MCU program protection system and method based on SM4 cryptographic algorithm

Abstract

The invention belongs to the technical field of information security encryption processing, and particularly relates to an MCU program protection system and method based on a SM4 cryptographic algorithm. Comprising the following steps: randomly generating a secret key of an SM4 algorithm, encrypting a program needing security protection through the SM4 algorithm in upper computer software, downloading a ciphertext generated after encryption into an on-chip Flash storage module through a JTAG downloader, and downloading the secret key and control information into an on-chip EEPROM storage module through a serial port downloader; after the MCU is powered on, the secret key and the control information stored in the on-chip EEPROM storage module are loaded into the SM4 algorithm decryption module to be called in the decryption process; and the Boot program reads the mode control information for judgment. According to the invention, the safety protection performance of the SM4 algorithm is utilized to protect the safety of MCU operation data, and leakage and stealing of core information are prevented.

Description

Technical Field

[0001] The present invention belongs to the technical field of information security encryption processing, and in particular relates to an MCU program protection system and method based on the national secret SM4 algorithm. Background Art

[0002] With the increasing informatization, digitization and networking of modern society, people's demand for information security technology is becoming more and more extensive and in-depth. The application field of information security technology has gradually expanded from traditional military and political departments to all aspects of social life. Information security products have become an important guarantee for the healthy operation of the entire society. As a core device for data processing and algorithm application, MCU plays an extremely important role in various aerospace and aviation electronic systems. During the application process, third parties can obtain running program codes through many channels, especially various core algorithms, communication protocols and other information cannot be effectively protected. As the hardware carrier of information security technology, how to build a secure encryption and decryption system to ensure the secure transmission and execution of data processing information is crucial. Summary of the invention

[0003] The purpose of the present invention is to overcome the above-mentioned shortcomings of the prior art. The present invention provides an MCU program protection system and method based on the national secret SM4 algorithm. By designing a security encryption and decryption system with MCU as the core component, the security protection performance of the SM4 algorithm is used to protect the security of MCU running data and prevent the leakage and theft of core information. The present invention ensures that even if the Flash program in the chip is stolen, the real executable code cannot be obtained because it is a ciphertext program, thereby effectively ensuring the security of the core application program code.

[0004] In order to solve the above technical problems, the present invention provides an MCU program protection method based on the national secret SM4 algorithm, comprising the following steps: Step S1: randomly generate a key of the SM4 algorithm, encrypt the program that needs to be protected by the SM4 algorithm in the host computer software, download the encrypted ciphertext to the on-chip Flash storage module through the JTAG downloader, and download the key and control information to the on-chip EEPROM storage module through the serial port downloader; Step S2: After the MCU is powered on, the key and control information stored in the on-chip EEPROM storage module will be loaded into the SM4 algorithm decryption module to be called during the decryption process; Step S3: The Boot program reads the mode control information to make a judgment, enters the program protection working mode, decrypts the ciphertext stored in the on-chip Flash storage module, and moves the program to the on-chip SRAM storage module after the decryption completion flag signal is set, until the on-chip SRAM storage module completes the execution of the program; Among them, the execution process of decryption in step S3 specifically includes: first, the Boot program moves the 64-bit ciphertext data twice, and then integrates the two 64-bit ciphertext data into a 128-bit ciphertext data, decrypts it using the SM4 algorithm decryption module, waits for the decryption completion signal to be set, and then writes the 128-bit plaintext code to the corresponding address of the on-chip SRAM storage module, and the address accumulation loop is executed until all the ciphertext data are decrypted.

[0005] Preferably, the host computer software supports SM4 algorithm encryption, JTAG download and serial communication functions, and the key of the SM4 algorithm is a 128-bit random number.

[0006] Preferably, the JTAG downloader supports the JTAG communication protocol for downloading and transmitting the encrypted program, and the serial port downloader supports a custom communication protocol for downloading and transmitting the key and control information.

[0007] Preferably, the on-chip EEPROM storage module is built into the MCU and is used to store keys and control information.

