A closed-loop anti-miswrite control system for a one-time programmable memory area

Abstract

This invention relates to a closed-loop anti-write control system for one-time programmable memory areas, belonging to the field of embedded system security control technology. It solves the problem in existing technologies where one-time programmable memory areas lack systematic closed-loop protection, failing to eliminate the risk of accidental writes to irreversible storage resources at the source. The system includes a physical confirmation unit for generating a first physical confirmation signal; a communication confirmation unit for generating a second communication confirmation signal; an authorization management and state latching unit for receiving the first and second physical and communication confirmation signals, performing state transitions, and outputting an authorization release signal; a whitelist comparison unit for receiving the target address to be written to and outputting an execution permission signal; and an access control unit for receiving the authorization release signal and the execution permission signal, and outputting a write enable signal to the irreversible memory unit when both signals are valid. This achieves closed-loop anti-write protection for one-time programmable memory areas.

Description

Technical Field

[0001] This invention relates to the field of embedded system security control technology, and in particular to a fully closed-loop anti-miswrite control system for a one-time programmable memory area. Background Technology

[0002] One-Time Programmable (OTP) storage resources have the physical characteristics of being non-erasable and non-recoverable once written. Writing incorrect data can lead to the scrapping of a single board, the failure of security configurations, or even malfunctions in an entire batch of devices. Therefore, the security and reliability requirements for its operation control process are far higher than those for ordinary Flash, EEPROM, or erasable registers.

[0003] In existing technologies, write protection for this type of irreversible storage resource mainly involves software access control, hardware gating, operation timing optimization, and interface protection. Regarding software access control, current solutions typically use password input, menu confirmation, or serial port commands as authorization methods, verifying the operator's identity through software logic; the authorization link is highly coupled with the write link. For hardware gating, existing solutions use physical devices such as a single button, DIP switch, or GPIO pin to control write access. Regarding storage resource operation optimization, some solutions focus on unlocking the programming timing, verifying the integrity of the write enable signal, or post-write repair mechanisms, but these all focus on programming efficiency, interface security, or single-point protection, rather than system-level protection design. Regarding access control, existing solutions typically only control write permissions without imposing additional constraints on the target scope of write operations.

[0004] However, existing solutions suffer from several drawbacks. First, the authorization link protection is insufficient. Software solutions are susceptible to accidental triggering, communication noise, or software anomalies, while hardware solutions are prone to granting permissions due to device misoperation, jitter, or wiring errors. Failure of any link in the single-point protection can lead to a complete collapse of the protection system. Second, there is a lack of clear stage definitions for irreversible write scenarios, making it difficult to strictly distinguish between critical stages such as default write prohibition, manual confirmation, communication confirmation, and post-write lockout, which can easily lead to overstepping or erroneous operations. Third, the write target range is not included in the core control chain, making it impossible to avoid permanent losses caused by address mismatches. Fourth, there is a lack of timeout constraints and abnormal lockout mechanisms. Once the system enters a writable state, it remains so for an extended period, making the risk exposure time uncontrollable. Fifth, there is a lack of a complete chain of evidence, outputting only a single success or failure result, making it impossible to trace and assign responsibility.

[0005] Therefore, there is an urgent need for a protection solution that can fundamentally solve the problem of irreversible write-triggered errors and has full-process closed-loop control capabilities. Summary of the Invention

[0006] Based on the above analysis, the embodiments of the present invention aim to provide a fully closed-loop anti-write control system for one-time programmable memory areas, in order to solve the problem that existing one-time programmable memory areas lack systematic closed-loop protection and cannot eliminate the risk of irreversible write to storage resources from the source.

[0007] This invention provides a fully closed-loop anti-miswrite control system for a one-time programmable memory area, comprising: A physical confirmation unit is used to generate a first physical confirmation signal in response to an external physical operation; The communication confirmation unit is used to receive and verify the confirmation command from the host computer through the communication link and generate a second communication confirmation signal. The authorization management and state latching unit is used to receive the first physical confirmation signal and the second communication confirmation signal, and to perform state transition and output the authorization release signal; The whitelist comparison unit is used to receive the target address to be written, match the target address to be written with a preset legal address range, and then output an execution permission signal based on the matching result; The access control unit is used to receive the authorization release signal and the execution permission signal, and outputs a write enable signal when the authorization release signal and the execution permission signal are both valid. An irreversible storage unit is used to receive the write enable signal and perform a one-way irreversible write operation.

[0008] Furthermore, the authorization management and state latching unit includes a one-way transition state machine, which includes: The LOCKED state represents the default write-disabled state, which is used to force entry after system power-on or reset and reject all write commands; The ARMED state represents a state of waiting for communication confirmation. It is entered after receiving a valid first physical confirmation signal and only accepts the second confirmation command. The UNLOCKED state represents a wait-to-write state, which is entered after receiving a valid second-level communication acknowledgment signal, and only accepts write commands and lockout commands; The unidirectional transition state machine only allows unidirectional transitions along the LOCKED, ARMED, and UNLOCKED states. When any state receives a command that does not conform to the semantics of the current state, an exception lock is triggered, and the state unconditionally jumps to the LOCKED state.

[0009] Furthermore, the authorization management and status latching unit performs the following control steps: Based on the current system state, the first physical acknowledgment signal received is verified for validity. If the first physical acknowledgment signal is verified to be valid, the current system state is transitioned from the default write-prohibited state to the waiting for communication acknowledgment state, and the acknowledgment window timer is started. Based on the current system state and the confirmation window timer, the received second communication confirmation signal is verified for second validity. If the second communication confirmation signal is verified as valid, the current system state is transitioned from the waiting for communication confirmation state to the waiting for write state, and the writable window timer is started. At the same time, a valid authorization release signal is output.

