, verification module 840, processor 901, memory 902, input / output interface 903, communication interface 904, bus 905. DETAILED DESCRIPTION

[0064] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0065] It should be noted that, although the functional modules are divided in the device schematic diagram and the logical order is shown in the flowchart, in some cases, the steps shown or described may be performed in a different order than the module division in the device or the order in the flowchart. The terms "first", "second", etc. in the specification, claims and the above drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence.

[0066] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by those skilled in the art to which the present invention belongs. The terms used herein are only for the purpose of describing the embodiments of the present invention and are not intended to limit the present invention.

[0067] First, some nouns involved in this application are analyzed:

[0068] PLC (Programmable Logic Controller) is a core control system device commonly used in the automation industry.

[0069] MCU (Micro Controller Unit) is the main control chip of the programmable logic controller.

[0070] The electronic signature is a unique identification code for each MCU set by the chip manufacturer when the MCU leaves the factory and is stored in the FLASH area that cannot be modified by the user.

[0071] APP (Application) is the application layer program part of the programmable logic controller product that includes user settings and programs. The program contains all functions that meet user needs.

[0072] IAP (In Application Programming) is the boot program part used to download and update the APP program in the programmable logic controller product. The program does not contain any functions for user needs and is only used to update the APP program and determine whether the APP program needs to be run.

[0073] In the process of using general-purpose MCU products, software program encryption is particularly important. The pins, function information, and user program download tools of general-purpose MCUs can all be obtained on the official website of the MCU manufacturer. Experienced hardware engineers can learn how to enable the MCU's boot mode through the product's PCB board, upload the user program in it to obtain the software program file, and then download the software program file to another product MCU with exactly the same hardware solution, so as to achieve the purpose of copying and stealing the software program, resulting in lower chip security. Among them, the user program refers to all programs stored in the user-readable and writable FLASH space in the MCU chip. Taking PLC as an example, it includes all contents such as the product's underlying software and the upper-level execution logic written by the user; and the software program file refers to the file formed after the user program is uploaded. Therefore, it is necessary to implement an encryption scheme so that the software program cannot be directly copied, or the software program cannot be run on other products even if it is copied.

[0074] Common implementations include:

[0075] (1) Solution using a customized special MCU

[0076] Unlike general-purpose MCUs, information about customized special MCUs cannot be obtained from the official website of the chip manufacturer. If the chip logo is erased, it is even difficult to easily know the chip manufacturer information. Since there is no way to upload user software program files (equivalent to user programs), the MCU software program can be prevented from being stolen from the source.

[0077] The problems with using customized special MCU solutions include: high customization costs, and companies with small usage cannot obtain customization services from chip manufacturers; low versatility, and poor portability when there is a need to change MCU brands or models.

[0078] (2) Solutions that collaborate with external hardware components to complete the encryption process

[0079] Use external components such as encryption chips and EEPROM (Electrically Erasable Programmable read only memory) whose contents cannot be uploaded to communicate with the MCU to complete the encryption process. Part of the content required in the encryption process is stored in such external components. Even if the MCU software program is uploaded and copied, the MCU program downloaded to another product cannot pass the encryption check because the program of the external component cannot be directly obtained, thus achieving the effect that the copied software program cannot be used, effectively preventing theft.

[0080] The problems with the solution of collaborating with external hardware components to complete the encryption process include: dependence on external hardware components. If the hardware components used for encryption cannot function properly for some reason, the product cannot be used even if the MCU operates normally, increasing the possibility of failure; additional hardware and circuit support is required, increasing product costs and hardware resource overhead such as chip pins.

[0081] Based on this, the embodiments of the present disclosure provide a chip encryption method and device, and a chip verification method and device, which obtain a random key and an original electronic signature of an original chip, and perform a first encryption process on the original electronic signature according to the random key to obtain a ciphertext file, and then store the random key and the ciphertext file in the original chip to obtain a target chip, thereby completing the encryption process of the original chip; then obtain the random key and the ciphertext file in the target chip obtained by the chip encryption method, obtain the original electronic signature of the target chip, and then decrypt the ciphertext file according to the random key to obtain the target electronic signature, and finally verify the original electronic signature and the target electronic signature to obtain a verification result, thereby completing the verification of the chip; the technical solution provided by the embodiments of the present disclosure can reduce the additional cost expenditure of the chip processing process, reduce the dependence on external hardware, improve the versatility and portability of the chip, increase the difficulty of cracking the user program in the chip, and improve the security of the chip.

