Hardware copyboard system and method based on FPGA and external IO module

Abstract

The application discloses a kind of hardware copy-preventing board system and method based on FPGA and external IO module, and the hardware copy-preventing board system and method in this method are authenticated to each other by using hash algorithm, and no true random number unit and encryption engine need to be set on FPGA master module, which can greatly reduce the design difficulty and design cost of FPGA master module, and this copy-preventing board system does not need to store the specific information of IO module in FPGA master module, has no special requirements for IO module, and has good versatility, which can meet the design requirements of different types of FPGA master module and external IO module for hardware copy-preventing board.

Description

Technical Field

[0001] This invention relates to the field of circuit hardware protection technology, and in particular to a method and system for preventing the reverse engineering of FPGA external I / O module hardware. Background Technology

[0002] Many existing hardware systems typically consist of a main control module and an I / O module. The main control module contains devices with logic operation and control capabilities, such as a CPU, MCU, DSP, and FPGA. The I / O module acts as a bridge between the external system and the main control module, responsible for data acquisition, conversion, and communication. The I / O module and the main control module are connected via a PCB, connectors, or cables. For hardware circuit protection, a common method is mutual authentication between the main control module and the encryption chip. Using this mutual authentication method to protect the hardware system requires meeting one or more of the following preconditions:

[0003] 1) The main control module and the encryption chip are on the same PCB;

[0004] 2) The main control module has a true random number generation function;

[0005] 3) The main control module and encryption chip need to support symmetric encryption algorithms such as AES or asymmetric encryption algorithms such as RSA;

[0006] 4) The main control module needs to store certain information from the I / O module.

[0007] A common hardware system currently uses an FPGA as the main controller module, exposing predefined I / O pin specifications. The I / O modules are designed according to these specifications, and the FPGA main controller module and the I / O modules are connected via cables or connectors to jointly complete the user's business logic. In this type of hardware system, the I / O modules are located externally to the FPGA main controller module, and the FPGA main controller module and the I / O modules are connected via cables or connectors, not on the same PCB, making them vulnerable to man-in-the-middle attacks. Furthermore, this type of FPGA main controller module itself does not contain a true random number generator and encryption engine, requiring third-party IP licensing or self-implementation, resulting in high implementation costs and technical difficulties. Additionally, the FPGA main controller module and the I / O modules are often not manufactured by the same company, the FPGA main controller module and the I / O modules are not a fixed pair, and the FPGA main controller module does not store I / O module-specific information.

[0008] It is evident that this hardware system is unlikely to meet any of the four prerequisites for mutual authentication between the main control module and the encryption chip. Existing anti-copying methods for this hardware system are difficult to meet the anti-copying requirements. Therefore, it is necessary to design an anti-copying system and method specifically for this hardware system that uses FPGA as the main control module and external I / O modules. Summary of the Invention

[0009] The technical problem to be solved by the present invention is to provide an anti-copying system and method specifically for FPGA main control modules and IO modules that are externally connected, where the FPGA main control module and IO module are not fixedly paired hardware systems, thus addressing the shortcomings of the prior art.

[0010] A hardware anti-copying system based on FPGA and external I / O module includes an FPGA main control module and an I / O module equipped with an encryption chip. The FPGA main control module includes a bit file storage unit, a pseudo-random number unit, a first verification code generation unit, and a verification code verification unit. The bit file storage unit is used to store firmware keys. The pseudo-random number unit is used to generate pseudo-random numbers using the FPGA controller's serial number as a seed value and send them to the I / O module. The first verification code generation unit is used to read the first true random number sent by the I / O module and use a hash algorithm to convert the data group composed of the pseudo-random number, the first true random number, and the firmware key into a first verification code. The verification code verification unit reads the second verification code sent by the I / O module and determines whether the first verification code and the second verification code are the same. The encryption chip includes a true random number unit, a verification key storage unit, and a second verification code generation unit. The true random number unit generates the first true random number and sends it to the FPGA main control module. The verification key storage unit is used to store verification keys. The second verification code generation unit reads the pseudo-random number and uses a hash algorithm to convert the data group composed of the pseudo-random number, the first true random number, and the verification key into a second verification code and sends it to the FPGA main control module.

[0011] Preferably, the encryption chip includes a plaintext area and a ciphertext area, and the verification key storage unit is disposed in the ciphertext area.

