Verification method and device of dual-code security module, electronic equipment and storage medium

Abstract

Embodiments of the present application provide a kind of double code security module verification method, device, electronic equipment and storage medium, the method comprises: obtaining the excitation signal for verifying the chip to be tested;The excitation signal is converted into driving signal;According to driving signal, double code security module in the chip to be tested is handled, and processing result is obtained;According to processing result and preset verification result, the verification result corresponding to double code security module in the chip to be tested is determined, in the present application embodiment, according to the function of double code security module to be tested, corresponding excitation signal is set, then the excitation signal is converted into driving signal, and the driving signal is input into double code security module in the chip to be tested, and an output result is obtained, the output result is compared with preset check result, and then it is judged whether the double code security module meets the requirements, so that each function of double code security module can be tested, so that double code security module is more comprehensively verified.

Description

Technical Field

[0001] This application relates to the field of computer technology, and more specifically, to a verification method, apparatus, electronic device, and storage medium for a dual-code security module. Background Technology

[0002] As chip technology continues to advance, the demands on chip functionality are also increasing. Dividing the chip's internal memory into two independent areas, each with its own independent 128-bit CSM (Card Security Module) password, is called a Dual Code Security Module (DCSM). This DCSM prevents unauthorized access to encrypted content, effectively preventing your code from being duplicated or reverse-compiled. Simultaneously, code requiring maintenance and upgrades can be stored in another independent area and authorized for use by designated personnel. Properly utilizing this feature can further enhance product security and usability.

[0003] Currently, Verilog HDL is used to write different test cases to verify the various functions of the DCSM module, or system-level test cases written in assembly language are used in the SOC system-on-a-chip to verify the various functions of the DCSM dual-code security module. However, due to the complexity of the DCSM dual-code security module's functions and its internal cryptographic logic, existing methods cannot determine the configuration mode and security function defects of the DCSM dual-code security module. How to more comprehensively verify the functions of the DCSM dual-code security module in the chip is an urgent problem to be solved. Summary of the Invention

[0004] The purpose of some embodiments of this application is to provide a verification method, apparatus, electronic device, and storage medium for a dual-code security module. The technical solution of this application involves acquiring an excitation signal for verifying a chip under test; converting the excitation signal into a drive signal; processing the dual-code security module in the chip under test according to the drive signal to obtain a processing result; and determining a verification result corresponding to the dual-code security module in the chip under test based on the processing result and a preset verification result. In this application embodiment, a corresponding excitation signal is set according to the function of the dual-code security module to be tested, and then the excitation signal is converted into a drive signal. This drive signal is input into the dual-code security module in the chip under test to obtain an output result. The output result is compared with a preset verification result, and the dual-code security module is judged to meet the requirements based on the comparison result. This allows for testing of various functions of the dual-code security module, thus providing a more comprehensive security verification of the dual-code security module.

[0005] Firstly, some embodiments of this application provide a verification method for a dual-code security module, including:

[0006] Obtain the stimulus signal for verifying the chip under test;

[0007] Convert the excitation signal into a drive signal.

[0008] The dual-code security module in the chip under test is processed according to the driving signal to obtain the processing result;

[0009] Based on the processing results and the preset verification results, the verification result corresponding to the dual-code security module in the chip under test is determined.

[0010] Some embodiments of this application set corresponding excitation signals according to the functions of the dual-code security module to be tested, then convert the excitation signals into driving signals, and input the driving signals into the dual-code security module in the chip under test to obtain an output result. The output result is compared with the preset verification result, and the dual-code security module is judged to meet the requirements based on the comparison result. In this way, the various functions of the dual-code security module can be tested, thus providing a more comprehensive security verification of the dual-code security module.

[0011] Optionally, converting the excitation signal into a drive signal includes:

[0012] The excitation signal is randomized to obtain the processed excitation signal;

[0013] The processed excitation signal is converted to obtain a driving signal corresponding to the excitation signal.

[0014] Some embodiments of this application randomize the generated stimuli to obtain a processed stimuli signal, and then convert the processed stimuli signal to obtain a corresponding driving signal. Different stimuli signals can be set, and the addition of randomization processing makes it suitable for different testing needs and makes the verification more accurate.

[0015] Optionally, the method further includes:

[0016] Obtain the first signal from the dual-code security module within the chip under test;

[0017] The first signal is compared with a preset configuration signal to obtain a comparison result, which is used to locate abnormal signals in the first signal.

