Memory operation method and device, computer equipment and readable storage medium

Abstract

The invention relates to a memory operation method and device, computer equipment, a computer readable storage medium and a computer program product, and can be applied to the technical field of computers. The method comprises the following steps: in response to an operation instruction for a target memory, generating a multi-bit trigger signal of a state machine; the operation instruction comprises an erasing instruction or a programming instruction; analyzing the multi-bit trigger signal through a state machine to obtain a multi-bit control signal for the target memory; performing key matching verification processing on the multi-bit control signal to obtain a verification result of the multi-bit control signal; under the condition that the verification result shows that the verification of the multi-bit control signal is passed, converting the multi-bit control signal into a final control signal, and sending the final control signal to the target memory; the target memory is used for performing erasing operation or programming operation according to the final control signal. By adopting the method, the security of memory operation can be improved.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a memory operation method, apparatus, computer device, computer-readable storage medium, and computer program product. Background Art

[0002] With the rapid development of computer technology, the application of memory in various embedded systems is becoming more and more extensive. Memory plays an important role in storing critical data in the system. Therefore, how to safely operate memory has become an important research direction.

[0003] Traditional technology usually uses a simple direct control method to erase or burn the memory; however, memory operations performed in this way lack an effective security verification mechanism and are prone to the risk of accidental tampering, resulting in low security of memory operations. Summary of the invention

[0004] Based on this, it is necessary to provide a memory operation method, apparatus, computer device, computer-readable storage medium and computer program product that can improve the security of memory operation in response to the above technical problems.

[0005] In a first aspect, the present application provides a memory operation method. The method comprises:

[0006] In response to an operation instruction for a target memory, a multi-bit trigger signal of a state machine is generated; the operation instruction includes an erase instruction or a program instruction;

[0007] By means of the state machine, the multi-bit trigger signal is analyzed and processed to obtain a multi-bit control signal for the target memory;

[0008] Performing key matching verification processing on the multi-bit control signal to obtain a verification result of the multi-bit control signal;

[0009] When the verification result indicates that the multi-bit control signal has passed the verification, the multi-bit control signal is converted into a final control signal, and the final control signal is sent to the target memory; the target memory is used to perform an erase operation or a burn operation according to the final control signal.

[0010] In one of the embodiments, the controller of the target memory accesses the default value of the address control pin of the target memory and selects a non-valid code area.

[0011] In one embodiment, the state machine is used to parse and process the multi-bit trigger signal to obtain a multi-bit control signal for the target memory, including:

[0012] Using the multi-bit trigger signal as a multi-bit input signal of the state machine;

[0013] Inputting the multi-bit input signal into the state machine for analysis and processing to obtain a multi-bit output signal output by the state machine;

[0014] A multi-bit control signal for the target memory is determined according to the multi-bit output signal.

[0015] In one of the embodiments, a reset domain of a logic in a controller of the target memory corresponding to an erase operation or a program operation of the target memory is the same as a reset domain in a target processor corresponding to the target memory.

[0016] In one of the embodiments, the startup information of the target processor corresponding to the target memory is stored in a read-only memory.

[0017] In one embodiment, the method further comprises:

[0018] Redundantly backing up the key information of the target storage in multiple backup storages;

[0019] Performing verification processing on the key information backed up in the multiple backup memories to obtain verification results of the key information backed up in the multiple backup memories;

[0020] According to the verification result, correct information is selected from the key information backed up in the multiple backup memories.

[0021] In one embodiment, after performing key matching verification processing on the multi-bit control signal to obtain the verification result of the multi-bit control signal, the method further includes:

[0022] If the verification result indicates that the multi-bit control signal fails verification, generating reporting information corresponding to the verification result;

[0023] The reporting information is reported to a target processor corresponding to the target memory.

[0024] In one of the embodiments, before generating a multi-bit trigger signal of a state machine in response to an operation instruction for a target memory, the method further includes:

[0025] When the operation instruction check passes and the operation address corresponding to the operation instruction is allowed to be operated, the operation instruction sent by the target processor corresponding to the target memory is received.

[0026] In a second aspect, the present application further provides a memory operation device. The device comprises:

[0027] A signal generating module, used for generating a multi-bit trigger signal of a state machine in response to an operation instruction for a target memory; the operation instruction includes an erase instruction or a write instruction;

[0028] A signal analysis module, used for analyzing and processing the multi-bit trigger signal through the state machine to obtain a multi-bit control signal for the target memory;

[0029] A signal verification module, used to perform key matching verification processing on the multi-bit control signal to obtain a verification result of the multi-bit control signal;

[0030] A signal sending module is used to convert the multi-bit control signal into a final control signal when the verification result indicates that the multi-bit control signal has passed the verification, and send the final control signal to the target memory; the target memory is used to perform an erasing operation or a burning operation according to the final control signal.

[0031] In a third aspect, the present application further provides a computer device. The computer device includes a memory and a processor, the memory stores a computer program, and the processor implements the following steps when executing the computer program:

[0032] In response to an operation instruction for a target memory, a multi-bit trigger signal of a state machine is generated; the operation instruction includes an erase instruction or a program instruction;

[0033] By means of the state machine, the multi-bit trigger signal is analyzed and processed to obtain a multi-bit control signal for the target memory;

[0034] Performing key matching verification processing on the multi-bit control signal to obtain a verification result of the multi-bit control signal;

[0035] When the verification result indicates that the multi-bit control signal has passed the verification, the multi-bit control signal is converted into a final control signal, and the final control signal is sent to the target memory; the target memory is used to perform an erase operation or a burn operation according to the final control signal.