[0012] Preferably, the FPGA main control module further includes a first read key generation unit and a read parameter decryption unit; the first read key generation unit is used to read the second true random number sent by the IO module, and use a hash algorithm to convert the data group composed of the pseudo random number, the second true random number, and the firmware key into a first read key; the read parameter decryption unit is used to perform an XOR operation on the encrypted read parameters to be read from the IO module and the first read key to restore the encrypted read parameters to the original read parameters; the encryption chip further includes a second read key generation unit and a read parameter encryption unit; the true random number unit generates a second true random number and sends it to the FPGA main control module; the second read key generation unit is used to read the pseudo random number sent by the FPGA main control module and use a hash algorithm to convert the data group composed of the pseudo random number, the second true random number, and the verification key into a second read key; the read parameter encryption unit is used to perform an XOR operation on the original read parameters to be read by the FPGA main control module and the second read key to generate encrypted read parameters and send them to the FPGA main control module.

[0013] Preferably, the FPGA main control module further includes a first write key generation unit, a write parameter encryption unit, and a third verification code generation unit; the first write key generation unit is used to read the third true random number sent by the IO module, and use a hash algorithm to convert the data group composed of the pseudo random number, the third true random number, and the firmware key into a first write key; the write parameter encryption unit is used to perform an XOR operation on the original write parameters and the first write key to generate encrypted write parameters and send them to the encryption chip of the IO module; the third verification code generation unit is used to use a hash algorithm to convert the data group composed of the original write parameters and the first write key into a third verification code and send it to the encryption chip; the encryption chip further includes a second write key generation unit, a write parameter decryption unit, and a fourth verification code generation unit. The system comprises a writing parameter verification unit and a writing parameter generation unit; the true random number unit generates a third true random number and sends it to the FPGA main control module; the second writing key generation unit reads the pseudo-random number sent by the FPGA main control module and uses a hash algorithm to convert the data group composed of the pseudo-random number, the third true random number, and the verification key into a second writing key; the writing parameter decryption unit performs an XOR operation on the encrypted writing parameters sent by the FPGA main control module and the second writing key to restore the encrypted writing parameters to the original writing parameters; the fourth verification code generation unit uses a hash algorithm to convert the data group composed of the original writing parameters and the second writing key into a fourth verification code; and the writing parameter verification unit compares whether the third verification code and the fourth verification code are the same.

[0014] Preferably, the FPGA main control module further includes an FPGA serial number reading unit, which is used to read the serial number of the FPGA controller on the FPGA main control module and send it to the pseudo-random number unit.

[0015] This invention also discloses a hardware anti-copying method based on FPGA and external I / O module. The hardware includes an FPGA main control module and an I / O module equipped with an encryption chip. The hardware anti-copying method includes the following steps:

[0016] S11. Load the bit file into the FPGA main control module through the application program, configure the FPGA controller, and the bit file contains the firmware key.

[0017] S12. The FPGA main control module generates a pseudo-random number using the FPGA controller's serial number as the seed value and sends it to the encryption chip.

[0018] S13. The encryption chip generates a first true random number and sends the first true random number to the FPGA main control module;

[0019] S14. The FPGA main control module uses a hash algorithm to convert the data group consisting of the pseudo-random number, the first true random number, and the firmware key into the first check code.

[0020] S15. The encryption chip uses a hash algorithm to convert the data group consisting of a pseudo-random number, a first true random number, and a verification key into a second verification code.

[0021] S16. Compare the first check code with the second check code. If they are equal, the authentication is successful and the IO module is genuine. If they are not equal, the authentication fails and the FPGA main control module stops working.

[0022] Preferably, after the IO module is authenticated, the FPGA main control module reads the parameters from the IO module, including the following steps:

[0023] S21. The FPGA main control module generates a pseudo-random number using the FPGA controller's serial number as the seed value and sends it to the encryption chip.

[0024] S22. The encryption chip generates a second true random number and sends the second true random number to the FPGA main control module;

[0025] S23. The FPGA main control module uses a hash algorithm to convert the data group composed of pseudo-random number, second true random number and firmware key into first reading key;

[0026] S24. The encryption chip uses a hash algorithm to convert the data group consisting of a pseudo-random number, a second true random number, and a verification key into a second reading key.

