Chip storage control method and device

Abstract

The invention provides a chip storage control method and device, electronic equipment, a chip and a medium, and relates to the technical field of electronic fuses. The method comprises the steps that in response to a first instruction of a central processing unit, a target instruction for a target memory is determined, and the first instruction is an operation instruction of the central processing unit on target data; and mapping the first address sequence of the target data into a second address sequence through a confusion algorithm according to the target instruction, and programming the target data to the target memory by using the second address sequence, or determining the first address sequence according to the target instruction to complete reading of the target memory. Through the technical scheme provided by the invention, the problems of safety and reliability of the efuse device on the SoC are solved, and the storage safety and reliability of the efuse device are improved.

Description

Technical Field

[0001] The present disclosure relates to the technical field of electronic fuses, and particularly to a chip storage control method, apparatus, electronic device, chip and medium. Background Art

[0002] An electronic fuse (efuse) is a programmable electronic fuse, which is a non-volatile storage device used to store information and protect a chip. Based on electron injection and thermal effects, once the efuse is blown, it cannot be programmed again. Based on this characteristic of the efuse, it is used in the security protection of storing information. Since the principle of the efuse is to program the key into the device by blowing a metal or polymer, visible traces will be left, and its stored content can be observed through a microscope. Especially in the field of System on Chip (SoC), the efuse is used to store important information. Once the information stored in the efuse is identified or damaged, it will bring great risks to the security of the SoC and affect its security and reliability. Summary of the Invention

[0003] The present disclosure provides a chip storage control method, apparatus, electronic device, chip and medium, so as to solve the problems of security and reliability of the efuse device for the SoC. By using a confusion algorithm in the efusec to re-establish the mapping relationship between the CPU address of the data to be processed and the storage address in the efuse, the security and reliability of the efuse device storage are improved.

[0004] In a first aspect embodiment of the present disclosure, a chip storage control method is proposed, and the method includes:

[0005] In response to a first instruction of a processor, determine a target instruction for a target memory, where the first instruction is an operation instruction of the processor on target data;

[0006] When the target instruction is a first type of instruction, map a first address sequence of the target data to a second address sequence, and use the second address sequence to burn the target data into the target memory, where the first address sequence is the register address sequence of the target data in the processor.

[0007] In an embodiment of the present disclosure, the method further includes:

[0008] When the target instruction is a second type of instruction, determine the first address sequence, and read the target data from the target memory according to the first address sequence.

[0009] In one embodiment of the present disclosure, when the target instruction is a first type of instruction, mapping the first address sequence of the target data to a second address sequence, and using the second address sequence to burn the target data into the target memory, including:

[0010] Obtain the first address sequence according to the first type of instruction;

[0011] Determine the second address sequence through a first mapping relationship based on a preset confusion factor and the first address sequence;

[0012] Burn the target data into the target memory according to the second address sequence.

[0013] In one embodiment of the present disclosure, when the target instruction is a second type of instruction, determine the first address sequence, and read the target data from the target memory according to the first address sequence, including:

[0014] Read the second address sequence;

[0015] Map the second address sequence to the first address sequence through a second mapping relationship based on a preset confusion factor and the second address sequence.

[0016] In one embodiment of the present disclosure, after mapping the second address sequence to the first address sequence through the second mapping relationship based on the preset confusion factor and the second address sequence, further including:

[0017] Return the first address sequence to the processor.

[0018] In one embodiment of the present disclosure, before burning the target data into the target memory according to the second address sequence, further including:

[0019] Turn on the write power switch of the target memory.

[0020] In one embodiment of the present disclosure, reading the second address sequence includes:

[0021] Traverse and read the second address sequence;

[0022] In response to the completion of reading the second address sequence, store the second address sequence in the cache unit, the read-write attribute of the cache unit is read-only, and a preset confusion factor is also stored in the cache unit.

[0023] In one embodiment of the present disclosure, reading the second address sequence further includes:

[0024] In response to the reset instruction, load the second address sequence into the cache unit.

[0025] A second aspect embodiment of the present disclosure proposes a chip storage control device, which includes a command interaction unit, a mode generation unit, a timing generation unit, a security function unit, an automatic cache unit, a device unit, and a power supply unit. Among them, the command interaction unit parses the first instruction of the processor into a target instruction, and the mode generation unit generates an enable signal for the timing generation unit in response to the target instruction, and the enable signal can enable the device unit to read and / or write target data; the security function unit responds to the target instruction and changes the mapping between the data register address in the processor and the actual storage address of the device unit.

[0026] In an embodiment of the present disclosure, the command interaction unit also supports storing the default timing parameters of the timing generation unit, the automatic cache unit is used to cache the target data in the device unit, and the power supply unit is used to receive the target instruction of the command interaction unit to power on the device unit.

[0027] A third aspect embodiment of the present disclosure proposes an electronic device, including: at least one processor; and a memory communicatively connected to the at least one processor; wherein, the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to execute the method of any one of the first aspect embodiments of the present disclosure.

[0028] A fourth aspect embodiment of the present disclosure proposes a non-transitory computer-readable storage medium storing computer instructions, wherein the computer instructions are used to cause a computer to execute the method of the first aspect embodiment of the present disclosure.

[0029] A fifth aspect embodiment of the present disclosure proposes a computer program product, characterized in that it includes a computer program, and the computer program implements the method of any one of the first aspect embodiments of the present disclosure when executed by a processor.

[0030] A sixth aspect embodiment of the present disclosure proposes a chip, including at least one processor and a communication interface; the communication interface is used to receive signals input to the chip or signals output from the chip, and the processor communicates with the communication interface and implements the method of any one of the first aspect embodiments of the present disclosure through logic circuits or by executing code instructions.

