Secure jtag authentication method, chip and electronic device

Abstract

This disclosure provides a secure JTAG authentication method, chip, and electronic device, belonging to the field of chip debugging technology. The secure JTAG authentication method includes: obtaining an image configuration file corresponding to the bootloader during the execution of a bootloader by the processor in the chip; performing security verification on the image configuration file, and sending a JTAG interface enable command to a debugging module based on the JTAG interface enable flag contained in the image configuration file after successful verification; receiving the JTAG interface enable command through the debugging module in the chip, and configuring a first interface enable register inside the debugging module according to the JTAG interface enable command to control the JTAG interface to be in a debuggable state. The secure JTAG authentication scheme provided by this disclosure combines software and hardware, balancing flexibility and security during chip testing and debugging.

Description

Technical Field

[0001] This disclosure relates to the field of chip debugging technology, and in particular to a secure JTAG authentication method, chip, and electronic device. Background Technology

[0002] JTAG (Joint Test Action Group) is an international standard testing protocol. The JTAG interface is one of the most commonly used debugging interfaces in chip development. Through the JTAG interface, developers can easily access critical data within the chip, such as viewing registers, memory, function call stacks, and so on.

[0003] Without a secure authentication mechanism, the JTAG interface is easily exploited by attackers to infiltrate the chip and obtain critical confidential data. Related technologies typically involve physically fusing the JTAG interface during the product rollout phase to ensure chip data security. However, this method is irreversible; if a problem occurs in the rolled-out product, it is impossible to test and debug the chip again through the JTAG interface.

[0004] Currently, there is a lack of effective secure JTAG certification schemes that can balance the security and flexibility of chips during testing and debugging. Summary of the Invention

[0005] In view of this, the present disclosure provides a secure JTAG authentication method, chip, and electronic device to at least solve or mitigate the above-mentioned problems.

[0006] According to a first aspect of the present disclosure, a secure JTAG authentication method is provided, applied to a chip, the chip including a processor, a debugging module, and a JTAG interface, the method comprising:

[0007] During the execution of the bootloader, the processor obtains the image configuration file corresponding to the bootloader; performs security verification on the image configuration file, and after the verification is passed, sends a JTAG interface enable command to the debug module according to the JTAG interface enable flag contained in the image configuration file.

[0008] The debugging module receives the JTAG interface enable instruction and configures the first interface enable register inside the debugging module according to the JTAG interface enable instruction to control the JTAG interface to be in a debuggable state.

[0009] According to a second aspect of the present disclosure, a chip is provided, including: a processor, a debugging module, and a JTAG interface;

[0010] The processor is configured to obtain the image configuration file corresponding to the bootloader during the execution of the bootloader; perform security verification on the image configuration file; and, after the verification is passed, send a JTAG interface enable instruction to the debug module according to the JTAG interface enable flag contained in the image configuration file.

[0011] The debugging module is configured to receive the JTAG interface enable command and configure the first interface enable register inside the debugging module according to the JTAG interface enable command, so as to control the JTAG interface to be in an adjustable state.

[0012] [P-137021-CN-PRI-1][HS2410899CCN] Trial status.

[0013] According to a third aspect of the present disclosure, an electronic device is provided, comprising: the chip described in the second aspect above.

[0014] According to the secure JTAG authentication scheme provided in this disclosure embodiment, after the chip is powered on and reset, the processor obtains the image configuration file corresponding to the bootloader, which contains the JTAG interface enable identifier, during the execution of the bootloader program. After the image configuration file passes security verification, it sends a JTAG interface enable instruction to the debug module according to the JTAG interface enable identifier contained in the image configuration file. After receiving the JTAG interface enable instruction, the debug module configures the first interface enable register inside the debug module according to the instruction, thereby controlling the JTAG interface to be in a debuggable state.

[0015] This embodiment controls the debugging state of the JTAG interface through a configuration file corresponding to the software program executed by the processor, thereby enabling flexible configuration of the JTAG interface state according to actual needs. Furthermore, after obtaining the configuration file, a security verification is performed on it. Specifically, after successful verification, the JTAG interface is controlled to be in a debuggable state by configuring the interface enable register in the debug module. Therefore, the above process also possesses high security. In summary, the secure JTAG authentication scheme provided by this embodiment combines software and hardware, balancing flexibility and security during chip testing and debugging. Attached Figure Description

[0016] To more clearly illustrate the technical solutions in the embodiments of this disclosure or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the embodiments of this disclosure. For those skilled in the art, other drawings can be obtained based on these drawings.

