Fault-tolerant storage and recovery method and system for software configuration data under electromagnetic fault injection

Abstract

The application discloses a software configuration data fault-tolerant storage and recovery method and system under electromagnetic fault injection. The method comprises a storage stage and a recovery stage: the software configuration data to be protected is split into multiple data shares in the storage stage, so that the configuration data can be restored when a preset threshold number of shares is collected, and the configuration data cannot be restored when the number of shares is less than the threshold; a flip radius of electromagnetic fault injection is determined, addresses are allocated to each share so that the physical distance between any two shares is greater than the flip radius, and the shares are stored according to the addresses; in the recovery stage, the surviving shares are read, and the configuration data is restored from the surviving shares when the number of the surviving shares reaches the threshold. The physical space distribution of the shares is constrained by the flip radius, so that at most one share is damaged physically by a single electromagnetic fault injection, the configuration data can be completely restored from the sufficient surviving shares after a single spatially concentrated damage, and the method does not depend on customized physical isolation hardware and can be implemented by software logic on a general-purpose memory.

Description

Technical Field

[0001] This invention relates to the field of computer data fault tolerance and recovery technology, specifically to a method and system for fault-tolerant storage and recovery of software configuration data under electromagnetic fault injection. Background Technology

[0002] Software configuration data is fundamental to the normal operation of various embedded systems, security chips, and industrial control equipment. During power-on and operation, the device needs to read a set of configuration data from memory, such as operating parameters, permission flags, key indexes, and control policies, and uses this data to determine the subsequent control flow and functional behavior. If this set of configuration data is bit-flipped or partially corrupted during storage or retrieval and is not corrected, the device may enter an unexpected operating state. Therefore, enabling the device to completely restore its configuration data and maintain correct operation after partial damage is a common practical requirement for all types of equipment.

[0003] As the deployment environments of such devices become increasingly complex, electromagnetic fault injection has become a real threat. Attackers can use electromagnetic pulse probes to apply transient disturbances to localized areas of a chip, causing bit flips to occur simultaneously in a contiguous area of ​​memory cells covered by the probe's flip radius in a single injection, resulting in localized damage with spatial clustering characteristics. Ensuring the complete restoration of configuration data under such spatially clustered damage is a problem that needs to be addressed in this field.

[0004] To address bit flips and partial corruption in stored data, related technologies generally incorporate detection and error correction mechanisms. For example, patent application CN113886810A discloses a detection and error correction method based on an SPN structure for persistent fault attacks. This method pre-stores input-output pairs and compares them at runtime to detect faults. It also establishes redundancy relationships between each element in the protected data and its logically adjacent elements. When a fault is detected, a majority vote is performed using multiple logically adjacent candidate elements to restore the corrupted element, and a system shutdown and restart are performed if necessary. This method improves the system's ability to maintain data integrity under fault conditions to a certain extent.

[0005] This approach of "establishing redundancy for protected data to facilitate recovery after damage" is prevalent in the field. Existing fault-tolerant solutions typically focus on the logical relationships and quantity of redundancy when designing redundancy, rarely considering the spatial distribution of redundancy and protected data in memory as constraints. For example, patent application CN105740168A discloses a fault-tolerant directory cache controller that achieves redundancy by setting multiple directory caches and using crossbar switches to improve the system's fault tolerance and reliability under harsh conditions such as complex electromagnetic environments. Another example is patent application CN105955839A, which discloses a regenerable code fault-tolerant method based on finite-field binary addition shifting. This method uses finite-field binary encoding redundancy and distributed storage to recover the original data after partial data failure. These solutions achieve fault tolerance and recovery by increasing redundancy or by combining encoding layer redundancy with logical dispersion. Their redundancy configuration focuses on the logical and quantitative levels, without considering the physical spatial distribution of redundancy and protected data in memory as constraints against damage. It is evident that "when designing redundancy for fault tolerance, only logical relationships and quantity are considered, redundancy is assumed to always be available, and the physical spatial distribution of redundancy and protected data is not constrained" is a common design approach in fault-tolerant storage and recovery solutions in this field.

[0006] However, existing technologies, such as detection and error correction, adding redundancy, or coding redundancy, only design redundancy at the logical level and in terms of quantity when establishing redundancy for the protected data to achieve restoration. That is, they only focus on "how many redundancies to allocate for each element, and how the redundancies are logically adjacent or how they are distributed," without constraining the physical spatial distribution of the redundancy and the protected data in memory. As a result, the redundancy used for restoration and the protected data are often placed in adjacent storage areas. When only scattered bit flips occur at the logical level, this arrangement can be corrected by adjacent redundancy; however, when facing situations such as electromagnetic fault injection that cause spatial clustering damage within a single flip radius, the protected data and its adjacent redundancy used for restoration are likely to be in the same storage space that can be covered by a single disturbance, thus tending to be destroyed together; furthermore, multiple candidate values ​​participating in the majority vote, because they share the premise of "intact adjacent redundancy," are also prone to misalignment under spatial clustering damage, making the voting results tend to be distorted.

[0007] In summary, neither existing technologies relying on logical adjacency redundancy for error correction, nor conventional approaches that simply increase the number of redundancies or employ coded redundancy, can meet the requirements in terms of resistance to spatial clustering damage. The actual operation of these devices precisely demands that configuration data be completely restored even after spatial clustering damage caused by electromagnetic fault injection. How to solve this problem without relying on customized physical isolation hardware has become a pressing technical challenge in this field.

