Hardware authorization method, logic device and embedded equipment

Abstract

The embodiment of the invention provides a hardware authorization method, a logic device and embedded equipment, and relates to the technical field of information security. If a hardware authorization instruction sent by the processor is received within a preset duration after the embedded device is powered on, whether an authorization module meets a preset authorization condition or not is determined; the preset authorization condition comprises that the authorization module is in place and target data is set in the authorization module; if the authorization module meets the preset authorization condition, a decryption instruction is sent to the authorization module, so that the authorization module decrypts the pre-stored encrypted data according to a pre-stored decryption key under the condition of receiving the decryption instruction; and obtaining decrypted data decrypted by the authorization module, verifying the decrypted data, and if the verification of the decrypted data is passed, determining that the hardware authorization is successful. Thus, it can be guaranteed that information such as an encryption algorithm and a secret key cannot be leaked, a hardware authorization mechanism cannot be avoided, the safety of the hardware authorization mechanism is improved, and the safety of hardware products during outsourcing production is guaranteed.

Description

Technical Field

[0001] The present application relates to the field of information security technology, and in particular to a hardware authorization method, a logic device, and an embedded device. Background Art

[0002] With the rapid development of mobile Internet, cloud, big data and other related technologies, the update rate of data communication products in the embedded field is getting faster and faster, especially the generation efficiency of mid- and low-end routing and switching equipment. Therefore, the outsourcing production of embedded product hardware will become an important indicator to measure whether an enterprise has a diversified development model, that is, whether it can quickly launch and release new products to occupy the market by leveraging the foundry's mature production technology, perfect management process, extreme supply chain cost and other advantages.

[0003] At present, when outsourcing production, it is often necessary to provide the foundry with information such as firmware version and system software version so that the foundry can produce hardware products based on this information. In this case, if the product hardware does not have license authorization technology at the design level, it is easy for some unscrupulous manufacturers to illegally produce unauthorized hardware products, resulting in pirated hardware products.

[0004] In the prior art, in order to ensure the security of embedded device hardware production, an authorization component can generally be set for the product hardware, and the product hardware can support license authorization technology through the following two methods.

[0005] First, the embedded CPU of the product hardware can control the authorization component to perform encryption calculations through original data, such as random numbers. At the same time, the CPU can also use the same encryption algorithm to perform encryption calculations. The CPU can then compare the encrypted data of the authorization component with the encrypted data of the CPU itself. If the encrypted data are the same, it can be determined that the hardware authorization is successful, so the CPU program can continue to run to produce the product hardware; conversely, if the encrypted data are different, it can be determined that the hardware authorization has failed, and the CPU program needs to be stopped at this time.

[0006] Secondly, the authorization component can store signature data or encrypted data, and the embedded CPU of the product hardware can trigger the authorization component to perform decryption calculations on the signature data or encrypted data. The CPU can then verify the decrypted data obtained by the decryption calculation. If the verification passes, it can be determined that the hardware authorization is successful, so the CPU program can continue to run to produce the product hardware; conversely, if the verification fails, it can be determined that the hardware authorization has failed, and the CPU program needs to be stopped at this time.

[0007] But both methods have certain flaws.

[0008] First of all, for the first method, since it is necessary to provide CPU-related programs to OEM manufacturers when outsourcing production, and this method requires the CPU to use encryption algorithms for encryption calculations, the CPU program will store corresponding encryption algorithms, symmetric keys and other information. In this case, the hardware authorization logic can be easily cracked externally, resulting in the leakage of encryption algorithms and symmetric keys. Therefore, this method has certain security risks.

[0009] Secondly, for the second method, although the decryption calculation is performed by the authorized component and the CPU does not participate in the calculation, if the CPU program is replaced, the authorized component will be bypassed. In this case, the product hardware can be produced without hardware authorization through the authorized component. In this way, the original hardware authorization mechanism will be circumvented. Therefore, this method also has certain security risks. Summary of the invention

[0010] In view of this, the purpose of this application is to provide a hardware authorization method, logic device and embedded device to ensure that information such as encryption algorithms and keys will not be leaked and that the hardware authorization mechanism will not be circumvented, thereby improving the security of the hardware authorization mechanism and further ensuring the security of hardware products during outsourced production.