[0017] Figure 1 This is a flowchart of a secure JTAG authentication method according to an embodiment of this disclosure;

[0018] Figure 2 This is a flowchart of a secure JTAG authentication method according to another embodiment of this disclosure;

[0019] Figure 3 This is a flowchart of a secure JTAG authentication method according to yet another embodiment of this disclosure;

[0020] Figure 4 This is a schematic diagram of the internal structure of a chip according to an embodiment of the present disclosure. Detailed Implementation

[0021] Embodiments of this disclosure will now be described in more detail with reference to the accompanying drawings. While some embodiments of this disclosure are shown in the drawings, it should be understood that this disclosure can be implemented in various forms and should not be construed as limited to the embodiments set forth herein. Rather, these embodiments are provided to provide a more thorough and complete understanding of this disclosure. It should be understood that the accompanying drawings and embodiments of this disclosure are for illustrative purposes only and are not intended to limit the scope of protection of this disclosure.

[0022] It should be noted that the headings of any section / subsection provided herein are not limiting. Various embodiments are described throughout this document, and embodiments of any type may be included under any section / subsection. Furthermore, embodiments described in any section / subsection may be combined in any way with any other embodiments described in the same section / subsection and / or different sections / subsections.

[0023] [P-137021-CN-PRI-1][HS2410899CCN]

[0024] In the description of embodiments of this disclosure, the term "comprising" and similar terms should be understood as open-ended inclusion, i.e., "including but not limited to". The term "based on" should be understood as "at least partially based on". The term "one embodiment" or "the embodiment" should be understood as "at least one embodiment". The term "some embodiments" should be understood as "at least some embodiments". Other explicit and implicit definitions may also be included below. The terms "first", "second", etc., may refer to different or the same objects. Other explicit and implicit definitions may also be included below.

[0025] The embodiments of this disclosure may involve user data, data acquisition, and / or use. All of these aspects comply with applicable laws, regulations, and relevant provisions. In the embodiments of this disclosure, all data collection, acquisition, processing, manipulation, forwarding, and use are conducted with the user's knowledge and confirmation. Accordingly, in implementing the embodiments of this disclosure, the type, scope of use, and usage scenarios of any data or information that may be involved should be communicated to the user and their authorization obtained in accordance with relevant laws and regulations through appropriate means. The specific methods of notification and / or authorization may vary depending on the actual situation and application scenario, and the scope of this disclosure is not limited in this respect.

[0026] In this specification and the embodiments, any processing of personal information will be carried out only under the premise of legality (such as obtaining the consent of the personal information subject, or being necessary for the performance of a contract), and will only be carried out within the scope stipulated or agreed upon. A user's refusal to process personal information other than that necessary for basic functions will not affect the user's use of basic functions.

[0027] Example 1

[0028] See Figure 1 , Figure 1 This is a flowchart of a secure JTAG authentication method according to an embodiment of this disclosure. This secure JTAG authentication method can be executed by a chip internally equipped with a processor, a debugging module, and a JTAG interface. Figure 1 As shown, this secure JTAG authentication method includes the following steps:

[0029] Step 102: During the execution of the bootloader, the processor obtains the image configuration file corresponding to the bootloader; performs security verification on the image configuration file, and after successful verification, sends a JTAG interface enable command to the debug module according to the JTAG interface enable flag contained in the image configuration file.

[0030] Specifically, for a chip, after power-on or reset, the BOOTROM program (Boot Read-Only Memory) can be executed by the processor located inside the chip. The BOOTROM program is a critical piece of code stored in the chip, ensuring that the system can boot safely and reliably from a known state. The specific functions of the BOOTROM program mainly include: performing the hardware initialization process, including memory detection, processor configuration, bus settings, etc.; implementing safe boot functionality, ensuring that the system only loads verified software and firmware; performing error detection during system startup, such as hardware failures and configuration errors; and, more importantly, storing device configuration information, such as boot parameters and system settings.

[0031] Based on the aforementioned functions of the BOOTROM program, in this embodiment of the disclosure, when it is desired to enable debugging permissions for the chip's JTAG interface to perform chip testing and debugging via the JTAG interface, a JTAG interface enable flag can be added to the image configuration file corresponding to the BOOTROM program, so as to securely enable debugging permissions for the chip's JTAG interface through the security authentication scheme provided in this disclosure.

[0032] In this embodiment, the specific form of the JTAG interface enable flag is not limited, and can be determined according to actual circumstances.

[0033] [P-137021-CN-PRI-1][HS2410899CCN] Appropriate content can be pre-defined as the JTAG interface enable flag. For example, the JTAG interface enable flag can be set in the image configuration file. During the actual authentication process, the specific value of this JTAG interface enable flag can be used to determine whether to enable debugging permissions for the chip's JTAG interface through the security authentication scheme provided in this disclosure. Furthermore, to save storage space, the JTAG interface enable flag can be set to 0, indicating that the chip's JTAG interface debugging permission is not enabled. That is, when the JTAG interface enable flag in the image configuration file is 0, the chip's JTAG interface debugging permission is kept in the off state. At this time, settings outside the chip cannot access the chip's internal data through the JTAG interface. Conversely, when the JTAG interface enable flag is 1, it indicates that the chip's JTAG interface debugging permission is enabled. That is, when the JTAG interface enable flag in the image configuration file is 1, the method provided in this embodiment can be executed to change the chip's JTAG interface debugging permission from the off state to the on state. At this time, developers or testers can access the chip's internal data through the JTAG interface to perform chip testing or debugging operations.

