Secure debugging method of embedded microprocessor and embedded microprocessor

Abstract

The invention relates to the technical field of microprocessors, and discloses a safety debugging method of an embedded microprocessor and the embedded microprocessor, the method comprises the following steps: implanting a random module in the microprocessor, constructing a resistance network array through random distribution of silicon substrate lattice defects to generate a disordered sequence, and if microprocessor data access is carried out, starting the random module; if physical intrusion is detected, a debugging session is established, three types of physical characteristics are synchronously generated to construct a composite key, a triple dynamic confusion layer is constructed in the microprocessor, the dynamic confusion layer and the composite key construct physical logic linkage protection, a probe access instruction logic address is called, if physical intrusion is detected, a probe triggers an invisible check point, and the probe accesses the invisible check point. The integrity of an execution environment is verified, if abnormal debugging is detected, a hardware defense mechanism is triggered, an access attack model is established, confusion parameters are trained and optimized, and a module interconnection mode is changed, so that the learning cycle of an attacker is broken, and the risk of attacking a processor in a machine learning mode is reduced.

Description

Technical Field

[0001] The present invention relates to the technical field of microprocessors, and particularly to a security debugging method for an embedded microprocessor and an embedded microprocessor. Background Art

[0002] The current security debugging technology of embedded microprocessors faces key challenges. SRAM-PUF, ring oscillator PUF, etc. rely on circuit characteristics, and their randomness is limited by process deviations and may be cracked by machine learning modeling attacks. Most chips use fixed keys or one-way authentication. Once the key is leaked, the entire life cycle fails, and it cannot cope with real-time physical intrusion during the debugging process. Although traditional encryption modules protect data storage, bus signals and timing characteristics may still leak key information. Differential power analysis (DPA) can crack keys. Existing solutions mostly rely on a single sensor (such as a photodetector), with a high false alarm rate and a slow response speed (millisecond level), making it difficult to prevent nanosecond-level probe attacks. The parameters of solutions such as code obfuscation and bus encryption are fixed, and attackers can reverse-crack them through long-term observation. Summary of the Invention

[0003] To solve the above technical problems, the main object of the present invention is to provide a security debugging method for an embedded microprocessor, including: implanting a random module in the microprocessor, where the random module is used to output a chaotic sequence; If a microprocessor data access is performed, a debugging session is established, three types of physical features are synchronously generated, a composite key is constructed, and a triple dynamic confusion layer is constructed inside the microprocessor, and the dynamic confusion layer and the composite key construct a physical logic linkage protection; Retrieving the logical address of the probe access instruction, if a physical intrusion is detected, the probe triggers an invisible checkpoint to verify the integrity of the execution environment, and if an abnormal debugging is detected, a hardware defense mechanism is triggered; Establishing an access attack model, training and optimizing the confusion parameters, and changing the module interconnection method through circuit reconstruction.

[0004] As a preferred solution of the security debugging method for the embedded microprocessor of the present invention, wherein: The random module is used to output a random number sequence, and the random number sequence is converted into the chaotic sequence; The chaotic sequence is used to generate a dynamic key or a random number seed.

[0005] As a preferred solution of the security debugging method for the embedded microprocessor of the present invention, wherein: The three types of physical features include a hardware fingerprint, an environmental fingerprint, and a behavior fingerprint; The hardware fingerprint quantifies the physical characteristic parameters of the current chip through a circuit for measuring the deviation of the charge and discharge time of the memory unit; The environmental fingerprint captures the near-field radiation pattern caused by the contact of the debugging probe through the on-chip electromagnetic sensor array, and combines the power supply ripple spectrum analysis to generate the environmental feature encoding; The behavior fingerprint statistically analyzes the timing entropy distribution of the debugging instruction stream and extracts the microscopic jitter characteristics of the execution delay; The chaotic mapping algorithm is used to nonlinearly fuse the three types of physical characteristics to generate a dynamic composite key.

[0006] As a preferred solution of the secure debugging method for the embedded microprocessor of the present invention, wherein: The construction of the triple dynamic confusion layer includes: Deploy dynamic remapping logic in the instruction decoding stage, and change the mapping relationship between the operation code and the functional unit in real time through the programmable microcode converter, so that the same machine code activates different physical execution paths in different debugging sessions; Insert NOP instructions with pseudo-random distribution into the different physical execution paths, and the insertion density is dynamically adjusted by the hash value of the debugging session key, and invalid operation codes are inserted between the decoding pipeline levels to interfere with static disassembly; Integrate an impedance adjustable circuit at the memory bus driving end, dynamically adjust the signal rise or fall time according to the lower 8 bits of the composite key, and inject mask noise with variable amplitude into the data buffer; Insert voltage-controlled delay units into the different physical execution paths, and the delay amount is obtained according to the non-linear sequence generated by the chaotic mapping algorithm of the composite key; When the impedance monitoring network around the debugging interface detects abnormal contact impedance, it triggers the reorganization of the microcode mapping table of the instruction stream confusion layer.

[0007] As a preferred solution of the secure debugging method for the embedded microprocessor of the present invention, wherein: Add intrusion response logic in the probe access stage, and the debugging interface monitoring module tracks the logical address mapping relationship of the debugging instructions in real time. When the access address deviates from the pre-stored whitelist, a secondary verification mechanism is triggered.

