Scanning protection method, system and device for memory

Abstract

The invention relates to the technical field of memory protection, in particular to a scanning protection method, system and device for a memory, and the method comprises the steps: storing a plurality of adjacent address information in response to a scanning operation of a storage module; performing difference value calculation on every two adjacent address information to obtain difference value information; judging whether a plurality of adjacent pieces of difference information are consistent to obtain output logic information, if so, outputting the first logic information, and if not, outputting the second logic information; based on the first logic information and the second logic information, performing one addition or zero returning on a result to obtain scanning rule information; and comparing the scanning rule information with the preset maximum linear reading times of the memory to obtain a comparison result, and judging whether an attack mark instruction of a protection mechanism is triggered or not according to the comparison result, so that the interference of a malicious circuit on a memory circuit is reduced, and the security of the memory circuit is improved.

Description

Technical Field

[0001] The present application relates to the field of memory protection technology, and in particular to a memory scanning protection method, system and device. Background Art

[0002] With the rapid development of the digital economy, the security issues of modern electronic information systems have become increasingly prominent. Chips, as the underlying core, have always played an irreplaceable role. Therefore, in some specific fields, such as financial IC cards, automotive chips, systems, etc., related chips are subject to huge potential attack risks. As the carrier of chip programs and key information, the security design of memory is an important part of chip security. At present, the common design is usually to increase the complexity of its encryption algorithm to increase security, but this method is limited and passive.

[0003] During the life cycle of a chip, its design, manufacturing, and application require the participation of multiple third-party entities. For example, the assistance of third-party design tools and design manufacturers may bring some unpredictable risks, such as the implantation of hardware Trojans by third-party IP cores and foundries, or even the chip user deciphering the burning interface and scanning the chip's internal memory through implanted and external malicious circuits to obtain its complete program, thereby decompiling and analyzing chip functions or other important information. Therefore, it is necessary to actively detect and protect the memory from attacks.

[0004] Currently, chips mainly include highly controllable circuits and general circuits, both of which can read and write to the memory. Highly controllable circuits are self-designed modules, and the possibility of malicious circuits is small; but if the general module is a standard module, the attacker's attack methods are diverse and feasible, such as multiple simulation tests and attacks, statistics, analysis, and even reverse engineering to decipher the communication and burning protocols, and then scan the memory. If it is a module designed by other third parties, since the internal details are not disclosed, the user cannot determine whether it contains unsafe circuits, so the security of the memory cannot be guaranteed. The above problems need to be solved. Summary of the invention

[0005] In order to reduce the interference of malicious circuits on memory circuits and improve the security of memory circuits, the present application provides a memory scanning protection method, system and device, which adopt the following technical solutions:

[0006] In a first aspect, the present application provides a scanning protection method for a memory, comprising:

[0007] In response to the scanning operation of the storage module, a plurality of adjacent address information is saved;

[0008] Calculating the difference between the adjacent address information in pairs to obtain the difference information;

[0009] Determine whether the adjacent difference information is consistent, and obtain output logic information, wherein if they are consistent, output first logic information, and if they are inconsistent, output second logic information;

[0010] Add one or reset the result based on the first logic information and the second logic information to obtain scanning regularity information;

[0011] The scanning rule information is compared with the preset maximum number of linear reads of the memory to obtain a comparison result, and it is determined whether to trigger an attack flag instruction of a protection mechanism according to the comparison result.

[0012] Preferably, when an attack flag instruction is obtained, reset information is obtained, and a reset operation is performed on the pseudo-random number generator according to the reset information. When an attack flag instruction is obtained, pseudo-sequence information is obtained according to the pseudo-random generator, and a feedback operation is performed according to the pseudo-sequence information.

[0013] Preferably, when an attack flag instruction is obtained, the count value of the attack flag instruction is compared with a preset attack maximum value to obtain an attack result, and it is determined whether to execute a data destruction operation based on the attack result.