[0036] In a fourth aspect, the present application further provides a computer-readable storage medium. The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the following steps are implemented:

[0037] In response to an operation instruction for a target memory, a multi-bit trigger signal of a state machine is generated; the operation instruction includes an erase instruction or a program instruction;

[0038] By means of the state machine, the multi-bit trigger signal is analyzed and processed to obtain a multi-bit control signal for the target memory;

[0039] Performing key matching verification processing on the multi-bit control signal to obtain a verification result of the multi-bit control signal;

[0040] When the verification result indicates that the multi-bit control signal has passed the verification, the multi-bit control signal is converted into a final control signal, and the final control signal is sent to the target memory; the target memory is used to perform an erase operation or a burn operation according to the final control signal.

[0041] In a fifth aspect, the present application further provides a computer program product. The computer program product includes a computer program, and when the computer program is executed by a processor, the following steps are implemented:

[0042] In response to an operation instruction for a target memory, a multi-bit trigger signal of a state machine is generated; the operation instruction includes an erase instruction or a program instruction;

[0043] By means of the state machine, the multi-bit trigger signal is analyzed and processed to obtain a multi-bit control signal for the target memory;

[0044] Performing key matching verification processing on the multi-bit control signal to obtain a verification result of the multi-bit control signal;

[0045] When the verification result indicates that the multi-bit control signal has passed the verification, the multi-bit control signal is converted into a final control signal, and the final control signal is sent to the target memory; the target memory is used to perform an erase operation or a burn operation according to the final control signal.

[0046] The above-mentioned memory operation method, device, computer equipment, computer-readable storage medium and computer program product generate a multi-bit trigger signal of a state machine in response to an operation instruction for a target memory; the operation instruction includes an erase instruction or a burn instruction; the multi-bit trigger signal is parsed and processed by the state machine to obtain a multi-bit control signal for the target memory; the multi-bit control signal is subjected to key matching verification processing to obtain a verification result of the multi-bit control signal; when the verification result indicates that the multi-bit control signal is verified, the multi-bit control signal is converted into a final control signal and the final control signal is sent to the target memory; the target memory is used to perform an erase operation or a burn operation according to the final control signal. The scheme converts the operation instruction of the memory into a multi-bit trigger signal, and obtains a multi-bit control signal by parsing and processing through a state machine, which is conducive to reducing the risk of a single signal being interfered with and causing a memory malfunction; at the same time, by performing key matching verification processing on the multi-bit control signal, and only allowing the control signal to be sent to the target memory when the verification is passed, it is conducive to preventing unauthorized or abnormal memory operations; thereby, it is conducive to improving the security of memory operations and preventing the memory content from being accidentally tampered with. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the related technologies, the drawings required for use in the embodiments or the related technical descriptions are briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0048] Figure 1 is a flow chart of a memory operation method in one embodiment;

[0049] Figure 2 A schematic diagram of a flash memory erase or write operation process in one embodiment;

[0050] Figure 3 A schematic diagram of a process for enhancing flash memory anti-tampering control in an embodiment;

[0051] Figure 4 A schematic diagram of a key matching logic structure between a flash memory controller and a flash memory device in one embodiment;

[0052] Figure 5 A schematic diagram of a multi-bit trigger signal generation structure of a flash memory controller in one embodiment;

[0053] Figure 6 is a structural block diagram of a memory operation device in one embodiment;

[0054] Figure 7 FIG. 4 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0055] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0056] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant regulations.

[0057] In an exemplary embodiment, Figure 1 As shown, a memory operation method is provided. This embodiment uses the method applied to a terminal as an example for illustration. It is understandable that the method can also be applied to a server, and can also be applied to a system including a terminal and a server, and is implemented through the interaction between the terminal and the server. Among them, the terminal can be, but is not limited to, various personal computers, laptops, smart phones, tablet computers, etc.; the server can be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides cloud computing services. In this embodiment, the method includes the following steps:

[0058] Step S101, in response to an operation instruction for a target memory, generating a multi-bit trigger signal of a state machine; the operation instruction includes an erase instruction or a program instruction.

[0059] Step S102: Analyze and process the multi-bit trigger signal through a state machine to obtain a multi-bit control signal for the target memory.

[0060] Step S103, performing key matching verification processing on the multi-bit control signal to obtain a verification result of the multi-bit control signal.

[0061] Step S104, when the verification result indicates that the multi-bit control signal has passed the verification, the multi-bit control signal is converted into a final control signal, and the final control signal is sent to the target memory; the target memory is used to perform an erase operation or a burn operation according to the final control signal.

[0062] The memory operation method may be a series of steps for controlling and accessing the memory, for example, it may be a control method for erasing or programming a Flash memory (flash memory).

[0063] The target memory may be a storage device that needs to be operated, for example, a Flash Device.

[0064] The operation instruction may be a command for controlling the target memory to perform a specific operation, for example, an erase instruction (ERASE) or a program instruction (PROGRAM) issued by a CPU.

[0065] The state machine may be a finite state machine for controlling erase / write operations of the target memory.

[0066] Among them, the multi-bit trigger signal can be a plurality of binary signals used to start the state machine, for example, it can be a plurality of trigger signals such as trigger[0], trigger[1], trigger[2], trigger[3], etc., where trigger means trigger.

[0067] The multi-bit control signal may be a plurality of binary signals output by the state machine for controlling the target memory, for example, a multi-bit coded signal such as ERASE[0:3] or PROGRAM[0:3].

[0068] The key matching verification process may be a process of performing security verification on the control signal, for example, it may be a key verification performed using an 8-bit key (such as 8'hAA).