[0031] In summary, according to the chip storage control method proposed by the present disclosure, in response to a first instruction of a processor, a target instruction for a target memory is determined, where the first instruction is an operation instruction of the processor on target data, and a read / write operation on the efuse array is determined; when the target instruction is a first type of instruction, a first address sequence of the target data is mapped to a second address sequence, and the target data is programmed into the target memory by using the second address sequence, where the first address sequence is a register address sequence of the target data in the processor. Through this method, when programming the target data into the efuse array, the mapping relationship between the register address of the target data in the processor and the storage address in the efuse array is obfuscated, and a new mapping relationship is re-established, ensuring that the addresses of the data programmed into the efuse array are discontinuous addresses. Without adding additional complex algorithms, the anti-snooping security function is implemented. When the processor reads the data in the efuse array, the storage address in the efuse array is restored to the register address of the processor, facilitating the processor to process. The security and reliability of the efuse device storage are improved.

[0032] It should be understood that the above general description and the following detailed description are only exemplary and explanatory, and do not limit the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] The accompanying drawings herein are incorporated into the specification and constitute a part of this specification, showing embodiments consistent with the present disclosure, and are used together with the specification to explain the principles of the present disclosure and do not constitute an improper limitation of the present disclosure.

[0034] Figure 1 is an overhead view of an efuse under an electron microscope in the related art;

[0035] Figure 2 is a schematic diagram of a CPU controlling an efuse to perform IO read / write operations through an efusec in the related art;

[0036] Figure 3 is a flowchart of a chip storage control method according to an embodiment of the present disclosure;

[0037] Figure 4 is a flowchart of a chip storage control method according to an embodiment of the present disclosure;

[0038] Figure 5 is a flowchart of mapping a first address sequence of target data to a second address sequence and programming the target data into the target memory when the target instruction is a first type of instruction according to an embodiment of the present disclosure;

[0039] Figure 6Schematic diagram of the mapping relationship between the first address sequence and the second address sequence before executing the first mapping relationship according to an embodiment of the present disclosure;

[0040] Figure 7 Schematic diagram of the mapping relationship between the first address sequence and the second address sequence after executing the first mapping relationship according to an embodiment of the present disclosure;

[0041] Figure 8 Flowchart for determining the first address sequence and reading target data from the target memory according to the first address sequence when the target instruction is a second - type instruction according to an embodiment of the present disclosure;

[0042] Figure 9 Flowchart for returning the first address sequence according to an embodiment of the present disclosure;

[0043] Figure 10 Flowchart for turning on the programming power supply of the target memory according to an embodiment of the present disclosure;

[0044] Figure 11 Flowchart for reading the second address sequence according to an embodiment of the present disclosure;

[0045] Figure 12 Flowchart for reading the second address sequence according to an embodiment of the present disclosure;

[0046] Figure 13 Flowchart of a security storage control method for an efuse controller according to an embodiment of the present disclosure;

[0047] Figure 14 Schematic diagram of the composition of a security function unit of an efuse controller according to an embodiment of the present disclosure;

[0048] Figure 15 Schematic diagram of the mapping relationship between the address sequence of the target data in the CPU and the address sequence in the efuse array after being processed by the first mapping relationship according to an embodiment of the present disclosure;

[0049] Figure 16 Schematic diagram of the structure of a system - on - chip storage control device according to an embodiment of the present disclosure;

[0050] Figure 17 Block diagram of an electronic device for implementing the chip storage control method of the present disclosure according to an exemplary embodiment;

[0051] Figure 18 Schematic diagram of the structure of a chip according to an embodiment of the present disclosure. Detailed implementation manners

[0052] Embodiments of the present disclosure will be described in detail below. Examples of the embodiments are shown in the accompanying drawings, where like or similar reference numerals identify the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and are intended to explain the present disclosure and should not be construed as limiting the present disclosure.

[0053] First, a brief introduction to relevant terms in the present disclosure:

[0054] In modern SoC designs, efuse is a very important technology that can be used to protect sensitive information in the SoC, prevent hacker attacks, and unauthorized access.

[0055] efuse: It is a programmable memory used to store sensitive information in the SoC, such as keys, certificates, serial numbers, etc. Different from traditional memories, the programming of efuse is one-time and cannot be changed once programmed. This feature makes efuse very suitable for storing information that needs to be protected because it can prevent hackers from cracking the security of the SoC by modifying the data in the memory.

[0056] An efuse usually consists of two parts: a programmer and a fuse. The programmer is used to program data into the fuse, and the fuse is used to store data. When the programmer programs data into the fuse, it changes the physical structure in the fuse, making it unchangeable. Once the fuse is programmed, it will permanently store the data, and even if the SoC loses power, the data in the fuse will not be lost.

[0057] Electronic fuse controller (efusec): It is a controller that controls the read / write input / output (IO) of the efuse device.

[0058] Figure 1 It is an aerial view of an efuse under an electron microscope in the related art. As Figure 1 shown, the unprogrammed efuse on the left is in the normal state and stores binary "0". The efuse on the right is in the programmed state, and the middle is the blown fuse, which stores binary "1". Based on this principle of the efuse, data is stored by programming the efuse device.

[0059] Figure 2 It is a schematic diagram of a CPU controlling the efuse for IO read / write operations through the efusec in the related art. As Figure 2As shown in the figure, in the field of SoC chip security, the CPU can configure the efusec to implement the IO function of the CPU for programming and reading the efuse. At the same time, it has the function of automatically reading after reset, which can be read by the CPU for use.

[0060] In the related art, the content stored in the efuse is encrypted and protected, and the encrypted plaintext is stored in the efuse. The encryption key is solidified in the chip, and hardware decryption is performed after reading to ensure the confidentiality of the key. However, when decrypting on the chip side, corresponding algorithms need to be added, which brings design difficulties and affects the chip reliability. At the same time, it brings additional overhead of area and power consumption. At the same time, based on the storage principle of the efuse device, the stored information can be observed and recognized through a microscope. Especially for SoC, the efuse is used to store important information. Once the information stored in the efuse is recognized or damaged, it will bring great risks to the security of the SoC, affecting its security and reliability.