[0082] The embodiments of the present disclosure provide a chip encryption method and device, a chip verification method and device, which are specifically described through the following embodiments. First, the chip encryption method in the embodiments of the present disclosure is described.

[0083] The chip encryption method provided in the embodiment of the present disclosure relates to the field of data security technology. The chip encryption method provided in the embodiment of the present disclosure can be applied to a terminal, can be applied to a server side, or can be software running in a terminal or a server side. In some embodiments, the terminal can be a smart phone, a tablet computer, a laptop computer, a desktop computer, or a smart watch, etc.; the server can be an independent server, or it can be a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, content delivery networks (Content Delivery Network, CDN), and big data and artificial intelligence platforms; the software can be an application that implements chip encryption methods, chip verification methods, etc., but is not limited to the above forms.

[0084] The present application can be used in many general or special computer system environments or configurations. For example: personal computers, server computers, handheld or portable devices, tablet devices, multiprocessor systems, microprocessor-based systems, set-top boxes, programmable consumer electronics, network PCs, minicomputers, mainframe computers, distributed computing environments including any of the above systems or devices, etc. The present application can be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform specific tasks or implement specific abstract data types. The present application can also be practiced in distributed computing environments, in which tasks are performed by remote processing devices connected through a communication network. In a distributed computing environment, program modules can be located in local and remote computer storage media including storage devices.

[0085] The disclosed embodiment proposes a chip encryption method, including: obtaining a random key; obtaining an original electronic signature of an original chip; performing a first encryption process on the original electronic signature according to the random key to obtain a ciphertext file; storing the random key and the ciphertext file in the original chip to obtain a target chip.

[0086] Figure 1 is an optional flow chart of the chip encryption method provided by the embodiment of the present disclosure. Figure 1 The method may include but is not limited to steps S110 to S140, specifically including:

[0087] S110, obtaining a random key;

[0088] S120, obtaining the original electronic signature of the original chip;

[0089] S130, performing a first encryption process on the original electronic signature according to the random key to obtain a ciphertext file;

[0090] S140, storing the random key and the ciphertext file in the original chip to obtain the target chip.

[0091] In step S110, a random key is generated by a host computer, wherein the host computer is used to connect to the PLC to complete the encryption process of the original chip on the PLC.

[0092] In step S120, the original chip is the chip to be encrypted installed on the PLC, and the original electronic signature is the electronic signature corresponding to the chip when it is read from the original chip. It should be noted that the electronic signature is stored in the FLASH area that cannot be modified by the user.

[0093] In step S130, the random key is key, the original electronic signature is signature1, and the first encryption algorithm used is F1, then the encryption process is cipher=F1(signature1, key), where cipher is the obtained ciphertext file. In a specific embodiment, the parameter format of the random key, electronic signature and ciphertext file is defined as int type, which generally occupies 4 bytes in a 32-bit MCU.

[0094] It should be noted that the encryption algorithm and the decryption algorithm are inverse processes of each other. The use of an algorithm with two inputs is to introduce a random factor in the form of a key, thereby enhancing the security of the chip encryption method.

[0095] In step S140, the specific location where the random key and the ciphertext file are stored is the FLASH of the original chip, and the target chip is the original chip that has been encrypted.

[0096] In a specific embodiment, the random key and the ciphertext file are key information in the entire encryption process. The random key and the ciphertext file are generated by software in the host computer. As long as the encryption software is not leaked, the encryption method cannot be cracked.

[0097] In a specific embodiment, even if a cracker copies all data in the FLASH area of ​​the main control chip and downloads it to another product with exactly the same hardware solution, he or she will not be able to steal the software program of the chip that has been encrypted by the chip encryption method provided by the embodiment of the present disclosure.

[0098] The chip encryption method provided by the embodiment of the present disclosure obtains a random key and the original electronic signature of the original chip, and performs a first encryption process on the original electronic signature according to the random key to obtain a ciphertext file, and then stores the random key and the ciphertext file in the original chip to obtain a target chip, thereby completing the encryption process of the original chip. The technical solution provided by the embodiment of the present disclosure can reduce the additional cost expenditure of the chip processing process, reduce the dependence on external hardware, improve the versatility and portability of the chip, increase the difficulty of cracking the user program in the chip, and improve the security of the chip.