[0018] Some embodiments of this application obtain the first signal of the dual-code security module in the chip under test and compare it with the preset configuration signal. This allows for the monitoring of signals within the chip under test, and if any abnormality is found, the location of the abnormality can be determined.

[0019] Optionally, the step of processing the dual-code security module in the chip under test according to the driving signal to obtain the processing result includes:

[0020] Each area in the dual-code security module is encrypted using a preset encryption password to obtain the encryption result.

[0021] The encryption result is decrypted using a preset decryption password to obtain a decryption result; wherein the preset encryption password and the preset decryption password correspond to each other;

[0022] The encryption result and the decryption result are used as the processing result.

[0023] In some embodiments of this application, a driving signal is input to the dual-code security module to obtain an output result, i.e., a processing result, which is used for subsequent comparison with a preset password to verify the dual-code security module.

[0024] Optionally, the step of decrypting the encryption result using a preset decryption password to obtain a decryption result includes:

[0025] The first and second data of the first register in the chip under test are obtained through the bus protocol.

[0026] Based on the first data, the first region is determined;

[0027] Based on the second data, the second region is determined;

[0028] By performing a preset pseudo-read operation, the first password corresponding to the first region is calculated, and the second password corresponding to the first password register is determined based on the first password; and the third password corresponding to the second region is calculated, and the fourth password corresponding to the second password register is determined based on the third password.

[0029] If the second password matches the preset password, the first area is successfully decrypted; if the fourth password matches the preset password, the second area is successfully decrypted.

[0030] If the second password does not match the preset password, or the fourth password does not match the preset password, then the decryption result is determined to be a decryption failure.

[0031] Some embodiments of this application calculate the password for each area by using a preset pseudo-read operation, and then compare the password with the preset password. If they match, the decryption is successful; if they do not match, the decryption fails. The decryption result is used to determine whether the dual-code security module has passed the verification.

[0032] Optionally, before acquiring the excitation signal for verifying the chip under test, the method further includes:

[0033] A pseudo-read operation is used to initialize the dual-code security module in the chip under test, and an initialization signal is obtained.

[0034] If the initialization signal is a preset signal, then the initialization operation of the dual-code security module in the chip under test is successful.

[0035] Some embodiments of this application pre-initialize the dual-code security module to improve the accuracy of subsequent verification.

[0036] Secondly, some embodiments of this application provide a verification device for a dual-code security module, including:

[0037] The acquisition module is used to acquire the stimulus signal for verifying the chip under test;

[0038] The conversion module is used to convert the excitation signal into a drive signal;

[0039] The processing module is used to process the dual-code security module in the chip under test according to the driving signal and obtain the processing result;

[0040] The verification module is used to determine the verification result corresponding to the dual-code security module in the chip under test based on the processing result and the preset verification result.

[0041] Some embodiments of this application set corresponding excitation signals according to the functions of the dual-code security module to be tested, then convert the excitation signals into driving signals, and input the driving signals into the dual-code security module in the chip under test to obtain an output result. The output result is compared with the preset verification result, and the dual-code security module is judged to meet the requirements based on the comparison result. In this way, the various functions of the dual-code security module can be tested, thus providing a more comprehensive security verification of the dual-code security module.

[0042] Optionally, the conversion module is used for:

[0043] The excitation signal is randomized to obtain the processed excitation signal;

[0044] The processed excitation signal is converted to obtain a driving signal corresponding to the excitation signal.

[0045] Some embodiments of this application randomize the generated stimuli to obtain a processed stimuli signal, and then convert the processed stimuli signal to obtain a corresponding driving signal. Different stimuli signals can be set, and the addition of randomization processing makes it suitable for different testing needs and makes the verification more accurate.

[0046] Optionally, the verification module is used for:

[0047] Obtain the first signal from the dual-code security module within the chip under test;

[0048] The first signal is compared with a preset configuration signal to obtain a comparison result, which is used to locate abnormal signals in the first signal.

[0049] Some embodiments of this application obtain the first signal of the dual-code security module in the chip under test and compare it with the preset configuration signal. This allows for the monitoring of signals within the chip under test, and if any abnormality is found, the location of the abnormality can be determined.

