Safety protection device and method for hardware debugging interface

Abstract

The invention discloses a safety protection device and method for a hardware debugging interface, and the device comprises a controller chip, the controller chip is provided with a debugging interface, and a clock signal or a data signal of the debugging interface is provided with a plurality of layers of PCB inner layer snakelike winding wires, so that the transmission length of the clock signal and the transmission length of the data signal have a large deviation. And the synchronous transmission requirement of the transmission line is not met. By changing the transmission characteristics of the synchronous signals on the PCB of the product end, the traditional interface hiding is changed into signal characteristic hiding, so that an attacker cannot completely master the signal characteristics of a transmission line even if the attacker can find the debugging interface, and the debugging interface cannot be normally taken over and used.

Description

Technical Field

[0001] The present invention relates to the technical field of hardware debugging, and in particular to a safety protection device and method for a hardware debugging interface. Background Art

[0002] GB / T 40861-2021 "General Technical Requirements for Automotive Information Security" clearly states that on-board electronic devices should pay attention to the security protection of hardware interfaces, remove and prohibit unnecessary debugging interfaces. Prevent attackers from directly accessing the hardware debugging interface and illegally debugging ECUs and chips. GB / T 40855-2021 "Technical Requirements and Test Methods for Information Security of Electric Vehicle Remote Service and Management Systems" also clearly requires that the debugging interface should be disabled or security access control should be set. The traditional processing method is not to bring out the debugging interface JTAG (Joint Test Action Group) or SWD (Serial Wire Debug), or to add a switch circuit in the middle of the debugging interface line, and to determine whether the access is legal by conditional judgment to decide whether to turn on the switch, so as to allow programmers to legally debug normal programs, or to avoid illegal debugging interface takeover. Although the former solution makes it difficult for attackers to access and debug chips, it is also inconvenient for developers to access and debug chips, which hinders after-sales service and technical analysis. As a feasible solution, the latter can achieve a certain degree of protection by adding additional drive circuits and switches in the middle of the debug line, but there are also certain problems. For example, the product has increased the cost of each unit due to the addition of additional circuit components and switches. At the same time, if the attacker finds the location of the control circuit and switch, he can also bypass the control switch and directly access the debug interface by flying wires, so there are also certain disadvantages. Summary of the invention

[0003] The purpose of the present invention is to provide a security protection device and method for a hardware debugging interface, so as to solve the technical problems required by the current automobile information security standards to pay attention to the security protection of the hardware interface, remove and prohibit unnecessary debugging interfaces, or set security access control, while being able to facilitate the use of the debugging interface by legally authorized R&D and after-sales personnel.

[0004] The present invention is implemented by adopting the following technical scheme: a safety protection device for a hardware debugging interface, comprising a controller chip, on which a debugging interface is arranged, and a multi-layer PCB inner layer serpentine winding is arranged on the clock signal or data signal of the debugging interface, so that a large deviation occurs in the transmission length of the clock signal and the data signal, and the synchronous transmission requirement of the transmission line is not met.

[0005] Furthermore, the controller chip includes one or more of a central processing unit, a microcontroller unit, a programmable gate array and a digital signal processor.

[0006] Furthermore, at least four layers of PCB inner layer serpentine winding are performed on the clock signal or data signal of the debugging interface.

[0007] Furthermore, it also includes a debugging adapter board, on which a debugging connector is provided, and the debugging connector is connected to the debugging interface to achieve electrical equal-length synchronous transmission of the transmission line.

[0008] Furthermore, for signals that are serpentine-wound on the controller chip, they are no longer serpentine-wound on the debugging adapter board; for signals that are not serpentine-wound on the controller chip, serpentine-wound on the debugging adapter board.

[0009] A security protection method for a hardware debugging interface utilizes the signal integrity theory of transmission lines to modulate the clock signal or data signal of the debugging interface of a product-side controller chip by using strip lines or serpentine windings to make the two signals unequal in length. This makes it impossible for the two signals at a product test point to achieve synchronous reception and synchronous action when the signal transmission speed is constant, thereby preventing attackers from obtaining the correct debugging interface data and effectively taking over the debugging interface, thereby achieving the effect of hiding the debugging interface.

[0010] Further, the following steps are included: S11: The clock signal of the debugging interface of the product-side controller chip is serpentine-wound on at least four layers of the PCB inner layer, so that the transmission length of the clock signal and the data signal has a large deviation and does not meet the synchronous transmission requirements of the transmission line; S12: According to the PCB data of the debugging interface of the controller chip on the product side, a debugging adapter board is set, and the transmission line characteristic deviation on the product is compensated by the debugging adapter board to realize the electrical equal-length synchronous transmission of the transmission line.

