Method for protecting sensitive information in chip and chip

Abstract

The invention discloses a method for protecting sensitive information in a chip and the chip, and aims to improve the security of sensitive data in the chip. According to the method, the chip life cycle is divided into four stages of testing, debugging, product running and life cycle ending, and different protection measures such as forbidding of a JTAG interface and OTP read-only locking are adopted in different stages. The stage is judged and stage backspacing is prevented by utilizing the stage mark and the register value, the private data protection process of the user is simplified, and the operation is simple, convenient and safe. The chip comprises a FLASH area and an OTP area, and the FLASH area stores a boot loader and executes a sensitive information protection method. According to the invention, the security of the chip is improved, data leakage or tampering is prevented, and the operation process is simplified.

Description

Technical Field

[0001] The present invention relates to a method for protecting sensitive information in a chip and also to a corresponding chip, belonging to the technical field of information security. Background Art

[0002] The boot loader of the security chip has functions such as signature verification, encryption, data tamper-proofing, and secure storage of the firmware to protect the data and firmware stored in the chip from being illegally accessed and tampered with, causing losses to users.

[0003] The boot loader of existing security chips is generally injected with sensitive data through the host computer tool, and then the security chip stores the sensitive data in the chip OTP (One Time Programmable) or the FLASH inside the chip. The OTP address is generally not open to the outside world to prevent sensitive data from being illegally read, such as software version number, hardware version number, user data and other information. The firmware and system data are stored inside the FLASH chip, and signature verification is generally used to prevent the firmware data from being tampered with. When downloading the firmware, the firmware is signed through the host computer tool, and then the signed firmware is sent to the chip. After receiving the firmware, the chip will verify the signature of the firmware, and the firmware will be started only after the signature verification passes.

[0004] However, although the boot loader of the existing security chip stores sensitive data in an OTP area whose address is not open to the public, the address can still be obtained through exhaustive method, and the security cannot meet the increasingly high commercial requirements.

[0005] In addition, sensitive data includes chip manufacturer data and user data. However, the current security chips do not protect chip manufacturer data and user data separately, and do not distinguish between firmware and data security levels. Because sensitive data does not distinguish between high, medium and low security levels, some low-security sensitive data will be set to a high security level, which is not convenient for subsequent use. The structure of sensitive data is complex, and users need to know the meaning of each data to set it, and sometimes even need to know the storage address of sensitive data before using it, which is inconvenient. Once sensitive data is attacked or tampered with, it will cause security vulnerabilities in the chip and start illegal firmware. Summary of the invention

[0006] The primary technical problem to be solved by the present invention is to provide a method for protecting sensitive information in a chip.

[0007] Another technical problem to be solved by the present invention is to provide a chip using the above sensitive information protection method.

[0008] In order to achieve the above technical objectives, the present invention adopts the following technical solutions:

[0009] According to a first aspect of an embodiment of the present invention, a method for protecting sensitive information in a chip is provided, comprising the following steps:

[0010] Step 1: Power on, read from OTP and determine whether the check phase 3 tag is marked, if it is marked, go to step 2, if not, go to step 3;

[0011] Step 2: Disable the JTAG interface of the chip, set gStage = product operation stage and stage = 3 for OTP, and go to step 6;

[0012] Step 3: Check register REG_STAGE_FLAG=01. If not, disable the JTAG interface and reset the chip. If yes, go to step 4.

[0013] Step 4: Set gStage = debugging stage and stage = 2, then go to step 5;

[0014] Step 5: Check the stage 2 flag, if there is a flag, go to step 6; if there is no flag, set gStage = test stage and stage = 1, and then go to step 6;

[0015] Step 6: Determine whether stage≥2 is satisfied. If not, proceed to step 8. If satisfied, proceed to step 7.

[0016] Step 7: Recalculate the CRC value based on the parameters or data in the current stage OTP, and compare it with the CRC value in the injected stage 2 parameters to determine whether they are consistent. If they are inconsistent, reduce the stage by 1 and reset the chip; if they are consistent, proceed to the next step;

[0017] Step 8: Determine whether stage≥3 is satisfied. If not, proceed to step 10. If satisfied, proceed to step 9.

