Microcontroller, safety system and protection method

Abstract

The invention provides a microcontroller, a safety system and a protection method. The microcontroller comprises an unsafe area, a safe area and a processing circuit. The non-safe area stores a neural network model. The neural network model includes an encrypted operator and an unencrypted operator. The secure area stores a key and includes a decryption circuit. In a non-secure mode, the processing circuitry interprets the unencrypted operator. In a secure mode, the processing circuit requires the decryption circuit to decrypt the encryption operator by using the key to generate a decryption result. In the secure mode, the processing circuit interprets the decryption result to generate an output data, and stores the output data to the non-secure region.

Description

Technical Field

[0001] The present invention relates to a microcontroller, and in particular to a microcontroller for processing a neural network model. Background Art

[0002] As technology develops, data security issues are also increasing. Data may be intercepted by illegal users before being stored in memory. Even if stored in memory, it may still be stolen by illegal users. Summary of the invention

[0003] One embodiment of the present invention provides a microcontroller, including a non-secure area, a secure area and a processing circuit. The non-secure area includes a first storage circuit. The first storage circuit stores a neural network model. The neural network model includes an encrypted operator and an unencrypted operator. The secure area includes a key management device, a decryption circuit and a second storage circuit. The key management device stores a key. The decryption circuit uses the key to decrypt the encrypted operator to generate a decryption result. The second storage circuit stores the decryption result. The processing circuit interprets the unencrypted operator and the decryption result. In a non-secure mode, the processing circuit interprets the unencrypted operator to generate a first output data. In a secure mode, the processing circuit requires the decryption circuit to decrypt the encrypted operator using the key and interpret the decryption result to generate a second output data. In the secure mode, the processing circuit stores the second output data to the first storage circuit.

[0004] The present invention further provides a security system, including an offline tool and a microcontroller. The offline tool includes an encryption circuit. The encryption circuit receives a neural network model. The neural network model includes a first operator and a second operator. The encryption circuit encrypts the second operator using a key to generate an encrypted operator. The microcontroller includes a non-secure area, a secure area, and a processing circuit. The non-secure area includes a first storage circuit. The first storage circuit stores the first operator and the encrypted operator. The secure area includes a key management device, a decryption circuit, and a second storage circuit. The key management device stores the key. The decryption circuit uses the key to decrypt the encrypted operator to generate a decryption result. The second storage circuit stores the decryption result. The processing circuit interprets the first operator and the decryption result. In a non-secure mode, the processing circuit interprets the first operator to generate a first output data. In a secure mode, the processing circuit interprets the decryption result to generate a second output data, and stores the second output data to the first storage circuit.

[0005] The present invention further provides a protection method applicable to a microcontroller. The microcontroller has a non-secure area and a secure area. The protection method of the present invention includes storing a first operator and an encryption operator in the non-secure area; storing a key in the secure area; in a non-secure mode, decrypting the first operator to generate a first output data; in a secure mode, using the key, decrypting the encryption operator to generate a decryption result, and decrypting the decryption result to generate a second output data. In the secure mode, the second output data is stored in the non-secure area.

[0006] The microcontroller, security system and protection method provided by the present invention can prevent data from being intercepted by illegal users before being stored in the memory, and prevent data from being stolen by illegal users after being stored in the memory.

[0007] The protection method of the present invention can be implemented through the microcontroller and security system of the present invention, which are hardware or firmware that can execute specific functions, or can be recorded in a recording medium in the form of program code and implemented in combination with specific hardware. When the program code is loaded and executed by an electronic device, processor, computer or machine, the electronic device, processor, computer or machine becomes a microcontroller and security system for implementing the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0008] Figure 1 Schematic diagram of the safety system of the present invention.

[0009] Figure 2 Schematic diagram of a microcontroller of the present invention.

[0010] Figure 3 It is a schematic diagram of the operation of the processing circuit of the present invention operating in a non-safe mode.

[0011] Figure 4 It is a schematic diagram of the operation of the processing circuit of the present invention operating in a safe mode.

[0012] Figure 5 It is a schematic diagram of the protection method of the present invention.