[0061] The method proposed in this disclosure is applied to the SoC storage control task, and its application has rich scenarios. For example, it can be used for the secure storage of the following information:

[0062] 1. Storing encryption keys: In many security applications, encryption keys are information that must be protected. Using the efuse can ensure that the keys cannot be accessed or modified by hackers.

[0063] 2. Storing serial numbers: Each SoC has a unique serial number used to identify the SoC. Using the efuse can ensure that the serial number cannot be modified or forged.

[0064] 3. Storing certificates: In security applications, certificates are used to verify the identity of the SoC. Using the efuse can ensure that the certificates cannot be attacked or modified by hackers.

[0065] 4. Storing configuration information: The efuse can also be used to store the configuration information of the SoC, such as CPU frequency, memory size, etc. These information can be read when the SoC starts up and changed as needed.

[0066] In actual scenarios, in the field of intelligent vehicles, it can be used for secure storage, firmware over-the-air (FOTA), security diagnosis, and secure operating environment. In the field of big data, it can be widely used to protect business privacy and data security. In the field of the Internet of Things, it can be used for the secure storage control of chips. The application scenarios are not limited in the embodiments of this disclosure.

[0067] The following will introduce the system-level chip storage control method provided by this disclosure in detail with reference to the accompanying drawings.

[0068] Figure 3 This is a flowchart of a chip storage control method according to an embodiment of the present disclosure. As Figure 1 shown in the embodiment, the chip storage control method includes:

[0069] Step 301, in response to a first instruction of a processor, determine a target instruction for a target memory, where the first instruction is an operation instruction of the processor on target data.

[0070] In this embodiment, the first instruction refers to a set of instruction sets of the processor, which is an instruction for operating on target data, such as performing 5 writes and 4 reads. In the present disclosure, the target memory is an electronic fuse array, which is a storage device composed of a large number of efuse devices. The target instruction refers to an instruction for performing read / write operations on the electronic fuse array. The target data is data that needs to be saved to the efuse array, such as encrypted keys, serial numbers of the SoC, storage certificates, configuration information of the SoC, and other data. The embodiment of the present disclosure is executed by an electronic fuse controller efusec. After receiving the first instruction of the processor, the efusec parses the first instruction to determine whether it contains an instruction that can be parsed as a target instruction. If the first instruction can be parsed as a target instruction, the security storage control method of the SoC is triggered.

[0071] Step 302, when the target instruction is a first type of instruction, map a first address sequence of the target data to a second address sequence, and use the second address sequence to burn the target data into the target memory, where the first address sequence is a register address sequence of the target data in the processor.

[0072] In this embodiment, the first type of instruction refers to an instruction for the efusec to perform a write operation on the target memory. The first address sequence refers to a register address sequence of the target data in the processor, which corresponds to the address of the target data in the register of the processor. The second address sequence refers to an address sequence of the target data in the efuse array, and the second address sequence is allocated by the efusec. If the target instruction parsed by the efusec is a write instruction, the first address sequence of the target data is mapped to the second address sequence, and the target data is burned into the efuse array for storage using the second address sequence. Alternatively, if the target instruction parsed by the efusec is a read instruction, the second address sequence is decrypted to obtain the first address sequence for the processor to read the target data.

[0073] In summary, according to the system-level chip storage control method proposed in the present disclosure, in response to a first instruction of a processor, a target instruction for a target memory is determined, where the first instruction is an operation instruction of the processor on target data, and a read / write operation on the efuse array is determined; when the target instruction is a first type of instruction, a first address sequence of the target data is mapped to a second address sequence, and the target data is programmed into the target memory by using the second address sequence, where the first address sequence is the register address sequence of the target data in the processor. Through this method, when programming the target data into the efuse array, the mapping relationship between the register address of the target data in the processor and the storage address in the efuse array is obfuscated, and a new mapping relationship is re-established, ensuring that the addresses of the data programmed into the efuse array are discontinuous addresses. Without adding additional complex algorithms, the anti-snooping security function is implemented, and the security and reliability of the efuse device storage are improved.

[0074] Figure 4 is a flowchart of a chip storage control method according to an embodiment of the present disclosure. Based on Figure 4 the embodiments shown, the following steps are included:

[0075] Step 401, when the target instruction is a second type of instruction, determine the first address sequence, and read the target data from the target memory according to the first address sequence.

[0076] In this embodiment, the second type of instruction refers to an instruction for the efusec to read the target memory. When the target instruction is a second type of instruction, that is, if the target instruction parsed by the efusec is a read instruction, the first address sequence of the target data is obtained for the processor to read the target data.

[0077] Figure 5 is a flowchart of mapping a first address sequence of target data to a second address sequence and programming the target data into the target memory when the target instruction is a first type of instruction according to an embodiment of the present disclosure. Figure 5 is a further description of Figure 3 step 102, based on Figure 5 the embodiments shown, the following steps are included:

[0078] Step 501, obtain the first address sequence according to the first type of instruction.

[0079] In this embodiment, the efusec obtains the register address in the CPU that stores the target data according to the write instruction for the efuse array in the target instruction, that is, the first address sequence.

[0080] Step 502, determine the second address sequence based on a preset obfuscation factor and the first address sequence through a first mapping relationship.

[0081] In this embodiment, the first mapping relationship is a method for mapping a first address sequence to a second address sequence, which is used to encrypt target data. The preset confusion factor is a conversion parameter for mapping the first address sequence to the second address sequence, which can be a matrix, a vector, or a list or an array. Through the first mapping relationship, the first address sequence can be converted into the second address sequence by the preset confusion factor. The first mapping relationship can be operations such as logical operations, matrix operations, and non - linear equations. The following are two specific implementation manners of the first mapping relationship, and the present disclosure does not limit the first mapping relationship.

