Core particle-oriented secure communication system and data transmission method

Abstract

The invention relates to the technical field of electronic information security, in particular to a core particle-oriented secure communication system and a data transmission method, which are realized by using a security chip and security IP (Internet Protocol) cores integrated in each core particle, the security management and control core particle dynamically configures corresponding security protocols and security measures according to task requirements; the security IP core is used for encrypting data transmitted among the core particles by using the session key; and each core particle is connected with the security control core particle, and the security control core particle performs identity verification on each core particle and assists each core particle in generating a session key for transmitting data encryption. According to the method, the security of data transmission among the core particles can be improved, meanwhile, the potential compatibility problem from different core particle design companies is solved, the protection capability of the whole system for resisting intrusive physical attacks is enhanced, and the security communication among the core particles of a general core particle integrated system can be realized.

Description

Technical Field

[0001] The present invention relates to the field of electronic information security technology, and in particular to a chip-oriented secure communication system and a data transmission method. Background Art

[0002] In the post-Moore era, 2D, 2.5D or 3D integration technologies based on the chiplet architecture are receiving more and more attention. These design methods divide the entire integrated circuit system into smaller "chiplets" and then achieve heterogeneous integration through advanced system-in-package (SiP) technology. The rise of chiplets provides a new idea and method for high-performance and cost-effective chip integration, with advantages such as improving chip yield, reducing development costs, reducing energy consumption, and improving performance. However, the design and implementation of a single chiplet still basically follows the supply chain model of traditional SoC chips, and chiplets will still face security threats in SoC design and manufacturing, such as overproduction, piracy, cloning, hardware Trojans, etc. At the same time, since chiplets need to be integrated at a high density at the packaging level and build the entire system, various sensitive data and information are transmitted and flowed at the packaging level. Compared with SoC, the attacks they face are more complex and are prone to security threats at the packaging level. For example, it is more vulnerable to physical intrusion attacks. Attackers can take advantage of the lack of high-density metal interconnects in the package substrate and use microprobes, focused ion beams (FIB), etc. to penetrate the package substrate to cut, add or modify the interconnects on the interposer and detect sensitive data inside. In addition, the package interposer needs to be manufactured by a specific foundry, and there is also a security risk that the foundry may implant hardware Trojans and malicious circuits inside the interposer.

[0003] Therefore, it is necessary to design a secure communication architecture and protocol based on the communication characteristics between chiplets, to ensure the security of data transmission between chiplets, and to resist invasive attacks faced by the packaging level. In existing patent applications, such as the Chinese patent (application number CN202310802966.6, patent name: Data transmission method for chiplet interconnection interface and chiplet interconnection interface), it only focuses on data transmission between chiplets, and does not consider security; another example is the Chinese patent (application number: CN202410859124.9, patent name: A hierarchical link management method and chip compatible with multiple chiplet interconnection interfaces), which designs a hierarchical link management method and chip for multiple chiplet interconnection interfaces, and does not consider the security mechanism in communication and management; another example is the Chinese patent (application number: CN202410859124.9, patent name: A hierarchical link management method and chip compatible with multiple chiplet interconnection interfaces. The core point of the patent is that the chiplet, based on its own security status, will alert the trusted central node and take corresponding security strategies if a threat is found, but it does not design security mechanisms such as data transmission between chiplets. Another example is the Chinese patent (application number: CN202310080538.7, patent name: Task processing method and security chip device for multi-chip heterogeneous security chips), which is based on the completion of the required encryption tasks based on multiple chiplets, and is not a general chiplet integrated system. For this reason, there is an urgent need for a data security transmission method for a general chiplet integrated system to resist the invasive attack faced by the packaging layer. Summary of the invention

[0004] To this end, the present invention provides a chip-oriented secure communication system and data transmission method to solve the problems of secure data transmission in existing general chip integration systems and resistance to invasive attacks on the encapsulation layer.