[0010] Furthermore, the authorization management and status latching unit performs a first validity check on the received first physical confirmation signal. If all checks pass, the first physical confirmation signal is deemed valid. The first validity check includes status check and anti-repeated triggering check.

[0011] Furthermore, the state verification is used to verify whether the current system state is the default write-prohibited state. If so, the verification passes; otherwise, the verification fails, and the first physical confirmation signal is determined to be an illegal overstepping operation, triggering an abnormal backlock. The anti-repeated triggering check is used to verify whether the time between receiving the first physical confirmation signal and the last valid first physical confirmation signal is greater than the preset anti-repeated locking time. If so, the check passes; otherwise, the check fails and the first physical confirmation signal is ignored.

[0012] Furthermore, the authorization management and status latching unit performs a second validity check on the received second communication confirmation signal. If all checks pass, the second physical confirmation signal is deemed valid. The second validity check includes stage matching check, time window check, and sequence check.

[0013] Furthermore, the stage matching verification is used to verify whether the current system state is in the waiting communication confirmation state. If so, the verification passes; otherwise, the verification fails, and the second physical confirmation signal is judged as an illegal overstepping operation, and an abnormal backlock is triggered. The time window verification is used to verify whether the moment the second communication confirmation signal is received is within the valid time period of the confirmation window timer. If so, the verification passes; otherwise, the verification fails, the second physical confirmation signal is determined to be an expired and invalid signal, and an abnormal backlock is triggered. The sequence check is used to verify whether the generation of the first physical confirmation signal precedes the generation of the second communication confirmation signal. If so, the check passes; otherwise, the check fails, the second physical confirmation signal is determined to be a timing disorder signal, and an abnormal backlock is triggered.

[0014] Furthermore, the matching process in the whitelist comparison unit with the preset legal address range includes any one or more of the following forms: Fixed address matching: one or more fixed address values ​​are preset. A hit is determined when the target address to be written completely matches any one of the address values. Address range matching: a legal address range is pre-defined by a start address and an end address. When the target address to be written falls within the range, it is considered a hit. Address mask matching: a base address and an address mask are preset. A hit is determined when the target address to be written matches the base address according to the mask. Bit segment mask matching uses a preset bit segment mask that allows writing. A hit is determined when the bits corresponding to the target address to be written fall within the range of the bit segment mask.

[0015] Furthermore, the unidirectional transition state machine also includes a DONE_WAIT_LOCK state, representing a write completion and lock-back pending state. This state is entered after the write operation is completed and only accepts lock-back commands, rejecting write commands and acknowledgment commands. The one-way transition state machine also allows transitions along the direction of the UNLOCKED state and the DONE_WAIT_LOCK state, and allows transitions from the DONE_WAIT_LOCK state to the LOCKED state.

[0016] Furthermore, the system also includes a readback verification unit, which reads the current data at the target address and compares it with the data to be written after the write operation is completed. If the comparison is consistent, a verification pass flag is output to the authorization management and status latching unit. After receiving the verification pass flag, the authorization management and status latching unit transitions the current system state from the DONE_WAIT_LOCK state to the LOCKED state, completing the full closed-loop control process. If the comparison is inconsistent, a verification error lockout signal is output to the authorization management and status latching unit, which triggers the error lockout, and the current system state is forcibly switched to the LOCKED state.

[0017] Compared with the prior art, the present invention can achieve at least one of the following beneficial effects: This invention provides a fully closed-loop anti-miswrite control system for a one-time programmable memory area. 1. By establishing two independent authorization conditions with different failure modes before a one-time programming action occurs, which must be established sequentially and both completed within a controlled confirmation window, the operator must simultaneously complete on-site physical confirmation and communication side confirmation. Without double confirmation, the writeable stage cannot be entered. Any signal abnormality, false triggering, or software error in a single link cannot unlock the write permission alone, thereby reducing the risk of irreversible writing caused by script false triggering, upper computer false transmission, link noise, and software abnormalities from the source. 2. By constructing a state latching mechanism, the system has a unique and clear semantic for the LOCKED, ARMED, and UNLOCKED stages, strictly constrains the unidirectional state transition path, and prohibits skipping stages; each stage only accepts commands that conform to the semantics of the current state, and any illegal commands are intercepted and trigger an exception lockback, fundamentally eliminating skipping, repetitive, or erroneous operations caused by unclear states. 3. The whitelist hit result and the authorization release signal are used as two independent and necessary conditions for the access control unit to output write enable. Neither can be missing. This mechanism makes write range control and write permission control equally important, and fundamentally solves the problem of permanent write loss caused by address mismatch.

[0018] In this invention, the above-described technical solutions can be combined with each other to achieve more preferred combinations. Other features and advantages of this invention will be set forth in the following description, and some advantages may become apparent from the description or be learned by practicing the invention. The objects and other advantages of this invention can be realized and obtained from what is particularly pointed out in the description and drawings. Attached Figure Description

[0019] The accompanying drawings are for illustrative purposes only and are not intended to limit the invention. Throughout the drawings, the same reference numerals denote the same parts.

[0020] Figure 1 This is a schematic diagram of the structure of the one-time programmable memory area closed-loop anti-miswrite control system provided in Embodiment 1 of the present invention; Figure 2 This is a schematic diagram of a one-way transition state machine provided in Embodiment 1 of the present invention. Detailed Implementation

[0021] Preferred embodiments of the present invention will now be described in detail with reference to the accompanying drawings, which form part of this application and are used together with the embodiments of the present invention to illustrate the principles of the present invention, but are not intended to limit the scope of the present invention.