[0099] In some embodiments, the chip encryption method further includes: obtaining constant address information of the original electronic signature; performing variable conversion processing on the constant address information to obtain variable address information; and updating the constant address information with the variable address information.

[0100] like Figure 2 As shown, Figure 2 is a flowchart of a chip encryption method provided in some other embodiments, the chip encryption method further comprising:

[0101] S210, obtaining constant address information of the original electronic signature;

[0102] S220, performing variable conversion processing on the constant address information to obtain variable address information;

[0103] S230, update the constant address information with the variable address information.

[0104] In step S210, the constant address information is the storage address of the original electronic signature originally stored in the original chip, and the storage address is stored in the program file in the form of a constant.

[0105] In step S220, the variable conversion process is: using variables that will not be optimized to form target constants, so as to convert the address from constant information to variable information. To prevent any encryption-related information from being revealed in the FLASH data, all fixed contents are converted into variables at the code level, and the compiler is prohibited from optimizing them into fixed values.

[0106] Specifically, if the constant address information of the original electronic signature stored in the MCU is: 0x27835146, the C language implementation process of its variable conversion processing is:

[0107] volatile char temp[4];

[0108] temp[0] = 0x27;

[0109] temp[1] = 0x83;

[0110] temp[2] = 0x51;

[0111] temp[3] = 0x46;

[0112] Among them, volatile is a feature modifier, which serves as an instruction keyword to ensure that this instruction will not be omitted due to compiler optimization and requires direct value reading each time; char temp[4] is an array converted into variables for storage, where temp[0], temp[1], temp[2], and temp[3] are the four elements of this array respectively. This is equivalent to splitting the constant address information into four variables and storing them in the array, realizing variable conversion processing.

[0113] In step S230, the variable address information is the address after the storage address of the original electronic signature is converted into a variable, and the address is stored in the program file in the form of a variable.

[0114] In the same model of chips from the same chip manufacturer, the address of the MCU electronic signature stored in the FLASH is constant. You can find out by consulting the official chip user manual. If this address is used directly in the code of the encryption program, the 32-bit data representing the FLASH address will be saved intact in the software program file and downloaded to the user program FLASH area of ​​the MCU. If the cracker uploads the user program file in the MCU, consults the official user manual according to the MCU model, and finds out the FLASH address information for storing the electronic signature, and then searches for this address in the uploaded file, the location of the code segment related to encryption can be obtained, and then it is possible to avoid the comparison and judgment of the MCU electronic signature by modifying this address value alone.

[0115] The chip encryption method provided by the present invention uses variable conversion to avoid such fixed values ​​related to the encryption process from appearing directly in the code in the form of constants or values ​​that can be optimized into constants by the compiler, which gives crackers an opportunity to exploit. By avoiding constant calculations and compiler optimization, the constants used in the encryption process are converted into variables that need to be calculated when the program is running, thereby hiding these constants from the FLASH data, improving the encryption security, and thus improving the security of the chip.

[0116] In some embodiments, a first encryption process is performed on the original electronic signature according to a random key to obtain a ciphertext file, including: obtaining an algorithm library; obtaining an algorithm random number; performing a random selection process in the algorithm library according to the algorithm random number to obtain a target algorithm; and performing a first encryption process on the original electronic signature according to the target algorithm to obtain a ciphertext file.

[0117] Figure 3 is a flowchart of step S130 in some embodiments, Figure 3 The illustrated step S130 includes but is not limited to steps S310 to S340:

[0118] S310, obtaining an algorithm library;

[0119] S320, obtaining an algorithm random number;

[0120] S330, performing random selection processing in an algorithm library according to the algorithm random number to obtain a target algorithm;

[0121] S340, performing a first encryption process on the original electronic signature according to a target algorithm to obtain a ciphertext file.

[0122] In step S310, the algorithm library is a collection of multiple encryption algorithms. In order to improve encryption security, it is necessary to avoid using a single encryption algorithm. In the upper software used for encryption and the IAP program of the PLC, multiple different encryption algorithms are prepared in advance to form an algorithm library.

[0123] In step S320, an algorithm random number is generated by a host computer and is used to select an algorithm according to the random number in step S330.

[0124] Specifically, taking C language as an example, with system time as a parameter, the srand(unsigned int_Seed) function can be used to use the system time as a random number seed each time to avoid pseudo-randomness, where unsigned int_Seed is the random number seed.

[0125] In step S330 to step S340, an algorithm in the algorithm library is called according to the randomly generated number, and the selected algorithm is the target algorithm. Then, the first encryption process is performed using the target algorithm to obtain a ciphertext file.