[0008] The core technical problem this invention aims to solve is that existing software configuration data fault-tolerant storage and recovery methods only design redundancy in terms of logic and quantity. The default redundancy is always safe and does not constrain the spatial distribution of redundancy and protected data in physical memory. This results in the recovery redundancy and protected data being placed in the same physical space that can be covered by a single disturbance. Therefore, it cannot resist attacks such as electromagnetic fault injection that cause spatial clustering damage within a single flip radius. A single injection can simultaneously break down the protected data and its recovery redundancy, and cause multiple candidate values ​​sharing the premise of being intact to be misdirected, thus deceiving the majority vote. Ultimately, without relying on customized physical isolation hardware, it is impossible to guarantee that the configuration data can be completely restored. Summary of the Invention

[0009] To address the aforementioned problems in the existing technology, this invention provides a method and system for fault-tolerant storage and recovery of software configuration data under electromagnetic fault injection. Without relying on customized physical isolation hardware, it incorporates the physical spatial distribution of redundant and protected data into the design of fault-tolerant storage and recovery, enabling the software configuration data to be completely restored even after spatial aggregation damage caused by electromagnetic fault injection.

[0010] The inventors of this invention discovered that the root cause of the difficulty in resisting electromagnetic fault injection in existing software configuration data fault-tolerant storage and recovery schemes lies in the implicit assumption that these schemes assume a never-stated premise: as long as redundancy is provided logically and quantitatively, redundancy will always be available, regardless of the physical area of ​​memory where the redundancy and the protected data reside or their distance from each other. Based on this default premise, the protected data and the redundancy used for restoration are often tightly packed in adjacent physical storage areas. This arrangement is not problematic when only scattered bit flips occur at the logical level, but when electromagnetic fault injection causes spatial clustering damage, the protected data and its redundancy are in the same physical space that can be covered by a single disturbance and are thus destroyed together. This also causes multiple candidate values ​​sharing the premise of "intact adjacent redundancy" to be misdirected, resulting in distorted voting. Therefore, the crux of the problem is not whether the logical design or quantity of redundancy is sufficient, but rather that existing schemes lack the constraint of the "physical spatial distribution" dimension.

[0011] Based on the above understanding, the core concept of this invention is to: split the software configuration data to be protected into multiple data shares, so that any insufficient share cannot restore the original configuration data; then, using the flip radius of the electromagnetic fault injection as a constraint benchmark, forcing the storage addresses of any two data shares to be physically spaced apart by a distance greater than the flip radius, so that any electromagnetic fault injection can only physically cover and damage at most one data share, and cannot simultaneously reach the second share; thus, after a spatial cluster damage, there are still sufficient surviving shares to restore the complete software configuration data. Here, "using the flip radius as a constraint benchmark to make each share physically discrete" and "the characteristic of sufficient share restoration" are functionally mutually supportive and jointly necessary to achieve the above objectives, and are not simply a superposition of mutually independent features; the effect of "a spatial cluster damage at most damages one share, thus still allowing restoration" is geometrically necessarily derived from the physical fact that the flip radius defines the single impact range and the layout constraint that the physical distance between shares is greater than the flip radius. The mechanism can be found in the theoretical analysis of the working mechanism in the specific embodiments below.

[0012] The first aspect of the present invention provides a method for fault-tolerant storage and recovery of software configuration data under electromagnetic fault injection, including a storage stage and a recovery stage.

[0013] In the storage phase, the software configuration data to be protected is divided into multiple data shares. The software configuration data can be restored if a preset threshold number of data shares are collected, while fewer than the threshold number of data shares are insufficient to restore the software configuration data. The flip radius of the electromagnetic fault injection is determined, and storage addresses in the memory are allocated to the multiple data shares, such that the physical distance between the storage addresses of any two data shares is greater than the flip radius. The multiple data shares are then distributed and stored in the memory according to the allocated storage addresses.

[0014] During the recovery phase, surviving data shares are read from the storage address. When the number of surviving data shares reaches the threshold number, the software configuration data is restored from the surviving data shares.

[0015] Furthermore, when allocating storage addresses in the memory for the multiple data shares, the correspondence between the addresses and physical locations of the memory in the physical layout is obtained. Based on the correspondence, candidate storage addresses with a distance between multiple physical locations that is greater than the flip radius are selected, and the multiple data shares are mapped one by one to the candidate storage addresses, so that the multiple data shares are physically discrete and discontinuous.

[0016] Furthermore, the physical distance that each data share should satisfy can be taken as the lower limit distance determined by adding a preset safety margin to the flip radius, so that the physical distance between the storage addresses of any two allocated data shares is not less than the lower limit distance, thereby maintaining the isolation margin that a single share can be covered even when there is an estimation deviation in the flip radius.

[0017] Furthermore, the process of splitting the software configuration data into multiple data shares involves constructing a characteristic polynomial over a finite domain, with the software configuration data as the quantity to be recovered. Multiple evaluation points are then taken on this characteristic polynomial to obtain the multiple data shares. Correspondingly, the process of reconstructing the software configuration data from the surviving data shares can be achieved through interpolation operations based on the evaluation points corresponding to the surviving shares. Using this method, any number of shares below a threshold cannot deduce the original configuration data, while any combination of surviving shares reaching the threshold can reconstruct the original configuration data. This, combined with the aforementioned discrete layout of physical space, allows for reconstruction even after a single share is destroyed in a spatial aggregation event.

[0018] Furthermore, the recovery phase can also extract the program counter timing trace of the preceding core instructions during the execution of the data share before reading it. A dynamic signature is generated based on this program counter timing trace, and the dynamic signature is logically correlated with the storage address of the data share to obtain the solution address for reading. The data share is then read according to the solution address. Therefore, the actual read address of the data share is not statically fixed, but is bound to the valid execution trace of the preceding core instructions. Only when the preceding execution trace meets expectations can the correct read address be calculated.

[0019] Furthermore, the recovery phase performs a validity check on the dynamic signature: when the dynamic signature is valid, the surviving data share is read according to the solution address and restoration is performed; when the dynamic signature is invalid, the solution address is directed to a preset anomaly trap area, thereby triggering a block and preventing restoration from being performed. With this arrangement, when electromagnetic fault injection disturbs the control flow preceding the read while altering the data share, the abnormal control flow trajectory will cause the solution address to fall directly into the anomaly trap area, blocking the injected and altered read process on-site, preventing the reading and acceptance of contaminated data even when the control flow has been disturbed.