[0022] Example 1 A specific embodiment of the present invention discloses a fully closed-loop anti-miswrite control system for a one-time programmable memory area, such as... Figure 1 As shown, it includes: A physical confirmation unit is used to generate a first physical confirmation signal in response to an external physical operation; The communication confirmation unit is used to receive and verify the confirmation command from the host computer through the communication link and generate a second communication confirmation signal. The authorization management and state latching unit is used to receive the first physical confirmation signal and the second communication confirmation signal, and to perform state transition and output the authorization release signal; The whitelist comparison unit is used to receive the target address to be written, match the target address to be written with a preset legal address range, and then output an execution permission signal based on the matching result; The access control unit is used to receive the authorization release signal and the execution permission signal, and outputs a write enable signal when the authorization release signal and the execution permission signal are both valid. An irreversible storage unit is used to receive the write enable signal and perform a one-way irreversible write operation.

[0023] It should be noted that the irreversible storage unit is the target object for protection of this system. It has built-in OTP, eFuse, and irreversible security configuration bits. When it receives the write enable signal from the access control unit, it can only perform a one-way irreversible write operation. After writing, it cannot be modified.

[0024] In practice, the first physical confirmation signal is a single-bit valid level signal or valid pulse signal output after confirming that the external physical operation is valid; wherein, the effective width of the signal is not less than one system clock cycle, so as to ensure that the authorization management and status latching unit can reliably latch the signal.

[0025] In practice, the physical confirmation unit includes any one of the following physical media: buttons, DIP switches, jump caps, hardware plug-in / plug-out detection interfaces, or combinations of multiple buttons, used to generate physical signals generated by external physical operations, i.e., the first physical confirmation signal.

[0026] Specifically, external physical operation refers to human intervention actions that require operators to be physically present at the equipment site and to be carried out through physical media, including: pressing buttons, toggling DIP switches, inserting or removing jumper caps, and inserting specific hardware keys.

[0027] Specifically, the first physical confirmation signal is generated only when the state change of the physical medium meets the preset valid conditions; if the state change of the physical medium does not meet the preset valid conditions, the first physical confirmation signal is not generated.

[0028] More specifically, when the physical confirmation unit is implemented using a button, the first physical confirmation signal is generated the instant the button is pressed for a duration that reaches the preset effective long press threshold; if the button is pressed for a duration that does not reach the preset effective long press threshold, the first physical confirmation signal is not generated, and the press is judged as an unintentional accidental touch and ignored.

[0029] Furthermore, when using buttons, the duration of the anti-shake processing is typically between 10ms and 50ms, used to filter out invalid edges caused by button bounce. The effective long press threshold is set according to the need to distinguish between intentional operation and unintentional touch, with a setting range of greater than or equal to 500ms, preferably set to 800ms.

[0030] More specifically, when the physical confirmation unit is implemented using a DIP switch, the first physical confirmation signal is generated after the DIP switch is detected to have been moved from the write-prohibited position to the confirm position and the level is stable; if the DIP switch is not moved to the confirm position or the level is unstable, the first physical confirmation signal is not generated.

[0031] More specifically, when the physical confirmation unit is implemented using a jump cap, the first physical confirmation signal is generated after the corresponding hardware plug-in / plug-out detection interface is detected when the jump cap is inserted or removed and the level is stable.

[0032] More specifically, when the physical confirmation unit is implemented using a multi-button combination, the first physical confirmation signal is generated the instant that multiple buttons are pressed in sequence within a preset time window according to a preset sequence; if the button sequence is incorrect or exceeds the preset time window, the first physical confirmation signal is not generated.

[0033] For example, the preset time window is set to within 1 second.

[0034] Specifically, the output of the physical confirmation unit is connected to the first input of the authorization management and status latching unit; the first physical confirmation signal is transmitted to the authorization management and status latching unit through this connection.

[0035] It should be noted that the physical confirmation unit is completely independent of the communication link. The first physical confirmation signal it generates does not depend on the normality or non-normality of any communication interface, and their failure modes are independent of each other. For example, in an embedded system, the physical confirmation unit collects data through an independent GPIO port, without processing through the communication protocol stack or communication controller; even if the communication interface completely fails, the physical confirmation signal can still be correctly collected and identified by the system.

[0036] During implementation, the communication confirmation unit receives confirmation commands through any of the following communication interfaces: UART serial port, USB virtual serial port, I2C bus, SPI bus, JTAG / SWD debug interface, CAN bus, or Ethernet interface.

[0037] In practice, the confirmation instruction is a confirmation instruction string in a preset format; the communication confirmation unit performs multi-dimensional legality verification on the received confirmation instruction, and if all verification dimensions are satisfied, the confirmation instruction is determined to be legal and valid, and then a second communication confirmation signal is generated.

[0038] Specifically, multi-dimensional legality verification includes instruction format verification and instruction content verification; among them, Command format verification is used to verify whether the frame header, frame length, and checksum of the received command are correct. If any field is incorrect, the verification dimension is determined to be unsatisfactory; otherwise, the verification dimension is determined to be satisfactory. Command content validation is used to verify whether the command content matches the preset confirmation command content. If they do not match, it is determined that the validation dimension is not satisfied; otherwise, it is determined that the validation dimension is satisfied. More specifically, the preset confirmation commands include "OK", "C", and "CONFIRM".

[0039] Specifically, if any verification dimension is not satisfied, the confirmation instruction is determined to be an illegal instruction. The communication confirmation unit does not output a second communication confirmation signal, triggers corresponding error handling according to the exception type, and records the corresponding exception event to the status indicator and log unit.

[0040] More specifically, if the instruction format validation or instruction content validation fails, the error handling is to discard the instruction and generate an exception event record.

