Memory protection system

Abstract

The present application discloses a memory protection system. The system comprises: a bus, and at least one memory controller coupled to the bus, each memory controller being coupled to a memory; a memory protection unit coupled to the bus, connected to the memory controller, the memory protection unit comprising an authentication unit, a control unit, and multiple protection blocks; and a configuration information storage unit, the configuration information storage unit being used to store an authentication key in a programmed state of the memory protection unit and configuration information for the multiple protection blocks; wherein the control unit configures the authentication unit and the multiple protection blocks based on the configuration information; when the memory protection unit is accessed or the configuration information is modified, the authentication unit is used to receive an input key and authenticate the input key with the authentication key stored in the authentication unit; the multiple protection blocks respectively correspond to multiple memory portions that need to be encrypted. The present application can prevent algorithms and software from being easily copied and reverse engineered.

Description

Technical Field

[0001] The present application relates to the field of storage technology, and in particular to a memory protection system. Background Art

[0002] The increased computing power of MCUs has made it possible to implement more complex algorithms and software. However, the portability of the C language and the versatility of MCU built-in memory make these algorithms and software extremely vulnerable to copying and reverse engineering. Therefore, it is extremely important to provide an effective protection solution for MCU memory.

[0003] like Figure 1 As shown, for solutions that require encrypted transmission, such as AES encrypted communication, the decryption key needs to be stored inside the chip. The key needs to be properly kept and cannot be read from the chip. This requires the chip to support key storage, and reading the key requires authentication.

[0004] like Figure 2 As shown, in the secondary development market, developer A releases the lib and chip to system provider B. Customer B only needs to get the chip from the original manufacturer and use A's lib. In this way, developer A will lose customer B.

[0005] The present invention specifically addresses various problems in the chip secondary development market, such as algorithms and software being extremely easy to be copied and reverse engineered, which leads to customer loss. Summary of the Invention

[0006] The purpose of this application is to provide a memory protection system to solve the problem in the prior art that algorithms and software are extremely easy to be copied and reverse engineered.

[0007] The present application discloses a memory protection system, comprising:

[0008] a bus, and at least one memory controller coupled to the bus, each of the at least one memory controller being coupled to a memory;

[0009] a memory protection unit coupled to the bus, the memory protection unit being connected to the at least one memory controller, the memory protection unit comprising an authentication unit, a control unit, and a plurality of protection blocks; and

[0010] a configuration information storage unit, the configuration information storage unit being configured to store an authentication key in a programming state of the memory protection unit and configuration information of the plurality of protection blocks;

[0011] In which, the control unit configures the authentication unit and the multiple protection blocks according to the configuration information. When the memory protection unit is accessed or the configuration information is modified, the authentication unit is used to receive an input key and authenticate the input key with the authentication key stored in the authentication unit. The multiple protection blocks respectively correspond to multiple memory parts that need to be encrypted.

[0012] In a preferred example, the configuration information includes the first and last addresses of the multiple memory parts corresponding to the multiple protection blocks, and the operation permissions of each of the multiple protection blocks, and the operation permissions include write protection permission, read protection permission and execution permission.

[0013] In a preferred example, the plurality of protection blocks have sequential numbers. When the areas of the plurality of memory parts corresponding to the plurality of protection blocks overlap, the protection block with a smaller sequential number has a higher corresponding priority.

[0014] In a preferred example, the memory protection unit has a data storage unit connected to the control unit, and the data storage unit is used to store data to be encrypted.

[0015] In a preferred example, the configuration information storage unit is further used to store an upper limit on the number of authentication times. When the number of times the authentication unit authenticates the input key reaches the upper limit, the memory protection unit is locked.

[0016] In a preferred example, when the configuration information storage unit is written with configuration information in a programming state, the upper 16 bits automatically complement the lower 16 bits, and after the memory protection system is powered on, it will detect whether the upper 16 bits and the lower 16 bits are complementary. If not, the memory is locked.

[0017] In a preferred example, when the memory protection system is powered off and then powered on again, the control unit self-configures the authentication unit and the plurality of protection blocks according to the configuration information.