[0020] A second aspect of the present invention provides a fault-tolerant storage and recovery system for software configuration data under electromagnetic fault injection, comprising a share splitting module, a layout allocation module, a distributed storage module, and a recovery module. The share splitting module is used to split the software configuration data to be protected into multiple data shares that satisfy the aforementioned threshold restoration characteristics; the layout allocation module is used to determine the flip radius of the electromagnetic fault injection and allocate storage addresses to the multiple data shares such that the physical distance between any two shares is greater than the flip radius; the distributed storage module is used to distribute and store the multiple data shares in a memory according to the allocated storage addresses; the recovery module is used to read the surviving data shares from the storage addresses and restore the software configuration data from the surviving shares when the number of surviving shares reaches a threshold number. The recovery module may further include a signature resolution unit, used to extract the program counter timing trace of the preceding core instructions before reading to generate a dynamic signature, and to resolve the read address accordingly; when the signature is valid, the surviving share is read and restored; when the signature is invalid, the resolved address is directed to an abnormal trap area to trigger blocking.

[0021] Compared with the prior art, the present invention has the following beneficial effects: Firstly, this invention introduces the dimension of "physical spatial distribution," which is generally overlooked in existing fault-tolerant schemes, into the fault-tolerant storage and recovery of software configuration data. Using the flip radius of an electromagnetic fault injection as a constraint benchmark, it forces that the physical distance between any two data shares be greater than this flip radius. Since any single electromagnetic fault injection can physically cover at most one flip radius, it can only damage at most one data share and cannot simultaneously reach a second share. Combined with the splitting characteristic of "sufficient shares can be restored, insufficient shares cannot be restored," configuration data can still be completely restored from surviving shares after a spatial clustering failure. This effect is inherently derived from the aforementioned physical layout constraints and share restoration characteristics, and does not rely on any customized physical isolation hardware; it can be implemented in software logic on general-purpose memory.

[0022] Secondly, this invention does not employ the existing method of "majority voting from logically adjacent candidate values ​​to restore the damaged element" during recovery. Instead, it directly collects surviving shares that reach a threshold number and uses them to restore the original configuration data. Since the data shares are physically discrete and any insufficient share cannot be used to deduce the original data, this invention no longer relies on the premise that "the protected data and its adjacent redundancies reside in the same storage area, and the adjacent redundancies are always intact." Accordingly, even if a spatial clustering failure damages a share, it only reduces one surviving share, and avoids the situation where multiple candidate values ​​sharing the premise of "adjacent redundancy intact" are misdirected, causing the majority vote to be deceived and resulting in an incorrect outcome. Thus, from the perspective of the restoration paradigm, this invention avoids the distortion problem of existing adjacent redundancy voting schemes under spatial clustering failure.

[0023] Third, in the implementation of introducing a dynamic signature decoding and reading address based on the program counter timing trajectory, the actual reading address of the data share is bound to the legitimate execution trajectory of the preceding core instruction. When electromagnetic fault injection disturbs the control flow while tampering with the data, the abnormal trajectory will cause the decoding address to fall into the abnormal trap area and trigger the blockage, thus intercepting the injected and polluted reading process on the spot, further improving the reliability of the configuration data reading link under electromagnetic fault injection.

[0024] Fourth, the present invention can be implemented in pure software logic on general-purpose memory and general-purpose processors without the need to introduce customized physical isolation hardware, special shielding structures or additional sensors for electromagnetic fault injection resistance, which facilitates deployment and application on existing embedded devices, security chips and industrial control equipment. Attached Figure Description

[0025] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments are briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0026] Figure 1 This is a block diagram of the software configuration data fault-tolerant storage and recovery system under electromagnetic fault injection provided in an embodiment of the present invention; Figure 2 This is a flowchart of the method for fault-tolerant storage and recovery of software configuration data under electromagnetic fault injection provided in this embodiment of the invention; Figure 3 This is a schematic diagram showing multiple data shares distributed in the memory with a physical spacing greater than the flip radius, as provided in an embodiment of the present invention. Figure 4 This is a flowchart of allocating storage addresses for multiple data shares provided in an embodiment of the present invention; Figure 5 This is a flowchart provided by an embodiment of the present invention for generating a dynamic signature based on the timing trajectory of the program counter and calculating the read address; Figure 6 This is a flowchart provided by an embodiment of the present invention for performing restoration or triggering blocking based on the result of dynamic signature validity judgment.

[0027] Figure reference numerals: 10, Share splitting module; 20, Layout allocation module; 30, Distributed storage module; 40, Recovery module; 41, Signature resolution unit; 100, Memory physical layout; 101, Data share 1; 102, Data share 2; 103, Data share 3; 104, Data share 4; 105, Data share 5; 200, Flip radius coverage; r, Flip radius; d, Physical distance between the storage addresses of any two data shares. Detailed Implementation

[0028] The technical solution of the present invention will be further described in detail below with reference to the embodiments. It should be understood that the specific embodiments described herein are only for explaining the present invention and are not intended to limit the present invention; the share quantity, threshold, finite field order, flip radius value, safety margin, etc. given in the embodiments are all exemplary values, and those skilled in the art can make corresponding adjustments without departing from the concept of the present invention.

[0029] Example 1 This embodiment uses the fault-tolerant storage and recovery of software configuration data in an embedded security control chip as an example to fully illustrate the entire process of this invention from writing configuration data to recovery after being subjected to electromagnetic fault injection. The system composition of this invention can be found in [link to relevant documentation]. Figure 1 The system includes a share splitting module 10, a layout allocation module 20, a distributed storage module 30, and a recovery module 40, wherein the recovery module 40 includes a signature resolution unit 41; the overall flow of the method of the present invention can be found in [reference needed]. Figure 2 This includes the storage phase and the recovery phase.