[0008] As a preferred solution of the secure debugging method for the embedded microprocessor of the present invention, wherein: The secondary verification mechanism adopts a three-stage trigger strategy, including: physical layer verification, execution environment verification, and instruction stream verification; The physical layer verification detects the probe contact pressure waveform through the electromagnetic sensor array and performs dynamic correlation analysis with the baseline data of the chip package stress sensor.

[0009] As a preferred solution of the secure debugging method for the embedded microprocessor of the present invention, wherein: The execution environment verification loads the reference hash tree in the trusted execution environment, performs memory traversal verification on the current debugger firmware, and uses an asynchronous verification mechanism to complete the CRC64 verification of the code segment within 3 clock cycles; The instruction stream verification deploys a shadow state machine in the instruction parser, compares the actual instruction stream with the expected state transition path in real time, and injects a pseudo response when an illegal state jump is detected.

[0010] As a preferred solution of the security debugging method of the embedded microprocessor of the present invention, wherein: The access attack model is trained by collecting and extracting access attack data, inputs data access instructions in real time, the trained access attack model identifies the power characteristics of the data access instructions, and continuously adjusts the parameters of the access attack model through real-time data, and trains and optimizes the obfuscation parameters through the access attack model.

[0011] As a preferred solution of the security debugging method of the embedded microprocessor of the present invention, wherein: The circuit reconstruction receives the power characteristics of the data access instructions output by the access attack model, performs a security assessment, and if the security assessment risk is abnormal, triggers the change of the module interconnection method; Reconstructs the circuit according to the preset interconnection scheme.

[0012] An embedded microprocessor, comprising: A physically unclonable entropy source module constructs a resistor network array based on the random distribution of silicon substrate lattice defects, introduces uncontrollable lattice dislocations and point defects by controlling the doping concentration and annealing process, forms a nanoscale random conductive property variation region, integrates a metal-insulator-metal structure in the defect region, constitutes a random resistor network determined by the defect conduction path, measures the tunneling current by scanning voltage, and generates a physically unclonable chaotic sequence for generating a dynamic key or a random number seed; A multimodal physical feature fusion module is used to receive hardware fingerprints, environmental fingerprints and behavioral fingerprints, and non-linearly fuse the features of the three types of fingerprints to generate a dynamic composite key; A triple dynamic obfuscation module modulates the memory bus impedance according to the composite key, dynamically adjusts the signal edge time, and injects mask noise with adjustable amplitude in the data buffer; An intrusion risk defense module detects physical intrusion through an electromagnetic sensor array and a chip stress sensor, and triggers a three-stage verification; An adaptive security optimization module collects the power characteristics of access instructions in real time, optimizes the obfuscation parameters through an access attack model, and changes the module interconnection method according to the real-time system security assessment result.

[0013] The beneficial effects of the present invention: This application constructs a resistor network array based on silicon substrate lattice defects, generates a random entropy source using atomic-level disorder, and its conduction path has a quantum tunneling effect that cannot be reproduced by external excitation, significantly enhancing the anti-modeling attack ability. It dynamically generates session keys through multi-modal physical characteristics (hardware / environment / behavior fingerprints), and combines triple confusion layers (instruction / data / timing) to achieve runtime dynamic perturbation, enabling each debugging session to have a unique protection strategy; This application adopts three-level hardware defenses: clock freezing → fuse isolation → quantum erasure, responds according to the attack intensity gradient, takes into account both security and chip availability, and optimizes the confusion parameters in real time through an access attack model, supports 256 predefined modes to switch by key, and breaks the attacker's learning cycle. Brief Description of the Drawings

[0014] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings required for the description of the embodiments will be briefly introduced below. Obviously, the drawings in the following description are only some embodiments of the present invention. For those of ordinary skill in the art, other drawings can be obtained based on these drawings without creative efforts. Among them: Figure 1 It is a flowchart of the security debugging method for the embedded microprocessor of the present invention; Figure 2 It is a schematic diagram of the lattice defect resistor network structure of the embedded microprocessor of the present invention; Figure 3 It is a schematic diagram of the structural principle of the embedded microprocessor of the present invention; Figure 4 It is a schematic diagram of the key structure and defense instruction output of the embedded microprocessor of the present invention.

[0015] Reference numerals: 1, first metal electrode; 2, insulator structure; 3, second metal electrode; 4, energized wire. Detailed Embodiments

[0016] To make the above objects, features, and advantages of the present invention more obvious and understandable, the detailed embodiments of the present invention will be described in detail below with reference to the drawings of the specification.

[0017] Many specific details are set forth in the following description in order to fully understand the present invention, but the present invention can also be implemented in other ways different from those described herein. Those skilled in the art can make similar promotions without departing from the connotation of the present invention. Therefore, the present invention is not limited by the specific embodiments disclosed below.

[0018] Secondly, the so-called "one embodiment" or "embodiment" herein refers to specific features, structures or characteristics that may be included in at least one implementation manner of the present invention. The appearances of "in one embodiment" in different places in this specification do not all refer to the same embodiment, nor are they separate or selectively exclusive embodiments from other embodiments.

[0019] Embodiment 1 As Figure 1 shown, a security debugging method for an embedded microprocessor includes: implanting a random module in the microprocessor, where the random module is used to output a chaotic sequence; The random module is used to output a random number sequence, and convert the random number sequence into the chaotic sequence; The finally output chaotic sequence is used to generate a dynamic key or a random number seed; Further, the random module adopts a hardware random number generator, and the hardware random number generator generates random numbers by means of physical phenomena, and these physical phenomena are unpredictable.