[0018] Step 9: Recalculate the CRC value based on the parameters or data in the current stage OTP, and compare it with the CRC value in the injected stage 2 parameters to determine whether they are consistent. If they are inconsistent, reduce the stage by 1 (make stage = 2) and reset the chip; if they are consistent, proceed to the next step;

[0019] Step 10: Determine whether one of the following conditions is met: gStage = test stage and stage! = 1, gStage = debug stage and stage! = 2; gStage = product operation stage and stage! = 3. If so, reset the chip; if not, end and enter firmware download and startup.

[0020] Preferably, the chip is not protected during the testing phase; the OTP of the chip is read-only locked during the debugging phase; the OTP of the chip is unreadable during the product operation phase, and JTAG debugging is prohibited, requiring firmware signature verification while keeping the OTP read-only locked.

[0021] Preferably, in the testing stage and the debugging stage, the register REG_STAGE_FLAG=01; in the product operation stage, the register REG_STAGE_FLAG=02.

[0022] Preferably, when upgrading from the test stage to the debug stage, the stage 2 mark is written into the OTP of the chip, and gStage=debug stage and stage=2 are set.

[0023] Preferably, when entering the product operation stage from the debugging stage, a stage 3 mark is written into the OTP of the chip, and gStage=product operation stage and stage=3 are set.

[0024] Preferably, the value of register REG_STAGE_FLAG is set to 02.

[0025] Preferably, during the debugging phase, an RSA public key is injected into the chip OTP for download authentication and signature.

[0026] According to a second aspect of an embodiment of the present invention, a chip is provided, including a FLASH area and an OTP area, wherein a boot loader is stored in the FLASH area for executing the sensitive information protection method in the chip as described above.

[0027] Preferably, the OTP of the chip is not protected during the testing phase; the OTP is read-only locked during the debugging phase; the OTP is made unreadable during the product operation phase, and JTAG debugging is prohibited, requiring firmware signature verification while keeping the OTP read-only locked.

[0028] Compared with the prior art, the present invention has the following advantages: 1) The chip is divided into four life cycle stages according to different usage scenarios, and the external data is divided into security levels according to different usage scenarios. It is written and protected at different stages to prevent data leakage or tampering, taking into account both security and convenience; 2) The stage mark and the register value are used to realize the judgment of different stages and prevent stage rollback; 3) The user's private data protection process is simplified, and the operation is simple and easy to use. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] Figure 1 This is a schematic diagram of the boot loader startup process during the product operation phase;

[0030] Figure 2The division of different security levels in the first embodiment of the present invention;

[0031] Figure 3 This is a flow chart of a method for protecting sensitive information in a chip in the first embodiment of the present invention;

[0032] Figure 4 This is an example diagram of parameters or data injected into a chip in the first embodiment of the present invention. DETAILED DESCRIPTION

[0033] The technical content of the present invention is described in detail below with reference to the accompanying drawings and specific embodiments.

[0034] The technical concept in the embodiment of the present invention is: by introducing a lifecycle maintenance mechanism in the boot loader of the chip, sensitive data is divided into chip manufacturer sensitive data and user sensitive data. Equipment manufacturers or terminal manufacturers only need to care about the use of user sensitive data without considering how the chip manufacturer's sensitive data is used, thereby simplifying the operation process and greatly reducing the difficulty of using sensitive data during chip software development. In addition, all sensitive data will be distinguished into low, medium and high security levels according to different security levels to facilitate subsequent use. After the lifecycle maintenance mechanism is introduced, once the lifecycle is upgraded, it cannot be rolled back. Even if the sensitive data is attacked or tampered with, the lifecycle cannot be rolled back, thereby avoiding security vulnerabilities and greatly improving the security of the chip.

