Anti-attack method and device for security element
By dynamically allocating a secure memory heap RAM region on the ARMv7-M architecture processor as the PSP stack and combining it with hardware random number generation and MPU protection, the problem of easy attacks on user programs is solved, and the system security and anti-attack capability are improved.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-08-28
- Publication Date
- 2026-03-10
AI Technical Summary
On ARMv7-M architecture processors, user programs use a single fixed PSP or MSP, which is vulnerable to error injection attacks, leading to stack overflows and corruption of critical data, and lacks effective protection measures.
When a user application calls a security-related function, an interrupt is triggered by the SVC instruction to dynamically allocate a RAM region in the secure memory heap as the PSP stack and randomize its location. Combined with hardware random numbers and MPU protection, this ensures that only privileged users can access it.
It improves the system's resistance to attacks, increases the difficulty for attackers to disrupt the stack, and reduces the success rate of attacks, especially against laser attacks.
Smart Images
Figure CN121637518A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of data security technology, and in particular to a method and apparatus for preventing attacks on security components. Background Technology
[0002] Taking the ARMv7-M architecture as an example, there are two stack pointers (SP): a default main stack pointer (MSP or SP_main) and a process stack pointer (PSP or SP_process). However, at any given time, register R13 will only map to one of them. The MSP is mainly used by the OS kernel, interrupt and exception service routines, while the PSP is generally only used by applications to ensure secure isolation between the system and applications.
[0003] The settings of MSP and PSP are controlled by the SPSEL bit (bit[1]) of the control register in the System Control Space (SCS).
[0004] refer to Figure 1 After power-on reset, the ARM processor defaults to privileged level and uses the MSP (Multi-Level Service). The system initializes; the processor executes the operating system using the MSP in privileged level; the application program is called, downgrading the processor's access level to user level and setting it to use the PSP (Power-On Service), then begins executing the user program; the processor executes the user program using the PSP in user level; when an exception or external interrupt occurs and is enabled, the processor first automatically pushes the status information of the currently interrupted function onto the PSP stack, then switches to privileged level, sets it to use the MSP, and retrieves the entry address of the corresponding interrupt service routine from the interrupt vector table to begin execution; the processor executes the interrupt service routine using the MSP in privileged level; after the interrupt service routine finishes execution, the processor automatically restores the saved status information of the interrupted function based on the value of EXC_RETURN, and switches back to user level to continue executing the user program using the PSP; after the application program finishes execution, the processor is restored to privileged level, and the operating system continues to execute using the MSP; the operating system continues to execute using the MSP.
[0005] However, existing technical solutions have the following shortcomings: user programs use a single fixed PSP, or even share an MSP with the operating system, making them vulnerable to error injection attacks, which can cause stack overflows, stack data corruption, and other problems; user programs do not have different levels, and critical sensitive data is not specially protected. Summary of the Invention
[0006] Based on the above analysis, embodiments of the present invention aim to provide a method and apparatus for preventing attacks on secure elements, in order to address the problem that in existing ARMv7-M architecture processors, the operating system and interrupt service routines use MSPs, while user programs use either MSPs or PSPs. Although user programs can use PSPs to isolate stack data between the operating system and the user program, there is a lack of effective means to protect critical data and operations in the application.
[0007] On one hand, embodiments of the present invention provide a method for preventing attacks on a security element, comprising: when a user application calls a security-related function, triggering an interrupt according to an SVC instruction and determining the security-related function to be called according to the SVC instruction; obtaining a hardware random number and dynamically allocating RAM from a secure memory heap as a dynamic PSP stack according to the hardware random number, wherein the PSP stack is a process stack pointer PSP stack; modifying the value of a PSP register according to the initial address of the dynamic PSP stack to switch the original PSP stack to the dynamic PSP stack; and directly calling the security-related function according to the value of the PSP register and exiting the interrupt to continue executing the user application.
