FPGA (Field Programmable Gate Array) remote updating optimization method and system and processor

Abstract

The invention relates to the technical field of digital signal processing, and discloses an FPGA (Field Programmable Gate Array) remote update optimization method, system and processor, the method comprises the following steps: loading the logic of a factory mirror image address a after power-on to verify the logic of an application mirror image address b, if verification fails, loading the power-on copy processing logic of the factory mirror image address a to verify the logic of the application mirror image address b, and if verification fails, loading the power-on copy processing logic of the application mirror image address b; copying the content at the third segment mirror image address c to the application mirror image address b; and if the verification is successful, loading the logic of the application mirror image address b, when a remote updating instruction is received, writing a new logic into the third segment mirror image address c by the remote updating process control logic of the application mirror image address b, and copying the content at the third segment mirror image address c into the application mirror image address b to finish updating. According to the scheme, when the remote updating is accidentally interrupted, the logic of the application mirror image address b of the previous version can still be operated after power-on again instead of the logic before long-time loading.

Description

Technical Field

[0001] The present invention relates to the technical field of digital signal processing, and in particular to an FPGA remote update optimization method and system, and a processor. Background Art

[0002] In the hardware system controlled by FPGA, the FPGA control logic is stored in non-volatile memory such as FLASH or EEPROM. After power-on, the FPGA reads the logic from the memory, loads it into the FPGA, and starts running according to the logic content.

[0003] Product publishers often need to perform subsequent upgrades to the logic after the product is released. Therefore, when the product is first released, it is necessary to allow the FPGA control logic in the memory to be updated without disassembling or adding external devices. This is the remote update function. In remote updates, it is necessary to consider various reasons, including power failure of the device, that may cause the update process to be interrupted, to avoid the situation where the product cannot be used anymore due to update failure.

[0004] In this regard, the existing solution - the two-stage update solution, divides the FPGA logic into two parts: the factory image and the application image, which are stored in different address ranges of the memory. After the device is powered on, the FPGA first reads and detects whether the application image is normal. If it is normal, the FPGA loads the application image logic, otherwise it loads the factory image logic. When updating the logic, under the control of the currently running old FPGA control logic, the new logic data is written into the memory to directly overwrite the previous old application image control logic data. In this way, when the device is powered on again, the new application image control logic will be executed. In this way, if the update process is interrupted, the device will detect that the application image is abnormal after restarting, and the factory logic will be loaded. Because the factory image also has the function of controlling remote updates, the re-update can continue at this time.

[0005] However, the existing remote update solutions have the following disadvantages: when the update is interrupted, the machine will return to the mirror logic of the factory mode the next time it is turned on. If the logic is upgraded many times, the factory logic and the latest application logic often differ by many versions. If the product contains multiple modules or the software control system is more complex, there may be incompatibility between the old and new versions, resulting in the inability to continue remote updates or other more serious consequences. Summary of the invention

[0006] In order to solve the problems in the prior art, the present invention provides an FPGA remote update optimization method and system, and a processor.

[0007] In order to achieve the above object, the first aspect of the present invention provides an FPGA remote update optimization method, comprising the following steps: S1, after power-on, load the logic of the factory image address a to verify the logic of the application image address b, S2, if the verification fails, load the power-on copy processing logic of the factory image address a, so that the content at the third segment image address c is copied to the application image address b, and the content of the third segment image address c is the logic content after the FPGA remotely updates the application image address b last time; if the copy is successful, wait for power to be restarted to execute steps S1-S2, if the copy fails or the power is not restarted, execute step S3; If the verification is successful, the logic of the application image address b is loaded. When the remote update instruction is received, the remote update process control logic of the application image address b first writes the new logic into the third segment image address c, and then copies the content at the third segment image address c to the application image address b to complete the update; S3. Run the remote update process control logic of the factory image address a. When receiving the remote update instruction, the remote update process control logic of the factory image address a first writes the new logic into the third segment image address c, and then copies the content at the third segment image address c to the application image address b to complete the update.

[0008] Preferably, the logic of the factory image address a also includes a simplified version of the business logic, which is used for FPGA external communication, and the communication protocol is compatible with the communication protocol of the complete version of the business logic.

[0009] Preferably, the method further includes FPGA remote update logic anti-cloning, comprising the following steps: Before leaving the factory, the logic at the application image address b is loaded and the authentication logic therein is run to read the serial number of the FPGA, and the digital signature is generated by the asymmetric public key encryption algorithm and then written into the electronic signature address d; Then, the copy logic in the logic at the application image address b is run to copy the signature verification logic and the business logic at the third segment image address c to the application image address b, thereby overwriting the authentication logic; After leaving the factory, when the signature verification logic and business logic of the application image address b are loaded after power-on, the electronic signature of the electronic signature address d will be read, and the asymmetric public key digital signature verification algorithm will be used to verify the electronic signature and the FPGA serial number. If the verification passes, the business logic in the application image address b is allowed to run normally. If the verification fails, the business logic is locked or the business logic behaves abnormally.

