Data parsing and bitstream configuration method and system for preventing Starbleed vulnerability attacks

Abstract

The present invention relates to the technical field of vulnerability attack prevention, and is a data parsing and bitstream configuration method and system for preventing Starbleed vulnerability attacks, comprising: determining whether a current register address is a WBSTAR register address; if not, transmitting the register data to a subsequent circuit; if so, determining whether a state machine is in an IDLE state; if not, transmitting the register data to the subsequent circuit; if so, determining whether a packet type, packet data length, and packet configuration operation meet vulnerability combination determination criteria; if not, transmitting the register data to the subsequent circuit; and if so, triggering a vulnerability warning. The present invention can solve the problem of imperfect prevention mechanisms for preventing Starbleed vulnerability attacks.

Description

Technical Field

[0001] The present invention relates to the technical field of vulnerability attack prevention, and in particular to a data parsing and bit stream configuration method and system for preventing Starbleed vulnerability attacks. Background Art

[0002] With the widespread application of FPGAs (field programmable gate arrays) in aerospace, industrial control, communications, and artificial intelligence, security issues are becoming increasingly prominent. FPGAs are configured and run by loading a user-designed bitstream.

[0003] FPGAs have a hardware security vulnerability called Starbleed, which is hidden in the FPGA's WBSTAR register configuration. An attacker first determines the data location of the WBSTAR configuration instruction. Then, by rewriting the ciphertext corresponding to that data location, they control the length of the data written to the WBSTAR register. The attacker then uses the FPGA itself as a decryption circuit, causing it to write the decrypted bitstream to the WBSTAR register and then read it out to crack the FPGA's encrypted bitstream.

[0004] Current defenses against the Starbleed vulnerability attack primarily obfuscate the location of the WBSTAR register configuration instructions in the configuration bitstream, preventing attackers from rewriting the packet data length of the WBSTAR register, thereby protecting the FPGA's encrypted bitstream. For example, a method and apparatus for defending against the Starbleed vulnerability (authorization announcement number CN111967014B) first decrypts the initial ciphertext to obtain plaintext, then determines a random number based on a preset random number selection strategy. The random number is then used to replace the configuration instructions in the plaintext, obfuscate the HMAC signature area data, and perform other operations. Finally, the obfuscated plaintext is encrypted to obtain the obfuscated ciphertext. However, this method does not fundamentally address the Starbleed vulnerability, and therefore, current defenses against Starbleed vulnerability attacks suffer from an incomplete defense mechanism. Summary of the Invention

[0005] The present invention provides a data parsing and bitstream configuration method and system for preventing Starbleed vulnerability attacks, the main purpose of which is to solve the problem of imperfect defense mechanism for preventing Starbleed vulnerability attacks.

[0006] To achieve the above objectives, the present invention provides a data parsing and bitstream configuration method for preventing Starbleed vulnerability attacks, comprising:

[0007] Obtain register data in the configuration bitstream, and perform bit-domain data parsing on the register data using a pre-built packet type parsing circuit module to obtain bit-domain parsed data, wherein the bit-domain parsed data includes: packet type valid data, packet length valid data, read / write valid flag, and register address valid data;

[0008] Identify the current register address based on the valid data of the register address;

[0009] Determine whether the current register address is the preset WBSTAR register address;

[0010] If the current register address is not the WBSTAR register address, the register data is transmitted to the subsequent circuit;

[0011] If the current register address is the WBSTAR register address, it is determined whether the state machine in the pre-built packet read and write control circuit module is in the preset IDLE state;

[0012] If the state machine in the packet read and write control circuit module is not in the IDLE state, the register data is transmitted to the subsequent circuit for data transmission;

[0013] If the state machine in the packet read / write control circuit module is in the IDLE state, the packet type, packet data length and packet configuration operation are determined respectively according to the packet type valid data, packet length valid data and read / write valid flag;

[0014] Determine whether the packet type, packet data length, and packet configuration operation meet the preset vulnerability combination judgment criteria, where the vulnerability combination judgment criteria are that the packet type is data packet type 1, the packet data length is greater than 1, and the packet configuration operation is a write operation;

[0015] If the packet type, packet data length, and packet configuration operation do not meet the vulnerability combination judgment criteria, the register data is transmitted to the subsequent circuit;

[0016] If the packet type, packet data length, and packet configuration operation meet the vulnerability combination judgment criteria, a vulnerability warning is triggered, completing the data parsing and bit stream configuration to prevent the Starbleed vulnerability attack.

[0017] Optionally, performing bit-domain data parsing on register data using a pre-built packet type parsing circuit module to obtain bit-domain parsed data includes:

[0018] Identifying a configuration application scenario of the configuration bitstream;

[0019] Selecting a target selector circuit from the multi-stage selector circuits of the pre-built packet type parsing circuit module according to the configuration application scenario;

[0020] The target selector circuit is used to input the register data into the combinational gate circuit in the packet type analysis circuit and perform bit field bit value comparison to obtain bit field analysis data.

[0021] Optionally, the configuration application scenarios include: JTAG interface input data configuration application scenarios, SPI interface input data configuration application scenarios, BPI interface input data configuration application scenarios, SMAP interface input data configuration application scenarios, SRL interface input data configuration application scenarios, and ICAP interface input data configuration application scenarios.

[0022] Optionally, after performing bit-domain data parsing on register data using a pre-built packet type parsing circuit module to obtain bit-domain parsed data, the method further includes:

[0023] Input the packet type valid data and packet length valid data into the pre-built packet length counter module.

[0024] Optionally, after inputting the packet type valid data and the packet length valid data into a pre-built packet length counter module, the method further includes:

[0025] The packet type valid data, the packet length valid data, and the read / write valid flag are input into a pre-built packet read / write control circuit module, which contains a state machine.

[0026] Optionally, after inputting the packet type valid data, the packet length valid data, and the read / write valid flag into the pre-built packet read / write control circuit module, the method further includes:

[0027] Input the packet type valid data, packet length valid data, read and write valid flag, and register address valid data into the pre-built Starbleed detection circuit module.

