Chip security mechanism self-checking system, method, computer device and storage medium

Abstract

The application relates to a chip security mechanism self-checking system, method, computer device and storage medium. The system comprises a self-checking control module, a pseudo-random number generation module, a security mechanism unit and a cyclic redundancy check module. The self-checking control module is used for sending a control signal to the security mechanism unit needing self-checking according to configuration, enabling the self-checking function of the security mechanism unit, sending a pseudo-random number seed to the pseudo-random number generation module, comparing a check code sent by the cyclic redundancy check module with a check value, and outputting a self-checking result according to a comparison result. The pseudo-random number generation module is used for generating a plurality of pseudo-random numbers according to the pseudo-random number seed. The security mechanism unit is used for starting self-checking according to the control signal, receiving the pseudo-random number excitation and generating output data. The cyclic redundancy check module is used for performing cyclic redundancy check operation on the output data of each security mechanism unit, generating a corresponding check code, and sending the current check code to the self-checking control module when the pseudo-random number is traversed. The system can improve the self-checking coverage, reduce the test time and power consumption.

Description

Technical Field

[0001] This application relates to the field of security mechanism detection technology, and in particular to a chip security mechanism self-testing system, method, computer device and storage medium. Background Technology

[0002] With the rapid development of chip design technology, functional safety has become an indispensable part of modern chip design. In chip designs with functional safety requirements, it is essential to ensure that the chip continues to function normally even in the event of a single point of failure, preventing undetected functional errors due to multiple points of failure. Therefore, safety mechanisms are typically incorporated into the design to simulate and detect single-point failures of safety functions.

[0003] Currently, various detection methods are employed in the industry to verify the effectiveness of these security mechanisms. These methods typically apply an excitation signal to a specific security mechanism and determine whether the mechanism is functioning correctly by detecting whether its output meets expectations. However, this approach requires designing a separate detection circuit for each security mechanism, making it unsuitable for different types of security mechanisms and significantly increasing design complexity and time costs.

[0004] To address the aforementioned issues, the Logic Built-In Self-Test (LBIST) technique was developed. LBIST utilizes Design for Testability (DFT) circuitry to apply stimuli to all circuits within a module and detect whether their outputs meet expectations. A significant characteristic of this technique is its independence from specific security mechanism types, enabling largely generalized testing.

[0005] However, LBIST technology tests all circuits inside the block, which affects test time, coverage and power consumption. Furthermore, verification can only be performed at the netlist stage, which lengthens the entire design cycle. Summary of the Invention

[0006] Therefore, it is necessary to provide a chip security mechanism self-testing system, method, computer device, and storage medium to address the aforementioned technical problems.

[0007] A chip security mechanism self-testing system, the system comprising:

[0008] The system includes a self-test control module, a pseudo-random number generation module, a cyclic redundancy check module, and at least one security mechanism unit.

[0009] The self-test control module is connected to the pseudo-random number generation module, the security mechanism unit, and the cyclic redundancy check module. It is used to send control signals to the security mechanism unit that needs to perform self-test according to the configuration, enable the self-test function of the security mechanism unit, send the pseudo-random number seed to the pseudo-random number generation module, compare the check code sent by the cyclic redundancy check module with the check value, and output the self-test result according to the comparison result.

[0010] The pseudo-random number generation module generates several pseudo-random numbers based on the pseudo-random number seed provided by the self-test control module, and outputs the pseudo-random numbers to each security mechanism unit.

[0011] The security mechanism unit is used to initiate self-testing according to control signals, receive pseudo-random number excitation, perform corresponding operations, and send the output data to the cyclic redundancy check module.

[0012] The cyclic redundancy check module is used to receive the output data generated by each security mechanism unit after traversing each pseudo-random number, perform cyclic redundancy check operation on the output data of each security mechanism unit, generate the corresponding check code, and send the current check code to the self-test control module when the pseudo-random number traversal is completed.

[0013] A self-testing method for chip security mechanisms, the method comprising:

[0014] The self-test control module sends control signals to the security mechanism unit that needs to perform self-test according to the configuration, enables the self-test function of the security mechanism unit, sends a pseudo-random number seed to the pseudo-random number generation module, compares the check code sent by the cyclic redundancy check module with the check value, and outputs the self-test result based on the comparison result.

[0015] The pseudo-random number generation module generates several pseudo-random numbers based on the pseudo-random number seed provided by the self-test control module, and outputs the pseudo-random numbers to each security mechanism unit.

