Debugging port opening method, arm service equipment and safety debugging method and system

Abstract

The invention discloses a debugging port opening method of an arm platform, arm service equipment and a safety debugging method and system, and the debugging port opening method comprises the steps: setting a one-time programmable memory, and storing a hash value of an authentication public key in the one-time programmable memory; receiving an authentication opening request sent by the key terminal, wherein the authentication opening request comprises an authentication public key and specified algorithm information; whether the authentication public key is legal or not is verified according to the stored hash value and specified algorithm information, if yes, a random number is generated, and an authentication feedback signal containing the random number is fed back to the key terminal; and receiving a signature of the random number sent by the key terminal, an authentication public key and specified algorithm information, verifying whether the authentication public key is legal or not according to the hash value and the specified algorithm information, if so, performing signature verification on the signature by using the authentication public key, opening the debugging port after the signature verification is passed, and if not or the signature verification is failed, ending. Compared with the prior art, the method is high in safety and reliability.

Description

Technical Field

[0001] This invention relates to the field of electronics, and more particularly to the secure debugging of ARM servers. Background Technology

[0002] Debug ports are an important feature in product development. During development, debug ports are typically used to analyze and resolve functional issues. Through the debug interface, we can monitor the product's running status, view or modify register values, observe changes in memory data, and, in conjunction with development tools such as IDEs and debuggers, easily troubleshoot various challenging problems.

[0003] While powerful debugging interfaces are invaluable tools in the development process, they also introduce security vulnerabilities and the risk of intellectual property leaks. Attackers can access various internal resources of the device through debugging ports, leveraging these robust interfaces to launch attacks and steal sensitive information, posing a serious security risk. Therefore, debugging ports are disabled or locked at the factory.

[0004] To address this issue, many high-value-added or security-sensitive products choose to permanently disable the debugging interface in the final step of the production process by modifying OTP / eFuse, etc. Once the product leaves the factory, the debugging interface is sealed, a simple and direct solution to the risks associated with debugging interfaces.

[0005] Therefore, there is an urgent need for a safe and reliable method for opening debug ports, ARM service devices, safe debugging methods and systems. Summary of the Invention

[0006] The purpose of this invention is to provide a method for opening the debug port on an ARM platform, an ARM service device, a secure debugging method and system, which has high security.

[0007] To achieve the above objectives, the present invention provides a method for opening a debug port on an ARM platform, comprising: setting a one-time programmable memory and storing the hash value of an authentication public key in the one-time programmable memory; receiving an authentication request sent by a key terminal, the authentication request including the authentication public key and specified algorithm information; verifying the validity of the authentication public key based on the stored hash value and the specified algorithm information, and if so, generating a random number and feeding back an authentication feedback signal containing the random number to the key terminal; receiving the signature of the random number, the authentication public key, and the specified algorithm information sent by the key terminal, verifying the validity of the authentication public key based on the hash value and the specified algorithm information, and if so, using the authentication public key to verify the signature, opening the debug port after successful verification, and ending if not or if verification fails.

[0008] Preferably, verifying the validity of the authentication public key based on the hash value and the specified algorithm information includes: obtaining the hash value of the authentication public key using the specified algorithm information, determining whether the hash value of the authentication public key is consistent with the hash value stored in the one-time programmable memory; if so, it is valid; otherwise, the process ends.

[0009] Preferably, the specified algorithm information includes specified hash algorithm information and specified public key algorithm information.

[0010] The present invention also provides an ARM service device, including one or more processors, a memory, one or more operation instructions stored in the memory, and a one-time programmable memory, wherein the one-time programmable memory stores the hash value of the authentication public key; the processor calls the operation instructions and executes them to implement the debug port opening method of the ARM platform as described above.

[0011] This invention also provides a secure debugging method for an ARM platform. A matching authentication public key and authentication private key are generated. Before leaving the factory, the hash value of the authentication public key is written into the device's one-time programmable memory. Before secure debugging of the device, a key terminal sends an authentication request to the device, the request including the authentication public key and specified algorithm information. The device verifies the validity of the authentication public key based on the hash value in the one-time programmable memory and the specified algorithm information. If valid, it generates a random number and sends an authentication feedback signal containing the random number back to the key terminal. The key terminal extracts the random number from the authentication feedback signal, signs the random number using its own authentication private key, and sends the signature, authentication public key, and specified algorithm information to the authentication module. The device verifies the validity of the authentication public key based on the hash value and specified algorithm information. If valid, it uses the authentication public key to verify the signature. If the verification is successful, the debugging port is opened for secure debugging of the device; otherwise, the process ends.

