Protection method for heating smoking set chip and hardware security module

Abstract

The invention discloses a protection method of a heating smoking set chip and a hardware security module. The method comprises the following steps: writing a user key into the heating smoking set chip; the hardware security module encrypts and decrypts a user key through a root key of the heating smoking set chip, and stores the encrypted user key in an eFlash flash memory; the hardware security module decrypts the Bootloader encrypted mirror image according to the decrypted user key, and carries out security authentication operation; the method comprises the following steps: starting a chip control system for controlling a heating smoking set chip to obtain an SDK encrypted mirror image of the heating smoking set chip; the hardware security module decrypts the SDK encrypted mirror image according to the root key and the encrypted user key, and loads the SDK encrypted mirror image to an SRAM (Static Random Access Memory); according to the method, the data is encrypted through the hardware security module, and the security of the data is ensured, so that the counterfeiting and counterfeiting behaviors of the chip are effectively prevented, the rights and interests of the chip are prevented from being invaded, and meanwhile, the information security of a user is also protected.

Description

Technical Field

[0001] The present application relates to the field of chip security technology, and in particular to a protection method for a heating smoking device chip and a hardware security module. Background Art

[0002] With the development of science and technology, chips are widely used in various fields, such as electronic payment, identity authentication, etc.; however, due to the low cost of chip manufacturing, it has also led to a large number of counterfeiting and imitation activities; this not only infringes on the rights and interests of the chip itself, but also brings huge security risks to users.

[0003] Heating devices are one of the core components of new tobacco products, and chips are also installed in heating devices; therefore, preventing the chips in heating devices from being counterfeited is also a major challenge for tobacco industry supervision.

[0004] Based on this, providing a protection method and a hardware security module that can effectively prevent counterfeiting and imitation of chips is a technical problem that needs to be solved urgently by those skilled in the art. Summary of the invention

[0005] In order to solve the above technical problems, the purpose of the present invention is to provide a protection method and a hardware security module for a heated smoking device chip. The data is encrypted by the hardware security module to ensure the security of the data, thereby effectively preventing the counterfeiting and imitation of the chip, avoiding infringement of the rights and interests of the chip itself, and protecting the user's information security.

[0006] The first object of the present invention is to provide a method for protecting a heating smoking device chip; The technical solution provided by the present invention is as follows: A method for protecting a heating smoking device chip comprises the following steps: Write the user key user_key into the heated smoking device chip; The hardware security module encrypts and decrypts the user key user_key through the root key root_key of the heated smoking device chip, and stores the encrypted user key user_key in the eFlash flash memory; The hardware security module decrypts the Bootloader encrypted image according to the decrypted user key user_key and performs security authentication calculation; By starting the chip control system that controls the heating smoking device chip, the SDK encrypted image of the heating smoking device chip is obtained; The hardware security module decrypts the SDK encrypted image according to the root key root_key and the encrypted user key user_key, and loads it into the SRAM static memory.

[0007] Preferably, the hardware security module reads the root key root_key of the heated smoking device chip to encrypt and decrypt the user key user_key, and stores the encrypted user key user_key in the eFlash flash memory, and further includes: The chip control system that controls the heating smoking device chip is started to obtain the Bootloader encrypted image of the heating smoking device chip.

[0008] Preferably, the starting of the chip control system for controlling the heating smoking device chip to obtain the Bootloader encrypted image of the heating smoking device chip specifically includes: The chip control system of the startup control heating smoking device chip is used to determine whether the safe startup mode of the heating smoking device chip is a software upgrade: If yes, use the UART data serial port to load the Bootloader encrypted image; If not, the Bootloader encrypted image is directly read from the eFlash flash memory.

[0009] Preferably, the hardware security module reads the root key root_key of the heated smoking device chip to encrypt and decrypt the user key user_key, and stores the encrypted user key user_key in the eFlash flash memory, specifically including: The hardware security module reads the root key root_key of the heated smoking device chip during the initialization phase to encrypt the user key user_key, and stores the encrypted user key user_key in the eFlash flash memory; The hardware security module reads the root key root_key of the heating smoking device chip during the initialization phase to decrypt the user key user_key and perform security authentication operations.