[0014] In a second aspect, the present application provides a scanning protection system for a memory, comprising a processor module, a read-write control module, an encryption module, a storage module, a decryption module and several general modules, and also comprising a detection module and a protection module, wherein the detection module comprises: an address register submodule, for saving several adjacent address information in response to a scanning operation of the storage module;

[0015] A calculation submodule, used for performing difference calculation on the adjacent address information in pairs to obtain difference information;

[0016] A first comparison submodule is used to determine whether the difference information of a plurality of adjacent ones is consistent, and obtain output logic information, wherein if they are consistent, the first logic information is output, and if they are inconsistent, the second logic information is output;

[0017] A counting register submodule, used for adding one or returning a result to zero based on the first logic information and the second logic information to obtain scanning regularity information;

[0018] The maximum value register submodule is used to store the maximum number of linear reads;

[0019] A second comparison submodule is used to compare the scanning rule information with the preset maximum number of linear reads of the memory to obtain a comparison result, and determine whether to trigger an attack flag instruction of a protection mechanism according to the comparison result;

[0020] The protection module is used to obtain the attack flag instruction and perform false feedback operation and data destruction operation according to the attack flag instruction.

[0021] Preferably, the address register submodule includes three address registers, which are respectively used to store the first address information, the second address information and the third address information, and the calculation submodule includes two subtractors, one of which is used to calculate the first address information and the second address information, and the other subtractor is used to calculate the second address information and the third address information to obtain two difference information acting on the first comparison submodule.

[0022] Preferably, the address register submodule includes two address registers, one of which is used to store the first address information and the second address information of the first clock cycle, and the other address register is used to store the second address information and the third address information of the second clock cycle. The calculation submodule includes a subtractor and two difference registers, and the subtractor is used to calculate the address information of the first clock cycle and the second clock cycle respectively, and obtain two difference information acting on the first comparison submodule and store them in the difference registers respectively.

[0023] Preferably, the protection module includes: a false feedback submodule, which is used to obtain reset information when the attack flag instruction of the detection module is obtained, and perform a reset operation on the pseudo-random number generator according to the reset information, and when the attack flag instruction of the detection module is obtained, obtain pseudo-sequence information according to the pseudo-random generator, and perform a feedback operation according to the pseudo-sequence information.

[0024] Preferably,

[0025] The protection module also includes:

[0026] The data destruction submodule is used to compare the count value of the attack flag instruction with the preset attack maximum value when the attack flag instruction is obtained, obtain the attack result, and determine whether to execute the data destruction operation according to the attack result.

[0027] Preferably, the address information includes ciphertext address information or plaintext address information.

[0028] Preferably, the second comparison submodule obtains an attack flag instruction when the scanning regularity information is greater than or equal to the maximum number of linear reads.

[0029] In a third aspect, the present application provides a scanning protection device for a memory, including the scanning protection system for the memory as described above.

[0030] In summary, compared with the prior art, the technical solution provided by this application has at least the following beneficial effects:

[0031] The present application comprises a memory circuit system consisting of a processor module, a read-write control module, an encryption module, a storage module, a decryption module and several general modules, and then connected to the read-write control module through a detection module to obtain address information of the read-write control module, monitor the address information, obtain an attack flag instruction when the address jump conforms to the scanning rule, and send the attack flag instruction to the connected protection module. When the protection module detects the attack flag instruction, it executes false feedback and data destruction operations, thereby protecting the program or data of the memory, reducing the interference of malicious circuits on the memory circuit, and improving the security of the memory circuit. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] Figure 1 This is a flow chart of a scanning protection method for a memory described in an embodiment of the present application.

[0033] Figure 2 It is a module diagram of a scanning protection system for a memory described in an embodiment of the present application.

[0034] Figure 3 It is a schematic diagram of the first module of the detection module described in the embodiment of the present application.

[0035] Figure 4 It is a schematic diagram of the second module of the detection module described in the embodiment of the present application.

[0036] Figure 5 It is a module schematic diagram of the false feedback submodule described in the embodiment of the present application.

[0037] Figure 6 It is a schematic diagram of the reset data processing flow of the false feedback submodule described in the embodiment of the present application.

[0038] Figure 7 It is a module schematic diagram of the data destruction submodule described in the embodiment of the present application.

[0039] Figure 8 It is a schematic diagram of the data processing flow of the data destruction submodule described in the embodiment of the present application.

[0040] Description of reference numerals:

[0041] 1. Processor module; 2. Read-write control module; 3. Encryption module; 4. Storage module; 5. Decryption module; 6. General module; 7. Detection module; 71. Address register submodule; 72. Calculation submodule; 73. First comparison submodule; 74. Count register submodule; 75. Maximum value register submodule; 76. Second comparison submodule; 8. Protection module; 81. False feedback submodule; 82. Data destruction submodule. DETAILED DESCRIPTION

[0042] The following combination Figure 1-Figure 6 The present application is described in further detail. The terms used in the embodiments of the present application are only for the purpose of describing specific embodiments and are not intended to be limiting.