[0005] According to the design scheme provided by the present invention, on the one hand, a chiplet-oriented secure communication system is provided, comprising a multi-chiplet system, wherein the multi-chiplet system comprises: The security control core is composed of multiple encryption components, and the security control core dynamically configures corresponding security protocols and security measures according to task requirements; and at least two chiplets integrated with a security IP core, wherein the security IP core is used to encrypt data transmitted between chiplets using a session key; Each chip is connected to a security control chip, which authenticates each chip and assists each chip in generating a session key for encrypting the transmitted data.

[0006] As the chip-oriented secure communication system of the present invention, further, the security control chip integrates a variety of sensors for detecting physical attack behaviors.

[0007] As the chip-oriented secure communication system of the present invention, further, the security control chip is implemented using a reconfigurable programmable logic array.

[0008] As a secure communication system for chiplets of the present invention, further, the security control chiplet adopts a public key algorithm to authenticate the identity of each chiplet, wherein the public key is uniformly stored by the security control chiplet, and the private key of each chiplet is stored by the corresponding security IP core.

[0009] On the other hand, the present invention also provides a method for transmitting data between chips, which is implemented based on the above-mentioned secure communication system, and the implementation process includes: After the system is powered on, the security control chip and the security IP cores of each chip are started, and the security control chip is used to perform identity authentication and session key exchange with each chip; The chiplets that have passed the identity authentication are activated to select the chiplets with corresponding functions according to the task requirements, and the corresponding tasks are executed through the secure data interaction between the chiplets.

[0010] As the inter-chiplet data transmission method of the present invention, further, the security control chip is used to authenticate the identity of each chiplet, including: using a one-way authentication protocol based on a public key algorithm to authenticate the identity of each chiplet.

[0011] As the data transmission method between chips of the present invention, further, the identity authentication process of each chip based on the one-way authentication protocol of the public key algorithm includes: First, the security control chip generates a raw random number and sends it to each chip; Next, the security IP core in each chip uses the chip's own private key to encrypt the received original random number and sends the encryption result to the security control chip; Then, the security control chip uses the stored corresponding chip public key to decrypt the received encryption result and obtain the encrypted random number, and compares the encrypted random number with the original random number. If the random numbers are consistent, it is determined that the corresponding chip identity authentication has passed.

[0012] As the inter-chiplet data transmission method of the present invention, further, the data of the secure interaction between each chiplet and the security control chiplet is encrypted using a session key negotiated by both parties.

[0013] As the inter-chip-grain data transmission method of the present invention, further, the data for secure interaction between the chiplets is encrypted by a session key generated by the security control chip according to the data interaction request.

[0014] The method for transmitting data between chips and particles of the present invention further includes: the security control chip uses a security protocol to monitor the attack behaviors faced by the system in real time, and controls the detected attack behaviors through security measures.

[0015] Beneficial effects of the present invention: The present invention realizes data transmission of a multi-chiplet system by securely controlling chiplets and a security IP core integrated on each chiplet, thereby improving the security of data transmission between chiplets, while solving potential compatibility issues from different chiplet design companies, enhancing the protection capability of the entire system against invasive physical attacks, and realizing secure communication between chiplets in a universal chiplet integrated system. DETAILED DESCRIPTION In order to make the purpose, technical solution and advantages of the present invention clearer and more understandable, the present invention is further described in detail below in conjunction with the technical solution.

[0017] To ensure the security of data transmission between chiplets and prevent attackers from detecting data transmission of chiplets at the packaging level through invasive attack methods. When transmitting data between chiplets, the sender's chiplet must verify the identity of the receiver's chiplet and establish a session key. To achieve this, all chiplets in the SiP must follow standardized authentication and key exchange protocols. However, in actual design, these chiplets come from different chiplet design companies and perform different tasks in the system. Therefore, these chiplets may not have the hardware and software to establish secure communications. In order to solve potential compatibility issues, an embodiment of the present invention provides a chiplet-oriented secure communication system, including a multi-chiplet system, wherein the multi-chiplet system includes: The security control core is composed of multiple encryption components, and the security control core dynamically configures corresponding security protocols and security measures according to task requirements; and at least two chiplets integrated with a security IP core, wherein the security IP core is used to encrypt data transmitted between chiplets using a session key; Each chip is connected to a security control chip, which authenticates each chip and assists each chip in generating a session key for encrypting transmitted data.