[0069] The verification result may be an output result of the key matching verification process, for example, may be status information indicating whether the keys match.

[0070] The final control signal may be a control signal obtained after a combinational logic operation of a multi-bit control signal.

[0071] The erase operation may be a process of clearing data in the target memory, for example, an operation of clearing the contents of the Flash memory triggered by an ERASE signal.

[0072] The programming operation may be a process of writing data into a target memory, for example, it may be a Flash memory data writing operation triggered by a PROGRAM (programming) signal.

[0073] Optionally, after receiving an operation instruction for a target memory (Flash Device), the Flash controller (Flash Controller) decodes the operation instruction into a 4-bit trigger signal trigger[0:3], and the trigger signal trigger[0:3] is used to start an erase / write state machine; the erase / write state machine generates a 4-bit erase control signal ERASE[0:3] or a 4-bit write control signal PROGRAM[0:3] according to the value of the trigger signal trigger[0:3]; the erase control signal ERASE[0:3] or the write control signal PROGRAM[0:3] is verified by a key matching verification circuit, and after the verification is passed, a combinational logic operation is performed on the erase control signal ERASE[0:3] or the write control signal PROGRAM[0:3] to obtain a final control signal for the target memory, and the final control signal is sent to a corresponding pin of the target memory (Flash Device), thereby triggering the target memory (Flash Device) to perform an erase operation or a write operation.

[0074] In the above-mentioned memory operation method, in response to the operation instruction for the target memory, a multi-bit trigger signal of the state machine is generated; the operation instruction includes an erase instruction or a burn instruction; the multi-bit trigger signal is parsed and processed by the state machine to obtain a multi-bit control signal for the target memory; the multi-bit control signal is subjected to key matching verification processing to obtain a verification result of the multi-bit control signal; when the verification result indicates that the multi-bit control signal is verified, the multi-bit control signal is converted into a final control signal, and the final control signal is sent to the target memory; the target memory is used to perform an erase operation or a burn operation according to the final control signal. This scheme converts the operation instruction of the memory into a multi-bit trigger signal, and parses and processes the multi-bit control signal through the state machine, which is conducive to reducing the risk of a single signal being interfered with and causing the memory to malfunction; at the same time, by performing key matching verification processing on the multi-bit control signal, and only allowing the control signal to be sent to the target memory when the verification is passed, it is conducive to preventing unauthorized or abnormal memory operations; thereby, it is conducive to improving the security of memory operations and preventing the memory content from being accidentally tampered with.

[0075] In an exemplary embodiment, the controller of the target memory accesses the default value of the address control pin of the target memory and selects the non-valid code area.

[0076] The controller may be a control circuit for controlling the target memory to perform data read and write operations, for example, may be a Flash Controller.

[0077] The address control pin may be an input port of the target memory for receiving address information, for example, an address input pin of a Flash Device.

[0078] The non-valid code area may be a storage space in the target memory that does not store valid program codes, for example, a storage area with an address of 32′hFFFF_FFFF.

[0079] The default value may be a preset value when no specific setting is performed on the system, for example, it may be an initial value automatically set by the address control pin after the system is reset.

[0080] Optionally, during the initialization phase, the Flash controller (Flash Controller) sets the default value of the address control pin of the target memory (Flash Device) to the address value of the non-valid code area, so that when the control signal of the Flash controller (Flash Controller) is subject to external interference or an abnormal flip occurs, even if the erase pin or the programming pin of the target memory (Flash Device) is abnormally triggered, the target memory (Flash Device) will only operate on the non-valid code area, thereby preventing the valid program code stored in the target memory (Flash Device) from being accidentally tampered with.

[0081] The technical solution provided in this embodiment, by setting the default value of the address control pin of the target memory in the non-valid code area, is beneficial for the target memory to only operate on the non-valid code area when the erase pin or the burn pin of the target memory is abnormally triggered due to external interference, thereby preventing the valid program code stored in the target memory from being accidentally tampered with, thereby improving the security of memory operations.

[0082] In an exemplary embodiment, a multi-bit trigger signal is analyzed and processed through a state machine to obtain a multi-bit control signal for a target memory, which specifically includes the following contents: the multi-bit trigger signal is used as a multi-bit input signal of the state machine; the multi-bit input signal is input into the state machine for analysis and processing to obtain a multi-bit output signal output by the state machine; and the multi-bit control signal for the target memory is determined based on the multi-bit output signal.

[0083] Among them, the multi-bit input signal can be a plurality of binary signals received by the state machine for triggering the operation of the state machine, for example, it can be a plurality of trigger signals such as trigger[0], trigger[1], trigger[2], trigger[3], etc. received by the state machine.

[0084] Among them, the multi-bit output signals can be multiple binary signals output by the state machine after processing for controlling the target memory, for example, they can be multi-bit encoded signals such as ERASE[0], ERASE[1], ERASE[2], ERASE[3] or PROGRAM[0], PROGRAM[1], PROGRAM[2], PROGRAM[3] output by the state machine.

[0085] Optionally, the Flash Controller uses the multi-bit trigger signal generated by the Command Decode module as a multi-bit input signal of an erase / program FSM. After receiving the multi-bit input signal, the erase / program FSM performs timing processing and state conversion on the multi-bit input signal through multiple internal triggers to generate a multi-bit output signal. The Flash Controller finally generates a multi-bit control signal for a target memory (Flash Device) after processing the multi-bit output signal output by the erase / program FSM through combinational logic.