[0011] Furthermore, step S12 is specifically as follows: The clock signal that is snake-wound on the controller chip is no longer snaked on the debug adapter board; For data signals that are not routed on the controller chip, serpentine routing is performed on the debugging adapter board.

[0012] Further, the following steps are included: S21: The data signal of the debugging interface of the product-side controller chip is serpentine-wound on at least four inner layers of the PCB, so that the transmission length of the data signal and the clock signal has a large deviation and does not meet the synchronous transmission requirements of the transmission line; S22: According to the PCB data of the debugging interface of the controller chip on the product side, a debugging adapter board is set, and the transmission line characteristic deviation on the product is compensated by the debugging adapter board to realize the electrical equal-length synchronous transmission of the transmission line.

[0013] Furthermore, step S22 is specifically as follows: For the data signals that are serpentine-wound on the controller chip, they are no longer serpentine-wound on the debugging adapter board; For clock signals that are not routed on the controller chip, serpentine routing is performed on the debugging adapter board.

[0014] The beneficial effect of the present invention is that the present invention changes the transmission characteristics of the synchronous signal on the PCB of the product end, so that the traditional interface hiding is changed to signal feature hiding, so that even if the attacker can find the debugging interface, he cannot fully grasp the signal characteristics of the transmission line, and thus cannot normally take over and use the debugging interface. As a developer, when developing a product, you only need to make a debugging adapter board to effectively compensate for the mismatch of the transmission line on the product end, so as to debug and track normally. Since the debugging adapter board is only used by developers and is not a standard product, there is no need to add additional hardware costs to the product. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the structures shown in these drawings without paying creative work.

[0016] Figure 1 It is the transmission line model diagram; Figure 2 This is a schematic diagram of the product-side controller chip structure; Figure 3 This is a schematic diagram of the debugging adapter board structure; Figure 4 is a cross-sectional view of a microstrip transmission line; Figure 5 is a cross-sectional view of a stripline transmission line; Figure 6 This is the schematic diagram of the safety protection device; In the figure, 1-signal path conductor, 2-dielectric, 3-return path conductor, 4-microstrip transmission line, 5-microstrip dielectric, 6-microstrip reference plane, 7-first stripline reference plane, 8-stripline dielectric, 9-stripline transmission line, 10-second stripline reference plane. DETAILED DESCRIPTION

[0017] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Generally, the components of the embodiments of the present invention described and shown in the drawings here can be arranged and designed in various different configurations.

[0018] It should be noted that similar reference numerals and letters denote similar items in the following drawings, and therefore, once an item is defined in one drawing, further definition and explanation thereof is not required in subsequent drawings.

[0019] Some embodiments of the present invention are described in detail below in conjunction with the accompanying drawings. In the absence of conflict, the following embodiments and features in the embodiments can be combined with each other.

[0020] See also Figure 2 , Figure 3 , Figure 6 , a safety protection device for a hardware debugging interface, including a controller chip, a debugging interface is provided on the controller chip, at least four layers of PCB inner layer serpentine winding are performed on the clock signal or data signal of the debugging interface, so that the transmission length of the clock signal and the data signal has a large deviation, and does not meet the synchronous transmission requirements of the transmission line, and the controller chip includes one or more of a central processing unit, a micro control unit, a programmable gate array and a digital signal processor. It also includes a debugging adapter board, a debugging connector is provided on the debugging adapter board, and the debugging connector is connected to the debugging interface to realize the electrical equal length synchronous transmission of the transmission line. For the signal that is serpentine wound on the controller chip, it is no longer wound on the debugging adapter board; for the signal that is not wound on the controller chip, it is serpentine wound on the debugging adapter board.

[0021] It should be noted that the present invention uses signal integrity technology to perform serpentine winding on the inner layer of a multi-layer (at least four-layer board) PCB (printed circuit board) for the synchronous clock and data signals of the debugging interface of the controller chip (CPU (central processing unit), MCU (microcontroller unit), FPGA (field programmable gate array), DSP (digital signal processor), etc.) of the in-vehicle electronic product, so that the transmission length of the clock signal and the data signal has a large deviation, and the transmission line (see for details) is not satisfied. Figure 1, the transmission line is composed of any two wires of a certain length, including the signal path wire 1 and the return path wire 3, and there is a dielectric 2 between the signal path wire 1 and the return path wire 3) synchronous transmission requirements, that is, normal high-speed synchronous signals require that the clock signal and the data signal are transmitted as long as possible or close to the same length, so as to ensure the requirements of data conversion on the rising edge and sampling on the falling edge of the clock. In this way, even if the attacker can find the test point of the debugging interface, because it is impossible to well match the equal length requirements and transmission speed characteristics of the transmission line (assuming uniform material, uniform conductor, and uniform signal impedance), it is impossible to normally perform illegal debugging of the controller chip. For developers, because they have mastered the transmission line design characteristics of the product, they can design a debugging adapter board with reverse compensation of the transmission line during debugging, and ultimately enable developers to adjust the equal length of the synchronization signal to control the synchronization of the transmission speed of the signal to achieve legal debugging needs for the chip.