[0012] Preferably, the device verifies the validity of the authentication public key based on the hash value and specified algorithm information by: the device using the specified algorithm information to obtain the hash value of the authentication public key, and determining whether the hash value of the authentication public key is consistent with the hash value stored in the one-time programmable memory. If so, it is valid; otherwise, the process ends.

[0013] Preferably, the specified algorithm information includes specified hash algorithm information and specified public key algorithm information.

[0014] Preferably, the key terminal retrieves the corresponding authentication key based on the authentication public key, uses the random number as the authentication value, and signs the random number based on the authentication key.

[0015] The present invention also provides a secure debugging system for an ARM platform, including an ARM server and a key terminal. The ARM server includes one or more first processors, a first memory, one or more first operation instructions stored in the first memory, and a one-time programmable memory, wherein the one-time programmable memory stores the hash value of an authentication public key. The key terminal includes one or more second processors, a second memory, and one or more second operation instructions stored in the second memory. The first processor and the second processor respectively execute the first operation instructions and the second operation instructions to implement the secure debugging method for the ARM platform as described above.

[0016] Compared with existing technologies, this invention includes specified algorithm information in the authentication request sent by the key terminal, enabling the ARM platform's authentication module to verify the security debugging using the provided cryptographic algorithm (public key algorithm and hash algorithm information), resulting in high security. Furthermore, this invention involves random numbers during authentication verification, and each verification uses different data, requiring a unique password each time. This ensures that even if information is snooped on in one instance, it will not affect subsequent authentication, further enhancing security. Attached Figure Description

[0017] Figure 1 This is a flowchart of the debugging port opening method for the ARM platform of the present invention.

[0018] Figure 2 This is a structural diagram of the secure debugging system for the ARM platform of this invention.

[0019] Figure 3 This is a flowchart illustrating the working process of the secure debugging system for the ARM platform of this invention. Detailed Implementation

[0020] To illustrate the technical content, structural features, objectives, and effects of the present invention in detail, the following description is provided in conjunction with the embodiments and accompanying drawings.

[0021] refer to Figure 1 This invention discloses a method for enabling a debug port on an ARM platform, comprising: S11, Set up a one-time programmable memory to store the hash value (such as SHA256, SM3, etc.) of the authentication public key.

[0022] The one-time programmable memory is either OTP or efuse.

[0023] S12, Receive an authentication request sent by the key terminal, the authentication request including an authentication public key and specified algorithm information. The specified algorithm information includes information about a specified hash algorithm and information about the public key algorithm. The specified hash algorithm information can be an identifier for the specified hash algorithm. The public key algorithm information can be an identifier for the specified public key algorithm. The specified algorithm is determined through the specified algorithm information.

[0024] S13, verify the validity of the authentication public key based on the stored hash value and the specified algorithm information.

[0025] Specifically, step S13 includes: obtaining the hash value of the authentication public key using specified algorithm information, determining whether the hash value of the authentication public key is consistent with the hash value stored in the one-time programmable memory; if so, it is valid; otherwise, the process ends.

[0026] Specifically, the authentication public key is converted into a serializable byte string according to the specified public key algorithm, and the serializable byte string is compressed into a fixed-length fingerprint according to the specified hash algorithm to obtain the hash value of the authentication public key.

[0027] S14, if so, generate a random number.

[0028] S15, an authentication feedback signal containing a random number is sent back to the key terminal. This authentication feedback signal is hexadecimal data. The authentication feedback signal also includes the device's unique identifier (UID).

[0029] S16, receive the signature of the random number, the authentication public key, and the specified algorithm information sent by the key terminal.

[0030] The specified algorithm information includes specified hash algorithm information and specified public key algorithm information.

[0031] S17. Verify the validity of the authentication public key based on the hash value and the specified algorithm information.

[0032] Specifically, step S17 includes: obtaining the hash value of the authentication public key using specified algorithm information, determining whether the hash value of the authentication public key is consistent with the hash value stored in the one-time programmable memory; if so, it is valid; otherwise, the process ends.

[0033] Specifically, the authentication public key is converted into a serializable byte string according to the specified public key algorithm, and the serializable byte string is compressed into a fixed-length fingerprint according to the specified hash algorithm to obtain the hash value of the authentication public key.