[0013] Reference numerals:

[0014] 100: Security System

[0015] 110: Offline Tools

[0016] 120: Microcontroller

[0017] 130, 130': Neural network model

[0018] 111: Encryption Circuit

[0019] 112: Injection Circuit

[0020] 121: Unsafe Zone

[0021] 122: Safe Zone

[0022] 123: Processing circuit

[0023] 124: Bus

[0024] KY: Key

[0025] OP0~OP2:Operator

[0026] OP1_E, OP3_E: Encryption operators

[0027] OP1_D, OP3_D: Decryption results

[0028] OP1_D_1~OP1_D_3: Decryption operator

[0029] 210: Transmission interface

[0030] 220, 260: Storage circuit

[0031] 230, 270: Non-volatile memory

[0032] IPC1, IPC2: Decoding program code

[0033] 221, 222: Memory

[0034] OUT1~OUT4, OUT1_1~OUT1_3: output data

[0035] IN1~IN4, IN2_1, IN2_2: input data

[0036] 240: Key management device

[0037] 250: Decryption Circuit

[0038] 281, 283: Memory

[0039] 282, 284: Software Programs

[0040] 290: Processor

[0041] 311~313, 411, 412: Function library DETAILED DESCRIPTION

[0042] In order to make the purpose, features and advantages of the present invention more clearly understood, the following embodiments are specifically cited and described in detail with reference to the accompanying drawings. The present invention specification provides different embodiments to illustrate the technical features of different implementations of the present invention. Among them, the configuration of each element in the embodiment is for illustrative purposes and is not intended to limit the present invention. In addition, some of the figure numbers in the embodiments are repeated for the purpose of simplifying the description and do not mean the correlation between different embodiments.

[0043] Figure 1 Schematic diagram of the security system of the present invention. As shown in the figure, the security system 100 includes an offline tool 110 and a microcontroller 120. The offline tool 110 receives a key KY and a neural network model 130. The present invention does not limit the number of keys KY. In other embodiments, the offline tool 110 receives more keys. In some embodiments, the offline tool 110 has a storage circuit (not shown) for storing the key KY and the neural network model 130.

[0044] The neural network model 130 includes operators OP0-OP2. The present invention does not limit the number of operators. The neural network model 130 has more or fewer operators. In this embodiment, the operators OP0-OP2 each have a predefined network architecture and a large number of parameters, such as weights and biases.

[0045] In addition, operators OP0~OP2 each have a tag information to indicate the type of network architecture. Taking operator OP0 as an example, when the tag information of operator OP0 meets a first preset value, it indicates that operator OP0 belongs to a first type of network architecture, such as a convolution neural network (CNN) architecture. When the tag information of operator OP0 meets a second preset value, it indicates that operator OP0 belongs to a second type of network architecture, such as a fully-connected (FC) architecture. When the tag information of operator OP0 meets a third preset value, it indicates that operator OP0 belongs to a third type of network architecture, such as a pooling architecture.

[0046] In one possible embodiment, the neural network model 130 is used as a deep learning model. The deep learning model is composed of multiple layers of neural networks. For example, the neural network model 130 may include a convolutional neural network (CNN) layer, a fully connected (FC) layer, and a pooling layer. Each layer of the neural network is converted into an operator, such as operators OP0~OP2. In addition, each operator includes a weight value, a bias value, etc. In some embodiments, each of the operators OP0~OP2 has a content information. The content information may include a large number of parameters (such as weights and bias values) and corresponding neural network information.

[0047] In this embodiment, the offline tool 110 includes an encryption circuit 111 and an injection circuit 112. The encryption circuit 111 uses a key KY to encrypt at least one of the operators OP0-OP2 to generate an encrypted operator. In this example, the encrypted operator has a tag information and an encryption information. In a possible embodiment, the encryption operation performed by the encryption circuit 111 is a symmetric encryption operation (symmetric encryption), such as the AES algorithm.

[0048] The offline tool 110 outputs the unencrypted operator and the encrypted operator to the microcontroller 120. For example, assume that the encryption circuit 111 uses the key KY to encrypt the operator OP1 to generate an encrypted operator OP1_E. In this example, the encryption circuit 111 encrypts the tag information and content information of the operator OP1 to generate an encrypted message. The encryption circuit 111 uses the encrypted message together with the tag information as the encrypted operator OP1_E. In one possible embodiment, the encryption circuit 111 sets the tag information of the encrypted operator OP1_E to a preset value. The offline tool 110 outputs the unencrypted operators OP0, OP2 and the encrypted operator OP1_E to the microcontroller 120. The unencrypted operators OP0, OP2 and the encrypted operator OP1_E constitute a neural network model 130'.

[0049] In some embodiments, the encryption circuit 111 encrypts the operators OP1 and OP2, and uses the encrypted result as the encryption operator OP1_E. For example, the encryption circuit 111 encrypts the tag information and content information of the operators OP1 and OP2 to generate an encrypted message. The encryption circuit 111 uses the encrypted message together with the tag information as the encryption operator OP1_E. In this example, the encryption circuit 111 sets the tag information of the encryption operator OP1_E to a preset value. Then, the encryption circuit 111 outputs the unencrypted operator OP0 and the encryption operator OP1_E to the microcontroller 120.