[0030] (a) Determination of the flipping radius Electromagnetic fault injection utilizes an electromagnetic probe positioned above the chip package. A single pulse induces bit flips in memory cells within a certain physical range directly below the probe; this range is referred to as the flip radius in this invention. In this embodiment, the flip radius is determined as follows: based on the coil diameter and pulse energy specifications of the electromagnetic probe, combined with a pre-characterization of the memory area of ​​the target chip that can actually be covered by a single pulse under these specifications, the maximum physical span of this covered area is taken as the flip radius r. In this embodiment, r is exemplarily taken as 200 micrometers, meaning that a single electromagnetic pulse on the chip layout can at most affect memory cells within a radius of 200 micrometers centered on the injection point.

[0031] (ii) Splitting of configuration data Let the software configuration data to be protected be D. This embodiment uses threshold partitioning over the finite field GF(2^8): select threshold parameters (k, n), where n is the total number of shares and k is the minimum number of shares required for restoration. In this embodiment, n=5 and k=3 are used as an example. Construct a polynomial f(x)=D+a1·x+a2·x^2 of degree k-1=2 over GF(2^8), where the constant term is the configuration data to be protected D, and the coefficients a1 and a2 are non-zero elements randomly selected over GF(2^8). If the length of D exceeds the range that a single finite field element can represent, then D is grouped by bytes, and each group independently constructs the above polynomial for parallel processing. Take n distinct and non-zero x-coordinates x1,…,x5 (in this embodiment, xi=i, i=1,…,5), and calculate n shares si=f(xi), i=1,…,5. Due to the properties of polynomial interpolation over a finite field, the polynomial f(x) can be uniquely reconstructed by taking any number of shares not less than k, and the constant term D can then be obtained. However, for any number of shares less than k, the value of D remains completely uncertain over GF(2^8), and D cannot be deduced in reverse.

[0032] (III) Physically Discrete Layout of Shares – The Core of the Invention This step forces the five shares s1, ..., s5 to be physically located far apart in memory, ensuring that any single electromagnetic pulse can physically cover at most one share. The distribution of each share on the memory physical layout after placement can be found in [reference needed]. Figure 3 The physical layout of the memory is marked as 100, the five data shares are marked as 101 to 105, the flip radius coverage of a single electromagnetic fault injection is marked as 200, the flip radius is denoted as r, and the physical distance between the memory addresses of any two shares is denoted as d. Each share satisfies that d is greater than r. Figure 3 The flip radius covers a range of 200, which can cover at most one share; the specific process for allocating storage addresses to each share can be found in [link to relevant documentation]. Figure 4 .

[0033] It should be clarified that the "physical spacing" referred to in this invention refers to the actual physical distance between two memory cells on the chip layout, not the numerical difference between their logical addresses. Since two memory cells with adjacent logical addresses are not necessarily physically adjacent on the layout, and two cells with very far logical addresses may still be physically adjacent, this invention bases the layout on the physical layout information of the memory, as follows: 1) Pre-obtain the logical address-physical location correspondence of the target memory, that is, the physical coordinates (x, y) of the memory cell corresponding to each logical address on the chip layout. This correspondence can be obtained from the layout information provided by the memory manufacturer or through the physical characterization of the target chip; 2) Under the constraint of this correspondence, a target storage address is selected for each of the 5 shares, such that the Euclidean distance between the physical coordinates corresponding to any two selected addresses is greater than the flip radius r, that is, for any i≠j, ‖(xi,yi)-(xj, yj)‖>r; In this embodiment, the 5 shares are respectively laid out on 5 storage regions on the chip layout with a spacing of more than 200 micrometers; 3) Store the 5 shares in the physical locations corresponding to the memory according to the addresses selected above.

[0034] With this arrangement, since the physical distance between any two shares is greater than the flip radius, a single electromagnetic pulse can physically cover at most the area where one share is located, thus destroying at most one share, while at least four other shares (≥k=3) remain alive, which is sufficient to restore D.

[0035] (iv) Decoding the timing signature of the program counter at the read address The process for generating the dynamic signature and calculating the read address in this step can be found in [link to documentation]. Figure 5 To further prevent attackers from forcing the system to read injected and contaminated regions by tampering with the read address pointer, this embodiment applies a dynamic signature constraint based on the program counter (PC) timing trajectory to the read address before reading the share.

[0036] 1) During the execution of the preceding core instructions in the configuration data reading process, collect the program counter value sequence PC1, PC2, …, PCm (i.e., the PC timing trajectory of the preceding core instructions) when these instructions are executed sequentially. 2) Apply a predetermined hash operation H to the PC time-series trajectory to generate a dynamic signature sig=H(PC1‖PC2‖…‖PCm); 3) Perform a logical entanglement operation between the physical base address pointer base_i of each share and the dynamic signature sig to obtain the actual read address addr_i = base_i ⊕ g(sig), where g is a predetermined mapping function and ⊕ is a bitwise XOR operation. When the preceding instructions are executed according to the normal control flow and the PC timing trace is not tampered with, g(sig) obtains the expected value that makes addr_i point exactly to the actual storage location of the i-th share, thereby correctly reading each surviving share.

[0037] (v) Share reading, legality determination and restoration This step, based on the dynamic signature validity assessment result, executes the restoration or triggers blocking process. See [link to relevant documentation]. Figure 6 .