[0041] Specifically, when the received confirmation command is determined to be valid, the communication confirmation unit outputs a single-bit valid level signal or a valid pulse signal as a second communication confirmation signal to the authorization management and status latching unit; wherein, the width of the valid pulse signal is not less than one system clock cycle to ensure that the authorization management and status latching unit can reliably latch the signal.

[0042] Optionally, the confirmation command can also be implemented using a challenge-response mechanism. When the authorization management and status latching unit enters the waiting communication confirmation state, the communication confirmation unit generates a random number and sends it to the host computer through the communication link. The host computer uses a pre-shared key to encrypt or hash the random number to generate response data and returns it. The communication confirmation unit compares the returned response data with the local calculation result. If the comparison is consistent, the confirmation command is determined to be legal and valid, and a second communication confirmation signal is generated. If the comparison is inconsistent, the second communication confirmation signal is not output and an illegal command lockout is triggered.

[0043] Understandably, the challenge-response mechanism, compared to fixed-string confirmation commands, has the ability to defend against replay attacks and is suitable for application scenarios with higher security requirements.

[0044] Optionally, the confirmation instruction may also be a private protocol frame including an instruction header, instruction type, data length, and checksum; the communication confirmation unit performs integrity and protocol format verification on the received protocol frame. If the verification passes, the confirmation instruction is deemed legal and valid, and a second communication confirmation signal is generated; if the verification fails, the second communication confirmation signal is not output and an illegal instruction lockout is triggered.

[0045] In implementation, the authorization management and state latching unit includes a one-way transition state machine, such as... Figure 2 As shown, the unidirectional transition state machine includes: The LOCKED state represents the default write-disabled state, which is used to force entry after system power-on or reset and reject all write commands; The ARMED state represents a state of waiting for communication confirmation. It is entered after receiving a valid first physical confirmation signal and only accepts the second confirmation command. The UNLOCKED state represents a wait-to-write state, which is entered after receiving a valid second-level communication acknowledgment signal, and only accepts write commands and lockout commands; The unidirectional transition state machine only allows unidirectional transitions along the LOCKED, ARMED, and UNLOCKED states. When any state receives a command that does not conform to the semantics of the current state, an exception lock is triggered, and the state unconditionally jumps to the LOCKED state.

[0046] Preferably, the unidirectional transition state machine further includes a DONE_WAIT_LOCK state, representing a write completion pending lock-back state, which is entered after the write operation is completed, and only accepts lock-back commands, rejecting write commands and acknowledgment commands; wherein, The one-way transition state machine also allows transitions along the direction of the UNLOCKED state and the DONE_WAIT_LOCK state, and allows transitions from the DONE_WAIT_LOCK state to the LOCKED state.

[0047] Specifically, the triggering conditions for transitioning from the DONE_WAIT_LOCK state to the LOCKED state include: receiving a lockback command issued by the operator through the communication interface; or automatically transitioning after receiving a verification pass flag output by the readback verification unit.

[0048] Specifically, for the LOCKED state, the command that conforms to the semantics of the current state is the first physical acknowledgment signal; for the ARMED state, the command that conforms to the semantics of the current state is the second communication acknowledgment signal; and for the UNLOCKED state, the commands that conform to the semantics of the current state are the write command "WRITE / W" and the lockback command "LOCK".

[0049] Specifically, a one-way transition state machine prohibits the following transition paths: The LOCKED state directly transitions to the UNLOCKED state, meaning it enters the writable state without prior communication confirmation. The ARMED state transitions directly to the DONE_WAIT_LOCK state, meaning it enters the write-wait-to-reclaim state directly without going through the UNLOCKED state. The UNLOCKED state transitions in reverse to the ARMED state; The DONE_WAIT_LOCK state transitions in reverse to the UNLOCKED or ARMED state.

[0050] During implementation, the authorization management and status latching unit performs the following control steps: Based on the current system state, the first physical acknowledgment signal received is verified for validity. If the first physical acknowledgment signal is verified to be valid, the current system state is transitioned from the default write-prohibited state to the waiting for communication acknowledgment state, and the acknowledgment window timer is started. Based on the current system state and the confirmation window timer, the received second communication confirmation signal is verified for second validity. If the second communication confirmation signal is verified as valid, the current system state is transitioned from the waiting for communication confirmation state to the waiting for write state, and the writable window timer is started. At the same time, a valid authorization release signal is output.

[0051] It should be noted that the authorization management and status latch unit only outputs a valid authorization release signal when the current state is UNLOCKED and no abnormal lockback condition is triggered; in the LOCKED, ARMED, or DONE_WAIT_LOCK states, the authorization management and status latch unit outputs an invalid authorization release signal or cancels the output authorization release signal.

[0052] Specifically, when the current system is in the waiting-to-write state, if any revocation occurs within the valid time period before the writable window timer expires, the authorization release signal will be revoked and the current system state will be rolled back to the default write-prohibited state. Revocation situations include not receiving a write command, receiving a command that does not conform to the semantics of the current state, and receiving an abnormal trigger signal.

[0053] It should be noted that the abnormality trigger signal is a notification signal sent by other units, namely the communication confirmation unit, the whitelist comparison unit, the access control unit, and the readback verification unit, to the authorization management and status latch unit after detecting an abnormality within their respective responsibilities. This signal is used to trigger the authorization management unit to perform a lockback operation.

[0054] In practice, the authorization management and status latching unit performs a first validity check on the received first physical confirmation signal. If all checks pass, the first physical confirmation signal is deemed valid. The first validity check includes status check and anti-repeated trigger check.

[0055] Specifically, the status check is used to verify whether the current system status is the default write-prohibited state. If so, the check passes; otherwise, the check fails, and the first physical confirmation signal is judged as an illegal overstepping operation, triggering an abnormal backlock. The anti-repeated triggering check is used to verify whether the time between receiving the first physical confirmation signal and the last valid first physical confirmation signal is greater than the preset anti-repeated locking time. If so, the check passes; otherwise, the check fails and the first physical confirmation signal is ignored.