[0020] A specific implementation method of a random module design includes: if the random module is constructed in the form of a metal-insulator-metal structure to form a resistance network array, by energizing the resistance network array, a physically unclonable chaotic sequence is generated, specifically including: As Figure 2 shown, a metal-insulator-metal structure is integrated above the distribution area to form a random resistance network determined by defective conduction paths; The first metal electrode 1 is used to provide a conductive electrode, and forms a non-linear conductive channel with the second metal electrode 3 and the insulator structure 2. The insulator structure 2 deposits a three-layer film of titanium nitride / hafnium dioxide / titanium nitride on the top to form a metal-insulator-metal tunneling junction. The thickness of the insulator layer is controlled at 1.5 - 3 nm, and the tunneling barrier height is about 2.5 eV.

[0021] The energizing wire 4 is arranged on the second metal electrode 3 and is used to transmit electric energy.

[0022] The working principle includes: when applying a ±1V scanning voltage, a random conductance matrix is obtained by measuring the tunneling current (with an accuracy of up to 10 pA). The differential amplifier circuit converts the current signal into an analog noise with a peak-to-peak value of 100 mV, and through a sampling rate of 128x@100 MHz (the sampling rate of 128x@100 MHz means that each cycle signal is sampled 128 times, and the total sampling rate is 12.8 GHz), effective entropy extraction is realized.

[0023] Further, the microprocessor embeds a correlated double sampling technology to eliminate common-mode noise, automatically switches to the battery power supply mode when the power supply noise > 50 mV, and triggers the entropy value caching mechanism when the temperature change rate > 1 °C / ms.

[0024] A specific implementation method for microprocessors to work together includes: After the microprocessor is powered on, it first performs lattice defect feature calibration (which takes less than 1 ms), establishes an initial entropy value generation model (including 1024 feature parameters). After the microprocessor starts working, it performs an environmental parameter scan every 10 μs, dynamically adjusts the mixing weights of the noise sources (with an accuracy of 0.1%), the output signal passes through a processing unit to generate an entropy flow (with a rate of ≥100 Mbps). If a physical intrusion is detected, it immediately switches to the initial entropy value, triggers the active shielding of the adjacent circuit to generate an electromagnetic interference field, and finally completes the physical erasure of sensitive parameters within 5 μs to generate a chaotic sequence.

[0025] The method for generating a chaotic sequence includes: By applying a scanning voltage of 0.5 - 2 V, measuring the tunneling current values of each node in the resistor network, converting them into analog noise signals through a differential amplifier, oversampling the noise signals using a Δ-Σ modulator, and combining a post-processing algorithm to extract a statistically uniform bit stream. The finally output chaotic sequence is used to generate a dynamic key or a random number seed, and its entropy value is not less than 0.98 bit.

[0026] Utilizing the non-replicable characteristics of silicon lattice defects, each chip has a physically unique entropy source fingerprint. Crackers cannot reproduce the same entropy source characteristics through reverse engineering. It converts the microscopic randomness in the microprocessor manufacturing process into a controllable secure entropy source. Through multi-physical field coupling and intelligent regulation technologies, it achieves an entropy quality comparable to that of a quantum random number generator on a standard CMOS process, while meeting the stringent requirements of the embedded system for area and power consumption.

[0027] If microprocessor data access is performed, a debug session is established, three types of physical characteristics are synchronously generated, a composite key is constructed, and a triple dynamic confusion layer is constructed inside the microprocessor. The dynamic confusion layer and the composite key construct a physical logic linkage protection.

[0028] Specifically, when the microprocessor detects a debug data access request, it triggers the debug session establishment process and synchronously collects three types of physical characteristics. The three types of physical characteristics include a hardware fingerprint, an environmental fingerprint, and a behavior fingerprint; The hardware fingerprint quantifies the physical characteristic parameters of the current chip through a circuit for measuring the deviation of the charge and discharge time of the memory unit, with a precision reaching the picosecond level; The environmental fingerprint uses an electromagnetic sensor array to capture the near-field radiation pattern caused by the contact of the debug probe, and combines the power supply ripple spectrum analysis to generate an environmental feature code; The behavior fingerprint statistically analyzes the temporal entropy distribution of the debug instruction stream and extracts the microscopic jitter characteristics of the execution delay.

[0029] The chaotic mapping algorithm is used to non-linearly fuse three types of features to generate a dynamic composite key. The key length is configurable (128 / 256 / 512 bits) and is bound to the current debugging session.

[0030] Furthermore, a specific implementation method for dynamic key generation and debugging session protection of an embedded processor includes: When the microprocessor detects a debugging data access request (such as the activation of the JTAG / SWD interface), it immediately starts the secure debugging session process and synchronously collects three types of physical features, including hardware fingerprint collection, environmental fingerprint collection, and behavioral fingerprint collection.

[0031] Furthermore, the specific implementation method for hardware fingerprint collection (chip unique identifier) includes: The memory unit measures the charge and discharge time. Specific test units are selected in the SRAM / Flash storage array, and standardized charge and discharge pulses are applied. The picosecond-level deviation of the unit response time (caused by process fluctuations) is measured through a high-precision time-to-digital converter (TDC), and the timing characteristics of multiple groups of units are extracted to form a unique hardware fingerprint of the chip.