[0027] S25. The encryption chip performs an XOR operation between the original reading parameters to be read by the FPGA main control module and the second reading key to generate encrypted reading parameters and sends them to the FPGA main control module.

[0028] S26. The FPGA main control module performs an XOR operation between the encrypted reading parameters and the first reading key to restore the original reading parameters.

[0029] Preferably, after the IO module is authenticated, the FPGA main control module writes parameters to the IO module, including the following steps:

[0030] S31. The FPGA main control module generates a pseudo-random number using the FPGA controller's serial number as the seed value and sends it to the encryption chip.

[0031] S32. The encryption chip generates a third true random number and sends the third true random number to the FPGA main control module;

[0032] S33, the FPGA main control module uses a hash algorithm to convert the data group composed of pseudo-random number, third true random number and firmware key into first write key;

[0033] S34. The FPGA main control module performs an XOR operation between the original write parameters to be written and the first write key to generate encrypted write parameters, and sends them to the encryption chip.

[0034] S35, the FPGA main control module uses a hash algorithm to convert the data group consisting of the original write parameters and the first write key into a third check code;

[0035] S36. The encryption chip uses a hash algorithm to convert the data group consisting of a pseudo-random number, a third true random number, and a verification key into a second write key.

[0036] S37. The encryption chip performs an XOR operation between the read encryption write parameters and the second write key to restore the encryption write parameters to the original write parameters.

[0037] S38. The encryption chip uses a hash algorithm to convert the data group consisting of the original write parameters and the second write key into a fourth check code.

[0038] S39. Compare whether the third check code and the fourth check code are the same. If they are the same, write the original write parameter to the specified location of the encryption chip.

[0039] Preferably, the hash algorithm used in steps S14 and S15 is the SHA-256 hash algorithm.

[0040] The present invention has the following beneficial effects: the hardware anti-copying system and method based on FPGA and external IO module uses a hash algorithm to realize mutual authentication between the FPGA main control module and the external IO module. There is no need to set a true random number unit and encryption engine on the FPGA main control module, which can greatly reduce the design difficulty and design cost of the FPGA main control module. Moreover, this anti-copying system does not need to store specific information of the IO module in the FPGA main control module, has no special requirements for the IO module, has good versatility, and can meet the anti-copying design requirements of hardware composed of different types of FPGA main control modules and external IO modules. Attached Figure Description

[0041] Figure 1 This is a system block diagram of an example of an anti-copying system in the hardware authentication state.

[0042] Figure 2 This is a flowchart of the hardware authentication method for the anti-copying system according to Embodiment 1 of the present invention.

[0043] Figure 3 This is a system block diagram of the anti-copying board system reading parameters according to Embodiment 2 of the present invention.

[0044] Figure 4 This is a flowchart of the method for reading parameters in the anti-copying board system according to Embodiment 2 of the present invention.

[0045] Figure 5 This is a system block diagram of the anti-copying system in Embodiment 3 of the present invention when writing parameters.

[0046] Figure 6 This is a flowchart of the method for writing parameters to the anti-copying system in Embodiment 3 of the present invention. Detailed Implementation

[0047] The following specific embodiments illustrate the implementation methods disclosed in this invention. Those skilled in the art can understand the advantages and effects of this invention from the content disclosed in this specification. This invention can be implemented or applied through other different specific embodiments, and various details in this specification can also be modified and changed based on different viewpoints and applications without departing from the concept of this invention. Furthermore, the accompanying drawings of this invention are for simple illustrative purposes only and are not depictions of actual dimensions; this is stated beforehand. The following embodiments will further describe the relevant technical content of this invention in detail, but the disclosed content is not intended to limit the scope of protection of this invention.

[0048] It should be understood that while terms such as "first" and "second" may be used in this document to describe various components or signals, these components or signals should not be limited by these terms. These terms are primarily used to distinguish one component from another, or one signal from another. Furthermore, the term "or" as used herein should, as appropriate, include any combination of one or more of the related listed items. Example

[0049] like Figure 1 As shown, the hardware anti-copying system based on FPGA and external IO module includes two parts: FPGA main control module 1 and external IO module 2. FPGA main control module 1 and IO module 2 are connected by cable or plug-in. Data transmission and communication can be performed between FPGA main control module 1 and IO module 2. IO module 2 is equipped with an encryption chip. FPGA main control module 1 is equipped with an FPGA controller. FPGA main control module 1 and IO module 2 form a hardware system.