[0043] Reference Figure 1 , a scanning protection method of a memory involved in the present application includes:

[0044] Step S1: In response to a scanning operation of the storage module, save a number of adjacent address information;

[0045] Step S2: performing difference calculation on the adjacent address information in pairs to obtain difference information;

[0046] Step S3: determining whether the adjacent difference information is consistent, and obtaining output logic information, wherein if they are consistent, outputting first logic information, and if they are inconsistent, outputting second logic information;

[0047] Step S4: adding one or returning to zero the result based on the first logic information and the second logic information to obtain scanning regularity information;

[0048] Step S5: Compare the scanning rule information with the preset maximum number of linear reads of the memory to obtain a comparison result, and determine whether to trigger the attack flag instruction of the protection mechanism according to the comparison result.

[0049] Specifically, the detection module is connected to the read-write control module to obtain the address information of the read-write control module, and the address information is monitored. When the address jump conforms to the scanning rule, the attack flag instruction is obtained, and the attack flag instruction is sent to the connected protection module. When the protection module detects the attack flag instruction, it executes false feedback and data destruction operations, thereby protecting the program or data of the memory, reducing the interference of malicious circuits on the memory circuit, and improving the security of the memory circuit.

[0050] As one of the implementation modes, when an attack flag instruction is obtained, reset information is obtained, and a reset operation is performed on a pseudo-random number generator according to the reset information. When an attack flag instruction is obtained, pseudo-sequence information is obtained according to the pseudo-random generator, and a feedback operation is performed according to the pseudo-sequence information.

[0051] As one implementation method, when an attack flag instruction is obtained, the count value of the attack flag instruction is compared with a preset attack maximum value to obtain an attack result, and whether to execute a data destruction operation is determined based on the attack result.

[0052] Reference Figure 2The scanning protection system of a memory involved in the present application specifically includes a processor module, a read-write control module, an encryption module, a storage module, a decryption module and several general modules, and also includes:

[0053] The detection module is used to obtain the address information of the read-write control module, monitor the address information, and obtain an attack flag instruction when the address jump conforms to the scanning rule;

[0054] The protection module is used to execute false feedback and data destruction operations in the case of obtaining the attack flag instruction of the detection module.

[0055] Specifically, the present application is composed of a processor module, a read-write control module, an encryption module, a storage module, a decryption module and several general modules or special modules to form an integrated circuit system. The processor module is the core of the system, responsible for executing computing tasks and controlling the entire data flow, receiving instructions and data from other modules, such as receiving data from general and special modules, and performing corresponding operations according to the data or instructions. The read-write control module is responsible for managing the reading and writing operations of data. It receives read-write requests sent by the processor module, or receives encrypted data from the encryption module, and communicates with the storage module to interact with the storage module. The encryption module protects the security of the data and usually encrypts the data before it enters the storage module. Receive data sent by the processor, read-write control module or general and special modules, encrypt it, and then transmit it to the storage module. The storage module is the main storage location of the data, receives encrypted or unencrypted data, writes it to a storage device, such as a hard disk, a solid-state drive, etc., or reads data from a storage device and transmits it to the decryption module to send it to a general and special module. The decryption module decrypts the data after it is read from the storage module, receives the encrypted data transmitted from the storage module, and transmits the plaintext data to the processor module or the general and special modules after decryption. The general and special modules include IP core modules, communication IO modules, burning modules and other functional modules. Among them, IP cores such as public security algorithm calculation modules, which have been designed by third-party design companies, can be directly purchased for integration; such as self-designed modules for a certain application scenario. For public standard protocols, communication IO modules can also directly purchase third-party general modules, but for customized protocols, they need to be redesigned, which are special modules. For third-party general modules, the internal details are not public, and there may be hardware Trojans; for conventional standard modules, there are many ways to crack them.

[0056] The present application also includes a detection module and a protection module. During the operation of the memory circuit system, the present application is connected to the read-write control module through the detection module, obtains the address information of the read-write control module, monitors the address information, obtains the attack flag instruction when the address jump conforms to the scanning rule, sends the attack flag instruction to the connected protection module, and executes false feedback and data destruction operations when the protection module detects the attack flag instruction, thereby protecting the program or data of the memory, reducing the interference of malicious circuits on the memory circuit, and improving the security of the memory circuit.