[0032] Environmental fingerprint collection includes deploying a micro electromagnetic induction coil around the debugging interface, capturing the near-field radiation pattern caused by probe contact, analyzing the radiation spectrum characteristics, such as the energy distribution in a specific frequency band, monitoring the instantaneous fluctuations of the core power rail, extracting the ripple frequency and amplitude characteristics, and generating an environmental fingerprint code in combination with the electromagnetic signal.

[0033] Behavioral fingerprint collection includes recording the clock cycle-level jitter during the execution of debugging instructions, statistically analyzing the delay distribution of key operations such as jump instructions and memory accesses, extracting micro-temporal entropy, quantifying the randomness of pipeline stalls and cache hits through hardware performance counters, and adaptively selecting the events with the largest entropy contribution for key collection.

[0034] Specifically, the clock cycle-level jitter comes from the fluctuations in instruction execution time; Pipeline stalls include branch prediction errors (such as incorrect conditional jump judgments, resulting in pipeline flushing), data dependencies (such as floating-point operations waiting for integer results), and resource contention (such as multiple units accessing the cache simultaneously).

[0035] Cache behavior includes cache hits or misses (the access latency difference between L1 / L2 / L3 caches can reach 10 - 100 cycles), and cache coherence protocols (such as the latency jitter introduced by MESI state transitions).

[0036] Power supply and temperature include the timing uncertainty caused by voltage fluctuations (±5%) and the drift of transistor threshold voltage (the delay increases by about 2% for every 10°C increase in temperature).

[0037] The latency distribution characteristics of critical operations include jump instructions and memory accesses; When the jump instruction prediction is correct, the latency is \(t_{correct\ prediction}\) (e.g., 2 - 3 cycles), and when the prediction is incorrect, the latency is \(t_{incorrect\ prediction}\) (e.g., 15 - 20 cycles, where the pipeline needs to be flushed and instructions need to be fetched again). The probability difference between the two forms an entropy source.

[0038] Memory accesses include: register access (1 cycle), L1 cache hit (3 - 4 cycles), L2 cache hit (10 - 15 cycles), and main memory access (100 - 200 cycles). The latency differences are huge, and the loading / replacement of cache lines has pseudo - randomness (e.g., the uncertainty introduced by the replacement policy based on the LRU algorithm).

[0039] The functions of hardware performance counters include obtaining the number of branch prediction errors, the number of data cache misses, the number of pipeline stall cycles, and the number of memory access latency cycles; By periodically reading hardware performance counters (e.g., every 1000 instructions), recording the occurrence frequency of each event, and constructing a multi - dimensional random vector \([c_1, c_2, c_3, c_4]\), the joint entropy reflects the complexity of the system's dynamic behavior.

[0040] Furthermore, a chaotic mapping algorithm is used to non - linearly fuse the three types of features: hardware fingerprints, environment fingerprints, and behavior fingerprints. The chaotic mapping algorithm complexly mixes and transforms different types of data. The three types of features are input into the chaotic mapping algorithm module. After being processed by the algorithm, a dynamic composite key is generated. The length of the key can be configured according to actual needs, providing three options: 128 - bit, 256 - bit, or 512 - bit.

[0041] The generated dynamic composite key is associated with the current debugging session. By setting up a key management module in the system to record each debugging session information and the dynamic composite key, during the debugging session, operations such as data encryption and authentication are performed, and the dynamic composite key bound to the debugging session is called to ensure the security of the debugging process and the confidentiality of data.

[0042] Chaotic algorithms include Logistic mapping, Tent mapping, etc. If Logistic mapping is used, determine the control parameter of the Logistic mapping and set it within the chaotic interval. For example, the control parameter \(\mu = 3.9\) to ensure that the system can generate a chaotic sequence, and select an initial value \(x\), where the value range of \(x\) is \((0, 1)\).

[0043] Due to the different data types and value ranges of hardware fingerprints, environmental fingerprints, and behavioral fingerprints, it is necessary to normalize them, unify their value ranges to the interval [0, 1]. Using the initialized control parameter μ and the initial value x, a chaotic sequence {x_1, x_2,..., x_N} is generated through Logistic mapping iteration. The number of iterations N can be determined according to the length of the generated key. Different weights are assigned to hardware fingerprints, environmental fingerprints, and behavioral fingerprints, and the weight assignment can be determined according to the importance of different fingerprints in security protection.

[0044] Multiply and add the normalized three types of fingerprint data with weights to obtain the fused eigenvalue, and perform a mapping operation on the fused eigenvalue and the chaotic sequence {x_1, x_2,..., x_N}.

[0045] Furthermore, the construction of the triple dynamic confusion layer includes: The instruction stream confusion layer is used to dynamically remap the correspondence between the opcode and the functional unit during the instruction decoding stage. The same machine code executes different physical circuit paths in different debugging sessions, implants randomized NOP instructions (the density is adjustable from 0.1% to 5%), and destroys the static disassembly logic; The data stream confusion layer is used to apply impedance modulation to the memory bus, dynamically adjust the signal rise / fall time according to the composite key, and inject masked noise into the data buffer. The noise amplitude is linearly related to the key segment; The timing stream confusion layer is used to insert programmable clock jitter units in the critical path to generate non-periodic delays. The response time of the debugging interface is dynamically perturbed according to the composite key, making it impossible for the logic analyzer to establish a stable trigger condition.