[0028] Optionally, determining whether a state machine in the pre-built packet read / write control circuit module is in a preset IDLE state includes:

[0029] If the state machine is in a preset WDC state, when receiving a preset type 2 data packet, it jumps to a preset WRPD state and determines whether the packet length counter module generates a preset packet counting end flag, wherein the WDC state indicates that the read / write valid flag is a write operation, the packet type corresponding to the packet type valid data is data packet type 1, and the packet data length corresponding to the packet length valid data is 0; the WRPD state indicates that the packet read / write control circuit module has received valid register address data, the type 2 data packet corresponding to the WBSTAR register address is being transmitted, and the read / write valid flag is a write operation;

[0030] When the packet length counter module generates a packet counting end flag, the state machine is in the IDLE state;

[0031] If the state machine is in the preset RDC state, when receiving a type 2 data packet, it jumps to the preset RDPD state and determines whether the packet length counter module generates a packet counting end flag, wherein the RDC state refers to the read-write valid flag being a read operation, the packet type corresponding to the packet type valid data is data packet type 2, and the packet data length corresponding to the packet length valid data is 0; the RDPD state refers to the packet read-write control circuit module having received valid register address data, the type 2 data packet corresponding to the WBSTAR register address being transmitted, and the read-write valid flag being a read operation;

[0032] When the packet length counter module generates a packet counting end flag, the state machine is in the IDLE state.

[0033] Optionally, determining whether the packet length counter module generates a preset packet counting end flag includes:

[0034] Identifying the packet data length of the type 2 data packet;

[0035] Counting down the packet data length of the type 2 data packet using a preset 27-bit width to obtain a decrement count value;

[0036] Determine whether the decrement count value is equal to 0;

[0037] If the decrement count value is not equal to 0, the packet length counter module does not generate a packet counting end flag;

[0038] If the decrement count value is equal to 0, the packet length counter module generates a packet counting end flag.

[0039] Optionally, after triggering the vulnerability warning, the method further includes:

[0040] triggering a lock signal based on the vulnerability warning;

[0041] The state machine is locked in the IDLE state according to the lock signal, and a configuration stop operation is performed, wherein the configuration stop operation includes: stopping the subsequent circuit configuration, stopping the write operation of the configuration WBSTAR register, and stopping the read operation of the configuration WBSTAR register.

[0042] To achieve the above objectives, the present invention further provides a data parsing and bitstream configuration system for preventing Starbleed vulnerability attacks, comprising:

[0043] The current register address judgment module is used to obtain register data in the configuration bit stream, perform bit-domain data parsing on the register data using a pre-built packet type parsing circuit module, and obtain bit-domain parsed data, wherein the bit-domain parsed data includes: packet type valid data, packet length valid data, read / write valid flag, and register address valid data; identify the current register address based on the register address valid data; determine whether the current register address is a preset WBSTAR register address; if the current register address is not a WBSTAR register address, transmit the register data to a subsequent circuit;

[0044] An IDLE state judgment module is used to judge whether the state machine in the pre-built packet read and write control circuit module is in the preset IDLE state if the current register address is the WBSTAR register address; if the state machine in the packet read and write control circuit module is not in the IDLE state, the register data is transmitted to the subsequent circuit;

[0045] a vulnerability combination determination standard determination module, configured to, if the state machine in the packet read / write control circuit module is in the IDLE state, determine the packet type, packet data length, and packet configuration operation based on the packet type valid data, packet length valid data, and read / write valid flag; and determine whether the packet type, packet data length, and packet configuration operation meet a preset vulnerability combination determination standard, wherein the vulnerability combination determination standard refers to the packet type being data packet type 1, the packet data length being greater than 1, and the packet configuration operation being a write operation; and if the packet type, packet data length, and packet configuration operation do not meet the vulnerability combination determination standard, then transmit the register data to a subsequent circuit;

[0046] The vulnerability warning module is triggered to trigger a vulnerability warning if the packet type, packet data length and packet configuration operation meet the vulnerability combination judgment criteria.

[0047] In order to solve the above problem, the present invention further provides an electronic device, comprising:

[0048] A memory storing at least one instruction; and a processor executing the instruction stored in the memory to implement the above-mentioned data parsing and bit stream configuration method for preventing Starbleed vulnerability attacks.

[0049] In order to solve the above problems, the present invention also provides a computer-readable storage medium, which stores at least one instruction. The at least one instruction is executed by a processor in an electronic device to implement the above-mentioned data parsing and bitstream configuration method for preventing Starbleed vulnerability attacks.

[0050] In order to solve the problem described in the background technology, the present invention determines the Starbleed vulnerability attack through the current register address, whether the state machine is in IDLE state, and the vulnerability combination judgment standard. First, it is necessary to obtain the register data in the configuration bit stream, and then use the front-stage circuit to perform bit domain data analysis on the register data to obtain bit domain analysis data, wherein the bit domain analysis data includes: packet type valid data, packet length valid data, read and write valid flag, register address valid data. Since the Starbleed vulnerability attack needs to simultaneously meet the three conditions that the current register address is the WBSTAR register address, the state machine is in IDLE state, the packet type, the packet data length and the packet configuration operation meet the vulnerability combination judgment standard, therefore, the current register address can be identified according to the register address valid data, and whether the current register address is the WBSTAR register address can be judged. If the current register address is not the WBSTAR register address, it means that there is no Starbleed vulnerability attack, and the register data is directly transmitted to the back-stage circuit. If the current register address is WBSTAR register address, then continue to perform the compliance judgment of the second condition, and judge whether the state machine in the packet read and write control circuit is in the IDLE state. If the packet read and write control circuit state machine is not in the IDLE state, it means that there is no Starbleed vulnerability attack, and the register data is directly transmitted to the downstream circuit. If the packet read and write control circuit state machine is in the IDLE state, it is necessary to perform the compliance judgment of the lower three conditions. First, according to the packet type valid data, packet length valid data and read and write valid flag, the packet type, packet data length and packet configuration operation are respectively determined. Then, it is judged whether the packet type, packet data length and packet configuration operation meet the vulnerability combination judgment standard. Among them, the vulnerability combination judgment standard refers to the packet type being data packet type 1, the packet data length being greater than 1 and the packet configuration operation being a write operation. If the packet type, packet data length and packet configuration operation do not meet the vulnerability combination judgment standard, it means that there is no Starbleed vulnerability attack, and the register data is directly transmitted to the downstream circuit. If the packet type, packet data length and packet configuration operation meet the vulnerability combination judgment standard, a vulnerability warning is triggered. Therefore, the present invention can solve the problem that the current defense mechanism for preventing Starbleed vulnerability attacks is imperfect. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] Figure 1 A flowchart of a data parsing and bitstream configuration method for preventing Starbleed vulnerability attacks provided by one embodiment of the present invention;

[0052] Figure 2 A flowchart of Starbleed vulnerability data analysis provided by one embodiment of the present invention;

[0053] Figure 3A state determination flow chart of a state machine provided in one embodiment of the present invention;

[0054] Figure 4 A functional module diagram of a data parsing and bitstream configuration system for preventing Starbleed vulnerability attacks provided by one embodiment of the present invention;

[0055] Figure 5 A schematic diagram of the structure of an electronic device that implements the data parsing and bitstream configuration method for preventing Starbleed vulnerability attacks provided by an embodiment of the present invention.