[0010] Preferably, the hardware security module reads the root key root_key of the heated smoking device chip during the initialization phase to decrypt the user key user_key and perform security authentication operations, specifically including: If the authentication fails, the heating smoking device chip executes an exception handling mechanism; If the authentication is successful, the hardware security module is executed to decrypt the Bootloader encrypted image according to the decrypted user key user_key and perform a security authentication operation.

[0011] Preferably, the step of starting a chip control system that controls the heating smoking device chip to obtain the SDK encrypted image of the heating smoking device chip specifically includes: By starting the chip control system that controls the heating smoking device chip, it is determined whether the safe startup mode of the heating smoking device chip is a software upgrade: If yes, use the UART data serial port to load the SDK encrypted image to be upgraded; If not, the SDK encrypted image is directly read from the eFlash flash memory.

[0012] Preferably, the hardware security module decrypts the Bootloader encrypted image according to the decrypted user key user_key and performs a security authentication operation, specifically including: If the authentication fails, the heating smoking device chip executes the exception handling mechanism; If the authentication is successful, the decrypted Bootloader encrypted image is loaded into the ILM and run.

[0013] Preferably, the hardware security module decrypts the SDK encrypted image according to the root key root_key and the encrypted user key user_key, and loads it into the SRAM static memory, specifically including: The hardware security module decrypts the SDK encrypted image according to the root key root_key and the encrypted user key user_key, and performs security authentication operations: If the authentication fails, the heating smoking device chip executes the exception handling mechanism; If the authentication is successful, the decrypted SDK encrypted image is loaded into the SRAM static memory and run.

[0014] Preferably, the exception handling mechanism is specifically: The hardware security module verifies and controls the GPIO lighting function and fixes a GPIO interface output. If the security boot check authentication fails, the GPIO light is controlled to flash.

[0015] The second object of the present invention is to provide a hardware security module; The technical solution provided by the present invention is as follows: A hardware security module, based on a protection method for a heated smoking device chip, comprises: a key management module, an encryption and decryption storage module, a BOOTROM module, an eFlash hardware address isolation module, an SM4-GCM module and a hardware security module controller; The key management module is used to manage the initialization and read and write permissions of all keys; The encryption and decryption storage module is used to encrypt and decrypt the user key user_key and store the root key root_key; The BOOTROM module is used to start the chip control system that controls the heated smoking device chip to obtain the Bootloader encrypted image of the heated smoking device chip; The eFlash hardware address isolation module is used to store the encrypted user key user_key; and is also used to isolate the software and hardware read and write permissions of the preset address in the eFlash flash memory; The SM4-GCM module is used for the hardware security module to decrypt the Bootloader encrypted image according to the decrypted user key user_key and perform security authentication operations; The hardware security module controller is used to decrypt the SDK encrypted image according to the root key root_key and the encrypted user key user_key, and load it into the SRAM static memory; it is also used to manage the overall operation of the hardware security module.

[0016] A method for protecting a heating smoking device chip provided by the present invention comprises the following steps: writing a user key user_key into the heating smoking device chip; a hardware security module encrypting and decrypting the user key user_key through a root key root_key of the heating smoking device chip, and storing the encrypted user key user_key in an eFlash flash memory; the hardware security module decrypts a Bootloader encrypted image according to the decrypted user key user_key, and performs a security authentication operation; the SDK encrypted image of the heating smoking device chip is obtained by starting a chip control system that controls the heating smoking device chip; the hardware security module decrypts the SDK encrypted image according to the root key root_key and the encrypted user key user_key, and loads it into an SRAM static memory; the method encrypts data through a hardware security module to ensure data security, thereby effectively preventing counterfeiting and imitation of the chip, avoiding infringement of the rights and interests of the chip itself, and also protecting the information security of the user. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0018] Figure 1 This is a flow chart of a method for protecting a heating smoking device chip according to an embodiment of the present invention; Figure 2 This is a schematic diagram of the structure of a hardware security module in an embodiment of the present invention; Figure 3 The figure is a schematic diagram of the structure of an electronic device in an embodiment of the present invention. DETAILED DESCRIPTION

[0019] In order to enable those skilled in the art to better understand the technical solutions in this application, the technical solutions in the embodiments of this application will be clearly and completely described below. Obviously, the described embodiments are only part of the embodiments of this application, not all of them. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0020] It should be noted that when an element is referred to as being "fixed on" or "set on" another element, it can be directly on the other element or indirectly set on the other element; when an element is referred to as being "connected to" another element, it can be directly connected to the other element or indirectly connected to the other element.

