Memory device and operating method
By verifying data integrity before loading the special function registers of the storage device, using the preload stage and checksum comparison mechanism, the problem of storage devices being vulnerable to fault injection attacks is solved, and effective resistance and recovery capabilities for fault injection are achieved. Reduces the possibility of attack success.
Patent Information
- Application Number
- CN202410677876.3
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Priority Date
- 2023-06-30
- Filing Date
- 2024-05-29
- Publication Date
- 2024-12-31
AI Technical Summary
Special functional registers in storage devices are susceptible to fault injection attacks. The existing technology lacks effective protection measures, especially under resource and area limitations. Traditional security measures are often all-in-one or nothing, and it is difficult to provide fault injection attacks. Fine protection.
A storage device is designed, including a preload stage that preloads data into a first preload register and verifies the integrity of the data before loading into a special function register, by calculating the checksum and the reference checksum Compare to ensure that the data is verified for integrity before loading, thereby reducing the risk of failure injection.
By verifying its integrity before data loading, the susceptibility of fault injection attacks is significantly reduced, the recovery ability of fault injection attacks is increased, and through the concept of virtual end-to-end integrity, the attacker must attack different information types multiple times through the concept of virtual end-to-end integrity. , significantly increases the difficulty of attack and reduces the success rate.
Smart Images
Figure CN119227056A_ABST
Abstract
Description
Technical Field
[0001] The present disclosure relates to a storage device. In addition, the present disclosure relates to a corresponding method of operating a storage device. Background Art
[0002] The storage device may include one or more special function registers for temporarily storing control data or configuration data. This storage device may be integrated into an interface unit, for example, which is inserted between the bus and the peripheral device. In this case, the control data or configuration data may be provided to the peripheral device via the special function registers. However, these special function registers may be susceptible to fault injection attacks. Summary of the invention
[0003] According to a first aspect of the present disclosure, a storage device is provided, comprising: one or more special function registers; a preloading stage comprising a first preloading register, wherein the preloading stage is configured to preload data into the first preloading register, and then load the preloaded data into the special function register; wherein the preloading stage is further configured to perform verification of the integrity of the preloaded data, and then load the preloaded data into the special function register.
[0004] In one or more embodiments, the preloading stage further comprises a second preloading register, and the preloading stage is configured to perform the verification by calculating a checksum on the preloaded data and comparing the checksum with a reference checksum stored in the second preloading register.
[0005] In one or more embodiments, the preloading stage further comprises a third preloading register, and the preloading stage is configured to perform the verification by calculating a combined checksum of the preloaded data and the address preloaded in the third preloading register and comparing the combined checksum with the reference checksum stored in the second preloading register.
[0006] In one or more embodiments, the address is an address of a specific one of the special function registers, and the preloading stage is configured to load the preloaded data into the specific one of the special function registers if the combined checksum matches the reference checksum.
[0007] In one or more embodiments, the preload stage is further configured to discard the preloaded data if the address stored in the third preload register does not match any of the addresses of the special function registers.
[0008] In one or more embodiments, the preload stage is configured to discard the preloaded data by loading the preloaded data into an empty register or by clearing the preload register.
[0009] In one or more embodiments, the reference checksum is a pre-computed checksum.
[0010] In one or more embodiments, the pre-calculated checksum is based on an error detection code, specifically a cyclic redundancy check, or based on an XOR-based longitudinal parity check.
[0011] In one or more embodiments, the reference checksum has been pre-calculated by software or firmware.
[0012] In one or more embodiments, the preloading stage is additionally configured to generate an error message upon or after an unsuccessful verification of the integrity of the preloaded data.
[0013] In one or more embodiments, the storage device further includes a default secure destination, wherein the default secure destination is an unassigned address.
[0014] In one or more embodiments, the interface unit comprises a storage device of said kind.
[0015] According to a second aspect of the present disclosure, a method for operating a storage device is conceived, wherein: a preloading stage included in the storage device preloads data into a first preloading register, and then loads the preloaded data into one or more special function registers included in the storage device; the preloading stage performs verification of the integrity of the preloaded data, and then loads the preloaded data into the special function registers.
[0016] In one or more embodiments, the method further includes storing a reference checksum in a second preload register included in the preload stage, wherein the preload stage performs the verification by calculating a checksum on the preloaded data and comparing the checksum with the reference checksum stored in the second preload register.
[0017] In one or more embodiments, the method further includes storing the address of the data in a third preloading register included in the preloading stage, and the preloading stage performs the verification by calculating a first checksum regarding the preloaded data, calculating a second checksum regarding the address stored in the third preloading register, combining the first checksum with the second checksum, and comparing the combined checksum with the reference checksum stored in the second preloading register. BRIEF DESCRIPTION OF THE DRAWINGS
[0018] The embodiments will be described in more detail with reference to the accompanying drawings.