[0082] In one implementation manner of this embodiment, the vector x is the first address sequence, the matrix A is the confusion factor, and the matrix A is an invertible matrix. The vector y is the second address sequence. Through the first mapping relationship y = Ax, the storage address information of the first address sequence mapped to the second address sequence can be obtained.

[0083] In one implementation manner of this embodiment, the vector x is the first address sequence, the vector k is the confusion factor, and the vector y is the second address sequence. Through the first mapping relationship y = x ⊕ k, that is, the exclusive - OR operation between x and k, the storage address information of the first address sequence mapped to the second address sequence can be determined.

[0084] Step 503: Burn the target data into the target memory according to the second address sequence.

[0085] In this embodiment, according to the second address sequence determined in the above steps, the target data is burned into the efuse array. That is, according to the address information specified in the second address sequence in the efuse array, the target data is stored in the specified address.

[0086] Figure 6 It is a schematic diagram of the mapping relationship between the first address sequence and the second address sequence before executing the first mapping relationship in an embodiment of the present disclosure. As Figure 6 shown, the CPU address 0 of the target data in the CPU corresponds to the efuse address 0 in the efuse array, the CPU address 1 corresponds to the efuse address 1, ……, the CPU address n - 1 corresponds to the efuse address n - 1, and the CPU address n corresponds to the efuse address n. That is, the register addresses of the target data in the CPU are consecutive addresses, and they are also stored as consecutive addresses in the efuse array and are in one - to - one correspondence.

[0087] Figure 7 It is a schematic diagram of the mapping relationship between the first address sequence and the second address sequence after executing the first mapping relationship in an embodiment of the present disclosure. As Figure 6As shown, after processing the first address sequence with the first mapping relationship, the CPU address 1 of the target data in the CPU corresponds to the efuse address n in the efuse array, and the CPU address n corresponds to the efuse address 1. Obviously, after executing the first mapping relationship, the corresponding relationship between the first address sequence and the second address sequence is disrupted, and the data in the second address is not stored continuously in the efuse array, improving the security and reliability of the target data in the SoC.

[0088] In this embodiment, the efusec determines the actual address to be stored in the efuse array, that is, the second address sequence, according to the instruction of the CPU to write data into the efuse array, using the confusion factor and the first address sequence through the confusion algorithm. Through Figure 6 and Figure 7 comparison, a secure and reliable second address sequence can be clearly obtained, ensuring that the target data can be securely and reliably stored in the efuse array without being snooped.

[0089] Figure 8 It is a flowchart for determining the first address sequence and reading the target data from the target memory according to the first address sequence when the target instruction is the second type of instruction in an embodiment of the present disclosure. Figure 8 It is a further description of step 401 of Figure 4 Based on the embodiment shown in Figure 8 includes the following steps:

[0090] Step 801, read the second address sequence.

[0091] In this embodiment, the efusec reads the second address sequence storing the target data from the efuse array.

[0092] Step 802, based on the preset confusion factor and the second address sequence, map the second address sequence to the first address sequence through the second mapping relationship.

[0093] In this embodiment, the second mapping relationship is a method for mapping the second address sequence to the first address sequence. The second mapping relationship corresponds one-to-one with the first mapping relationship and is used to decrypt the target data. According to the preset confusion factor and the read second address sequence, the second address sequence can be mapped to the first address sequence through the second mapping relationship.

[0094] In an implementation manner of this embodiment, the preset confusion factor is matrix A, the second address sequence is y, and the first address sequence x = A -1 y can be obtained through the second mapping relationship.

[0095] In this embodiment, according to the read instruction in the target instruction, the first address sequence is determined through the second mapping relationship, realizing the restoration of the second address sequence in the efuse array to the first address sequence that can be directly processed by the processor. Without adding redundant decryption algorithms, secure and efficient data reading is achieved.

[0096] Figure 9 It is a flowchart for returning the first address sequence according to an embodiment of the present disclosure. Figure 9 It is a specific description after step 802 of Figure 8 Based on the embodiment shown in Figure 9 it includes the following steps:

[0097] Step 901: Return the first address sequence to the processor.

[0098] In this embodiment, after determining the first address sequence through the second mapping relationship according to the target instruction, the efusec obtains the register address that can be directly used by the processor, and then returns the first address sequence to the processor to ensure that the processor can correctly read the target data in the efuse array.

[0099] Figure 10 It is a flowchart for turning on the programming power supply of the target memory according to an embodiment of the present disclosure. Figure 10 It is a specific description before step 503 of Figure 5 Based on the embodiment shown in Figure 10 it includes the following steps:

[0100] Step 1001: Turn on the programming power supply switch of the target memory.

[0101] In this embodiment, before programming the target data into the electronic fuse array according to the second address sequence, it is necessary to turn on the programming power supply switch of the electronic fuse array. Since the efuse device is fused by a high current to change its structure for storing information, before programming the efuse array, turn on the programming power supply switch of the efuse array to ensure that the efuse array can complete the programming according to the current or voltage controlled by the timing signal.

[0102] Figure 11 It is a flowchart for reading the second address sequence according to an embodiment of the present disclosure. Figure 11 It is a specific description of step 801 of Figure 8 Based on the embodiment shown in Figure 11 it includes the following steps:

[0103] Step 1101: Traverse and read the second address sequence.

[0104] In this embodiment, efusec traverses and reads the second address sequence to complete the reading of the second address sequence.

[0105] Step 1102: In response to the completion of the reading of the second address sequence, store the second address sequence in the cache unit. The read / write attribute of the cache unit is read-only, and a preset confusion factor is also stored in the cache unit.