[0034] The specified algorithm may include international algorithms or national cryptographic algorithms, such as RAS, ECC, SM2, etc.

[0035] S18, if so, then use the authentication public key to verify the signature.

[0036] S19, after the signature verification is successful, open the debugging port.

[0037] If not, or if the verification fails, the process ends.

[0038] The key terminal receives signals via a serial port.

[0039] The key terminal of the present invention has an authentication public key and an authentication private key that match the hash value stored in a one-time programmable memory, thereby opening a debug port.

[0040] refer to Figure 2 The present invention discloses an ARM service device 20, including one or more first processors 21, a first memory 22, one or more first operation instructions 23 stored in the first memory 22, and a one-time programmable memory 24, wherein the one-time programmable memory 24 stores the hash value of the authentication public key; the first processor 21 calls the first operation instructions 23 and executes them to implement the debug port opening method of the ARM platform as described above.

[0041] The first processor 21 of the ARM service device 20 is equipped with an authentication module 41 and a debug port 42.

[0042] refer to Figure 3 This invention discloses a secure debugging method for an ARM platform, which generates a matching pair of authentication public key and authentication private key, and writes the hash value of the authentication public key into the one-time programmable memory 24 of the ARM service device 20 before leaving the factory. The secure debugging method includes: 1. Before performing security debugging on the ARM service device 20, the key terminal 10 sends an authentication request to the ARM service device 20, the authentication request including the authentication public key and the specified algorithm information.

[0043] 2. The authentication module 41 of the ARM service device 20 verifies the validity of the authentication public key based on the hash value in the one-time programmable memory 24 and the specified algorithm information. Specifically, it obtains the specified public key algorithm and hash algorithm through the specified algorithm information, converts the authentication public key into a serializable byte string according to the specified public key algorithm, and compresses the serializable byte string into a fixed-length fingerprint according to the specified hash algorithm to obtain the hash value of the authentication public key. Then, it compares the hash value of the authentication public key with the hash value in the one-time programmable memory 24. If they match, the authentication public key is valid; otherwise, it is invalid.

[0044] 3. If so, generate a random number.

[0045] 4. The authentication module 41 of the ARM service device 20 sends an authentication feedback signal containing a random number to the key terminal 10. The authentication feedback signal includes a unique identifier of the ARM service device 20.

[0046] 5. The key terminal 10 extracts the random number from the authentication feedback signal and signs the random number according to its own authentication key.

[0047] Specifically, the key terminal 10 uses a predefined authentication key (i.e., authentication key) from the debug port 42 via an external tool to sign the returned random number. Specifically, the key terminal 10 retrieves the corresponding authentication key based on the authentication public key, uses the random number as the authentication value, and signs the random number based on the authentication key.

[0048] 6. Send the signature of the random number, the authentication public key, and the specified algorithm information to the authentication module 41.

[0049] 7. The authentication module 41 of the ARM service device 20 verifies the validity of the authentication public key based on the hash value and the specified algorithm.

[0050] 8. If so, the authentication public key is used to verify the signature to determine whether the authentication key of the key terminal 10 matches the authentication public key in the arm service device 20.

[0051] 9. After the authentication module 41 verifies the signature, it opens the debugging port 42 to perform security debugging on the ARM service device 20. After the debugging is completed, the key terminal 10 can send a specified string to the ARM service device 20 through the serial port tool to make it close the debugging port 42.

[0052] If the authentication module 41 verifies the signature, it will open the debugging path via jtag-dap to open the debugging port 42 and return a message indicating that the verification has passed.

[0053] If not, or if the verification fails, the process ends.

[0054] Among them, the key terminal 10 needs to predefine a series of commands to open the debug port, including the request for the debug port authentication process, the specified algorithm information (identifiers of public key algorithm and hash algorithm), the response data format, and the format for public key transmission, etc.

[0055] The ARM service device 20 verifies the validity of the authentication public key based on the hash value by: the ARM service device 20 uses specified algorithm information to obtain the hash value of the authentication public key, and determines whether the hash value of the authentication public key is consistent with the hash value stored in the one-time programmable memory 24. If so, it is valid; otherwise, the process ends.

[0056] The key terminal 10 and the ARM service device 20 communicate via a serial port.

[0057] refer to Figure 2 This invention discloses a secure debugging system for an ARM platform, including an ARM server 20 and a key terminal 10, wherein the ARM server 20 is as described above. The key terminal 10 includes one or more second processors 31, a second memory 32, and one or more second operation instructions 33 stored in the second memory 32. The first processor 21 and the second processor 31 respectively execute the first operation instructions 23 and the second operation instructions 33 to implement the secure debugging method for the ARM platform as described above.