[0057] As one implementation method, the detection module includes:

[0058] The address register submodule is used to store several adjacent sub-address information;

[0059] A calculation submodule is used to calculate adjacent address information to obtain a number of difference information;

[0060] A first comparison submodule, used for comparing difference information to obtain output logic information;

[0061] The counting register submodule is used to add one or reset to zero according to the output logic information to obtain the scanning regularity information;

[0062] The maximum value register submodule is used to store the maximum number of linear reads;

[0063] The second comparison submodule is used to compare the scanning regularity information with the maximum number of linear reads to obtain an attack flag instruction for triggering a protection mechanism.

[0064] Specifically, refer to Figure 3 The address register submodule of the embodiment of the present application is connected to the calculation submodule, the calculation submodule is connected to the first comparison submodule, the first comparison submodule is connected to the counting register submodule, the counting register submodule and the maximum value register submodule are both connected to the second comparison submodule, and finally the attack flag instruction is output and sent to the protection module. The address register submodule obtains the address information for storage, Figure 3 The A signal is the address information, which specifically includes the ciphertext address information and the plaintext address information. According to the connection relationship between the address register submodule and the calculation submodule, the address information is sent to the corresponding subtractor in the calculation submodule for calculation, and the difference information obtained is sent to the first comparison submodule for comparison to obtain the output logic information. The output logic information is usually logic 1 or logic 0. The counting register submodule performs a +1 operation when obtaining logic 1, otherwise it returns to zero. After each execution, a scanning rule information is obtained. The second comparison submodule obtains the maximum number of linear reads in the maximum value register submodule, and compares the scanning rule information with the maximum number of linear reads. If the conditions are met, the attack flag instruction is obtained, that is, Figure 3 The B signal in the protection module starts.

[0065] As one implementation manner, the address information includes ciphertext address information or plaintext address information.

[0066] Specifically, the present application monitors the ciphertext address of the read memory and the plaintext address of the read memory through a detection module. When the address jump conforms to the scanning rule, the protection mechanism is triggered, and the detection module processes the ciphertext address information and the plaintext address information. Plaintext address information refers to the real physical address or logical address of the data in the memory, that is, the original address that has not been encrypted or obfuscated. In the system, the processor and other components use the plaintext address to directly access the data or instructions in the memory. Ciphertext address information refers to the address after encryption. In a system with high security requirements, the data will be encrypted and stored in the memory. At this time, the corresponding storage address also needs to be encrypted to protect the security of the data. The ciphertext address is different from the plaintext address. It is an address generated by a certain encryption algorithm or conversion algorithm.

[0067] As one implementation method, the address register submodule includes three address registers, which are respectively used to store first address information, second address information and third address information. The calculation submodule includes two subtractors, one of which is used to calculate the first address information and the second address information, and the other subtractor is used to calculate the second address information and the third address information to obtain two difference information acting on the first comparison submodule.

[0068] Specifically, refer to Figure 3 The embodiment of the present application designs two groups of identical detection circuit modules, one group monitors the plaintext address to prevent malicious programs and circuits from scanning it, and the other group monitors the ciphertext address to prevent malicious circuits and reverse engineering-assisted scanning.

[0069] The detection process is to first use three groups of address registers, namely, the first address register ADDR1, the second address register ADDR2, and the third address register ADDR3, to respectively store the plaintext address information or the ciphertext address information of the memory read three times adjacently. The first address register and the second address register are connected to the input end of the first subtractor, and the second address register and the third address register are connected to the input end of the second subtractor, so that the subtractor calculates ADDR1-ADDR2 and ADDR2-ADDR3 respectively.

[0070] After the first comparison submodule obtains the difference information of ADDR1-ADDR2 and ADDR2-ADDR3, it performs a difference comparison. The comparator determines whether the above two differences are consistent. If they are consistent, it means that ADDR1, ADDR2, and ADDR3 meet the one-time scanning rule, and outputs logic 1 or logic 0, otherwise it outputs logic 0 or logic 1. Based on the output result of the comparator, the count value register performs a +1 operation or a return to 0 operation. At this time, the count value CNT means that the plaintext address or the ciphertext address continuously meets the CNT scanning rules.

[0071] As one implementation manner, the second comparison submodule obtains an attack flag instruction when the scanning regularity information is greater than or equal to the maximum number of linear reads.

[0072] Specifically, the embodiment of the present application uses the maximum value register submodule to make it clear that the number of linear reads of the memory in normal operation of the chip will not exceed MAX times, and then writes the data MAX into the maximum value register in the chip POR stage, or uses a hardware circuit to solidify the data MAX. Finally, the second comparison submodule compares CNT and MAX. When CNT ≥ MAX, it means that the chip is under attack, and an attack flag information is generated, thereby triggering the chip protection mechanism.