[0008] The beneficial effects of the above technical solution are as follows: Critical operations in user applications no longer use PSP or MSP, but instead dynamically allocate a RAM region from the security function's memory heap as the PSP (referred to as a dynamic PSP stack), which improves the system's resistance to attacks. The dynamic PSP stack can randomize the stack position for each secure function call, making it impossible for attackers to determine the exact location of the stack. This increases the difficulty for attackers to destroy the stack using laser attacks, reducing the success rate of system attacks.
[0009] A further improvement to the above method, triggering an interrupt based on the SVC instruction and determining the security-related function to be called based on the SVC instruction, further includes: actively triggering an SVC interrupt using the SVC instruction of the ARM processor and providing the SVC interrupt signal to the nested vector interrupt controller (NVIC); after receiving the SVC interrupt signal, the NVIC automatically obtains the entry address of the SVC interrupt service routine from the interrupt vector table and begins executing the interrupt service routine; and obtains the service function number passed in by the SVC instruction from the original PSP stack, and determines the address of the security-related function based on the service function number.
[0010] Based on a further improvement of the above method, before starting the execution of the interrupt service routine and after obtaining the service function number passed by the SVC instruction, the method further includes: determining whether the stack before triggering the SVC interrupt is the PSP stack or the main stack pointer MSP stack based on bit 2 of the link register; and when it is determined that the stack before triggering the SVC interrupt is the PSP stack, obtaining the service function number passed by the SVC instruction from the PSP stack.
[0011] A further improvement to the above method, obtaining a hardware random number and dynamically allocating RAM from the secure memory heap as a dynamic PSP stack based on the hardware random number, further includes: generating the hardware random number through the register of the security chip random number generator; and dynamically allocating RAM from the secure memory heap as a dynamic PSP stack, wherein the starting address of the dynamic PSP stack is determined based on the sum of the current starting address of the free block in the secure memory heap and the hardware random number.
[0012] A further improvement to the above method, modifying the value of the PSP register according to the initial address of the dynamic PSP stack to switch the original PSP stack to the dynamic PSP stack, further includes: updating the value of the PSP register from the current address of the original stack to the initial address of the dynamic PSP stack; switching from the original stack to the dynamic PSP stack according to the updated value of the PSP register; and when the number of formal parameters of the security-related function is greater than 4, reading the formal parameters of the security function from the original stack and then writing them into the dynamic PSP stack.
[0013] Further improvements to the above method include directly calling security-related functions based on the value of the PSP register, which further includes: after switching from the original stack to the dynamic PSP stack, calling the security-related function or reading the security-related RAM or NVM based on the address of the security-related function; checking whether the security-related function to be called is consistent with the security-related function that has already been called based on the service function number, wherein if they are consistent, the check is passed.
[0014] Further improvements to the above method, exiting the interrupt to continue executing the user application further include: the user application processing the called security-related functions; clearing the data in the dynamic PSP stack, updating the value of the PSP register from the current address of the dynamic PSP stack to the address of the original stack before the interrupt; exiting the SVC interrupt service routine, the ARM processor automatically restoring the context state of the user application; and continuing to execute the original user application before the SVC interrupt.
[0015] Based on a further improvement of the above method, before the user application calls security-related functions, the method further includes: after the ARM processor is powered on and reset, it defaults to the privileged level and is set to use the main stack pointer (MSP); the system is initialized, and then the ARM processor executes the operating system using the main stack pointer (MSP) under the privileged level; the user application is called, the access level of the ARM processor is downgraded from the privileged level to the user level and the process stack pointer (PSP) is set to use; and the ARM processor executes the user application using the process stack pointer (PSP) under the user level.
[0016] Based on further improvements to the above method, user applications calling security-related functions may further include: accessing RAM or NVM regions storing critical and sensitive data, or accessing algorithm coprocessors.