[0010] Preferably, the logic of the factory image address a, the logic of the application image address b and the logic of the third segment image address c are spliced ​​into a memory initialization file before leaving the factory and are written into corresponding addresses respectively.

[0011] A second aspect of the present invention provides a method combining FPGA remote update and logic anti-cloning functions, comprising the following steps: Before leaving the factory, the logic at the application image address b is loaded and the authentication logic therein is run to read the serial number of the FPGA, and the digital signature is generated by the asymmetric public key encryption algorithm and then written into the electronic signature address d; Then, the copy logic in the logic at the application image address b is run to copy the signature verification logic and the business logic at the third segment image address c to the application image address b, thereby overwriting the authentication logic; After leaving the factory and powering on, load the logic of the factory image address a to verify the logic of the application image address b: If the verification fails, the power-on copy processing logic of the factory image address a is loaded, so that the content at the third segment image address c is copied to the application image address b. The content of the third segment image address c is the logic content after the FPGA remotely updated the application image address b last time; if the copy is successful, wait for power-on again to load the logic of the factory image address a. If the copy fails or the power is not re-on, the remote update process control logic of the factory image address a is run. When the remote update instruction is received, the remote update process control logic of the factory image address a first writes the new logic to the third segment image address c, and then copies the content at the third segment image address c to the application image address b to complete the update; If the verification is successful, the logic of the application image address b is loaded. When the remote update instruction is received, the remote update process control logic of the application image address b first writes the new logic into the third segment image address c, and then copies the content at the third segment image address c to the application image address b to complete the update. At the same time, the signature verification logic of the application image address b will read the electronic signature of the electronic signature address d, and use the asymmetric public key digital signature verification algorithm to verify the electronic signature and the FPGA serial number. If the verification passes, the business logic in the application image address b is allowed to run normally. If the verification fails, the business logic is locked or the business logic behaves abnormally.

[0012] The third aspect of the present invention provides an FPGA remote update optimization system, including a factory mirror module, an application mirror module and a third-stage mirror module. The factory mirror module is used to confirm that the logic of the application mirror module is checked before powering on. If the check fails, the power-on copy processing logic of the factory mirror module is run to copy the logic of the third-segment mirror module to the application mirror module. The logic of the third-segment mirror module is the logic content after the FPGA remotely updates the application mirror module last time; if the copy is successful, wait for the system to be powered on again. If the copy fails or the power is not turned on again, the remote update process control logic of the factory mirror module is run. After receiving the remote update instruction, the remote update process control logic of the factory mirror module first writes the new logic into the third-segment mirror module, and then copies the content of the third-segment mirror module to the application mirror module to complete the update; The application mirror module is used to power on and, after successful inspection by the factory mirror module, when a remote update instruction is received, the remote update process control logic of the application mirror module first writes the new logic into the third-segment mirror module, and then copies the logic content of the third-segment mirror module to the application mirror module to complete the update.

[0013] Preferably, it also includes an initialization mirror module and an electronic signature module, The initialization mirror module is used to load the authentication logic of the initialization mirror module before leaving the factory, so as to read the serial number of the FPGA, generate a digital signature through an asymmetric public key encryption algorithm and write it into the electronic signature module, and then clear the logic content of the initialization mirror module; The application mirror module is also used to read the electronic signature of the electronic signature module when the signature verification logic of the application mirror module is powered on and loaded after leaving the factory, and use an asymmetric public key digital signature verification algorithm to verify the electronic signature and the FPGA serial number. If the verification passes, the business logic of the application mirror module is allowed to run normally. If the verification fails, the business logic is locked or the business logic behaves abnormally.

[0014] Preferably, the system is based on a memory as a carrier, the factory image module is located at the factory image address a of the memory, the third-segment image module is located at the third-segment image address c, the electronic signature module is located at the electronic signature address d, and the application image module and the initialization image module are both located at the application image address b; the clearing of the logical content of the initialization image module adopts erasing or destroying the logical content of the initialization image module, and then powering on again; or, the clearing of the logical content of the initialization image module adopts loading the copy logic of the initialization image module to copy the signature verification logic of the third-segment image module to the application image module, thereby overwriting the authentication logic.

[0015] Preferably, the factory mirror module is also used to verify the application mirror module after failure. If the re-power-on verification fails again, the remote update process control logic of the factory mirror module is loaded. After receiving the remote update instruction, the remote update process control logic of the factory mirror module first writes the new logic into the third-segment mirror module, and then copies the logic content of the third-segment mirror module to the application mirror module to complete the update; and / or, it is also used for FPGA external communication, and the communication protocol is compatible with the communication protocol of the full version of the business logic to support the transmission of remote update commands and remote update data.