[0056] Specifically, the preset anti-repeated locking time is set based on the minimum time interval of human operation. This is used to prevent state confusion or accidental reset caused by accidental touch of physical buttons or repeated pressing by the operator within the same authorization process. Preferably, it is set to 3000ms, which ensures that the system has sufficient time for subsequent communication interaction after an intentional physical confirmation, and effectively blocks all secondary physical signals within this time period, forcibly stipulating that one physical confirmation corresponds to only one process, until timeout or relock.

[0057] In practice, the authorization management and status latching unit performs a second validity check on the received second communication confirmation signal. If all checks pass, the second physical confirmation signal is deemed valid. The second validity check includes stage matching check, time window check, and sequence check.

[0058] Specifically, the phase matching check is used to verify whether the current system state is waiting for communication confirmation. If so, the check passes; otherwise, the check fails, and the second physical confirmation signal is judged as an illegal overstepping operation, and an abnormal backlock is triggered. The time window check is used to verify whether the moment the second communication confirmation signal is received is within the valid time period of the confirmation window timer. If so, the check passes; otherwise, the check fails, the second physical confirmation signal is determined to be an expired and invalid signal, and an abnormal backlock is triggered. Sequence verification is used to verify whether the generation of the first physical confirmation signal precedes the generation of the second communication confirmation signal. If so, the verification passes; otherwise, the verification fails, the second physical confirmation signal is determined to be a timing disorder signal, and an abnormal backlock is triggered.

[0059] Specifically, the effective time for confirming that the window timer has not expired is set according to the reasonable time required for the operator to read the prompt and enter the confirmation command after completing the physical confirmation. The setting range is 15000ms to 60000ms; preferably, it is set to 30000ms, which not only gives the operator enough time to complete the communication confirmation, but also prevents the system from staying in the ARMED state for a long time and expanding the security risk window.

[0060] Specifically, the effective time for the writable window timer to not time out is set based on the sufficient time required to complete a single irreversible write operation, with a setting range of 5000ms to 120000ms; preferably, it is set to 30000ms, so as to compress the total time the system is in the UNLOCKED high-risk writable state as much as possible while ensuring that the write operation has enough time to be fully executed, thereby reducing the risk of exposure in abnormal scenarios.

[0061] Preferably, when the authorization management and status latching unit triggers an abnormal lockback, it performs the following operations: Revoke the previously issued authorization release signal; Clear the authorization status flag and temporary storage information; Stop and clear all confirmation window timers and writable window timers; Force the current system state to be migrated to the default write-prohibited state; Output the abnormal lockout event and the abnormal type code to the status indicator and log unit.

[0062] It should be noted that clearing the authorization status flag and temporary storage information means completely clearing all intermediate states (whether it has been confirmed, confirmation time, etc.) and temporary data (cache address, cache data, etc.) generated in this authorization process, ensuring that the internal state is consistent with the external state when the system rolls back to the LOCKED state, and that no historical information that may be misused by subsequent processes remains.

[0063] In practice, a valid authorization release signal is a single-bit valid level signal, i.e., a high-level signal; an invalid authorization release signal is a single-bit invalid level signal, i.e., a low-level signal.

[0064] Preferably, the authorization management and status latching unit is also used to output the current status code to the status indication and log unit; wherein, the status code is a 2-bit code, corresponding to the four states LOCKED, ARMED, UNLOCKED and DONE_WAIT_LOCK respectively; the status code is a continuously valid real-time level signal, which is updated in real time as the status changes.

[0065] Specifically, the first input terminal of the authorization management and status latch unit is connected to the output terminal of the physical confirmation unit, the second input terminal is connected to the output terminal of the communication confirmation unit, and the output terminal is connected to the input terminal of the whitelist comparison unit and the input terminal of the access control unit, respectively.

[0066] During implementation, the matching of the whitelist comparison unit with the preset legal address range includes any one or more of the following forms: Fixed address matching: one or more fixed address values ​​are preset. A hit is determined when the target address to be written completely matches any one of the address values. Address range matching: a legal address range is pre-defined by a start address and an end address. When the target address to be written falls within the range, it is considered a hit. Address mask matching: a base address and an address mask are preset. A hit is determined when the target address to be written matches the base address according to the mask. Bit segment mask matching uses a preset bit segment mask that allows writing. A hit is determined when the bits corresponding to the target address to be written fall within the range of the bit segment mask.

[0067] Specifically, in address mask matching, the address mask is used to mask the inline offset in the target address to be written, and only the line address or page address is matched; in bit field mask matching, the bit field mask is used to limit the range of target bits that are allowed to be written.

[0068] Specifically, the preset legal address range setting in the whitelist comparison unit is either written into a constant table during firmware compilation and burned along with the firmware; or stored in a separate signature configuration file, which is loaded and enabled after the signature is verified during system initialization; or written to a dedicated configuration storage area once and cannot be changed after being written.

[0069] It should be noted that the preset range of legal addresses in the whitelist comparison unit cannot be dynamically modified during normal system operation.

[0070] Specifically, the whitelist comparison unit extracts the address parameter from the write command as the target address to be written; if the write command carries an address parameter, the parameter is directly extracted as the target address to be written; if the write command does not carry an address parameter, the default target address pre-configured by the system is used as the target address to be written.

[0071] Specifically, when the authorization release signal is valid and the target address to be written falls within the preset legal address range, the whitelist comparison unit outputs an authorized execution signal at a valid level, i.e., a high level signal; when the authorization release signal is invalid or the target address to be written does not fall within the preset legal address range, the output authorized execution signal is at an invalid level, i.e., a low level signal.