[0126] In addition, in a specific embodiment, the ciphertext file needs to be saved in the original chip in step S140 to obtain the target chip, which requires the host computer to send the ciphertext file to the PLC. During the sending process, the algorithm random number generated in step S320 is inserted into the communication frame of the ciphertext file to increase the security of communication. Correspondingly, in the ciphertext file acquisition process of step S510, the PLC first reads this randomly generated number, and then calls the corresponding decryption algorithm from the algorithm library to decrypt the ciphertext, which makes the encryption algorithm not easy to be cracked, and at the same time, it can increase the complexity of the command communication frame in the form of inserting irrelevant data, thereby improving the security of the chip.

[0127] Specifically, if the algorithm random number generated by the host computer is X, and the algorithm library contains 5 algorithms numbered 0-4, then a random value in the range of 0-4 can be obtained by X%5, and the algorithm with the corresponding number is selected as the target algorithm, where the algorithms in the algorithm library include but are not limited to DES, AES, etc.

[0128] The chip encryption method provided by the present disclosure changes the encryption algorithm from single logic to random logic, thereby improving the security of the chip.

[0129] In some embodiments, a random key and a ciphertext file are stored in an original chip to obtain a target chip, including: obtaining a fixed key; performing a second encryption process on the random key and the ciphertext file according to the fixed key to obtain a random sub-key and a ciphertext sub-file; and storing the random sub-key and the ciphertext sub-file in the original chip to obtain a target chip.

[0130] Figure 4 is a flowchart of step S140 in some embodiments, Figure 4 The illustrated step S140 includes but is not limited to steps S410 to S430:

[0131] S410, obtaining a fixed key;

[0132] S420, performing a second encryption process on the random key and the ciphertext file according to the fixed key to obtain a random sub-key and a ciphertext sub-file;

[0133] S430, storing the random sub-key and the ciphertext sub-file in the original chip to obtain a target chip.

[0134] In step S410, the fixed key is used for the second encryption process of the random key and the ciphertext file, that is, the second encryption process, to ensure the security of the random key and the ciphertext file during the communication and storage process.

[0135] In step S420, after the original electronic signature is first encrypted using the random key to obtain the ciphertext file, another encryption is performed using a fixed key to prevent the randomly generated encryption key from being directly read out in the command communication frame.

[0136] In step S430, the random subkey is a key obtained after the random key is subjected to the second encryption process, and the ciphertext subfile is a file obtained after the ciphertext file is subjected to the second encryption process.

[0137] According to the chip verification method provided by the embodiment of the present disclosure, even if a cracker copies all the data in the FLASH area of ​​the main control chip and downloads it to another product with exactly the same hardware solution, the software program of this product cannot be stolen.

[0138] The disclosed embodiment provides a chip verification method, which obtains a random key and a ciphertext file in a target chip obtained by a chip encryption method, obtains the original electronic signature of the target chip, decrypts the ciphertext file according to the random key, obtains the target electronic signature, and finally verifies the original electronic signature with the target electronic signature to obtain a verification result, thereby completing the verification of the chip. The technical solution provided by the disclosed embodiment can reduce the additional cost expenditure of the chip processing process, reduce the dependence on external hardware, improve the versatility and portability of the chip, increase the difficulty of cracking the user program in the chip, and improve the security of the chip.

[0139] The disclosed embodiment proposes a chip verification method, including: obtaining a random key and a ciphertext file in a target chip obtained according to a chip encryption method such as any of the above embodiments; obtaining an original electronic signature of the target chip; decrypting the ciphertext file according to the random key to obtain a target electronic signature; and verifying the original electronic signature with the target electronic signature to obtain a verification result.

[0140] Figure 5 is an optional flow chart of the chip verification method provided by the embodiment of the present disclosure. Figure 5The method may include but is not limited to steps S510 to S540, specifically including:

[0141] S510, obtaining a random key and a ciphertext file in the target chip;

[0142] S520, obtaining the original electronic signature of the target chip;

[0143] S530, decrypting the ciphertext file according to the random key to obtain a target electronic signature;

[0144] S540, verifying the original electronic signature and the target electronic signature to obtain a verification result.