[0022] The present invention can be applied to the masking of the debugging interface of the vehicle hardware controller, and is also applicable to other high-speed synchronous signals that require masking. The specific methods include: On the product side, the synchronous interface signal of the controller on the PCBA (printed circuit board with mounted components) is modulated into a state of unequal length. For example, the clock signal is significantly longer than the data signal. The signal length deviation is sufficient to cause abnormalities in the sampling and signal flipping of high-speed synchronous signals.

[0023] It should be pointed out that the transmission speed of the signal in the PCB is related to the materials around the signal (air, copper, dielectric), and the establishment speed and propagation speed of the alternating electric and magnetic fields formed by the signal in the space around the transmission line conductor. Uniform materials, uniform conductors, and uniform impedance will lead to uniform and consistent signal transmission speed. In the case of differences in length, the arrival time of the signal will naturally be biased.

[0024] In order to achieve better signal masking effect, the transmission line of the product-side synchronous signal is routed through the inner layer of a multilayer board (at least a four-layer board), that is, the transmission line is made into a strip line (a type of transmission line). For details, see Figure 5 The stripline transmission line includes a first stripline reference plane 7 and a second stripline reference plane 10, a stripline dielectric 8 is arranged between the first stripline reference plane 7 and the second stripline reference plane 10, and a stripline transmission line 9 is arranged in the stripline dielectric 8. Instead of using a microstrip line (a type of transmission line, see Figure 4 The microstrip transmission line includes a microstrip reference plane 6, a microstrip dielectric 5 is arranged on the microstrip reference plane 6, and a microstrip transmission line 4 is arranged on the microstrip dielectric 5).

[0025] Usually microstrip lines are copper lines running on the surface layer, while striplines are transmission lines running between reference layers. Striplines are generally invisible to the naked eye.

[0026] When an attacker wants to access the controller's debug interface for debugging, monitoring or downloading data through the clock signal and data signal test points on the PCBA surface, the received data will be erroneous or garbled because the attacker cannot grasp all the characteristics of the transmission line and does not understand the signal transmission deviation and signal delay characteristics. Therefore, it will be impossible to obtain accurate data or conduct illegal debugging activities.

[0027] For legitimate users such as R&D personnel, since they can master the PCB data designed by EDA (electronic design automation), they can fully simulate, adjust and measure the routing length and delay characteristics of the signal on the product. Therefore, they only need to make a debugging adapter board to compensate for the transmission line characteristic deviation on the product through the adapter board, thus realizing the electrical equal-length synchronous transmission of the transmission line.

[0028] For signals that are serpentine-wound on the product-side PCB, they are no longer wound on the adapter board PCB side, and the routing needs to be as short as possible. For signals that are not wound on the product-side PCB, serpentine winding is required on the adapter board side to adjust the two signals to the same length as much as possible until they meet the synchronous signal characteristics of the transmission line. And in order to ensure the impedance continuity and transmission rate consistency of the product, the debugging adapter board can also be made into a strip line. In this way, developers can fully grasp the signal characteristics of the product side and the debugging adapter board side during design, and can use simulation and testing during research and development to ensure that the R&D personnel can fully meet the signal integrity characteristics during operation, so that the clock signal and data signal are transmitted synchronously, so as to correctly debug and download the chip.

[0029] Further, such as Figure 2 As shown in the figure, the clock signal between point C and point D is serpentine-wound. The equivalent length of the straightened serpentine winding is equal to A, and its transmission line length is much longer than the data signal length B between point G and point H on the product. In this way, the signals at test points D and G will be out of sync, and the synchronization of the clock signal and the data signal cannot be effectively achieved. In this way, the attacker cannot effectively control the debugging interface. In order to better achieve the concealment effect, the clock signal and the data signal are routed through the inner layer of the multi-layer PCB board so that they cannot be directly seen on the surface layer.