[0050] The FPGA main control module 1 includes a bit file storage unit 11, an FPGA serial number reading unit 12, a pseudo-random number unit 13, a first verification code generation unit 14, and a verification code verification unit 15. The bit file storage unit 11 is used to download and store bit files. It connects to an external system via a system bus, loads the bit file into the FPGA main control module via the system bus, and configures the FPGA main control module's functions. The bit file contains a firmware key, Pkey1. The FPGA serial number reading unit 12 reads the serial number of the FPGA controller on the FPGA main control module. This serial number is globally unique. The FPGA serial number reading unit 12 is connected to the pseudo-random number unit 13. The serial number of the FPGA controller read by the FPGA serial number reading unit 12 is sent to the pseudo-random number unit 13. The pseudo-random number unit 13 uses this serial number as a seed value to generate a pseudo-random number, random1, and sends it to the encryption chip of the IO module 2.

[0051] The first verification code generation unit 14 is used to read the first true random number random2 sent by the IO module 2, and use a hash algorithm to convert the data group (random1, random2, Pkey1) composed of the pseudo random number, the first true random number, and the firmware key into the first verification code MAC1. The verification code verification unit 15 is used to read the second verification code MAC2 sent by the IO module 2, and compare whether the first verification code MAC1 and the second verification code MAC2 are the same.

[0052] The encryption chip of IO module 2 includes a true random number unit 21, a verification key storage unit 22, and a second verification code generation unit 23. The true random number unit 21 generates true random numbers and sends them to the FPGA main control module 1. Each time the true random number unit 21 generates a different true random number, during verification, it generates the first true random number, random2. The verification key storage unit 22 stores the verification key Pkey2. For genuine IO modules, the verification key Pkey2 has the same value as the firmware key Pkey1. The verification key Pkey2 is directly burned into the ciphertext area of ​​the encryption chip during production. The encryption chip's storage area is divided into a plaintext area and a ciphertext area. The plaintext area stores publicly available information such as the manufacturer's name, product name, product serial number, and product version number. This information is burned into the chip during production and can only be read, not modified. The ciphertext area stores confidential information such as the verification key and product parameters. This information is burned into the chip during production. The verification key cannot be read from outside the chip and is only used internally; the product parameters can be read and written encrypted.

[0053] The second verification code generation unit 23 reads the pseudo-random number random1 sent by the FPGA main control module and uses a hash algorithm to convert the data group (random1, random2, Pkey2) consisting of the pseudo-random number, the first true random number, and the verification key into a second verification code MAC2. The hash algorithm used by the second verification code generation unit 23 is exactly the same as the hash algorithm used by the first verification code generation unit 14. The second verification code generation unit 23 is communicatively connected to the verification code verification unit 15 of the FPGA main control module 1 and sends the value of the second verification code MAC2 to the verification code verification unit 15.

[0054] As a preferred implementation, the first verification code generation unit 14 and the second verification code generation unit 23 use the SHA-256 hash algorithm. The SHA-256 hash algorithm is a digital digest algorithm that can generate a 256-bit hash value based on plaintext of any length. With this algorithm, different plaintexts generate different hash values, the probability of collision is extremely low, and even slight changes in the plaintext will cause significant changes in the hash value. It is also impossible to deduce the plaintext content from the hash value. Therefore, it has a very good confidentiality effect. The SHA-256 hash algorithm is easy to design and implement in FPGA controllers, and the corresponding encryption chip cost is also relatively low.

[0055] like Figure 2 As shown, the anti-copying method of this hardware anti-copying system adopts the following specific steps during authentication:

[0056] S11. The application loads the bit file into the FPGA bit file storage unit 11 of the FPGA main control module through the data bus, and configures the FPGA controller. The bit file contains the firmware key Pkey1.

[0057] S12, FPGA serial number reading unit 12 reads the serial number of the FPGA controller on the FPGA main control module and sends it to the pseudo-random number unit 13. The pseudo-random number unit 13 generates a pseudo-random number random1 with the serial number as the seed value and sends it to the IO module 2.

[0058] S13. The encryption chip generates a first true random number random2 through the true random number unit 21 and sends the first true random number random2 to the FPGA main control module 1.