[0018] In a preferred example, the at least one storage controller is respectively coupled to memories of different types, and the memories are static random access memory, flash memory or core coupled memory.

[0019] In a preferred example, the configuration information storage unit is included in the flash memory.

[0020] In a preferred embodiment, the memory protection unit further includes a status register, and the status register is used to display the usage status of the memory protection unit.

[0021] In the implementation mode of this application, it is used in the secondary development market of chips. For example, developer A develops an algorithm and sells the algorithm and chip to developer B. However, developer A hopes to protect the algorithm to prevent developer B from obtaining the algorithm code and copying the code to the chip purchased by developer B from other channels.

[0022] All operations of the memory protection system of the present invention require authentication. If authentication is not passed, the configuration of the memory protection unit becomes unreadable, the internal data storage unit becomes unreadable and unmodifiable, and the blocks protected by the memory protection unit remain in a protected state that cannot be removed, thus enhancing data security. Furthermore, the present invention allows for customizable protection permissions based on different applications, maximizing flexibility.

[0023] In the control unit, the protection state of the protection block is configured in program mode, and these configurations are saved in Flash. After the chip is reset, the configuration saved in Flash is first loaded into the corresponding register and executed. This allows the protection state of the protection block to take effect immediately, ensuring that the protection state is preserved even in power-off situations and takes effect immediately after power-on.

[0024] The specification of this application describes a large number of technical features, distributed across various technical solutions. Listing all possible combinations of the technical features (i.e., technical solutions) of this application would make the specification unduly lengthy. To avoid this problem, the various technical features disclosed in the above-mentioned Summary of the Invention, the various technical features disclosed in the various embodiments and examples below, and the various technical features disclosed in the accompanying drawings may be freely combined with each other to form various new technical solutions (all of which should be deemed to have been described in this specification), unless such a combination of technical features is technically infeasible. For example, if one example discloses features A+B+C and another example discloses features A+B+D+E, and features C and D are equivalent technical means that perform the same function, only one of them can be used technically, not both. Feature E can be technically combined with feature C. In this case, the solution A+B+C+D should not be considered described because it is technically infeasible, while the solution A+B+C+E should be considered described. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] Figure 1 It is a schematic diagram of an encryption transmission scheme in the prior art.

[0026] Figure 2 It is a process diagram of chip development in the prior art.

[0027] Figure 3 This is a process diagram of chip development with a verification key added according to an embodiment of the present application.

[0028] Figure 4 It is a structural diagram of a memory protection system according to one embodiment of the present application.

[0029] Figure 5 This is a schematic diagram comparing the protection status of the memory protection system in one embodiment of the present application with the protection status of the existing kernel's own memory protection system.

[0030] Figure 6 It is a flowchart of the operation of the memory protection unit according to one embodiment of the present application. DETAILED DESCRIPTION

[0031] In the following description, many technical details are provided to help readers better understand this application. However, those skilled in the art will understand that even without these technical details and various changes and modifications based on the following embodiments, the technical solutions claimed in this application can be implemented.

[0032] In order to solve the problems in the prior art, better solutions are as follows Figure 3 As shown, Developer A embeds a valid key in the chip and adds a check key valid mechanism to the Lib file. If the key is invalid, the Lib file is not executed. Developer A can configure the Lib file area to be non-readable and non-writable, but only executable, making code analysis more difficult, making the algorithm and software extremely difficult to copy and reverse engineer.

[0033] In order to make the objectives, technical solutions and advantages of this application clearer, the implementation methods of this application will be further described in detail below with reference to the accompanying drawings.

[0034] One embodiment of the present application relates to a memory protection system. Figure 4 A schematic diagram of a memory protection system in one embodiment is shown, the system comprising: a bus (BUS), at least one memory controller coupled to the bus, a memory protection unit (MPU) coupled to the bus, and a configuration information storage unit (the shaded portion of the authentication unit and the control unit in the figure). At least one memory controller is coupled to a memory. In one embodiment, the memory coupled to at least one memory controller is of a different type. For example, the memory is a static random access memory (SRAM), a flash memory (Flash), a core coupled memory (CCM), or any other type of memory. It is understood that Figure 1 The system described in the embodiment may be an MCU system, which may further include a processor (CPU). Figure 4 In the example shown, the system includes Flash memory and SRAM memory.