[0086] The technical solution provided in this embodiment, by expanding a single trigger signal into a multi-bit trigger signal, and adopting a multiple conversion mechanism of a state machine to parse and process the multi-bit trigger signal and then convert it into a multi-bit control signal, is beneficial to increase the complexity of the trigger signal and the control signal, and reduce the probability of abnormal flipping of the signal when it is disturbed, thereby preventing the target memory from being accidentally triggered to perform erase or burn operations due to signal abnormalities.

[0087] In an exemplary embodiment, the reset domain of the logic in the controller of the target memory corresponding to the erase operation or the program operation of the target memory is the same as the reset domain in the target processor corresponding to the target memory.

[0088] The logic may be a circuit part in the Flash controller for controlling the target memory to perform an erase operation or a program operation, for example, it may be a control circuit in the Flash controller responsible for generating an ERASE (erase) signal and a PROGRAM (program) signal.

[0089] The reset domain may be a signal scope in which a module or circuit in the chip is set to an initial state upon receiving a reset signal. For example, it may be a signal coverage scope that maintains the relevant control logic in a reset state when an abnormality is detected in the chip.

[0090] The target processor may be a central processing unit that performs data exchange with the target memory, for example, may be a CPU (central processing unit) that sends an erase command or a program command to the Flash controller.

[0091] Optionally, the logic circuit in the Flash controller (Flash Controller) responsible for controlling the erase operation and the burn operation of the target memory (FlashDevice) is controlled by the same reset signal as the target processor (CPU). When the chip detects a watchdog timeout, a clock abnormality or other abnormal conditions, the control logic of the erase operation and the burn operation in the Flash controller (FlashController) enters the reset state at the same time as the target processor (CPU); while the logic circuit in the Flash controller (Flash Controller) responsible for loading the calibration information still maintains an independent reset domain and is reset only when the chip is powered on or a low power voltage is detected.

[0092] The technical solution provided in this embodiment, by setting the reset domain of the logic circuit responsible for erase and write operations in the controller of the target memory to be the same as the reset domain of the target processor, is beneficial for synchronously resetting the erase / write operation logic in the target processor and the target memory controller when the chip detects an abnormality, and promptly terminating the memory operation that may be executed, thereby preventing accidental tampering of the data in the target memory in the event of a chip abnormality.

[0093] In an exemplary embodiment, the startup information of the target processor corresponding to the target memory is stored in a read-only memory.

[0094] The startup information may be program code and data that are first executed by the target processor (CPU) after power-on or reset, for example, a startup program for checking the integrity of the subsequently executed code.

[0095] Among them, the read-only memory can be a memory whose content cannot be modified after manufacturing is completed, for example, it can be a ROM (read-only memory), which has the characteristic that the stored content cannot be erased or rewritten, and can ensure the security of the startup program.

[0096] Optionally, after the chip is powered on or reset, the Flash controller (Flash Controller) first reads the boot program of the target processor (CPU) from the read-only memory (ROM). Since the content of the read-only memory (ROM) cannot be modified after manufacturing, the integrity and security of the boot program can be ensured; after the target processor (CPU) executes the boot program, the boot program will perform an integrity check on the subsequent execution code stored in the target memory (Flash Device), and will continue to execute the subsequent code only after the verification is passed.

[0097] The technical solution provided in this embodiment, by storing the startup information of the target processor in a read-only memory, is helpful to prevent the startup information from being abnormally erased or tampered with, and ensures that the target processor can execute the correct startup program after each power-on or reset, thereby helping to improve the startup reliability and operation safety of the system.

[0098] In an exemplary embodiment, the following contents are also included: redundantly backing up the key information of the target storage in multiple backup storages; verifying the key information backed up in the multiple backup storages to obtain verification results of the key information backed up in the multiple backup storages; and selecting correct information from the key information backed up in the multiple backup storages based on the verification results.

[0099] The key information may be important data stored in the target memory that requires special protection, such as system configuration information, user data, or key program code.

[0100] The backup memory may be an independent storage device for storing a copy of key information, for example, a Flash Device that is physically isolated from the target memory.

[0101] The redundant backup process may be a process of repeatedly storing the same key information in two or more different backup memories, for example, the key information may be stored in specific physical spaces of two different Flash Devices.

[0102] The verification process may be a process of verifying the correctness of key information stored in the backup memory, for example, using ECC (error correction code) for verification or verifying through a voting mechanism.

[0103] The verification result may be a result of determining the correctness of the key information obtained through verification processing, for example, a status of passing or failing an ECC (error correction code) verification.

[0104] The correct information may be key information that has been verified and confirmed not to have been tampered with, for example, data verified by ECC (error correction code) in two backups, or data selected by a voting mechanism in multiple backups.

[0105] Optionally, the Flash Controller stores the key information in the target memory (Flash Device) in multiple different backup memories for redundant backup. When the key information needs to be read, the Flash Controller reads all the backed-up key information from the multiple backup memories at the same time and performs ECC (error checking code) verification on the backup information. If the number of backups is two, the Flash Controller determines which data is correct through ECC (error checking code) verification. If the number of backups is greater than two, the Flash Controller selects the correct information through a voting mechanism.

[0106] The technical solution provided in this embodiment, by redundantly backing up the key information of the target storage in multiple backup storages and verifying the backed-up key information, is helpful to reduce the probability of key information being tampered with at the same time and to promptly discover the tampered data, thereby facilitating the acquisition of correct key information even when part of the backup data is tampered with, thereby ensuring the integrity and availability of the system's key data.