[0016] The security mechanism unit initiates a self-test based on the control signal, receives pseudo-random number excitation, performs corresponding operations, and sends the output data to the cyclic redundancy check module.

[0017] The cyclic redundancy check module receives the output data generated by each security mechanism unit after traversing each pseudo-random number, performs cyclic redundancy check operation on the output data of each security mechanism unit, generates the corresponding check code, and sends the current check code to the self-test control module when the pseudo-random number traversal is completed.

[0018] A computer device includes a memory and a processor, the memory storing a computer program, and the processor executing the computer program performing the following steps:

[0019] The self-test control module sends control signals to the security mechanism unit that needs to perform self-test according to the configuration, enables the self-test function of the security mechanism unit, sends a pseudo-random number seed to the pseudo-random number generation module, compares the check code sent by the cyclic redundancy check module with the check value, and outputs the self-test result based on the comparison result.

[0020] The pseudo-random number generation module generates several pseudo-random numbers based on the pseudo-random number seed provided by the self-test control module, and outputs the pseudo-random numbers to each security mechanism unit.

[0021] The security mechanism unit initiates a self-test based on the control signal, receives pseudo-random number excitation, performs corresponding operations, and sends the output data to the cyclic redundancy check module.

[0022] The cyclic redundancy check module receives the output data generated by each security mechanism unit after traversing each pseudo-random number, performs cyclic redundancy check operation on the output data of each security mechanism unit, generates the corresponding check code, and sends the current check code to the self-test control module when the pseudo-random number traversal is completed.

[0023] A computer-readable storage medium having a computer program stored thereon, the computer program performing the following steps when executed by a processor:

[0024] The self-test control module sends control signals to the security mechanism unit that needs to perform self-test according to the configuration, enables the self-test function of the security mechanism unit, sends a pseudo-random number seed to the pseudo-random number generation module, compares the check code sent by the cyclic redundancy check module with the check value, and outputs the self-test result based on the comparison result.

[0025] The pseudo-random number generation module generates several pseudo-random numbers based on the pseudo-random number seed provided by the self-test control module, and outputs the pseudo-random numbers to each security mechanism unit.

[0026] The security mechanism unit initiates a self-test based on the control signal, receives pseudo-random number excitation, performs corresponding operations, and sends the output data to the cyclic redundancy check module.

[0027] The cyclic redundancy check module receives the output data generated by each security mechanism unit after traversing each pseudo-random number, performs cyclic redundancy check operation on the output data of each security mechanism unit, generates the corresponding check code, and sends the current check code to the self-test control module when the pseudo-random number traversal is completed.

[0028] The aforementioned chip security mechanism self-testing system, method, computer equipment, and storage medium, through a self-testing control module, flexibly select the security mechanism units to be self-tested based on configuration, enabling their self-testing functions. Using pseudo-random number stimulation provided by a pseudo-random number generation module, precise testing of the security mechanisms is performed, thus avoiding the waste of resources in full-range testing and improving testing efficiency and fault coverage. The pseudo-random number generation module can generate various pseudo-random numbers based on a seed, providing a unified stimulus input for all security mechanisms. The cyclic redundancy check module receives the response outputs of all security mechanisms for unified verification, realizing a universal testing method for different security mechanism units, with strong adaptability and easy expansion. The security mechanism units, through a multiplexer design, can control the stimulation testing only on specified modules, ensuring the normal operation of unrelated circuits. The cyclic redundancy check module compresses the output data after each pseudo-random number test and generates a checksum, achieving fast and accurate result verification. Verification can be completed at the RTL stage, significantly shortening the design cycle. This invention improves the efficiency and reliability of security mechanism self-testing in complex chip environments. Attached Figure Description

[0029] Figure 1 This is a block diagram of a chip security mechanism self-testing system in one embodiment;

[0030] Figure 2 This is a schematic diagram of the workflow of the system of the present invention in one embodiment;

[0031] Figure 3 This is an internal structural diagram of a computer device in one embodiment. Detailed Implementation

[0032] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0033] In one embodiment, such as Figure 1 As shown, a chip security mechanism self-testing system is provided, including a self-testing control module, a pseudo-random number generation module, a cyclic redundancy check module, and at least one security mechanism unit;

[0034] The self-test control module is connected to the pseudo-random number generation module, the security mechanism unit, and the cyclic redundancy check module. It is used to send control signals to the security mechanism unit that needs to perform self-test according to the configuration, enable the self-test function of the security mechanism unit, send the pseudo-random number seed to the pseudo-random number generation module, compare the check code sent by the cyclic redundancy check module with the check value, and output the self-test result according to the comparison result.