[0017] On the other hand, embodiments of the present invention provide an anti-attack device for a security element, comprising: an interrupt triggering module, used to trigger an interrupt according to an SVC instruction when a user application calls a security-related function; a call determination module, used to determine the security-related function to be called according to the SVC instruction; a random number acquisition module, used to acquire a hardware random number; a dynamic PSP stack allocation module, used to dynamically allocate RAM from a secure memory heap as a dynamic PSP stack according to the hardware random number, wherein the PSP stack is a process stack pointer PSP stack; a register value modification module, used to modify the value of a PSP register according to the initial address of the dynamic PSP stack to switch the original PSP stack to the dynamic PSP stack; a calling module, used to directly call the security-related function according to the value of the PSP register; and an interrupt stopping module, used to exit the interrupt to continue executing the user application.
[0018] Compared with the prior art, the present invention can achieve at least one of the following beneficial effects:
[0019] 1. Critical operations in user applications no longer use PSP or MSP, but instead dynamically allocate a RAM region from the security feature's memory heap as a PSP (referred to as dynamic PSP stack) to improve the system's resistance to attacks;
[0020] 2. In the function that dynamically allocates PSPs, random numbers are introduced to further randomize the starting address of the PSPs without exceeding the allocatable space of the memory heap, while ensuring that it is 8-byte aligned. Therefore, the location of the dynamically allocated PSP stack in the memory heap is not fixed each time, which can effectively reduce the possibility of successful stack injection attacks by attackers;
[0021] 3. Laser attack involves using a laser to irradiate the MOS transistor region of the SRAM cell after the chip has been unpacked, thereby changing the on or off state of the MOS transistor. The key to laser attack is controlling the timing and location of the laser irradiation;
[0022] 4. The dynamic PSP stack can randomize the stack position for each secure function call, making it impossible for attackers to determine the exact location of the stack. This increases the difficulty for attackers to use laser attacks to destroy the stack and reduces the success rate of system attacks.
[0023] In this invention, the above-described technical solutions can be combined with each other to achieve more preferred combinations. Other features and advantages of this invention will be set forth in the following description, and some advantages may become apparent from the description or be learned by practicing the invention. The objects and other advantages of this invention can be realized and obtained from what is particularly pointed out in the description and drawings. Attached Figure Description
[0024] The accompanying drawings are for illustrative purposes only and are not intended to limit the invention. Throughout the drawings, the same reference numerals denote the same parts.
[0025] Figure 1 A flowchart illustrating the processing of existing technologies using MSP and PSP stacks;
[0026] Figure 2 A flowchart illustrating an attack prevention method for a security element according to an embodiment of the present invention;
[0027] Figure 3 This is a diagram illustrating the application of a dynamic PSP stack according to an embodiment of the present invention;
[0028] Figure 4 A flowchart illustrating the process of calling a security function according to an embodiment of the present invention; and
[0029] Figure 5 This is a block diagram of an anti-attack device for a security element according to an embodiment of the present invention. Detailed Implementation
[0030] Preferred embodiments of the present invention will now be described in detail with reference to the accompanying drawings, which form part of this application and are used together with the embodiments of the present invention to illustrate the principles of the present invention, but are not intended to limit the scope of the present invention.
[0031] refer to Figure 2A specific embodiment of the present invention discloses a method for preventing attacks on a security element, comprising: in step S201, when a user application calls a security-related function, triggering an interrupt according to an SVC instruction and determining the security-related function to be called according to the SVC instruction; in step S202, obtaining a hardware random number and dynamically allocating RAM from the secure memory heap as a dynamic PSP stack according to the hardware random number, wherein the PSP stack is a process stack pointer PSP stack; in step S203, modifying the value of the PSP register according to the initial address of the dynamic PSP stack to switch the original PSP stack to the dynamic PSP stack; and in step S204, directly calling the security-related function according to the value of the PSP register and exiting the interrupt to continue executing the user application.