[0059] S14, the first verification code generation unit 14 of the FPGA main control module uses a hash algorithm to convert the data group (random1, random2, Pkey1) composed of pseudo-random number, first true random number and firmware key into first verification code MAC1;

[0060] S15. The second verification code generation unit 23 of the encryption chip uses a hash algorithm to convert the data group (random1, random2, Pkey2) consisting of pseudo-random number, first true random number, and verification key into the second verification code MAC2.

[0061] S16. The verification code verification unit 15 of the FPGA main control module compares the first verification code MAC1 with the second verification code MAC2. If they are equal, the IO module 2 passes the authentication and is genuine. The FPGA main control module 1 and the IO module 2 can proceed to the next step of data transmission. If they are not equal, the IO module 2 fails the authentication and is judged to be potentially pirated. The FPGA main control module 1 stops working and no longer transmits data with the IO module, thereby achieving the purpose of preventing PCB copying. Example

[0062] like Figure 3 As shown, to prevent information leakage and board copying during parameter reading from the FPGA main control module of the IO module, the FPGA main control module 1 is supplemented with a first reading key generation unit 17 and a reading parameter decryption unit 18 based on Embodiment 1. The first reading key generation unit 17 is used to read the second true random number random3 sent by the IO module 2, and use a hash algorithm to convert the data group (random1, random3, Pkey1) composed of the pseudo random number, the second true random number, and the firmware key into the first reading key SessionKey1. The reading parameter decryption unit 18 is used to perform an XOR operation between the encrypted reading parameter cipher1 read from the IO module 2 and the first reading key SessionKey1 to restore it to the original reading parameter Func1.

[0063] The encryption chip of IO module 2 adds a second read key generation unit 25 and a read parameter encryption unit 26; the second read key generation unit 25 is used to read the pseudo-random number random1 sent by FPGA main control module 1 and use a hash algorithm to convert the data group (random1, random3, Pkey2) composed of pseudo-random number, second true random number and verification key into the second read key SessionKey2; the read parameter encryption unit 26 is used to perform an XOR operation between the original read parameter Func1 to be read by FPGA main control module and the second read key SessionKey2 to generate the encrypted read parameter cipher1.

[0064] like Figure 4 As shown, when the FPGA main control module 1 needs to read parameters from the IO module 2, the hardware anti-copying system employs the following steps:

[0065] S21. The pseudo-random number unit 13 of the FPGA main control module generates a pseudo-random number random1 using the serial number of the FPGA controller as the seed value and sends it to the encryption chip of the IO module 2.

[0066] S22. The true random number unit 21 of the encryption chip generates a second true random number random3 and sends the second true random number random3 to the FPGA main control module 1.

[0067] S23, the first reading key generation unit 17 of the FPGA main control module uses a hash algorithm to convert the data group (random1, random3, Pkey1) composed of pseudo-random number, second true random number and firmware key into the first reading key SessionKey1;

[0068] S24. The second reading key generation unit 25 of the encryption chip reads the pseudo-random number random1 sent by the FPGA main control module 1, and uses a hash algorithm to convert the data group (random1, random3, Pkey2) composed of the pseudo-random number, the second true random number, and the verification key into the second reading key SessionKey2.

[0069] S25. The encryption unit 26 performs an XOR operation on the original reading parameter Func1 that the FPGA main control module wants to read from the IO module and the second reading key SessionKey2 to generate the encrypted reading parameter cipher1, and sends it to the FPGA main control module.

[0070] S26. The reading parameter decryption unit 18 of the FPGA main control module performs an XOR operation on the encrypted reading parameter cipher1 and the first reading key SessionKey1 to restore it to the original reading parameter Func1. In this way, the FPGA main control module can complete the reading of parameters from the IO module.