[0011] In order to achieve the above purpose, the technical solution adopted in the embodiment of the present application is as follows:

[0012] In a first aspect, the present invention provides a hardware authorization method, which is applied to a logic device in an embedded device, wherein the embedded device further comprises a processor and an authorization module, and the logic device is connected to the processor, and the method comprises:

[0013] If a hardware authorization instruction sent by the processor is received within a preset time after the embedded device is powered on, it is determined whether the authorization module meets a preset authorization condition; the preset authorization condition includes that the authorization module is in place and the target data is set in the authorization module;

[0014] If the authorization module meets the preset authorization condition, a decryption instruction is sent to the authorization module, so that the authorization module decrypts the pre-stored encrypted data according to the pre-stored decryption key when receiving the decryption instruction;

[0015] The decrypted data obtained after the decryption by the authorization module is obtained, and the decrypted data is verified. If the decrypted data passes the verification, it is determined that the hardware authorization is successful.

[0016] In an optional embodiment, the method further comprises:

[0017] If the hardware authorization instruction sent by the processor is not obtained within a preset time after the embedded device is powered on, the embedded device is reset and the values ​​of all its registers are reset to initial values.

[0018] In an optional implementation manner, the target data is an identity identifier, and determining whether the authorization module satisfies a preset authorization condition includes:

[0019] Performing in-place detection on the authorization module according to the level state of the pin connected to the authorization module;

[0020] When it is determined that the authorization module is in place, sending an instruction to the authorization module to obtain the identity identifier of the authorization module;

[0021] If the identity of the authorization module is successfully obtained, it is determined that the authorization module meets the preset authorization condition;

[0022] If the identity identifier of the authorization module is not obtained, it is determined that the authorization module does not meet the preset authorization condition.

[0023] In an optional embodiment, the method further comprises:

[0024] If the authorization module does not meet the preset authorization condition, the embedded device is reset and the values ​​of all its registers are reset to initial values.

[0025] In an optional implementation manner, the verifying the decrypted data includes:

[0026] Determining whether the decrypted data matches the identity of the authorization module and the pre-stored device identity;

[0027] If the decrypted data matches the identity of the authorization module and the pre-stored device identity, it is determined that the decrypted data has passed the verification;

[0028] If the decrypted data does not match the identity of the authorization module and the pre-stored device identity, it is determined that the decrypted data verification has failed.

[0029] In an optional embodiment, the method further comprises:

[0030] If the decrypted data verification fails, the embedded device is reset and the values ​​of all its registers are reset to initial values.

[0031] In an optional implementation, after the step of determining that the hardware authorization is successful, the method further includes:

[0032] Generate authorization success information, and store the authorization success information in a register of the processor so that the processor can read it.

[0033] In a second aspect, the present invention provides a logic device, the logic device is connected to a processor in an embedded device, and the embedded device further includes an authorization module;

[0034] The logic device is used to determine whether the authorization module meets a preset authorization condition when receiving a hardware authorization instruction sent by the processor within a preset time after the embedded device is powered on; the preset authorization condition includes that the authorization module is in place and the target data is set in the authorization module;

[0035] The logic device is further configured to send a decryption instruction to the authorization module if the authorization module meets the preset authorization condition, so that the authorization module decrypts the pre-stored encrypted data according to the pre-stored decryption key when receiving the decryption instruction;

[0036] The logic device is further used to obtain the decrypted data obtained after the decryption by the authorization module, and verify the decrypted data. If the decrypted data passes the verification, it is determined that the hardware authorization is successful.

[0037] In an optional implementation, the logic device is also used to reset the embedded device and reset the values ​​of all its registers to default values ​​if the hardware authorization instruction sent by the processor is not obtained within a preset time after the embedded device is powered on.

[0038] In a third aspect, the present invention provides an embedded device, comprising the logic device described in the aforementioned embodiment, the embedded device further comprising a processor and an authorization module, the logic device being communicatively connected to the processor and the authorization module respectively.