[0035] The pseudo-random number generation module generates several pseudo-random numbers based on the pseudo-random number seed provided by the self-test control module, and outputs the pseudo-random numbers to each security mechanism unit.

[0036] The safety mechanism unit is used to initiate self-testing based on control signals, receive pseudo-random number excitations, perform corresponding operations, and send the output data to the cyclic redundancy check module.

[0037] The Cyclic Redundancy Check (CRBC) module receives the output data generated by each security mechanism unit after iterating through each pseudo-random number, performs CRBC operations on the output data of each security mechanism unit, generates the corresponding check code, and sends the current check code to the self-test control module when the pseudo-random number iteration is complete.

[0038] Figure 1 In this code, `bist_ctrl` represents the self-test control module. Based on the CPU or hardware configuration and control information, it initiates the corresponding security mechanism to perform a self-test and verifies the CRC checksum after completion. `prng` represents the pseudo-random number generation module. It obtains a pseudo-random number seed from `bist_ctrl` each time, generates a round of pseudo-random numbers, and outputs them to various modules. `sm0sm1...smn` represent security mechanism modules. These modules require a mux for their inputs and outputs. When `sm_bist_en` is valid, the stimulus provided by `prng` is selected and output to the CRC module. When `sm_bist_en` is invalid, the original function input is selected, and the output is also connected to the original function module. `crc` represents the Cyclic Redundancy Check module. This module receives the outputs of all security mechanism units, generates a CRC checksum, and outputs it to `bist_ctrl` for comparison.

[0039] In the aforementioned chip security mechanism self-testing system, the self-testing control module flexibly selects the security mechanism units to be self-tested based on the configuration, enabling their self-testing functions. Through pseudo-random number stimulation provided by the pseudo-random number generation module, the security mechanisms are accurately tested, thus avoiding the waste of resources in full-range testing and improving testing efficiency and fault coverage. The pseudo-random number generation module can generate various pseudo-random numbers based on a seed, providing a unified stimulus input for all security mechanisms. The cyclic redundancy check module receives the response outputs of all security mechanisms for unified verification, realizing a universal testing method for different security mechanism units, with strong adaptability and easy expansion. The security mechanism units, through a multiplexer design, can control the stimulation testing only on specified modules, ensuring the normal operation of unrelated circuits. The cyclic redundancy check module compresses the output data after each pseudo-random number test and generates a checksum, achieving fast and accurate result verification. Verification can be completed at the RTL stage, significantly shortening the design cycle. This embodiment of the invention can improve the efficiency and reliability of security mechanism self-testing in complex chip environments.

[0040] In one embodiment, the security mechanism unit includes a security mechanism module, a first multiplexer, and a second multiplexer. The input and output interfaces of the security mechanism module are respectively connected to the first multiplexer and the second multiplexer. The first multiplexer is connected to a pseudo-random number generation module and is used to receive pseudo-random numbers sent by the pseudo-random number generation module. The second multiplexer is connected to a cyclic redundancy check module and is used to send the output data of the security mechanism module to the cyclic redundancy check module.

[0041] In one embodiment, the first multiplexer is further configured to receive input data from the normal functional path; the second multiplexer is further configured to send output data from the security mechanism module to the normal functional path.

[0042] In one embodiment, the system further includes a processor connected to a self-test control module, used to read configuration data from non-volatile memory and initialize the self-test control module using the configuration data. In this embodiment, the processor (CPU) is used to implement software control of the configuration and startup of bit_ctrl; for chips without a CPU, startup can be controlled by hardware. The non-volatile memory (NVM) stores the prng seed and related configurations of bit_ctrl, enabling different test coverage and test objects based on different configurations.

[0043] In one embodiment, the checksum sent by the Cyclic Redundancy Check (CRBC) module is compared with the checksum value, and a self-test result is output based on the comparison result. This includes: analyzing whether the checksum sent by the CRBC module matches the checksum value; if it matches, determining whether the random number seed needs to be changed; if not, outputting a correct self-test result; if it does not match, the self-test fails and an error self-test result is output.

[0044] In one embodiment, the check code sent by the cyclic redundancy check module is compared with the check value, and a self-test result is output based on the comparison result. The method also includes: if the random number seed needs to be changed, a new pseudo-random number seed is sent to the pseudo-random number generation module according to the configuration.

[0045] In one embodiment, determining whether the random number seed needs to be changed includes: if the fault coverage of the security mechanism module corresponding to the current pseudo-random number seed is lower than the expected target, then the random number seed needs to be changed.