[0073] As one of the implementation modes, the address register submodule includes two address registers, one of which is used to store the first address information and the second address information of the first clock cycle, and the other address register is used to store the second address information and the third address information of the second clock cycle. The calculation submodule includes a subtractor and two difference registers, and the subtractor is used to calculate the address information of the first clock cycle and the second clock cycle respectively, and obtain two difference information acting on the first comparison submodule and store them in the difference registers respectively.

[0074] Specifically, refer to Figure 4 , the circuit of the detection module can also be implemented in the manner of the embodiment of the present application. The previous embodiment and the present embodiment implement the same function. The previous embodiment simultaneously calculates the difference between ADDR1 and ADDR2 and the difference between ADDR2 and ADDR3. If they are consistent, it means that they comply with the one-time scanning rule. The embodiment of the present application first calculates the difference between ADDR1 and ADDR2, and saves it in Difference 1; in the next clock cycle, the value of ADDR2 overwrites ADDR1, and the value of ADDR3 overwrites ADDR2, and at the same time Difference 1 is transmitted to Difference 2, and the new Difference 1 is equal to ADDR2-ADDR3; if Difference 1 and Difference 2 are consistent, it also means that they comply with the one-time scanning rule.

[0075] As one implementation mode, the protection module includes:

[0076] The false feedback submodule is used to obtain reset information when the attack flag instruction of the detection module is obtained, and perform a reset operation on the pseudo-random number generator according to the reset information; and to obtain pseudo-sequence information according to the pseudo-random generator when the attack flag instruction of the detection module is obtained, and perform a feedback operation according to the pseudo-sequence information.

[0077] Specifically, refer to Figure 5 and Figure 6 , the embodiment of the present application takes into account that the emergency measure against the attack is usually to reset the chip. For experienced attackers, the interference or misleading of the reset is not enough to perform protection, and the attack direction can often be quickly adjusted. Therefore, the embodiment of the present application designs a scanning attack response module with multi-dimensional interference and misleading analysis, so that a surface behavior is first made, which is wrong, but meets the attacker's expected phenomenon; then when the attacker performs multiple scanning attacks on the chip, the data sequence fed back by the chip remains unchanged, which is consistent with the phenomenon of normal scanning of the memory, leading to some wrong directions, such as: the scanning attack is successful.

[0078] The attack flag instruction is sent to the false feedback module to start the pseudo-random number generator logic, and the pseudo-random sequence replaces the memory ciphertext sequence, that is, replaces Figure 5 The D signal in is output; in order to ensure the consistency of the pseudo-random sequence during multiple scanning attacks without power failure, it is necessary to initialize the pseudo-random number generator at the end of the scanning attack, and its initial value is the reset or set value.

[0079] The false feedback submodule also sets a circuit for judging the end of the scanning attack, that is, the generation process of the reset or set signal is as follows: the attack information is sent to the false feedback module, and the main clock counts the time interval between the two memory read signals, that is, the main clock cycle between the two memory read signals is counted, specifically, the acquisition Figure 5 The C signal, i.e. the main clock and the memory read signal; then the count value generates an end reference value through a shift operation, and the result is stored in the reference value register; when the count value is equal to the end reference value, it is considered that the scan attack is over, and a reset or set signal is generated to initialize the pseudo-random number generator.

[0080] As one implementation mode, the protection module further includes: a data destruction submodule, which is used to execute a data destruction operation when an attack flag instruction of the detection module is obtained.

[0081] Specifically, refer to Figure 7 and Figure 8 ,The work flow of the data destruction module is as follows: power on the chip and read the attack count value, i.e. Figure 7 The E signal in the attack; the maximum value generated = base number + random number of finite length, the base number determines the minimum value of the interval to which the maximum value belongs, and the random number improves the interference. Figure 7 The F signal is the base and random number; the count value is compared with the maximum value. When the count value is less than the maximum value, the chip is intact; when the count value is greater than or equal to the maximum value, the memory erase signal is triggered to damage the chip. The scan attack signal is triggered, and the attack count value is +1; the count value is compared with the maximum value. When the count value is less than the maximum value, the chip is intact, and the new attack count value is recorded in the memory, that is, output Figure 7 G signal; when the count value is greater than or equal to the maximum value, the memory erase signal is triggered, that is, Figure 7 The H signal will damage the chip.