[0035] First embodiment

[0036] like Figure 2 As shown, the system microcontroller unit (SMCU) usually goes through the processes of testing, debugging, terminal product, and end of life of the chip from the wafer off the line. In this embodiment, the boot loader of the SMCU divides the life cycle of the chip into four stages according to these different usage processes. Each stage can only be upgraded to the next adjacent stage and cannot be rolled back (the upgrade parameters of each stage are written into OTP and cannot be erased and rewritten).

[0037] Specifically, in the test phase (used by process manufacturers to test chips), the chip memory (OTP, FLASH, RAM) is in the initial state (the boot loader detects that there is no stage mark in the OTP, and considers that the stage = test stage and tage = 1), and the chip manufacturer can test the chip and peripheral interfaces. This stage requires writing calibration parameter marks. After the chip passes the calibration, SN is injected into the OTP and the calibration parameter mark is written, indicating that the chip calibration is qualified. In addition, the parameters injected into the OTP are upgraded from the test phase to the debugging phase, such as Figure 3, including stage 2 flag, SN (sequence number), calibration parameters, CRC (CRC32 value of parameters from Stage2_flag to CRC).

[0038] Write the stage 2 flag in OTP (for example, make the value of the stage 2 flag 1), set gStage = debug stage and stage = 2, and upgrade to the debug stage. In this stage, the value of the register REG_STAGE_FLAG is equal to 01.

[0039] During the debugging phase (used by device manufacturers to debug the chip's hardware and software), device manufacturers may frequently download debugging firmware, and the chip has not yet become a mature product, so only basic protection is provided for this phase (protecting chip identity information: SN, test mark). When the development is completed, the device manufacturer injects the RSA public key (used for download authentication and signature) and private data into the chip, and writes the stage 3 mark in the OTP (for example, making the value of the stage 3 mark 1), sets gStage = product operation stage and stage = 3, and the chip enters the product operation stage. In addition, the value of the register REG_STAGE_FLAG is set to 02.

[0040] The parameters injected from the debugging stage to the product operation stage are similar to those in the test stage, including stage 3 marker, SN, calibration parameters, and CRC. In this stage, the value of register REG_STAGE_FLAG remains 01.

[0041] In the product operation stage (the chip is combined with other software and hardware and provided to users in the form of terminal products), the chip works in the actual product environment with the highest security level. Some keys and private data need to be strictly protected to prevent external reading and tampering. The device manufacturer can update the chip firmware program (signature verification is required). In this stage, if the device firmware of stage 3 cannot be started, it is considered that the chip has been damaged and has reached stage 4, which means the end of the life cycle.

[0042] At the end of the life cycle (the chip hardware reaches the end of its service life and the chip cannot start the firmware), the security level is the highest in the product operation stage. Even at the end of the life cycle, the security protection function is still effective. If the hardware supporting the security function is damaged, the firmware cannot be started and the sensitive data inside the chip cannot be obtained externally.

[0043] It can be seen that in this embodiment, each stage of the upgrade must be in accordance with Figure 2The upgrade process is as shown in the figure. You cannot skip the upgrade stage. The security level of each stage is different, that is, the means of protecting sensitive data are different. The security level is the highest at the end of the life cycle and product operation stage, and the protection of sensitive data is the most stringent. Sensitive data leakage is strictly prohibited. The security level of the debugging stage is second, and there is no security protection in the testing stage. This design can prevent the chip from falling back from a high security level stage to a low security level stage, thereby avoiding major security accidents caused by security level errors and sensitive data cannot be protected.

[0044] Moreover, in this embodiment, different security levels of protection (hierarchical protection) are provided for each stage, so that the chip has different functions. The following is an example of a comparison table of each stage and function. Those skilled in the art can understand that the content of this comparison table can also be adjusted according to actual needs, such as adding control over specific functions.

[0045] Table 1 Comparison of each stage and function

[0046]

[0047] Specifically, the hierarchical protection mechanism includes: no protection in the testing phase; OTP is read-only locked in the debugging phase; OTP is made unreadable and JTAG debugging is prohibited in the product operation phase, and firmware verification is required while keeping OTP read-only locked; at the end of the life cycle, OTP is unreadable, JTAG debugging is prohibited, and firmware startup is prohibited.