[0039] The hardware authorization method, logic device and embedded device provided by the embodiment of the present application, the logic device can first determine whether the hardware authorization instruction sent by the processor is received within a preset time after power-on, so as to determine whether the program in the processor has been replaced, and then continue to execute the next hardware authorization step if it is received, so that the hardware authorization can be performed while ensuring that the processor program is not replaced. In addition, the logic device can send a decryption instruction to the authorization module when the authorization module meets the authorization conditions, so that the authorization module decrypts the pre-stored encrypted data according to the pre-stored decryption key, and the authorization module can determine whether the hardware authorization is successful according to the verification of the decrypted data. Since the authorization conditions include that the authorization module is connected in place with the logic device and the target data is set therein, the logic device can perform the next hardware authorization step when it is determined that the authorization module is not bypassed and meets certain setting requirements, so as to ensure that the hardware authorization mechanism will not be circumvented. At the same time, the secret key and the encrypted data are stored in the authorization chip, and the processor and the logic device do not store the relevant parameters, nor do they perform decryption calculations, so it can be ensured that the decryption algorithm and the secret key will not be leaked. In summary, this method can improve the security of the hardware authorization mechanism, thereby ensuring the security of hardware products during outsourcing production.

[0040] In order to make the above-mentioned objects, features and advantages of the present application more obvious and easy to understand, preferred embodiments are specifically cited below and described in detail with reference to the attached drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0042] Figure 1 A block diagram of an embedded device provided in an embodiment of the present application is shown;

[0043] Figure 2 A schematic diagram of a process flow of a hardware authorization method provided in an embodiment of the present application is shown;

[0044] Figure 3 Another schematic diagram of a process flow of a hardware authorization method provided in an embodiment of the present application is shown;

[0045] Figure 4 Another flowchart of the hardware authorization method provided in an embodiment of the present application is shown.

[0046] Icon: 10-Logic device; 20-Processor; 30-Authorization module. DETAILED DESCRIPTION

[0047] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. The components of the embodiments of the present application described and shown in the drawings here can be arranged and designed in various different configurations.

[0048] Therefore, the following detailed description of the embodiments of the present application provided in the accompanying drawings is not intended to limit the scope of the present application for which protection is sought, but merely represents selected embodiments of the present application. Based on the embodiments of the present application, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present application.

[0049] It should be noted that relational terms such as "first" and "second" are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprises" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the existence of other identical elements in the process, method, article or device including the element.

[0050] Figure 1 For a block diagram of an embedded device provided in an embodiment of the present application, see Figure 1 The embedded device includes a logic device 10, a processor 20 and an authorization module 30, and the logic device 10 is connected to the processor 20 and the authorization module 30 respectively.

[0051] Optionally, the processor 20 may be a CPU (Central Processing Unit), and the authorization module 30 may be an authorization chip or the like.

[0052] Optionally, the logic device may be a Complex Programmable Logic Device (CPLD) or a Field Programmable Gate Array (FPGA).

[0053] It can be understood that, in normal application situations, the logic device should be connected to the processor and the authorization module respectively to perform hardware authorization.

[0054] Optionally, a configuration channel and a control channel may be provided between the processor 20 and the logic device 10 , and a data channel may be provided between the logic device 10 and the authorization module 30 .

[0055] In this embodiment, the configuration channel can be used for normal instruction interaction between the processor and the logic device, such as write instructions, read instructions, etc.; the control channel can be used for the logic device to control the operating state of the processor, such as reset control, etc.; the data channel can be used for normal data interaction between the logic device and the authorization module, such as obtaining decrypted data, etc.

[0056] Optionally, in the embodiment of the present invention, after the foundry performs hardware production on the embedded device of the present invention, the production is completed only after the software program corresponding to the original manufacturer is loaded. After the embedded device is powered on, it is necessary to pass the authorization verification of the embedded device before the customer can use it normally.

[0057] In this embodiment, the logic device may be used to determine whether the authorization module meets a preset authorization condition when receiving a hardware authorization instruction sent by the processor within a preset time period after the embedded device is powered on.