[0145] Before step S510, the PLC needs to be powered on and the IAP program needs to be run. The entire verification process is performed during the running of the IAP program to obtain the verification result. It should be noted that in addition to completing the verification, the boot program is also responsible for updating the user program. During the debugging stage of the PLC user, the user program often needs to be updated. If it does not need to be updated, it will directly jump to the user program. When updating, it will stay in the boot program and wait for the update.

[0146] In steps S510 to S520, the target chip is Figure 1 The chip encryption method shown is obtained, the target chip is the chip to be verified, and the host computer reads the random key and ciphertext file stored in the target chip, as well as the original electronic signature of the target chip, for the subsequent verification process.

[0147] In step S530, corresponding to the first encryption process in step S130, the random key is key, the ciphertext file is cipher, and the decryption algorithm used is the decryption algorithm F2 corresponding to F1. The decryption process is signature2=F2(signature, cipher), where signature2 is the target electronic signature obtained after decryption.

[0148] It should be noted that the encryption algorithm and the decryption algorithm are inverse processes of each other. The use of an algorithm with two inputs is to introduce a random factor in the form of a key, thereby enhancing the security of the chip encryption method.

[0149] In step S540, the verification process includes: comparing the decrypted target electronic signature signature2 with the original electronic signature signature1 read from the target chip, and the verification results include signature match and signature mismatch; if the signatures match, the PLC executes the process of jumping to the APP program and starts to run the user program normally; if the signatures do not match, the IAP program will not execute the process of jumping to the APP program, so that the PLC cannot run the APP program, thereby essentially achieving the effect of preventing the software program from being stolen.

[0150] It should be noted that the random key data stored in the FLASH of the PLC that has not received the encryption key information is 0xFFFF. If the random key data is empty, that is, 0xFFFF, it will be judged as a decryption failure, indicating that the chip has not been processed by the chip encryption algorithm.

[0151] In some embodiments, obtaining the original electronic signature of the target chip includes: obtaining variable address information; performing constant conversion processing on the variable address information to obtain constant address information; and obtaining the original electronic signature of the target chip according to the constant address information.

[0152] Figure 6 is a flowchart of step S520 in some embodiments, Figure 6 The illustrated step S520 includes but is not limited to steps S610 to S630:

[0153] S610, obtaining variable address information;

[0154] S620, performing constant conversion processing on the variable address information to obtain constant address information;

[0155] S630, obtaining the original electronic signature of the target chip according to the constant address information.

[0156] In step S610, the variable address information is the address after the storage address of the original electronic signature is converted into a variable, and the address is stored in the program file in the form of a variable.

[0157] In step S620, if the constant address information of the original electronic signature stored in the MCU is: 0x27835146, the C language implementation process of its constant conversion processing is:

[0158] int ID_add;

[0159] ID_add=(temp[0]<<6*4)|(temp[1]<<4*4)|(temp[2]<<2*4)|temp[3];

[0160] Among them, “|” is the bitwise AND symbol, “<<” is the left shift symbol, ID_add is the electronic signature address value, and temp[0], temp[1], temp[2], and temp[3] are the four elements of the temp[4] array respectively.

[0161] When an electronic signature is required during chip verification, the electronic signature address value ID_add is calculated to avoid storing the temp initialization value directly in FLASH, thereby reducing the possibility of a cracker obtaining the specific value of the temp array from FLASH and increasing the difficulty of cracking.

[0162] In step S630, the constant address information is the storage address of the original electronic signature originally stored in the original chip, and the storage address is stored in the program file in the form of a constant. After obtaining the constant address information, the original electronic signature is extracted according to the address information for chip verification.

[0163] The chip encryption method provided by the present invention uses variable conversion to avoid such fixed values ​​related to the encryption process from appearing directly in the code in the form of constants or values ​​that can be optimized into constants by the compiler, which gives crackers an opportunity to exploit. By avoiding constant calculation and compiler optimization, the constants used in the encryption process are converted into variables that need to be calculated when the program is running, thereby hiding the constants from the FLASH data, improving the encryption security, and thus improving the security of the chip.

[0164] See also Figure 7 , Figure 7 The chip encryption of an embodiment is illustrated, and the chip encryption device includes:

[0165] A random key acquisition module 710, used to acquire a random key;

[0166] The original chip signature acquisition module 720 is used to acquire the original electronic signature of the original chip;

[0167] The first encryption processing module 730 is used to perform a first encryption process on the original electronic signature according to a random key to obtain a ciphertext file;

[0168] The target chip generation module 740 is used to store the random key and the ciphertext file in the original chip to obtain the target chip.