[0016] A fourth aspect of the present invention provides a processor for running a program, wherein the program, when being run, is used to execute: such as the above-mentioned FPGA remote update optimization method.

[0017] Through the above technical solution, a three-stage update solution is used, that is, after power-on, the logic of the factory image address a copies the content of the third image address c to the application image address b. When the remote update process control logic of the application image address b is remotely updated, the new logic is first written into the third image address, and then the content at the third image address is copied to the application image address. It is ensured that when the remote update is accidentally interrupted, the logic of the application image address b of the previous version will still be run after powering on again, rather than loading the logic from a long time ago. Even if the update fails, the worst case is that it will eventually return to the application image logic of the last successful update, and will not return to the original application image logic at the factory or return to the factory image logic. The existing solution will return to the factory image logic when the update fails. And there is no additional hardware equipment added, only an additional board power-on step is added, the additional production steps are small, and the method is simple and low-cost. In addition, based on the three-stage update scheme, the present invention configures the power-on copy processing logic at the factory mirror address a, and respectively configures the remote update process control logic at the factory mirror address a and the application mirror address b, and loads the corresponding logic of different addresses according to the power-on sequence and the verification results to implement the above-mentioned three-stage update scheme, effectively avoiding: accidental power outages and extreme situations that cause the logic at address b and address c to be incomplete, etc., resulting in the failure of copying and writing the content at the third-stage mirror address c to the application mirror address b.

[0018] Other features and advantages of the embodiments of the present invention will be described in detail in the subsequent detailed description. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] The accompanying drawings are used to provide a further understanding of the embodiments of the present invention and constitute a part of the specification. Together with the following specific implementations, they are used to explain the embodiments of the present invention, but do not constitute a limitation on the embodiments of the present invention. In the accompanying drawings: Figure 1This is a schematic diagram of an FPGA remote update optimization process according to an embodiment of the present invention; Figure 2 This is a schematic diagram of the pre-shipment process of the FPGA remote update logic anti-cloning logic in Example 3 of the present invention. DETAILED DESCRIPTION

[0020] The specific implementation of the embodiment of the present invention is described in detail below in conjunction with the accompanying drawings. It should be understood that the specific implementation described here is only used to illustrate and explain the embodiment of the present invention, and is not used to limit the embodiment of the present invention. Example

[0021] The embodiment of the present invention provides an FPGA remote update optimization method, such as Figure 1 As shown, the following steps are included: S1, after power-on, load the logic of the factory image address a to verify the logic of the application image address b, S2. If the verification fails, the power-on copy processing logic of the factory image address a is loaded to copy the content at the third segment image address c to the application image address b (power-on copy processing logic). The content of the third segment image address c is the logic content after the FPGA remotely updated the application image address b last time; if the copy is successful, wait for power-on again to execute steps S1-S2. If the copy fails or the power is not re-applied, execute step S3; If the verification is successful, the logic of the application image address b is loaded. When the remote update instruction is received, the remote update process control logic of the application image address b first writes the new logic into the third segment image address c, and then copies the content at the third segment image address c to the application image address b (the remote update process control logic of the factory image address a), and the update is completed; S3. Run the remote update process control logic of the factory image address a. When receiving the remote update instruction, the remote update process control logic of the factory image address a first writes the new logic into the third segment image address c, and then copies the content at the third segment image address c to the application image address b to complete the update.

[0022] In another embodiment of the present invention, the logic of the factory image address a also includes a simplified business logic for FPGA external communication, and the communication protocol is compatible with the communication protocol of the complete business logic to support the transmission of remote update commands and remote update data.

[0023] In summary, in the logic of the factory image address a, the constraint file stipulates that the logic at address b is checked first when powered on. If the check succeeds, the logic at address b is loaded. If the check fails, the logic at address a is loaded. In addition, the logic of the factory image address a also includes the following 3 logics, which are in parallel relationship and have no order of dependency between them: (1.1) Power-on copy processing logic: After power-on, this part of the logic copies the content at address c to address b. The purpose of this part is: if this part of the logic is loaded now, it means that the image at address b is incomplete and causes its verification to fail, so this part of the logic copies the image at address c to b, so that the logic at b can be loaded normally at the next power-on.

[0024] (1.2) Remote update process control logic: When the outside world sends a command to start the remote update task, the logic in this part first receives the remote update data and writes it to address c, and then copies the content at address c to address b. The purpose of this part is: if an extreme situation occurs and the logic at address b and address c are incomplete, the function implemented by this part of the logic can rewrite the logic at b and address c through external input remote update data.