[0058] The preset authorization condition includes that the authorization module is in place and the target data is set in the authorization module.

[0059] Optionally, the logic device may also be used to send a decryption instruction to the authorization module if the authorization module meets preset authorization conditions, so that the authorization module decrypts the pre-stored encrypted data according to the pre-stored decryption key when receiving the decryption instruction.

[0060] Optionally, the logic device may also be used to obtain decrypted data obtained after decryption by the authorization module, and verify the decrypted data. If the decrypted data passes the verification, it is determined that the hardware authorization is successful.

[0061] The logic device provided in the embodiment of the present application can first determine whether the hardware authorization instruction sent by the processor is received within a preset time after power-on, so as to determine whether the program in the processor has been replaced. If it is received, the next hardware authorization step will be continued, so that the hardware authorization can be performed while ensuring that the processor program has not been replaced. In addition, the logic device can send a decryption instruction to the authorization module when the authorization module meets the authorization conditions, so that the authorization module decrypts the pre-stored encrypted data according to the pre-stored decryption key, and the authorization module can determine whether the hardware authorization is successful according to the verification of the decrypted data. Since the authorization conditions include that the authorization module is connected in place with the logic device and the target data is set therein, the logic device can perform the next hardware authorization step when it is determined that the authorization module has not been bypassed and meets certain setting requirements, so as to ensure that the hardware authorization mechanism will not be circumvented. At the same time, the secret key and the encrypted data are stored in the authorization chip, and the processor and the logic device do not store the relevant parameters, nor do they perform decryption calculations, so it can be ensured that the decryption algorithm and the secret key will not be leaked. In summary, this method can improve the security of the hardware authorization mechanism, thereby ensuring the security of hardware products during outsourcing production.

[0062] Optionally, the logic device may also be used to reset the embedded device and reset all registers in the logic device to initial values ​​if no hardware authorization instruction is received from the processor within a preset time after the embedded device is powered on.

[0063] It is understandable that, in addition to being used in hardware authorization scenarios, logic devices can also support the operation of many functions. Therefore, after resetting all the internal registers to their initial values, the system will not be able to be used normally. Therefore, it can be avoided that the system can still be used normally after the reset, thereby ensuring that the hardware authorization steps cannot be circumvented during outsourced production to ensure security.

[0064] Next, Figure 1 The logic device 10 in the embodiment is the execution subject, and the hardware authorization method provided in the embodiment of the present application is exemplarily introduced in combination with the flow chart.

[0065] Specifically, Figure 2 A flowchart of the hardware authorization method provided in the embodiment of the present application is shown in Figure 2 , the method comprising:

[0066] Step S20: If a hardware authorization instruction sent by the processor is received within a preset time after the embedded device is powered on, it is determined whether the authorization module meets the preset authorization condition.

[0067] The preset authorization condition includes that the authorization module is in place and the target data is set in the authorization module.

[0068] Optionally, if the program in the processor has not been replaced, the processor will send a hardware authorization instruction to the logic device after power-on.

[0069] Optionally, the logic device may start timing after the embedded device is powered on to determine whether a hardware authorization instruction sent by the processor is received within a preset time period.

[0070] Optionally, the preset duration can be set according to actual application conditions, for example, set to 3 minutes.

[0071] Optionally, the processor may send a hardware authorization instruction to the logic device by writing a register of the logic device, thereby triggering the logic device to perform authorization authentication.

[0072] It is understandable that during normal use, the logic device should be connected to the authorization module. However, in the case of illegal production, the original authorization module in the embedded device may be replaced or the hardware authorization module may not be connected. Therefore, in order to ensure the security of hardware authorization, the logic device needs to first determine whether the authorization module meets the preset authorization conditions.

[0073] Step S21: If the authorization module meets the preset authorization conditions, a decryption instruction is sent to the authorization module, so that the authorization module decrypts the pre-stored encrypted data according to the pre-stored decryption key when receiving the decryption instruction.

[0074] Optionally, the authorization module may pre-store a decryption key and encrypted data, and the encrypted data may be generated in advance by an encryption algorithm and stored in the authorization module.