[0048] Based on the hierarchical protection mechanism of the above stages, such as Figure 3 As shown, the sensitive information protection method in a chip provided by the first embodiment of the present invention includes the following steps:

[0049] Step 1: Power on, read from OTP and determine whether the check phase 3 tag is marked. If it is marked, go to step 2, if not, go to step 3.

[0050] If the stage 3 mark is marked, it means that the chip is in the product operation stage (stage 3); according to the comparison table shown in Table 1, the JTAG (Join Test Action Group) interface of the chip should be disabled to prevent unauthorized access and tampering. For chips without a stage 3 mark, it means that the chip is not in stage 3 (it may be stage 1 or stage 2).

[0051] Step 2: Disable the JTAG interface of the chip, set gStage=Product Run Stage and stage=3 for OTP, and go to step 6.

[0052] As mentioned above, since the equipment manufacturer writes the Phase 3 mark in the chip's OTP when the chip enters the product operation stage (Phase 3) from the debugging stage (Phase 2), in this step, because the Phase 3 mark is already marked, it indicates that the chip has entered Phase 3 and cannot be returned.

[0053] Since the chip has entered the product operation stage, according to the settings in Table 1, the JTAG interface of the chip is disabled to prevent unauthorized access and tampering; and, gStage=product operation stage and stage=3 are set for OTP.

[0054] Step 3: Check register REG_STAGE_FLAG=01. If not, disable the JTAG interface and reset the chip. If yes, go to step 4.

[0055] As mentioned above, when the chip enters the product operation stage, the value of the register REG_STAGE_FLAG is set to 02. In other words, the register REG_STAGE_FLAG = 01 in the test stage (stage 1) and the debugging stage (stage 2). By judging the value of the register REG_STAGE_FLAG, the chips in the product operation stage (stage 3) and later can be distinguished. Since the chips in the product operation stage (stage 3) have been detected according to the stage 3 mark in step 1, the register value is used in this step to distinguish the chips in stage 3 from the chips in stage 1 or stage 2.

[0056] For stage 4 chips, they must have stage 3 markings, so they have the security functions of stage 3. Compared with stage 3 chips, stage 4 chips are just unable to start, so there is no need to judge.

[0057] Step 4: Set gStage = debugging stage and stage = 2, then go to step 5.

[0058] As mentioned above, since the register REG_STAGE_FLAG=01, it is determined in step 3 that the chip is in the test stage (stage 1) and the debug stage (stage 2). In this step, the chip is set to gStage=debug stage and stage=2.

[0059] Step 5: Check the stage 2 flag. If it is marked, go to step 6; if it is not marked, set gStage=test stage and stage=1, and then go to step 6.

[0060] Because the stage 2 mark is injected into the OTP when the test stage is upgraded to the debug stage, there is no mark in the chip in the test stage. Therefore, this step is used to distinguish the chips in the test stage (stage 1) and the debug stage (stage 2). In other words, the above steps are used to distinguish the chips in the three stages and process them separately.

[0061] Step 6: Determine whether stage≥2 is satisfied. If not, proceed to step 8; if satisfied, proceed to step 7.

[0062] Step 7: Recalculate the CRC value based on the parameters or data in the current stage OTP, and compare it with the CRC value in the injected stage 2 parameters to determine whether they are consistent. If they are inconsistent, the stage is reduced by 1 and the chip is reset; if they are consistent, proceed to the next step.

[0063] The chip provided in the embodiment of the present invention injects parameters or data structures ( Figure 4 ) contains the CRC value of the current parameters or data. When the bootloader determines the size of the s tage, it will recalculate the CRC of the parameters or data in the OTP of the current stage, and then compare the newly calculated CRC value with the CRC value in the originally injected parameters or data. If the CRC is consistent, the check passes. If it is inconsistent, it means that the parameters or data of the current stage have been tampered with, and the current parameters or data are unusable. The s tage is reduced by 1 (or stage=1), and the chip is reset.