[0032] Compared to existing technologies, the attack prevention method for the security element provided in this embodiment no longer uses the original PSP or MSP for critical operations in the user application. Instead, it dynamically allocates a RAM region from the security function's memory heap as the PSP (referred to as a dynamic PSP stack), which improves the system's resistance to attacks. The dynamic PSP stack can randomize the stack position for each secure function call, making it impossible for attackers to determine the exact location of the stack. This increases the difficulty for attackers to destroy the stack using laser attacks and reduces the success rate of system attacks.
[0033] The following text will refer to Figure 2 The specific steps of the anti-attack method for a security element according to an embodiment of the present invention will be described in detail.
[0034] Before step S201, the method further includes:
[0035] After power-on reset, the ARM processor is in privileged level by default and is set to use the main stack pointer (MSP).
[0036] The system initializes, and then the ARM processor executes the operating system using the main stack pointer (MSP) in privileged mode;
[0037] The user application is invoked to downgrade the ARM processor's access level from privileged to user level and set the process stack pointer (PSP) to be used; and
[0038] ARM processors use the process stack pointer (PSP) to execute user applications at the user level.
[0039] In step S201, when a user application calls a security-related function, an interrupt is triggered according to the SVC instruction, and the security-related function to be called is determined according to the SVC instruction. For example, the security-related function may be a function closely related to system security.
[0040] Specifically, triggering an interrupt based on the SVC instruction and determining the safety-related functions to be called based on the SVC instruction further includes: actively triggering an SVC interrupt using the ARM processor's SVC instruction and providing the SVC interrupt signal to the nested vector interrupt controller (NVIC); after receiving the SVC interrupt signal, the NVIC automatically obtains the entry address of the SVC interrupt service routine from the interrupt vector table and begins executing the interrupt service routine; and obtains the service function number passed in by the SVC instruction from the original PSP stack and determines the address of the safety-related function based on the service function number.
[0041] Before executing the interrupt service routine and after obtaining the service function number passed in by the SVC instruction, the process further includes: determining whether the stack before the SVC interrupt was the PSP stack or the MSP stack based on bit 2 of the link register; and if it is determined that the stack before the SVC interrupt was the PSP stack, retrieving the service function number passed in by the SVC instruction from the PSP stack. However, if it is determined that the stack before the SVC interrupt was the MSP stack, an exception occurs, requiring the chip to be reset.
[0042] In step S202, a hardware random number is obtained and RAM is dynamically allocated from the secure memory heap based on the hardware random number as a dynamic PSP stack, wherein the PSP stack is a process stack pointer stack.
[0043] Specifically, obtaining a hardware random number and dynamically allocating RAM from the secure memory heap as a dynamic PSP stack based on the hardware random number further includes: generating a hardware random number through the register of the security chip random number generator; and dynamically allocating RAM from the secure memory heap as a dynamic PSP stack, wherein the starting address of the dynamic PSP stack is determined based on the sum of the current starting address of the free block in the secure memory heap and the hardware random number.
[0044] In step S203, the value of the PSP register is modified according to the initial address of the dynamic PSP stack to switch to the dynamic PSP stack.
[0045] Specifically, modifying the PSP register value according to the initial address of the dynamic PSP stack to switch to the dynamic PSP stack further includes: updating the PSP register value from the current address of the original stack to the initial address of the dynamic PSP stack; switching from the original PSP stack to the dynamic PSP stack based on the updated PSP register value; and when the number of parameters of the security-related functions is greater than 4, reading the parameters of the security functions from the original stack and writing them into the dynamic PSP stack. Specifically, the four security-related function parameters are passed directly through registers R0 to R3, while the remaining security-related function parameters are passed through the dynamic PSP stack. When the number of parameters of the security-related functions is less than or equal to 4, the security-related function parameters are passed directly through registers R0 to R3.
[0046] In step S204, the security-related function is directly called based on the value of the PSP register, and the interrupt is exited to continue executing the user application.