[0072] Preferably, the whitelist comparison unit is also used to allow the execution signal to remain at an invalid level when the target address to be written does not hit the preset legal address range, and to output a whitelist verification failure exception signal to the authorization management and status latch unit; after receiving the whitelist verification failure exception signal, the authorization management and status latch unit triggers an exception lockback.

[0073] It should be noted that the exception lockout upon whitelist verification failure is the highest priority operation and is not restricted by the current system state. Regardless of whether the system is currently in the UNLOCKED state or another state, once whitelist verification fails, the system immediately and unconditionally reverts to the LOCKED state, ensuring that illegal address write requests are completely blocked and that no authorization information remains that can be used by subsequent processes.

[0074] Specifically, the input of the whitelist comparison unit is connected to the output of the authorization management and status latch unit to receive the authorization release signal; the output of the whitelist comparison unit is connected to the input of the access control unit to output the execution permission signal.

[0075] During implementation, the write enable signal sent by the access control unit to the irreversible memory unit includes the write enable valid level, the target address to be written, and the data to be written; among them, the write enable valid level is used to start the write process of the irreversible memory unit.

[0076] Specifically, the authorization release signal and the execution permission signal are both valid, meaning that both the authorization release signal and the execution permission signal are valid level signals.

[0077] Preferably, during the output of the write enable signal, the access control unit continuously monitors the authorization release signal and the execution permission signal. If either signal becomes invalid during the writing process, the access control unit immediately cancels the write enable signal.

[0078] Preferably, the access control unit is also used to start a write window timer when outputting a write enable signal. If the write operation is not completed within the valid time period of the write window timer, the write enable signal is canceled and a write timeout exception signal is output to the authorization management and status latch unit, which triggers an exception lockout.

[0079] Understandably, in any of the following scenarios—confirmation failure, communication command format / content mismatch, stage mismatch, illegal target address, confirmation window timeout, writable window timeout, write operation timeout, session interruption, readback verification failure, or maintenance anomaly—the system immediately revokes all writable permissions and forces a rollback to the LOCKED default write-prohibited state. Any abnormal trigger signal can independently trigger an abnormal lockback, strictly limiting the exposure time of the system's high-risk writable state to the dual constraints of the writable window timer and the write timeout detection timer. This effectively solves the problem of existing technologies exposing the system to the writable state for extended periods without any anomaly fallback protection.

[0080] It is understood that the access control unit is the only channel for issuing write commands to the irreversible storage unit, and there is no path in the system to bypass the access control unit and write directly to the irreversible storage unit.

[0081] During implementation, when the write operation of the irreversible storage unit is completed, the current system state transitions from the UNLOCKED state to the LOCKED state, and all write permissions are immediately revoked, completing the closed-loop control process for a single irreversible write.

[0082] Specifically, the completion of the write operation means that the access control unit has sent a write enable signal to the irreversible memory unit, and the irreversible memory unit has completed the physical burning operation. The access control unit confirms that the sending cycle of the write enable signal has ended.

[0083] Preferably, the system includes a readback verification unit connected to an irreversible storage unit and an authorization management and status latch unit. This unit reads the current data at the target address after a write operation is completed and compares it with the data to be written. If the comparison matches, a verification pass flag is output to the authorization management and status latch unit. Upon receiving the verification pass flag, the authorization management and status latch unit transitions the current system state from DONE_WAIT_LOCK to LOCKED, completing the full closed-loop control process. If the comparison does not match, a verification error lockout signal is output to the authorization management and status latch unit, which triggers the error lockout, forcibly transitioning the current system state to LOCKED.

[0084] Preferably, the system further includes a status indication and logging unit, connected to the authorization management and status latching unit. The status indication and logging unit includes: The status indication submodule uses a multi-mode indicator device to output the current status information in different indication modes under different states. The logging submodule is used to output structured logs when state transitions and critical operations occur. The logs contain at least timestamp, event type, and status information fields.

[0085] Specifically, the structured logs output by the logging submodule include any one or more of the following types: The phase prompt log outputs the current state name, triggering event, and operation guidance information during state transition; Summary logs output status codes, event names, instruction content, and timestamps after key operations are completed; Heartbeat log, periodically outputs timestamps, received command counts, and dropped command counts; The status snapshot log outputs the current configuration parameters, stored values, and write counts when a status transition or an exception is triggered.

[0086] It is understandable that post-write readback verification, LED multi-mode status indicators, and four types of structured logs—stage prompt logs, summary logs, heartbeat logs, and status snapshot logs—are incorporated as essential components of the irreversible write process. Each round of authorization, unlocking, writing, verification, and lockback is observable, verifiable, and traceable, providing objective evidence for write result analysis, troubleshooting, solution improvement, and responsibility determination.

[0087] Preferably, the system also includes a hardware watchdog to assist in locking back. When the current system state enters the UNLOCKED state, the hardware watchdog is activated and a very short timeout (e.g., 1 second) is set. If the software process is abnormally stuck, the watchdog timeout triggers an interrupt. The only function of the interrupt service routine is to force the locking back.