[0046] When the impedance monitoring network around the debugging interface recognizes abnormal contact, it immediately triggers the dynamic reorganization of the instruction stream confusion layer; The implicit checkpoint in the pipeline automatically verifies the execution environment every time it runs a preset cycle. If tampering is found, it starts the noise enhancement mode of the data stream confusion layer; Trigger the primary response according to the attack intensity grading, inject a pseudo-random interrupt signal into the debugging channel; the intermediate response fuses some non-critical debugging registers; the ultimate response erases the configuration parameters of the key generation module and resets the chip.

[0047] Establish a confusion strategy lookup table (LUT), store 256 predefined confusion modes, and select and mix multiple confusion modes in real time according to the composite key. The mode switching period is 10 - 1000 μs. After each debugging session ends, all confusion parameters and intermediate states are automatically cleared.

[0048] This design ensures that even if an attacker obtains the debugging data of the same chip multiple times, the protection mechanism cannot be cracked through comparative analysis by deeply coupling the session key with a triple dynamic obfuscation layer, forming a dual protection barrier of physical randomness and logical complexity.

[0049] Retrieve the logical address of the probe access instruction. If a physical intrusion is detected, the probe triggers an invisible checkpoint to verify the integrity of the execution environment. If abnormal debugging is detected, a hardware defense mechanism is triggered. Add intrusion response logic during the probe access phase. The debugging interface monitoring module continuously tracks the logical address mapping relationship of debugging instructions. When the accessed address deviates from the pre-stored whitelist, a secondary verification mechanism is triggered. Furthermore, the secondary verification mechanism adopts a three-stage trigger strategy, including: physical layer verification, execution environment verification, and instruction stream verification. The physical layer verification detects the probe contact pressure waveform through an electromagnetic sensor array and performs dynamic correlation analysis with the baseline data of the chip package stress sensor. When the distortion of the pressure waveform exceeds 5%, the verification is activated. The execution environment verification loads the reference hash tree in the trusted execution environment (TEE) to perform memory traversal verification on the current debugger firmware. An asynchronous verification mechanism is used to complete the CRC64 verification of the code segment within 3 clock cycles. The instruction stream verification deploys a shadow state machine in the JTAG instruction parser to continuously compare the actual instruction stream with the expected state transition path. When an illegal state jump is detected, a pseudo response is injected. If the hardware defense mechanism is triggered, a three-level response is used to handle the defense mechanism, including: Level-I response immediately freezes the debugging interface clock through the clock gating unit, and at the same time activates the transient voltage suppressor in the power supply loop to reduce the debugging port voltage to a safe level. Level-II response triggers the fuse array reconfiguration logic to dynamically cut off the connection path between the physical feature acquisition module and the bus, and generates a temporary isolation key through the PUF circuit to encrypt and lock the sensitive registers. Level-III response starts the selective erasure mode in the self-destruction protocol, and applies a 7V programming voltage to the antifuse memory storing the key using the principle of quantum tunneling effect to achieve physically irreversible erasure. The abnormal debugging determination adopts a hybrid decision model: the spectral mutation rate of the environmental fingerprint, the entropy change gradient of the behavior fingerprint, and the offset of the hardware fingerprint form a three-dimensional feature space vector. The intrusion probability is calculated in real time through a support vector machine (SVM) classifier. When the intrusion probabilities of the three types of features exceed the standard, a defense trigger signal is generated.

[0050] A specific implementation method includes: A dedicated monitoring circuit is set up at the chip debug interface (such as JTAG, SWD) to scan the data access address mode in real time. After detecting a write operation to the 0x4000_0000 address (debug control register), the subsequent process is started, the power supplies of three types of physical feature acquisition modules are activated, and the parameters are configured. The charge and discharge measurement circuit of the memory sets the measurement period to 1 μs, the accuracy is calibrated to ±1 ps, the electromagnetic sensor array turns on 8 near-field probes, the sampling rate is 1 GHz, and the instruction stream monitoring unit configures a shadow state machine and loads the standard JTAG instruction state transition table.

[0051] Charge and discharge operations are sequentially performed on 1024 random units of the on-chip SRAM. The charge and discharge times of each unit are measured through a time-to-digital converter (TDC), and the deviation values are recorded. For example, the average charge time is 1.2 ns, and for a certain unit it is 1.2001 ns, with a deviation of +100 ps. The deviation values are quantized into 16-bit binary numbers to form a hardware fingerprint data block.

[0052] The electromagnetic sensor captures the near-field radiation waveform at the moment when the debug probe makes contact (such as a sine wave with a frequency of 200 MHz), synchronously collects the power supply ripple (such as 5V ± 50 mV, ripple frequency 100 kHz), obtains the spectral characteristics through FFT analysis, and encodes the waveform and spectral characteristics into a 256-bit environmental fingerprint data block.

[0053] Monitor the execution order of the debug instruction stream (such as first executing the DRIVER instruction and then the READ instruction), record the execution interval between adjacent instructions (such as the time taken from DRIVER to READ is 200 ns), calculate the timing entropy (reflecting the degree of chaos of the instruction stream), and extract the microscopic jitter of the instruction execution delay (such as a fluctuation of ±5 ns) to form a 128-bit behavior fingerprint data block.