[0035] The memory protection unit is connected to at least one memory controller. The memory protection unit includes an authentication unit, a control unit, and multiple protection blocks (e.g., protection blocks 0 through N). A configuration information storage unit is used to store an authentication key in the memory protection unit's programmed state and configuration information for the multiple protection blocks. The control unit configures the authentication unit and the multiple protection blocks based on the configuration information. When accessing or modifying the memory protection unit's configuration information, the authentication unit receives an input key and authenticates the input key against the authentication key stored in the authentication unit. The multiple protection blocks correspond to multiple memory sections that require encryption.

[0036] In one embodiment, the configuration information includes the first and last addresses of the memory portions corresponding to the plurality of protection blocks, and the operation permissions of the plurality of protection blocks, wherein the operation permissions include write protection permission, read protection permission, and execute permission.

[0037] In one embodiment, the plurality of protection blocks have sequential numbers (eg, 0-N). When the areas of the plurality of memory portions corresponding to the plurality of protection blocks overlap, the protection block with a smaller sequential number has a higher priority.

[0038] In one embodiment, the memory protection unit has a data storage unit connected to the control unit, and the data storage unit is used to store data to be encrypted.

[0039] In one embodiment, the configuration information storage unit is further used to store an upper limit on the number of authentication times. When the number of times the authentication unit authenticates the input key reaches the upper limit, the memory protection unit is locked.

[0040] In one embodiment, the configuration information storage unit is included in a flash memory so that the information can be retained even after a power outage. When the memory protection system is powered off and then powered back on, the control unit self-configures the authentication unit and the multiple protection blocks based on the configuration information. It should be understood that the configuration information storage unit can also be included in other types of non-volatile memory and can be configured based on the actual needs of the system.

[0041] In one embodiment, the memory protection unit further includes a status register, and the status register is used to display the usage status of the memory protection unit.

[0042] In order to better understand the technical solution of the present application, a specific example is provided below for illustration. The details listed in the example are mainly for ease of understanding and are not intended to limit the scope of protection of the present application.

[0043] Aiming at the read, write and execute permission control of the MCU built-in memory, the present invention designs an authenticated memory protection unit (AMPU).

[0044] refer to Figure 4 As shown, the AMPU unit includes an authentication unit, a control unit, a data storage unit and multiple protection blocks.

[0045] The protection block can set the following blocks separately: ① Whether it is readable in privileged mode, ② Whether it is writable in privileged mode, ③ Whether it is executable in privileged mode, ④ Whether it is readable in non-privileged mode, ⑤ Whether it is writable in non-privileged mode, ⑥ Whether it is executable in non-privileged mode, ⑦ Whether DAP (Debug Access Port) is readable, ⑧ Whether DAP (Debug Access Port) is writable.

[0046] The range of the protected area is divided by filling in the starting and ending addresses, thereby protecting some areas within the chip without affecting the normal use of other areas. The specific implementation process is as follows: This unit provides registers for setting the starting and ending addresses of each area. Writing the starting and ending addresses of the corresponding area into the registers can limit the scope of the protected area. Only the storage area within the range is protected, while the area outside the range is unprotected and can be freely used for secondary development.

[0047] In addition, if there is overlap between the protection areas of the protection blocks, the protection status of the overlapping part is determined by the configuration of the protection block with the smaller number.

[0048] Except for the status register, all the registers of the AMPU are mapped to the system internal Flash (for example, Figure 4 Therefore, there are two modes for writing to the AMPU registers: one is to save the configuration only in the registers and execute the register configuration without saving it in the mapped Flash, which is called "non-program" mode; the other is to save the configuration in the mapped Flash first, then reflect it to the registers and execute the configuration, which is called "program" mode. The mapped Flash that stores the AMPU configuration can only be accessed through the corresponding registers and cannot be accessed via the address bus.