[0050] Optionally, the processing module is used for:

[0051] Each area in the dual-code security module is encrypted using a preset encryption password to obtain the encryption result.

[0052] The encryption result is decrypted using a preset decryption password to obtain a decryption result; wherein the preset encryption password and the preset decryption password correspond to each other;

[0053] The encryption result and the decryption result are used as the processing result.

[0054] In some embodiments of this application, a driving signal is input to the dual-code security module to obtain an output result, i.e., a processing result, which is used for subsequent comparison with a preset password to verify the dual-code security module.

[0055] Optionally, the processing module is used for:

[0056] The first and second data of the first register in the chip under test are obtained through the bus protocol.

[0057] Based on the first data, the first region is determined;

[0058] Based on the second data, the second region is determined;

[0059] By performing a preset pseudo-read operation, the first password corresponding to the first region is calculated, and the second password corresponding to the first password register is determined based on the first password; and the third password corresponding to the second region is calculated, and the fourth password corresponding to the second password register is determined based on the third password.

[0060] If the second password matches the preset password, the first area is successfully decrypted; if the fourth password matches the preset password, the second area is successfully decrypted.

[0061] If the second password does not match the preset password, or the fourth password does not match the preset password, then the decryption result is determined to be a decryption failure.

[0062] Some embodiments of this application calculate the password for each area by using a preset pseudo-read operation, and then compare the password with the preset password. If they match, the decryption is successful; if they do not match, the decryption fails. The decryption result is used to determine whether the dual-code security module has passed the verification.

[0063] Optionally, the acquisition module is further configured to:

[0064] A pseudo-read operation is used to initialize the dual-code security module in the chip under test, and an initialization signal is obtained.

[0065] If the initialization signal is a preset signal, then the initialization operation of the dual-code security module in the chip under test is successful.

[0066] Some embodiments of this application pre-initialize the dual-code security module to improve the accuracy of subsequent verification.

[0067] Thirdly, some embodiments of this application provide an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, it can implement the verification method of the dual-code security module as described in any embodiment of the first aspect.

[0068] Fourthly, some embodiments of this application provide a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, can implement the verification method of the dual-code security module as described in any embodiment of the first aspect.

[0069] Fifthly, some embodiments of this application provide a computer program product, the computer program product including a computer program, wherein when the computer program is executed by a processor, it can implement the verification method of the dual-code security module as described in any embodiment of the first aspect. Attached Figure Description

[0070] To more clearly illustrate the technical solutions of some embodiments of this application, the accompanying drawings used in some embodiments of this application will be briefly described below. It should be understood that the following drawings only show some embodiments of this application and should not be regarded as a limitation of the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0071] Figure 1 A flowchart illustrating a verification method for a dual-code security module provided in an embodiment of this application;

[0072] Figure 2 A schematic diagram of the structure of a module-level general verification platform based on SV provided in an embodiment of this application;

[0073] Figure 3 A schematic diagram of the decryption process provided in an embodiment of this application;

[0074] Figure 4 A schematic diagram of the structure of a verification device for a dual-code security module provided in an embodiment of this application;

[0075] Figure 5 This is a schematic diagram of an electronic device provided in an embodiment of this application. Detailed Implementation

[0076] The technical solutions of some embodiments of this application will now be described with reference to the accompanying drawings.

[0077] It should be noted that similar reference numerals and letters in the following figures indicate similar items; therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures. Furthermore, in the description of this application, terms such as "first," "second," etc., are used only to distinguish descriptions and should not be construed as indicating or implying relative importance.

[0078] As chip technology continues to advance, the demands on chip functionality are also increasing. Dividing the chip's internal memory into two independent areas, each with its own independent 128-bit CSM (Card Security Module) password, is called a Dual Code Security Module (DCSM). This DCSM prevents unauthorized access to encrypted content, effectively preventing your code from being duplicated or reverse-compiled. Simultaneously, code requiring maintenance and upgrades can be stored in another independent area and authorized for use by designated personnel. Properly utilizing this feature can further enhance product security and usability.