[0050] In other embodiments, the encryption circuit 111 uses different keys to encrypt different operations. For example, the encryption circuit 111 uses a first key to encrypt the operator OP1 to generate a first encrypted operator, and uses a second key to encrypt the operator OP2 to generate a second encrypted operator. In this example, the encryption circuit 111 outputs the unencrypted operator OP0, the first encrypted operator, and the second encrypted operator to the microcontroller 120.

[0051] In another possible embodiment, the encryption circuit 111 uses the same key to encrypt different operators. For example, the encryption circuit 111 uses the key KY to encrypt the operator OP0 to generate a first encrypted operator, and uses the key KY to encrypt the operator OP2 to generate a second encrypted operator. In this example, the encryption circuit 111 outputs the first encrypted operator, the unencrypted operator OP1, and the second encrypted operator to the microcontroller 120.

[0052] The injection circuit 112 uses a secure key provision process to inject the key KY into the microcontroller 120. In other embodiments, when the encryption circuit 111 uses different keys to encrypt different operators, the injection circuit 112 injects different keys into the microcontroller 120. Therefore, the microcontroller 120 can decrypt different encrypted operators using the corresponding keys. In one possible embodiment, the injection circuit 112 is independent of the offline tool 100.

[0053] In other embodiments, the encryption circuit 111 may encrypt the key SK and then provide the encrypted result to the injection circuit 112. The injection circuit 112 injects the encrypted key into the microcontroller 120. The present invention does not limit how the encryption circuit 111 encrypts the key SK. In one embodiment, the encryption circuit 111 encrypts the key SK using an asymmetric encryption algorithm (such as an ECC algorithm or an RSA algorithm).

[0054] In this embodiment, the microcontroller 120 includes a non-secure area 121, a secure area 122, and a processing circuit 123. The non-secure area 121 stores a neural network model 130'. The neural network model 130' includes operators OP0, OP2, and an encryption operator OP1_E. In this example, since the operators OP0 and OP2 are not encrypted, the operators OP0 and OP2 are called unencrypted operators.

[0055] The security zone 122 stores the key KY. The key KY is not encrypted. In other embodiments, the security zone 122 stores the encrypted key. In this embodiment, the key KY is provided by the injection circuit 112, but this is not intended to limit the present invention. In other embodiments, the key KY may be injected into the security zone 122 via a network interface.

[0056] The processing circuit 123 accesses the non-secure area 121 and the secure area 122 through the bus 124. In one possible embodiment, the processing circuit 123 supports the non-secure mode and the secure mode of the Trustzone. In the non-secure mode, the processing circuit 123 interprets the operators OP0 and OP2 of the non-secure area 121. In the secure mode, the processing circuit 123 first uses the key KY to decrypt the encrypted information of the encryption operator OP1_E to generate a decryption result OP1_D, and then interprets the decryption result OP1_D. In this example, the decryption result OP1_D is the same as the operator OP1.

[0057] Since the neural network model 130' has at least one encryption operator, even if an illegal person obtains the neural network model 130' in the non-secure area 121, the neural network model 130' cannot be used. In addition, since the encryption circuit 111 only encrypts some key operators (such as OP1) of the neural network model 130, and does not encrypt all operators (such as OP0~OP2) of the neural network model 130, a balance between security and computing load can be achieved. Furthermore, since the secure area 122 provides a trusted operation environment (trusted operation environment), combined with standard encryption and decryption operations, the confidentiality of the neural network model is ensured and will not be infringed by malicious users outside the secure area.

[0058] Figure 2 Schematic diagram of the microcontroller of the present invention. The non-secure area 121 includes a storage circuit 220. The storage circuit 220 includes a memory 221. The memory 221 stores operators OP0, OP2 and encryption operator OP1_E. The present invention does not limit the type of the memory 221. In a possible embodiment, the memory 221 is a volatile memory, such as a random access memory (RAM).

[0059] In other embodiments, the non-secure area 121 further includes a transmission interface 210. The transmission interface 210 receives the operators OP0, OP2 and the encryption operator OP1_E from the offline tool 110. The transmission interface 210 may directly store the operators OP0, OP2 and the encryption operator OP1_E in the storage circuit 220. The present invention does not limit the type of the transmission interface 210. In one possible embodiment, the transmission interface 210 is an Internet interface.