[0049] In the control unit, the protection status of the protection block configured in program mode (as described in the protection block section above) will be saved in the mapped Flash. Figure 5 As shown in the figure, after the chip is reset, the configuration saved in the Flash will be loaded into the corresponding register and executed first, so that the protection state of the protection block will take effect directly.

[0050] In the control unit, the protection state of the protection block configured in non-program mode (as described in the protection block section above) is not saved in the mapped Flash. After the chip is reset, the configuration saved in Flash is first loaded into the corresponding registers and executed, so that the protection state of the protection block is restored to the old configuration.

[0051] In the authentication unit, the key for configuring the AMPU can only be used in program mode, that is, the modified new key will be saved directly in the mapped Flash. In this way, after the chip is reset, only the new key can unlock the AMPU.

[0052] In the authentication unit, the process of unlocking the AMPU is as follows: in non-program mode, write the key to the key register and then start verification. If the verification is successful, the corresponding verification pass flag will be set.

[0053] In the control unit, the number of AMPU unlock failures is limited and configurable. If the number of unlock failures reaches the upper limit, that is, the number of times the input key verification fails reaches the upper limit, the AMPU unit will be locked and the protected block will be protected. The remaining internal storage units can still be used. After the unit is in the locked state, even if the correct key is entered, authentication cannot be passed. The unit can only be reset by "formatting". After formatting, the unit is restored to the factory state and the memory in the chip will be completely erased.

[0054] When writing to the Flash memory mapped by the AMPU in program mode, the Flash memory must still adhere to the rule that "1" can only be written to "0". Therefore, before programming, the Flash memory must be erased to ensure that it is in an all-1 state. To ensure the correctness of the data entered and to prevent malicious hacking, the upper 16 bits of the Flash memory mapped by the AMPU registers automatically complement the lower 16 bits in the program mode. For example, if the lower 16 bits are 0x5555, then the upper 16 bits are 0xAAAA. If the lower 16 bits are written to 0xAAAA without erasing the Flash memory mapped by the registers, the upper 16 bits will automatically be written to 0x5555. According to the Flash write rule, the lower 16 bits will be 0x0000 and the upper 16 bits will be 0x0000. Since the upper and lower 16 bits are not complementary, this will cause a program error. This error will be detected during the verification of the Flash memory mapped by the registers after a chip reset, and an "auto-load error" will be immediately generated. When an "autoload error" occurs, the AMPU locks the entire chip (i.e., the entire chip is unreadable and unwritable, and only the first 16 bytes are executable). To correct this, the unit can only be reset by "formatting." After formatting, the unit returns to its factory state, and the chip's memory is completely erased.

[0055] The AMPU also provides a data storage unit for storing protected data. This data can only be read and written via a 32-bit register. The data is stored in the mapped Flash memory and must be written to in accordance with the Flash rule that only "1" can be written to "0".

[0056] The existing ARM core's built-in MPU protection settings will become invalid when the chip is reset, and the protection effect will be set by software after power-on. Figure 5 As shown in the figure, the ARM core's built-in MPU can only be used for program flow control and to ensure stable operation of the MCU in multi-tasking operations and execution situations, and cannot play a role in protecting code in the secondary development market. However, this patent uses mapped Flash to save the configuration of the AMPU and automatically loads it into the register when the chip is initialized, so that the chip is always in a protected state, such as Figure 5 As shown in "AMPU", the code and data in the chip obtained by the secondary development user are in a protected state. The encrypted code and data can only be called in the specified chip, which can be applied to the secondary development market.

[0057] After the chip is reset, the AMPU is in an unauthenticated state. Modifying the protection state of the protected block, reading and modifying the data storage unit, and modifying the key require authentication. The specific process is as follows Figure 6 shown.

[0058] Step S1: Chip reset.

[0059] Step S2: The AMPU configuration in the mapped Flash is automatically loaded into the register.

[0060] Step S3, write the key.

[0061] Step S4: Start authentication.