[0056] Description of reference numerals:

[0057] 1. Electronic device; 10. Processor; 11. Memory; 12. Bus.

[0058] The purpose, features and advantages of the present invention will be further described with reference to the accompanying drawings and in conjunction with the embodiments. DETAILED DESCRIPTION

[0059] It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.

[0060] The embodiments of the present application provide a data parsing and bitstream configuration method for preventing Starbleed vulnerability attacks. The execution subject of the data parsing and bitstream configuration method for preventing Starbleed vulnerability attacks includes, but is not limited to, at least one of electronic devices such as a server and a terminal that can be configured to execute the method provided by the embodiments of the present application. In other words, the data parsing and bitstream configuration method for preventing Starbleed vulnerability attacks can be executed by software or hardware installed on a terminal device or a server device, and the software can be a blockchain platform. The server includes, but is not limited to, a single server, a server cluster, a cloud server, or a cloud server cluster.

[0061] Reference Figure 1 FIG. 1 is a flow chart of a method for data parsing and bitstream configuration to prevent Starbleed vulnerability attacks according to an embodiment of the present invention. In this embodiment, the method for data parsing and bitstream configuration to prevent Starbleed vulnerability attacks includes:

[0062] S1. Obtain register data in the configuration bit stream, and use a pre-built packet type parsing circuit module to perform bit field data parsing on the register data to obtain bit field parsed data, wherein the bit field parsed data includes: packet type valid data, packet length valid data, read and write valid flag, and register address valid data.

[0063] As can be understood, the configuration bitstream refers to the user-designed bitstream used to load and run the FPGA program. This configuration bitstream contains the complete FPGA internal configuration state, wiring, logic resources, I / O settings, and register data. Register data refers to the data in the FPGA configuration bitstream used to initialize, control, and configure the FPGA's internal registers. Examples include WBSTAR register data and FDRI register data.

[0064] Furthermore, the front-stage circuit is configured to receive configuration data for various interfaces (e.g., JTAG, SPI, BPI, SMAP, SRL, and ICAP) and input the interface configuration data into a packet type parsing circuit module for packet type parsing. The packet type parsing circuit module is a circuit module configured to parse out valid data from various bit fields within register data in the configuration bitstream, such as valid packet type data, valid packet length data, a read / write valid flag, and valid register address data.

[0065] Specifically, the JTAG interface refers to a universal test and debug interface. The SPI interface refers to a serial peripheral interface, and the reading and writing data of the SPI interface are independently controlled by different signals. The BPI interface refers to a general term for parallel peripheral interfaces. The SMAP interface refers to a loading configuration interface used to configure the FPGA, which quickly loads configuration data through a parallel data bus. The SRL interface refers to a serial peripheral interface, and its reading and writing data share a common signal control. The ICAP interface refers to the internal configuration access port provided by the FPGA to the user.

[0066] Furthermore, the bit field data parsing refers to identifying valid data for each bit field in the register data. The bit field parsing data refers to valid data for each bit field in the register data obtained after bit field data parsing. The packet type valid data refers to valid data in the register data used to indicate the packet type. The packet length valid data refers to valid data in the register data used to indicate the length of the packet data. The read / write valid flag refers to a valid flag in the register data used to indicate a packet read / write operator. The register address valid data refers to valid data in the register data used to indicate the register address.

[0067] In an embodiment of the present invention, the method of performing bit-domain data parsing on register data using a pre-built packet type parsing circuit module to obtain bit-domain parsed data includes:

[0068] Identifying a configuration application scenario of the configuration bitstream;

[0069] Selecting a target selector circuit from the multi-stage selector circuits of the pre-built packet type parsing circuit module according to the configuration application scenario;

[0070] The target selector circuit is used to input the register data into the combinational gate circuit in the packet type analysis circuit and perform bit field bit value comparison to obtain bit field analysis data.

[0071] It is understood that the configuration application scenario refers to the configuration application mode for each type of interface configuration data. The multi-stage selector circuit is used to effectively select and output each type of interface configuration data. Because two configuration application scenarios cannot exist simultaneously when register data is input into the packet type parsing circuit module using the previous stage circuit, a valid circuit can be selected in the multi-stage selector circuit to input the interface configuration data for a specific configuration application scenario into the packet type parsing circuit. Each stage of the multi-stage selector circuit has a one-to-one correspondence with each type of interface configuration data.

[0072] Furthermore, the target selector circuit refers to a circuit corresponding to the configuration application scenario. The combinational gate circuit refers to a circuit within the packet type parsing circuit for identifying valid data in each bit field of the register data, such as a combinational gate circuit such as XOR, XNOR, and AND. The bit values ​​of different bit fields in the register data are compared by the combinational gate circuit to obtain the bit field parsed data.

[0073] In an embodiment of the present invention, the configuration application scenarios include: JTAG interface input data configuration application scenario, SPI interface input data configuration application scenario, BPI interface input data configuration application scenario, SMAP interface input data configuration application scenario, SRL interface input data configuration application scenario, and ICAP interface input data configuration application scenario.

[0074] In an embodiment of the present invention, after performing bit-domain data parsing on register data using a pre-built packet type parsing circuit module to obtain bit-domain parsed data, the method further includes:

[0075] Input the packet type valid data and packet length valid data into the pre-built packet length counter module.

[0076] It is understandable that the packet length counter module can count down the packet data length.

[0077] It should be understood that after inputting the packet type valid data and the packet length valid data into the pre-built packet length counter module, the method further includes:

[0078] The packet type valid data, the packet length valid data, and the read / write valid flag are input into a pre-built packet read / write control circuit module, which contains a state machine.

[0079] It can be understood that the packet read and write control circuit module is responsible for generating status flags during the data packet configuration process. The functional implementation of this circuit module depends on the state machine. The state machine can generate state jumps based on the packet type valid data, read and write valid flags, and packet length count end flags. At the beginning and end of the normal bit stream configuration, the state machine will stop in the IDLE state.

[0080] Furthermore, after inputting the packet type valid data, the packet length valid data, and the read / write valid flag into the pre-built packet read / write control circuit module, the method further includes:

[0081] Input the packet type valid data, packet length valid data, read and write valid flag, and register address valid data into the pre-built Starbleed detection circuit module.

[0082] It can be understood that the Starbleed detection circuit module refers to a circuit module that detects Starbleed vulnerabilities based on data such as packet type valid data, packet length valid data, read and write valid flags, and register address valid data. When the Starbleed detection circuit module determines that a Starbleed vulnerability exists, it will trigger a system reset operation and at the same time block the read and write operations on the WBSTAR register to prevent data leakage.