[0060] In other embodiments, the non-secure area 121 further includes a non-volatile memory (NVM) 230. The non-volatile memory 230 stores a decryption program code IPC1. In the non-secure mode, the processing circuit 123 executes the decryption program code IPC1 to decrypt the unencrypted operators OP0 and OP2. In one possible embodiment, the decryption program code IPC1 is used to decrypt a model that complies with the TensorFlow lite standard. In some embodiments, the decryption program code IPC1 is a software function library.

[0061] The secure area 122 includes a key management device 240, a decryption circuit 250, and a storage circuit 260. The key management device 240 stores the key KY. The present invention does not limit the number of keys stored in the key management device 240. In some embodiments, when the encryption circuit 111 uses multiple keys to perform encryption operations, the key management device 240 stores the keys.

[0062] In other embodiments, the secure area 122 has a transmission interface (not shown). The transmission interface of the secure area 122 receives the key KY from the injection circuit 112 and stores the key KY in the key management device 240. In another possible embodiment, the key management device 240 receives the key KY from the injection circuit 112 via the bus 124.

[0063] The decryption circuit 250 uses the key KY to perform a decryption operation on the encrypted information of the encryption operator OP1_E to generate a decryption result OP1_D. The decryption result OP1_D includes at least one operator. After being processed by the decryption circuit 250, the tag information and content information of the decryption result OP1_D are the same as the tag information and content information of the operator OP1. In another possible embodiment, it is assumed that the encryption circuit 111 uses the same key to encrypt the operators OP1 and OP2. In this example, after being processed by the decryption circuit 250, the decryption result OP1_D includes a first decryption operator and a second decryption operator. The tag information and content information of the first decryption operator are the same as the tag information and content information of the operator OP1. The tag information and content information of the second decryption operator are the same as the tag information and content information of the operator OP2. In other embodiments, when the key KY is an encryption key, the decryption circuit 222 first decrypts the key SK, and then uses the decrypted key to process the encrypted information of the encryption operator (such as OP1_E).

[0064] The storage circuit 260 stores the decryption result OP1_D. The present invention does not limit the structure of the storage circuit 260. In one possible embodiment, the storage circuit 260 has a volatile memory. In some embodiments, the decryption circuit 250 is directly connected to the storage circuit 260 to directly write the decryption result OP1_D to the storage circuit 260.

[0065] In other embodiments, the secure area 122 further includes a non-volatile memory 270. The non-volatile memory 270 stores an interpreter code IPC2. In one possible embodiment, the interpreter code IPC2 is used to interpret a model that complies with the TensorFlowlite standard. In some embodiments, the interpreter code IPC2 is a software function library.

[0066] In the security mode, the processing circuit 123 uses the decryption program code IPC2 to decrypt the decryption result OP1_D to generate an output data OUT2. The processing circuit 123 stores the output data OUT2 in the storage circuit 220 of the non-security area 121. In one possible embodiment, the storage circuit 220 includes a memory 222. The memory 222 stores the output data OUT2. In this example, the memories 221 and 222 are independent of each other. In other embodiments, the storage circuit 220 has a single memory for storing the operators OP0, OP2, the encryption operator OP1_E and the output data OUT2.

[0067] In some embodiments, the processing circuit 123 includes memories 281, 283 and a processor 290. The memory 281 stores a software program 282. The present invention does not limit the type of the memory 281. The memory 281 may be a non-volatile memory or a volatile memory. In other embodiments, the software program 282 may be stored in the storage circuit 220 or the non-volatile memory 230.

[0068] The memory 283 stores a software program 284 . The present invention does not limit the type of the memory 283 . The memory 283 may be a non-volatile memory or a volatile memory. In other embodiments, the software program 284 may be stored in the storage circuit 260 or the non-volatile memory 270 .

[0069] Processor 290 accesses memories 281 and 283. In non-secure mode, processor 290 executes software program 282 to decrypt operators OP0 and OP2 (also known as unencrypted operators). In secure mode, processor 290 executes software program 284 to decrypt decryption result OP1_D. In one possible embodiment, processor 290 is a general-purpose processor.

[0070] Figure 3 This is an operational diagram of the processing circuit of the present invention operating in a non-secure mode. In one possible embodiment, the microcontroller 120 receives an external request and interprets the neural network model 130" based on the external request. After completing the interpretation, the microcontroller 120 provides an output data OUT4, also called an inference output (output inferenced data). In one possible embodiment, the microcontroller 120 uses the neural network model 130" to perform an image recognition inference or a sound recognition inference.