[0046] In one specific embodiment, such as Figure 2 As shown, a schematic diagram of the workflow of the system of the present invention is provided, and the steps are explained as follows:

[0047] S1, CPU, or hardware initializes the configuration of bist_ctrl according to NVM.

[0048] S2 and bist_ctrl enable the corresponding security mechanism self-check according to the configuration.

[0049] S3 and bist_ctrl provide pseudo-random number seeds to prng and enable prng to generate pseudo-random numbers.

[0050] The pseudo-random numbers from S4 and prng are sent to various security mechanisms. Therefore, each time the pseudo-random number changes, the internal logic will perform different operations, and the output will also change accordingly. The output is sent to the CRC module, and the CRC checks all the signals sent in each cycle.

[0051] S5. Iterate through all pseudo-random numbers in sequence.

[0052] S6. After all pseudo-random numbers have been traversed, check if the CRC matches the expected value. If not, output a self-test error status or alarm signal.

[0053] S7. It is possible that the random number corresponding to a pseudo-random number seed has a low fault coverage of the security mechanism. In this case, the pseudo-random number seed can be changed and execution can start again from S3.

[0054] S8. If all seeds have been executed and the CRC comparisons are correct, then the self-check is considered to have passed.

[0055] In this embodiment, the self-test control module supports the expansion of different types of security mechanisms. Only the corresponding security mechanism unit needs to be configured; there is no need to design specific detection circuits for each security mechanism. Furthermore, it can precisely control the enabling of security mechanism units requiring self-testing, while unrelated circuits operate normally, avoiding resource waste and improving self-testing efficiency. Using pseudo-random numbers as test stimuli enhances the universality of testing, as it is independent of the implementation method and type of specific security mechanisms. The pseudo-random number generation module generates multiple test vectors based on a seed, covering more test scenarios and thus more effectively detecting latent faults in security mechanisms. The pseudo-random number generation module provides a unified stimulus, and the CRC module provides unified verification of the security mechanism unit output. The system can adapt to different types of security mechanisms and implement a unified testing process. Real-time verification of the output data, compressed into a single checksum, quickly assesses the status of the security mechanism unit, reducing the time spent analyzing the original output data. The functions of each module in this system can be designed and verified during the RTL stage, avoiding delays in the netlist stage and significantly shortening the entire design cycle.

[0056] It should be understood that, although Figure 2 The steps in the flowchart are shown sequentially as indicated by the arrows, but these steps are not necessarily executed in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order in which these steps are executed, and they can be performed in other orders. Figure 2 At least some of the steps in the process may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these sub-steps or stages is not necessarily sequential, but can be executed in turn or alternately with other steps or at least some of the sub-steps or stages of other steps.

[0057] In one embodiment, a chip security mechanism self-testing method is provided, including the following steps:

[0058] The self-test control module sends control signals to the security mechanism unit that needs to be self-tested according to the configuration, enables the self-test function of the security mechanism unit, sends a pseudo-random number seed to the pseudo-random number generation module, compares the check code sent by the cyclic redundancy check module with the check value, and outputs the self-test result based on the comparison result.

[0059] The pseudo-random number generation module generates several pseudo-random numbers based on the pseudo-random number seed provided by the self-test control module, and outputs the pseudo-random numbers to each security mechanism unit.

[0060] The security mechanism unit initiates self-testing based on control signals, receives pseudo-random number excitations, performs corresponding operations, and sends the output data to the cyclic redundancy check module.

[0061] The cyclic redundancy check module receives the output data generated by each security mechanism unit after traversing each pseudo-random number. It performs cyclic redundancy check on the output data of each security mechanism unit to generate the corresponding check code. When the pseudo-random number traversal is completed, the current check code is sent to the self-test control module.

[0062] For specific limitations on the chip security mechanism self-testing method, please refer to the limitations on the chip security mechanism self-testing system mentioned above, which will not be repeated here. Each module in the aforementioned chip security mechanism self-testing system can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in hardware or independently of the processor in the computer device, or stored in software in the memory of the computer device, so that the processor can call and execute the corresponding operations of each module.

[0063] In one embodiment, a computer device is provided, which may be a terminal, and its internal structure diagram may be as follows: Figure 3As shown, the computer device includes a processor, memory, network interface, display screen, and input devices connected via a system bus. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The network interface is used to communicate with external terminals via a network connection. When the computer program is executed by the processor, it implements a chip security mechanism self-test method. The display screen can be an LCD screen or an e-ink display screen. The input devices can be a touch layer covering the display screen, buttons, a trackball, or a touchpad mounted on the computer device casing, or an external keyboard, touchpad, or mouse.