[0021] It should be understood that the terms "length", "width", "up", "down", "front", "back", "left", "right", "vertical", "horizontal", "top", "bottom", "inside", "outside", etc., indicating the orientation or position relationship, are based on the orientation or position relationship shown in the drawings, and are only for the convenience of describing the present application and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore should not be understood as a limitation on the present application.

[0022] In addition, the terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of technical features indicated. Therefore, a feature defined as "first" or "second" may explicitly or implicitly include one or more of the features. In the description of this application, "multiple" and "several" mean two or more, unless otherwise clearly and specifically defined.

[0023] It should be noted that the structures, proportions, sizes, etc. illustrated in the drawings of this specification are only used to match the contents disclosed in the specification for people familiar with this technology to understand and read, and are not used to limit the conditions under which this application can be implemented. Therefore, they have no substantive technical significance. Any structural modification, change in proportional relationship or adjustment of size should still fall within the scope of the technical content disclosed in this application without affecting the effects and purposes that can be achieved by this application.

[0024] like Figure 1As shown, an embodiment of the present invention provides a method for protecting a heating smoking device chip, comprising the following steps: S1. Write the user key user_key into the heated smoking device chip; In step S1, during the initialization phase of the heated smoking device chip, the user key user_key, the product serial number and all the encrypted related software that can control the heated smoking device are written.

[0025] S2. The hardware security module encrypts and decrypts the user key user_key through the root key root_key of the heating smoking device chip, and stores the encrypted user key user_key in the eFlash flash memory; In step S2, the root key root_key of the heated smoking device chip is securely stored in the encrypted storage area of ​​the chip, which can only be accessed by the hardware security module; therefore, the root key root_key of the heated smoking device chip is read by the hardware security module to encrypt and decrypt the user key user_key written in step S1, and then the encrypted user key user_key is stored in the eFlash flash memory.

[0026] S3. The hardware security module decrypts the Bootloader encrypted image according to the decrypted user key user_key and performs security authentication operations; In step S3, the hardware security module decrypts the Bootloader encrypted image according to the decrypted user key user_key obtained in step S2, and performs security authentication on the user key data to determine whether it is legitimate; the Bootloader encrypted image in this embodiment is a hardware-started boot process. For example, when the hardware system of the heated smoking device is started for the first time, there will be a boot process similar to the mobile phone startup interface, which can be understood as a process of reading software data. Because of the eFlash flash memory, the speed will be very fast, accurate to 0.1s.

[0027] S4. By starting the chip control system that controls the heating smoking device chip, the SDK encrypted image of the heating smoking device chip is obtained; In step S4, the SDK encrypted image of the heating smoking device chip is obtained by starting the chip control system that controls the heating smoking device chip; the chip control system in this embodiment includes two parts, software and hardware, and the SDK encrypted image stored in the chip can be obtained by starting the chip control system.

[0028] S5. The hardware security module decrypts the SDK encrypted image according to the root key root_key and the encrypted user key user_key, and loads it into the SRAM static memory.

[0029] In step S5, the hardware security module decrypts the SDK encrypted image according to the root key root_key and the encrypted user key user_key in the encrypted storage area, and loads it into the SRAM static memory; the main function of the SRAM static memory in this embodiment is that, unlike the eFlash flash memory, the data can remain constant when powered on, so it is faster and has low power consumption; and unlike the dynamic memory, there is data only when the power is on, and no data is recorded when the power is off.