[0083] Furthermore, the Starbleed vulnerability data parsing process composed of the front-stage circuit, packet type analysis circuit module, packet read and write control circuit module, packet length counter module, Starbleed detection circuit module and back-stage circuit can be referred to Figure 2 shown.

[0084] S2. Identify the current register address based on the valid data of the register address.

[0085] It can be explained that the current register address refers to the register address indicated in the register data.

[0086] S3. Determine whether the current register address is the preset WBSTAR register address.

[0087] It is understandable that the WBSTAR register address refers to the register address indicated in the WBSTAR register. The WBSTAR register refers to the hot start initial address register, which is used to store boot address data and can realize the initial address of reading data from the external memory chip after the hot start reset inside the chip.

[0088] If the current register address is not the WBSTAR register address, then S4 is executed to transmit the register data to the subsequent circuit.

[0089] It can be understood that the latter circuit refers to a circuit module that further performs subsequent logic or control operations on register data attacked by the Starbleed vulnerability.

[0090] Furthermore, since the Starbleed vulnerability is hidden in the WBSTAR register configuration of the FPGA, when the current register address is not the WBSTAR register address, it means that the Starbleed vulnerability does not exist, and therefore the register data is directly transmitted to the subsequent circuit.

[0091] If the current register address is the WBSTAR register address, then S5 is executed to determine whether the state machine in the pre-built packet read and write control circuit module is in the preset IDLE state.

[0092] It is understood that the state machine is used to indicate the configuration state of the packet read / write control circuit module during the register data configuration process, and can generate state jumps based on the packet type valid data, the read / write valid flag, and the packet length count end flag. The IDLE state refers to the initial state or end state of the state machine. The state machine will be in the IDLE state at the beginning or end of the configuration bit stream, when the NOOP data in the configuration bit stream is parsed, or when the address register completes data configuration.

[0093] In an embodiment of the present invention, determining whether a state machine in a pre-built packet read / write control circuit module is in a preset IDLE state includes:

[0094] If the state machine is in a preset WDC state, when receiving a preset type 2 data packet, it jumps to a preset WRPD state and determines whether the packet length counter module generates a preset packet counting end flag, wherein the WDC state indicates that the read / write valid flag is a write operation, the packet type corresponding to the packet type valid data is data packet type 1, and the packet data length corresponding to the packet length valid data is 0; the WRPD state indicates that the packet read / write control circuit module has received valid register address data, the type 2 data packet corresponding to the WBSTAR register address is being transmitted, and the read / write valid flag is a write operation;

[0095] When the packet length counter module generates a packet counting end flag, the state machine is in the IDLE state;

[0096] If the state machine is in the preset RDC state, when receiving a type 2 data packet, it jumps to the preset RDPD state and determines whether the packet length counter module generates a packet counting end flag, wherein the RDC state refers to the read-write valid flag being a read operation, the packet type corresponding to the packet type valid data is data packet type 2, and the packet data length corresponding to the packet length valid data is 0; the RDPD state refers to the packet read-write control circuit module having received valid register address data, the type 2 data packet corresponding to the WBSTAR register address being transmitted, and the read-write valid flag being a read operation;

[0097] When the packet length counter module generates a packet counting end flag, the state machine is in the IDLE state.

[0098] Furthermore, the WDC state is valid when the read / write valid flag indicates a write operation, the packet type corresponding to the packet type valid data is data packet type 1, and the packet length corresponding to the packet length valid data is 0. When the state machine is in the WDC state, it indicates that the combinational gate circuit will receive a Type 2 data packet and, upon receiving the Type 2 data packet, jumps to the WRPD state. The Type 2 data packet refers to a data packet of Type 2. The WRPD state is a state process in which, after determining valid data at the register address, the data packet corresponding to the register address is transmitted and a write operation is performed. When the packet length counter module generates a packet count end flag, it jumps back from the WRPD state to the IDLE state.

[0099] In detail, the data structure of the Type 1 data packet is as follows:

[0100] It can be interpreted that in the 32-bit double word of the Type 1 data packet, the 31 to 29 bit fields indicate the data packet type, the 28 to 27 bit fields indicate the packet read and write operators, 01 for read operation, 10 for write operation, 00 for empty, and 11 for reserved. The 26 to 13 bit fields indicate the register address to be configured, the 12 to 11 bit fields are reserved, and the 10 to 0 bit fields are the data length that the register address needs to be configured, in double words. When the data length that the register address needs to configure exceeds the range that can be indicated by 11 bits, it is necessary to configure a Type 2 data packet following the Type 1 data packet, and the 10 to 0 bit fields of the Type 1 data packet need to be filled with all 0s. The data length is indicated only by the Type 2 data packet. For example: when the data packet of the FDRI register needs to be configured, the data length is indicated only by the Type 2 data packet.

[0101] Furthermore, the data structure of the type 3 data packet is as follows:

[0102] As you can understand, in the 32-bit doubleword of a Type 2 packet, bits 31 to 29 indicate the packet type, and bits 28 to 27 indicate the packet read and write operators, which are consistent with those for Type 1 packets. Bits 26 to 0 are the data length to be configured for the register address. This expands the 11-bit data length of the Type 1 packet to a 27-bit data length that satisfies the maximum data length of the register address.

[0103] Specifically, the packet length counter module can count down the packet data length. The module is a 27-bit down counter that can count down the packet data length of a Type 1 packet or a Type 2 packet. The count end flag indicates when the packet length counter has counted down to 0.

[0104] Furthermore, the RDC state is valid when the read / write valid flag indicates a read operation, the packet type corresponding to the packet type valid data is data packet type 1, and the packet length corresponding to the packet length valid data is 0. When the state machine is in the WDC state, it indicates that the combinational gate circuit will receive a type 2 data packet and, upon receiving the type 2 data packet, jumps to the RDPD state. The RDPD state is a state process in which, after determining that the register address has valid data, the data packet corresponding to the register address is transmitted and a read operation is performed. When the packet length counter module generates a packet count end flag, it jumps back from the WRPD state to the IDLE state.

[0105] In detail, the state judgment flow chart of the state machine can be found in Figure 3 shown.

[0106] In an embodiment of the present invention, determining whether the packet length counter module generates a preset packet counting end flag includes:

[0107] Identifying the packet data length of the type 2 data packet;

[0108] Counting down the packet data length of the type 2 data packet using a preset 27-bit width to obtain a decrement count value;

[0109] Determine whether the decrement count value is equal to 0;

[0110] If the decrement count value is not equal to 0, the packet length counter module does not generate a packet counting end flag;

[0111] If the decrement count value is equal to 0, the packet length counter module generates a packet counting end flag.