[0071] In this embodiment, the neural network model 130" is provided by an offline tool and includes operators OP0, OP1_E, OP2 and OP3_E. Operators OP0 and OP2 are unencrypted operators. Operators OP1_E and OP3_E are encrypted operators. In one possible embodiment, the offline tool uses the same or different keys to encrypt the two operators to generate operators OP1_E and OP3_E.

[0072] After receiving the external request, the processor 290 enters a non-secure mode. In the non-secure mode, the processor 290 executes the software program 282 to interpret the operator OP0. The processor 290 reads the tag information contained in the operator OP0, and calls the function library 311 according to the tag information contained in the operator OP0. The processor 290 calculates the content information of the operator OP0 and the input data IN1 according to the function library 311 to generate an output data OUT1. In a possible embodiment, the function library 311 is an algorithm. The processor 290 substitutes the operator OP0 and the input data IN1 into the function library 311, and uses the calculation result as the output data OUT1.

[0073] The processor 290 uses the output data OUT1 as the input data IN2 of the encryption operator OP1_E. The processor 290 reads the tag information of the encryption operator OP1_E and calls a function library 313 according to the tag information of the encryption operator OP1_E. In one possible embodiment, the function library 313 includes a non-secure callable secure function called a trusted machine learning execution application programming interface. In this example, the processor 290 calls the function library located in the secure area according to the characteristics of the non-secure callable secure function of the function library 313. Then, the processor 290 leaves the non-secure mode and enters the secure mode.

[0074] In the security mode, the processor 290 requires the decryption circuit 250 to use the key KY to decrypt the encrypted information of the encryption operator OP1_E to generate a decryption result OP1_D. The processor 290 interprets the decryption result OP1_D to generate an output data OUT2. The processor 290 stores the output data OUT2 in the non-security area 121 and switches to the non-security mode.

[0075] In the non-secure mode, the processor 290 executes the software program 282 to interpret the operator OP2. During the interpretation process, the processor 290 reads the tag information of the operator OP2 and uses the output data OUT2 as the input data IN3 of the operator OP2. The processor 290 calls a function library 312 according to the tag information of the operator OP2. The processor 290 operates on the content information of the operator OP2 and the input data IN3 according to the function library 312 to generate an output data OUT3.

[0076] The processor 290 uses the output data OUT3 as the input data IN4 of the encryption operator OP3_E. The processor 290 reads the tag information of the encryption operator OP3_E and calls the function library 313 according to the tag information of the encryption operator OP3_E. At this time, the processor 290 leaves the non-secure mode and enters the secure mode.

[0077] In the security mode, the processor 290 requests the decryption circuit 250 to decrypt the encrypted information of the encryption operator OP3_E to generate a decryption result OP3_D. The processor 290 interprets the decryption result OP3_D to generate an output data OUT4. The processor 290 stores the output data OUT4 in the non-security area 121 and switches to the non-security mode. At this time, the final output data (i.e., OUT4) is the inference output.

[0078] The present invention does not limit the content of the software programs 282 and 284. In one possible embodiment, the software programs 282 and 284 are interpreters of TensorFlow lite, which are used to provide a software execution environment for TensorFlow lite. In this example, the processor 290 can interpret each operator in the TensorFlow lite file through the software programs 282 and 284. The processor 290 calls the corresponding function library according to the tag information contained in each operator to perform the corresponding algorithm.

[0079] In some embodiments, function libraries 311-313 constitute the interpretation program code IPC1. The present invention does not limit the number of function libraries. In other embodiments, the interpretation program code IPC1 includes more function libraries. The present invention also does not limit what kind of operations function libraries 311 and 312 perform. Taking function library 311 as an example, function library 311 may perform a convolutional neural network (CNN) operation, a fully connected (FC) operation, or a pooling operation on the corresponding operator and its input data. In other embodiments, different operators may correspond to the same function library. For example, although in Figure 3 In the example, operators OP0 and OP2 correspond to different function libraries, but operators OP0 and OP2 may correspond to the same function library.

[0080] Figure 4 FIG. 2 is a schematic diagram of the processing circuit of the present invention operating in a safe mode. When the processor 290 enters the safe mode, the processor 290 requires the decoding circuit 250 to use the key KY to decrypt the encrypted information of the encryption operator OP1_E to generate a decryption result OP1_D. The processor 290 executes the software program 284 to interpret the decryption result OP1_D.