[0030] Compared with the prior art, this method encrypts data through a hardware security module to ensure data security, thereby effectively preventing chip counterfeiting and imitation, avoiding infringement of the rights and interests of the chip itself, and also protecting user information security.

[0031] Preferably, the hardware security module reads the root key root_key of the heated smoking device chip to encrypt and decrypt the user key user_key, and stores the encrypted user key user_key in the eFlash flash memory, and further includes: The chip control system that controls the heating smoking device chip is started to obtain the Bootloader encrypted image of the heating smoking device chip.

[0032] In actual use, the chip control system that controls the heating smoking device chip is started to obtain the Bootloader encrypted image of the heating smoking device chip; the chip control system in this embodiment includes two parts, software and hardware. By starting the chip control system, the Bootloader encrypted image stored in the chip can be obtained.

[0033] Preferably, the starting of the chip control system for controlling the heating smoking device chip to obtain the Bootloader encrypted image of the heating smoking device chip specifically includes: The chip control system of the startup control heating smoking device chip is used to determine whether the safe startup mode of the heating smoking device chip is a software upgrade: If yes, use the UART data serial port to load the Bootloader encrypted image; If not, the Bootloader encrypted image is directly read from the eFlash flash memory.

[0034] In actual use, the heating tobacco chip supports normal boot mode and safe boot mode, and the safe boot mode is suitable for scenarios that require safe boot and software encryption. After power-on, the program in the BOOTROM write-protected flash memory is first run, and then the chip control system that controls the heating tobacco chip is started to determine whether to read the Bootloader encrypted image directly from the eFlash flash memory or use the UART data serial port to load the Bootloader encrypted image, and then perform hardware security decryption and verification. After the verification passes, run the decrypted user program; therefore, by starting the chip control system that controls the heating tobacco chip, it is determined whether the safe boot mode of the heating tobacco chip is a software upgrade: if so, use the UART data serial port to load the Bootloader encrypted image; if not, read the Bootloader encrypted image directly in the eFlash flash memory.

[0035] Preferably, the hardware security module reads the root key root_key of the heated smoking device chip to encrypt and decrypt the user key user_key, and stores the encrypted user key user_key in the eFlash flash memory, specifically including: The hardware security module reads the root key root_key of the heated smoking device chip during the initialization phase to encrypt the user key user_key, and stores the encrypted user key user_key in the eFlash flash memory; The hardware security module reads the root key root_key of the heating smoking device chip during the initialization phase to decrypt the user key user_key and perform security authentication operations.

[0036] In actual use, since the heating tobacco chip has a life cycle set, the hardware security module reads the root key root_key of the heating tobacco chip during the initialization phase of the heating tobacco chip to encrypt the user key user_key, and then stores the encrypted user key user_key in the eFlash flash memory; then, the user key user_key is decrypted based on the root key root_key of the heating tobacco chip, and the user key data is securely authenticated to determine whether it is legal.

[0037] Preferably, the hardware security module reads the root key root_key of the heated smoking device chip during the initialization phase to decrypt the user key user_key and perform security authentication operations, specifically including: If the authentication fails, the heating smoking device chip executes an exception handling mechanism; If the authentication is successful, the hardware security module is executed to decrypt the Bootloader encrypted image according to the decrypted user key user_key and perform a security authentication operation.

[0038] In actual use, the security authentication operation is expressed as follows: if the authentication fails, the heating tobacco device chip executes the exception handling mechanism; if the authentication passes, step S3 is executed; the exception handling mechanism adopted in this embodiment is specifically a hardware security module verification control GPIO lighting function, and a GPIO interface output is fixed. If the security startup check authentication fails, the GPIO light is controlled to flash.

[0039] Preferably, the step of starting a chip control system that controls the heating smoking device chip to obtain the SDK encrypted image of the heating smoking device chip specifically includes: By starting the chip control system that controls the heating smoking device chip, it is determined whether the safe startup mode of the heating smoking device chip is a software upgrade: If yes, use the UART data serial port to load the SDK encrypted image to be upgraded; If not, the SDK encrypted image is directly read from the eFlash flash memory.