[0058] The key terminal of the present invention includes a key for debugging and opening.

[0059] OTP: One-Time Programmable, a non-volatile memory that can be programmed once. UID: Unique Identifier. IDE: Integrated Development Environment.

[0060] The above-disclosed embodiments are merely preferred embodiments of the present invention and should not be construed as limiting the scope of the present invention. Therefore, any equivalent variations made in accordance with the scope of the present invention are still within the scope of the present invention.

Claims

1. A method for enabling a debug port on an ARM platform, characterized in that: include: A one-time programmable memory is provided, in which the hash value of the authentication public key is stored; Receive an activation authentication request sent by the key terminal, wherein the activation authentication request includes an authentication public key and specified algorithm information; The authentication public key is verified to be valid based on the stored hash value and the specified algorithm information. If valid, a random number is generated and an authentication feedback signal containing the random number is fed back to the key terminal. The system receives the signature of a random number, the authentication public key, and the specified algorithm information sent by the key terminal. It verifies the validity of the authentication public key based on the hash value and the specified algorithm information. If valid, it uses the authentication public key to verify the signature. If the verification is successful, it opens the debugging port. If not, or if the verification fails, it terminates.

2. The method for enabling the debug port on an ARM platform as described in claim 1, characterized in that: Verifying the validity of the authentication public key based on the hash value and the specified algorithm information includes: The hash value of the authentication public key is obtained using the specified algorithm information. It is then determined whether the hash value of the authentication public key is consistent with the hash value stored in the one-time programmable memory. If they are consistent, the authentication is valid; otherwise, the process ends.

3. The method for enabling the debug port on an ARM platform as described in claim 1, characterized in that: The specified algorithm information includes the specified hash algorithm information and the specified public key algorithm information.

4. An ARM service device, characterized in that: It includes one or more processors, a memory, one or more operation instructions stored in the memory, and a one-time programmable memory, wherein the hash value of the authentication public key is stored in the one-time programmable memory; The processor invokes and executes the operation instructions to implement the debug port opening method for the ARM platform as described in any one of claims 1-3.

5. A secure debugging method for an ARM platform, characterized in that: include: Generate a matching pair of authentication public key and authentication private key, and write the hash value of the authentication public key into the device's one-time programmable memory before leaving the factory; Before performing security debugging on the device, the key terminal sends an authentication request to the device, which includes an authentication public key and specified algorithm information. The device verifies the validity of the authentication public key based on the hash value in the one-time programmable memory and the specified algorithm information. If valid, it generates a random number and sends an authentication feedback signal containing the random number back to the key terminal. The key terminal extracts the random number from the authentication feedback signal, signs the random number according to its own authentication key, and sends the signature of the random number, the authentication public key, and the specified algorithm information to the authentication module. The device verifies the validity of the authentication public key based on the hash value and the specified algorithm information. If valid, the device uses the authentication public key to verify the signature. If the signature verification is successful, the debugging port is opened to allow for secure debugging of the device. Otherwise, the process ends.

6. The secure debugging method for an ARM platform as described in claim 5, characterized in that: The device verifies the validity of the authentication public key based on the hash value and specified algorithm information, including: The device uses specified algorithm information to obtain the hash value of the authentication public key, and determines whether the hash value of the authentication public key is consistent with the hash value stored in the one-time programmable memory. If it is consistent, the authentication is valid; otherwise, the process ends.

7. The secure debugging method for an ARM platform as described in claim 5, characterized in that: The specified algorithm information includes the specified hash algorithm information and the specified public key algorithm information.

8. The secure debugging method for an ARM platform as described in claim 5, characterized in that: The key terminal retrieves the corresponding authentication key based on the authentication public key, uses the random number as the authentication value, and signs the random number based on the authentication key.

9. A secure debugging system for an ARM platform, characterized in that: The system includes an ARM server and a key terminal. The ARM server includes one or more first processors, a first memory, one or more first operation instructions stored in the first memory, and a one-time programmable memory that stores the hash value of the authentication public key. The key terminal includes one or more second processors, a second memory, and one or more second operation instructions stored in the second memory. The first processor and the second processor respectively execute the first operation instructions and the second operation instructions to implement the secure debugging method of the ARM platform as described in any one of claims 5-8.

Images