[0054] Normalize the hardware fingerprint, environmental fingerprint, and behavior fingerprint data. The hardware fingerprint is sorted by the unit deviation value, and the first 256 maximum values are taken as valid data. The waveform and spectral characteristics of the environmental fingerprint are reduced to 128 bits through principal component analysis (PCA), and the timing entropy and jitter characteristics of the behavior fingerprint are combined into a 128-bit vector.

[0055] Initialize the Logistic mapping parameters (μ = 3.9, x0 = 0.123456), generate 256 chaotic values, multiply the three types of normalized fingerprint data by the chaotic values respectively (the weight of the hardware fingerprint is 0.5, the weight of the environmental fingerprint is 0.3, and the weight of the behavior fingerprint is 0.2), sum the product results and take the modulus 256 to generate a 256-bit composite key, where x0 is the initial iteration value.

[0056] Store the session ID (such as timestamp + random number) and the key in the on-chip secure RAM. At the same time, encrypt the key with AES-256 through the hardware encryption engine. After every 100 debug instructions are executed, collect the environmental fingerprint again and update the environmental characteristics part of the key.

[0057] The electromagnetic sensor continuously monitors the probe pressure waveform. If the waveform distortion exceeds 5% (such as changing from a sine wave to a square wave), trigger secondary verification. The TEE module loads the pre-stored debugger firmware hash tree, traverses the memory and calculates CRC64. If the verification fails (such as the hash values do not match), freeze the debug interface and trigger a three-level response mechanism: The first-level response immediately cuts off the clock of the debug interface. At the same time, through the transient voltage suppressor, reduce the voltage of the debug port from 3.3V to 0.5V and restore it after 1ms.

[0058] The second-level response fuses some fuses, cuts off the connection between the physical feature acquisition module and the bus, and encrypts the sensitive registers with a temporary key generated by the PUF.

[0059] The third-level response applies a 7V voltage to the antifuse memory and irreversibly erases the key storage area using the quantum tunneling effect.

[0060] Perform anomaly judgment, including real-time calculation of the spectral mutation rate of the environmental fingerprint (such as the ripple frequency suddenly changes from 100kHz to 500kHz), the entropy change gradient of the behavior fingerprint (such as the temporal entropy suddenly drops from 0.8 to 0.3), and the hardware fingerprint offset (such as the current deviation mean changes by more than 3% compared to the baseline value).

[0061] Train the SVM classifier, set the Mahalanobis distance thresholds for the three types of features (such as hardware offset > 3%, environmental mutation > 5%, behavior entropy change > 0.5). When any two types of features exceed the standard at the same time, trigger the defense mechanism (such as the first-level response); when all three types exceed the standard, trigger the third-level response.

[0062] Establish an access attack model, train and optimize the confusion parameters, and change the module interconnection method.

[0063] Specifically, change the module interconnection method through circuit reconstruction.

[0064] A method for establishing an access attack model includes: Collect access attack data, including but not limited to malicious debug instructions, abnormal access address patterns, illegal data read and write operations, etc. The attack data is obtained from actual attack event records, simulated attack experiments, and public datasets released by security research institutions.

[0065] Extract key features from the collected data, such as the execution frequency of debug instructions, the distribution law of access addresses, the rate and direction of data transmission, etc.

[0066] Train the access attack model with the extracted feature data. Divide the data set into a training set and a test set. The training set is used for parameter learning of the model, and the test set is used to evaluate the performance of the model. During the training process, continuously adjust the parameters of the model to improve the recognition accuracy of the model for attacks.

[0067] Furthermore, select instruction obfuscation, data obfuscation, control flow obfuscation, etc. Instruction obfuscation increases the complexity of instructions by encoding, replacing, or inserting redundant instructions for debugging instructions; data obfuscation hides the true meaning of data by encrypting, transforming, or adding noise to the data; control flow obfuscation increases the difficulty for attackers to analyze the program by changing the execution flow of the program.

[0068] Set initial obfuscation parameters for the obfuscation technology, such as the rules for instruction encoding, the keys for data encryption, the probability of control flow transfer, etc.

[0069] Define the optimization objectives, such as improving the false recognition rate of the attack model, reducing the impact of obfuscation on system performance, etc.

[0070] Use the trained attack model to evaluate different combinations of obfuscation parameters, and calculate the fitness value of each combination according to the optimization objectives.

[0071] A specific implementation method for changing the module interconnection method through circuit reconstruction includes: Analyze the functions, input / output interfaces, and dependencies between each module to determine the changeable interconnection methods between the modules.

[0072] Fuse multiple different module interconnection schemes, including changing the connection order between modules, adding or reducing connections between modules, and introducing intermediate modules.

[0073] Use the established access attack model to conduct a security assessment on each interconnection scheme. The evaluation metrics include the false recognition rate of the attack model, the difficulty for attackers to crack the system, etc.

[0074] According to the selected interconnection scheme, reconstruct the circuit, implement the redesigned circuit through Verilog or VHDL, or perform dynamic configuration of the circuit using a field-programmable gate array (FPGA).