[0025] (1.3) Simplified business logic: A simplified version of the business logic, including the necessary business logic to ensure that the machine does not suffer irreversible damage or freeze. In particular, it must include the board's external communication function, and its communication protocol must be compatible with the communication protocol of the full version of the business logic to support the transmission of remote update commands and remote update data. The purpose is: if the board is part of a larger complex control system, then if all business logic is not included, other components in the system may misjudge the current state of the system, so some of the most basic business functions are retained here to prevent the system from paralyzing, and to provide support for the communication protocol module for the remote update function.

[0026] Furthermore, if the verification is successful, the logic of the application image address b is loaded, and the business logic of address b is started, that is, the logic required for the normal operation of the machine. When the remote update instruction is received, the remote update process control logic of the application image address b is started, such as Figure 1 As shown, first write the new logic to the third-segment mirror address c, and then copy the content at the third-segment mirror address c to the application mirror address b. If the write is successful, the update is completed, and the user turns off the power and then powers on again to start the logic of the successful remote update. If the write fails, the logic at the application mirror address b is incomplete. After the second user powers on, the system restarts steps S1-S2, loads the power-on copy processing logic of the factory mirror address a, copies the content at the third-segment mirror address c to the application mirror address b, and then powers on for the third time to verify the logic of the application mirror address b until it is successfully updated; if the update fails again, that is, the third user powers on to verify the logic of the application mirror address b and still fails, then the remote update process control logic of the factory mirror address a is loaded.

[0027] Therefore, after the first power-on verification is successful, the remote update process control logic of the application mirror address b copies the content at the third-segment mirror address c to the application mirror address b. However, unexpected power outages and other situations may cause the content at the third-segment mirror address c to fail to be copied and written to the application mirror address b. During the second power-on verification, it is determined whether the first power-on writing to the application mirror address b is successful. If the writing is unsuccessful, the power-on copy processing logic of the factory mirror address a is loaded and rewritten to make up for the writing failure caused by the unexpected situation during the first power-on. Then, the power is turned on again to execute steps S1-S2, that is, the third power-on and verification is performed again. However, extreme situations may also occur, resulting in the incomplete content at the third-segment mirror address c and the application mirror address b, which causes the power-on copy processing logic to still fail to write after the second power-on, and ultimately causes the third power-on verification to still fail. At this time, the remote update process control logic of the factory image address a is loaded, the remote update data is received and written to address c, and then the content at address c is copied to address b, so as to rewrite the logic at b and address c through external input remote update data, and overcome the problem that the logic at address b and address c are incomplete due to extreme situations. It can effectively solve the problem of write failure caused by unexpected power failure when the content at address c is copied and written to address b.

[0028] In summary, the embodiment of the present invention uses a three-stage update solution, that is, after power-on, the logic of the factory mirror address a copies the content of the third mirror address c to the application mirror address b. When the remote update process control logic of the application mirror address b performs remote update, the new logic is first written into the third mirror address, and then the content at the third mirror address is copied to the application mirror address. It ensures that when the remote update is accidentally interrupted, the logic of the application mirror address b of the previous version will still be run after powering on again, rather than loading the logic from a long time ago. Even if the update fails, the worst case is that it will eventually return to the application mirror logic of the last successful update, and will not return to the original application mirror logic at the time of shipment or return to the factory mirror logic. The existing solution will return to the factory mirror logic when the update fails. And there is no additional hardware equipment added, only an additional board power-on step is added, the additional production steps are increased less, and the method is simple and low-cost. In addition, based on the three-stage update scheme, the present invention configures the power-on copy processing logic at the factory mirror address a, and respectively configures the remote update process control logic at the factory mirror address a and the application mirror address b, and loads the corresponding logic of different addresses according to the power-on sequence and the verification results to implement the above-mentioned three-stage update scheme, effectively avoiding: accidental power outages and extreme situations that cause the logic at address b and address c to be incomplete, etc., resulting in the failure of copying and writing the content at the third-stage mirror address c to the application mirror address b. Example

[0029] In the hardware system controlled by FPGA, the FPGA control logic is stored in non-volatile memory such as FLASH or EEPROM. After power-on, the FPGA reads the logic from the memory, loads it into the FPGA, and starts to run according to the logic content. When a malicious third party obtains the product circuit board, it may copy the circuit design of the board and make a pirated board. And copy all the contents in the memory into the memory on its own board to achieve complete cloning of the board function. In this regard, the existing solution 1 to prevent the logic from being copied and cloned is to use additional external hardware devices for encryption. The logic is encrypted or the FPGA is verified by additional devices. If the verification fails, some or all business functions are closed or abnormal. However, additional hardware devices will increase the additional production cost of the product. Existing solution 2: Read the serial number of each FPGA of each device in advance before leaving the factory, store it directly without processing or perform certain data simple processing before storing it in the memory matching the FPGA. After power-on, the FPGA logic reads the processed data from the memory and compares it with the serial number of its own FPGA to determine whether it matches. If the match fails, some or all business functions are closed or abnormal. However, the operation of reading the serial number of each FPGA and then writing it into the memory before leaving the factory adds a step to the production process, increasing production costs. In addition, once the algorithm for data processing or verification of the serial number is known to a malicious third party, the anti-cloning effect will become invalid, which is contrary to the Kerckhoffs principle in cryptography.