[0034] After obtaining the image configuration file containing the JTAG interface enable flag, to ensure the file's security, integrity, and source reliability, and to prevent malicious tampering, this embodiment of the disclosure performs security verification on the image configuration file. This embodiment of the disclosure does not limit the specific verification method; it can be customized according to actual conditions. For example, digital signature calculation can be used to verify the file's signature to ensure the file has not been tampered with and its source is trustworthy; file access permissions can also be pre-set, and during the processor's execution of the bootloader, the access permissions can be checked to ensure that only authorized users can access or modify the image configuration file; the file's source can also be verified, such as detecting whether the file comes from a trusted publisher or source, etc.

[0035] Step 104: Receive the JTAG interface enable instruction through the debugging module, and configure the first interface enable register inside the debugging module according to the JTAG interface enable instruction to control the JTAG interface to be in a debuggable state.

[0036] Specifically, a register for controlling the debugging state of the JTAG interface can be set in the debugging module, namely the first interface enable register in step 104 above. One or more bits can be set in the first interface enable register to control the debugging state of the JTAG interface. The process of configuring the first interface enable register inside the debugging module according to the JTAG interface enable instruction can be as follows: write a preset value to the corresponding bit of the first interface enable register to control the JTAG interface to be in a debuggable state. For example, it can be preset that when a 1 is written to the corresponding bit, the JTAG interface is enabled, that is, the JTAG interface is controlled to be in a debuggable state; conversely, when a 0 is written to the corresponding bit, the JTAG interface is disabled, that is, the JTAG interface is controlled to be in a non-debuggable state.

[0037] The secure JTAG authentication method provided in this embodiment involves the processor obtaining an image configuration file containing a JTAG interface enable identifier during the execution of the bootloader program after the chip is powered on and reset. After the image configuration file passes security verification, a JTAG interface enable instruction is sent to the debug module according to the JTAG interface enable identifier contained in the image configuration file. After receiving the JTAG interface enable instruction, the debug module configures the first interface enable register inside the debug module according to the instruction, thereby controlling the JTAG interface to be in a debuggable state.

[0038] In this embodiment of the disclosure, the debugging state of the JTAG interface is controlled by the image configuration file corresponding to the software program executed by the processor, thereby enabling flexible configuration of the JTAG interface state according to actual needs. Furthermore,

[0039] [P-137021-CN-PRI-1][HS2410899CCN] After obtaining the aforementioned image configuration file, a security verification was performed on the image configuration file. Furthermore, after successful verification, the JTAG interface was controlled to be in a debuggable state by configuring the interface enable register in the debug module. Therefore, the above process also possesses high security. In summary, the secure JTAG authentication scheme provided by this disclosure combines software and hardware, taking into account both flexibility and security during chip testing and debugging.

[0040] Furthermore, the secure JTAG authentication scheme provided in this disclosure can control the JTAG interface debugging permissions by setting a first interface enable register in the debugging module to control the JTAG interface debugging permissions according to the JTAG interface enable flag contained in the pre-created image configuration file. The hardware implementation is relatively simple, reducing the hardware resources required for secure JTAG authentication and lowering costs and power consumption.

[0041] Furthermore, considering that after the debugging module configures the first interface enable register internally according to the JTAG interface enable instruction, an attacker may take certain attack measures to modify the configuration of the first interface enable register, thereby changing the debugging permissions of the JTAG interface, this embodiment of the disclosure can also take further measures from a hardware logic perspective to ensure that the chip can only be configured with JTAG interface debugging permissions once after each power-on startup.

[0042] Optionally, in some embodiments, an OTP register (One-Time Programmable Register) can be used as the first interface enable register, thereby taking advantage of the register's characteristic that it can only be written once and cannot be changed once the data is written, to prevent the configuration of the first interface enable register from being maliciously modified.

[0043] Optionally, in other embodiments, a status lock register can be set in the debug module to control the configuration of the first interface enable register from being maliciously tampered with. Specifically:

[0044] After configuring the first interface enable register inside the debug module according to the JTAG interface enable instruction, the above-mentioned secure JTAG authentication method may also include:

[0045] The debug module performs a preset value write operation on the status lock register to control the other registers in the debug module to be in read-only state.