[0064] Those skilled in the art will understand that Figure 3 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0065] In one embodiment, a computer device is provided, including a memory and a processor, the memory storing a computer program, the processor executing the computer program to implement the steps of the method described above.

[0066] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon, which, when executed by a processor, implements the steps of the method described above.

[0067] Those skilled in the art will understand that all or part of the processes in the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above methods.

[0068] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0069] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of the invention patent. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A chip security mechanism self-testing system, characterized in that, The system includes a self-test control module, a pseudo-random number generation module, a cyclic redundancy check module, and at least one security mechanism unit. The self-test control module is connected to the pseudo-random number generation module, the security mechanism unit, and the cyclic redundancy check module. It is used to send control signals to the security mechanism unit that needs to perform self-test according to the configuration, enable the self-test function of the security mechanism unit, send the pseudo-random number seed to the pseudo-random number generation module, compare the check code sent by the cyclic redundancy check module with the check value, and output the self-test result according to the comparison result. The pseudo-random number generation module generates several pseudo-random numbers based on the pseudo-random number seed provided by the self-test control module, and outputs the pseudo-random numbers to each security mechanism unit. The security mechanism unit includes a security mechanism module, a first multiplexer, and a second multiplexer; it is used to initiate self-testing according to control signals, receive pseudo-random number excitations, perform corresponding operations, and send output data to the cyclic redundancy check module. The input and output interfaces of the security mechanism module are respectively connected to the first multiplexer and the second multiplexer; The cyclic redundancy check module is used to receive the output data generated by each security mechanism unit after traversing each pseudo-random number, perform cyclic redundancy check operation on the output data of each security mechanism unit, generate the corresponding check code, and send the current check code to the self-test control module when the pseudo-random number traversal is completed.

2. The system according to claim 1, characterized in that, The first multiplexer is connected to the pseudo-random number generation module and is used to receive pseudo-random numbers sent by the pseudo-random number generation module; The second multiplexer is connected to the cyclic redundancy check module and is used to send the output data of the security mechanism module to the cyclic redundancy check module.

3. The system according to claim 2, characterized in that, The first multiplexer is also used to receive input data from the normal function path; the second multiplexer is also used to send the output data of the security mechanism module to the normal function path.

4. The system according to claim 1, characterized in that, The system also includes a processor; The processor is connected to the self-test control module and is used to read configuration data from non-volatile memory and initialize the self-test control module using the configuration data.

5. The system according to claim 1, characterized in that, The checksum sent by the Cyclic Redundancy Check (CRBC) module is compared with the checksum value, and the self-test result is output based on the comparison result, including: Analyze whether the check code sent by the cyclic redundancy check module matches the check value. If it matches, determine whether the random number seed needs to be changed. If not, output the self-check result. If it does not meet the requirements, the self-test will fail and an error result will be output.

6. The system according to claim 5, characterized in that, The process involves comparing the checksum sent by the Cyclic Redundancy Check (CR) module with the checksum value, outputting the self-test result based on the comparison result, and also includes: If the random number seed needs to be changed, a new pseudo-random number seed will be sent to the pseudo-random number generation module according to the configuration.

7. The system according to claim 5, characterized in that, Determining whether the random number seed needs to be changed includes: If the fault coverage of the security mechanism module corresponding to the current pseudo-random number seed is lower than the expected target, the random number seed needs to be replaced.

8. A chip security mechanism self-testing method implemented in the system described in any one of claims 1-7, characterized in that, The method includes: The self-test control module sends control signals to the security mechanism unit that needs to perform self-test according to the configuration, enables the self-test function of the security mechanism unit, sends a pseudo-random number seed to the pseudo-random number generation module, compares the check code sent by the cyclic redundancy check module with the check value, and outputs the self-test result based on the comparison result. The pseudo-random number generation module generates several pseudo-random numbers based on the pseudo-random number seed provided by the self-test control module, and outputs the pseudo-random numbers to each security mechanism unit. The security mechanism unit initiates a self-test based on the control signal, receives pseudo-random number excitation, performs corresponding operations, and sends the output data to the cyclic redundancy check module. The cyclic redundancy check module receives the output data generated by each security mechanism unit after traversing each pseudo-random number, performs cyclic redundancy check on the output data of each security mechanism unit, generates the corresponding check code, and sends the current check code to the self-test control module when the pseudo-random number traversal is completed.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method of claim 8.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the steps of the method described in claim 8.

Images