[0106] In this embodiment, the cache unit refers to a memory for caching the second address sequence and the preset confusion factor between the efuse array and efusec, such as storage devices like ROM, EMMC, Flash, etc., or it can also refer to a dedicated storage space in RAM for caching the second address sequence and the preset confusion factor. After confirming that the second address sequence has been read, store the second address sequence in the cache unit, and the read / write attribute of this cache unit is read-only.

[0107] In this embodiment, setting the read-only attribute of the cache unit can prevent the data returned to the processor from being tampered with, including the second address sequence and the preset confusion factor. The cache unit can improve the reading speed of efusec for the second address sequence and the preset confusion factor. At the same time, due to the limitations of the physical properties of the efuse array, its programming times are limited and it is difficult to have the programming times of other non-volatile storage media. Therefore, the service life of the efuse array can be greatly improved through the cache unit.

[0108] Figure 12 It is a flowchart of a method for reading the second address sequence according to an embodiment of the present disclosure. Figure 12 It is a specific description of Figure 11 step 1101, based on the embodiment shown in Figure 12 includes the following steps:

[0109] Step 1201: In response to the reset instruction, load the second address sequence into the cache unit.

[0110] In this embodiment, when receiving the reset instruction of the SoC and initializing the SoC, load the second address sequence of the efuse array into the cache unit. Thus, the address of the target data in the efuse array is reserved in the cache unit in a timely manner, which is convenient for efusec to quickly access the second address sequence and helps to improve the service life of the efuse array.

[0111] Figure 13 It is a flowchart of a secure storage control method for an efuse controller according to an embodiment of the present disclosure. In this embodiment, based on Figure 13As shown in the figure, the efuse controller controls the programming and reading of the efuse by receiving instructions from the central processing unit (CPU). The efuse controller includes seven units: a command interaction unit 1, a mode generation unit 2, a timing generation unit 3, a security function unit 4, an automatic cache unit 5, a device unit 6, and a power supply unit 7.

[0112] Command interaction unit 1: It is the interaction unit with the CPU. The efusec is a sub-module of the SoC and communicates with the CPU using the Advanced Peripheral Bus (APB). It can also communicate through peripheral buses such as the Serial Peripheral Interface (SPI) and Universal Asynchronous Receiver / Transmitter (UART), or other on-chip buses. It parses the bus and resolves it into configuration signals required by the efusec controller, which act on the security function unit 4 and the mode generation unit 2 respectively. At the same time, it stores the default timing parameters for the timing generation unit 3. When the default parameters do not meet the device timing, it supports online updating to control the power supply switch of the voltage regulator power switch (VQPS) for efuse programming.

[0113] Mode generation unit 2: According to the mode commands parsed by the command interaction unit 1, the mode generation unit 2 generates the mode enable signals required by the timing generation unit 3, supporting all mode enables of the device unit 6, including: shutdown, standby, array programming, array reading. The control enables of each mode are implemented using a state machine. Only one mode is supported to take effect at the same time, and it also supports an anti-misconfiguration function, that is, when the current mode has not ended, the newly configured mode will not take effect.

[0114] Timing generation unit 3: This unit generates the interface timing of the efuse device unit 6 and generates the interface timing of the specific working mode of the device unit 6 according to the address configuration of the command interaction unit 1 and the working mode indicated by the mode generation unit 2.

[0115] Security function unit 4: Changes the mapping between the CPU address and the actual efuse address, and obfuscates the addresses for programming and reading.

[0116] Figure 14 It is a schematic diagram of the composition of the security function unit of an efuse controller according to an embodiment of the present disclosure. As Figure 14 shown, the security function unit 4 includes an obfuscation factor 4-0, a CPU address configuration unit 4-1, and an efuse actual address unit 4-2.

[0117] The selection principle of the first mapping relationship is as follows:

[0118] 1. From the perspective of the command interaction unit 1, the input and output are the same, which does not affect the read and write addresses. The addresses mapped to the efuse are different from the input and output.

[0119] 2. The addresses of the command interaction unit 1 and the efuse are in one-to-one correspondence.

[0120] Adopting this mapping relationship has no impact on the CPU, but the continuous segments stored in the efuse are scrambled, greatly increasing the difficulty of obtaining the key through snooping.

[0121] Figure 15 The following is a schematic diagram of the mapping relationship between the address sequence of the target data in the CPU and the address sequence in the efuse array after being processed by the first mapping relationship in an embodiment of the present disclosure. As Figure 15 shown, after being scrambled, the mapping relationship between the CPU configuration address and the real address in the efuse array shuffles the order of the data stored in the continuous efuse address space. For example, CPU_ADDR_0 does not correspond to efuse_ADDR_0, but to efuse_ADDR_n; CPU_ADDR_n does not correspond to efuse_ADDR_n, but to efuse_ADDR_1. This re-established mapping relationship plays a role in security protection, preventing continuous key segments from being snooped and avoiding threats to the security and reliability of the SoC.

[0122] Automatic cache unit 5: The automatic cache generates the address and mode control for the efusec automatic read, which acts on the mode generation unit 3 and the timing generation unit 3, traverses and reads the addresses of the device unit 6, and sends out the load done flag after the reading is completed. The stored information of the device unit 6 is uniformly distributed to other subsystems of the SoC after load done. The data read from the unit 6 is cached in the buffer of the automatic cache unit 5. The buffer can be a Random Access Memory (RAM) or a register array. Moreover, the buffer has a read-only attribute. When the SoC system reset is released, the efuse data is automatically loaded. The newly burned data is loaded into the buffer after the reset again. The content of the buffer is divided into two parts. One part stores the scrambling factors of the storage security function unit 4 for the security unit of the efusec, and the other scrambling factors are stored in the device unit 6. From a security perspective, the scrambling factors of each chip are different; the other part stores the burned content of the normal CPU for the CPU to read.

[0123] Device unit 6: efuse array, supporting basic operating modes such as shutdown, standby, array programming, and array reading, with capacity sizes of 1KB, 2KB, 4KB, and 8KB supported. The efusec of the present disclosure adopts a parametric design and supports all capacity specifications. The timing generation unit 3 adapts to the IO interfaces of efuse devices from different manufacturers.

