CN108228525B

CN108228525B - Device and method for safely realizing SOC (system on chip) of multi-core 8051 processor

Info

Publication number: CN108228525B
Application number: CN201611145616.3A
Authority: CN
Inventors: 王洪; 刘华平
Original assignee: BEIJING DWIN TECHNOLOGY CO LTD
Current assignee: BEIJING DWIN TECHNOLOGY CO LTD
Priority date: 2016-12-13
Filing date: 2016-12-13
Publication date: 2021-09-24
Anticipated expiration: 2036-12-13
Also published as: CN108228525A

Abstract

The invention relates to an encryption method and device for data exchange between a multi-core 8051 processor SOC and an off-chip FLASH. The safety realization device system comprises a plurality of 8051 processors, a JTAG Controller, a Code & Data SRAM and an encryption and decryption processing module; the encryption module comprises a MUX module, an Efuse module, a JTAG security module and a Spi flash controller module. The processors read and write the external SPI FLASH through an Spi FLASH controller module based on the unique CODE generated by the EFUSE; the JTAG interface of the dual-core 8051SOC communicates with the JTAG security module through a JTAG Controller, the JTAG security module performs encryption and decryption processing through the unique CODE generated by the EFUSE module, and finally performs data read-write exchange with the SPI FLASH.

Description

Device and method for safely realizing SOC (system on chip) of multi-core 8051 processor

Technical Field

The invention relates to the field of processor security, in particular to an encryption method and device for data exchange between a multi-core 8051 processor SOC and an off-chip FLASH.

Background

The 8051 core processor does not usually have a large-capacity data storage space on the chip, so an external chip capable of storing data is needed, and one of the core processors is suitable for a very wide low-cost and superior-performance chip storage medium-SPI FLASH operation in the modern electronic industry. However, since the standard SPI FLASH itself does not have the capability of encrypting data, the data security of the SPI FLASH has suffered from the following problem.

The FLASH chip, named 'FLASH memory' in Chinese, belongs to one type of memory devices. The physical characteristics of the flash memory are fundamentally different from those of a common memory, namely, various DDR, SDRAM or RDRAM belong to volatile memories, and data in the memories cannot be maintained as long as current supply is stopped, so that the data needs to be reloaded into the memories every time a computer is started; the flash memory is a Non-Volatile (Non-Volatile) memory, which can hold data for a long time without current supply, and has a storage characteristic equivalent to a hard disk, which is the basis of the flash memory becoming a storage medium for various portable digital devices.

NOR and NAND are the two major non-volatile flash memory technologies on the market. The first development of NOR flash technology by Intel in 1988 has drastically changed the situation that was formerly made up of EPROM and EEPROM. Immediately after 1989, toshiba published a NAND flash architecture that emphasizes reduced cost per bit, higher performance, and easy upgrades over the interface like a disk.

SPI is an abbreviation for Serial Peripheral Interface (Serial Peripheral Interface). SPI is a high-speed, full-duplex, synchronous communication bus to only occupy four lines on the pin of chip, practiced thrift the pin of chip, save space on the overall arrangement for PCB simultaneously, provide convenience, just because of this kind of simple easy-to-use characteristic, more and more chips have integrated this kind of communication protocol now, for example from the FLASH chip who takes the SPI interface.

The communication principle of SPI is simple and it works in a master-slave mode, which usually has a master device and one or more slave devices, requiring at least 4 wires, and in fact 3 wires (in case of unidirectional transmission). Also common to all SPI-based devices are SDI (data in), SDO (data out), SCLK (clock), CS (chip select).

Although the FLASH chip of the SPI interface does nothing more than do, the security of the data stored in the SPI FLASH has always been a big problem. Because it is more and more widely used in multi-core 8051 processors, data encryption is rarely done well.

Disclosure of Invention

The device and the method for realizing the safety of the SOC of the multi-core 8051 processor ensure that the data stored in the SPI FLASH can be protected most safely. This enables the user's data and core code to run securely on the SOC. The safety device and the technical scheme have simple design, and the realization area and the power consumption on the SOC are small.