[0046] Specifically, in the above embodiments, a status lock register is set in the debugging module to set permissions for data written to other registers. Furthermore, it can be pre-set that writing different specific values ​​to this status lock register controls the other registers to different states. For example, when a first preset value is written to the status lock register, the other registers in the debugging module are controlled to be in a read-only state, i.e., a state where modification is prohibited; when a second preset value is written to the status lock register, the other registers in the debugging module are controlled to be in a modifiable state. After the debugging module configures the first interface enable register according to the received JTAG interface enable instruction, it can write the first preset value to the status lock register, thereby controlling the remaining registers in the debugging module to be in a state where modification is prohibited. Through this method, the configuration of the first interface enable register in the debugging module can be effectively prevented from being maliciously tampered with.

[0047] [P-137021-CN-PRI-1][HS2410899CCN]

[0048] Optionally, in some embodiments, the image configuration file may also include: public key information, and image signature information;

[0049] Perform security verification on the image configuration file, including:

[0050] The public key information is used to verify the signature of the image signature information;

[0051] If the signature verification passes, the file hash value of the image configuration file is calculated and compared with the existing hash value contained in the image signature information.

[0052] If the file hash value matches an existing hash value, then the image configuration file has passed security verification.

[0053] Specifically, in the above embodiments, a public key and a signature are used to perform security verification on the image configuration file, thereby ensuring the integrity of the file and the reliability of its source, and preventing the file from being maliciously tampered with.

[0054] When creating an image configuration file, an asymmetric encryption algorithm can be used to generate a public and private key pair. The private key is kept secret, while the public key can be made public. The creator of the image configuration file can use the private key to sign the file, thereby generating image signature data. After the public key information and image signature information are sent to the chip along with the image configuration file, the processor in the chip can use the obtained public key information to verify the image signature information. After the signature verification is successful, the hash value of the image configuration file can be calculated, and the calculated file hash value can be compared with the existing hash value contained in the image signature information. If the hash values ​​match, the signature can be confirmed as valid, that is, the image configuration file can be confirmed as not having been tampered with.

[0055] The aforementioned security verification process based on public keys and signatures utilizes an asymmetric encryption mechanism using public and private keys, enabling verification of a file's origin without sharing the secret. Furthermore, the verification process based on public keys and signatures is relatively simple and convenient; therefore, this verification method can also improve the efficiency of security verification.

[0056] Optionally, in some embodiments, the image configuration file may further include: device identification information; after security verification of the image configuration file, the secure JTAG authentication method may further include:

[0057] Obtain the device identification information corresponding to the chip;

[0058] Compare the device identification information corresponding to the obtained chip with the device identification information contained in the image configuration file; if they are the same, the verification is confirmed to be successful.

[0059] Specifically, the device identification information can be a unique identifier representing the device where the chip resides; that is, the device identification information is used to identify the uniqueness of the device where the chip resides. The specific content of the device identification information in this embodiment is not limited; any suitable code or number with a unique correspondence can be used as the device identification information. For example, the device identification information can be the device serial number of the device where the chip resides, etc.

[0060] In the case where the image configuration file created for the current chip indicates that JTAG interface debugging permissions are disabled, in order to keep the JTAG interface in a debuggable state, an attacker may use an image configuration file created for other devices that indicates that JTAG interface debugging permissions are enabled to impersonate the image configuration file created for the current chip, thereby enabling the debugging permissions of the JTAG interface in the current chip through the secure JTAG authentication method provided in the above embodiments of this disclosure.

[0061] To avoid the aforementioned situation, in the example disclosed above, a unique device identifier representing the device where the chip is located is added to the image configuration file. Therefore, after obtaining the image configuration file, the settings are first configured...

[0062] [P-137021-CN-PRI-1][HS2410899CCN] Check the device identification information. When the device identification information contained in the image configuration file is the same as the real device identification information of the device where the chip is located, it can be guaranteed that the image configuration file obtained is created for the current chip, which eliminates the above-mentioned situation of impersonating the image configuration file. At this time, sending the JTAG interface enable command to the debugging module can further improve the security of the chip during the testing and debugging process.

[0063] Optionally, in some embodiments, the secure JTAG authentication method may further include:

[0064] If the device identification information corresponding to the obtained chip is different from the device identification information contained in the image configuration file, the verification is determined to have failed.

[0065] Send a JTAG interface disable command to the debug module via the processor;

[0066] The debugging module receives the JTAG interface disable command and configures the first interface enable register according to the JTAG interface disable command to control the JTAG interface to be in a disabled state.

[0067] Specifically, when the device identification information contained in the image configuration file is different from the actual device identification information of the device where the chip is located, it can be confirmed that the currently obtained image configuration file is untrusted, or even maliciously tampered with by an attacker. In this case, to ensure the security of the data inside the chip, the processor can send a JTAG interface disable instruction to the debug module, so that the debug module can configure the first interface enable register according to the JTAG interface disable instruction, thereby controlling the JTAG interface to be in a disabled state.