[0112] It is understood that the decrement count value refers to the count value during the countdown of the packet data length. When counting down the packet data length of a Type 1 data packet, an 11-bit width is used for countdown, and when counting down the packet data length of a Type 2 data packet, a 27-bit width is used for countdown. When the decrement count value reaches 0, a packet count end flag is generated, indicating that the register configuration data of the register address has been completed. At this time, the packet count end flag is output to the packet read and write control circuit module and the Starbleed detection circuit module.

[0113] If the state machine in the packet read / write control circuit module is not in the IDLE state, then S6 is executed to transmit the register data to the subsequent circuit.

[0114] As you can understand, in an SRAM-based FPGA configuration bitstream, the FDRI register data refers to the user configuration data written to the SRAM. SRAM is a static random access memory (SDRAM) that stores data that remains constant as long as power is supplied. The FDRI register is the configuration data register written to the SRAM.

[0115] Furthermore, each double word in the FDRI register data is generated according to specific specifications. There is a certain probability that some bit fields in the FDRI register data will be the same as the value of the WBSTAR register address, causing the Starbleed error vulnerability warning to be falsely triggered. To avoid this, the FDRI register data configuration and the WBSTAR register data configuration are distinguished by determining whether the state machine is in the IDLE state. First, during the FDRI register data packet configuration, the state machine of the packet read and write control circuit module has already passed the WDC state and received a type 2 data packet, and then jumped to the WRPD state. The WRPD state indicates that the FDRI register data packet is being received and is currently in the state of writing to the FDRI register. Although the data being written at this time may be exactly the same as the data value configured to the WBSTAR register after being rewritten by the attacker, since data is not being written to the WBSTAR register, it can be determined that the configuration bit stream at this time is a non-attack bit stream, and the state machine is definitely not in the IDLE state.

[0116] Specifically, by determining whether the state machine in the packet read / write control circuit module is in the IDLE state, not only can the false triggering of the Starbleed error vulnerability warning be eliminated and data collisions avoided, but the system can also be informed that before the WBSTAR register address is obtained, the packet length counter module has generated a count end flag, the previous register address configuration has ended normally, and the state machine has jumped back to the IDLE state, thus avoiding the influence of the previously generated configuration problems on the judgment of the Starbleed error vulnerability.

[0117] If the state machine in the packet read / write control circuit module is in the IDLE state, S7 is executed to respectively determine the packet type, packet data length and packet configuration operation according to the packet type valid data, packet length valid data and read / write valid flag.

[0118] S8. Determine whether the packet type, packet data length, and packet configuration operation meet the preset vulnerability combination judgment criteria.

[0119] Specifically, the vulnerability combination determination criteria refer to the packet type being data packet type 1, the packet data length being greater than 1, and the packet configuration operation being a write operation.

[0120] This is understandable because the packet data length configured in the WBSTAR register is 1 and the WBSTAR register only stores the last double word written. By overwriting the packet data length in the WBSTAR register to greater than 1 and writing the ciphertext of the configuration bitstream into the WBSTAR register, the attacker replaces the original legitimate bitstream. This causes the modified encrypted bitstream to fail HMAC verification, causing the system configuration to automatically reset the FPGA. However, the data in the WBSTAR register is not reset and can be decrypted and read out, leaking the user's encrypted bitstream.

[0121] Furthermore, in the chip's configuration bitstream, only the packet data length of the FDRI register is greater than 1; the packet data length of the WBSTAR register is always 1. When rewriting the bitstream, an attacker must first rewrite the WBSTAR register's packet data length to a value greater than 1. To avoid affecting the write configuration operation, the read and write operations in the rewritten WBSTAR register's data packet remain write operations, and the configured data packet is a Type 1 packet. Therefore, when the WBSTAR register's packet data length is greater than 1, the packet configuration operation is a write operation, the packet type is Data Packet Type 1, and the current register address is the WBSTAR register address, and the state machine is in the IDLE state, it can be determined that the current bitstream configuration process is an abnormal register configuration process, indicating that the configuration bitstream has been maliciously tampered with by an attacker, and the Starbleed detection circuit module can trigger a vulnerability warning.

[0122] If the packet type, packet data length and packet configuration operation do not meet the vulnerability combination judgment standard, then S9 is executed to transmit the register data to the subsequent circuit.

[0123] If the packet type, packet data length, and packet configuration operation meet the vulnerability combination judgment criteria, S10 is executed to trigger a vulnerability warning, completing data parsing and bit stream configuration to prevent Starbleed vulnerability attacks.

[0124] In an embodiment of the present invention, after triggering the vulnerability warning, the method further includes:

[0125] triggering a lock signal based on the vulnerability warning;

[0126] The state machine is locked in the IDLE state according to the lock signal, and a configuration stop operation is performed, wherein the configuration stop operation includes: stopping the subsequent circuit configuration, stopping the write operation of the configuration WBSTAR register, and stopping the read operation of the configuration WBSTAR register.

[0127] It is understandable that if the current register address is the WBSTAR register address, the state machine is in the IDLE state, and the vulnerability combination judgment criteria are met, it is necessary to stop the configuration process of all subsequent circuits and prohibit any read and write operations on the WBSTAR register to protect data security.

[0128] Furthermore, upon receiving the PROGRAM_B global reset signal from outside the system, the packet read / write control circuit module releases the locked state machine, and the packet length counter module, packet type parsing circuit module, and Starbleed detection circuit module are reset. The FPGA then returns to its initial configuration state and awaits reconfiguration. PROGRAM_B refers to the global reset pin, which clears all configuration information within the FPGA, restoring the FPGA to its initial state and allowing it to be reconfigured.