[0079] Currently, Verilog HDL is used to write different test cases to verify the various functions of the DCSM module, or system-level test cases written in assembly language are used in a SOC system-on-a-chip to verify the various functions of the DCSM dual-code security module. However, due to the complexity of the DCSM dual-code security module's functions and its intricate internal cryptographic logic, existing methods cannot determine the configuration mode and security function defects of the DCSM dual-code security module. Therefore, some embodiments of this application provide a verification method for a dual-code security module. This method includes acquiring an excitation signal for verifying the chip under test; converting the excitation signal into a drive signal; and according to the drive signal... The system processes the dual-code security module in the chip under test using a dynamic signal to obtain a processing result. Based on the processing result and a preset verification result, a verification result corresponding to the dual-code security module in the chip under test is determined. In this embodiment, a corresponding excitation signal is set according to the function to be tested, and then the excitation signal is converted into a driving signal. This driving signal is input to the dual-code security module in the chip under test to obtain an output result. The output result is compared with the preset verification result, and the dual-code security module is judged to meet the requirements based on the comparison result. This allows for testing of various functions of the dual-code security module, thus providing a more comprehensive security verification of the dual-code security module.

[0080] like Figure 1 As shown, an embodiment of this application provides a verification method for a dual-code security module, the method comprising:

[0081] S101. Obtain the excitation signal for verifying the chip under test;

[0082] Specifically, to ensure the security of the dual-code security module in the chip under test (DUT), the DUT needs to be verified before using the chip. The terminal device uses a signal generator to generate an excitation signal to verify the DUT. This excitation signal can be a control signal, a rectangular wave, a square wave, or any other arbitrary waveform; no specific limitation is made in this embodiment. The dual-code security module in the DUT is the DUT itself.

[0083] S102, Convert the excitation signal into a drive signal;

[0084] Specifically, the terminal device converts the excitation signal into a drive signal and verifies the security of the dual-code security module based on the drive signal.

[0085] S103. Based on the driving signal, process the dual-code security module in the chip under test to obtain the processing result;

[0086] Specifically, the terminal device inputs the drive signal into the dual-code security module in the chip under test to obtain the output waveform. The terminal device monitors the input signal and output waveform of the dual-code security module in real time.

[0087] S104. Based on the processing results and preset verification results, determine the verification result corresponding to the dual-code security module in the chip under test.

[0088] Specifically, the terminal device converts the obtained output waveform into a first digital signal, compares the first digital signal with a preset verification result, i.e., a second digital signal. If the first digital signal and the second digital signal match, it means that the dual-code security module of the chip has passed the verification; if the first digital signal and the second digital signal do not match, it means that the dual-code security module of the chip has failed the verification.

[0089] This application proposes a DCSM verification method based on SV. The method involves configuring the excitation signal of the test routine and performing a randomization operation (i.e., digitization) on the excitation signal to convert it into a digital signal; calling the driver function to operate the serial port on the DUT bus; collecting the signals output by the DUT during the test; comparing the processed collected signals with the randomized expected result (i.e., the preset verification result); and saving the output data and the comparison result in a preset log file format.

[0090] Some embodiments of this application set corresponding excitation signals according to the functions of the dual-code security module to be tested, then convert the excitation signals into driving signals, and input the driving signals into the dual-code security module in the chip under test to obtain an output result. The output result is compared with the preset verification result, and the dual-code security module is judged to meet the requirements based on the comparison result. In this way, the various functions of the dual-code security module can be tested, thus providing a more comprehensive security verification of the dual-code security module.

[0091] Another embodiment of this application further supplements the description of the verification method for the dual-code security module provided in the above embodiments.

[0092] Figure 2 This is a schematic diagram of the structure of the SV-based module-level general verification platform provided in the embodiments of this application, as shown below. Figure 2 As shown, this SV-based module-level general verification platform includes:

[0093] Signal layer:

[0094] Interface: Connects the DUT to the driver and detector, which are written in SV language.

[0095] Command layer:

[0096] Driver: Converts excitation signals into drive signals to drive the DUT under test, that is, inputs the drive signal into the DUT and outputs waveform signals;

[0097] Monitor: Monitors the DUT simulation signal and converts the DUT simulation signal into data (coordinates, data visualization);

[0098] Assertion: Modeling system behavior based on clock cycles, i.e., pre-configuring signals;

[0099] Functional layer:

[0100] Generator: Used to generate the excitation signals required for DUT simulation;

[0101] Agent: Saves the excitation signal of the generator, and then sends the excitation signal to the driver in waveform order or signal timing sequence.