[0030] Therefore, the embodiment of the present invention adds FPGA remote update logic anti-cloning logic on the basis of embodiment 1, and a method combining FPGA remote update and logic anti-cloning functions includes the following steps: Before leaving the factory, the logic at the application image address b is loaded and the authentication logic therein is run to read the serial number of the FPGA, and the digital signature is generated by the asymmetric public key encryption algorithm and then written into the electronic signature address d; Then, the copy logic in the logic at the application image address b is run to copy the signature verification logic and the business logic at the third segment image address c to the application image address b, thereby overwriting the authentication logic; After leaving the factory and powering on, load the logic of the factory image address a to verify the logic of the application image address b: If the verification fails, the power-on copy processing logic of the factory image address a is loaded, so that the content at the third segment image address c is copied to the application image address b. The content of the third segment image address c is the logic content after the FPGA remotely updated the application image address b last time; if the copy is successful, wait for power-on again to load the logic of the factory image address a. If the copy fails or the power is not re-on, the remote update process control logic of the factory image address a is run. When the remote update instruction is received, the remote update process control logic of the factory image address a first writes the new logic to the third segment image address c, and then copies the content at the third segment image address c to the application image address b to complete the update; If the verification is successful, the logic of the application image address b is loaded. When the remote update instruction is received, the remote update process control logic of the application image address b first writes the new logic into the third segment image address c, and then copies the content at the third segment image address c to the application image address b to complete the update. At the same time, the signature verification logic of the application image address b will read the electronic signature of the electronic signature address d, and use the asymmetric public key digital signature verification algorithm to verify the electronic signature and the FPGA serial number. If the verification passes, the business logic in the application image address b is allowed to run normally. If the verification fails, the business logic is locked or the business logic behaves abnormally.

[0031] Therefore, based on Example 1, the logic of applying the mirror address b also includes authentication logic, copy logic and signature verification logic.

[0032] Authentication logic: After power-on, read the serial number of the FPGA, generate a digital signature through an asymmetric public key encryption algorithm, and write it to address d. The purpose is: different FPGAs often have different serial numbers, which can generate different electronic signatures. Writing this electronic signature into the memory is equivalent to establishing a connection between the memory and the FPGA. The subsequent signature verification logic is to verify whether this connection is correct. If a malicious third party copies the content in the memory including the electronic signature to its own pirated board, then since different FPGAs often have different serial numbers, the serial number of the FPGA of this new pirated board is often different from that of the original board. However, the malicious third party copied the same electronic signature as the original board, so on the pirated board, this connection can often be detected as incorrect, and the board's application mirror logic can know that it is currently in a pirated board.

[0033] Copy logic: After waiting for the authentication logic to be executed, copy the content at address c to address b. The purpose is to overwrite the authentication logic and replace it with the factory image logic of the application image address b (including signature verification logic, remote update process control logic and business logic), so that the logic of the application image address b is loaded after the next power-on. At the same time, the authentication logic contained in the initialization image logic is cleared. After the product is sold, a malicious third party cannot obtain the public key information in the authentication logic, and there is no way to calculate the corresponding correct electronic signature through the FPGA serial number on his own pirated board, so as to ensure the "verifiable and unforgeable" nature of the electronic signature.

[0034] The authentication logic and the replication logic are placed in the application image address b as the initialization image logic before leaving the factory. After leaving the factory, they can be overwritten by the factory image logic of the application image address b, or they can be erased or destroyed. The embodiment of the present invention gives priority to the former.

[0035] Signature verification logic: After power-on, read the electronic signature at address d, and use an asymmetric public key digital signature verification algorithm to verify it with the FPGA serial number. If the verification fails, the business logic is locked or the business logic behaves abnormally. If the verification passes, the business logic is allowed to run normally. The above signature verification algorithm meets the characteristics: it matches the digital signature generation algorithm mentioned in the authentication logic, and the verification public key it uses matches the encrypted private key of the digital signature generation algorithm mentioned in the authentication logic. The purpose is to verify whether the electronic signatures in the FPGA and the memory are matching. If they do not match, it means that the electronic signature in the memory may be copied from other boards, rather than generated and written by the authentication logic mentioned above, which further indicates that the current board may be a pirated board.