[0081] In one possible embodiment, the decryption result OP1_D includes a decryption operator OP1_D_1. During the decryption process, the processor 290 reads the tag information contained in the decryption operator OP1_D_1, and uses the output data OUT1 as the input data IN2 of the decryption operator OP1_D_1. The processor 290 calls a function library 411 according to the tag information contained in the decryption operator OP1_D_1. The processor 290 operates on the content information of the decryption operator OP1_D_1 and the input data IN2 according to the function library 411 to generate an output data OUT1_1. After completing the decryption operation, the processor 290 stores the output data OUT1_1 in the non-secure area 121, leaves the secure mode and enters the non-secure mode. In the non-secure mode, the processor 290 uses the output data OUT1_1 as Figure 3 The input data IN3 of the operator OP2 is decoded and the operator OP2 is decoded.

[0082] In another possible embodiment, the decryption result OP1_D includes decryption operators OP1_D_1 to OP1_D_3. In this example, the processor 290 decodes the decryption operator OP1_D_1 to generate output data OUT1_1. Next, the processor 290 decodes the decryption operator OP1_D_2. During the decoding process, the processor 290 reads the tag information included in the decryption operator OP1_D_2 and uses the output data OUT1_1 as the input data IN2_1 of the decryption operator OP1_D_2. The processor 290 calls the function library 411 according to the tag information included in the decryption operator OP1_D_2. The processor 290 operates on the content information of the decryption operator OP1_D_2 and the input data IN2_1 according to the algorithm of the function library 411 to generate an output data OUT1_2.

[0083] Next, the processor 290 decodes the decryption operator OP1_D_3. During the decoding process, the processor 290 reads the tag information contained in the decryption operator OP1_D_3, and uses the output data OUT1_2 as the input data IN2_2 of the decryption operator OP1_D_3. The processor 290 calls the function library 412 according to the tag information contained in the decryption operator OP1_D_3. The processor 290 operates on the content information of the decryption operator OP1_D_3 and the input data IN2_2 according to the function library 412 to generate an output data OUT1_3. After completing the decoding operation, the processor 290 stores the output data OUT1_3 in the non-secure area 121 and enters the non-secure mode. In the non-secure mode, the processor 290 uses the output data OUT1_3 as Figure 3The software program 282 is executed to interpret the operator OP2. In one embodiment, the function libraries 411 and 412 are used as the interpreting program code IPC2.

[0084] Please refer to Figure 3 When the processor 290 decrypts the encryption operator OP3_E, the processor 290 calls the function library 313 according to the tag information of the encryption operator OP3_E. At this time, the processor 290 leaves the non-safe mode and enters the safe mode. In the safe mode, the processor 290 commands the decryption circuit 250 to decrypt the encrypted information of the encryption operator OP3_E to generate a decryption result OP3_D. The processor 290 decrypts the decryption result OP3_D. Since the characteristics of the decryption result OP3_D are similar to the characteristics of the decryption result OP1_D, it will not be repeated. In addition, the way in which the processor 290 decrypts the decryption result OP3_D is the same as the way in which the processor 290 decrypts the decryption result OP1_D, so it will not be repeated.

[0085] Since the neural network model 130" of the non-secure area 121 includes an encryption operator, even if a malicious user steals the neural network model 130", the neural network model 130" cannot be used. Furthermore, since the secure area 122 provides a trusted computing environment, the security of the encryption operators OP1_E and OP3_E can be improved.

[0086] Figure 5 The figure is a flow chart of the protection method of the present invention. The protection method of the present invention is applicable to a microcontroller. The microcontroller has a non-secure area and a secure area. The protection method of the present invention can exist through program code. When the program code is loaded and executed by a machine, the machine becomes a microcontroller and a security system for implementing the present invention.

[0087] A first operator and a first encryption operator are stored in a non-secure area of ​​the microcontroller (step S511), and a key is stored in a secure area of ​​the microcontroller (step S512). In one possible embodiment, the first operator, the first encryption operator, and the key are provided by an offline tool. In this example, the offline tool uses the key to encrypt at least one key operator of a neural network model to generate the first encryption operator. The present invention does not limit the order of steps S511 and S512. In another possible embodiment, step S512 is earlier than step S511.

[0088] In this embodiment, the microcontroller interprets the unencrypted operator in the non-secure area, decrypts the encrypted information of the encrypted operator in the secure area, and then interprets the decrypted operator. For example, in the non-secure mode, the microcontroller interprets the first operator to generate a first output data (step S513). In one possible embodiment, the microcontroller stores the first output data in the non-secure area. In a secure mode, the microcontroller performs steps S514 to S516. Step S514 uses a key to decrypt the encrypted information of the first encrypted operator to generate a first decryption result. Step S515 interprets the first decryption result to generate a second output data. Step S516 stores the second output data to the non-secure area.