[0102] Verifier: Receives data from the monitor and compares the output signal of the DUT with the expected, i.e., the preset verification result, to obtain the verification result corresponding to the dual-code security module in the chip under test. The verification result is used to determine whether the dual-code security module in the chip under test is secure.

[0103] Optionally, the excitation signal is converted into a drive signal, including:

[0104] The excitation signal is randomized to obtain the processed excitation signal;

[0105] The processed excitation signal is converted to obtain the driving signal corresponding to the excitation signal.

[0106] Some embodiments of this application randomize the generated stimuli to obtain a processed stimuli signal, and then convert the processed stimuli signal to obtain a corresponding driving signal. Different stimuli signals can be set, and the addition of randomization processing makes it suitable for different testing needs and makes the verification more accurate.

[0107] Optionally, the method further includes:

[0108] Acquire the first signal from the dual-code security module within the chip under test;

[0109] The first signal is compared with the preset configuration signal to obtain the comparison result, which is used to locate the abnormal signal in the first signal.

[0110] Specifically, the terminal device can also perform assertion monitoring on the first signal in the dual-code security module to determine whether the relevant signal is triggered or whether the relevant function is complete, and then locate the abnormal signal in the first signal, such as a signal that is not triggered or a signal with an incomplete format.

[0111] In this embodiment, the excitation signal required by the DUT is first configured by the transmitter, and then the excitation signal is randomized by the agent. After randomization by the driver, the randomized excitation signal is converted into a driving signal and input to the DUT. Finally, the monitor collects the output data of the DUT and converts it into a log file for storage after processing. This embodiment can also add assertion monitoring to monitor the internal signals and interface signals of the DUT to accurately locate whether the function point is covered.

[0112] In this embodiment, after the test stimulus is prepared, randomization is performed, the dual-code security module DCSM is operated, and then the AHB protocol is called to generate the interface signal driving DCSM. During the operation of DUT, assertions are used to monitor the UDT interface and internal signals, the DUT output signal is received through the monitor, the signal is converted into usable data, and compared with the expected result.

[0113] Some embodiments of this application obtain the first signal of the dual-code security module in the chip under test and compare it with the preset configuration signal. This allows for the monitoring of signals within the chip under test, and if any abnormality is found, the location of the abnormality can be determined.

[0114] Optionally, based on the driving signal, the dual-code security module in the chip under test is processed to obtain the processing result, including:

[0115] Each area in the dual-code security module is encrypted using a preset encryption password to obtain the encryption result.

[0116] The encrypted result is decrypted using a preset decryption password to obtain the decrypted result; where the preset encryption password and the preset decryption password correspond to each other;

[0117] The encryption and decryption results are used as the processing results.

[0118] In some embodiments of this application, a driving signal is input to the dual-code security module to obtain an output result, i.e., a processing result, which is used for subsequent comparison with a preset password to verify the dual-code security module.

[0119] Optionally, the encrypted result is decrypted using a preset decryption password to obtain the decrypted result, including:

[0120] The first and second data of the first register in the chip under test are obtained through the bus protocol.

[0121] Based on the first data, determine the first region;

[0122] Based on the second data, the second region is determined;

[0123] By performing a pre-defined pseudo-read operation, the first password corresponding to the first region is calculated, and the second password corresponding to the first password register is determined based on the first password; and the third password corresponding to the second region is calculated, and the fourth password corresponding to the second password register is determined based on the third password.

[0124] If the second password matches the preset password, the first area is successfully decrypted; if the fourth password matches the preset password, the second area is successfully decrypted.

[0125] If the second password does not match the preset password, or the fourth password does not match the preset password, then the decryption result is determined to be a decryption failure.

[0126] Figure 3 A schematic diagram of the decryption process provided in the embodiments of this application, as shown below. Figure 3 As shown, firstly, the driver generates a dummyread operation, causing DCSM to initialize the inidone process according to the dummyread order. After the inidone initialization process is completed, the i_ini_done initialization signal is checked by assertion. If the initialization signal is pulled high, it means that the inidone initialization process is successful. If it is not pulled high, it means that the inidone initialization process is incorrect.

[0127] After completing the inidone process, assertions and monitors are used to check whether the encrypted configuration signal output by DCSM is consistent with the expected configuration.