[0107] In an exemplary embodiment, after performing key matching verification processing on a multi-bit control signal and obtaining a verification result of the multi-bit control signal, the following contents are also included: when the verification result indicates that the multi-bit control signal verification fails, generating reporting information corresponding to the verification result; and reporting the reporting information to the target processor corresponding to the target memory.

[0108] The reported information may be a warning or error message generated when an abnormal operation is detected, for example, Flash operation abnormality information generated when a key verification fails, which is used to notify the target processor (CPU) of a potential illegal access attempt.

[0109] Optionally, after receiving an erase or program command sent by a target processor (CPU), the Flash Controller performs key matching verification processing on the multi-bit control signal; when the Flash Controller detects that the key matching verification result of the multi-bit control signal fails, the Flash Controller immediately terminates the current erase or program operation, and generates report information including the verification failure reason, verification failure time and related control signal status, and sends the report information to the target processor (CPU) through the system bus, so that the target processor (CPU) can be aware of the abnormal status of the Flash Controller (Flash Controller) in time.

[0110] The technical solution provided in this embodiment, by generating reporting information and reporting it to the target processor when the multi-bit control signal verification fails, is conducive to timely detection of illegal access or abnormal operation that the Flash memory may suffer, thereby facilitating the system to quickly perceive potential data tampering risks and take corresponding protection measures, thereby improving the security of memory data.

[0111] In an exemplary embodiment, before generating a multi-bit trigger signal of a state machine in response to an operation instruction for a target memory, the following content is also included: when the operation instruction check passes and the operation address corresponding to the operation instruction is allowed to be operated, receiving the operation instruction issued by the target processor corresponding to the target memory.

[0112] The operation address may be the address information of the storage area to be operated in the target memory (Flash Device), for example, it may be the address of the non-valid code area (32'hFFFF_FFFF) or the address of the valid code area. The Flash Controller needs to determine whether the address is allowed to be erased or written.

[0113] Optionally, before receiving an operation instruction sent by a target processor (CPU), the Flash Controller first performs a validity check on the operation instruction (this part of the check can be performed by the CPU), including checking whether the type of the operation instruction is a valid erase command (ERASE) or a program command (PROGRAM), and checking whether the operation address corresponding to the operation instruction is located in a valid code area that is allowed to be operated; only when the operation instruction check passes and the operation address corresponding to the operation instruction is allowed to be operated, the Flash Controller will receive the operation instruction and further generate a multi-bit trigger signal for starting the erase / program control state machine.

[0114] The technical solution provided in this embodiment performs a double check on the operation instruction and the operation address before receiving the operation instruction sent by the target processor, which is beneficial for filtering out illegal operation instructions before the instruction is executed, thereby preventing key data in the Flash memory from being abnormally erased or rewritten, thereby improving the security of memory operations.

[0115] The following is an application example to illustrate the memory operation method provided by the present application. This application example uses the method applied to a Flash Controller as an example.

[0116] Related technologies:

[0117] The flash memory (Flash) inside the chip may be accidentally tampered in some cases, including erase and rewrite operations. This tampering is usually related to factors such as unstable power supply, program design defects or external interference. For example, when the power supply voltage fluctuates frequently near the working threshold of the chip, it may cause errors in the chip logic circuit, thereby erroneously executing instructions to erase or burn the flash memory (Flash); when the program design fails to properly manage the flash memory operation, such as a sudden power failure during the erase or write process, it may cause the flash memory (Flash) data to be in an abnormal state; when the chip is subject to external interference, the registers inside the chip may be abnormally flipped. If the abnormal flip signal happens to be the erase or burn control signal of the flash device (FlashDevice), the data of the flash device will be tampered with.

[0118] Tampering with the flash memory data inside the chip may lead to a variety of serious consequences, including but not limited to the following:

[0119] Data loss: Data in the flash storage area is tampered with, including important system configuration information, user data, operating system or application code, etc.

[0120] System crash: If the system startup code or key driver is tampered with, it may cause the program operation logic to change, making the entire system unable to start or run normally;

[0121] Security risks: If the security keys or encrypted data stored in the flash memory are tampered with, the security of the system may be reduced;

[0122] Reliability issues: If the flash memory is abnormally tampered with, causing system malfunction, it will seriously affect the reliability of the product.

[0123] Therefore, ensuring the security and integrity of the flash memory data inside the chip is crucial to the stable operation of the device, especially in automotive chips. To this end, effective security measures and technical means are needed to prevent data from being tampered with.

[0124] In the related art, in order to prevent the embedded flash memory of the chip from being abnormally erased or burned, the following technical means can be used:

[0125] Power supply monitoring mechanism (Method 1): Through the power supply monitoring circuit, when it is detected that the power supply voltage is lower than the designed voltage threshold, the chip is reset to prevent abnormal operation of the internal logic of the chip caused by voltage instability;

[0126] Erase / burn protection mechanism (Method 2): When the processor (CPU) runs abnormally, the erase / burn program may be executed by mistake, so a protection mechanism is added to prevent misoperation through multiple check mechanisms;

[0127] Flash storage error detection (Method 3): Use error correction code (ECC) or parity to detect and correct read and write errors in flash memory;

[0128] Watchdog / clock anomaly detection (Method 4): When the watchdog times out or detects a chip clock anomaly, a reset request is triggered to reset the processor (CPU) to prevent the processor from executing an erroneous program and causing abnormal chip operation.

[0129] Through the above measures, the probability of abnormal erasure / rewriting of the chip embedded Flash can be reduced.