[0030] like Figure 3As shown, because developers still need to use the debug interface, a debug adapter board should be designed during the development phase. The debug adapter board can be designed as a microstrip line or a stripline, that is, the signal runs on the surface or on the inner layer. The figure shows an example of running on the inner layer. Because it is used by developers, this is not a mandatory requirement. The signal characteristics of the debug adapter board are complementary to the signal characteristics of the transmission line at the product end, that is, the clock signal between D' and E points is no longer serpentine, while the data signal between G' and F points is serpentine, so that the two can finally reach equal length or nearly equal length, which meets the signal integrity characteristics of the synchronous signal.

[0031] like Figure 4 As shown in the figure, if the microstrip line is routed on the PCB of the product in the conventional way, the signal line will be exposed to the attacker's sight, and it is easy for the attacker to imitate and find a countermeasure. Even if the microstrip line is a common strategy for most PCB routing, it is not ideal for the hidden interface on the product side.

[0032] like Figure 5 As shown, using stripline is different. The transmission line of the stripline runs on the inner layer of the PCB, and there is a complete copper layer of the reference plane on the surface, which can ensure that the actual routing of the inner layer cannot be seen on the surface, and it is not easy to be imitated and dealt with. At the same time, the transmission line characteristics of the stripline are better controlled, and the EMC (electromagnetic compatibility) performance can be better. Therefore, the product side still needs to design the synchronous debugging signal into a stripline instead of a microstrip line. There is no mandatory requirement for the debugging adapter board, and it can be made into a stripline or a microstrip line.

[0033] like Figure 6 As shown, when R&D personnel need to debug and download programs, they need to use a debugging adapter board, align the D' point probe of the debugging adapter board with the D point on the product PCB; align the G' point probe of the debugging adapter board with the G point on the product PCB to ensure reliable contact. At this time, the clock line of the debugging interface will be composed of two segments, namely the CD segment and the DE segment, where the CD segment has a serpentine winding, and the DE segment does not have a serpentine winding. The equivalent transmission line length of the CD segment is A, and the equivalent transmission line length of the DE segment is A*. The equivalent total length of the clock line L=A+A*. At the same time, the data line of the debug interface is also composed of two sections, namely the HG section and the GF section. The HG section has no serpentine winding, while the GF section has serpentine winding. The equivalent length of the HG section is B, and the equivalent length of the GF section is B*. The equivalent length of the data line is P=B+B*. According to the design rules of high-speed synchronous signals, only two equivalent lengths need to be modulated to make L=P±deviation length, where the deviation length is not enough to cause the failure of the flipping and sampling action of the synchronous signal, and the debug interface can communicate normally when it meets the configuration of the high-speed clock. This method works better for signals with higher frequencies.

[0034] The present invention also provides a security protection method for a hardware debugging interface. By utilizing the signal integrity theory of transmission lines, the clock signal or data signal of the debugging interface of the product-side controller chip is modulated to be of unequal lengths by using strip lines or serpentine windings. This makes it impossible for the two signals at a product test point to achieve synchronous reception and synchronous action when the signal transmission speed is constant, thereby preventing an attacker from obtaining the correct data of the debugging interface and effectively taking over the debugging interface, thereby achieving the effect of hiding the debugging interface.

[0035] In practical applications, the safety protection method can be designed using the following steps: S11: The clock signal of the debugging interface of the product-side controller chip is serpentine-wound on at least four layers of the PCB inner layer, so that the transmission length of the clock signal and the data signal has a large deviation and does not meet the synchronous transmission requirements of the transmission line; S12: According to the PCB data of the debugging interface of the controller chip on the product side, a debugging adapter board is set to compensate for the transmission line characteristic deviation on the product through the debugging adapter board to achieve electrical equal-length synchronous transmission of the transmission line; for the clock signal that is serpentine-wound on the controller chip, it is no longer wound on the debugging adapter board; for the data signal that is not wound on the controller chip, serpentine winding is performed on the debugging adapter board.

[0036] In practical applications, this safety protection method can also be designed using the following steps: S21: The data signal of the debugging interface of the product-side controller chip is serpentine-wound on at least four inner layers of the PCB, so that the transmission length of the data signal and the clock signal has a large deviation and does not meet the synchronous transmission requirements of the transmission line; S22: According to the PCB data of the debugging interface of the product-side controller chip, a debugging adapter board is set to compensate for the transmission line characteristic deviation on the product through the debugging adapter board to achieve electrical equal-length synchronous transmission of the transmission line. For the data signal that is serpentine-wound on the controller chip, it is no longer wound on the debugging adapter board; for the clock signal that is not wound on the controller chip, serpentine winding is performed on the debugging adapter board.