[0071] The hash algorithm used in the above methods is the same SHA-256 hash algorithm. Using this method, when the FPGA main control module 1 reads parameters from the IO module 2, the read parameters are transmitted in an encrypted format, effectively preventing man-in-the-middle attacks and thus achieving better anti-copying effects. Example

[0072] like Figure 5As shown, to prevent information leakage and board copying during the writing of parameters to the IO module by the FPGA main control module, the FPGA main control module 1, based on Embodiment 1, adds a first writing key generation unit 19, a writing parameter encryption unit 31, and a third verification code generation unit 32. The first writing key generation unit 19 reads the third true random number random4 sent by the IO module and uses a hash algorithm to convert the data group (random1, random4, Pkey1) composed of the pseudo-random number, the third true random number, and the firmware key into a first writing key SessionKey3. The writing parameter encryption unit 31 performs an XOR operation between the original writing parameter Func2 to be written to the IO module and the first writing key SessionKey3 to generate an encrypted writing parameter cipher2, and sends this encrypted writing parameter cipher2 to the encryption chip; the third verification code generation unit 32 uses a hash algorithm to convert the data group (Func2, SessionKey3) composed of the original writing parameter and the first writing key into a third verification code MAC3 and sends it to the encryption chip of the IO module 2.

[0073] The encryption chip adds a second write key generation unit 27, a write parameter decryption unit 28, a fourth verification code generation unit 29, and a write parameter verification unit 30. The second write key generation unit 27 reads the pseudo-random number random1 sent by the FPGA main control module and uses a hash algorithm to convert the data group (random1, random4, Pkey2) composed of the pseudo-random number, the third true random number, and the verification key into the second write key SessionKey4. The write parameter decryption unit 28 performs an XOR operation between the encrypted write parameter cipher2 sent by the FPGA main control module 1 and the second write key SessionKey2, restoring the encrypted write parameter cipher2 back to the original write parameter Func2. The fourth verification code generation unit 29 uses a hash algorithm to convert the data group (Func2, SessionKey4) composed of the original write parameter and the second write key into the fourth verification code MAC4. The write parameter verification unit 30 is used to read the third verification code MAC3 sent by the FPGA main control module and compare whether the third verification code MAC3 and the fourth verification code MAC4 are the same. If they are the same, the original write parameter Func2 is written to the specified storage location in the encryption chip.

[0074] like Figure 6 As shown, when the FPGA main control module 1 needs to write parameters into the IO module 2, the hardware anti-copying system includes the following steps:

[0075] S31. The pseudo-random number unit 13 of the FPGA main control module 1 generates a pseudo-random number random1 using the serial number of the FPGA controller as the seed value and sends it to the encryption chip of the IO module 2.

[0076] S32. The true random number unit 21 of the encryption chip generates a third true random number random4 and sends the third true random number random4 to the FPGA main control module 1.

[0077] S33, the first write key generation unit 19 of the FPGA main control module uses a hash algorithm to convert the data group (random1, random4, Pkey1) composed of pseudo-random number, third true random number and firmware key into the first write key SessionKey3.

[0078] S34. The FPGA main control module's write parameter encryption unit 31 performs an XOR operation between the original write parameter Func2 to be written to the IO module and the first write key SessionKey3 to generate an encrypted write parameter cipher2, and sends the encrypted write parameter cipher2 to the encryption chip.

[0079] S35, the third verification code generation unit 32 of the FPGA main control module uses a hash algorithm to convert the data group (Func2, SessionKey3) composed of the original writing parameters and the first writing key into the third verification code MAC3, and sends it to the encryption chip;

[0080] S36. The second write key generation unit 27 of the encryption chip reads the pseudo-random number random1 sent by the FPGA main control module and uses a hash algorithm to convert the data group (random1, random4, Pkey2) composed of the pseudo-random number, the third true random number, and the verification key into the second write key SessionKey4.

[0081] S37. The encryption chip's write parameter decryption unit 28 performs an XOR operation between the encrypted write parameter cipher2 sent by the FPGA main control module 1 and the second write key SessionKey4, and restores the encrypted write parameter cipher2 to the original write parameter Func2.

[0082] S38, the fourth verification code generation unit 29 of the encryption chip uses a hash algorithm to convert the data group (Func2, SessionKey4) composed of the original writing parameters and the second writing key into the fourth verification code MAC4;

[0083] S39. The encryption chip write parameter verification unit 30 reads the third verification code MAC3 sent by the FPGA main control module and compares whether the third verification code MAC3 and the fourth verification code MAC4 are the same. If they are the same, the original write parameter Func2 is written to the specified storage location in the encryption chip. If they are different, an error message is sent.

[0084] By employing the above method, the FPGA main control module 1 transmits data to the IO module 2 using an encrypted format during the parameter writing process. Simultaneously, a calibration unit is set up to further calibrate the written parameters, effectively preventing man-in-the-middle attacks and thus achieving better anti-copying performance. To further prevent errors in the written parameters, the FPGA main control module 1 can also read the written parameters using the aforementioned parameter reading method and determine whether they match the required written parameters.