[0128] During this process, a random variable can be added when driving the dummyread operation to randomize the dummyread order and the inidone process. Then, a monitor is used to monitor the DUT output encryption configuration signal. The collected data is compared with the expected result of the randomized input data. Finally, the analysis report can more comprehensively verify the correctness of this part of the code.

[0129] After the inidone process is completed, the DCSMAHB bus is driven using the AHB bus protocol. The registers are manipulated to encrypt the DCSM. After confirming the encrypted zone and block areas, the decryption process can be performed on the corresponding zone areas. The decryption process for each zone is as follows:

[0130] Decrypting zone1:

[0131] The value of the z1 linkpointer register in the DUT is read via the AHB bus. The zone block is calculated from the read value, and the 128-bit password for the corresponding block is obtained through a dummyread process. Then, the corresponding 32-bit password is written to the four password registers in the DCSM zone1 area via the AHB bus. After the DCSM registers receive the password, they are compared with the password obtained from the dummyread. If both passwords are correct, decryption is successful, and the o_z1_lock signal in the DCSM is pulled low. If the password is incorrect, decryption fails.

[0132] Zone 2 Decryption:

[0133] The value of the z2linkpointer register in the DUT is read via the AHB bus. The block is calculated from this value, and a 128-bit password for the corresponding block is obtained through a dummyread process. Then, a corresponding 32-bit password is written to each of the four password registers in the DCSMzone2 area via the AHB bus. The password obtained by the DCSM register is compared with the password obtained from the dummyread. If both passwords are correct, decryption is successful, and the o_z2_lock signal in the DCSM is pulled low. If the password is incorrect, decryption fails. To ensure complete verification, randomization can be added to the decryption process. Randomizing the z2linkpointer value can cause corresponding changes to the block calculated by the DCSM, and randomizing the password generated by the dummyread can make the verification by the DCSM module more complete.

[0134] Some embodiments of this application calculate the password for each area by using a preset pseudo-read operation, and then compare the password with the preset password. If they match, the decryption is successful; if they do not match, the decryption fails. The decryption result is used to determine whether the dual-code security module has passed the verification.

[0135] Optionally, before acquiring the stimulus signal for verifying the chip under test, the method further includes:

[0136] A pseudo-read operation is used to initialize the dual-code security module in the chip under test, and an initialization signal is obtained.

[0137] If the initialization signal is the preset signal, then the initialization operation of the dual-code security module in the chip under test is successful.

[0138] Some embodiments of this application pre-initialize the dual-code security module to improve the accuracy of subsequent verification.

[0139] It should be noted that each of the implementable methods in this embodiment can be implemented individually or in any combination without conflict. This application does not limit this.

[0140] Another embodiment of this application provides a verification device for a dual-code security module, used to execute the verification method for the dual-code security module provided in the above embodiment.

[0141] like Figure 4 The diagram shown is a structural schematic of the verification device for the dual-code security module provided in this application embodiment. The verification device for the dual-code security module includes an acquisition module 401, a conversion module 402, a processing module 403, and a verification module 404, wherein:

[0142] The acquisition module 401 is used to acquire the excitation signal for verifying the chip under test;

[0143] The conversion module 402 is used to convert the excitation signal into a drive signal;

[0144] The processing module 403 is used to process the dual-code security module in the chip under test according to the driving signal and obtain the processing result;

[0145] The verification module 404 is used to determine the verification result corresponding to the dual-code security module in the chip under test based on the processing result and the preset verification result.

[0146] Regarding the apparatus in this embodiment, the specific manner in which each module performs its operations has been described in detail in the embodiments related to the method, and will not be elaborated upon here.

[0147] Some embodiments of this application set corresponding excitation signals according to the functions of the dual-code security module to be tested, then convert the excitation signals into driving signals, and input the driving signals into the dual-code security module in the chip under test to obtain an output result. The output result is compared with the preset verification result, and the dual-code security module is judged to meet the requirements based on the comparison result. In this way, the various functions of the dual-code security module can be tested, thus providing a more comprehensive security verification of the dual-code security module.

[0148] Another embodiment of this application further supplements the description of the verification device for the dual-code security module provided in the above embodiments.

[0149] Optionally, the conversion module is used for:

[0150] The excitation signal is randomized to obtain the processed excitation signal;

[0151] The processed excitation signal is converted to obtain the driving signal corresponding to the excitation signal.