[0075] Applying the circuit reconstruction technology to the security protection system can establish an effective access attack model, optimize the obfuscation parameters to improve the security of the system, and at the same time change the module interconnection method through circuit reconstruction to enhance the anti-attack ability of the system from multiple levels. [[ID=3l]]

[0076] Embodiment 2

[0077] An embedded microprocessor, see Figure 3 , including: A physically unclonable entropy source module constructs a resistance network array based on the random distribution of silicon substrate lattice defects. By controlling the doping concentration and annealing process, uncontrollable lattice dislocations and point defects are introduced to form nanoscale randomly conductive characteristic variation regions. A metal-insulator-metal structure is integrated in the defect regions to form a random resistance network determined by the defect conduction paths. By measuring the tunneling current through a scanning voltage, a physically unclonable chaotic sequence is generated for generating dynamic keys or random number seeds. A multimodal physical feature fusion module is used to receive hardware fingerprints, environmental fingerprints, and behavior fingerprints, and nonlinearly fuse the features of the three types of fingerprints to generate a dynamic composite key. A triple dynamic obfuscation module modulates the memory bus impedance according to the composite key, dynamically adjusts the signal edge time, and injects mask noise with adjustable amplitude in the data buffer area. An intrusion risk defense module detects physical intrusion through an electromagnetic sensor array and a chip stress sensor, triggering a three-stage verification. An adaptive security optimization module real-time collects the power characteristics of access instructions, optimizes the obfuscation parameters through an access attack model, and changes the module interconnection method according to the real-time system security assessment results.

[0078] As Figure 4 shown, the hardware fingerprint quantifies the chip physical characteristic parameters by measuring the charge and discharge time deviation of the memory cells; the environmental fingerprint analysis generates environmental characteristic codes; the behavior fingerprint statistically analyzes the timing entropy distribution of the debug instruction stream and extracts the microscopic jitter characteristics of the execution delay.

[0079] Using the chaotic mapping algorithm to receive the three types of fingerprint data, a "composite key" and a "chaotic sequence" are generated through nonlinear fusion. The composite key serves as the core credential for security operations, and the chaotic sequence is used to drive the dynamic obfuscation strategy.

[0080] Identify data access characteristics through total impedance modulation and using an access attack model; Furthermore, the total impedance modulation dynamically adjusts the rise / fall time of the memory bus signal based on the lower 8 bits of the composite key to achieve bus timing obfuscation.

[0081] The access attack model identifies data access characteristics, analyzes characteristics such as the power of data access instructions, identifies potential attack behaviors, and provides a basis for the defense strategy.

[0082] Invalid mask interference defends against static analysis by injecting interference signals. The optimization of the obfuscation parameters requires combining the attack model to optimize the obfuscation strategy.

[0083] Generating the chaotic sequence provides random parameters for dynamic obfuscation, and the defense response triggers the hardware defense mechanism against attacks.

[0084] The circuit reconstruction changes the module interconnection mode according to the security assessment results, generates composite keys, primary defense strategies, power supply, etc., supports the operation of the module system, and forms a complete security closed-loop from feature collection, key generation to defense execution.

[0085] It is important to note that the construction and arrangement of the present application shown in multiple different exemplary embodiments are merely illustrative. Although only two embodiments are described in detail in this disclosure, those who refer to this disclosure should easily understand that many modifications are possible without substantially departing from the novel teachings and advantages of the subject matter described in this application. For example, the dimensions, scales, structures, shapes and proportions of various components, as well as parameter values (such as temperature, pressure, etc.), installation arrangements, use of materials, color, orientation changes, etc. For example, an element shown as integrally formed may be composed of multiple parts or elements, the position of the element may be inverted or otherwise changed, and the nature or number or position of discrete elements may be changed or altered. Therefore, all such modifications are intended to be included within the scope of the present invention. The order or sequence of any process or method steps may be changed or reordered according to alternative embodiments. Any "means-plus-function" clause is intended to cover the structures that perform the functions described herein, and not only structural equivalents but also equivalent structures. Other substitutions, modifications, changes and omissions may be made in the design, operating conditions and arrangement of the exemplary embodiments without departing from the scope of the present invention. Therefore, the present invention is not limited to specific embodiments, but extends to various modifications that still fall within the scope of the appended claims.

[0086] In addition, in order to provide a concise description of the exemplary embodiments, not all features of the actual embodiments may be described (i.e., those features that are not relevant to the currently considered best mode of implementing the present invention or those that are not relevant to the implementation of the present invention).

[0087] It should be understood that in the development of any actual implementation, as in any engineering or design project, a large number of specific implementation decisions may be made. Such development efforts may be complex and time-consuming, but for those of ordinary skill in the art who benefit from this disclosure, without excessive experimentation, the development efforts will be a routine task of design, manufacturing and production.

[0088] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit them. Although the present invention has been described in detail with reference to the preferred embodiments, those of ordinary skill in the art should understand that the technical solutions of the present invention can be modified or equivalently replaced without departing from the spirit and scope of the technical solutions of the present invention, and they should all be covered within the scope of the claims of the present invention.

Claims

1. A security debugging method for an embedded microprocessor, characterized in that Including: implanting a random module in the microprocessor, where the random module is used to output a chaotic sequence; If microprocessor data access is performed, a debug session is established, three types of physical characteristics are synchronously generated, a composite key is constructed, and a triple dynamic confusion layer is constructed inside the microprocessor, and the dynamic confusion layer and the composite key construct a physical logic linkage protection; Retrieving the logical address of the probe access instruction, if a physical intrusion is detected, the probe triggers an invisible checkpoint to verify the integrity of the execution environment, and if an abnormal debug is detected, a hardware defense mechanism is triggered; Establishing an access attack model, training and optimizing confusion parameters, and changing the module interconnection method through circuit reconstruction.