[0047] Directly calling security-related functions based on the value of the PSP register further includes: after switching from the original stack to the dynamic PSP stack, calling the security-related function based on its address or reading the security-related RAM and NVM; and checking whether the security-related function to be called is consistent with the one already called based on the service function number. If they are consistent, that is, the called security-related function is correct, the check is passed and the interrupt is exited; if they are inconsistent, the program has an error, that is, the check has failed, and the chip is reset.
[0048] Specifically, user applications calling security-related functions further include: accessing RAM or NVM regions where critical sensitive data is stored, or accessing algorithm coprocessors.
[0049] Specifically, exiting the interrupt to continue executing the user application further includes: the user application processing the security-related functions that have been called; clearing the data in the dynamic PSP stack and updating the value of the PSP register from the current address of the dynamic PSP stack to the address of the original stack before the interrupt; exiting the SVC interrupt service routine, and the ARM processor automatically restoring the context state of the user application; and continuing to execute the original user application before the SVC interrupt.
[0050] refer to Figure 5 A specific embodiment of the present invention discloses an anti-attack device for a security element, comprising: an interrupt triggering module 501, used to trigger an interrupt according to an SVC instruction when a user application calls a security-related function; a call determination module 502, used to determine the security-related function to be called according to the SVC instruction; a random number acquisition module 503, used to acquire a hardware random number; a dynamic PSP stack allocation module 504, used to dynamically allocate RAM from the secure memory heap as a dynamic PSP stack according to the hardware random number, wherein the PSP stack is a process stack pointer stack; a register value modification module 505, used to modify the value of the PSP register according to the initial address of the dynamic PSP stack to switch to the dynamic PSP stack; a calling module 506, used to directly call the security-related function according to the value of the PSP register; and an interrupt stopping module 507, used to exit the interrupt to continue executing the user application.
[0051] In the following text, refer to Figures 2 to 4 The specific details of the anti-attack method for a security element according to embodiments of the present invention will be described in detail by way of specific examples.
[0052] On ARMv7-M architecture processors, the operating system and interrupt service routines typically use the MSP (Multi-Instance Service), while user programs can use either the MSP or PSP (Programmable Instance Service Service). Although user programs can use the PSP to isolate stack data between the operating system and the user program, there is a lack of effective means to protect critical data and operations in the application, such as key operations and PIN verification.
[0053] To isolate and protect the stack memory used by critical operations in user applications and improve the overall system security, this technical solution mainly adopts the following measures:
[0054] In COS, a common lightweight dynamic memory management mechanism is implemented by allocating a dedicated, fixed region from RAM as a memory heap and implementing interface methods such as malloc(), realloc(), and free() for dynamic allocation and deallocation of this memory region. These methods are then called by upper-level modules when requesting temporary caches. For example, when writing multiple spaced data blocks to the same Flash page, to minimize erase / write time, a RAM cache the size of the Flash page is typically dynamically allocated from the memory heap. The original content of the target Flash page is copied into this RAM cache, and then the multiple data blocks are written to their respective locations in the RAM cache. Finally, the data is written to the target Flash page all at once.
[0055] Under normal circumstances, the operating system runs at the privileged level using the MSP (Multi-Level Service), while user applications run at the user level using either the MSP or PSP (User-Level Service). To enhance security, user applications can use only the PSP, thus physically isolating the stack space of the operating system and the user application.
[0056] In this scheme, in order to further improve the system's resistance to attacks, critical operations in user applications no longer use PSP or MSP, but instead dynamically allocate a RAM area from the security function's memory heap as a PSP (referred to as dynamic PSP stack).
[0057] The starting address of the PSP stack dynamically allocated for security-related critical operations is determined by several factors: the starting address of the memory heap, which is always fixed; the size of cache dynamically allocated but not yet released by other modules, which is random and related to the execution path; and the position of the critical operation in the COS. For example, the DES encryption function is an important security-related function that is frequently called by multiple modules such as GP and JavaCard API. In the function that dynamically allocates PSP, random numbers are introduced to further randomize the starting address of the PSP without exceeding the allocatable space of the memory heap, while ensuring its 8-byte alignment.