[0075] It can be understood that the authorization module can decrypt the pre-stored encrypted data based on the pre-stored decryption algorithm and decryption key.

[0076] Step S22, obtaining the decrypted data obtained after the decryption by the authorization module, and verifying the decrypted data. If the decrypted data passes the verification, it is determined that the hardware authorization is successful.

[0077] Optionally, considering that the authorization module may be replaced, the logic device needs to verify the decrypted data of the authorization module to determine whether the hardware authorization is successful.

[0078] In the hardware authorization method provided by the embodiment of the present application, the logic device can first determine whether the hardware authorization instruction sent by the processor is received within a preset time after power-on, so as to determine whether the program in the processor has been replaced, and then continue to execute the next hardware authorization step if it is received, so that the hardware authorization can be performed while ensuring that the processor program has not been replaced. In addition, the logic device can send a decryption instruction to the authorization module when the authorization module meets the authorization conditions, so that the authorization module decrypts the pre-stored encrypted data according to the pre-stored decryption key, and the authorization module can determine whether the hardware authorization is successful according to the verification of the decrypted data. Since the authorization conditions include that the authorization module is connected in place with the logic device and the target data is set therein, the logic device can perform the next hardware authorization step when it is determined that the authorization module has not been bypassed and meets certain setting requirements, thereby ensuring that the hardware authorization mechanism will not be circumvented. At the same time, the secret key and the encrypted data are stored in the authorization chip, and the processor and the logic device do not store the relevant parameters, nor do they perform decryption calculations, so it can be ensured that the decryption algorithm and the secret key will not be leaked. In summary, this method can improve the security of the hardware authorization mechanism, thereby ensuring the security of hardware products during outsourcing production.

[0079] Optionally, if the logic device does not obtain the hardware authorization instruction sent by the processor within a preset time after the embedded device is powered on, the embedded device may be reset and the values ​​of all its registers may be reset to initial values.

[0080] Optionally, resetting the embedded device in the embodiment of the present invention means that the logic device may reset other devices in the embedded device except itself, that is, the processor and the authorization module.

[0081] In this embodiment, if the logic device does not obtain the authorization instruction sent by the processor within the preset time after the embedded device is powered on, it may mean that the program in the processor may have been replaced, and therefore the original hardware authorization indication function cannot be executed. In this case, there may be a risk of illegal production, so it is necessary to stop the normal operation of the embedded device system so that the embedded device cannot be used normally.

[0082] In this embodiment, it is considered that the reset pin of the processor may be vacant, resulting in the logic device being unable to reset the processor when controlling the reset of the embedded device. Therefore, when the logic device resets the embedded device, not only does it need to restart the entire embedded device, but all registers in the logic device are also reset to their initial values.

[0083] It is understandable that, in addition to being used in hardware authorization scenarios, logic devices can also support the operation of many functions. Therefore, after resetting all the internal registers to their initial values, the system will not be able to be used normally. Therefore, it can be avoided that the system can still be used normally after the reset, thereby ensuring that the hardware authorization steps cannot be circumvented during outsourced production to ensure security.

[0084] In a possible implementation, the target data may be an identity identifier, which may uniquely represent an authorization module, such as an ID.

[0085] Next, a possible implementation method is provided for determining whether the authorization module meets the preset authorization conditions.

[0086] Specifically, in Figure 2 On the basis of Figure 3 For another flowchart of the hardware authorization method provided in the embodiment of the present application, please refer to Figure 3 The determination of whether the authorization module meets the preset authorization condition in step S20 can also be implemented by the following steps:

[0087] Step S20-1, performing a presence detection on the authorization module according to the level state of the pin connected to the authorization module.

[0088] Step S20-2: When it is determined that the authorization module is in place, an instruction for obtaining the identity of the authorization module is sent to the authorization module.

[0089] Step S20-3: If the identity of the authorization module is successfully obtained, it is determined that the authorization module meets the preset authorization conditions.

[0090] Step S20-4: If the identity identifier of the authorization module is not obtained, it is determined that the authorization module does not meet the preset authorization condition.