[0089] The present invention does not limit the order in which the microcontroller processes the first operator and the first encryption operator. When the priority of the first operator is higher than the priority of the first encryption operator, the microcontroller processes the first operator first and then processes the first encryption operator. Therefore, steps S513 to S516 are performed in sequence. For example, the microcontroller first interprets the first operator in the non-secure area to obtain a first output data. Then, the microcontroller first decrypts the encrypted information of the first encryption operator in the secure area to generate a first decryption result, and then interprets the first decryption result. During the interpretation process, the microcontroller uses the first output data of the first operator as input data of the first decryption result.

[0090] However, when the priority of the first encryption operator is higher than the priority of the first operator, the microcontroller processes the first encryption operator first and then processes the first operator. Therefore, steps S514 to S516 are earlier than step S513. For example, the microcontroller first decrypts the encrypted information of the first encryption operator in the secure area to generate a first decryption result, and then interprets the first decryption result to generate a second output data. During the interpretation process, the microcontroller uses an input data as input data of the first decryption result. Then, the microcontroller interprets the content information of the first operator in the non-secure area and uses the second output data of the first decryption result as input data of the first operator.

[0091] The present invention does not limit how step S513 interprets the first operator. In one possible embodiment, step S513 selects one of the multiple algorithms stored in the non-secure area to operate an input data (or second output data) and the first operator according to the tag information of the first operator to generate the first output data. Similarly, the present invention does not limit how step S515 interprets the first decryption result. In one possible embodiment, step S515 selects one of the multiple algorithms stored in the secure area to operate the first output data (or an input data) and the first decryption result to perform a specific operation according to the tag information of the first decryption result to generate the second output data.

[0092] The present invention does not limit the number of unencrypted operators and encrypted operators in the non-secure area of ​​the microcontroller. The number of encrypted operators may be greater than or less than the number of unencrypted operators. In some embodiments, step S511 further stores a second operator and a second encrypted operator in the non-secure area of ​​the microcontroller. In one possible embodiment, the priority of the first operator is higher than the first encryption operator, the priority of the first encryption operator is higher than the second operator, and the priority of the second operator is higher than the second encryption operator. In this example, the microcontroller is in non-secure mode, and according to the tag information of the first operator, a first algorithm is selected from multiple algorithms stored in the non-secure area to process an input data and a first operator to generate a first output data.

[0093] Next, the microcontroller enters the security mode, first decrypts the encrypted information of the first encryption operator to generate a first decryption result, and then interprets the first decryption result. The microcontroller selects a second algorithm from a plurality of algorithms stored in the security zone to process the first output data and the first decryption result according to the tag information of the first decryption result to generate a second output data.

[0094] Then, the microcontroller enters the non-safe mode. In the non-safe mode, the microcontroller selects a third algorithm from a plurality of algorithms stored in the non-safe area to process a second output data and the second operator according to the tag information of the second operator to generate a third output data. In one possible embodiment, if the tag information of the second operator is the same as the tag information of the first operator, the third algorithm is the same as the first algorithm. In other words, if the tag information of the second operator is the same as the tag information of the first operator, the microcontroller selects the same algorithm to process the first and second operators.

[0095] Next, the microcontroller enters the security mode and first decrypts the encryption information of the second encryption operator to generate a second decryption result. The microcontroller selects a fourth algorithm from a plurality of algorithms stored in the security zone to process the third output data and the second decryption result according to the tag information of the second decryption result to generate a fourth output data. Since the second encryption operator is the final operator, the microcontroller outputs the fourth output data as an inference. In one possible embodiment, if the tag information of the second encryption operator is the same as the tag information of the first encryption operator, the fourth algorithm is the same as the second algorithm. In other words, if the tag information of the second encryption operator is the same as the tag information of the first encryption operator, the microcontroller selects the same algorithm to process the first and second encryption operators.

[0096] The protection method of the present invention, or a specific form or part thereof, may exist in the form of program code. The program code may be stored in a physical medium, such as a floppy disk, a CD, a hard disk, or any other machine-readable (such as computer-readable) storage medium, or a computer program product not limited to an external form, wherein when the program code is loaded and executed by a machine, such as a computer, the machine becomes used to participate in the microcontroller and security system of the present invention. The program code may also be transmitted through some transmission medium, such as wires or cables, optical fibers, or any transmission form, wherein when the program code is received, loaded and executed by a machine, such as a computer, the machine becomes used to participate in the microcontroller and security system of the present invention. When implemented in a general-purpose processing unit, the program code combines with the processing unit to provide a unique device that operates similarly to an application-specific logic circuit.