[0036] The technical solution of the embodiment of the present invention adds an electronic signature address d on the basis of the three-stage update solution, combines each address and the corresponding logic, solves the remote update while also achieving the purpose of logical anti-cloning solution, and effectively integrates the remote update solution and the logical anti-cloning solution into one solution.

[0037] It is worth explaining that the signature verification logic, remote update process control logic and business logic are in a parallel relationship and there is no order of dependency between them.

[0038] The embodiment of the present invention uses an asymmetric public key algorithm to generate and verify the digital signature of the FPGA serial number, and saves it in the memory to implement the serial number verification of the FPGA, thereby realizing the board logic anti-copying. During production, the initialization mirror logic is written to the application mirror address through the normal logic writing process, and the application mirror logic is written to the third segment mirror address. Among them, the initialization mirror includes the function of copying or moving the data at the third segment mirror address to the application mirror address; or, the initialization mirror includes the function of deleting or destroying the integrity of the data at the application mirror address. It is achieved that even if a malicious third party obtains all the algorithm details, as long as the private key used to generate the digital signature is not leaked, the anti-cloning function is still effective, and the remote update solution and the logic anti-cloning solution can be integrated into a set of solutions.

[0039] It is worth mentioning that the FPGA remote update logic anti-cloning logic of embodiment 2 of the present invention and the update optimization logic of embodiment 1 can be used separately as independent solutions. Example

[0040] Based on the same inventive concept, the second aspect of the embodiment of the present invention provides an FPGA remote update optimization system, including a factory image module, an application image module and a third-stage image module. The factory mirror module is used to confirm that the logic of the application mirror module is checked before powering on. If the check fails, the power-on copy processing logic of the factory mirror module is run to copy the logic of the third-segment mirror module to the application mirror module. The logic of the third-segment mirror module is the logic content after the FPGA remotely updates the application mirror module last time; if the copy is successful, wait for the system to be powered on again. If the copy fails or the power is not turned on again, the remote update process control logic of the factory mirror module is run. After receiving the remote update instruction, the remote update process control logic of the factory mirror module first writes the new logic into the third-segment mirror module, and then copies the content of the third-segment mirror module to the application mirror module to complete the update; The application mirror module is used to power on and, after successful inspection by the factory mirror module, when a remote update instruction is received, the remote update process control logic of the application mirror module first writes the new logic into the third-segment mirror module, and then copies the logic content of the third-segment mirror module to the application mirror module to complete the update.

[0041] Furthermore, it also includes an initialization image module and an electronic signature module, The initialization mirror module is used to load the authentication logic of the initialization mirror module before leaving the factory, so as to read the serial number of the FPGA, generate a digital signature through an asymmetric public key encryption algorithm and write it into the electronic signature module, and then clear the logic content of the initialization mirror module; The application mirror module is also used to read the electronic signature of the electronic signature module when the signature verification logic of the application mirror module is powered on and loaded after leaving the factory, and use an asymmetric public key digital signature verification algorithm to verify the electronic signature and the FPGA serial number. If the verification passes, the business logic of the application mirror module is allowed to run normally. If the verification fails, the business logic is locked or the business logic behaves abnormally.

[0042] Furthermore, the system is based on a memory as a carrier, the factory image module is located at the factory image address a of the memory, the third-segment image module is located at the third-segment image address c, the electronic signature module is located at the electronic signature address d, and the application image module and the initialization image module are both located at the application image address b; the clearing of the logical content of the initialization image module adopts erasing or destroying the logical content of the initialization image module, and then powering on again; or, the clearing of the logical content of the initialization image module adopts loading the copy logic of the initialization image module to copy the signature verification logic of the third-segment image module to the application image module, thereby overwriting the authentication logic.

[0043] Furthermore, the factory mirror module is also used to verify the application mirror module after failure. If the re-power-on verification fails again, the remote update process control logic of the factory mirror module is loaded. After receiving the remote update instruction, the remote update process control logic of the factory mirror module first writes the new logic into the third-segment mirror module, and then copies the logic content of the third-segment mirror module to the application mirror module to complete the update; and / or, it is also used for FPGA external communication, and the communication protocol is compatible with the communication protocol of the full version of the business logic to support the transmission of remote update commands and remote update data.

[0044] 1. If Figure 1 and Figure 2 As shown, firstly, the logic of the factory image address a, the application image address b and the third segment image address c is created.

[0045] 2. Combine the above logic into a memory initialization file so that the file is located at the corresponding address after being written into the memory.

[0046] (III) During production, the above files are written into the memory.

[0047] (IV) Power on the board once before leaving the factory. This step is usually performed before the board function test. (The purpose of this part is to load the initialization image logic at address b after powering on, write the electronic signature generated by the FPGA serial number into the memory address d, and then copy the application image logic at address c to address b, overwriting the original initialization image logic).