[0169] The specific implementation of the chip encryption device of this embodiment is basically the same as the specific implementation of the above-mentioned chip encryption method, and will not be repeated here.

[0170] See also Figure 8 , Figure 8 The chip verification device of an embodiment is illustrated, and the chip verification device includes:

[0171] The ciphertext file acquisition module 810 is used to acquire the random key and ciphertext file in the target chip obtained according to the chip encryption method of any of the above embodiments;

[0172] The original electronic signature acquisition module 820 is used to acquire the original electronic signature of the target chip;

[0173] The target electronic signature acquisition module 830 is used to decrypt the ciphertext file according to the random key to obtain the target electronic signature;

[0174] The verification module 840 is used to verify the original electronic signature and the target electronic signature to obtain a verification result.

[0175] The specific implementation of the chip verification device of this embodiment is basically the same as the specific implementation of the above-mentioned chip verification method, and will not be repeated here.

[0176] The present disclosure also provides an electronic device, including:

[0177] at least one memory;

[0178] at least one processor;

[0179] at least one program;

[0180] The program is stored in the memory, and the processor executes the at least one program to implement the chip encryption method or chip verification method disclosed in the present invention. The electronic device can be any intelligent terminal including a mobile phone, a tablet computer, a personal digital assistant (PDA), a car computer, etc.

[0181] See also Fig. 9 , Fig. 9 The hardware structure of an electronic device of another embodiment is illustrated, and the electronic device includes:

[0182] The processor 901 may be implemented by a general-purpose CPU (Central Processing Unit), a microprocessor, an application-specific integrated circuit (Application Specific Integrated Circuit, ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of the present disclosure;

[0183] The memory 902 can be implemented in the form of ROM (Read Only Memory), static storage device, dynamic storage device or RAM (Random Access Memory). The memory 902 can store operating systems and other applications. When the technical solutions provided in the embodiments of this specification are implemented by software or firmware, the relevant program codes are stored in the memory 902, and the processor 901 calls and executes the chip encryption method and chip verification method of the embodiments of the present disclosure;

[0184] Input / output interface 903, used to implement information input and output;

[0185] Communication interface 904, used to realize communication interaction between the device and other devices, which can be realized by wired means (such as USB, network cable, etc.) or wireless means (such as mobile network, WIFI, Bluetooth, etc.); and

[0186] A bus 905 that transmits information between the various components of the device (e.g., the processor 901, the memory 902, the input / output interface 903, and the communication interface 904);

[0187] The processor 901 , the memory 902 , the input / output interface 903 and the communication interface 904 are connected to each other in communication within the device via a bus 905 .

[0188] The embodiment of the present disclosure further provides a storage medium, which is a computer-readable storage medium. The computer-readable storage medium stores computer-executable instructions, and the computer-executable instructions are used to enable a computer to execute the above-mentioned chip encryption method or chip verification method.

[0189] The memory, as a non-transient computer-readable storage medium, can be used to store non-transient software programs and non-transient computer executable programs. In addition, the memory may include a high-speed random access memory, and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some embodiments, the memory may optionally include a memory remotely disposed relative to the processor, and these remote memories may be connected to the processor via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0190] The embodiments described in the embodiments of the present disclosure are intended to more clearly illustrate the technical solutions of the embodiments of the present disclosure and do not constitute a limitation on the technical solutions provided by the embodiments of the present disclosure. Those skilled in the art will appreciate that with the evolution of technology and the emergence of new application scenarios, the technical solutions provided by the embodiments of the present disclosure are also applicable to similar technical problems.

[0191] It can be understood by those skilled in the art that Figure 1-6 The technical solutions shown in the figure do not constitute a limitation on the embodiments of the present disclosure, and may include more or fewer steps than those shown in the figure, or a combination of certain steps, or different steps.

[0192] The device embodiments described above are merely illustrative, and the units described as separate components may or may not be physically separated, that is, they may be located in one place or distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0193] Those skilled in the art will appreciate that all or some of the steps in the methods disclosed above, and the functional modules / units in the systems and devices may be implemented as software, firmware, hardware, or a suitable combination thereof.

[0194] The terms "first", "second", "third", "fourth", etc. (if any) in the specification of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0195] It should be understood that in the present application, "at least one (item)" means one or more, and "plurality" means two or more. "And / or" is used to describe the association relationship of associated objects, indicating that three relationships may exist. For example, "A and / or B" can mean: only A exists, only B exists, and A and B exist at the same time, where A and B can be singular or plural. The character " / " generally indicates that the objects associated before and after are in an "or" relationship. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single or plural items. For example, at least one of a, b or c can mean: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, c can be single or multiple.