[0129] In order to solve the problem described in the background technology, the present invention determines the Starbleed vulnerability attack through the current register address, whether the state machine is in IDLE state, and the vulnerability combination judgment standard. First, it is necessary to obtain the register data in the configuration bit stream, and then use the front-stage circuit to perform bit domain data analysis on the register data to obtain bit domain analysis data, wherein the bit domain analysis data includes: packet type valid data, packet length valid data, read and write valid flag, register address valid data. Since the Starbleed vulnerability attack needs to simultaneously meet the three conditions that the current register address is the WBSTAR register address, the state machine is in IDLE state, the packet type, the packet data length and the packet configuration operation meet the vulnerability combination judgment standard, therefore, the current register address can be identified according to the register address valid data, and whether the current register address is the WBSTAR register address can be judged. If the current register address is not the WBSTAR register address, it means that there is no Starbleed vulnerability attack, and the register data is directly transmitted to the back-stage circuit. If the current register address is WBSTAR register address, then continue to perform the compliance judgment of the second condition, and judge whether the state machine in the packet read and write control circuit is in the IDLE state. If the packet read and write control circuit state machine is not in the IDLE state, it means that there is no Starbleed vulnerability attack, and the register data is directly transmitted to the downstream circuit. If the packet read and write control circuit state machine is in the IDLE state, it is necessary to perform the compliance judgment of the lower three conditions. First, according to the packet type valid data, packet length valid data and read and write valid flag, the packet type, packet data length and packet configuration operation are respectively determined. Then, it is judged whether the packet type, packet data length and packet configuration operation meet the vulnerability combination judgment standard. Among them, the vulnerability combination judgment standard refers to the packet type being data packet type 1, the packet data length being greater than 1 and the packet configuration operation being a write operation. If the packet type, packet data length and packet configuration operation do not meet the vulnerability combination judgment standard, it means that there is no Starbleed vulnerability attack, and the register data is directly transmitted to the downstream circuit. If the packet type, packet data length and packet configuration operation meet the vulnerability combination judgment standard, a vulnerability warning is triggered. Therefore, the present invention can solve the problem that the current defense mechanism for preventing Starbleed vulnerability attacks is imperfect.

[0130] like Figure 4 , which is a functional module diagram of a data parsing and bitstream configuration system for preventing Starbleed vulnerability attacks provided by one embodiment of the present invention.

[0131] The data parsing and bitstream configuration system 100 for preventing Starbleed vulnerability attacks described in the present invention can be installed in an electronic device. Depending on the functionality implemented, the data parsing and bitstream configuration system 100 for preventing Starbleed vulnerability attacks can include a current register address determination module 101, an IDLE state determination module 102, a vulnerability combination determination standard determination module 103, and a vulnerability warning triggering module 104. The modules described in the present invention, also referred to as units, refer to a series of computer program segments that can be executed by an electronic device processor and can perform a fixed function, and are stored in the electronic device's memory.

[0132] The current register address determination module 101 is configured to obtain register data in the configuration bit stream, perform bit-domain data parsing on the register data using a pre-built packet type parsing circuit module, and obtain bit-domain parsed data, wherein the bit-domain parsed data includes: packet type valid data, packet length valid data, read / write valid flag, and register address valid data; identify the current register address based on the register address valid data; determine whether the current register address is a preset WBSTAR register address; and if the current register address is not a WBSTAR register address, transmit the register data to a subsequent circuit;

[0133] The IDLE state judgment module 102 is used to judge whether the state machine in the pre-built packet read and write control circuit module is in the preset IDLE state if the current register address is the WBSTAR register address; if the state machine in the packet read and write control circuit module is not in the IDLE state, the register data is transmitted to the subsequent circuit;

[0134] The vulnerability combination determination standard determination module 103 is configured to, if the state machine in the packet read / write control circuit module is in the IDLE state, determine the packet type, packet data length, and packet configuration operation based on the packet type valid data, packet length valid data, and read / write valid flag; determine whether the packet type, packet data length, and packet configuration operation meet a preset vulnerability combination determination standard, wherein the vulnerability combination determination standard refers to the packet type being data packet type 1, the packet data length being greater than 1, and the packet configuration operation being a write operation; and if the packet type, packet data length, and packet configuration operation do not meet the vulnerability combination determination standard, transmit the register data to a subsequent circuit;

[0135] The vulnerability warning triggering module 104 is configured to trigger a vulnerability warning if the packet type, packet data length, and packet configuration operation meet the vulnerability combination determination criteria.

[0136] In detail, the modules in the data parsing and bitstream configuration system 100 for preventing Starbleed vulnerability attack in the embodiment of the present invention are used in the same manner as above. Figure 1 The data parsing and bit stream configuration methods for preventing Starbleed vulnerability attacks are the same technical means as those described in , and can produce the same technical effects, so they will not be repeated here.

[0137] like Figure 5 FIG. 1 is a schematic diagram of the structure of an electronic device for implementing a data parsing and bitstream configuration method for preventing Starbleed vulnerability attacks provided by an embodiment of the present invention.

[0138] The electronic device 1 may include a processor 10, a memory 11 and a bus 12, and may also include a computer program stored in the memory 11 and executable on the processor 10, such as a data parsing and bitstream configuration method program for preventing Starbleed vulnerability attacks.

[0139] The memory 11 includes at least one type of readable storage medium, including flash memory, a removable hard disk, a multimedia card, a card-type memory (e.g., SD or DX memory), a magnetic memory, a magnetic disk, an optical disk, etc. In some embodiments, the memory 11 may be an internal storage unit of the electronic device 1, such as a removable hard disk of the electronic device 1. In other embodiments, the memory 11 may also be an external storage device of the electronic device 1, such as a plug-in removable hard disk, a Smart Media Card (SMC), a Secure Digital (SD) card, a flash memory card, etc. Furthermore, the memory 11 includes both internal storage units of the electronic device 1 and external storage devices. The memory 11 can be used not only to store application software installed in the electronic device 1 and various types of data, such as the code for data parsing and bitstream configuration methods to protect against Starbleed vulnerability attacks, but also to temporarily store data that has been output or is about to be output.

[0140] In some embodiments, the processor 10 may be comprised of an integrated circuit, such as a single packaged integrated circuit or a plurality of packaged integrated circuits with the same or different functions, including a combination of one or more central processing units (CPUs), microprocessors, digital processing chips, graphics processors, and various control chips. The processor 10 is the control core (control unit) of the electronic device, connecting the various components of the electronic device using various interfaces and circuits. It executes programs or modules stored in the memory 11 (such as data parsing and bitstream configuration methods for preventing Starbleed vulnerability attacks) and accesses data stored in the memory 11 to execute various functions and process data.

[0141] The bus 12 may be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus. The bus 12 may be divided into an address bus, a data bus, a control bus, etc. The bus 12 is configured to enable communication between the memory 11 and at least one processor 10, etc.

[0142] Figure 5 Only the electronic device with components is shown, and it can be understood by those skilled in the art that Figure 5 The structure shown does not constitute a limitation on the electronic device 1 , and may include fewer or more components than shown in the figure, or combine certain components, or arrange the components differently.

[0143] For example, although not shown, the electronic device 1 may further include a power supply (e.g., a battery) to power various components. Preferably, the power supply may be logically connected to the at least one processor 10 via a power management device, thereby enabling functions such as charge management, discharge management, and power consumption management via the power management device. The power supply may further include any components such as one or more DC or AC power supplies, a recharging device, a power failure detection circuit, a power converter or inverter, and a power status indicator. The electronic device 1 may also include various sensors, Bluetooth modules, Wi-Fi modules, etc., which are not further described here.