[0082] Since the maximum attack value generated each time the chip is powered on is different, the time node of chip destruction is not unique, which can effectively hide the damage condition of the chip and mislead the attacker.

[0083] An embodiment of the present application provides a scanning protection device for a memory, including the scanning protection system for the memory as described above.

[0084] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process of the above-described device and product can refer to the corresponding process in the aforementioned method embodiment, and will not be repeated here.

[0085] In several embodiments provided in this application, it should be understood that the disclosed methods, systems, devices and program products may be implemented in other ways.

[0086] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0087] As described above, the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A scanning protection method for a memory, characterized in that: include: In response to the scanning operation of the storage module, a plurality of adjacent address information is saved; Calculating the difference between the adjacent address information in pairs to obtain the difference information; Determine whether the adjacent difference information is consistent, and obtain output logic information, wherein if they are consistent, output first logic information, and if they are inconsistent, output second logic information; Add one or reset the result based on the first logic information and the second logic information to obtain scanning regularity information; The scanning rule information is compared with the preset maximum number of linear reads of the memory to obtain a comparison result, and it is determined whether to trigger an attack flag instruction of a protection mechanism according to the comparison result.

2. The scanning protection method of the memory according to claim 1, characterized in that: When an attack flag instruction is obtained, reset information is obtained, and a reset operation is performed on the pseudo-random number generator according to the reset information. When an attack flag instruction is obtained, pseudo-sequence information is obtained according to the pseudo-random number generator, and a feedback operation is performed according to the pseudo-sequence information.

3. The scanning protection method of the memory according to claim 2, characterized in that: When an attack flag instruction is obtained, the count value of the attack flag instruction is compared with a preset attack maximum value to obtain an attack result, and whether to execute a data destruction operation is determined based on the attack result.

4. A scanning protection system for a memory, comprising a processor module, a read-write control module, an encryption module, a storage module, a decryption module and several general modules, characterized in that: It also includes a detection module and a protection module. The detection module includes: The address register submodule is used to save a number of adjacent address information in response to the scanning operation of the storage module; A calculation submodule, used for performing difference calculation on the adjacent address information in pairs to obtain difference information; A first comparison submodule is used to determine whether the difference information of a plurality of adjacent ones is consistent, and obtain output logic information, wherein if they are consistent, the first logic information is output, and if they are inconsistent, the second logic information is output; A counting register submodule, used for adding one or returning a result to zero based on the first logic information and the second logic information to obtain scanning regularity information; The maximum value register submodule is used to store the maximum number of linear reads; A second comparison submodule is used to compare the scanning rule information with the preset maximum number of linear reads of the memory to obtain a comparison result, and determine whether to trigger an attack flag instruction of a protection mechanism according to the comparison result; The protection module is used to obtain the attack flag instruction and perform false feedback operation and data destruction operation according to the attack flag instruction.

5. The scanning protection system for storage according to claim 4, characterized in that: The address register submodule includes three address registers, which are respectively used to store first address information, second address information and third address information. The calculation submodule includes two subtractors, one of which is used to calculate the first address information and the second address information, and the other subtractor is used to calculate the second address information and the third address information to obtain two difference information acting on the first comparison submodule.

6. The scanning protection system for storage according to claim 4, characterized in that: The address register submodule includes two address registers, one of which is used to store the first address information and the second address information of the first clock cycle, and the other address register is used to store the second address information and the third address information of the second clock cycle. The calculation submodule includes a subtractor and two difference registers. The subtractor is used to calculate the address information of the first clock cycle and the second clock cycle respectively, and obtain two difference information acting on the first comparison submodule and store them in the difference registers respectively.

7. The scanning protection system for storage according to claim 4, characterized in that: The protection module comprises: The false feedback submodule is used to obtain reset information when the attack flag instruction of the detection module is obtained, and perform a reset operation on the pseudo-random number generator according to the reset information; and to obtain pseudo-sequence information according to the pseudo-random generator when the attack flag instruction of the detection module is obtained, and perform a feedback operation according to the pseudo-sequence information.

8. The scanning protection system for storage according to claim 4, characterized in that: The protection module also includes: The data destruction submodule is used to compare the count value of the attack flag instruction with the preset attack maximum value when the attack flag instruction is obtained, obtain the attack result, and determine whether to execute the data destruction operation according to the attack result.

9. The scanning protection system for storage according to claim 4, characterized in that: The address information includes ciphertext address information or plaintext address information.

10. A scanning protection device for a memory, characterized in that: A scanning protection system for a memory comprising any one of claims 4-9.

Images