[0040] In actual use, the chip control system that controls the heated smoking device chip is started to determine whether the safe startup mode of the heated smoking device chip is a software upgrade: if so, the UART data serial port is used to load the SDK encrypted image to be upgraded; if not, the SDK encrypted image is directly read in the eFlash flash memory; this judgment is mainly to provide an interface method for subsequent software upgrades.

[0041] Preferably, the hardware security module decrypts the Bootloader encrypted image according to the decrypted user key user_key and performs a security authentication operation, specifically including: If the authentication fails, the heating smoking device chip executes the exception handling mechanism; If the authentication is successful, the decrypted Bootloader encrypted image is loaded into the ILM and run.

[0042] In actual use, the security authentication operation is expressed as follows: if the authentication fails, the heated tobacco device chip executes the exception handling mechanism; if the authentication passes, the decrypted Bootloader encrypted image is loaded into the ILM and runs; the exception handling mechanism used in this embodiment is specifically the hardware security module verification control GPIO lighting function, and a GPIO interface output is fixed. If the security boot check authentication fails, the GPIO flashing light is controlled; the ILM in this embodiment is local memory, which is a local memory with 32KB storage space, and the code can run on it; because the current bootloader code is about 10KB, it is placed on the ILM local memory and runs.

[0043] Preferably, the hardware security module decrypts the SDK encrypted image according to the root key root_key and the encrypted user key user_key, and loads it into the SRAM static memory, specifically including: The hardware security module decrypts the SDK encrypted image according to the root key root_key and the encrypted user key user_key, and performs security authentication operations: If the authentication fails, the heating smoking device chip executes the exception handling mechanism; If the authentication is successful, the decrypted SDK encrypted image is loaded into the SRAM static memory and run.

[0044] In actual use, the security authentication operation is expressed as follows: if the authentication fails, the heated tobacco device chip executes the exception handling mechanism; if the authentication passes, the decrypted SDK encrypted image is loaded into the SRAM static memory and run; the exception handling mechanism used in this embodiment is specifically a hardware security module verification control GPIO lighting function, and a fixed GPIO interface output, if the security startup check authentication fails, the GPIO light is controlled to flash.

[0045] like Figure 2 As shown, the present invention also provides a hardware security module, based on a protection method for a heating smoking device chip, comprising: a key management module, an encryption and decryption storage module, a BOOTROM module, an eFlash hardware address isolation module, an SM4-GCM module and a hardware security module controller; The key management module is used to manage the initialization and read and write permissions of all keys; The encryption and decryption storage module is used to encrypt and decrypt the user key user_key and store the root key root_key; The BOOTROM module is used to start the chip control system that controls the heated smoking device chip to obtain the Bootloader encrypted image of the heated smoking device chip; The eFlash hardware address isolation module is used to store the encrypted user key user_key; and is also used to isolate the software and hardware read and write permissions of the preset address in the eFlash flash memory; The SM4-GCM module is used for the hardware security module to decrypt the Bootloader encrypted image according to the decrypted user key user_key and perform security authentication operations; The hardware security module controller is used to decrypt the SDK encrypted image according to the root key root_key and the encrypted user key user_key, and load it into the SRAM static memory; it is also used to manage the overall operation of the hardware security module.

[0046] In actual application, a hardware security module is set up and applied to a protection method for a heated tobacco device chip, including: a key management module, an encryption and decryption storage module, a BOOTROM module, an eFlash hardware address isolation module, an SM4-GCM module and a hardware security module controller; the key management module is respectively connected to the encryption and decryption storage module and the hardware security module controller; the SM4-GCM module is connected to the hardware security module controller; the hardware security module controller is respectively connected to the BOOTROM module and the eFlash hardware address isolation module through a bus; wherein, the SM4-GCM module is a hardware accelerator containing a lightweight SM4-GCM algorithm, which is used to realize the encrypted storage and security authentication of the user key user_key and the software; the data is encrypted by the hardware security module to ensure the security of the data, thereby effectively preventing the counterfeiting and imitation of the chip, avoiding the infringement of the rights and interests of the chip itself, and also protecting the information security of the user.