[0038] 1) Read the remaining shares based on the actual read address addr_i calculated above; 2) Verify whether the dynamic signature sig used for this calculation is valid: If the preceding control flow is normal and the PC timing trajectory is consistent with expectations, then sig is valid and the calculation address points to the real share location; if the attacker tampered with the read address pointer or disrupted the preceding control flow, causing the PC timing trajectory to deviate from expectations, then sig changes, and g(sig) changes accordingly, so that addr_i no longer points to the real share, but points to the preset abnormal trap area; 3) For the live shares read, when the signature is valid, collect no less than k=3 shares and use Lagrange interpolation on the finite field GF(2^8) to restore the original configuration data D; when the signature changes or the solution address points to the abnormal trap area, the reading process hits the trap area and triggers the block, and the reading and use of configuration data will no longer continue, thereby avoiding the use of contaminated data.

[0039] Through the above process, even if an electromagnetic fault injection destroys at most one share, the system can still accurately restore the original configuration data by interpolation under the constraints of at least k surviving shares and valid signatures. Moreover, the entire process does not rely on any customized physical isolation hardware, but is implemented solely through pure software logic such as share splitting, physical discrete layout, PC timing signature resolution, and finite field interpolation.

[0040] Example 2 The difference between this embodiment and Embodiment 1 lies in the implementation of the number of shares and the physical discrete layout. This is to illustrate that the technical solution of the present invention, "dispersing and storing each share with a physical spacing greater than the flip radius", can be implemented by a variety of specific layout methods, and is not limited to the multi-region layout in a single memory used in Embodiment 1.

[0041] (a) Parameter settings In this embodiment, the flipping radius is still determined in the manner described in Embodiment 1, and is exemplarily taken as r = 150 micrometers. The threshold parameters are exemplarily taken as n = 7 and k = 4, that is, the configuration data D is split into 7 shares on GF(2^8), and at least 4 shares are required for restoration. The share splitting method is the same as in Embodiment 1. A polynomial f(x) = D + a1·x + a2·x^2 + a3·x^3 of degree k-1 = 3 is constructed on GF(2^8), and 7 shares s1, ..., s7 are calculated by taking 7 distinct non-zero abscissas.

[0042] (ii) Physical discrete layout across memory blocks In this embodiment, the target memory is physically divided into multiple independent memory banks with significant physical spacing between them. During layout, based on the logical address-physical location correspondence, the seven shares are mapped to memory cells in different memory banks, satisfying the following conditions: 1) At most one share can be placed in the same memory cell; 2) The physical coordinate Euclidean distance between any two shares of the storage cell is greater than the flip radius r = 150 micrometers.

[0043] Since the memory cells are geographically dispersed, distributing shares across different memory cells naturally and more robustly ensures that the physical distance between any two shares is greater than the flip radius. When the number of memory cells exceeds the number of shares, priority can be given to selecting the memory cells with the largest physical distance to carry the shares, further increasing the physical distance margin between shares.

[0044] (III) Effects With this arrangement, a single electromagnetic pulse will affect at most one memory bank, thereby damaging at most one share, while at least six shares (≥k=4) will remain viable, sufficient for interpolation to restore D. This embodiment demonstrates that whether multiple physically distant regions are divided within a single memory (Embodiment 1), or shares are distributed across multiple independent memory banks on a layout (this embodiment), as long as the constraint that "the physical distance between any two shares is greater than the flip radius" is satisfied, the technical effect of this invention can be achieved; the number of shares n and the threshold k can also be adjusted accordingly based on safety margin requirements. The process of program counter timing signature decryption, legality determination, and interpolation restoration for reading addresses in this embodiment is the same as in Embodiment 1, and will not be repeated here.

[0045] Example 3 This embodiment focuses on the specific implementation of the present invention in terms of program counter timing signature decomposition and anomaly blocking of the read address, as well as the security margin setting of the lower limit of the share physical spacing, in order to illustrate the complete triggering and blocking process of the present invention in resisting the attack path of "tampering with the read address pointer and forcing the system to read the corrupted data".

[0046] (a) Safety margin setting for physical spacing of shares In Examples 1 and 2, the lower limit of the physical distance between shares is taken as the flip radius r. Considering that the impact range of electromagnetic fault injection may be slightly expanded in practice due to factors such as pulse energy fluctuations and probe positioning deviations, this example, when determining the lower limit of the physical distance between shares, further adds a preset safety margin Δ on the basis of the flip radius. That is, it requires that the Euclidean distance of the physical coordinates of any two shares in the memory cell satisfies ‖(xi, yi)-(xj, yj)‖>r+Δ. In this example, the flip radius is exemplarily taken as r=200 micrometers, and the safety margin is exemplarily taken as Δ=50 micrometers, that is, the lower limit of the physical distance between shares is taken as 250 micrometers. After adding the safety margin, even if the actual impact range of a single pulse is expanded relative to the nominal flip radius, it can still be guaranteed to cover at most one share.

[0047] (ii) The impact of configuration parameters on control flow direction In this embodiment, the configuration data read by the preceding core instructions includes configuration parameters that determine the direction of its subsequent control flow, such as flags used for conditional branch judgments and index values ​​used for jump target selection. The value of these configuration parameters directly affects the execution path of the preceding core instructions, thereby affecting their program counter timing trajectory. This correlation ensures that whether the configuration data itself is read correctly is interlocked with whether the preceding control flow is normal and whether the PC timing trajectory meets expectations—once the read address is tampered with, causing abnormal configuration parameters to be read, the preceding control flow will deviate accordingly, the PC timing trajectory will deviate from expectations, and the signature mutation will be exposed immediately.