[0091] Optionally, the authorization module may not meet the authorization condition in two cases, namely, the logic device is not connected to the authorization module or the authorization module is other modules that do not meet the requirements.

[0092] In this embodiment, the logic device can first determine whether it is in communication connection with the authorization module. If there is a communication connection, an instruction to obtain the identity identifier is sent to the authorization module. If the corresponding identity identifier can be obtained, it means that the authorization module is a module that meets the requirements. If the identity identifier cannot be obtained, it means that the authorization module may not be configured with an identity identifier at all or does not support obtaining the identity identifier. Therefore, the authorization module is other modules that do not meet the requirements. At this time, there may be a risk of the authorization module being replaced.

[0093] In this embodiment, in order to avoid possible security risks when the authorization module is replaced, if the authorization module does not meet the preset authorization conditions, the logic device can reset the embedded device and reset the values ​​of all its registers to initial values.

[0094] It should be noted that if the corresponding identity can be obtained, it only means that the authorization module is a module with an identity and supports obtaining the identity, but it does not mean that the authorization module is the original authorization module provided by the original manufacturer of the hardware product. Further verification is needed.

[0095] Optionally, if the corresponding identity identifier can be obtained, the logic device may send a decryption instruction to the authorization module, and the authorization module may decrypt the pre-stored encrypted data according to the pre-stored decryption key, thereby obtaining the decrypted data.

[0096] In one possible implementation, the encrypted data can be generated in advance based on the identity of the authorization module and the device identity, so the decrypted data can include the identity of the authorization module and the device identity. In this case, the logic device can verify the decrypted data through the identity corresponding to the authorization module and the pre-stored device identity.

[0097] In this embodiment, for a box-type embedded device, the device identity may be the identity of the box-type embedded device itself, and for a distributed embedded device, the device identity may be the identity of a single board where the processor, authorization module and logic device are located.

[0098] Specifically, in Figure 2 On the basis of Figure 4 For another flowchart of the hardware authorization method provided in the embodiment of the present application, please refer to Figure 4 The verification of the decrypted data in the above step S22 can also be achieved by the following steps:

[0099] Step S22-1, determining whether the decrypted data matches the identity of the authorization module and the pre-stored device identity.

[0100] Step S22-2: If the decrypted data matches the identity of the authorization module and the pre-stored device identity, it is determined that the decrypted data verification has passed.

[0101] Step S22-3: If the decrypted data does not match the identity of the authorization module and the pre-stored device identity, it is determined that the decrypted data verification has failed.

[0102] In this embodiment, embedded devices of the same model can have the same device identity, while embedded devices of different models have different device identity. Therefore, this method can also prevent the foundry from illegally producing hardware products corresponding to a certain hardware product project in other hardware product projects, thereby ensuring the safety of hardware products during outsourced production.

[0103] In this embodiment, the identity of the authorization module obtained by the logic device can be further verified to determine whether the authorization module is an original authorization module. At the same time, the decrypted data can be verified to determine whether there is an error in the decrypted data.

[0104] In this embodiment, if the decrypted data verification fails, the logic device may reset the embedded device and reset the values ​​of all its registers to initial values.

[0105] Optionally, if the decrypted data does not match any one of the identity identifier and the device identity identifier, it can be determined that the decrypted data verification has failed.

[0106] Optionally, in order to ensure that the processor can run normally when the hardware authorization is successful, the logic device needs to notify the processor of the result of the successful hardware authorization.

[0107] In a possible implementation, after determining that the hardware authorization is successful, the logic device may generate authorization success information and store the authorization success information in a register of the logic device so that the processor can read the information. The register for storing the authorization success information is predefined.

[0108] Optionally, after sending the hardware authorization instruction, the processor may wait for a preset authorization time to read the register of the logic device. If authorization success information is read, it can be determined that the hardware authorization is successful, so the program can continue to run.

[0109] Optionally, the authorization success information may be an authorization success identifier.