[0144] Furthermore, the electronic device 1 may also include a network interface. Optionally, the network interface may include a wired interface and / or a wireless interface (such as a WI-FI interface, a Bluetooth interface, etc.), which is generally used to establish a communication connection between the electronic device 1 and other electronic devices.

[0145] Optionally, the electronic device 1 may further include a user interface, which may be a display or an input unit (such as a keyboard). Optionally, the user interface may also be a standard wired interface or a wireless interface. Optionally, in some embodiments, the display may be an LED display, a liquid crystal display, a touch-sensitive liquid crystal display, or an OLED (Organic Light-Emitting Diode) touchscreen. The display may also be appropriately referred to as a display screen or a display unit, and is used to display information processed by the electronic device 1 and to display a visual user interface.

[0146] The data parsing and bitstream configuration method program for preventing Starbleed vulnerability attacks stored in the memory 11 of the electronic device 1 is a combination of multiple instructions. When running in the processor 10, it can achieve the following:

[0147] Obtain register data in the configuration bitstream, and perform bit-domain data parsing on the register data using a pre-built packet type parsing circuit module to obtain bit-domain parsed data, wherein the bit-domain parsed data includes: packet type valid data, packet length valid data, read / write valid flag, and register address valid data;

[0148] Identify the current register address based on the valid data of the register address;

[0149] Determine whether the current register address is the preset WBSTAR register address;

[0150] If the current register address is not the WBSTAR register address, the register data is transmitted to the subsequent circuit;

[0151] If the current register address is the WBSTAR register address, it is determined whether the state machine in the pre-built packet read and write control circuit module is in the preset IDLE state;

[0152] If the state machine in the packet read and write control circuit module is not in the IDLE state, the register data is transmitted to the subsequent circuit for data transmission;

[0153] If the state machine in the packet read / write control circuit module is in the IDLE state, the packet type, packet data length and packet configuration operation are determined respectively according to the packet type valid data, packet length valid data and read / write valid flag;

[0154] Determine whether the packet type, packet data length, and packet configuration operation meet the preset vulnerability combination judgment criteria, where the vulnerability combination judgment criteria are that the packet type is data packet type 1, the packet data length is greater than 1, and the packet configuration operation is a write operation;

[0155] If the packet type, packet data length, and packet configuration operation do not meet the vulnerability combination judgment criteria, the register data is transmitted to the subsequent circuit;

[0156] If the packet type, packet data length, and packet configuration operation meet the vulnerability combination judgment criteria, a vulnerability warning is triggered, completing the data parsing and bit stream configuration to prevent the Starbleed vulnerability attack.

[0157] Specifically, the specific implementation method of the processor 10 for the above instructions can refer to Figures 1 to 5 The description of the relevant steps in the corresponding embodiments will not be repeated here.

[0158] Furthermore, if the modules / units integrated into the electronic device 1 are implemented as software functional units and sold or used as independent products, they may be stored in a computer-readable storage medium. The computer-readable storage medium may be volatile or non-volatile. For example, the computer-readable medium may include any entity or device capable of carrying the computer program code, a recording medium, a USB flash drive, a mobile hard drive, a magnetic disk, an optical disk, a computer memory, or a read-only memory (ROM).

[0159] The present invention further provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program. When the computer program is executed by a processor of an electronic device, the computer program can implement:

[0160] Obtain register data in the configuration bitstream, and perform bit-domain data parsing on the register data using a pre-built packet type parsing circuit module to obtain bit-domain parsed data, wherein the bit-domain parsed data includes: packet type valid data, packet length valid data, read / write valid flag, and register address valid data;

[0161] Identify the current register address based on the valid data of the register address;

[0162] Determine whether the current register address is the preset WBSTAR register address;

[0163] If the current register address is not the WBSTAR register address, the register data is transmitted to the subsequent circuit;

[0164] If the current register address is the WBSTAR register address, it is determined whether the state machine in the pre-built packet read and write control circuit module is in the preset IDLE state;

[0165] If the state machine in the packet read and write control circuit module is not in the IDLE state, the register data is transmitted to the subsequent circuit for data transmission;

[0166] If the state machine in the packet read / write control circuit module is in the IDLE state, the packet type, packet data length and packet configuration operation are determined respectively according to the packet type valid data, packet length valid data and read / write valid flag;

[0167] Determine whether the packet type, packet data length, and packet configuration operation meet the preset vulnerability combination judgment criteria, where the vulnerability combination judgment criteria are that the packet type is data packet type 1, the packet data length is greater than 1, and the packet configuration operation is a write operation;

[0168] If the packet type, packet data length, and packet configuration operation do not meet the vulnerability combination judgment criteria, the register data is transmitted to the subsequent circuit;

[0169] If the packet type, packet data length, and packet configuration operation meet the vulnerability combination judgment criteria, a vulnerability warning is triggered, completing the data parsing and bit stream configuration to prevent the Starbleed vulnerability attack.

[0170] In the several embodiments provided by the present invention, it should be understood that the disclosed devices, systems and methods can be implemented in other ways. For example, the system embodiments described above are only exemplary, and actual implementations may have other division methods.

[0171] The modules described as separate components may or may not be physically separate, and the components shown as modules may or may not be physical units, that is, they may be located in one place or distributed across multiple network elements. Some or all of the modules may be selected to achieve the purpose of the solution of this embodiment according to actual needs.

[0172] In addition, the functional modules in various embodiments of the present invention may be integrated into a single processing unit, each unit may exist physically separately, or two or more units may be integrated into a single unit. The aforementioned integrated units may be implemented in the form of hardware or hardware plus software functional modules.

[0173] It will be apparent to those skilled in the art that the present invention is not limited to the details of the exemplary embodiments described above, and that the present invention can be implemented in other specific forms without departing from the spirit or essential characteristics of the present invention.

[0174] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not limiting. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the present invention.