[0048] (V) When the user uses the device, the application image logic at the running address b will be automatically loaded after the device is powered on.

[0049] (VI) When users need remote updates: (1) Receive the updated new logic data from the manufacturer and then start remote updating.

[0050] (2) If the remote update ends normally, the content at address b will be replaced with the new logical image data. The new logic will be run the next time the computer is turned on, and the update will be successful.

[0051] (3) If the remote update is canceled or aborted during the step of "receiving remote update data and writing it to address c" (cancelled by the user or the process is interrupted due to an accident): since the content at address b is not affected, the next time the computer is powered on, the old logic of the last successfully updated version will still be run. If the user or the host computer finds that the logic is still the old one, it can be updated again.

[0052] (4) If the remote update is canceled or aborted during the "Copy the content at address c to address b" step (cancelled by the user or the process is interrupted due to an accident): Since the content at address b is incomplete, the factory logic at address a will be run at the next startup, and the "Copy the content at address c to address b" step will be run. If this step is canceled or aborted (cancelled by the user or the process is interrupted due to an accident), the process will be repeated at the next startup due to the incomplete content at address b; if this step ends normally, the content at address b will be replaced with the new logical mirror data, and the new logic will be run at the next startup, and the update will be successful.

[0053] A third aspect of an embodiment of the present invention provides a processor for running a program, wherein the program, when being run, is used to execute: such as the above-mentioned FPGA remote update optimization method.

[0054] In summary, the solution of the present invention has the following advantages: (1) When the remote update is interrupted unexpectedly, the previous version of the application image logic will still run after the power is turned on again, rather than loading the logic from a long time ago. In other words, when the update fails in this solution, the worst case is that it will eventually return to the application image logic that was successfully updated last time, and will not return to the original application image logic at the factory or return to the factory image logic. The existing solution will return to the factory image logic when the update fails.

[0055] (2) No additional hardware equipment is added.

[0056] (3) The number of additional production steps is relatively small, with only one additional board power-on step added.

[0057] (4) Even if a malicious third party obtains all the algorithm details, the anti-cloning function will still be effective as long as the private key used to generate the digital signature is not leaked.

[0058] (5) Allow remote update solutions and logical anti-cloning solutions to be integrated into one solution.

[0059] It should also be noted that the terms "comprises," "includes," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, commodity, or apparatus that includes a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity, or apparatus.

[0060] The above are only embodiments of the present application and are not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application should be included within the scope of the claims of the present application.

Claims

1. A FPGA remote update optimization method, characterized in that: The following steps are involved: S1, after power-on, load the logic of the factory image address a to verify the logic of the application image address b, S2, if the verification fails, load the power-on copy processing logic of the factory image address a, so that the content at the third segment image address c is copied to the application image address b, and the content of the third segment image address c is the logic content after the FPGA remotely updates the application image address b last time; if the copy is successful, wait for power to be restarted to execute steps S1-S2, if the copy fails or the power is not restarted, execute step S3; If the verification is successful, the logic of the application image address b is loaded. When the remote update instruction is received, the remote update process control logic of the application image address b first writes the new logic into the third segment image address c, and then copies the content at the third segment image address c to the application image address b to complete the update; S3. Run the remote update process control logic of the factory image address a. When receiving the remote update instruction, the remote update process control logic of the factory image address a first writes the new logic into the third segment image address c, and then copies the content at the third segment image address c to the application image address b to complete the update.

2. The method according to claim 1, characterized in that The logic of the factory image address a also includes a simplified version of the business logic, which is used for FPGA external communication, and the communication protocol is compatible with the communication protocol of the complete version of the business logic.

3. The method according to claim 1, characterized in that The method also includes FPGA remote update logic anti-cloning, including the following steps: Before leaving the factory, the logic at the application image address b is loaded and the authentication logic therein is run to read the serial number of the FPGA, and the digital signature is generated by the asymmetric public key encryption algorithm and then written into the electronic signature address d; Then, the copy logic in the logic at the application image address b is run to copy the signature verification logic and the business logic at the third segment image address c to the application image address b, thereby overwriting the authentication logic; After leaving the factory, when the signature verification logic and business logic of the application image address b are loaded after power-on, the electronic signature of the electronic signature address d will be read, and the asymmetric public key digital signature verification algorithm will be used to verify the electronic signature and the FPGA serial number. If the verification passes, the business logic in the application image address b is allowed to run normally. If the verification fails, the business logic is locked or the business logic behaves abnormally.

4. The method according to any one of claims 1 to 3, characterized in that: The logic of the factory image address a, the logic of the application image address b and the logic of the third segment image address c are spliced ​​into a memory initialization file before leaving the factory and are written into corresponding addresses respectively.