[0130] Procedure for performing flash erase or write operations Figure 2 . Figure 2 The process of performing flash erase / burn operation is shown, which specifically includes the following steps: First, step 1: the CPU (central processing unit) issues an erase / burn command, and then performs a judgment on the erase / burn key match. If the key match judgment result is no, the process terminates; if the key match judgment result is yes, then continue to judge whether the address to be erased / burned is allowed to be operated. If the judgment result that the address is allowed to be operated is no, the process terminates; if the judgment result that the address is allowed to be operated is yes, then enter step 2: the Flash (flash memory) controller performs the erase / burn operation, and then enter step 3: the Flash device erase / burn related pins take effect. After that, it is judged that the erase / burn is completed. If the completion judgment result is no, it returns to continue to execute step 2; if the completion judgment result is yes, the process ends and reports the logic to the CPU. At the same time, the figure also includes a reporting logic module and a reset signal control line represented by a dotted line, which includes two reset signal sources, such as reset requests such as watchdog / clock abnormalities and low voltage detection.

[0131] However, the above technical means still have the following technical defects:

[0132] Method 1: When the power supply voltage fluctuates repeatedly at the critical threshold of the chip's operating voltage, the reset circuit may not be able to respond to the voltage abnormality in time. At this time, after the logic circuit of the chip fails, it may cause abnormal operation of the flash memory due to failure to reset in time;

[0133] Method 2: When the processor is running abnormally, the related erase / write protection mechanism may also be misunderstood and locked. In addition, when the chip power supply is unstable or disturbed, it may directly affect the logic circuit behind the protection mechanism, thereby bypassing the flash memory protection mechanism;

[0134] Method 3: The storage error detection mechanism can only detect or repair partial bit errors. Once the flash memory is completely erased, the system will not be able to resume normal operation.

[0135] Method 4: Watchdog timeout and clock anomaly detection require a certain response time. Before the reset request takes effect, the processor may have mistakenly executed the flash erase and burn commands. Since the flash controller needs to complete the loading of chip calibration information before the processor starts, the reset range of the flash controller is smaller than the reset range of the processor. The reset request can only reset the processor but not the flash controller. Therefore, the flash erase / burn operation triggered by the error will still be executed.

[0136] In order to protect the security and integrity of data stored in flash memory (Flash), based on related technologies, this application example proposes a number of enhanced technologies to provide protection from two levels: the flash controller (Flash Controller) and the system on chip (SOC, System on Chip).

[0137] Figure 3An enhanced flash memory anti-tampering control process is presented, which specifically includes the following steps and modules: First, step 1: the CPU (central processing unit) issues an erase / burn command, and then performs a judgment on the erase / burn key match. If the key match judgment result is no, the process terminates; if the key match judgment result is yes, then continue to judge whether the erase / burn address is allowed to be operated. If the address is allowed to be operated, the process terminates; if the address is allowed to be operated, then enter step 2: the Flash (flash memory) controller performs the erase / burn operation. Enter the judgment of the key match of the Flash device erase / burn related pins. If the pin key match judgment result is no, the process terminates; if the pin key match judgment result is yes, then enter step 3: the Flash device erase / burn related pins take effect. Then judge whether the erase / burn is completed. If the completion judgment result is no, then return to continue to execute step 2; if the completion judgment result is yes, then the process ends and the reporting logic is reported. At the same time, the figure also includes the reporting logic module, the chip boot code security storage mechanism module, and the reset signal control line represented by the dotted line, which includes two reset signal sources such as reset requests such as watchdog / clock abnormality and low voltage detection. Figure 3 The dashed box content in .

[0138] Specifically, the enhanced protection measures of the flash memory controller include:

[0139] The default value of the address control pin for the flash controller to access the flash device is set in the non-valid code area;

[0140] The signal (ERASE / PROGRAM) generated by the flash controller to control the erase / program operation of the flash device can only be sent to the flash device after being verified by the key;

[0141] The key input / output signals of the flash memory controller that controls the state machine of the flash memory device to erase / write are designed with multiple bits.

[0142] Enhanced protection measures at the SoC level include:

[0143] The reset domain of the flash memory controller module's logic for erasing / writing flash memory devices is the same as the reset domain of the processor (CPU). Specifically, when the chip detects an abnormality, it maintains the key control logic in a reset state to ensure that this part of the logic does not execute abnormally.

[0144] Special protection is provided for the flash memory space storing critical program information:

[0145] a) Use read-only memory (ROM) for storage;

[0146] b) Use a backup storage mechanism.

[0147] The details are as follows:

[0148] The flash controller's enhanced protection measures include:

[0149] The default value of the address control pin that the flash controller uses to access the flash device is set to the non-valid code area (e.g. 32'hFFFF_FFFF). In this way, even if the erase / write pin of the flash device is abnormally pulled high due to interference, the valid code area will not be erased or rewritten.

[0150] The signal generated by the flash controller to control the flash device erase / write operation can only be sent to the flash device after being verified by the key:

[0151] a) Ensure that when the processor runs abnormally or the erase / write signal output by the flash memory controller is disturbed and abnormally flipped, as long as the key does not match, the content in the flash memory device can be guaranteed not to be tampered with;

[0152] b) Key protection is performed at the location closest to the flash memory device, so that even if there is a problem with the previous control logic, no erroneous operation will occur on the flash memory.