[0019] Figure 1 An illustrative embodiment of a storage device is shown.
[0020] Figure 2 An illustrative embodiment of a method of operating a storage device is shown.
[0021] Figure 3 Another illustrative embodiment of a storage device is shown. DETAILED DESCRIPTION
[0022] As mentioned above, the storage device may include one or more special function registers for temporarily storing control data or configuration data. This storage device may be integrated into an interface unit, for example, which is inserted between the bus and the peripheral device. In this case, the control data or configuration data may be provided to the peripheral device through special function registers. However, these special function registers may be susceptible to fault injection attacks. Unlike security elements that can resist fault injection attacks by applying the concept of end-to-end integrity, most peripheral devices do not have enough resources to apply this concept. In other words, for most peripheral devices, applying the concept of end-to-end integrity is too power-consuming and area-consuming. However, for a very streamlined set of highly sensitive security configurations, protection against fault injection attacks may be required. For these situations, the choice is very limited because security is traditionally applied in an all-or-nothing manner.
[0023] Discussed now are memory devices and corresponding methods for operating memory devices that facilitate resistance to fault injection attacks. The memory devices and corresponding operating methods can be used to advantage in interface units of the kind described above.
[0024] Figure 1An illustrative embodiment of a storage device 100 is shown. The storage device 100 includes one or more special function registers 102. In addition, the storage device 100 includes a preloading stage 104 operably coupled to the special function registers 102. The preloading stage 104 includes a first preloading register (not shown). In addition, the preloading stage 104 is configured to preload data into the first preloading register before loading the preloaded data into the special function registers 102. In addition, the preloading stage 104 is configured to perform a verification of the integrity of the preloaded data before loading the preloaded data into the special function registers 102. By verifying the integrity of the data before loading the data into the special function registers 102, the susceptibility to fault injection can be reduced. More specifically, although the integrity of the special function registers 102 can also be protected, it may still contain faults within several clock cycles. By preloading the data and verifying the integrity of the data before loading the data into the special function registers 102, this risk can be reduced. It should be noted that verifying the integrity of the data refers to verifying whether the data has not been manipulated by a malicious party. The skilled person will appreciate that such verification may be implemented in different ways.
[0025] In one or more embodiments, the preloading stage further includes a second preloading register, and the preloading stage is configured to perform verification by calculating a checksum on the preloaded data and comparing the checksum with a reference checksum stored in the second preloading register. In this way, verification of the integrity of the preloaded data is facilitated. In one or more embodiments, the preloading stage further includes a third preloading register, and the preloading stage is configured to perform verification by calculating a combined checksum on the preloaded data and the address preloaded in the third preloading register and comparing the combined checksum with a reference checksum stored in the second preloading register. By verifying both the data and the address of the special function register into which the data will be loaded, resilience to fault injection attacks can be further increased.
[0026] In one or more embodiments, the address is the address of a specific special function register in the special function registers, and the preloading stage is configured to load the preloaded data into the specific special function register in the special function registers when the combined checksum matches the reference checksum. This produces a practical implementation scheme of verifying the integrity of the data and the address of the special function register into which the data should be loaded. In one or more embodiments, the preloading stage is additionally configured to discard the preloaded data when the address stored in the third preloading register does not match any of the addresses of the special function registers. In this way, the resilience against fault injection attacks can be further increased. In a practical implementation scheme, the preloading stage can be configured to discard the preloaded data by loading the preloaded data into an empty register or by clearing the preloading register.
[0027] In one or more embodiments, the reference checksum is a pre-calculated checksum. In this way, the reference checksum can be easily generated. In addition, in one or more embodiments, the pre-calculated checksum is based on an error detection code (EDC), or an XOR-based longitudinal parity check. More specifically, the EDC can be a cyclic redundancy check (CRC). These checksums are checksums that are particularly suitable for verifying the integrity type of preloaded data. However, the technician should understand that these types only represent examples, and other types of checksums can also be used. In addition, in actual implementation schemes, the reference checksum has been pre-calculated by software or firmware. In one or more embodiments, the preload stage is additionally configured to generate an error message when or after an unsuccessful verification of the integrity of the preloaded data. In this way, the system can be triggered to react to possible fault injection attacks in an appropriate manner.
[0028] Figure 2 An illustrative embodiment of a method 200 for operating a storage device is shown. The method 200 includes the following steps. At 202, a preload stage included in the storage device preloads data into a first preload register, and then loads the preloaded data into one or more special function registers included in the storage device. In addition, at 204, the preload stage performs a verification of the integrity of the preloaded data, and then loads the preloaded data into the special function registers. As mentioned above, by verifying the integrity of the data before loading the data into the special function registers, the susceptibility to fault injection can be reduced.