5. A method combining FPGA remote update and logic anti-cloning functions, characterized in that: The following steps are involved: Before leaving the factory, the logic at the application image address b is loaded and the authentication logic therein is run to read the serial number of the FPGA, and the digital signature is generated by the asymmetric public key encryption algorithm and then written into the electronic signature address d; Then, the copy logic in the logic at the application image address b is run to copy the signature verification logic and the business logic at the third segment image address c to the application image address b, thereby overwriting the authentication logic; After leaving the factory and powering on, load the logic of the factory image address a to verify the logic of the application image address b: If the verification fails, the power-on copy processing logic of the factory image address a is loaded, so that the content at the third segment image address c is copied to the application image address b. The content of the third segment image address c is the logic content after the FPGA remotely updated the application image address b last time; if the copy is successful, wait for power-on again to load the logic of the factory image address a. If the copy fails or the power is not re-on, the remote update process control logic of the factory image address a is run. When the remote update instruction is received, the remote update process control logic of the factory image address a first writes the new logic to the third segment image address c, and then copies the content at the third segment image address c to the application image address b to complete the update; If the verification is successful, the logic of the application image address b is loaded. When the remote update instruction is received, the remote update process control logic of the application image address b first writes the new logic into the third segment image address c, and then copies the content at the third segment image address c to the application image address b to complete the update. At the same time, the signature verification logic of the application image address b will read the electronic signature of the electronic signature address d, and use the asymmetric public key digital signature verification algorithm to verify the electronic signature and the FPGA serial number. If the verification passes, the business logic in the application image address b is allowed to run normally. If the verification fails, the business logic is locked or the business logic behaves abnormally.

6. An FPGA remote update optimization system, characterized in that: Including factory mirror module, application mirror module and third-stage mirror module, The factory mirror module is used to confirm that the logic of the application mirror module is checked before powering on. If the check fails, the power-on copy processing logic of the factory mirror module is run to copy the logic of the third-segment mirror module to the application mirror module. The logic of the third-segment mirror module is the logic content after the FPGA remotely updates the application mirror module last time; if the copy is successful, wait for the system to be powered on again. If the copy fails or the power is not turned on again, the remote update process control logic of the factory mirror module is run. After receiving the remote update instruction, the remote update process control logic of the factory mirror module first writes the new logic into the third-segment mirror module, and then copies the content of the third-segment mirror module to the application mirror module to complete the update; The application mirror module is used to power on and, after successful inspection by the factory mirror module, when a remote update instruction is received, the remote update process control logic of the application mirror module first writes the new logic into the third-segment mirror module, and then copies the logic content of the third-segment mirror module to the application mirror module to complete the update.

7. The system according to claim 6, characterized in that It also includes an initialization mirror module and an electronic signature module. The initialization mirror module is used to load the authentication logic of the initialization mirror module before leaving the factory, so as to read the serial number of the FPGA, generate a digital signature through an asymmetric public key encryption algorithm and write it into the electronic signature module, and then clear the logic content of the initialization mirror module; The application mirror module is also used to read the electronic signature of the electronic signature module when the signature verification logic of the application mirror module is powered on and loaded after leaving the factory, and use an asymmetric public key digital signature verification algorithm to verify the electronic signature and the FPGA serial number. If the verification passes, the business logic of the application mirror module is allowed to run normally. If the verification fails, the business logic is locked or the business logic behaves abnormally.

8. The system according to claim 7, characterized in that The system is based on a memory as a carrier, the factory image module is located at the factory image address a of the memory, the third-segment image module is located at the third-segment image address c, the electronic signature module is located at the electronic signature address d, and the application image module and the initialization image module are both located at the application image address b; the logical content of the initialization image module is cleared by erasing or destroying the logical content of the initialization image module and then powering on again; or, the logical content of the initialization image module is cleared by loading the copy logic of the initialization image module to copy the signature verification logic of the third-segment image module to the application image module, thereby overwriting the authentication logic.

9. The system according to any one of claims 6 to 8, characterized in that: The factory mirror module is also used to verify the application mirror module after failure. If the re-power-on verification fails again, the remote update process control logic of the factory mirror module is loaded. After receiving the remote update instruction, the remote update process control logic of the factory mirror module first writes the new logic into the third-segment mirror module, and then copies the logic content of the third-segment mirror module to the application mirror module to complete the update; and / or, it is also used for FPGA external communication, and the communication protocol is compatible with the communication protocol of the full version of the business logic to support the transmission of remote update commands and remote update data.

10. A processor, characterized in that: Used to run a program, wherein the program, when run, is used to execute: the FPGA remote update optimization method according to any one of claims 1 to 4.

Images