[0085] As a preferred implementation, in this embodiment, each unit in Embodiment 2 can also be integrated into Embodiment 3, so that the purpose of preventing copying can be achieved during parameter reading and writing.

[0086] This hardware anti-copying system and method based on FPGA and external I / O modules uses a hash algorithm to achieve mutual authentication between the FPGA main control module and the external I / O module. The FPGA main control module does not need to set up a true random number unit and encryption engine, which can significantly reduce the design difficulty and design cost of the FPGA main control module. Moreover, this anti-copying system does not need to store specific information of the I / O module in the FPGA main control module, has no special requirements for the I / O module, has good versatility, and can meet the anti-copying design requirements of hardware composed of different types of FPGA main control modules and external I / O modules.

[0087] The content disclosed above is only a preferred and feasible embodiment of the present invention, and is not intended to limit the scope of the patent application of the present invention. Therefore, all equivalent technical changes made using the contents of the present invention specification and drawings are included in the scope of the patent application of the present invention.

Claims

1. A hardware anti-copying system based on FPGA and external I / O module, comprising an FPGA main control module and an I / O module equipped with an encryption chip, characterized in that: The FPGA main control module includes a bit file storage unit, a pseudo-random number unit, a first verification code generation unit, and a verification code verification unit; the bit file storage unit is used to store firmware keys; the pseudo-random number unit is used to generate pseudo-random numbers using the FPGA controller's serial number as a seed value and send them to the IO module; The first verification code generation unit is used to read the first true random number sent by the IO module and use a hash algorithm to convert the data group composed of the pseudo random number, the first true random number, and the firmware key into the first verification code. The verification code verification unit is used to read the second verification code sent by the IO module and determine whether the first verification code and the second verification code are the same. The encryption chip includes a true random number unit, a verification key storage unit, and a second verification code generation unit; The true random number unit is used to generate a first true random number and send it to the FPGA main control module; The verification key storage unit is used to store the verification key; The second verification code generation unit reads the pseudo-random number and uses a hash algorithm to convert the data group consisting of the pseudo-random number, the first true random number, and the verification key into a second verification code, which is then sent to the FPGA main control module.

2. The hardware anti-copying system based on FPGA and external I / O module according to claim 1, characterized in that, The FPGA main control module also includes a first reading key generation unit and a reading parameter decryption unit; The first read key generation unit is used to read the second true random number sent by the IO module, and use a hash algorithm to convert the data group composed of the pseudo random number, the second true random number, and the firmware key into the first read key; The read parameter decryption unit is used to perform an XOR operation between the encrypted read parameters to be read from the IO module and the first read key to restore the encrypted read parameters to the original read parameters. The encryption chip also includes a second read key generation unit and a read parameter encryption unit; The true random number unit generates a second true random number and sends it to the FPGA main control module; the second read key generation unit is used to read the pseudo random number sent by the FPGA main control module and use a hash algorithm to convert the data group composed of the pseudo random number, the second true random number, and the verification key into a second read key; The read parameter encryption unit is used to perform an XOR operation between the original read parameters to be read by the FPGA main control module and the second read key to generate encrypted read parameters and send them to the FPGA main control module.

3. The hardware anti-copying system based on FPGA and external I / O module according to claim 1, characterized in that, The FPGA main control module also includes a first write key generation unit, a write parameter encryption unit, and a third verification code generation unit. The first write key generation unit is used to read the third true random number sent by the IO module and use a hash algorithm to convert the data group composed of the pseudo random number, the third true random number, and the firmware key into the first write key; The write parameter encryption unit is used to perform an XOR operation between the original write parameters and the first write key to generate encrypted write parameters and send them to the encryption chip of the IO module. The third verification code generation unit is used to convert the data group consisting of the original writing parameters and the first writing key into a third verification code using a hash algorithm and send it to the encryption chip. The encryption chip also includes a second write key generation unit, a write parameter decryption unit, a fourth verification code generation unit, and a write parameter verification unit; The true random number unit generates a third true random number and sends it to the FPGA main control module; the second write key generation unit is used to read the pseudo random number sent by the FPGA main control module and use a hash algorithm to convert the data group composed of the pseudo random number, the third true random number, and the verification key into a second write key; The write parameter decryption unit is used to perform an XOR operation between the encrypted write parameters sent by the FPGA main control module and the second write key to restore the encrypted write parameters to the original write parameters. The fourth verification code generation unit is used to convert the data group consisting of the original writing parameters and the second writing key into a fourth verification code using a hash algorithm. A write parameter verification unit is used to compare whether the third check code and the fourth check code are the same.