[0008] Preferably, in the program protection mode, JTAG has a shielding function to ensure that the information of the on-chip Flash storage module cannot be accessed through the JTAG port.

[0009] Preferably, in step S2, the key stored in the on-chip EEPROM storage module is loaded into the key register of the SM4 algorithm decryption module, the control information is loaded into the register corresponding to the MCU, and the control information includes a field that can permanently shield the JTAG debugging function.

[0010] Preferably, the working mode of the MCU also includes a normal mode, and when in the normal mode, the program in the on-chip Flash storage module or the on-chip SRAM storage module can be directly read for execution.

[0011] Preferably, the mode control information loaded by the on-chip EEPROM storage module is read by a boot program to make a judgment, so as to distinguish between the normal mode and the program protection mode.

[0012] The present invention also provides an MCU program protection system based on the national secret SM4 algorithm, which adopts the above-mentioned MCU program protection method based on the national secret SM4 algorithm, including: The host computer software has the SM4 algorithm encryption function and random key generation function, and supports user password login; The JTAG downloader is connected to the JTAG port built into the MCU. The host computer software downloads the ciphertext generated by the SM4 algorithm to the on-chip Flash storage module through the JTAG downloader. The serial port downloader is connected to the built-in serial port of the MCU. The host computer software downloads the key and related control information to the on-chip EEPROM storage module through the multiplexed port pins of the serial port downloader; The MCU has a built-in Boot program responsible for program migration and mode selection functions, an on-chip Flash storage module, an on-chip EEPROM storage module and an SM4 algorithm decryption module.

[0013] Compared with the prior art, the present invention has the following beneficial effects: The present invention is responsible for the transfer and mode control of the encrypted program through the Boot program of the MCU, and the circuit has a built-in SM4 hardware decryption module and an EEPROM memory module. The host computer encrypts the anti-theft program to obtain the program ciphertext, downloads it to the on-chip Flash through the JTGA interface, and downloads the key to the EEPROM storage module through the serial port. After the MCU is powered on and started, the ciphertext program in the Flash is moved to the SM4 decryption module for decryption through the BOOT program, and the decrypted program is loaded into the SRAM, and finally the execution of the program is completed. The present invention can effectively prevent the on-chip program code of the MCU from being illegally read, and if the program code of the on-chip Flash is read through other illegal reverse means, the real program code cannot be obtained because it is ciphertext data. Based on the design of the SM4 encryption algorithm and the security protection system, the present invention achieves safe and reliable protection for important program storage. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] Figure 1 This is a block diagram of the program security protection system of the present invention.

[0015] Figure 2 This is a flow chart of the upper computer software data burning process of the present invention.

[0016] Figure 3 The block diagram of the program security protection system of the present invention within the MCU.

[0017] Figure 4 It is the execution flow chart of the ciphertext program of the present invention. DETAILED DESCRIPTION

[0018] The present invention is further described in detail below in conjunction with the accompanying drawings and specific embodiments. The advantages and features of the present invention will become more apparent from the following description. It should be noted that the accompanying drawings are in very simplified form and in non-precise proportions, and are only used to conveniently and clearly assist in explaining the purpose of the embodiments of the present invention.

[0019] like Figure 1 As shown, the embodiment of the present invention provides an MCU program protection system based on the SM4 algorithm, which mainly includes a host computer software, a serial port downloader, a JTAG downloader and an MCU. The host computer software is written and designed in C++ language, has the SM4 encryption algorithm function and the random key generation function, and supports user password login. The host computer software downloads the encrypted program to the on-chip Flash storage module of the MCU through the JTAG downloader, and downloads the key and related control information to the on-chip EEPROM storage module built into the MCU through the homemade serial port downloader. The data download and burning process is as follows: Figure 2 The host computer sends a function instruction through the serial port downloader. The first step is to send the EEPROM write instruction 0Fh and the write address information TA; the second step is to read the EEPROM status information RA by sending the AA instruction, and compare the values ​​of TA and RA. If they are equal, continue to the next step, otherwise return to the first step; the third step is to send the data information to be written to the TA address; the fourth step is to read the EEPROM status information RE by sending the instruction 33. If RE is equal to FF, proceed to the next step. If it is not equal to FF, continue to execute the fourth step; the fifth step is to send the instruction F0 to read the data written to the TA address, and compare the read data with the data written in the third step. If they are equal, feedback is successful, otherwise execute the first step.