[0047] Furthermore, the present application also discloses an electronic device. Figure 3 This is a structural diagram of an electronic device 20 according to an exemplary embodiment. The content in the diagram cannot be regarded as any limitation on the scope of use of the present application.

[0048] Figure 3The structural diagram of an electronic device 20 provided in an embodiment of the present application. The electronic device 20 may specifically include: at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input / output interface 25, and a communication bus 26. The memory 22 is used to store a computer program, which is loaded and executed by the processor 21 to implement the relevant steps in the protection method of the heating smoking device chip disclosed in any of the above embodiments. In addition, the electronic device 20 in this embodiment may specifically be an electronic computer.

[0049] In this embodiment, the power supply 23 is used to provide working voltage for each hardware device on the electronic device 20; the communication interface 24 can create a data transmission channel between the electronic device 20 and the external device, and the communication protocol it follows is any communication protocol that can be applied to the technical solution of the present application, and is not specifically limited here; the input and output interface 25 is used to obtain external input data or output data to the outside world, and its specific interface type can be selected according to specific application needs and is not specifically limited here.

[0050] In addition, the memory 22, as a carrier for storing resources, can be a read-only memory, a random access memory, a disk or an optical disk, etc. The resources stored thereon may include an operating system 221, a computer program 222 and data 223, etc. The storage method can be temporary storage or permanent storage.

[0051] Among them, the operating system 221 is used to manage and control the hardware devices and computer programs 222 on the electronic device 20 to realize the operation and processing of the data 223 in the memory 22 by the processor 21, which can be Windows Server, Netware, Unix, Linux, etc. In addition to including a computer program that can be used to complete the protection method of the heating smoking device chip executed by the electronic device 20 disclosed in any of the aforementioned embodiments, the computer program 222 can also further include a computer program that can be used to complete other specific tasks. In addition to including data transmitted from an external device received by the protection device of the heating smoking device chip, the data 223 can also include data collected by its own input and output interface 25, etc.

[0052] The steps of the method or algorithm described in conjunction with the embodiments disclosed herein may be implemented directly using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0053] Furthermore, the present application also discloses a computer-readable storage medium for storing a computer program; wherein, when the computer program is executed by a processor, the aforementioned disclosed method for protecting a heating smoking device chip is implemented. The specific steps of the method can be referred to the corresponding contents disclosed in the aforementioned embodiments, and will not be described in detail here.

[0054] In this specification, each embodiment is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can be referred to each other. For the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part.

[0055] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0056] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0057] If a flow chart is used in the present application, the flow chart is used to illustrate the operations performed by the system according to the embodiment of the present application. It should be understood that the preceding or following operations are not necessarily performed accurately in order. On the contrary, each step can be processed in reverse order or simultaneously. At the same time, other operations can also be added to these processes, or a certain step or several steps of operations can be removed from these processes.

[0058] The above description of the disclosed embodiments enables one skilled in the art to implement or use the present invention. Various modifications to these embodiments will be apparent to one skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention will not be limited to the embodiments shown herein, but rather to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A method for protecting a heating smoking device chip, characterized in that: The steps include: Write the user key user_key into the heated smoking device chip; The hardware security module encrypts and decrypts the user key user_key through the root key root_key of the heated smoking device chip, and stores the encrypted user key user_key in the eFlash flash memory; The hardware security module decrypts the Bootloader encrypted image according to the decrypted user key user_key and performs security authentication calculation; By starting the chip control system that controls the heating smoking device chip, the SDK encrypted image of the heating smoking device chip is obtained; The hardware security module decrypts the SDK encrypted image according to the root key root_key and the encrypted user key user_key, and loads it into the SRAM static memory.

2. The method for protecting a heating smoking device chip according to claim 1, characterized in that: The hardware security module reads the root key root_key of the heated smoking device chip to encrypt and decrypt the user key user_key, and stores the encrypted user key user_key in the eFlash flash memory, and also includes: The Bootloader encrypted image of the heating smoking device chip is obtained by starting the chip control system that controls the heating smoking device chip.