[0018] An IP core (Intellectual Property core) is a hardware description language program with specific circuit functions. This program is independent of the integrated circuit process and can be transplanted to different semiconductor processes to produce integrated circuit chips. In this embodiment, the security IP core uses a specified encryption algorithm to securely encrypt data transmitted between chips. By integrating a security IP core in each chip, the security IP core is independent of the chip design and can be easily integrated inside different chips; at the same time, in the entire SiP system, a separate security control chip is used to realize the identity authentication of other chips and the monitoring of secure data communication, so as to improve the security of data transmission between chips and enhance the protection of the entire system against invasive physical attacks.

[0019] Among them, the security control chip is composed of various cryptographic components, such as asymmetric cryptographic engines, hash algorithm engines, hash functions, true random number generators (TRNG), etc., which are used to perform security functions. As a dedicated centralized root of trust chip, the security control chip can be integrated into different SiP systems to ensure comprehensive defense against various security risks. When designing the SiP system, relevant security rules and protocols are constructed as needed, and the security control chip is configured and implemented.

[0020] The security control chip is a dynamically configurable chip. As the root of trust for the entire SiP system, it can be implemented as a dedicated chip or a programmable logic array FPGA. The security control chip has a reconfigurable feature and can be dynamically configured to implement different security protocols according to requirements. It integrates a variety of sensors such as EM / laser / voltage detection sensors, fault-time sensors, etc. to detect physical attacks such as voltage / clock fault attacks and establishment time violations. Once an attack is detected, the security control chip will activate the preset security measures for control processing, including data destruction.

[0021] The security IP core may include a cryptographic engine, a true random number generator (TRNG), etc., and can interact with the security control chip to achieve identity authentication and establish session keys, ensuring the security of subsequent data transmission. Other companies can integrate the security IP core into the chip when designing the chip. The data transmission between the chips is encrypted by the security IP core and the encrypted interaction data is sent out.

[0022] Furthermore, based on the above system, an embodiment of the present invention also provides a method for transmitting data between chiplets, comprising: After the system is powered on, the security control chip and the security IP cores of each chip are started, and the security control chip is used to perform identity authentication and session key exchange with each chip; The chiplets that have passed the identity authentication are activated to select the chiplets with corresponding functions according to the task requirements, and the corresponding tasks are executed through the secure data interaction between the chiplets.

[0023] The entire system can use a public key algorithm to achieve identity authentication between chiplets. The security IP core in each chiplet stores a unique private key for encryption of the chiplet, and its public key is uniformly stored by the security control chiplet.

[0024] After power-on, the security control chiplet starts up first, and each chiplet only starts up the corresponding security IP core. After that, the security control chiplet needs to authenticate each chiplet. Only after the authentication is passed can the corresponding chiplet start up later. The authentication process can adopt the traditional one-way authentication protocol based on the public key algorithm. The specific process can be described as follows: 1) The security control chip generates a random number R and sends it to chip 1; 2) After receiving R, core particle 1 encrypts the received R with its stored private key s1 and sends it to the security control core particle; 3) After receiving the data, the security control chip verifies the signature with the public key of the internally stored chip 1 to obtain R, and compares it with the original R. If they are consistent, the identity authentication of chip 1 is passed.

[0025] The identity authentication process of other core particles is the same as that of core particle 1, and will not be described one by one here.

[0026] After the core particle identity authentication is passed, the security control core particle can interact with the core particle for data. The session key used for data interaction is generated through negotiation between the two parties.

[0027] If data exchange is required between chiplets, the initiator needs to apply to the security control chiplet, which will coordinate the generation of session keys and distribute them to each chiplet. The chiplets will then use the key for data communication.

[0028] Unless otherwise specifically stated, the relative steps, numerical expressions and values ​​of the components and steps set forth in these embodiments do not limit the scope of the present invention.

[0029] In this specification, each embodiment is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can be referred to each other. For the system disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part.