4. The hardware anti-copying system based on FPGA and external I / O module according to claim 1, characterized in that, The FPGA main control module also includes an FPGA serial number reading unit, which is used to read the serial number of the FPGA controller on the FPGA main control module and send it to the pseudo-random number unit.

5. The hardware anti-copying system based on FPGA and external I / O module according to claim 1, characterized in that, The encryption chip includes a plaintext area and a ciphertext area, and the verification key storage unit is located in the ciphertext area.

6. A hardware anti-copying method based on FPGA and external I / O module, the hardware comprising an FPGA main control module and an I / O module equipped with an encryption chip, characterized in that, The hardware anti-copying method includes the following steps: S11. Load the bit file into the FPGA main control module through the application program, configure the FPGA controller, and the bit file contains the firmware key. S12. The FPGA main control module generates a pseudo-random number using the FPGA controller's serial number as the seed value and sends it to the encryption chip. S13. The encryption chip generates a first true random number and sends the first true random number to the FPGA main control module; S14. The FPGA main control module uses a hash algorithm to convert the data group consisting of the pseudo-random number, the first true random number, and the firmware key into the first check code. S15. The encryption chip uses a hash algorithm to convert the data group consisting of a pseudo-random number, a first true random number, and a verification key into a second verification code. S16. Compare the first check code with the second check code. If they are equal, the authentication is successful and the IO module is genuine. If they are not equal, authentication will fail.

7. The hardware anti-copying board method based on FPGA and external I / O module according to claim 6, characterized in that, After the IO module is authenticated, the FPGA main control module reads the parameters from the IO module through the following steps: S21. The FPGA main control module generates a pseudo-random number using the FPGA controller's serial number as the seed value and sends it to the encryption chip. S22. The encryption chip generates a second true random number and sends the second true random number to the FPGA main control module; S23. The FPGA main control module uses a hash algorithm to convert the data group composed of pseudo-random number, second true random number and firmware key into first reading key; S24. The encryption chip uses a hash algorithm to convert the data group consisting of a pseudo-random number, a second true random number, and a verification key into a second reading key. S25. The encryption chip performs an XOR operation between the original reading parameters to be read by the FPGA main control module and the second reading key to generate encrypted reading parameters and sends them to the FPGA main control module. S26. The FPGA main control module performs an XOR operation between the encrypted reading parameters and the first reading key to restore the original reading parameters.

8. The hardware anti-copying board method based on FPGA and external I / O module according to claim 6, characterized in that, After the IO module is authenticated, the FPGA main control module writes parameters to the IO module, including the following steps: S31. The FPGA main control module generates a pseudo-random number using the FPGA controller's serial number as the seed value and sends it to the encryption chip. S32. The encryption chip generates a third true random number and sends the third true random number to the FPGA main control module; S33, the FPGA main control module uses a hash algorithm to convert the data group composed of pseudo-random number, third true random number and firmware key into first write key; S34. The FPGA main control module performs an XOR operation between the original write parameters to be written and the first write key to generate encrypted write parameters, and sends them to the encryption chip. S35, the FPGA main control module uses a hash algorithm to convert the data group consisting of the original write parameters and the first write key into a third verification code, and sends it to the encryption chip; S36. The encryption chip uses a hash algorithm to convert the data group consisting of a pseudo-random number, a third true random number, and a verification key into a second write key. S37. The encryption chip performs an XOR operation between the read encryption write parameters and the second write key to restore the encryption write parameters to the original write parameters. S38. The encryption chip uses a hash algorithm to convert the data group consisting of the original write parameters and the second write key into a fourth check code. S39. Compare whether the third check code and the fourth check code are the same. If they are the same, write the original write parameter to the specified location of the encryption chip.

9. The hardware anti-copying method based on FPGA and external I / O module according to claim 6, characterized in that: The hash algorithm used in steps S14 and S15 is the SHA-256 hash algorithm.

Images