[0048] (III) Complete process of signature decoding, anomaly trap zone triggering and blocking 1) During the execution of the core instruction preceding the configuration data reading, the program counter value sequence PC1,…,PCm is collected, and a dynamic signature sig=H(PC1‖…‖PCm) is generated through hash operation H; 2) Logically entangle the physical base address pointers base_i of each share with the signature through the mapping function g, and calculate the actual read address addr_i = base_i ⊕ g(sig); 3) Normal situation: When the preceding control flow is normal and the PC timing trajectory meets expectations, sig is valid, g(sig) obtains the expected value, and addr_i points to the actual storage location of each share; the system reads the live shares according to addr_i, collects no less than k shares and accurately restores D by Lagrange interpolation on GF(2^8); 4) Abnormal Situations: When an attacker tampers with the read address pointer or disrupts the preceding control flow by tampering with configuration parameters, the PC timing trajectory deviates from the expected value, sig changes, and g(sig) changes accordingly, causing the calculated addr_i to no longer point to the real share, but to the pre-set abnormal trap area; once the read process hits this abnormal trap area, it triggers a preset blocking action, such as terminating the subsequent reading and use of configuration data, setting an error flag, or switching to a security processing flow, thereby preventing the system from continuing to read and use the contaminated or incorrectly located data.

[0049] Through the above process, this invention not only resists the spatial aggregation and damage of the configuration data body caused by electromagnetic fault injection through the physical discrete layout of the shares, but also ensures that any tampering with the read address or the preceding control flow will cause the solution address to fall into the anomaly trap zone and be blocked immediately through the logical entanglement of PC timing signature and read address. Both of these together guarantee that the configuration data is completely and correctly restored or securely blocked when subjected to the above-mentioned attacks, and the entire process does not rely on customized physical isolation hardware. The process of splitting and restoring shares in this embodiment is the same as in Embodiment 1, and will not be described again.

[0050] Example 4: Theoretical Analysis of the Mechanism of Action This embodiment provides a theoretical analysis of the fault-tolerant storage and recovery scheme of the present invention from the perspective of its working mechanism, in order to clarify the inherent necessity that distinguishes the present invention from the prior art. It should be noted that the following analysis is a mechanism deduction under several idealized assumptions, which aims to explain the geometric and logical necessity on which the present invention is based. It does not constitute a limitation on the scope of protection of the present invention, does not represent the precise quantitative performance of the actual system under specific operating conditions, and does not introduce any measured experimental data; the relationships involved in the analysis, such as the flip radius defining the single-time influence range and the full recoverability characteristics of finite domain threshold splitting, are all well-known facts in the art.

[0051] For ease of analysis, the following assumptions are made: Assumption 1: Electromagnetic fault injection has a flip radius, denoted as r. The impact of a single electromagnetic fault injection on the memory is physically defined within a coverage area of ​​radius r centered on the injection point; memory cells outside this coverage area do not experience bit flips due to the injection. This assumption corresponds to the well-known physical fact that electromagnetic fault injection exhibits spatial locality.

[0052] Assumption 2: The software configuration data to be protected is divided into n data shares, satisfying the threshold property: collecting at least k shares is sufficient to uniquely reconstruct the original configuration data, while collecting fewer than k shares is insufficient to reconstruct the original configuration data, where k is no greater than n. This assumption corresponds to the well-known algebraic property of threshold partitioning over a finite field.

[0053] Assumption 3: The redundant design at the logical level and the physical layout of the redundancy in memory are two independent design dimensions. Without imposing special constraints on the physical layout, the physical location of the redundancy in memory is determined by conventional processes such as compilation, linking, and memory allocation, and there is no necessary correspondence between it and its logical adjacency.

[0054] Corollary 1: The Inevitability of Existing Technology Failure. Suppose that existing fault-tolerant schemes establish redundancy for protected data, but only configure redundancy logically and quantitatively, without imposing a constraint on the physical distance between the redundancy and the protected data based on radius r. This degenerates into the situation described by existing technology. According to Assumption 3, the physical layout distance between the protected data and the redundancy used for restoration is unconstrained, thus there is a possibility that they fall within the same coverage area of ​​radius r. If this happens, according to Assumption 1, a single electromagnetic fault injection can simultaneously destroy the protected data and its recovery redundancy. Therefore, as long as the physical distance is not constrained based on radius r, existing schemes cannot, in principle, eliminate the possibility that "the protected data and its recovery redundancy will be simultaneously destroyed by a single injection," meaning that failure under this scenario is possible rather than preventable. Furthermore, simply increasing the number of redundancies under this approach will not eliminate the possibility of simultaneous damage, as the newly added redundancies are still not constrained by the physical layout (r). They could fall into the same coverage area as the protected data. Therefore, increasing the number of redundancies can only delay, not eliminate, the possibility of simultaneous damage. Similarly, changing the logical adjacency between redundancies is problematic. As shown in Assumption 3, logical adjacency does not necessarily correspond to the physical layout, and it cannot guarantee that the protected data and its recovery redundancy are physically separated into different coverage areas. Thus, without introducing physical spatial distribution constraints, all conventional improvements to existing approaches cannot fundamentally prevent spatially clustered damage from simultaneously damaging the protected data and its recovery redundancy.