[0068] As described in step 104 above, one or more bits can be set in the first interface enable register to control the debug state of the JTAG interface. The process of configuring the first interface enable register inside the debug module according to the JTAG interface disable instruction can also be as follows: write a preset value to the corresponding bit of the first interface enable register to control the JTAG interface to be in a disabled state. For example, if writing 1 to the corresponding bit enables the JTAG interface, that is, controls the JTAG interface to be in a debuggable state; conversely, writing 0 to the corresponding bit disables the JTAG interface, that is, controls the JTAG interface to be in a non-debuggable state. Then, when the debug module receives the JTAG interface disable instruction sent by the processor, it can write 0 to the corresponding bit of the first interface enable register, thereby disabling the JTAG interface.

[0069] Furthermore, similar to the case where the debug module configures its internal first interface enable register according to the JTAG interface enable instruction, considering that after the debug module configures its internal first interface enable register according to the JTAG interface disable instruction, an attacker might take certain attack measures to modify the configuration of the first interface enable register, thereby changing the JTAG interface debugging permission from a disabled state to a debuggable state, this embodiment of the disclosure can also take further measures from a hardware logic perspective to ensure that the chip can only configure JTAG interface debugging permission once after each power-on startup.

[0070] Optionally, in some embodiments, an OTP register (One-Time Programmable Register) can be used as the first interface enable register, thereby taking advantage of the register's characteristic that it can only be written once and cannot be changed once the data is written, to prevent the configuration of the first interface enable register from being maliciously modified.

[0071] Alternatively, in some other embodiments, a status lock register can be set in the debug module to enable...

[0072] [P-137021-CN-PRI-1][HS2410899CCN] The configuration of the first interface enable register is controlled through the status lock register to prevent malicious tampering. Specifically:

[0073] After configuring the first interface enable register inside the debug module according to the JTAG interface disable instruction, the above-mentioned secure JTAG authentication method may also include:

[0074] The debug module performs a preset value write operation on the status lock register to control the other registers in the debug module to be in read-only state.

[0075] Specifically, in the above embodiments, a status lock register is set in the debugging module to set permissions for data written to other registers. Furthermore, it can be pre-set that writing different specific values ​​to this status lock register controls the other registers to different states. For example, when a first preset value is written to the status lock register, the other registers in the debugging module are controlled to be in a read-only state, i.e., a state where modification is prohibited; when a second preset value is written to the status lock register, the other registers in the debugging module are controlled to be in a modifiable state. After the debugging module configures the first interface enable register according to the received JTAG interface disable instruction, it can write the first preset value to the status lock register, thereby controlling the remaining registers in the debugging module to be in a state where modification is prohibited. Through this method, the problem of malicious tampering with the configuration of the first interface enable register in the debugging module, leading to the tampering of JTAG interface debugging permissions, can be effectively avoided.

[0076] Optionally, in some embodiments, the device identification information corresponding to the chip is stored in a one-time programmable memory in the chip.

[0077] Specifically, the actual device identification information of the device on which the chip is located can be stored in the one-time programmable memory in the chip. This utilizes the characteristic of one-time programmable memory that it can only be written once and cannot be changed once the data is written, to prevent attackers from maliciously tampering with the actual device identification information of the device on which the chip is located, thereby further improving the security of the chip during testing and debugging.

[0078] See Figure 2 , Figure 2 This is a flowchart of a secure JTAG authentication method according to another embodiment of this disclosure. The following is in conjunction with... Figure 2 The secure JTAG authentication scheme provided in the embodiments of this disclosure will be explained and described as follows:

[0079] After the chip powers on, the processor loads and executes the bootloader BOOTROM, and obtains the corresponding image configuration file during program execution. To ensure file reliability, security verification is performed based on the public key information and image signature information contained in the image configuration file. After successful verification, the chip's corresponding device serial number is read from the chip's one-time programmable memory and compared with the device serial number in the image configuration file. If the two serial numbers match, the image configuration file is considered reliable. The processor then sends a JTAG interface enable instruction to the debug module, causing the debug module to configure its internal first interface enable register to enable the JTAG interface. If the two serial numbers differ, the image configuration file has been tampered with. To ensure chip data security, the processor sends a JTAG interface disable instruction to the debug module, causing the debug module to configure its internal first interface enable register to disable the JTAG interface.

[0080] Further, see Figure 2 To prevent the configuration of the first interface enable register from being maliciously tampered with, it is still being debugged.

[0081] The [P-137021-CN-PRI-1][HS2410899CCN] test module includes a status lock register. After configuring the first interface enable register in the debug module, a preset value is written to the status lock register through the debug module. This controls all registers in the debug module except the status lock register to be in read-only mode, thus preventing modification of the first interface enable register configuration. Afterward, the BOOTROM program execution can continue until the chip initialization is complete.