[0153] For example, an 8-bit key (8'hAA) can be used for protection. Figure 4 . Figure 4 The key matching logic structure between a flash memory controller and a flash memory device is shown, which includes the following modules and signals: the flash memory controller (Flash controller) is on the upper left side, the flash memory device (Flash device) is on the upper right side, and the key matching logic module is on the lower left side. The flash memory controller is connected to the key matching logic, and the key matching logic is connected to the flash memory device. The key matching logic includes eight trigger units, which are used to process eight-bit key signals of key [7], key [6], key [5], key [4], key [3], key [2], key [1], and key [0] respectively. Each trigger unit has a D input terminal (data input terminal) and a Q output terminal (data output terminal), and also includes clock and reset control signal inputs. The operation signals between the flash memory controller and the flash memory device include two control signals: erase and burn. There can be an AND operation logic gate circuit at the output end of the key matching logic to generate the final control signal output.

[0154] The start trigger signal and control signal of the flash memory controller's erase / burn state machine are designed with multi-bit encoding. In this way, when disturbed, the abnormal flip of the trigger signal will not easily start the erase / burn control state machine, and the abnormal flip of the control signal will not easily cause the erase / burn pin signal of the flash memory device to be pulled high.

[0155] refer to Figure 5 , Figure 5 The structure of a multi-bit trigger signal generation of a flash memory controller is shown. From left to right, it includes the following modules and signals: first, the flash controller (flash memory controller) module, which includes a command decoding unit and an erase / write state machine module; the key matching logic module is at the bottom; and the flash device (flash memory device) module is at the far right. The specific signal connections include: the trigger signal part uses four trigger (DFF) units to process trigger [3], trigger [2], trigger [1], and trigger [0] signals respectively. These signals are generated through AND operation logic gates to generate trigger signals. The erase signal part uses four trigger (DFF) units to process erase [3], erase [2], erase [1], and erase [0] signals respectively. These signals are generated through AND operation logic gates to generate erase signals. The write signal part also uses four trigger (DFF) units to process write [3], write [2], write [1], and write [0] signals respectively. These signals are generated through AND operation logic gates to generate write signals.

[0156] The enhanced protection measures at the SoC level include:

[0157] The reset domain of the flash memory controller module's logic for erasing / writing flash memory devices is the same as the processor's reset domain. This ensures that when the chip detects an abnormality, it can promptly terminate the erase / write operation that the flash memory controller may be executing, and maintain the related control logic in the default state. The calibration information loading related logic in the flash memory controller is still reset only when the chip is powered on or a low power voltage is detected.

[0158] Special protection measures are taken for the flash memory space storing critical program information:

[0159] a) Store the processor's boot program in a read-only memory. After checking the integrity of the subsequent execution code in the boot program, the subsequent code is executed. Since the read-only memory cannot be erased, the boot code can be guaranteed to be safe. After the processor is reset, the normal boot program can be executed. Once the flash memory content is detected to be tampered with, the system can also generate an alarm message and report it;

[0160] b) Redundant backup of critical information areas in multiple different flash memory devices, and error correction code (ECC) verification when reading. Since the possibility of specific physical spaces of different flash memory devices being abnormally tampered with at the same time is low, the integrity of the information can be protected through the redundancy mechanism:

[0161] When two redundant backups are used, the information in the flash memory is verified by the error correction code, and the data that passes the verification is considered to be correct data;

[0162] When multiple (greater than two) redundant backups are used, the correct data can be selected through a voting mechanism.

[0163] The technical solution provided by this application example solves the problem of the storage content of the chip embedded Flash being tampered with when the program runs away or interference causes possible chip logic abnormalities, thereby improving the security and reliability of the system and the security of memory operations.

[0164] It should be understood that, although the various steps in the flowcharts involved in the above-mentioned embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above-mentioned embodiments can include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0165] Based on the same inventive concept, the embodiment of the present application also provides a memory operation device for implementing the memory operation method involved above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations in one or more memory operation device embodiments provided below can refer to the limitations on the memory operation method above, and will not be repeated here.

[0166] In an exemplary embodiment, Figure 6 As shown, a memory operation device is provided, and the memory operation device 600 may include:

[0167] The signal generating module 601 is used to generate a multi-bit trigger signal of the state machine in response to an operation instruction for the target memory; the operation instruction includes an erase instruction or a write instruction;

[0168] The signal analysis module 602 is used to analyze and process the multi-bit trigger signal through a state machine to obtain a multi-bit control signal for the target memory;

[0169] The signal verification module 603 is used to perform key matching verification processing on the multi-bit control signal to obtain a verification result of the multi-bit control signal;

[0170] The signal sending module 604 is used to convert the multi-bit control signal into a final control signal when the verification result indicates that the multi-bit control signal has passed the verification, and send the final control signal to the target memory; the target memory is used to perform an erase operation or a burn operation according to the final control signal.

[0171] In an exemplary embodiment, the controller of the target memory accesses the default value of the address control pin of the target memory and selects the non-valid code area.

[0172] In an exemplary embodiment, the signal analysis module 602 is also used to use a multi-bit trigger signal as a multi-bit input signal of a state machine; input the multi-bit input signal into the state machine for analysis and processing to obtain a multi-bit output signal output by the state machine; and determine a multi-bit control signal for the target memory based on the multi-bit output signal.

[0173] In an exemplary embodiment, the reset domain of the logic in the controller of the target memory corresponding to the erase operation or the program operation of the target memory is the same as the reset domain in the target processor corresponding to the target memory.

[0174] In an exemplary embodiment, the startup information of the target processor corresponding to the target memory is stored in a read-only memory.

[0175] In an exemplary embodiment, the device 600 also includes: an information processing module, which is used to perform redundant backup processing on the key information of the target storage in multiple backup storages; verify the key information backed up in the multiple backup storages to obtain the verification results of the key information backed up in the multiple backup storages; and select correct information from the key information backed up in the multiple backup storages based on the verification results.