[0064] Specifically, in this step, because the chip has status = 2 (obtained in step 4), status minus 1 is status = 1. Thus, in this step, the chip is set to gStage = debugging stage and stage = 1. By making the gStage value and the status value incompatible, the chip whose parameters or data have been tampered with can be distinguished.

[0065] Therefore, based on the CRC value in the debugging phase (phase 2) parameters, consistency judgment is performed to determine whether the parameters or data of the chip in phase 2 or phase 3 have been tampered with. With such a design, terminal manufacturers do not need to know the OTP address where these parameters are to be written, nor do they need to know the meaning of the parameters injected in the test phase, or even whether the parameters injected in the test phase exist. They only need to ensure that the parameters injected from the debugging phase to the product operation phase are correct, and firmware signature verification can be achieved, taking into account both security and ease of use.

[0066] Step 8: Determine whether stage≥3 is satisfied. If not, proceed to step 10; if satisfied, proceed to step 9.

[0067] Step 9: Recalculate the CRC value based on the parameters or data in the OTP of the current stage, and compare it with the CRC value in the injected stage 2 parameters to determine whether they are consistent. If they are inconsistent, reduce the stage by 1 (make stage = 2) and reset the chip; if they are consistent, proceed to the next step.

[0068] Step 10: Determine whether one of the following conditions is met: gStage = test stage and stage! = 1, gStage = debug stage and stage! = 2; gStage = product operation stage and stage! = 3. If so, reset the chip; if not, end and enter firmware download and startup.

[0069] As described above, in one embodiment of the present invention, the stages are checked in order from high to low (stage 3 to stage 1). If the current stage is the product operation stage (stage 3), the value of the register REG_STAGE_FLAG is equal to 02, gStage = product operation stage, and stage = 3. If the current stage is the debugging stage, the value of the register REG_STAGE_FLAG is equal to 01, gStage = debugging stage, and stage = 2. If the current stage is the testing stage, the value of the register REG_STAGE_FLAG is equal to 1, gStage = testing stage, and stage = 1. If one of the judgment conditions of the above three stages is not met, the chip is reset and the program cannot be started. Therefore, once the chip is attacked by an external attack and the internal data of the OTP is tampered, the boot loader can detect this situation after startup and refuse to start the firmware.

[0070] In addition, since the value of register REG_STAGE_FLAG is equal to 01 by default in the chip during the test and debugging phases, the value of register REG_STAGE_FLAG will be set to 02 only when it is upgraded to the product operation phase. Moreover, the register is designed to be unable to be changed back to 01 after a value other than 01 is written to it, so as to avoid tampering. When the chip is actually running, in phase 2, the parameters injected with OTP are locked as read-only and cannot be read, so external attacks cannot tamper with the data; in phase 3, the parameters injected with OTP are set to be unreadable, so external attacks cannot tamper with the data either. In summary, the parameters injected in each phase cannot be modified, and the value of register REG_STAGE_FLAG cannot be modified after being written once, so the stage cannot be rolled back, thus achieving the purpose of protecting data security.

[0071] Second embodiment

[0072] A third embodiment of the present invention provides a method for protecting sensitive information in a chip, comprising the following steps:

[0073] Power on and start up, check the stage 3 mark from the chip's OTP. If there is a mark, disable the JTAG interface and reset the chip. If there is no mark, go to the next step;

[0074] Check the stage 2 mark. If there is a mark, it means the chip is in the debugging stage. If there is no mark, it means the chip is in the testing stage.

[0075] Recalculate the CRC value based on the parameters or data in the current stage OTP, and compare it with the CRC value in the injected stage 2 parameters. If they are consistent, start the firmware; if they are inconsistent, reset the chip.

[0076] Among them, when the chip enters the debugging stage from the testing stage, the stage 2 mark is written and the parameters or data of stage 2 are injected; when the chip enters the product operation stage from the debugging stage, the stage 3 mark is written and the parameters or data of stage 3 are injected.