[0082] Optionally, in some embodiments, the debugging module further includes a second interface enable register; the method may also include:

[0083] Obtain chip lifecycle information through the debugging module;

[0084] If the chip is determined to be in the production testing phase based on the chip lifecycle information, then configure the second interface enable register to control the JTAG interface to be in a debuggable state.

[0085] Specifically, in this embodiment of the disclosure, the debugging module is provided with two interface enable registers that can control the debugging permissions of the JTAG interface: a first interface enable register and a second interface enable register. That is, the debugging module has two parallel JTAG interface control links: a control link based on the first interface enable register and a control link based on the second interface enable register.

[0086] Regarding the control link based on the first interface enable register, as described in the above embodiments, the specific configuration of the first interface enable register is determined by the JTAG interface enable instruction sent by the processor according to the JTAG interface enable flag in the image configuration file. In other words, the control link based on the first interface enable register controls the debugging state of the JTAG interface through the image configuration file corresponding to the software program executed by the processor. Therefore, the JTAG interface state can be flexibly configured according to actual needs.

[0087] Regarding the control link based on the second interface enable register, its specific configuration is determined by the debugging module based on the chip's current lifecycle information. Specifically: when the chip is in the production testing phase, the control link based on the second interface enable register is configured to be enabled, facilitating debugging and testing by R&D or testing personnel. This configuration process does not require recreating the image configuration file; instead, it is automated by the debugging module based on the chip's current lifecycle information. Therefore, the operation is simple and cost-effective. When the chip is in the non-production testing phase (i.e., the off-line phase), the control link based on the second interface enable register can be configured to be disabled. If a problem occurs with the chip, a valid image configuration file can be created, and then JTAG interface debugging permissions can be enabled through the control link of the first interface enable register.

[0088] In this embodiment, two JTAG interface debugging permission control links are set in the debugging module to enable JTAG interface debugging permissions under different circumstances. Specifically: when the chip is in the production testing phase, the control link based on the second interface enable register will automatically be enabled, thus conveniently and quickly meeting debugging and testing needs; when the chip is in the non-production testing phase, an image configuration file can be created according to testing needs, and then JTAG interface debugging permissions can be enabled through the control link based on the first interface enable register, thus balancing the flexibility and security of the chip during testing and debugging. In summary, the above embodiments of this disclosure...

[0089] [P-137021-CN-PRI-1][HS2410899CCN] Examples can be used in different application scenarios and have the advantages of convenience, security and flexibility.

[0090] See Figure 3 , Figure 3 This is a flowchart of a secure JTAG authentication method according to yet another embodiment of this disclosure. The following is in conjunction with... Figure 3 The specific process of controlling JTAG interface debugging permissions through the two JTAG interface debugging permission control links mentioned above will be explained.

[0091] After the chip is powered on or reset, the control link based on the first interface enable register is in a closed and configurable state by default. That is, the link is currently closed, but it can be enabled by the image configuration file corresponding to the software program executed by the processor. The control link based on the second interface enable register is closed by default.

[0092] The debugging module first obtains the chip lifecycle information and determines the current stage of the chip, specifically: whether the chip is currently in the production testing stage.

[0093] If the current stage is production testing, the control link based on the second interface enable register will be automatically enabled, while the control link based on the first interface enable register will remain configurable.

[0094] If the system is currently in the production testing phase, the control link based on the first interface enable register will be automatically disabled, while maintaining its configurable state. Subsequently, when a chip issue arises requiring testing and debugging via the JTAG interface, a valid image configuration file can be created, thereby enabling JTAG interface debugging permissions through the control link of the first interface enable register.

[0095] Furthermore, to prevent attackers from modifying the configuration of the first interface enable register and thus altering the debugging permissions of the JTAG interface, additional measures can be taken from a hardware logic perspective to ensure that the chip can only configure the first interface enable register once after each power-on, thus ensuring that the state of the control link based on the first interface enable register is unconfigurable. For example, an OTP register can be used as the first interface enable register; alternatively, a status lock register can be set in the debug module to control the configuration of the first interface enable register from being maliciously tampered with.

[0096] Optionally, in some embodiments, chip lifecycle information is stored in a one-time programmable memory within the chip;

[0097] By using the debugging module, chip lifecycle information can be obtained, including:

[0098] The debug module reads chip lifecycle information from a one-time programmable memory.

[0099] Specifically, because one-time programmable memory (IPM) can only be written to once and cannot be changed once the data is written, chip lifecycle information can be stored in IPM to prevent malicious tampering. This method of using IPM to store chip lifecycle information further enhances the security of the chip during testing and debugging.

[0100] Example 2

[0101] See Figure 4 , Figure 4 This is a schematic diagram of the internal structure of a chip according to an embodiment of this disclosure. The chip 400 includes: a processor 4002, a debugging module 4004, and a JTAG interface 4006. Specifically:

[0102] Processor 4002 is used to obtain the image configuration corresponding to the bootloader during the execution of the bootloader.