[0020] The system of the present invention is developed and designed based on a general MCU. The design of the program protection system is realized by adding an SM4 algorithm module and an EEPROM memory without changing the normal working mode of the MCU. The structure is as follows: Figure 3 As shown in the figure, the EEPROM memory is used to store keys and control information; the SM4 module is used to decrypt data; the Flash is used to store ciphertext programs; the SRAM is used to store decrypted plaintext programs; and the kernel is used to execute plaintext programs. The circuit adopts a forward design approach and is upgraded to a general MCU with SM4 algorithm decryption function after scheme demonstration, logic design, simulation verification, layout design, plate making and packaging testing.

[0021] The program code that needs to be protected is encrypted by the host computer software using the SM4 algorithm, and the generated ciphertext is downloaded to the MCU's on-chip Flash storage module through JTAG. The MCU's working mode is divided into normal mode and program protection mode. In normal working mode, the program in the on-chip Flash or SRAM storage module can be directly read for execution; in program protection mode, the ciphertext program in the on-chip Flash is moved to the SM4 algorithm module for decryption through the guidance of the Boot program, and the decrypted program is then moved to the on-chip SRAM to complete the execution of the program.

[0022] The serial port downloader adopts a custom communication protocol. The host computer software downloads the key and related control information to the on-chip EEPROM storage module through the serial port downloader multiplexing port pins.

[0023] The MCU's built-in Boot program is responsible for program migration and mode selection. After the circuit is powered on, the key stored in the EEPROM is automatically loaded into the key register of the SM4 module and is called during the data decryption process.

[0024] In the program protection working mode, JTAG has a shielding function, and the data of the on-chip storage module cannot be accessed through the debug port. If the data stored in the Flash is stolen through reverse engineering, intrusion, etc., the real program data cannot be parsed because it is encrypted ciphertext data.

[0025] After the circuit is powered on, the Boot program reads the control information in the EEPROM to determine the working mode of the circuit. In the normal working mode, the use of the MCU is the same as that of a general MCU; in the program protection working mode, the host computer software and the MCU need to be used together. The steps are as follows: Step 1: Generate a key randomly, encrypt the program to be protected through the host computer software, and then download it to the MCU on-chip Flash memory through JTAG, and download the key and control information to the EEPROM memory through the serial port downloader.

[0026] Step 2: After power-on, the key in the EEPROM is loaded into the SM4 module key register, and the control information is loaded into the corresponding register of the MCU. The control information contains a field that can permanently block the JTAG debugging function.

[0027] Step 3: The Boot program reads the mode control information to make a judgment, enters the program protection working mode, and decrypts the ciphertext program data in the Flash. The process is as follows: Figure 4 As shown in the figure, in the first step, after the MCU is powered on, the information stored in the EEPROM is automatically loaded into the corresponding registers in the chip. In the second step, the BOOT program starts to execute, and the ciphertext program in the Flash memory is moved to the SM4 module for decryption. The decryption result is written into the SRAM. This operation is repeated until all ciphertext programs are decrypted and written into the SRAM, then jump to the SRAM to start executing the plaintext program until the program is executed in the chip.

[0028] Among them, in the decryption execution process, the Boot migration program moves the 64-bit ciphertext data twice, and then integrates the two 64-bit data into a 128-bit ciphertext data, uses SM4 to decrypt, and waits for the decryption completion signal to be set. Then, the 128-bit plaintext code is written to the corresponding address of the on-chip SRAM, and the address is accumulated and executed in a loop until all the ciphertext data is decrypted.

[0029] The above description is only a description of the preferred embodiments of the present invention, and is not intended to limit the scope of the present invention. Any changes or modifications made by a person skilled in the art in the field of the present invention based on the above disclosure shall fall within the scope of protection of the claims.