The technical scheme for solving the technical problems is as follows: the installation implementation device System based on the dual-core 8051 processor SOC comprises a CPU 08051 System, a CPU 18051 System, a JTAG Controller, a Code & Data SRAM and an encryption and decryption processing module;

the CPU 08051 System is one of the constituent cores of a dual-core 8051SOC System and is one of processors for processing data by the whole dual-core 8051;

the CPU 18051 System is one of the constituent cores of the dual core 8051SOC System, and is one of the processors for the whole dual core 8051 to process data;

the JTAG Controller is an external downloading and simulating interface of the dual-core 8051SOC system and is used for program development and program burning of the dual-core 8051;

the Code & Data SRAM is a high-speed buffer area of internal codes and Data of a dual-core 8051SOC system and provides a reliable buffer area for the codes and the Data;

the encryption and decryption processing module comprises a MUX module, an Efuse module, a JTAG security module and a Spi flash controller module.

The MUX module has the function of data selection logic and is used for determining and switching the time sequence of data exchange between the JTAG security module and the Spi flash controller module and the Spi flash;

the eFuse module is an electronic fuse, can be made into a unique identification CODE through the eFuse module, and is mainly provided for a CODE required by encryption and decryption of a chip, each SOC has a corresponding unique CODE, and the SOC algorithm module can generate a corresponding encryption and decryption identifier according to the CODE. The unique encryption and decryption identification can ensure that each chip is different and unique;

the JTAG security module is mainly used for encrypting and decrypting JTAG access SPI FLASH, and JTAG data is enabled to access the SPI FLASH through the dual-core 8051SOC through the JTAG security module not through transparent transmission but through encryption transmission, so that the data is encrypted no matter where the data is read from or written into the SPI FLASH;

the Spi FLASH controller module is mainly used for the CPU to access the Spi FLASH for encryption and decryption, and both the CPU0 and the CPU1 need to encrypt and decrypt data when the two CPUs read and access the Spi FLASH, so that the encryption of data transmission is ensured. The amount of operations for encrypting and decrypting data by the CPU0 and the CPU1 can be reduced, and the processing load on the CPU0 and the CPU1 can be increased without requiring a complicated encryption algorithm.

The invention has the beneficial effects that: the whole-course data encryption can be completely carried out on the reading and writing of the SPI FLASH through the encryption and decryption processing module, and for the CPU, the data reading and writing of the SPI FLASH through the independent encryption and decryption processing module can be completely calculated to be transparent. Thus, the data encryption and decryption processing between the deep SPI FLASH and the multi-core 8051SOC is completed on the basis of not increasing extra power consumption and workload.

On the basis of the technical scheme, the invention can be further improved as follows:

further, the MUX selecting logic function module is located between the external SPI FLASH and JTAG security module and the SPI FLASH controller module;

furthermore, through the effective cooperation between the MUX selection logic module and the SPI FLASH, JTAG security module and the SPI FLASH controller module, the SPI FLASH and the dual-core 8051SOC can smoothly perform data reading and writing operations.

The beneficial effect of adopting the further scheme is that: through the MUX selection logic module, the problem that two CPUs of a JTAG interface and an internal dual-core 8051SOC compete for the SPI FLASH control right can be avoided.

Further, a unique identification code is generated by the EFUSE module.

Further, the unique identification codes JTAG security and the Spi flash controller generated by the EFUSE module may generate the encrypted data through hardware logic by the unique identification codes.

The beneficial effect of adopting the further scheme is that: the dual-core 8051SOC system is completely encrypted for reading and writing the data of the SPI FLASH and is an encryption method that chips of the same type are different from one another.

The method for realizing the device based on the dual-core 8051SOC system safety comprises the following steps:

step 1, a CPU0 and a CPU1 of a dual-core 8051SOC read and write an external SPI FLASH through a unique CODE generated by a Spi FLASH controller module based on EFUSE;

step 2, a JTAG interface of the dual-core 8051SOC communicates with a JTAG security module through a JTAG Controller, the JTAG security module performs encryption and decryption processing through a unique CODE generated by an EFUSE module, and finally performs data read-write exchange with an SPI FLASH;

and 3, judging the time domain and the logic domain by the JTAG security module and the Spi FLASH controller module through the MUX hardware logic selection module, and determining which module is communicated with the SPI FLASH after judgment.