[0097] Unless otherwise defined, all words (including technical and scientific words) herein are generally understood by those skilled in the art to which the present invention belongs. In addition, unless expressly indicated, the definitions of words in general dictionaries should be interpreted as consistent with the meanings in articles in the relevant technical field, and should not be interpreted as ideal or overly formal. Although the terms "first", "second", etc. can be used to describe various elements, these elements should not be limited by these terms. These terms are only used to distinguish one element from another element.

[0098] Although the present invention has been disclosed as above with preferred embodiments, it is not intended to limit the present invention. Any person skilled in the art may make some changes and modifications without departing from the spirit and scope of the present invention. For example, the system, device or method described in the embodiments of the present invention may be implemented in a physical embodiment of hardware, software or a combination of hardware and software. Therefore, the scope of protection of the present invention shall be subject to the scope defined by the attached claims.

Claims

1. A microcontroller, characterized in that: include:

1. Non-safety area, including: A first storage circuit stores a neural network model, wherein the neural network model includes an encrypted operator and a first unencrypted operator; A safety zone, including: a key management device storing a key; a decryption circuit, using the key to decrypt the encryption operator to generate a decryption result; a second storage circuit for storing the decryption result; a processing circuit for decrypting the first unencrypted operator and the decryption result; in: In a non-secure mode, the processing circuit decrypts the first unencrypted operator to generate a first output data; In safe mode: The processing circuit instructs the decryption circuit to decrypt the encryption operator using the key; The processing circuit interprets the decryption result to generate a second output data; The processing circuit stores the second output data in the first storage circuit.

2. The microcontroller according to claim 1, characterized in that The processing circuit uses an input data when deciphering the first unencrypted operator, and uses the first output data when deciphering the encrypted operator.

3. The microcontroller according to claim 1, wherein: The processing circuit uses an input data when decrypting the encrypted operator and uses the second output data when decrypting the first unencrypted operator.

4. The microcontroller according to claim 1, characterized in that The processing circuit executes a first software program to read a first tag information included in the first unencrypted operator. The processing circuit selects a first function library according to the first tag information and uses the first function library to process a first input data and the first unencrypted operator to generate the first output data.

5. The microcontroller according to claim 4, characterized in that The decryption result includes a first decryption operator and a second decryption operator; The processing circuit executes a second software program for reading a second tag information included in the first decryption operator and reading a third tag information included in the second decryption operator; The processing circuit selects a second function library according to the second tag information, and uses the second function library to process the first output data and the first decryption operator to generate a third output data; The processing circuit selects a third function library according to the third tag information, and uses the third function library to process the third output data and the second decryption operator to generate the second output data.

6. The microcontroller according to claim 4, characterized in that The decryption result includes a decryption operator, and the processing circuit executes a second software program to read a second tag information included in the decryption operator; The processing circuit selects a second function library according to the second tag information, and uses the second function library to process the first output data and the decryption operator to generate the second output data.

7. A security system, characterized in that: include: An offline tool, including: an encryption circuit, receiving a neural network model, the neural network model including a first operator and a second operator, the encryption circuit encrypting the second operator using a first key to generate a first encrypted operator; and A microcontroller, comprising:

1. Non-safety area, including: a first storage circuit for storing the first operator and the first encryption operator; A safety zone, including: a key management device storing the first key; a decryption circuit, using the first key to decrypt the first encryption operator to generate a decryption result; a second storage circuit for storing the decryption result; a processing circuit for interpreting the first operator and the decryption result; in: In a non-secure mode, the processing circuit interprets the first operator to generate a first output data; In a security mode, the processing circuit interprets the decryption result to generate a second output data, and stores the second output data in the first storage circuit.

8. The security system according to claim 7, characterized in that Also includes: a first memory storing a first software program; as well as a second memory storing a second software program; in: In the non-secure mode, the processing circuit executes the first software program to interpret the first operator; In the security mode, the processing circuit executes the second software program to interpret the decryption result.

9. A protection method, characterized in that: Applicable to a microcontroller having a non-secure area and a secure area, the protection method comprises: storing a first operator and a first encryption operator in the non-secure area; storing a key in the secure area; In a non-secure mode: Decoding the first operator to generate a first output data; In safe mode: Decrypting the first encryption operator using the key to generate a first decryption result; Decoding the first decryption result to generate a second output data; The second output data is stored in the non-safe area.

10. The protection method according to claim 9, characterized in that: The step of interpreting the first decryption result comprises: Reading a first mark information of the first decryption result; According to the first marking information, a first algorithm is selected from a plurality of algorithms to process the first output data and the first decryption result to generate the second output data.

Images