[0058] Therefore, the location of the dynamically allocated PSP stack in the memory heap is not fixed each time, which can effectively reduce the possibility of successful stack injection attacks by attackers.
[0059] The dynamic PSP stack area is protected by an MPU to effectively prevent unauthorized access to the dynamic PSP stack; (if the chip does not support an optional MPU, a security check with the same function can be added to the code).
[0060] This dynamic PSP stack area is set to be accessible only at the privilege level, so user applications need to use SVC (System Service Call) to enter the privilege level and then call the function that uses this dynamic PSP stack area.
[0061] 1. Identify security-related functions, RAM regions, and NVM regions in user applications.
[0062] Based on their input data and processing procedures, functions are artificially categorized into ordinary operations and secure operations. Secure functions are those closely related to system security, such as the encrypted storage of system keys and PIN verification. Ordinary functions are those that, excluding secure functions, implement business functionalities.
[0063] Security-related RAM areas mainly include global RAM variables used only by security functions, such as global arrays temporarily storing PINs or keys. A RAM area is allocated for security algorithms as a memory heap, which can be used to request temporary working arrays for algorithm computation and to request dynamic PSP stacks.
[0064] Security-related NVM areas mainly include NVM variables or arrays that store key data such as keys and PINs.
[0065] 2. Configure MPU
[0066] First, configure the linker configuration of the project (such as the ARM Scatter file) to allocate security-related functions, RAM regions, and NVM regions from the user application to adjacent locations in the HEX.
[0067] Then, configure the MPU so that only privileged users can call security-related functions in user applications and use security-related RAM and NVM regions.
[0068] 3. The process for calling a safe function is as follows:
[0069] (1) After power-on reset, the ARM processor is in privileged class by default and uses MSP.
[0070] (2) System initialization.
[0071] (3) The processor uses MSP to execute the operating system in privileged level.
[0072] The ARMv7-M processor divides its state into privileged and user levels. Generally, the operating system needs to encapsulate access to low-level hardware resources, so it needs to run in privileged mode, using either MSP or PSP. Upper-level applications, on the other hand, can call operating system functions through system services provided by the operating system, so they only need to run in user mode and can only use PSP. Here, for the sake of distinction, the operating system uses MSP, and user programs use PSP.
[0073] (4) Call the user application, downgrade the processor's access level to user level and set it to use PSP (set CONTROL[0]=1, CONTROL[1]=1), and start executing the user program.
[0074] (5) The processor uses the PSP to execute user applications at the user level.
[0075] (6) When a user application needs to call security-related functions or read security-related RAM or NVM (Non-volatile random-access memory), it needs to actively trigger an SVC interrupt using ARM's SVC instruction (such as the Thumb-2 instruction SVC or the compiler-provided __svc_indirect, which passes svc_num through R12).
[0076] (7) After the processor’s NVIC receives the SVC interrupt signal, it automatically obtains the entry address of the SVC interrupt service routine from the interrupt vector table and starts executing the interrupt service routine.
[0077] (8) Determine whether the stack before triggering the SVC interrupt is the MSP or PSP stack based on bit 2 of the LR register (link register).
[0078] (9) Get the service function number passed in by the SVC instruction from the stack, which corresponds to the security function to be called.
[0079] (10) Determine the security function to be called based on the service function number.
[0080] (11) Obtain a hardware true random number, and use this true random number to dynamically allocate a block of RAM from the security function's memory heap as a dynamic PSP stack; SEs are all implemented using security chips, and these security chips use hardware to implement random number generators. COS generates the required random number by configuring the registers of the security chip's random number generator. When implementing the code, the starting address of the dynamic PSP stack needs to be processed as follows: 1) 8-byte alignment; 2) Boundary check to ensure that the ending address of the dynamic PSP stack does not exceed the memory heap.