[0110] In several embodiments provided in the present application, it should be understood that the disclosed method can also be implemented in other ways. The embodiments described above are merely schematic. For example, the flowchart in the accompanying drawings shows the possible implementation architecture, functions and operations of the method and computer program product according to multiple embodiments of the present application. In this regard, each box in the flowchart or block diagram can represent a module, a program segment or a part of the code, and a part of the module, program segment or code contains one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two consecutive boxes can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flow chart, and the combination of boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or action, or can be implemented with a combination of dedicated hardware and computer instructions.

[0111] The above description is only the preferred embodiment of the present application and is not intended to limit the present application. For those skilled in the art, the present application may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application.

Claims

1. A hardware authorization method, characterized in that: A logic device applied to an embedded device, the embedded device further comprising a processor and an authorization module, the logic device being connected to the processor, the method comprising: If a hardware authorization instruction sent by the processor is received within a preset time after the embedded device is powered on, it is determined whether the authorization module meets a preset authorization condition; the preset authorization condition includes that the authorization module is in place and the target data is set in the authorization module; If the authorization module meets the preset authorization condition, a decryption instruction is sent to the authorization module, so that the authorization module decrypts the pre-stored encrypted data according to the pre-stored decryption key when receiving the decryption instruction; The decrypted data obtained after the decryption by the authorization module is obtained, and the decrypted data is verified. If the decrypted data passes the verification, it is determined that the hardware authorization is successful.

2. The method according to claim 1, characterized in that The method further comprises: If the hardware authorization instruction sent by the processor is not obtained within a preset time after the embedded device is powered on, the embedded device is reset and the values ​​of all its registers are reset to initial values.

3. The method according to claim 1, characterized in that The target data is an identity identifier, and the determining whether the authorization module satisfies a preset authorization condition includes: Performing in-place detection on the authorization module according to the level state of the pin connected to the authorization module; When it is determined that the authorization module is in place, sending an instruction to the authorization module to obtain the identity identifier of the authorization module; If the identity of the authorization module is successfully obtained, it is determined that the authorization module meets the preset authorization condition; If the identity identifier of the authorization module is not obtained, it is determined that the authorization module does not meet the preset authorization condition.

4. The method according to claim 1, characterized in that: The method further comprises: If the authorization module does not meet the preset authorization condition, the embedded device is reset and the values ​​of all its registers are reset to initial values.

5. The method according to claim 1, characterized in that: The verifying the decrypted data comprises: Determining whether the decrypted data matches the identity of the authorization module and the pre-stored device identity; If the decrypted data matches the identity of the authorization module and the pre-stored device identity, it is determined that the decrypted data has passed the verification; If the decrypted data does not match the identity of the authorization module and the pre-stored device identity, it is determined that the decrypted data verification has failed.

6. The method according to claim 1, characterized in that The method further comprises: If the decrypted data verification fails, the embedded device is reset and the values ​​of all its registers are reset to initial values.

7. The method according to any one of claims 1 to 6, characterized in that: After the step of determining that the hardware authorization is successful, the method further includes: Generate authorization success information, and store the authorization success information in a register of the processor so that the processor can read it.

8. A logic device, characterized in that: The logic device is connected to a processor in an embedded device, and the embedded device further includes an authorization module; The logic device is used to determine whether the authorization module meets a preset authorization condition when receiving a hardware authorization instruction sent by the processor within a preset time after the embedded device is powered on; the preset authorization condition includes that the authorization module is in place and the target data is set in the authorization module; The logic device is further configured to send a decryption instruction to the authorization module if the authorization module meets the preset authorization condition, so that the authorization module decrypts the pre-stored encrypted data according to the pre-stored decryption key when receiving the decryption instruction; The logic device is further used to obtain the decrypted data obtained after the decryption by the authorization module, and verify the decrypted data. If the decrypted data passes the verification, it is determined that the hardware authorization is successful.

9. The logic device according to claim 8, characterized in that: The logic device is also used to reset the embedded device and reset the values ​​of all its registers to initial values ​​if the hardware authorization instruction sent by the processor is not obtained within a preset time after the embedded device is powered on.

10. An embedded device, characterized in that: The embedded device comprises the logic device as claimed in claim 9, and further comprises a processor and an authorization module, wherein the logic device is communicatively connected to the processor and the authorization module respectively.

Images