[0055] Inference 2: The Necessity of the Technical Means of this Invention. This invention mandates that the physical distance between the storage addresses of any two data shares is greater than r. Assumption 1 states that any coverage area with radius r has a diameter of 2r; and since the physical distance between any two shares in this invention is greater than r, for any electromagnetic fault injection, at most one data share will fall within its coverage area of ​​radius r. The remaining shares, due to their physical distance from that share being greater than r, will remain outside the coverage area and will not be damaged by the injection. Therefore, an electromagnetic fault injection will at most damage one data share, and the number of surviving shares after the injection will be no less than n minus one. Combined with Assumption 2, as long as n minus one is not less than k, the original data configuration can be uniquely restored from the surviving shares. It is evident that "constraining the physical distance between shares based on r" is a geometrically necessary condition to ensure that a sufficient number of shares survive and can be restored after a spatial aggregation failure. The following further explains that to achieve the goal of "restorability after single-attack spatial aggregation damage," the aforementioned method of isolating shares based on the spatial scale r of the physical attack and the distance dimension of the physical map is necessary and cannot be simply replaced by known methods: First, if redundancy is distributed across nodes or logical partitions without constraining the physical spacing based on r, then according to Corollary 1, the distributed shares may still fall into the same coverage area, and it cannot be guaranteed that at most one share will be damaged; Second, if only the number of shares or redundancies is increased without constraining the physical spacing, then according to Corollary 1, it can only delay but not eliminate simultaneous damage, nor can it guarantee that the surviving share reaches k; Third, if only the configuration data is encrypted or encoded without constraining the physical layout of its ciphertext or codewords in memory, then the ciphertext or codewords may also fall into the same coverage area and be injected and destroyed as a whole at once, and encryption or encoding itself does not change its physical spatial distribution; Fourth, if dedicated shielding or physical isolation hardware is used, custom hardware needs to be introduced, which is beyond the scope of software logic implementation on general-purpose memory. Therefore, it is evident that only by using the flip radius of the electromagnetic fault injection as a constraint benchmark and making each share mutually discrete in the distance dimension of the physical layout can we geometrically ensure that at most one share is destroyed in a single spatial aggregation damage without introducing customized physical isolation hardware, thus ensuring that all shares survive and can be restored. The "share threshold splitting" and "physical discrete layout based on r" in this method are mutually supportive and indispensable. Without the former, the destruction of a single share may leak or destroy the original data, and without the latter, multiple shares may be destroyed simultaneously by a single injection. The two are not simply superpositions of independent features, but are both necessary to achieve the above goals.It should also be pointed out that existing schemes for majority voting based on logically adjacent redundancy require that the protected data and its redundancy be logically and physically close to each other in order to vote. This requirement is exactly the opposite of the direction of the present invention, which is to "make the shares physically far apart". Therefore, based on the existing adjacent redundancy voting scheme, those skilled in the art have no motivation to make the redundancy physically far apart. On the contrary, they will be guided to make it close to each other, which constitutes the opposite technical teaching.

[0056] Corollary 3: Physical Source of Weight Parameter Limitations. From Corollary 2, the critical condition ensuring that at most one share is destroyed in a single injection is that the physical distance between any two shares is greater than the flip radius r. In engineering implementation, the value of the flip radius r can often only be estimated through pre-characterization, resulting in a certain estimation deviation. To maintain the isolation margin of at most one share being destroyed under this deviation, the lower limit of the physical distance that shares should satisfy can be taken as the flip radius r plus a preset safety margin, ensuring that the physical distance between any two shares is not less than this lower limit. This lower limit distance is the physical source of the limitation "the lower limit distance determined based on the flip radius plus a preset safety margin" in the claims of this invention. Its function is to ensure that this invention can maintain the isolation margin that allows a single share to be covered even when there is an estimation deviation in the flip radius.

[0057] It should be noted that the above analysis clarifies the necessity of the present invention at the geometric and logical levels, demonstrating that the technical means of the present invention are necessary to achieve the goal of "resisting spatial accumulation damage". The actual anti-injection performance of the present invention on specific chips and specific memory is also related to specific factors such as the layout characteristics of the chip, the energy and operation mode of the injection device. During implementation, experiments can be conducted in conjunction with specific chips and memory to determine the appropriate flip-flop radius value and safety margin.

[0058] Mechanism Comparison Explanation To illustrate the difference between this invention and existing adjacent redundancy voting schemes in resisting electromagnetic fault injection, the following comparative explanation of the different results of the two schemes under the same spatial aggregation and destruction is presented from a mechanistic perspective. It should be noted that this comparative explanation is based on the inherent mechanism deduction of the technical solutions, used to clarify the mechanism of action that distinguishes this invention from the prior art, rather than a comparison of experimental data.

[0059] (I) Failure Mechanism of Existing Adjacent Redundant Voting Schemes under Spatial Aggregation Damage One existing type of fault-tolerant storage and recovery scheme basically involves setting up several logically adjacent redundant copies for each element of the protected data. When an element is corrupted, the element is restored by a majority vote of its logically adjacent candidate values. This type of scheme is designed with two assumptions in mind: first, the corruption occurs sporadically at the logical level, and the logically adjacent redundancies of the corrupted element are usually still intact; second, the fault-tolerant capability of the redundancy depends only on its logical design and quantity, and is independent of the spatial distribution of the redundancy in physical memory.

[0060] However, logically adjacent redundant copies are often placed in physically close, or even within the same, storage area that can be overwritten by a single disturbance when they are implemented in physical memory. Electromagnetic fault injection causes spatial clustering corruption within the flip radius of a single pulse—first, the protected element and its logically adjacent redundancies are destroyed along with it due to their physical proximity, resulting in a large number of missing candidate values ​​for voting; second, even if some candidate values ​​remain, because they share the premise of "intact adjacency" which no longer holds in this situation, multiple candidate values ​​tend to shift together in the wrong direction, causing the majority vote to reach an agreement on an erroneous majority and produce an incorrect result. With both premises breached by spatial clustering corruption, this type of scheme cannot guarantee the correct restoration of the protected data in this situation.

[0061] (II) The reduction mechanism of the present invention under the same spatial aggregation and damage This invention fundamentally changes the aforementioned design premise. First, it no longer assumes that "redundant fault tolerance is independent of physical spatial distribution." Instead, it uses the flip radius of the electromagnetic fault injection as a constraint benchmark, forcing each data share to be physically discrete, with the physical distance between any two shares greater than the flip radius. This ensures that the spatial aggregation damage of a single pulse can physically cover at most one share, thus destroying at most one share. Second, during recovery, this invention no longer uses a "majority vote by multiple logically adjacent candidate values." Instead, it directly collects surviving shares that reach a threshold number k and accurately restores the original data through finite field interpolation. Since any insufficient share cannot be used to deduce the original data, while sufficient shares can uniquely determine the original data, the restoration of this invention does not rely on the premise of "adjacent intactness," nor does it have the possibility of "multiple candidate values ​​sharing the same fault premise and coordinating the wrong direction."