[0077] Third embodiment

[0078] The third embodiment of the present invention provides a chip. The chip has a FLASH and OTP area. The FLASH area stores a boot loader for executing the sensitive information protection method in each of the above embodiments after power-on.

[0079] It should be noted that the above multiple embodiments are only examples. The technical solutions of various embodiments can be combined, and the order of various steps can be changed, all within the scope of protection of this patent.

[0080] The above is a detailed description of the sensitive information protection method and chip provided by the present invention. For those skilled in the art, any obvious changes made to the present invention without departing from the essence of the present invention will constitute an infringement of the patent right of the present invention and will bear corresponding legal responsibilities.

Claims

1. A method for protecting sensitive information in a chip, characterized in that The following steps are involved: Step 1: Power on, read from OTP and determine whether the check phase 3 tag is marked, if it is marked, go to step 2, if not, go to step 3; Step 2: Disable the JTAG interface of the chip, set gStage = product operation stage and stage = 3 for OTP, and go to step 6; Step 3: Check register REG_STAGE_FLAG=01. If not, disable the JTAG interface and reset the chip. If yes, go to step 4; Step 4: Set gStage = debug stage and stage = 2, then go to step 5; Step 5: Check the stage 2 flag. If it is marked, go to step 6. If it is not marked, set gStage = test stage and stage = 1, and then go to step 6. Step 6: Determine whether stage≥2 is satisfied. If not, proceed to step 8. If satisfied, proceed to step 7. Step 7: Recalculate the CRC value based on the parameters or data in the current stage OTP, and compare it with the CRC value in the injected stage 2 parameters to determine whether they are consistent. If they are inconsistent, reduce the stage by 1 and reset the chip; if they are consistent, proceed to the next step; Step 8: Determine whether stage≥3 is satisfied. If not, proceed to step 10. If satisfied, proceed to step 9. Step 9: Recalculate the CRC value based on the parameters or data in the current stage OTP, and compare it with the CRC value in the injected stage 2 parameters to determine whether they are consistent. If they are inconsistent, reduce the stage by 1 and reset the chip; if they are consistent, proceed to the next step; Step 10: Determine whether one of the following conditions is met: gStage = test stage and stage! = 1, gStage = debug stage and stage! = 2; gStage = product operation stage and stage! = 3. If so, reset the chip; if not, end and enter firmware download and startup.

2. The sensitive information protection method according to claim 1, characterized in that: The chip is not protected during the testing phase; the OTP of the chip is read-only locked during the debugging phase; the OTP of the chip is unreadable during the product operation phase, and JTAG debugging is prohibited, requiring firmware signature verification while keeping the OTP read-only locked.

3. The sensitive information protection method according to claim 2, characterized in that: During the testing and debugging phases, the register REG_STAGE_FLAG=01; during the product operation phase, the register REG_STAGE_FLAG=02.

4. The sensitive information protection method according to claim 3, characterized in that: When upgrading from the test stage to the debug stage, the stage 2 mark is written into the OTP of the chip, and gStage=debug stage and stage=2 are set.

5. The sensitive information protection method according to claim 4, characterized in that: When entering the product operation stage from the debugging stage, the stage 3 mark is written in the OTP of the chip, and gStage=product operation stage and stage=3 are set.

6. The sensitive information protection method according to claim 5, characterized in that: Set the value of register REG_STAGE_FLAG to 02.

7. The sensitive information protection method according to claim 6, characterized in that: In the debugging phase, the RSA public key is injected into the chip OTP for download authentication and signature.

8. A chip, including FLASH and OTP, characterized in that A boot loader is stored in the FLASH area for executing the sensitive information protection method according to any one of claims 1 to 7.

9. The chip according to claim 8, characterized in that: The OTP of the chip is not protected during the testing phase; the OTP is read-only locked during the debugging phase; the OTP is made unreadable during the product operation phase, and JTAG debugging is prohibited, requiring firmware signature verification while keeping the OTP read-only locked.

Images