[0081] PSP starting address = (current starting address of free block in memory heap + random number).
[0082] (12) Determine the number of formal parameters of the security function to be called. If it is greater than 4, the parameters passed in need to be read from the old stack and written to the new dynamic PSP stack. 1 is correct. The actual parameters in the original stack need to be copied to the new PSP stack. Otherwise, the security function cannot continue to execute on the new PSP stack.
[0083] (13) Modify the value of PSP and switch SP to the new dynamic PSP stack.
[0084] (14) Based on the address of the called security function obtained in step ⑩, directly call the target security function. Additionally, pass in the service function number obtained from the SVC instruction in step ⑨, and check for consistency during the execution of the security function.
[0085] (15) Start processing the target security function, such as accessing the RAM or NVM area where critical sensitive data is stored, or accessing hardware resources such as the algorithm coprocessor.
[0086] (16) Clear the data in the current PSP stack, modify the value of the PSP, and switch the SP to the original stack.
[0087] (17) Exit the SVC interrupt service routine and the processor will automatically restore the original user application's context state.
[0088] (18) Then continue executing the original user application that was interrupted by the SVC interrupt.
[0089] 4. The beneficial effects are as follows:
[0090] The following analysis uses laser attack as an example to illustrate the improvement effect of this technical solution on the system's ability to prevent error injection attacks. Laser attack involves using a laser to irradiate the MOS transistor region of the SRAM cell after the chip has been depackaged, thereby changing the on or off state of the MOS transistor. The key to laser attack is controlling the timing and location of the laser irradiation.
[0091] A dynamic PSP stack can randomize the stack position for each secure function call, making it impossible for attackers to determine the exact location of the stack. This increases the difficulty for attackers to use laser attacks to destroy the stack and reduces the success rate of system attacks.
[0092] The key to this technical solution is to dynamically obtain a randomly located RAM block from the memory heap before calling the secure function, which serves as the PSP stack required for the execution of the secure function. On the one hand, by introducing true hardware random numbers, the PSP stack is randomly distributed each time it is called, increasing the difficulty for attackers to attack the stack. On the other hand, in conjunction with the MPU, hardware-level privilege level protection, access control, and anomaly detection are provided for this dynamic PSP stack, restricting access to the secure function only under privileged conditions. Once unauthorized access occurs, the MPU hardware will automatically trigger an exception.
[0093] Those skilled in the art will understand that all or part of the processes of the methods described in the above embodiments can be implemented by a computer program instructing related hardware, and the program can be stored in a computer-readable storage medium. The computer-readable storage medium may be a disk, optical disk, read-only memory, or random access memory, etc.
[0094] The above description is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any changes or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in the present invention should be included within the scope of protection of the present invention.
Claims
1. A method of attack protection of a secure element, characterized in that, Comprising: triggering an interrupt according to an SVC instruction and determining a security related function to be called according to the SVC instruction when a user application calls the security related function; obtaining a hardware random number and dynamically applying RAM as a dynamic PSP stack from a secure memory heap according to the hardware random number, wherein the PSP stack is a process stack pointer (PSP) stack; modifying a value of a PSP register according to an initial address of the dynamic PSP stack to switch an original PSP stack to the dynamic PSP stack; and directly calling the security related function according to the value of the PSP register and exiting the interrupt to continue executing the user application.
2. The attack-resistant method of a security element according to claim 1, characterized in that, Triggering an interrupt according to an SVC instruction and determining a security related function to be called according to the SVC instruction further comprises: actively triggering an SVC interrupt using an SVC instruction of an ARM processor and providing an SVC interrupt signal to a nested vector interrupt controller (NVIC); the nested vector interrupt controller (NVIC) automatically obtaining an entry address of an SVC interrupt service routine from an interrupt vector table upon receiving the SVC interrupt signal, and starting to execute the interrupt service routine; and obtaining a service function number passed in by the SVC instruction from the original PSP stack, and determining an address of the security related function according to the service function number.