[0124] Power supply unit 7: When programming the efuse array, the power supply unit 7 is turned on, and the switch of the programming power supply is controlled by the command interaction unit 1.

[0125] Through a secure storage control method of an efuse controller according to an embodiment of the present disclosure, secure storage control of the data stored in the efuse array by the efusec is achieved, improving the security and reliability of the storage of the efuse device.

[0126] The present disclosure provides a chip storage control method. In response to a first instruction of a processor, a target instruction for a target memory is determined, where the first instruction is an operation instruction of the processor on target data, and a read / write operation on the efuse array is determined; when the target instruction is a first type of instruction, a first address sequence of the target data is mapped to a second address sequence, and using the second address sequence, the target data is programmed into the target memory, where the first address sequence is the register address sequence of the target data in the processor. Through this method, when programming the target data into the efuse array, the mapping relationship between the register address of the target data in the processor and the storage address in the efuse array is scrambled, and a new mapping relationship is re-established, ensuring that the addresses of the data programmed into the efuse array are discontinuous addresses. Without adding an additional complex algorithm, a snooping prevention security function is achieved. When the processor reads the data in the efuse array, the storage address in the efuse array is restored to the register address of the processor, facilitating the processing by the processor. The security and reliability of the storage of the efuse device are improved.

[0127] Corresponding to the methods provided in the above several embodiments, the present disclosure also provides a chip storage control device. Since the device provided in the embodiment of the present disclosure corresponds to the methods provided in the above several embodiments, the implementation manners of the methods are also applicable to the device provided in this embodiment and will not be described in detail in this embodiment.

[0128] Figure 16 It is a schematic structural diagram of a chip storage control device 1600 according to an embodiment of the present disclosure. As Figure 16As shown in the figure, the chip storage control device includes: a command interaction unit, a mode generation unit, a timing generation unit, a security function unit, an automatic cache unit, a device unit, and a power supply unit. Among them, the command interaction unit parses the first instruction of the processor into a target instruction. The mode generation unit responds to the target instruction and generates an enable signal for the timing generation unit. The enable signal can enable the device unit to read and / or write target data. The security function unit responds to the target instruction and changes the mapping between the data register address in the processor and the actual storage address of the device unit.

[0129] In an embodiment of the present disclosure, the command interaction unit also supports storing the default timing parameters of the timing generation unit. The automatic cache unit is used to cache the target data in the device unit. The power supply unit is used to receive the target instruction of the command interaction unit to power on the device unit.

[0130] In summary, through the chip storage control device, in response to the first instruction of the processor, a target instruction for the target memory is determined, where the first instruction is an operation instruction of the processor on the target data, and the read and write operations on the efuse array are determined; when the target instruction is a first type of instruction, the first address sequence of the target data is mapped to a second address sequence, and the target data is programmed into the target memory using the second address sequence, where the first address sequence is the register address sequence of the target data in the processor. Through this method, when programming the target data into the efuse array, the mapping relationship between the register address of the target data in the processor and the storage address in the efuse array is obfuscated, and a new mapping relationship is re-established, ensuring that the addresses of the data programmed into the efuse array are discontinuous addresses. Without adding additional complex algorithms, the anti-snooping security function is realized. When the processor reads the data in the efuse array, the storage address in the efuse array is restored to the register address of the processor, which is convenient for the processor to process. This device solves the problems of security and reliability of the efuse device for the SoC, and improves the security and reliability of the efuse device storage.

[0131] In the above embodiments provided by the present disclosure, the methods and devices provided by the embodiments of the present disclosure are introduced. In order to implement the various functions in the methods provided by the above embodiments of the present disclosure, an electronic device may include a hardware structure, software modules, and implement the above various functions in the form of a hardware structure, software modules, or a combination of a hardware structure and software modules. A certain function among the above various functions may be executed in the form of a hardware structure, software module, or a combination of a hardware structure and software module.

[0132] Figure 17 It is a block diagram of an electronic device 1700 for implementing the above system-level chip storage control method shown according to an exemplary embodiment.

[0133] For example, the electronic device 1700 can be a mobile phone, a computer, a messaging device, a game console, a tablet device, a medical device, a fitness device, a personal digital assistant, etc.

[0134] Referring Figure 17 , the electronic device 1700 may include one or more of the following components: a processing component 1702, a memory 1704, a power supply component 1706, a multimedia component 1708, an audio component 1710, an input / output (I / O) interface 1712, a sensor component 1714, and a communication component 1717.

[0135] The processing component 1702 generally controls the overall operation of the electronic device 1700, such as operations associated with display, telephone calls, data communication, camera operations, and recording operations. The processing component 1702 may include one or more processors 1720 to execute instructions to complete all or part of the steps of the above methods. In addition, the processing component 1702 may include one or more modules to facilitate the interaction between the processing component 1702 and other components. For example, the processing component 1702 may include a multimedia module to facilitate the interaction between the multimedia component 1708 and the processing component 1702.

[0136] The memory 1704 is configured to store various types of data to support the operation of the electronic device 600. Examples of these data include instructions for any application or method operating on the electronic device 1700, contact data, phone book data, messages, pictures, videos, etc. The memory 1704 can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, a magnetic disk, or an optical disk.

[0137] The power supply component 1706 provides power to various components of the electronic device 1700. The power supply component 1706 may include a power management system, one or more power supplies, and other components associated with generating, managing, and distributing power for the electronic device 1700.