The invention has the beneficial effects that: the encryption and decryption data are obtained through the unique CODE generated by the EFUSE on the dual-core 8051 processor SOC and the encryption and decryption processing of the JTAG security module and the Spi FLASH controller module, the data in the dual-core 8051 processor SOC are separated from the data stored in the external SPI FLASH, and normal communication can be carried out only through the safety device and the encryption is carried out. Therefore, the problems that the external data of the traditional multi-core 8051 processor SOC system is not encrypted and the encryption is simple are solved.

further, when the unique CODE bit number generated by the EFUSE module is not the preset bit number, the Spi flash controller module of step 1 does not perform encryption/decryption read-write operation on the data, thereby preventing erroneous execution results caused by abnormal data.

Further, when the unique CODE bit generated by the EFUSE module is not the preset bit, the JTAG security module of step 2 does not perform encryption/decryption read/write operations on the data, thereby preventing the data from causing an erroneous execution result due to an exception.

Further, when the JTAG security module and the Spi flash controller module find that the data read and written back after being switched by the MUX is abnormal by decrypting the data, the JTAG security module and the Spi flash controller module do not perform encryption and decryption read and write operations on the data any more, thereby preventing erroneous execution results from being caused by the abnormal data.

The beneficial effect of adopting the further scheme is that: the method can avoid the damage or destruction of the chip caused by external or internal damage to the correctness of data reading and writing, and prevent the wrong data from causing the wrong operation of the CPU of the multi-core 8051 processor and further causing wrong output, thereby realizing the omnibearing data safety and the extremely high reliability of the chip.

Drawings

FIG. 1 is a schematic diagram of an internal architecture of a dual core 8051SOC system according to the present invention;

FIG. 2 is a schematic diagram of the safety device of the present invention;

FIG. 3 is a schematic flow chart of a method for implementing the security device of the present invention;

Detailed Description

The principles and features of this invention are described below in conjunction with the following drawings, which are set forth by way of illustration only and are not intended to limit the scope of the invention.

As shown in fig. 1, the system for implementing the installation apparatus based on the multi-core 8051SOC of the present invention includes a JTAG interface 1, a CPU0 system 2 in the dual 8051SOC, a CPU1 system 3 in the dual 8051SOC, a JTAG CONTROLLER 4, an SPI FLASH 5, and a security apparatus system 6;

as shown in fig. 2, the safety device system is composed of an EFUSE electronic fuse 61, a MUX digital logic selector 63, a JTAG SECURITY 64, and an SPI FLASH CONTROLLER 62 control module.

Data of the external SPIFLASH to be accessed by the JTAG needs to be preprocessed by the JTAG CONTROL 4, the JTAG CONTROL analyzes that the data of the JTAG needs to pass through the CPU0 system 2 or the CPU1 system 3, and sends the data to a corresponding CPU system, and finally sends the data to the MUX data logic selection module 63 after being encrypted and decrypted by the JTAG SECURITY module 64, and then carries out the last data read-write operation with the SPI FLASH 5.

For the CPU0 system 2 or the CPU1 system 3 in the system to directly access the SPI FLASH 5, the SPI FLASH CONTROLLER module 62 is required to perform encryption and decryption, and then perform data read-write operation with the SPI FLASH 5 after the encryption and decryption and the selection of the MUX data logic selector 63.

As shown in fig. 2, the JTAG SECURITY module 64 and the SPI FLASH CONTROLLER module 62 are encrypted by a unique CODE generated by the DFUSE electronic fuse 61, and each dual core 8051SOC system of the same model has a unique CODE and is different, so that different encrypted and decrypted data can be made by the CODE.

As shown in fig. 3, the method for safely implementing the apparatus based on the multi-core 8051 processor SOC includes the following steps:

step 1, generating a unique CODE through an EFUSE module 61;

step 2, the JTAG SECURTY module 64 and the SPI FLASH CONTROL module 62 carry out data encryption and decryption according to the CODE;

step 3, the MUX logic selection module 63 adjusts the data exchange logic with the FLASH;

and 4, finally, realizing the encrypted data exchange read-write operation of the dual-core 8051 processor SOC and the SPI FLASH 5.