Claims

1. A data parsing and bitstream configuration method for preventing Starbleed vulnerability attacks, characterized in that: The method comprises: Obtain register data in the configuration bitstream, and perform bit-domain data parsing on the register data using a pre-built packet type parsing circuit module to obtain bit-domain parsed data, wherein the bit-domain parsed data includes: packet type valid data, packet length valid data, read / write valid flag, and register address valid data; Identify the current register address based on the valid data of the register address; Determine whether the current register address is the preset WBSTAR register address; If the current register address is not the WBSTAR register address, the register data is transmitted to the subsequent circuit; If the current register address is the WBSTAR register address, it is determined whether the state machine in the pre-built packet read and write control circuit module is in the preset IDLE state; If the state machine in the packet read and write control circuit module is not in the IDLE state, the register data is transmitted to the subsequent circuit for data transmission; If the state machine in the packet read / write control circuit module is in the IDLE state, the packet type, packet data length and packet configuration operation are determined respectively according to the packet type valid data, packet length valid data and read / write valid flag; Determine whether the packet type, packet data length, and packet configuration operation meet the preset vulnerability combination judgment criteria, where the vulnerability combination judgment criteria are that the packet type is data packet type 1, the packet data length is greater than 1, and the packet configuration operation is a write operation; If the packet type, packet data length, and packet configuration operation do not meet the vulnerability combination judgment criteria, the register data is transmitted to the subsequent circuit; If the packet type, packet data length, and packet configuration operation meet the vulnerability combination judgment criteria, a vulnerability warning will be triggered, completing the data parsing and bitstream configuration to prevent the Starbleed vulnerability attack; The method of performing bit-domain data parsing on register data using a pre-built packet type parsing circuit module to obtain bit-domain parsed data includes: Identifying a configuration application scenario of the configuration bitstream; Selecting a target selector circuit from the multi-stage selector circuits of the pre-built packet type parsing circuit module according to the configuration application scenario; Using the target selector circuit, the register data is input into the combinational gate circuit in the packet type analysis circuit and bit field bit value comparison is performed to obtain bit field analysis data; After triggering the vulnerability warning, the method further includes: triggering a lock signal based on the vulnerability warning; The state machine is locked in the IDLE state according to the lock signal, and a configuration stop operation is performed, wherein the configuration stop operation includes: stopping the subsequent circuit configuration, stopping the write operation of the configuration WBSTAR register, and stopping the read operation of the configuration WBSTAR register.

2. The data parsing and bitstream configuration method for preventing Starbleed vulnerability attacks according to claim 1, wherein: The configuration application scenarios include: JTAG interface input data configuration application scenario, SPI interface input data configuration application scenario, BPI interface input data configuration application scenario, SMAP interface input data configuration application scenario, SRL interface input data configuration application scenario, and ICAP interface input data configuration application scenario.

3. The data parsing and bitstream configuration method for preventing Starbleed vulnerability attacks according to claim 1, wherein: After performing bit-domain data parsing on register data using the pre-built packet type parsing circuit module to obtain bit-domain parsed data, the method further includes: Input the packet type valid data and packet length valid data into the pre-built packet length counter module.

4. The data parsing and bitstream configuration method for preventing Starbleed vulnerability attacks according to claim 3, wherein: After inputting the packet type valid data and the packet length valid data into the pre-built packet length counter module, the method further includes: The packet type valid data, the packet length valid data, and the read / write valid flag are input into a pre-built packet read / write control circuit module, which contains a state machine.

5. The data parsing and bitstream configuration method for preventing Starbleed vulnerability attacks according to claim 4, wherein: After inputting the packet type valid data, the packet length valid data, and the read / write valid flag into the pre-built packet read / write control circuit module, the method further includes: Input the packet type valid data, packet length valid data, read and write valid flag, and register address valid data into the pre-built Starbleed detection circuit module.

6. The data parsing and bitstream configuration method for preventing Starbleed vulnerability attacks according to claim 5, characterized in that: The determining whether the state machine in the pre-built packet read / write control circuit module is in a preset IDLE state includes: If the state machine is in a preset WDC state, when receiving a preset type 2 data packet, it jumps to a preset WRPD state and determines whether the packet length counter module generates a preset packet counting end flag, wherein the WDC state indicates that the read / write valid flag is a write operation, the packet type corresponding to the packet type valid data is data packet type 1, and the packet data length corresponding to the packet length valid data is 0; the WRPD state indicates that the packet read / write control circuit module has received valid register address data, the type 2 data packet corresponding to the WBSTAR register address is being transmitted, and the read / write valid flag is a write operation; When the packet length counter module generates a packet counting end flag, the state machine is in the IDLE state; If the state machine is in the preset RDC state, when receiving a type 2 data packet, it jumps to the preset RDPD state and determines whether the packet length counter module generates a packet counting end flag, wherein the RDC state refers to the read-write valid flag being a read operation, the packet type corresponding to the packet type valid data is data packet type 2, and the packet data length corresponding to the packet length valid data is 0; the RDPD state refers to the packet read-write control circuit module having received valid register address data, the type 2 data packet corresponding to the WBSTAR register address being transmitted, and the read-write valid flag being a read operation; When the packet length counter module generates a packet counting end flag, the state machine is in the IDLE state.

7. The data parsing and bitstream configuration method for preventing Starbleed vulnerability attacks according to claim 6, wherein: The determining whether the packet length counter module generates a preset packet counting end flag includes: Identifying the packet data length of the type 2 data packet; Counting down the packet data length of the type 2 data packet using a preset 27-bit width to obtain a decrement count value; Determine whether the decrement count value is equal to 0; If the decrement count value is not equal to 0, the packet length counter module does not generate a packet counting end flag; If the decrement count value is equal to 0, the packet length counter module generates a packet counting end flag.

8. A system for implementing the data parsing and bitstream configuration method for preventing Starbleed vulnerability attacks as claimed in claim 1, characterized in that: The system comprises: The current register address judgment module is used to obtain register data in the configuration bit stream, perform bit-domain data parsing on the register data using a pre-built packet type parsing circuit module, and obtain bit-domain parsed data, wherein the bit-domain parsed data includes: packet type valid data, packet length valid data, read / write valid flag, and register address valid data; identify the current register address based on the register address valid data; determine whether the current register address is a preset WBSTAR register address; if the current register address is not a WBSTAR register address, transmit the register data to a subsequent circuit; An IDLE state judgment module is used to judge whether the state machine in the pre-built packet read and write control circuit module is in the preset IDLE state if the current register address is the WBSTAR register address; if the state machine in the packet read and write control circuit module is not in the IDLE state, the register data is transmitted to the subsequent circuit; a vulnerability combination determination standard determination module, configured to, if the state machine in the packet read / write control circuit module is in the IDLE state, determine the packet type, packet data length, and packet configuration operation based on the packet type valid data, packet length valid data, and read / write valid flag; and determine whether the packet type, packet data length, and packet configuration operation meet a preset vulnerability combination determination standard, wherein the vulnerability combination determination standard refers to the packet type being data packet type 1, the packet data length being greater than 1, and the packet configuration operation being a write operation; and if the packet type, packet data length, and packet configuration operation do not meet the vulnerability combination determination standard, then transmit the register data to a subsequent circuit; The vulnerability warning module is triggered to trigger a vulnerability warning if the packet type, packet data length and packet configuration operation meet the vulnerability combination judgment criteria.

Images