[0138] The multimedia component 1708 includes a screen that provides an output interface between the electronic device 1700 and the user. In some embodiments, the screen may include a liquid crystal display (LCD) and a touch panel (TP). If the screen includes a touch panel, the screen can be implemented as a touch screen to receive input signals from the user. The touch panel includes one or more touch sensors to sense touches, swipes, and gestures on the touch panel. The touch sensors can sense not only the boundaries of touch or swipe actions but also detect the duration and pressure associated with the touch or swipe operations. In some embodiments, the multimedia component 1708 includes a front camera and / or a rear camera. When the electronic device 1700 is in an operating mode, such as a shooting mode or a video mode, the front camera and / or the rear camera can receive external multimedia data. Each of the front camera and the rear camera can be a fixed optical lens system or have a focal length and optical zoom capabilities.

[0139] The audio component 1710 is configured to output and / or input audio signals. For example, the audio component 1710 includes a microphone (MIC) that is configured to receive external audio signals when the electronic device 1700 is in an operating mode, such as a call mode, a recording mode, and a voice recognition mode. The received audio signals can be further stored in the memory 1704 or transmitted via the communication component 1717. In some embodiments, the audio component 1710 further includes a speaker for outputting audio signals.

[0140] The I / O interface 1712 provides an interface between the processing component 1702 and a peripheral interface module, and the peripheral interface module can be a keyboard, a click wheel, buttons, etc. These buttons can include but are not limited to: a home button, a volume button, a power button, and a lock button.

[0141] The sensor component 1714 includes one or more sensors for providing an assessment of the state of various aspects of the electronic device 1700. For example, the sensor component 1714 can detect the on / off state of the electronic device 1700, the relative positioning of components, such as the display and the keypad of the electronic device 1700. The sensor component 1714 can also detect a change in the position of the electronic device 1700 or a component of the electronic device 1700, the presence or absence of user contact with the electronic device 1700, the orientation or acceleration / deceleration of the electronic device 1700, and a change in the temperature of the electronic device 1700. The sensor component 1714 can include a proximity sensor that is configured to detect the presence of nearby objects without any physical contact. The sensor component 1714 can also include a light sensor, such as a CMOS or a CCD image sensor, for use in imaging applications. In some embodiments, the sensor component 1714 can further include an acceleration sensor, a gyro sensor, a magnetic sensor, a pressure sensor, or a temperature sensor.

[0142] The communication component 1717 is configured to facilitate communication between the electronic device 1700 and other devices in a wired or wireless manner. The electronic device 1700 may access a wireless network based on a communication standard, such as WiFi, 2G or 3G, 4G LTE, 6G NR (New Radio), or a combination thereof. In an exemplary embodiment, the communication component 1717 receives a broadcast signal or broadcast-related information from an external broadcast management system via a broadcast channel. In an exemplary embodiment, the communication component 1717 further includes a Near Field Communication (NFC) module to facilitate short-range communication. For example, the NFC module may be implemented based on Radio Frequency Identification (RFID) technology, Infrared Data Association (IrDA) technology, Ultra Wideband (UWB) technology, Bluetooth (BT) technology, and other technologies.

[0143] In an exemplary embodiment, the electronic device 1700 may be implemented by one or more Application Specific Integrated Circuits (ASICs), Digital Signal Processors (DSPs), Digital Signal Processing Devices (DSPDs), Programmable Logic Devices (PLDs), Field Programmable Gate Arrays (FPGAs), controllers, microcontrollers, microprocessors, or other electronic components for performing the above method.

[0144] In an exemplary embodiment, a non-transitory computer-readable storage medium including instructions is also provided, such as a memory 1704 including instructions, and the above instructions may be executed by a processor 1720 of the electronic device 1700 to complete the above method. For example, the non-transitory computer-readable storage medium may be a ROM, Random Access Memory (RAM), CD-ROM, magnetic tape, floppy disk, and optical data storage device, etc.

[0145] Embodiments of the present disclosure also propose a non-transitory computer-readable storage medium storing computer instructions, wherein the computer instructions are used to cause a computer to execute the system-level chip storage control method described in the above embodiments of the present disclosure.

[0146] Embodiments of the present disclosure also propose a computer program product, including a computer program, and the computer program executes the system-level chip storage control method described in the above embodiments of the present disclosure when being executed by a processor.

[0147] Figure 18 FIG. 1800 is a schematic structural diagram of a chip for implementing the above system-level chip storage control method according to an exemplary embodiment.

[0148] Refer to Figure 18, the chip 1800 includes at least one communication interface 1801 and a processor 1802; the communication interface 1801 is configured to receive signals input to the chip 1800 or signals output from the chip 1800, and the processor 1802 communicates with the communication interface 1801 and implements the system-level chip storage control method described in the above embodiments through logic circuits or by executing code instructions.

[0149] It should be noted that the terms "first", "second", etc. in the specification and claims of the present disclosure and the above drawings are used to distinguish similar objects, and do not necessarily have to be used to describe a specific order or sequence. It should be understood that such data may be interchanged under appropriate circumstances so that the embodiments of the present disclosure described herein can be implemented in an order other than those illustrated or described herein. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present disclosure. On the contrary, they are merely examples of devices and methods consistent with some aspects of the present disclosure as detailed in the appended claims.

[0150] In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "schematic embodiments", "examples", "specific examples" or "some examples", etc. means that the specific features, structures, materials or characteristics described in connection with the embodiment or example are included in at least one embodiment or example of the present disclosure. In this specification, the schematic expressions of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described can be combined in any one or more embodiments or examples in a suitable manner.

[0151] Any process or method description in the flowchart or described in other ways herein can be understood as representing a module, segment or part of code including one or more executable instructions for implementing a specific logical function or process, and the scope of the preferred embodiments of the present disclosure includes additional implementations, where the functions may be executed in a manner other than shown or discussed, including in a substantially simultaneous manner according to the functions involved or in a reverse order, which should be understood by those skilled in the art to which the embodiments of the present disclosure belong.