The above description is only for the purpose of illustrating the preferred embodiments of the present invention and is not to be construed as limiting the invention, and any modifications, equivalents, improvements and the like that fall within the spirit and principle of the present invention are intended to be included therein.

Claims

1. A secure realization device of a multi-core 8051 processor SOC is characterized by comprising a CPU 08051 System, a CPU 18051 System, a JTAG Controller, a Code & Data SRAM and an encryption and decryption processing module;

the CPU 08051 System and the CPU 18051 System are one of the constituent cores of the dual-core 8051SOC System and one of the processors for processing data of the whole dual-core 8051;

the encryption and decryption processing module is used for realizing encryption and decryption of data transmission and comprises a MUX module, an Efuse module, a JTAG security module and a Spi flash controller module; the MUX module has the function of data selection logic and is used for determining and switching the time sequence of data exchange between the JTAG security module and the Spi flash controller module and the Spi flash; the system comprises an Efuse module, an SOC algorithm module and an Efuse module, wherein the Efuse module is an electronic fuse, can be made into a unique identification CODE through the Efuse module, is mainly provided for a CODE required by encryption and decryption of a chip, each SOC has a corresponding unique CODE, the SOC algorithm module can generate a corresponding encryption and decryption identifier according to the CODE, and each chip can be different and unique through the unique encryption and decryption identifier; the JTAG security module is mainly used for encrypting and decrypting JTAG access SPI FLASH, and JTAG data is enabled to access the SPI FLASH through the dual-core 8051SOC through the JTAG security module not through transparent transmission but through encryption transmission, so that the data is encrypted no matter where the data is read from or written into the SPI FLASH; the Spi FLASH controller module is mainly used for the CPU to access the Spi FLASH for encryption and decryption, and both the CPU0 and the CPU1 need to perform data encryption and decryption by using the module for reading and accessing the Spi FLASH, so that the data transmission encryption is ensured, the computation load of the CPU0 and the CPU1 on data encryption and decryption can be reduced, and the processing load of the CPU0 and the CPU1 is increased without a complex encryption algorithm.

2. The apparatus of claim 1, wherein the MUX module is located between an external SPI FLASH and JTAG security module and a SPI FLASH controller module; through the effective cooperation between the MUX module, the SPI FLASH, the JTAG security module and the SPI FLASH controller module, the SPI FLASH and the dual-core 8051SOC can smoothly perform data reading and writing operations.

3. The apparatus of claim 1, wherein the EFUSE module generates a unique id, and the unique id JTAG security and the Spi flash controller generated by the EFUSE module may generate the encrypted data through the unique id by hardware logic.

4. A safe realization method of a multi-core 8051 processor SOC is characterized by mainly comprising the following steps:

step one, a CPU0 and a CPU1 of a dual-core 8051SOC read and write an external SPI FLASH through a unique CODE generated by a Spi FLASH controller module based on EFUSE;

step two, a JTAG interface of the dual-core 8051SOC communicates with a JTAG security module through a JTAG Controller, the JTAG security module performs encryption and decryption processing through a unique CODE generated by an EFUSE module, and finally performs data read-write exchange with the SPI FLASH;

and step three, the JTAG security module and the Spi FLASH controller module carry out time domain and logic judgment through judgment of the MUX hardware logic selection module, and determine which module is communicated with the SPI FLASH after judgment.

5. The secure implementation method of a multicore 8051 processor SOC of claim 4, wherein when the number of unique CODE bits generated by the EFUSE module is not a preset number of bits, the Spi flash controller module of said first step does not perform encryption/decryption read/write operations on the data, thereby preventing erroneous execution results of the data due to an exception.

6. The secure implementation method of the multi-core 8051 processor SOC of claim 4, wherein when the number of unique CODE bits generated by the EFUSE module is not a preset number of bits, the JTAG security module of the second step does not perform encryption/decryption read/write operations on the data, thereby preventing the data from causing an erroneous execution result due to an exception.

7. The secure implementation method of the multi-core 8051 processor SOC of claim 4, wherein when the JTAG security module and the Spi flash controller module discover that the data read and written back after being switched by the MUX is abnormal by decrypting the data, the JTAG security module and the Spi flash controller module do not perform encryption and decryption read and write operations on the data any more, thereby preventing the data from causing an erroneous execution result due to the abnormality.