[0152] Some embodiments of this application randomize the generated stimuli to obtain a processed stimuli signal, and then convert the processed stimuli signal to obtain a corresponding driving signal. Different stimuli signals can be set, and the addition of randomization processing makes it suitable for different testing needs and makes the verification more accurate.

[0153] Optionally, the verification module is used for:

[0154] Acquire the first signal from the dual-code security module within the chip under test;

[0155] The first signal is compared with the preset configuration signal to obtain the comparison result, which is used to locate the abnormal signal in the first signal.

[0156] Some embodiments of this application obtain the first signal of the dual-code security module in the chip under test and compare it with the preset configuration signal. This allows for the monitoring of signals within the chip under test, and if any abnormality is found, the location of the abnormality can be determined.

[0157] Optionally, the processing module is used for:

[0158] Each area in the dual-code security module is encrypted using a preset encryption password to obtain the encryption result.

[0159] The encrypted result is decrypted using a preset decryption password to obtain the decrypted result; where the preset encryption password and the preset decryption password correspond to each other;

[0160] The encryption and decryption results are used as the processing results.

[0161] In some embodiments of this application, a driving signal is input to the dual-code security module to obtain an output result, i.e., a processing result, which is used for subsequent comparison with a preset password to verify the dual-code security module.

[0162] Optionally, the processing module is used for:

[0163] The first and second data of the first register in the chip under test are obtained through the bus protocol.

[0164] Based on the first data, determine the first region;

[0165] Based on the second data, the second region is determined;

[0166] By performing a pre-defined pseudo-read operation, the first password corresponding to the first region is calculated, and the second password corresponding to the first password register is determined based on the first password; and the third password corresponding to the second region is calculated, and the fourth password corresponding to the second password register is determined based on the third password.

[0167] If the second password matches the preset password, the first area is successfully decrypted; if the fourth password matches the preset password, the second area is successfully decrypted.

[0168] If the second password does not match the preset password, or the fourth password does not match the preset password, then the decryption result is determined to be a decryption failure.

[0169] Some embodiments of this application calculate the password for each area by using a preset pseudo-read operation, and then compare the password with the preset password. If they match, the decryption is successful; if they do not match, the decryption fails. The decryption result is used to determine whether the dual-code security module has passed the verification.

[0170] Optionally, the acquisition module is also used for:

[0171] A pseudo-read operation is used to initialize the dual-code security module in the chip under test, and an initialization signal is obtained.

[0172] If the initialization signal is the preset signal, then the initialization operation of the dual-code security module in the chip under test is successful.

[0173] Some embodiments of this application pre-initialize the dual-code security module to improve the accuracy of subsequent verification.

[0174] Regarding the apparatus in this embodiment, the specific manner in which each module performs its operations has been described in detail in the embodiments related to the method, and will not be elaborated upon here.

[0175] It should be noted that each of the implementable methods in this embodiment can be implemented individually or in any combination without conflict. This application does not limit this.

[0176] This application also provides a computer-readable storage medium storing a computer program thereon. When the program is executed by a processor, it can implement the operation of any of the methods corresponding to the verification methods of the dual-code security module provided in the above embodiments.

[0177] This application also provides a computer program product, which includes a computer program, wherein when the computer program is executed by a processor, it can implement the operation of any of the methods corresponding to the verification methods of the dual-code security module provided in the above embodiments.

[0178] like Figure 5As shown, some embodiments of this application provide an electronic device 500, which includes: a memory 510, a processor 520, and a computer program stored in the memory 510 and executable on the processor 520. When the processor 520 reads the program from the memory 510 via a bus 530 and executes the program, it can implement any of the methods included in the verification method of the dual-code security module described above.

[0179] Processor 520 can process digital signals and can include various computing architectures. For example, it can be a complex instruction set computer architecture, a reduced instruction set computer architecture, or an architecture that implements multiple instruction set combinations. In some examples, processor 520 can be a microprocessor.

[0180] The memory 510 can be used to store instructions executed by the processor 520 or data related to the execution of instructions. These instructions and / or data may include code for implementing some or all of the functions of one or more modules described in the embodiments of this application. The processor 520 of this disclosure embodiment can be used to execute the instructions in the memory 510 to implement the methods shown above. The memory 510 includes dynamic random access memory, static random access memory, flash memory, optical memory, or other memories well known to those skilled in the art.