[0196] In the several embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0197] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0198] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0199] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including multiple instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (Read-Only Memory, referred to as ROM), random access memory (Random Access Memory, referred to as RAM), disk or optical disk and other media that can store programs.

[0200] The preferred embodiments of the present disclosure are described above with reference to the accompanying drawings, but the scope of the rights of the present disclosure is not limited thereto. Any modification, equivalent substitution and improvement made by those skilled in the art without departing from the scope and essence of the present disclosure should be within the scope of the rights of the present disclosure.

Claims

1. A chip encryption method, characterized in that: include: Get a random key; Get the original electronic signature of the original chip; The chip encryption method further includes: Obtaining constant address information of the original electronic signature; Performing variable conversion processing on the constant address information to obtain variable address information; Updating the constant address information with the variable address information; The step of performing variable conversion processing on the constant address information to obtain the variable address information includes: The constant address information is split into four variables and stored in an array to implement variable conversion processing; Performing a first encryption process on the original electronic signature according to the random key to obtain a ciphertext file; The random key and the ciphertext file are stored in the original chip to obtain a target chip; The step of storing the random key and the ciphertext file in the original chip to obtain the target chip includes: Get the fixed key; Performing a second encryption process on the random key and the ciphertext file according to the fixed key to obtain a random sub-key and a ciphertext sub-file; The random sub-key and the ciphertext sub-file are stored in the original chip to obtain the target chip.

2. The method according to claim 1, characterized in that The first encryption process is performed on the original electronic signature according to the random key to obtain a ciphertext file, including: Get the algorithm library; Get algorithm random number; Performing random selection processing in the algorithm library according to the algorithm random number to obtain a target algorithm; The first encryption process is performed on the original electronic signature according to the target algorithm to obtain the ciphertext file.

3. A chip verification method, characterized in that: include: Obtaining a random key and a ciphertext file in a target chip obtained according to the method described in any one of claims 1 to 2; Obtaining the original electronic signature of the target chip; Decrypting the ciphertext file according to the random key to obtain a target electronic signature; The original electronic signature and the target electronic signature are verified to obtain a verification result.

4. The method according to claim 3, characterized in that The obtaining of the original electronic signature of the target chip comprises: Get variable address information; Performing constant conversion processing on the variable address information to obtain constant address information; The original electronic signature of the target chip is obtained according to the constant address information.

5. A chip encryption device, characterized in that: include: A random key acquisition module, used to acquire a random key; The original chip signature acquisition module is used to obtain the original electronic signature of the original chip; A first encryption processing module, used to perform a first encryption processing on the original electronic signature according to the random key to obtain a ciphertext file; A target chip generation module, used for storing the random key and the ciphertext file in the original chip to obtain a target chip; The chip encryption device also includes: Obtaining constant address information of the original electronic signature; Performing variable conversion processing on the constant address information to obtain variable address information; Updating the constant address information with the variable address information; The chip encryption device also includes: The constant address information is split into four variables and stored in an array to implement variable conversion processing; The target chip generation module also includes: Get the fixed key; Performing a second encryption process on the random key and the ciphertext file according to the fixed key to obtain a random sub-key and a ciphertext sub-file; The random sub-key and the ciphertext sub-file are stored in the original chip to obtain the target chip.

6. A chip verification device, characterized in that: include: A ciphertext file acquisition module, used to obtain a random key and a ciphertext file in a target chip obtained according to the method described in any one of claims 1 to 2; An original electronic signature acquisition module, used to acquire the original electronic signature of the target chip; A target electronic signature acquisition module is used to decrypt the ciphertext file according to the random key to obtain a target electronic signature; The verification module is used to verify the original electronic signature and the target electronic signature to obtain a verification result.

7. An electronic device, characterized in that: include: at least one memory; at least one processor; at least one program; The program is stored in the memory, and the processor executes at least one of the programs to implement: The method according to any one of claims 1 to 2; or, A method as claimed in any one of claims 3 to 4.

8. A storage medium, the storage medium being a computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions, and the computer-executable instructions are used to cause a computer to execute: The method according to any one of claims 1 to 2; or, A method as claimed in any one of claims 3 to 4.

Images