Claims

1. A MCU program protection method based on the national secret SM4 algorithm, characterized in that: The steps include: Step S1: randomly generate a key of the SM4 algorithm, encrypt the program that needs to be protected by the SM4 algorithm in the host computer software, download the encrypted ciphertext to the on-chip Flash storage module through the JTAG downloader, and download the key and control information to the on-chip EEPROM storage module through the serial port downloader; Step S2: After the MCU is powered on, the key and control information stored in the on-chip EEPROM storage module will be loaded into the SM4 algorithm decryption module to be called during the decryption process; Step S3: The Boot program reads the mode control information to make a judgment, enters the program protection working mode, decrypts the ciphertext stored in the on-chip Flash storage module, and moves the program to the on-chip SRAM storage module after the decryption completion flag signal is set, until the on-chip SRAM storage module completes the execution of the program; Among them, the execution process of decryption in step S3 specifically includes: first, the Boot program moves the 64-bit ciphertext data twice, and then integrates the two 64-bit ciphertext data into a 128-bit ciphertext data, decrypts it using the SM4 algorithm decryption module, waits for the decryption completion signal to be set, and then writes the 128-bit plaintext code to the corresponding address of the on-chip SRAM storage module, and the address is accumulated and executed in a loop until all the ciphertext data are decrypted.

2. The MCU program protection method based on the national secret SM4 algorithm as described in claim 1 is characterized in that: The host computer software supports SM4 algorithm encryption, JTAG download and serial communication functions, and the key of the SM4 algorithm is a 128-bit random number.

3. The MCU program protection method based on the national secret SM4 algorithm as described in claim 1 is characterized in that: The JTAG downloader supports the JTAG communication protocol and is used for downloading and transmitting the encrypted program. The serial port downloader supports a custom communication protocol and is used for downloading and transmitting the key and control information.

4. The MCU program protection method based on the national secret SM4 algorithm as described in claim 1 is characterized in that: The on-chip EEPROM storage module is built into the MCU and is used to store keys and control information.

5. The MCU program protection method based on the national secret SM4 algorithm as claimed in claim 1 is characterized in that: In program protection mode, JTAG has a shielding function to ensure that the information of the on-chip Flash storage module cannot be accessed through the JTAG port.

6. A method for protecting MCU programs based on the national secret SM4 algorithm as claimed in claim 5, characterized in that: In step S2, the key stored in the on-chip EEPROM storage module is loaded into the key register of the SM4 algorithm decryption module, the control information is loaded into the register corresponding to the MCU, and the control information includes a field that can permanently shield the JTAG debugging function.

7. A method for protecting MCU programs based on the national secret SM4 algorithm as claimed in claim 1, characterized in that: The working mode of the MCU also includes a normal mode. When in the normal mode, the program in the on-chip Flash storage module or the on-chip SRAM storage module can be directly read for execution.

8. A method for protecting MCU programs based on the national secret SM4 algorithm as described in claim 7, characterized in that: The mode control information loaded by the on-chip EEPROM storage module is read by a boot program to make a judgment, so as to distinguish between the normal mode and the program protection mode.

9. An MCU program protection system based on the national secret SM4 algorithm, using the MCU program protection method based on the national secret SM4 algorithm as described in any one of claims 1 to 8, characterized in that: include: The host computer software has the SM4 algorithm encryption function and random key generation function, and supports user password login; The JTAG downloader is connected to the JTAG port built into the MCU. The host computer software downloads the ciphertext generated by the SM4 algorithm to the on-chip Flash storage module through the JTAG downloader. The serial port downloader is connected to the built-in serial port of the MCU. The host computer software downloads the key and related control information to the on-chip EEPROM storage module through the multiplexed port pins of the serial port downloader; The MCU has a built-in Boot program responsible for program migration and mode selection functions, an on-chip Flash storage module, an on-chip EEPROM storage module and an SM4 algorithm decryption module.

Images