[0029] The presently disclosed storage device and corresponding operating method facilitate the implementation of a virtual end-to-end integrity concept using a mix of software and hardware. By means of multiple accesses to a set of registers indicating the destination (e.g., address), content, and integrity information, the presently disclosed mechanism ensures that an attacker must successfully attack multiple accesses to inject any fault into the protected special function registers. In other words, the attacker should not apply the correct timing of the attack only once, but should apply it multiple times for different information types (address, content, integrity), where the timing undergoes software modifications, each time with different characteristics. This increases the difficulty of the attack exponentially at negligible software cost, thereby significantly reducing the attacker's likelihood of success.
[0030] Compared to the traditional end-to-end integrity concept, the virtual end-to-end integrity concept can provide a safe and reliable mechanism for enabling a selected subset of special function registers to benefit from the integrity protection benefits of a highly secure product at negligible cost. In addition, the mechanism exponentially increases the difficulty for an attacker, thereby exponentially reducing the success rate of an attacker. In addition, since the integrity verification is performed before the data is loaded into the special function registers, the susceptibility that the destination registers (i.e., the special function registers) may contain faulty data for several clock cycles before the system begins to respond is eliminated.
[0031] More specifically, the virtual end-to-end integrity concept may be based on a system comprising a control, a set of preload stage registers containing data and its destination, and integrity protection (e.g., based on an error detection code) covering the data and, as appropriate, its destination (i.e., the address of the data). Once all preload registers have been loaded and their integrity has been confirmed, the control may ensure that the preloaded data is transferred to the integrity protected special function registers. It should be noted that in addition to the integrity verification performed on the preloaded data, another integrity verification may be performed on the data loaded into the special function registers. Furthermore, it should be noted that the default secure destination may be an unassigned address (i.e., empty, such as 0xFFFF_FFFF). The control may be fully hardware automated, in that once the data has been preloaded and its integrity has been confirmed, the hardware may trigger the loading of the data into the special function registers. Alternatively, the control may be implemented by software access to a dedicated preload register CTRL. Furthermore, once the preload register has been copied to the destination register, the preload register may remain in a reactive state. Furthermore, the preload register may be cleared or overwritten, and then the next secure load may be initiated.
[0032] Figure 3Another illustrative embodiment of a memory device 300 is shown. The device 300 includes a set of standard special function registers 302 that are not protected. In addition, the device 300 includes a set of securely loaded integrity protected special function registers 334. The latter special function registers 334 are protected by EDC check operations 356, 358, 360, 362 that are performed on the data loaded into the registers 336, 338, 340, 342, the addresses 364, 366, 368, 370, and the checksum values 356, 358, 360, 362. In accordance with the present disclosure, the memory device 300 includes a secure preload stage 312 that performs verification of the integrity of the preloaded data and its addresses in addition to the mechanisms based on the EDC check operations 356, 358, 360, 362. For this purpose, the preload stage 312 includes preload registers 314, 316, 318, 320 for preloading addresses, data, reference checksums, and control values, respectively. The reference checksum stored in the preload register 318 is a precalculated checksum. In order to verify the integrity of the preloaded address and data, this reference checksum is compared with a combined checksum 322 calculated from the preloaded address and the preloaded data. If the combined checksum 322 matches the reference checksum, the preloaded data can be loaded into the special function registers 336, 338, 340, 342 with the preloaded address. If the combined checksum does not match the reference checksum, an error message can be generated. In addition, if the preloaded address does not match any one of the addresses of the registers 336, 338, 340, 342, the preloaded data can be discarded, for example, by loading the preloaded data into an empty register 344.
[0033] It should be noted that the above embodiments have been described with reference to different subject matters. In particular, some embodiments may have been described with reference to method-type claims, while other embodiments may have been described with reference to apparatus-type claims. However, a person skilled in the art will conclude from the above that, unless otherwise indicated, any combination of features relating to different subject matters, in addition to any combination of features belonging to one type of subject matter, in particular a combination of features of method-type claims and features of apparatus-type claims, is also considered to be disclosed by this document.
[0034] In addition, it should be noted that the drawings are schematic. In different drawings, similar or identical elements are represented by the same figure mark. In addition, it should be noted that in order to provide a concise description of the illustrative embodiments, the implementation details that belong to the customary practices of technicians may not be described. It should be understood that in the development of any such implementation scheme, as in any engineering or design project, a large number of implementation scheme-specific decisions must be made to achieve the specific goals of the developer, such as complying with system-related and business-related constraints, which may vary depending on the implementation scheme. In addition, it should be understood that such development work may be complex and time-consuming, but it is just a routine task of design, manufacture and production for ordinary technicians who benefit from the present disclosure.