[0037] The present invention utilizes the signal integrity theory of transmission lines and modulates the synchronization signal of the debugging interface at the product end to unequal lengths by using strip lines, serpentine windings, etc. Under the condition of a certain signal transmission speed, the two signals at the product test point will not be able to achieve synchronous reception and synchronous action, so that the attacker cannot obtain the correct debugging interface data and cannot effectively take over the debugging interface, thereby achieving the effect of hiding the debugging interface.

[0038] For the aforementioned embodiments, for the sake of simplicity, they are all described as a series of action combinations, but those skilled in the art should be aware that the present application is not limited by the order of the actions described, because according to the present application, some steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are preferred embodiments, and the actions involved are not necessarily required by the present application.

[0039] The above embodiments describe the basic principles and main features of the present invention and the advantages of the present invention. Those skilled in the art should understand that the present invention is not limited by the above embodiments, and the above embodiments and descriptions are only for explaining the principles of the present invention. Without departing from the spirit and scope of the present invention, the changes and modifications made by those skilled in the art shall be within the scope of protection of the appended claims of the present invention without departing from the spirit and scope of the present invention.

Claims

1. A safety protection device for a hardware debugging interface, characterized in that: It includes a controller chip, on which a debugging interface is arranged, and a multi-layer PCB inner layer serpentine winding is arranged on the clock signal or data signal of the debugging interface, so that the transmission length of the clock signal and the data signal has a large deviation and does not meet the synchronous transmission requirement of the transmission line.

2. A safety protection device for a hardware debugging interface as claimed in claim 1, characterized in that: The controller chip includes one or more of a central processing unit, a micro control unit, a programmable gate array and a digital signal processor.

3. A safety protection device for a hardware debugging interface as claimed in claim 2, characterized in that: Perform at least four layers of PCB inner layer serpentine routing on the clock signal or data signal of the debug interface.

4. A safety protection device for a hardware debugging interface as claimed in claim 3, characterized in that: It also includes a debugging adapter board, on which a debugging connector is provided, and the debugging connector is connected to the debugging interface to achieve electrical equal-length synchronous transmission of the transmission line.

5. A safety protection device for a hardware debugging interface as claimed in claim 4, characterized in that: For the signals that are serpentine-routed on the controller chip, they are no longer serpentine-routed on the debugging adapter board; For signals that are not routed on the controller chip, serpentine routing is performed on the debugging adapter board.

6. A security protection method for a hardware debugging interface, characterized in that: By using the signal integrity theory of transmission lines, the clock signal or data signal of the debug interface of the product-side controller chip is modulated to unequal lengths by using strip lines or serpentine windings. This makes it impossible for the two signals at the product test point to achieve synchronous reception and synchronous action when the signal transmission speed is constant, making it impossible for attackers to obtain the correct debug interface data and effectively take over the debug interface, thereby hiding the debug interface.

7. A method for protecting the security of a hardware debugging interface according to claim 6, characterized in that: The steps include: S11: The clock signal of the debugging interface of the product-side controller chip is serpentine-wound on at least four layers of the PCB inner layer, so that the transmission length of the clock signal and the data signal has a large deviation and does not meet the synchronous transmission requirements of the transmission line; S12: According to the PCB data of the debugging interface of the controller chip on the product side, a debugging adapter board is set, and the transmission line characteristic deviation on the product is compensated by the debugging adapter board to realize the electrical equal-length synchronous transmission of the transmission line.

8. A method for protecting the security of a hardware debugging interface according to claim 7, characterized in that: Step S12 is specifically as follows: The clock signal that is snake-wound on the controller chip is no longer snaked on the debug adapter board; For data signals that are not routed on the controller chip, serpentine routing is performed on the debugging adapter board.

9. A method for protecting the security of a hardware debugging interface according to claim 6, characterized in that: The steps include: S21: The data signal of the debugging interface of the product-side controller chip is serpentine-wound on at least four inner layers of the PCB, so that the transmission length of the data signal and the clock signal has a large deviation and does not meet the synchronous transmission requirements of the transmission line; S22: According to the PCB data of the debugging interface of the controller chip on the product side, a debugging adapter board is set, and the transmission line characteristic deviation on the product is compensated by the debugging adapter board to realize the electrical equal-length synchronous transmission of the transmission line.

10. A method for protecting the security of a hardware debugging interface according to claim 9, characterized in that: Step S22 is specifically as follows: For the data signals that are serpentine-wound on the controller chip, they are no longer serpentine-wound on the debugging adapter board; For clock signals that are not routed on the controller chip, serpentine routing is performed on the debugging adapter board.

Images