[0088] Compared with existing technologies, this embodiment provides a fully closed-loop anti-miswrite control system for a one-time programmable memory area. By establishing two independent authorization conditions with different failure modes before the one-time programming action occurs, and both conditions must be met sequentially and completed within a controlled confirmation window, the operator must simultaneously complete both on-site physical confirmation and communication-side confirmation. Without dual confirmation, the writeable stage cannot be entered. Any single link signal anomaly, false triggering, or software error cannot individually unlock write access, thus reducing the risk of irreversible writes caused by script mis-triggering, erroneous transmissions from the host computer, link noise, and software anomalies from the source. Furthermore, by constructing a state latching mechanism, the system... The system has a unique and clear semantic for the LOCKED, ARMED, and UNLOCKED stages, strictly constraining the unidirectional state transition path and prohibiting skip-level transitions. Each stage only accepts commands that conform to the semantics of the current state. Any illegal command is intercepted and triggers an abnormal backlock, fundamentally eliminating skip-level, duplicate, or erroneous operations caused by unclear states. The whitelist hit result and the authorization release signal are both independent and necessary conditions for the access control unit to output write enable. Neither can be missing. This mechanism makes write range control and write permission control equally important, fundamentally solving the problem of permanent write loss caused by address mismatch.

[0089] Example 2 This invention provides a specific embodiment of a fully closed-loop anti-miswrite control method for a one-time programmable memory area. Based on the system described in the embodiment, the method includes the following steps: S1. After the system is powered on or reset, it enters the LOCKED state and rejects all write commands. S2. In the LOCKED state, check whether the first physical confirmation signal is valid. If it is valid, switch the state from LOCKED to ARMED to wait for confirmation and start the confirmation window timer. S3. In the ARMED state, receive the confirmation command through the communication link and verify the validity of the confirmation command. If a valid confirmation command is received in the confirmation window, switch the state from ARMED state to UNLOCKED state and start the writable window timer. S4. In the UNLOCKED state, receive the write command, extract the target address to be written, compare the target address to be written with a whitelist of preset legal address ranges, and if the whitelist is matched, execute the write operation. S5. After the write operation is completed, a lockout operation is performed to switch the state back to the LOCKED state, completing the full closed-loop control process for a single write operation.

[0090] The specific implementation process of this invention can be found in the above system embodiments, and will not be repeated here.

[0091] Since this embodiment is based on the same principle as the above system embodiment, this method also has the corresponding technical effects of the above method embodiment.

[0092] Example 3 This invention provides a specific embodiment, using the RP2350 microcontroller as an example to illustrate the system of Embodiment 1. No additional hardware is required; onboard resources are directly reused to complete the entire closed-loop protection logic. The specific implementation is as follows: Hardware resource reuse: The physical confirmation unit reuses the onboard BOOTSEL button, the communication confirmation unit reuses the USB serial port, the status indicator submodule reuses the onboard LED, and the one-time programming storage area reuses the chip's internal OTP storage area.

[0093] Physical confirmation unit parameter configuration: Set the effective long press threshold to 800ms, and configure anti-shake, edge latching and anti-repeated triggering logic; the first confirmation is only established when the BOOTSEL button is pressed and held for 800ms. Short press, shaking, and occasional touch are not considered as valid first physical confirmation signals.

[0094] BOOTSEL button reading method: The button state is obtained by temporarily changing the output enable of the relevant QSPI pins and reading the high-order input register. This does not require continuous occupation of ordinary GPIO pins and does not affect the original function of the chip.

[0095] Communication confirmation unit implementation: It uses OK, C and other commands as confirmation signals to adapt to various serial port terminals and communication link environments.

[0096] State latch implementation: It is implemented using a one-way transition finite state machine. The main states include LOCKED, ARMED, and UNLOCKED. The write-wait-to-lock phase is implemented through an independent DONE_WAIT_LOCK process flag. Each state has a unique and clear semantic. Only one-way state transition is allowed, and illegal overstepping is prohibited.

[0097] Whitelist comparison unit configuration: The default fixed whitelist target line ALLOWED_ROW = 0x0400, and writing is only allowed when the target address to be written completely matches the whitelist; the whitelist can be expanded to a fixed page number, address range, or bit field mask according to actual needs.

[0098] The status indicator submodule implements the following: the onboard LED flashes briefly in the LOCKED state, flashes quickly in the ARMED state, remains constantly lit in the UNLOCKED state, and adopts a custom-defined flashing frequency in the write-and-wait-lock stage, so that the operator can intuitively perceive the current stage of the system without checking the terminal.

[0099] Log recording implementation: Four types of logs are output via serial port to form a complete chain of evidence: FLOW stage prompt log, used to clarify the current step and the next operation guidance; VIEW summary log, used to output core fields such as mode, state, step, evt, cmd, next; RUN heartbeat log, used to periodically output time, receive count, discard count, and overflow count; STATUS status snapshot log, used to output current mode, whitelist target, OTP value, written flag, and write count.

[0100] Abnormal lockout mechanism: When communication confirmation fails or an error occurs; the target address to be written is not in the whitelist; the predetermined time window of each stage is exceeded; the write readback result does not match; maintenance is abnormal or a command that does not conform to the current stage is executed; the operator actively executes the LOCK lockout command, the system immediately revokes the write permission, clears the authorization status, and enters the LOCKED default write-prohibited state.

[0101] Irreversible storage: The RP2350 microcontroller's built-in OTP is used as the irreversible storage area. Page addresses and row addresses are divided by code and used as whitelist verification parameters.

[0102] Those skilled in the art will understand that all or part of the processes of the methods described in the above embodiments can be implemented by a computer program instructing related hardware, and the program can be stored in a computer-readable storage medium. The computer-readable storage medium may be a disk, optical disk, read-only memory, or random access memory, etc.

[0103] The above description is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any changes or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in the present invention should be included within the scope of protection of the present invention.

Claims

1. A fully closed-loop anti-miswrite control system for a one-time programmable memory area, characterized in that, include: A physical confirmation unit is used to generate a first physical confirmation signal in response to an external physical operation; The communication confirmation unit is used to receive and verify the confirmation command from the host computer through the communication link and generate a second communication confirmation signal. The authorization management and state latching unit is used to receive the first physical confirmation signal and the second communication confirmation signal, and to perform state transition and output the authorization release signal; The whitelist comparison unit is used to receive the target address to be written, match the target address to be written with a preset legal address range, and then output an execution permission signal based on the matching result; The access control unit is used to receive the authorization release signal and the execution permission signal, and outputs a write enable signal when the authorization release signal and the execution permission signal are both valid. An irreversible storage unit is used to receive the write enable signal and perform a one-way irreversible write operation.