[0035] Finally, it should be noted that a person skilled in the art should be able to design many alternative embodiments without departing from the scope of the appended claims. In the claims, any reference numerals placed between parentheses should not be interpreted as limiting the claims. The words "comprise(s)" or "comprising" do not exclude the presence of elements or steps other than those listed in the claims. The words "a" or "an" before an element do not exclude the presence of multiple such elements. The measures recited in the claims may be implemented by means of hardware comprising several unique elements and / or by means of a processor that is appropriately programmed. In a device claim that lists several components, several of these components may be embodied by one and the same hardware. The mere fact that certain measures are recited in mutually different dependent claims does not indicate that a combination of these measures cannot be used to advantage.
[0036] Reference numerals list
[0037] 100 Storage Device
[0038] 102 Preload Level
[0039] 104 Special Function Registers
[0040] 200 Method of operating a storage device
[0041] 202 The preloading stage included in the storage device preloads data into a first preloading register, and then loads the preloaded data into one or more special function registers included in the storage device.
[0042] 204 The preload stage performs a verification of the integrity of the preloaded data before loading the preloaded data into the special function registers
[0043] 300 Storage Devices
[0044] 302 Standard Special Function Registers
[0045] 304 Standard CFG 0
[0046] 306 Standard CFG 1
[0047] 308 Standard CFG…
[0048] 310 Standard CFG M
[0049] 312 Security preload level
[0050] 314 Preload address
[0051] 316 Preload Data
[0052] 318 preload EDC (data + address)
[0053] 320 Preload CTRL
[0054] 322EDC (data, address)
[0055] 324 Comparator
[0056] 326 AND Gate
[0057] 328 Multiplexer
[0058] 330 Multiplexer
[0059] 332 Multiplexer
[0060] 334 Secure Load Integrity Protected Registers 336 Secure CFG 0
[0061] 338 Safety CFG 1
[0062] 340 Security CFG…
[0063] 342 Security CFG N344 Empty register 346 EDC (data 0 + address 0)
[0064] 348EDC (data 1+address 1)
[0065] 350EDC (data...+address...)
[0066] 352EDC (data N + address N)
[0067] 354 Empty register
[0068] 356 EDC Check
[0069] 358 EDC Check
[0070] 360 EDC Verification
[0071] 362 EDC check 364 address 0
[0072] 366 Address 1
[0073] 368 Address…
[0074] 370 addresses N372 multiplexer.
Claims
1. A storage device, characterized in that: include: One or more special function registers; a preloading stage comprising a first preloading register, wherein the preloading stage is configured to preload data into the first preloading register and thereafter load the preloaded data into the special function register; Wherein the preloading stage is further configured to perform a verification of the integrity of the preloaded data before loading the preloaded data into the special function register.
2. The device according to claim 1, characterized in that The preloading stage further comprises a second preloading register, and wherein the preloading stage is configured to perform the verification by calculating a checksum on the preloaded data and comparing the checksum with a reference checksum stored in the second preloading register.
3. The device according to claim 2, characterized in that The preloading stage further comprises a third preloading register, and wherein the preloading stage is configured to perform the verification by calculating a combined checksum on the preloaded data and the address preloaded in the third preloading register and comparing the combined checksum with the reference checksum stored in the second preloading register.
4. The device according to claim 3, characterized in that The address is an address of a specific one of the special function registers, and wherein the preload stage is configured to load the preloaded data into the specific one of the special function registers if the combined checksum matches the reference checksum.
5. The device according to claim 4, characterized in that The preloading stage is additionally configured to discard the preloaded data if the address stored in the third preloading register does not match any of the addresses of the special function registers.
6. The device according to claim 5, characterized in that The preload stage is configured to discard the preloaded data by loading the preloaded data into an empty register or by clearing the preload register.
7. The device according to any one of claims 2 to 6, characterized in that The reference checksum is a pre-calculated checksum.
8. The device according to claim 7, characterized in that The pre-calculated checksum is based on an error detection code, specifically a cyclic redundancy check, or based on an XOR-based longitudinal parity check.
9. An interface unit, characterized in that: Comprising a storage device as claimed in any preceding claim.
10. A method for operating a storage device, characterized in that: The preloading stage included in the storage device preloads data into a first preloading register, and thereafter loads the preloaded data into one or more special function registers included in the storage device; The preload stage performs a verification of the integrity of the preloaded data before loading the preloaded data into the special function registers.