[0103] [P-137021-CN-PRI-1][HS2410899CCN] Set the file; perform security verification on the image configuration file, and after successful verification, send a JTAG interface enable command to the debug module according to the JTAG interface enable flag contained in the image configuration file.

[0104] The debugging module 4004 is used to receive the JTAG interface enable instruction and configure the first interface enable register inside the debugging module according to the JTAG interface enable instruction, so as to control the JTAG interface 4006 to be in a debuggable state.

[0105] Specifically, based on the BOOTROM program's ability to store device configuration information, this embodiment adds a JTAG interface enable flag to the corresponding image configuration file of the BOOTROM program when it is desired to enable debugging permissions for the chip's JTAG interface for chip testing and debugging. After obtaining the image configuration file containing the JTAG interface enable flag, to ensure the file's security, integrity, and source reliability, and to prevent malicious tampering, this embodiment performs security verification on the image configuration file. After successful verification, the processor 4002 can send a JTAG interface enable command to the debugging module 4004, causing the debugging module 4004 to configure its internal first interface enable register according to the JTAG interface enable command, thereby controlling the JTAG interface to be in a debuggable state.

[0106] The chip provided in this disclosure, after power-on reset, controls the debug state of the JTAG interface through the image configuration file corresponding to the software program executed by the processor 4002, thereby enabling flexible configuration of the JTAG interface state according to actual needs. Furthermore, after obtaining the image configuration file, a security verification is performed on it. Specifically, after successful verification, the JTAG interface is controlled to be in a debuggable state by configuring the interface enable register in the debug module 4004. Therefore, the above process also has high security. In summary, the secure JTAG authentication scheme provided in this disclosure, through a combination of software and hardware, balances the flexibility and security of the chip during testing and debugging.

[0107] In addition, the chip provided in this embodiment can control the JTAG interface debugging permission by setting a first interface enable register for controlling the JTAG interface debugging permission in the debugging module 4004. This can be achieved according to the JTAG interface enable flag contained in the pre-created image configuration file. The hardware implementation difficulty is low, reducing the hardware resources required for secure JTAG authentication and lowering costs and power consumption.

[0108] Optionally, in some embodiments, the debug module 4004 is further provided with a status lock register;

[0109] The debug module 4004 is also used to perform a preset value write operation on the status lock register after configuring the first interface enable register inside the debug module 4004 according to the JTAG interface enable instruction, so as to control the other registers in the debug module 4004 except the status lock register to be in a read-only state.

[0110] Optionally, in some embodiments, the debugging module 4004 is further provided with a second interface enable register; the debugging module 4004 is also used to: obtain chip lifecycle information; if it is determined based on the chip lifecycle information that the chip is in the production testing stage, then configure the second interface enable register to control the JTAG interface to be in a debuggable state.

[0111] Optionally, in some embodiments, the chip lifecycle information is stored in a one-time programmable memory in the chip 400; when the debug module 4004 performs the step of acquiring the chip lifecycle information, it is specifically used for:

[0112] The chip lifecycle information is read from the one-time programmable memory using the debug module 4004.

[0113] Optionally, in some embodiments, the image configuration file further includes: public key information, and image signature information;

[0114] [P-137021-CN-PRI-1][HS2410899CCN]

[0115] Processor 4002, when performing the security verification step of the image configuration file, is specifically used for:

[0116] The public key information is used to verify the signature of the image signature information;

[0117] If the signature verification passes, the file hash value of the image configuration file is calculated and compared with the existing hash value contained in the image signature information.

[0118] If the file hash value matches an existing hash value, then the image configuration file has passed security verification.

[0119] Optionally, in some embodiments, the image configuration file further includes: device identification information; after performing the step of security verification of the image configuration file, the processor is further configured to:

[0120] Obtain the device identification information corresponding to the chip;

[0121] Compare the device identification information corresponding to the obtained chip 400 with the device identification information contained in the image configuration file; if they are the same, the verification is confirmed to be successful.

[0122] Optionally, in some embodiments, the processor 4002 is further configured to:

[0123] If the device identification information corresponding to the obtained chip 400 is different from the device identification information contained in the image configuration file, the verification is determined to have failed; a JTAG interface disable command is sent to the debug module 4004 through the processor 4002.

[0124] Correspondingly, the debugging module 4004 is also used to: receive a JTAG interface disable instruction and configure the first interface enable register according to the JTAG interface disable instruction to control the JTAG interface to be in a disabled state.

[0125] Optionally, in some embodiments, the device identification information corresponding to chip 400 is stored in a one-time programmable memory in chip 400.