[0181] The above are merely embodiments of this application and are not intended to limit the scope of protection of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of protection of this application. It should be noted that similar reference numerals and letters in the following figures indicate similar items; therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures.

[0182] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

[0183] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

Claims

1. A verification method for a dual-code security module, characterized in that, The method includes: Obtain the stimulus signal for verifying the chip under test; Convert the excitation signal into a drive signal. The dual-code security module in the chip under test is processed according to the driving signal to obtain the processing result; Based on the processing results and the preset verification results, determine the verification result corresponding to the dual-code security module in the chip under test; The process of processing the dual-code security module in the chip under test according to the driving signal to obtain the processing result includes: Each area in the dual-code security module is encrypted using a preset encryption password to obtain the encryption result. The encryption result is decrypted using a preset decryption password to obtain a decryption result; wherein the preset encryption password and the preset decryption password correspond to each other; The encryption result and the decryption result are used as the processing result; The step of decrypting the encryption result using a preset decryption password to obtain the decryption result includes: The first and second data of the first register in the chip under test are obtained through the bus protocol. Based on the first data, the first region is determined; Based on the second data, the second region is determined; By performing a preset pseudo-read operation, the first password corresponding to the first region is calculated, and the second password corresponding to the first password register is determined based on the first password; and the third password corresponding to the second region is calculated, and the fourth password corresponding to the second password register is determined based on the third password. If the second password matches the preset password, the first area is successfully decrypted; if the fourth password matches the preset password, the second area is successfully decrypted. If the second password does not match the preset password, or the fourth password does not match the preset password, then the decryption result is determined to be a decryption failure.

2. The verification method for the dual-code security module according to claim 1, characterized in that, The step of converting the excitation signal into a drive signal includes: The excitation signal is randomized to obtain the processed excitation signal; The processed excitation signal is converted to obtain a driving signal corresponding to the excitation signal.

3. The verification method for the dual-code security module according to claim 1, characterized in that, The method further includes: Obtain the first signal from the dual-code security module within the chip under test; The first signal is compared with a preset configuration signal to obtain a comparison result, which is used to locate abnormal signals in the first signal.

4. The verification method for the dual-code security module according to claim 1, characterized in that, Before acquiring the excitation signal for verifying the chip under test, the method further includes: A pseudo-read operation is used to initialize the dual-code security module in the chip under test, and an initialization signal is obtained. If the initialization signal is a preset signal, then the initialization operation of the dual-code security module in the chip under test is successful.

5. A verification device for a dual-code security module, characterized in that, The device includes: The acquisition module is used to acquire the stimulus signal for verifying the chip under test; The conversion module is used to convert the excitation signal into a drive signal; The processing module is used to process the dual-code security module in the chip under test according to the driving signal and obtain the processing result; The verification module is used to determine the verification result corresponding to the dual-code security module in the chip under test based on the processing result and the preset verification result. The processing module is used for: Each area in the dual-code security module is encrypted using a preset encryption password to obtain the encryption result. The encryption result is decrypted using a preset decryption password to obtain a decryption result; wherein the preset encryption password and the preset decryption password correspond to each other; The encryption result and the decryption result are used as the processing result; The step of decrypting the encryption result using a preset decryption password to obtain the decryption result includes: The first and second data of the first register in the chip under test are obtained through the bus protocol. Based on the first data, the first region is determined; Based on the second data, the second region is determined; By performing a preset pseudo-read operation, the first password corresponding to the first region is calculated, and the second password corresponding to the first password register is determined based on the first password; and the third password corresponding to the second region is calculated, and the fourth password corresponding to the second password register is determined based on the third password. If the second password matches the preset password, the first area is successfully decrypted; if the fourth password matches the preset password, the second area is successfully decrypted. If the second password does not match the preset password, or the fourth password does not match the preset password, then the decryption result is determined to be a decryption failure.

6. The verification device for the dual-code security module according to claim 5, characterized in that, The conversion module is used for: The excitation signal is randomized to obtain the processed excitation signal; The processed excitation signal is converted to obtain a driving signal corresponding to the excitation signal.

7. An electronic device, characterized in that, The system includes a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, it implements the verification method of the dual-code security module as described in any one of claims 1-4.

8. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program, characterized in that, when the program is executed by a processor, it can implement the verification method of the dual-code security module as described in any one of claims 1-4.

Images