[0176] In an exemplary embodiment, the device 600 further includes: an information reporting module, configured to generate reporting information corresponding to the verification result when the verification result indicates that the multi-bit control signal verification fails; and report the reporting information to the target processor corresponding to the target memory.

[0177] In an exemplary embodiment, the apparatus 600 further includes: an instruction receiving module, configured to receive an operation instruction sent by a target processor corresponding to the target memory when the operation instruction check passes and the operation address corresponding to the operation instruction is allowed to be operated.

[0178] Each module in the above-mentioned memory operation device can be implemented in whole or in part by software, hardware or a combination thereof. Each of the above-mentioned modules can be embedded in or independent of a processor in a computer device in the form of hardware, or can be stored in a memory in a computer device in the form of software, so that the processor can call and execute operations corresponding to each of the above modules.

[0179] In an exemplary embodiment, a computer device is provided. The computer device may be a terminal, and its internal structure diagram may be as shown in FIG. Figure 7 As shown. The computer device includes a processor, a memory, an input / output interface, a communication interface, a display unit and an input device. The processor, the memory and the input / output interface are connected through a system bus, and the communication interface, the display unit and the input device are connected to the system bus through the input / output interface. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The input / output interface of the computer device is used to exchange information between the processor and the external device. The communication interface of the computer device is used to communicate with an external terminal in a wired or wireless manner, and the wireless manner can be realized through WIFI, a mobile cellular network, NFC (near field communication) or other technologies. When the computer program is executed by the processor, a memory operation method is implemented. The display unit of the computer device is used to form a visually visible picture, which can be a display screen, a projection device or a virtual reality imaging device. The display screen can be a liquid crystal display screen or an electronic ink display screen, and the input device of the computer device can be a touch layer covering the display screen, or a button, trackball or touchpad set on the computer device shell, or an external keyboard, touchpad or mouse.

[0180] Those skilled in the art will understand that Figure 7 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0181] In an exemplary embodiment, a computer device is further provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the steps in the above-mentioned method embodiments when executing the computer program.

[0182] In an exemplary embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps in the above-mentioned method embodiments are implemented.

[0183] In an exemplary embodiment, a computer program product is provided, including a computer program, and when the computer program is executed by a processor, the steps in the above method embodiments are implemented.

[0184] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., but are not limited to this.

[0185] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0186] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A memory operation method, characterized in that: The method comprises: In response to an operation instruction for a target memory, a multi-bit trigger signal of a state machine is generated; the operation instruction includes an erase instruction or a program instruction; By means of the state machine, the multi-bit trigger signal is analyzed and processed to obtain a multi-bit control signal for the target memory; Performing key matching verification processing on the multi-bit control signal to obtain a verification result of the multi-bit control signal; When the verification result indicates that the multi-bit control signal has passed the verification, the multi-bit control signal is converted into a final control signal, and the final control signal is sent to the target memory; the target memory is used to perform an erase operation or a burn operation according to the final control signal.

2. The method according to claim 1, characterized in that The controller of the target memory accesses the address control pin default value of the target memory and selects the non-valid code area.

3. The method according to claim 1, characterized in that The state machine is used to analyze and process the multi-bit trigger signal to obtain a multi-bit control signal for the target memory, including: Using the multi-bit trigger signal as a multi-bit input signal of the state machine; Inputting the multi-bit input signal into the state machine for analysis and processing to obtain a multi-bit output signal output by the state machine; A multi-bit control signal for the target memory is determined according to the multi-bit output signal.

4. The method according to claim 1, characterized in that: The reset domain of the logic in the controller of the target memory corresponding to the erase operation or the program operation of the target memory is the same as the reset domain in the target processor corresponding to the target memory.

5. The method according to claim 1, characterized in that The startup information of the target processor corresponding to the target memory is stored in the read-only memory.

6. The method according to claim 1, characterized in that The method further comprises: Redundantly backing up the key information of the target storage in multiple backup storages; Performing verification processing on the key information backed up in the multiple backup memories to obtain verification results of the key information backed up in the multiple backup memories; According to the verification result, correct information is selected from the key information backed up in the multiple backup memories.

7. The method according to claim 1, characterized in that After performing key matching verification processing on the multi-bit control signal to obtain the verification result of the multi-bit control signal, the method further includes: If the verification result indicates that the multi-bit control signal fails verification, generating reporting information corresponding to the verification result; The reporting information is reported to a target processor corresponding to the target memory.

8. The method according to any one of claims 1 to 7, characterized in that Before generating a multi-bit trigger signal of a state machine in response to an operation instruction for a target memory, the method further includes: When the operation instruction check passes and the operation address corresponding to the operation instruction is allowed to be operated, the operation instruction sent by the target processor corresponding to the target memory is received.

9. A memory operation device, characterized in that: The device comprises: A signal generating module, used for generating a multi-bit trigger signal of a state machine in response to an operation instruction for a target memory; the operation instruction includes an erase instruction or a write instruction; A signal analysis module, used for analyzing and processing the multi-bit trigger signal through the state machine to obtain a multi-bit control signal for the target memory; A signal verification module, used to perform key matching verification processing on the multi-bit control signal to obtain a verification result of the multi-bit control signal; A signal sending module is used to convert the multi-bit control signal into a final control signal when the verification result indicates that the multi-bit control signal has passed the verification, and send the final control signal to the target memory; the target memory is used to perform an erasing operation or a burning operation according to the final control signal.

10. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 8 are implemented.

11. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 8 are implemented.

12. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 8 are implemented.

Images