[0030] The units and method steps of each example described in conjunction with the embodiments disclosed herein can be implemented by electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. A person of ordinary skill in the art may use different methods to implement the described functions for each specific application, but such implementation is not considered to be beyond the scope of the present invention.

[0031] Those skilled in the art will appreciate that all or part of the steps in the above method can be completed by instructing related hardware through a program, and the program can be stored in a computer-readable storage medium, such as a read-only memory, a disk or an optical disk. Optionally, all or part of the steps in the above embodiment can also be implemented using one or more integrated circuits, and accordingly, each module / unit in the above embodiment can be implemented in the form of hardware or in the form of software function modules. The present invention is not limited to any specific form of combination of hardware and software.

[0032] Finally, it should be noted that the above-described embodiments are only specific implementations of the present invention, which are used to illustrate the technical solutions of the present invention, rather than to limit them. The protection scope of the present invention is not limited thereto. Although the present invention is described in detail with reference to the above-described embodiments, ordinary technicians in the field should understand that any technician familiar with the technical field can still modify the technical solutions recorded in the above-described embodiments within the technical scope disclosed by the present invention, or can easily think of changes, or make equivalent replacements for some of the technical features therein; and these modifications, changes or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention shall be subject to the protection scope of the claims.

Claims

1. A chiplet-oriented secure communication system, comprising a multi-chiplet system, characterized in that: The multi-core particle system comprises: The security control core is composed of multiple encryption components, and the security control core dynamically configures corresponding security protocols and security measures according to task requirements; and at least two chiplets integrated with a security IP core, wherein the security IP core is used to encrypt data transmitted between chiplets using a session key; Each chip is connected to a security control chip, which authenticates each chip and assists each chip in generating a session key for encrypting transmitted data.

2. The chiplet-oriented secure communication system according to claim 1, characterized in that: The security control core integrates a variety of sensors for detecting physical attack behaviors.

3. The chiplet-oriented secure communication system according to claim 1 or 2, characterized in that: The security control core particle is implemented using a reconfigurable programmable logic array.

4. The chiplet-oriented secure communication system according to claim 1, characterized in that: The security control chip uses a public key algorithm to authenticate the identity of each chip, where the public key is uniformly stored by the security control chip, and the private key of each chip is stored by the corresponding security IP core.

5. A method for transmitting data between chips, characterized in that: Based on the implementation of the secure communication system according to claim 1, the implementation process includes: After the system is powered on, the security control chip and the security IP cores of each chip are started, and the security control chip is used to perform identity authentication and session key exchange with each chip; The chiplets that have passed the identity authentication are activated to select the chiplets with corresponding functions according to the task requirements, and the corresponding tasks are executed through the secure data interaction between the chiplets.

6. The method for transmitting data between chips according to claim 5, characterized in that: The security control chip is used to authenticate the identities of the chips, including: using a one-way authentication protocol based on a public key algorithm to authenticate the identities of the chips.

7. The PPP / INS / LiDAR combined positioning method based on graph optimization according to claim 6 is characterized in that: The one-way authentication protocol based on the public key algorithm performs the identity authentication process for each chip, including: First, the security control chip generates a raw random number and sends it to each chip; Next, the security IP core in each chip uses the chip's own private key to encrypt the received original random number and sends the encryption result to the security control chip; Then, the security control chip uses the stored corresponding chip public key to decrypt the received encryption result and obtain the encrypted random number, and compares the encrypted random number with the original random number. If the random numbers are consistent, it is determined that the corresponding chip identity authentication has passed.

8. The method for transmitting data between chips according to claim 5, characterized in that: The data of the secure interaction between each chiplet and the security control chiplet is encrypted using the session key negotiated by both parties.

9. The method for transmitting data between chips according to claim 5, characterized in that: The data exchanged securely between the chips is encrypted by the session key generated by the security control chip based on the data exchange request.

10. The method for transmitting data between chips according to claim 5, characterized in that: It also includes: The security control chip uses security protocols to monitor the attack behaviors faced by the system in real time, and controls the detected attack behaviors through security measures.