[0126] It should be noted that the details of chip 400 have been described in detail with reference to the flowchart in the above-mentioned secure JTAG authentication embodiment. For specific details, please refer to the description in the above-mentioned secure JTAG authentication embodiment. It will not be repeated here.

[0127] This disclosure also provides an electronic device, including the chip described in the above embodiments.

[0128] It should be understood that the various embodiments in this specification are described in a progressive manner, and the same or similar parts between the various embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, for the method embodiments, since they are basically similar to the methods described in the apparatus and system embodiments, the description is relatively simple, and relevant parts can be referred to the descriptions of other embodiments.

[0129] It should be understood that the foregoing describes specific embodiments of this specification. Other embodiments are within the scope of the claims. In some cases, the actions or steps recited in the claims may be performed in a different order than that shown in the embodiments and may still achieve the desired result. Furthermore, the processes depicted in the drawings do not necessarily require the specific or sequential order shown to achieve the desired result. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0130] It should be understood that the use of a singular form to describe an element or to show only one element in the accompanying drawings does not imply that the number of such element is limited to one. Furthermore, modules or elements described or shown as separate herein may be combined into a single module or element, and modules or elements described or shown as single herein may be broken down into multiple modules or elements.

[0131] It should also be understood that the terminology and expressions used herein are for descriptive purposes only, and one or more embodiments described herein should not be limited to these terms and expressions. The use of these terms and expressions does not exclude any illustrative and descriptive equivalent features (or parts thereof), and it should be recognized that various modifications that may exist should also be included within the scope of the claims. Other modifications, variations, and substitutions may also exist. Accordingly, the claims should be considered to cover all such equivalents.

Claims

1. A secure JTAG authentication method applied to a chip, the chip comprising a processor, a debugging module, and a JTAG interface, the method comprising: During the execution of the bootloader, the processor obtains the image configuration file corresponding to the bootloader. The image configuration file is subjected to security verification, and after the verification is successful, a JTAG interface enable command is sent to the debugging module according to the JTAG interface enable flag contained in the image configuration file. The debugging module receives the JTAG interface enable instruction and configures the first interface enable register inside the debugging module according to the JTAG interface enable instruction to control the JTAG interface to be in a debuggable state.

2. The method according to claim 1, wherein, The debugging module is also equipped with a status lock register; After configuring the first interface enable register inside the debug module according to the JTAG interface enable instruction, the method further includes: The debugging module performs a preset value write operation on the status lock register to control the other registers in the debugging module, except for the status lock register, to be in a read-only state.

3. The method according to claim 2, wherein, The debugging module also includes a second interface enable register; the method further includes: The debugging module is used to obtain chip lifecycle information; If the chip is determined to be in the production testing phase based on the chip lifecycle information, then the second interface enable register is configured to control the JTAG interface to be in a debuggable state.

4. The method according to claim 3, wherein, The chip lifecycle information is stored in a one-time programmable memory within the chip; The step of obtaining chip lifecycle information through the debugging module includes: The debugging module reads the chip lifecycle information from the one-time programmable memory.

5. The method according to any one of claims 1-4, wherein, The image configuration file also includes: public key information, and image signature information; The security verification of the image configuration file includes: The public key information is used to verify the signature of the image signature information; If the signature verification passes, the file hash value of the image configuration file is calculated, and the calculated file hash value is compared with the existing hash value contained in the image signature information. If the file hash value matches the existing hash value, then the image configuration file is determined to have passed security verification.

6. The method according to any one of claims 1-4, wherein, The image configuration file also includes: device identification information; after performing security verification on the image configuration file, the method further includes: Obtain the device identification information corresponding to the chip; Compare the device identifier information corresponding to the obtained chip with the device identifier [P-137021-CN-PRI-1][HS2410899CCN] information contained in the image configuration file; if they are the same, the verification is confirmed to be successful.

7. The method according to claim 6, wherein, The method further includes: If the device identification information corresponding to the obtained chip is different from the device identification information contained in the image configuration file, then the verification is determined to have failed. The processor sends a JTAG interface disable command to the debug module; The debugging module receives the JTAG interface disable command and configures the first interface enable register according to the JTAG interface disable command to control the JTAG interface to be in a disabled state.

8. The method according to claim 6, wherein, The device identification information corresponding to the chip is stored in the one-time programmable memory in the chip.

9. A chip, comprising: Processor, debug module, and JTAG interface; The processor is configured to obtain the image configuration file corresponding to the bootloader during the execution of the bootloader; perform security verification on the image configuration file; and, after the verification is passed, send a JTAG interface enable instruction to the debug module according to the JTAG interface enable flag contained in the image configuration file. The debugging module is used to receive the JTAG interface enable instruction and configure the first interface enable register inside the debugging module according to the JTAG interface enable instruction, so as to control the JTAG interface to be in a debuggable state.

10. An electronic device, comprising: The chip as described in claim 9.

Images