[0062] Step S5, determine whether the key is correct, if so, proceed to step S6, if not, proceed to step S8.

[0063] Step S6: The memory protection unit is in an authentication passed state.

[0064] Step S7, setting the storage protection unit, including:

[0065] 1. Ability to modify and set memory protection units (including releasing the protection status of protection blocks, etc.)

[0066] 2. Can read and modify built-in storage area

[0067] 3. Modifiable keys

[0068] Step S8: The memory protection unit is in an unauthenticated state.

[0069] Step S9: Check whether the number of authentication errors has reached the upper limit.

[0070] Step S10: The memory protection unit is in a latched state.

[0071] This patent allows for flexible configuration of protected blocks and protection states. The data storage unit provided allows Developer A to write unified chip identification information, facilitating mass production. The key in this patent can be modified, and as long as the key is not leaked, the code and data within the chip can be protected, making it very effective for the secondary development market.

[0072] All documents mentioned in this specification are considered to be included in their entirety in the disclosure of this application so that they can be used as a basis for modification when necessary. In addition, it should be understood that the above description is only a preferred embodiment of this specification and is not intended to limit the scope of protection of this specification. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of one or more embodiments of this specification should be included in the scope of protection of one or more embodiments of this specification.

[0073] In some cases, the processes depicted in the accompanying figures do not necessarily require the particular order shown, or sequential order, to achieve desirable results.In certain implementations, multitasking and parallel processing are also possible or may be advantageous.

Claims

1. A memory protection system, characterized in that: include: a bus, and at least one memory controller coupled to the bus, each of the at least one memory controller being coupled to a memory; a memory protection unit coupled to the bus, the memory protection unit being connected to the at least one memory controller, the memory protection unit comprising an authentication unit, a control unit, and a plurality of protection blocks, the plurality of protection blocks respectively corresponding to a plurality of memory portions to be protected set in the memory; as well as a configuration information storage unit, the configuration information storage unit being used to store an authentication key in a programming state of the memory protection unit and configuration information of the plurality of protection blocks, the configuration information including the first and last addresses of the plurality of memory portions corresponding to the plurality of protection blocks, and respective operation permissions of the plurality of protection blocks, the operation permissions including write protection permission, read protection permission, and execute permission, wherein the plurality of protection blocks are sequentially numbered, and when the regions of the plurality of memory portions corresponding to the plurality of protection blocks overlap, a protection block with a smaller sequential number has a higher priority; the configuration information is first saved to a mapped flash memory and then reflected on a register and configuration is executed, the configuration information storage unit being included in the flash memory, and the flash memory can only be accessed through the corresponding register and cannot be accessed through an address bus; wherein the control unit configures the authentication unit and the plurality of protection blocks according to the configuration information, and when accessing or modifying the configuration information of the memory protection unit, the authentication unit is configured to receive an input key and authenticate the input key with an authentication key stored in the authentication unit; When the memory protection system is powered off and then powered on again, upon powering on again, the control unit automatically self-configures the authentication unit and multiple protection blocks according to the configuration information, so that the multiple protection blocks are always in a protection state.

2. The memory protection system according to claim 1, wherein: The memory protection unit comprises a data storage unit connected to the control unit, and the data storage unit is used to store data to be encrypted.

3. The memory protection system according to claim 1, wherein: The configuration information storage unit is further configured to store an upper limit on authentication times. When the number of times the authentication unit authenticates the input key reaches the upper limit, the memory protection unit is locked.

4. The memory protection system according to claim 1, wherein: When configuration information is written into the configuration information storage unit in the programming state, the upper 16 bits automatically complement the lower 16 bits, and after the memory protection system is powered on, it will detect whether the upper 16 bits and the lower 16 bits are complementary. If not, the memory is locked.

5. The memory protection system according to claim 1, wherein: The memories coupled to each of the at least one storage controller are different types of memories, which are static random access memory, flash memory or core coupled memory.

6. The memory protection system according to claim 1, wherein: The memory protection unit further includes a status register, and the status register is used to display the usage status of the memory protection unit.

Images