[0062] Accordingly, in the case of damage to the same spatial cluster, i.e., at most one share is damaged: the existing adjacent redundant voting scheme is difficult to restore correctly because the protected data and its recovery redundancy are physically destroyed together, and the remaining candidates are misaligned; the present invention, on the other hand, ensures that no less than k shares survive due to the physical discrete layout, and the full restoration paradigm is not affected by voting fraud, and can still accurately restore the original configuration data.

[0063] (III) Summary of Comparison The fundamental difference between this invention and existing adjacent redundancy voting schemes lies in the fact that this invention identifies and constrains the dimension of "spatial distribution of redundancy and protected data in physical memory," which is neglected by existing schemes. Accordingly, it replaces "logical adjacent redundancy + majority voting" with "physical discrete layout + sufficient share interpolation restoration." This mechanism ensures that the recovery redundancy of configuration data no longer resides in the same physical space as the protected data, a space that can be overwritten by a single disturbance, and it no longer relies on the "adjacent integrity" premise, which is no longer valid under spatial clustering damage. This difference enables this invention to resist spatial clustering damage caused by electromagnetic fault injection, which existing schemes cannot resist, without relying on customized physical isolation hardware.

[0064] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A method for fault-tolerant storage and recovery of software configuration data under electromagnetic fault injection, characterized in that, The system includes a storage phase and a recovery phase. The storage phase includes: splitting the software configuration data to be protected into multiple data shares, wherein the multiple data shares satisfy the condition that collecting a preset threshold number of data shares is sufficient to restore the software configuration data, while fewer than the threshold number of data shares are insufficient to restore the software configuration data; determining the flip radius of the electromagnetic fault injection, and allocating storage addresses in the memory to the multiple data shares, such that the physical distance between the storage addresses of any two data shares is greater than the flip radius; and distributing the multiple data shares in the memory according to the allocated storage addresses. The recovery phase includes: reading the still-living data shares from the storage addresses, and restoring the software configuration data from the living data shares when the number of living data shares reaches the threshold number.

2. The method according to claim 1, characterized in that, The step of determining the flip radius of the electromagnetic fault injection and allocating storage addresses in the memory for the plurality of data shares includes: obtaining the correspondence between the addresses and physical locations of the memory in the physical layout; selecting a plurality of candidate storage addresses from the memory based on the correspondence, such that the distance between the physical locations corresponding to any two selected candidate storage addresses is greater than the flip radius; and mapping the plurality of data shares one by one to the plurality of candidate storage addresses, such that the plurality of data shares are physically discrete and discontinuous.

3. The method according to claim 1, characterized in that, The step of splitting the software configuration data to be protected into multiple data shares includes: constructing a characteristic polynomial with the software configuration data as the quantity to be recovered over a finite field, and taking multiple different evaluation points for the characteristic polynomial to obtain the multiple data shares; correspondingly, the step of restoring the software configuration data from the surviving data shares includes: restoring the software configuration data through interpolation operations based on the evaluation points corresponding to the surviving data shares.

4. The method according to claim 1, characterized in that, The recovery phase further includes: before reading the data share, extracting the program counter timing trace of the preceding core instruction for reading the data share during execution, and generating a dynamic signature based on the program counter timing trace; performing a logical association operation between the dynamic signature and the storage address of the data share to obtain a solution address for reading the data share; and reading the data share according to the solution address.

5. The method according to claim 4, characterized in that, The recovery phase further includes: determining the validity of the dynamic signature; when the dynamic signature is valid, reading the surviving data share according to the solution address and performing the restoration; when the dynamic signature is invalid, the solution address points to a preset abnormal trap area to trigger blocking and stop performing the restoration.

6. The method according to claim 1, characterized in that, The software configuration data refers to the configuration parameters read by embedded devices, security chips, or industrial control devices during operation, which are used to determine the direction of their control flow.

7. The method according to any one of claims 1 to 6, characterized in that, The physical spacing that should be satisfied between each data share in the memory is a lower limit spacing determined based on the flip radius plus a preset safety margin. The physical spacing between any two allocated data shares in the memory address shall not be less than the lower limit spacing.

8. A fault-tolerant storage and recovery system for software configuration data under electromagnetic fault injection, characterized in that, The system includes a share splitting module, a layout allocation module, a distributed storage module, and a recovery module. The share splitting module is used to split the software configuration data to be protected into multiple data shares, wherein collecting a preset threshold number of data shares is sufficient to restore the software configuration data, while collecting fewer than the threshold number of data shares is insufficient to restore the software configuration data. The layout allocation module is used to determine the flip radius of the electromagnetic fault injection and allocate storage addresses in the memory to the multiple data shares, ensuring that the physical distance between the storage addresses of any two data shares is greater than the flip radius. The distributed storage module is used to distribute and store the multiple data shares in the memory according to the allocated storage addresses; The recovery module is used to read the still-living data shares from the storage address, and when the number of living data shares reaches the threshold number, the software configuration data is restored from the living data shares.

9. The system according to claim 8, characterized in that, The recovery module further includes a signature resolution unit; the signature resolution unit is used to extract the program counter timing trajectory of the preceding core instruction for reading the data share during execution before reading the data share, generate a dynamic signature based on the program counter timing trajectory, and perform a logical association operation between the dynamic signature and the storage address of the data share to obtain a resolution address; the recovery module is used to: when the dynamic signature is valid, read the surviving data share according to the resolution address and perform the restoration; when the dynamic signature is invalid, make the resolution address point to a preset abnormal trap area to trigger blocking.

10. The system according to claim 8, characterized in that, The share splitting module is used to construct a characteristic polynomial with the software configuration data as the quantity to be recovered over a finite domain, and to obtain the multiple data shares by taking multiple different evaluation points on the characteristic polynomial; the recovery module is used to restore the software configuration data by interpolation operation based on the evaluation points corresponding to the surviving data shares.

Images