3. The attack-resistant method of a security element according to claim 2, characterized in that, Before starting to execute the interrupt service routine and after obtaining the service function number passed in by the SVC instruction further comprises: determining whether a PSP stack or a main stack pointer (MSP) stack was before triggering the SVC interrupt according to bit2 of a link register; and when it is determined that the PSP stack was before triggering the SVC interrupt, obtaining the service function number passed in by the SVC instruction from the PSP stack.
4. The attack-resistant method of a security element according to claim 2, characterized in that, Obtaining a hardware random number and dynamically applying RAM as a dynamic PSP stack from a secure memory heap according to the hardware random number further comprises: generating the hardware random number through a register of a secure chip random number generator; and dynamically applying RAM as the dynamic PSP stack from the secure memory heap, wherein a starting address of the dynamic PSP stack is determined according to a sum of a current starting address of a free block in the secure memory heap and the hardware random number.
5. The attack-resistant method of a security element according to claim 2, characterized in that, Modifying a value of a PSP register according to an initial address of the dynamic PSP stack to switch an original PSP stack to the dynamic PSP stack further comprises: updating the value of the PSP register from a current address of the original stack to the initial address of the dynamic PSP stack; switching from the original stack to the dynamic PSP stack according to the updated value of the PSP register; and when a number of parameters of the security related function is greater than 4, reading out the parameters of the security function from the original stack and then writing into the dynamic PSP stack.
6. The attack-resistant method of a security element according to claim 5, characterized in that, Directly calling the security related function according to the value of the PSP register further comprises: after switching from the original stack to the dynamic PSP stack, calling the security related function according to the address of the security related function or reading a security related RAM, NVM; and checking whether the security related function to be called is consistent with the security related function that has been called according to the service function number, wherein when the security related function to be called is consistent with the security related function that has been called, the checking is passed.
7. A method of attack-resistant security element according to claim 6, characterized in that, The exiting the interruption to continue executing the user application further comprises: the user application processing the invoked security related function; emptying data in the dynamic PSP stack, updating the value of the PSP register from the current address of the dynamic PSP stack to the address of the original stack before the interruption; exiting the SVC interruption service routine, the ARM processor automatically restoring the field state of the user application; and continuing to execute the original user application before the SVC interruption.
8. The attack-resistant method of a security element according to any one of claims 1 to 7, characterized in that, Before the user application invokes the security related function further comprises: the ARM processor is in a privilege level by default after power-on reset, and a main stack pointer (MSP) is set; the system is initialized, and then the ARM processor executes an operating system in the privilege level using the main stack pointer (MSP); the user application is invoked, and the access level of the ARM processor is reduced from the privilege level to a user level and a process stack pointer (PSP) is set; and the ARM processor executes a user application in the user level using the process stack pointer (PSP).
9. A security element attack prevention method according to any one of claims 1-7, characterized in that, The user application invoking the security related function further comprises: accessing a RAM or NVM area storing critical sensitive data or accessing an algorithm coprocessor.
10. An attack-proof device for a security element, characterized in that The method comprises: an interruption triggering module, configured to trigger an interruption according to an SVC instruction when a user application invokes a security related function; an invocation determining module, configured to determine the security related function to be invoked according to the SVC instruction; a random number obtaining module, configured to obtain a hardware random number; a dynamic PSP stack applying module, configured to dynamically apply RAM as a dynamic PSP stack from a secure memory heap according to the hardware random number, wherein the PSP stack is a process stack pointer (PSP) stack; a register value modifying module, configured to modify the value of a PSP register according to the initial address of the dynamic PSP stack to switch an original PSP stack to the dynamic PSP stack; an invoking module, configured to directly invoke the security related function according to the value of the PSP register; and an interruption stopping module, configured to exit the interruption to continue executing the user application.