[0152] The logic and / or steps represented in the flowchart or otherwise described herein can, for example, be considered as a definable sequence list of executable instructions for implementing logical functions, and can be specifically implemented in any computer-readable medium for use by an instruction execution system, apparatus, or device (such as a computer-based system, a system including a processing module, or other systems that can fetch and execute instructions from the instruction execution system, apparatus, or device), or in conjunction with these instruction execution systems, apparatuses, or devices. For the purposes of this specification, a "computer-readable medium" can be any device that can contain, store, communicate, propagate, or transport a program for use by or in conjunction with an instruction execution system, apparatus, or device. More specific examples (non-exhaustive list) of computer-readable media include the following: an electrical connection portion with one or more wirings (control method), a portable computer disk cartridge (magnetic device), a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber device, and a portable compact disc read-only memory (CDROM). Additionally, the computer-readable medium can even be paper or other suitable media on which a program can be printed, because the program can be obtained electronically, for example, by optically scanning the paper or other media, followed by editing, interpretation, or, if necessary, other appropriate processing, and then stored in a computer memory.

[0153] It should be understood that various parts of the embodiments of the present disclosure can be implemented using hardware, software, firmware, or a combination thereof. In the above embodiments, multiple steps or methods can be implemented using software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented using hardware, as in another embodiment, any one or a combination of the following techniques well known in the art can be used: discrete logic circuits having logic gate circuits for implementing logical functions on data signals, application-specific integrated circuits having appropriate combinational logic gate circuits, programmable gate arrays (PGAs), field-programmable gate arrays (FPGAs), and the like.

[0154] Those of ordinary skill in the art of this technology can understand that all or part of the steps carried by the methods of the above embodiments can be completed by instructing relevant hardware through a program, and the program can be stored in a computer-readable storage medium. When the program is executed, it includes one or a combination of the steps of the method embodiments.

[0155] In addition, each functional unit in various embodiments of the present disclosure may be integrated into one processing module, or each unit may exist physically alone, or two or more units may be integrated into one module. The above-mentioned integrated module may be implemented in the form of hardware or in the form of a software functional module. When the integrated module is implemented in the form of a software functional module and sold or used as an independent product, it may also be stored in a computer-readable storage medium. The above-mentioned storage medium may be a read-only memory, a magnetic disk or an optical disc, etc.

[0156] Although the embodiments of the present disclosure have been shown and described above, it can be understood that the above embodiments are exemplary and should not be construed as limiting the present disclosure. Those of ordinary skill in the art can make changes, modifications, substitutions, and variations to the above embodiments within the scope of the present disclosure.

Claims

1. A chip storage control method, characterized in that, The method includes: In response to a first instruction of a processor, determining a target instruction for a target memory, where the first instruction is an operation instruction of the processor on target data; When the target instruction is a first type of instruction, mapping a first address sequence of the target data to a second address sequence, and using the second address sequence to write the target data to the target memory, where the first address sequence is a register address sequence of the target data in the processor.

2. The method according to claim 1, wherein The method further includes: When the target instruction is a second type of instruction, determining the first address sequence and reading the target data from the target memory according to the first address sequence.

3. The method according to claim 1, wherein When the target instruction is a first type of instruction, mapping the first address sequence of the target data to a second address sequence and using the second address sequence to write the target data to the target memory includes: Obtaining the first address sequence according to the first type of instruction; Based on a preset confusion factor and the first address sequence, determining the second address sequence through a first mapping relationship; Writing the target data to the target memory according to the second address sequence.

4. The method according to claim 2, characterized in that, When the target instruction is a second type of instruction, determining the first address sequence and reading the target data from the target memory according to the first address sequence includes: Reading the second address sequence; Based on a preset confusion factor and the second address sequence, mapping the second address sequence to the first address sequence through a second mapping relationship.

5. The method according to claim 4, wherein After mapping the second address sequence to the first address sequence based on the preset confusion factor and the second address sequence through the second mapping relationship, it further includes: Returning the first address sequence to the processor.

6. The method according to claim 3, wherein Before writing the target data to the target memory according to the second address sequence, it further includes: Turning on the write power switch of the target memory.

7. The method according to claim 4, wherein The reading of the second address sequence includes: Traversing and reading the second address sequence; In response to the completion of the reading of the second address sequence, storing the second address sequence in a cache unit, where the read / write attribute of the cache unit is read-only, and the preset confusion factor is also stored in the cache unit.

8. The method according to claim 7, wherein The reading of the second address sequence further includes: In response to a reset instruction, loading the second address sequence into the cache unit.

9. A chip storage control device, characterized in that, The device includes a command interaction unit, a mode generation unit, a timing generation unit, a security function unit, an automatic cache unit, a device unit, and a power supply unit. The command interaction unit parses a first instruction of the processor into a target instruction. The mode generation unit generates an enable signal for the timing generation unit in response to the target instruction, and the enable signal enables the device unit to read and / or write target data. The security function unit changes the mapping between the data register address in the processor and the actual storage address of the device unit in response to the target instruction.

10. The device according to claim 9, characterized in that, The command interaction unit also supports storing the default timing parameters of the timing generation unit. The automatic cache unit is used to cache the target data in the device unit, and the power supply unit is used to receive the target instruction of the command interaction unit to power on the device unit.

11. An electronic device, characterized in that, Comprising: At least one processor; And A memory communicatively connected to the at least one processor; wherein, The memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the method according to any one of claims 1-8.

12. A non-transitory computer-readable storage medium storing computer instructions, characterized in that, The computer instructions are used to cause the computer to execute the method according to any one of claims 1-8.

13. A computer program product, characterized in that, Comprising a computer program, which implements the method according to any one of claims 1-8 when executed by a processor.

14. A chip, characterized in that, Comprising at least one processor and a communication interface; the communication interface is used to receive signals input to the chip or signals output from the chip, and the processor communicates with the communication interface and implements the method according to any one of claims 1-8 through logic circuits or by executing code instructions.

Images