2. The security debugging method of the embedded microprocessor according to claim 1, characterized in that: The random module is used to output a random number sequence, and the random number sequence is converted into the chaotic sequence; The chaotic sequence is used to generate a dynamic key or a random number seed.

3. The security debugging method of the embedded microprocessor according to claim 2, characterized in that: The generation method of the chaotic sequence includes: The three types of physical characteristics include hardware fingerprint, environmental fingerprint and behavior fingerprint; The hardware fingerprint quantifies the physical characteristic parameters of the current chip through a deviation measurement circuit of the charge and discharge time of the memory unit; The environmental fingerprint captures the near-field radiation pattern caused by the contact of the debug probe through an on-chip electromagnetic sensor array, and combines the power supply ripple spectrum analysis to generate an environmental feature code; The behavior fingerprint statistically analyzes the timing entropy distribution of the debug instruction stream and extracts the microscopic jitter characteristics of the execution delay; Using a chaotic mapping algorithm to nonlinearly fuse the three types of physical characteristics to generate a dynamic composite key.

4. The security debugging method of the embedded microprocessor according to claim 3, characterized in that: The construction of the triple dynamic confusion layer includes: Deploying dynamic remapping logic in the instruction decoding stage, and real-time changing the mapping relationship between the operation code and the functional unit through a programmable microcode converter, so that the same machine code activates different physical execution paths in different debug sessions; The different physical execution paths are implanted with NOP instructions with pseudo-random distribution, and the insertion density is dynamically adjusted by the hash value of the debug session key, and invalid operation codes are inserted between the decoding pipeline levels to interfere with static disassembly; Integrating an impedance adjustable circuit at the memory bus driving end, dynamically adjusting the signal rise or fall time according to the lower 8 bits of the composite key, and injecting mask noise with variable amplitude into the data buffer; Inserting a voltage control delay unit into the different physical execution paths, and the delay amount is obtained according to the non-linear sequence generated by the chaotic mapping algorithm of the composite key; When the impedance monitoring network around the debug interface detects an abnormal contact impedance, it triggers the reorganization of the microcode mapping table of the instruction stream confusion layer.

5. The security debugging method of the embedded microprocessor according to claim 4, characterized in that: Adding intrusion response logic in the probe access stage, and the debug interface monitoring module real-time tracks the logical address mapping relationship of the debug instructions. When the access address deviates from the pre-stored whitelist, a secondary verification mechanism is triggered.

6. The security debugging method of the embedded microprocessor according to claim 5, characterized in that: The secondary verification mechanism adopts a three-stage trigger strategy, including: physical layer verification, execution environment verification, and instruction stream verification; The physical layer verification detects the probe contact pressure waveform through an electromagnetic sensor array and performs dynamic correlation analysis with the baseline data of the chip package stress sensor.

7. The security debugging method of the embedded microprocessor according to claim 6, characterized in that: The execution environment verification loads the reference hash tree in the trusted execution environment, performs memory traversal verification on the current debugger firmware, and completes the CRC64 verification of the code segment within 3 clock cycles by using an asynchronous verification mechanism; The instruction stream verification deploys a shadow state machine in the instruction parser, compares the actual instruction stream with the expected state transition path in real time, and injects a pseudo-response when an illegal state jump is detected.

8. The security debugging method of the embedded microprocessor according to claim 7, characterized in that: The access attack model is trained by collecting and extracting access attack data, inputs data access instructions in real time, identifies the power characteristics of the data access instructions by the trained access attack model, continuously adjusts the parameters of the access attack model through real-time data, and trains and optimizes the obfuscation parameters through the access attack model.

9. The security debugging method of the embedded microprocessor according to claim 1, characterized in that: The circuit reconstruction receives the power characteristics of the data access instructions output by the access attack model, performs a security assessment, and if the security assessment risk is abnormal, triggers the change of the module interconnection method; Reconstruct the circuit according to the preset interconnection scheme.

10. An embedded microprocessor for implementing the secure debugging method of the embedded microprocessor according to any one of claims 1-9, characterized in that, Including: A physically unclonable entropy source module constructs a resistor network array based on the random distribution of silicon substrate lattice defects, introduces uncontrollable lattice dislocations and point defects by controlling the doping concentration and annealing process, forms a nanoscale random conductive property variation region, integrates a metal-insulator-metal structure in the defect region, constitutes a random resistor network determined by the defect conduction path, measures the tunneling current by scanning voltage, and generates a physically unclonable chaotic sequence for generating dynamic keys or random number seeds; A multimodal physical feature fusion module is used to receive hardware fingerprints, environmental fingerprints, and behavior fingerprints, and nonlinearly fuse the features of the three types of fingerprints to generate a dynamic composite key; A triple dynamic obfuscation module modulates the impedance of the memory bus according to the composite key, dynamically adjusts the signal edge time, and injects mask noise with adjustable amplitude in the data buffer; An intrusion risk defense module detects physical intrusion through an electromagnetic sensor array and a chip stress sensor, and triggers a three-stage verification; An adaptive security optimization module collects the power characteristics of access instructions in real time, optimizes the obfuscation parameters through the access attack model, and changes the module interconnection method according to the real-time system security assessment results.

Images