2. The one-time programmable memory area fully closed-loop anti-miswrite control system according to claim 1, characterized in that, The authorization management and state latching unit includes a one-way transition state machine, which includes: The LOCKED state represents the default write-disabled state, which is used to force entry after system power-on or reset and reject all write commands; The ARMED state represents a state of waiting for communication confirmation. It is entered after receiving a valid first physical confirmation signal and only accepts the second confirmation command. The UNLOCKED state represents a wait-to-write state, which is entered after receiving a valid second-level communication acknowledgment signal, and only accepts write commands and lockout commands; The unidirectional transition state machine only allows unidirectional transitions along the LOCKED, ARMED, and UNLOCKED states. When any state receives a command that does not conform to the semantics of the current state, an exception lock is triggered, and the state unconditionally jumps to the LOCKED state.

3. The one-time programmable memory area fully closed-loop anti-miswrite control system according to claim 2, characterized in that, The authorization management and status latching unit performs the following control steps: Based on the current system state, the first physical acknowledgment signal received is verified for validity. If the first physical acknowledgment signal is verified to be valid, the current system state is transitioned from the default write-prohibited state to the waiting for communication acknowledgment state, and the acknowledgment window timer is started. Based on the current system state and the confirmation window timer, the received second communication confirmation signal is verified for second validity. If the second communication confirmation signal is verified as valid, the current system state is transitioned from the waiting for communication confirmation state to the waiting for write state, and the writable window timer is started. At the same time, a valid authorization release signal is output.

4. The one-time programmable memory area fully closed-loop anti-miswrite control system according to claim 3, characterized in that, The authorization management and status latching unit performs a first validity check on the received first physical confirmation signal. If all checks pass, the first physical confirmation signal is deemed valid. The first validity check includes status check and anti-repeated trigger check.

5. The one-time programmable memory area fully closed-loop anti-miswrite control system according to claim 4, characterized in that, The state verification is used to verify whether the current system state is the default write-prohibited state. If so, the verification passes; otherwise, the verification fails, and the first physical confirmation signal is judged as an illegal overstepping operation, and an abnormal backlock is triggered. The anti-repeated triggering check is used to verify whether the time between receiving the first physical confirmation signal and the last valid first physical confirmation signal is greater than the preset anti-repeated locking time. If so, the check passes; otherwise, the check fails and the first physical confirmation signal is ignored.

6. The one-time programmable memory area fully closed-loop anti-miswrite control system according to claim 3, characterized in that, The authorization management and status latching unit performs a second validity check on the received second communication confirmation signal. If all checks pass, the second physical confirmation signal is deemed valid. The second validity check includes stage matching check, time window check, and sequence check.

7. The one-time programmable memory area fully closed-loop anti-miswrite control system according to claim 6, characterized in that, The stage matching verification is used to verify whether the current system state is in the waiting communication confirmation state. If so, the verification passes; otherwise, the verification fails, and the second physical confirmation signal is judged as an illegal overstepping operation, and an abnormal backlock is triggered. The time window verification is used to verify whether the moment the second communication confirmation signal is received is within the valid time period of the confirmation window timer. If so, the verification passes; otherwise, the verification fails, the second physical confirmation signal is determined to be an expired and invalid signal, and an abnormal backlock is triggered. The sequence check is used to verify whether the generation of the first physical confirmation signal precedes the generation of the second communication confirmation signal. If so, the check passes; otherwise, the check fails, the second physical confirmation signal is determined to be a timing disorder signal, and an abnormal backlock is triggered.

8. The one-time programmable memory area fully closed-loop anti-miswrite control system according to claim 1, characterized in that, The whitelist comparison unit performs matching with the preset legal address range in one or more of the following forms: Fixed address matching: one or more fixed address values ​​are preset. A hit is determined when the target address to be written completely matches any one of the address values. Address range matching: a legal address range is pre-defined by a start address and an end address. When the target address to be written falls within the range, it is considered a hit. Address mask matching: a base address and an address mask are preset. A hit is determined when the target address to be written matches the base address according to the mask. Bit segment mask matching uses a preset bit segment mask that allows writing. A hit is determined when the bits corresponding to the target address to be written fall within the range of the bit segment mask.

9. The one-time programmable memory area fully closed-loop anti-miswrite control system according to any one of claims 2-7, characterized in that, The unidirectional transition state machine also includes a DONE_WAIT_LOCK state, representing a write completion and lock-back pending state. This state is entered after the write operation is completed and only accepts lock-back commands, rejecting write commands and acknowledgment commands. The one-way transition state machine also allows transitions along the direction of the UNLOCKED state and the DONE_WAIT_LOCK state, and allows transitions from the DONE_WAIT_LOCK state to the LOCKED state.

10. The one-time programmable memory area fully closed-loop anti-miswrite control system according to claim 9, characterized in that, The system also includes a readback verification unit, which reads the current data at the target address and compares it with the data to be written after the write operation is completed. If the comparison is consistent, a verification pass flag is output to the authorization management and status latching unit. After receiving the verification pass flag, the authorization management and status latching unit transitions the current system state from the DONE_WAIT_LOCK state to the LOCKED state, completing the full closed-loop control process. If the comparison is inconsistent, a verification error lockout signal is output to the authorization management and status latching unit. The authorization management and status latching unit triggers the error lockout, and the current system state is forcibly switched to the LOCKED state.

Images