3. The method for protecting a heating smoking device chip according to claim 2, characterized in that: The starting of the chip control system for controlling the heating smoking device chip to obtain the Bootloader encrypted image of the heating smoking device chip specifically includes: By starting the chip control system that controls the heating smoking device chip, it is determined whether the safe startup mode of the heating smoking device chip is a software upgrade: If yes, use the UART data serial port to load the Bootloader encrypted image; If not, the Bootloader encrypted image is directly read from the eFlash flash memory.

4. The method for protecting a heating smoking device chip according to claim 1, characterized in that: The hardware security module reads the root key root_key of the heated smoking device chip to encrypt and decrypt the user key user_key, and stores the encrypted user key user_key in the eFlash flash memory, specifically including: The hardware security module reads the root key root_key of the heated smoking device chip during the initialization phase to encrypt the user key user_key, and stores the encrypted user key user_key in the eFlash flash memory; The hardware security module reads the root key root_key of the heating smoking device chip during the initialization phase to decrypt the user key user_key and perform security authentication operations.

5. The method for protecting a heating smoking device chip according to claim 1, characterized in that: The hardware security module reads the root key root_key of the heating smoking device chip in the initialization phase to decrypt the user key user_key and perform security authentication operations, specifically including: If the authentication fails, the heating smoking device chip executes an exception handling mechanism; If the authentication is successful, the hardware security module is executed to decrypt the Bootloader encrypted image according to the decrypted user key user_key and perform a security authentication operation.

6. The method for protecting a heating smoking device chip according to claim 1, characterized in that: The step of starting the chip control system for controlling the heating smoking device chip to obtain the SDK encrypted image of the heating smoking device chip specifically includes: By starting the chip control system that controls the heating smoking device chip, it is determined whether the safe startup mode of the heating smoking device chip is a software upgrade: If yes, use the UART data serial port to load the SDK encrypted image to be upgraded; If not, the SDK encrypted image is directly read from the eFlash flash memory.

7. The method for protecting a heating smoking device chip according to claim 5, characterized in that: The hardware security module decrypts the Bootloader encrypted image according to the decrypted user key user_key and performs security authentication operations, specifically including: If the authentication fails, the heating smoking device chip executes the exception handling mechanism; If the authentication is successful, the decrypted Bootloader encrypted image is loaded into the ILM and run.

8. The method for protecting a heating smoking device chip according to claim 7, characterized in that: The hardware security module decrypts the SDK encrypted image according to the root key root_key and the encrypted user key user_key, and loads it into the SRAM static memory, specifically including: The hardware security module decrypts the SDK encrypted image according to the root key root_key and the encrypted user key user_key, and performs security authentication operations: If the authentication fails, the heating smoking device chip executes the exception handling mechanism; If the authentication is successful, the decrypted SDK encrypted image is loaded into the SRAM static memory and run.

9. The method for protecting a heating smoking device chip according to claim 8, characterized in that: The exception handling mechanism specifically includes: The hardware security module verifies and controls the GPIO lighting function and fixes a GPIO interface output. If the security boot check authentication fails, the GPIO light is controlled to flash.

10. A hardware security module, based on the protection method of the heating smoking device chip according to claims 1 to 9, characterized in that: include: Key management module, encryption and decryption storage module, BOOTROM module, eFlash hardware address isolation module, SM4-GCM module and hardware security module controller; The key management module is used to manage the initialization and read and write permissions of all keys; The encryption and decryption storage module is used to encrypt and decrypt the user key user_key and store the root key root_key; The BOOTROM module is used to start the chip control system that controls the heated smoking device chip to obtain the Bootloader encrypted image of the heated smoking device chip; The eFlash hardware address isolation module is used to store the encrypted user key user_key; and is also used to isolate the software and hardware read and write permissions of the preset address in the eFlash flash memory; The SM4-GCM module is used for the hardware security module to decrypt the Bootloader encrypted image according to the decrypted user key user_key and perform security authentication operations; The hardware security module controller is used to decrypt the SDK encrypted image according to the root key root_key and the encrypted user key user_key, and load it into the SRAM static memory; it is also used to manage the overall operation of the hardware security module.

Images