CN109818745B

CN109818745B - Internet of things information security chip

Info

Publication number: CN109818745B
Application number: CN201711166972.8A
Authority: CN
Inventors: 熊晓明; 徐崇耀; 郑欣; 詹瑞典
Original assignee: Chipeye Microelectronics Foshan Ltd
Current assignee: Chipeye Microelectronics Foshan Ltd
Priority date: 2017-11-21
Filing date: 2017-11-21
Publication date: 2022-04-01
Anticipated expiration: 2037-11-21
Also published as: CN109818745A

Abstract

The invention discloses an information security chip of the Internet of things, which comprises a central processing unit, a dynamic memory, a flash memory, an SM2 encryption algorithm unit, an SM3 encryption algorithm unit, an SM4 encryption algorithm unit, an AES encryption algorithm unit, a true random number generator, a physical unclonable function circuit, an I2C interface, a UART interface, an SPI interface, an I/O interface, a JTAG interface and a timer, wherein the central processing unit, the dynamic memory, the flash memory, the SM2 encryption algorithm unit, the SM3 encryption algorithm unit, the SM4 encryption algorithm unit, the AES encryption algorithm unit, the true random number generator, the physical unclonable function circuit, the UART interface, the SPI interface, the JTAG interface and the timer are interconnected through an on-chip bus; the true random number generator is used for generating a true random number, the physical unclonable function circuit is used for chip authentication and key generation, when a key is needed, the true random number generated by the true random number generator is input into the physical unclonable function circuit through an on-chip bus, the physical unclonable function circuit outputs a unique response sequence, and the response sequence is the key. The invention has the advantages of high encryption and decryption operation speed, less hardware resource consumption, lower power consumption, no duplication and stealing of keys and higher security and anti-counterfeiting level.

Description

Internet of things information security chip

Technical Field

The invention relates to the field of information security, in particular to an information security chip of the Internet of things.

Background

At present, in the era of high-speed development of information technology, the internet is rapidly becoming a carrier of all industries and promoting the progress of the industries, and the internet of things is used as a basic medium and a pioneer for improving the application of the internet, so that the efficiency of industrial production and life of people is greatly improved. Its application is called the third wave of world information industry development following computers, internet. Meanwhile, the safety problem of the internet of things is also paid much attention by people.

In order to guarantee information security, the national cryptology administration of China proposed an SM2 elliptic curve public key cryptographic algorithm, an SM3 cryptographic hash algorithm and an SM4 block cryptographic algorithm in 12 months in 2010. The effective combination of the three encryption algorithms can meet the safety requirements of data encryption and decryption, identity authentication, data integrity and authenticity in various password applications. Thereby providing effective guarantee for the information safety of China.

The unclonable function based on the arbiter is an implementation form of a Physical Unclonable Function (PUF) on silicon, and mainly utilizes physical randomness generated by manufacturing process deviation of a device to extract a characteristic quantity uniquely related to the object. The corresponding object can be uniquely identified by the characteristic quantity, and the characteristic quantity cannot be copied because process variations in the production process cannot be copied. Therefore, PUFs based on semiconductor technology have the properties of irreproducibility, uniqueness, stability, immune-invasive attack. The current popular symmetric encryption algorithms AES, SM4, etc. need to store the key in the non-volatile storage, which is easily attacked by intrusion, resulting in the key being copied and stolen. And the silicon-based arbiter PUF can prevent invasive attack and prevent the secret key from being copied and stolen, and can be applied to the field of chip anti-counterfeiting identification.

The True Random Number Generator (TRNG) realized by a physical method is a reflection of a natural random physical process, and even if all information such as a TRNG algorithm and the like is exposed, the result cannot be guessed, namely, the random number generated by the high-quality TRNG never has periodicity. Therefore, TRNG plays important roles in information security systems, such as data encryption, key management, public and private key generation, digital signatures, identity authentication, and the like.

With the rapid development of integrated circuit manufacturing processes, SoC of system on chip is in operation. The SoC greatly reduces the system volume and improves the system performance; SoC is more and more widely applied due to the advantages of high integration level, small volume, low power consumption, good reliability, short product appearance period and the like. However, some products in the current market adopt a software encryption mode, so that the data encryption speed is low, the period is long, meanwhile, some products are completely encrypted by hardware, although the speed is high, the chip area is large, the power consumption is high, and the low-power-consumption requirement of the product of the internet of things cannot be met. Meanwhile, most products in the market store the key in a nonvolatile memory, so that the key is easily attacked in an intrusive way, and the key is copied and stolen. The problems seriously restrict the popularization and development of the Internet of things and bring great potential safety hazard to products of the Internet of things.

Disclosure of Invention

The technical problem to be solved by the invention is to provide an internet of things information security chip with high encryption and decryption operation speed, less hardware resource consumption and lower power consumption, non-replicable and non-stealing keys and high security and anti-counterfeiting level aiming at the defects in the prior art.

The technical scheme adopted by the invention for solving the technical problems is as follows: an information security chip of the internet of things is constructed, and the chip comprises a central processing unit, a dynamic memory, a flash memory, an SM2 encryption algorithm unit, an SM3 encryption algorithm unit, an SM4 encryption algorithm unit, an AES encryption algorithm unit, a true random number generator, a physical unclonable function circuit, an I2C interface, a UART interface, an SPI interface, an I/O interface, a JTAG interface and a timer, wherein a register is arranged in the SM4 encryption algorithm unit, the central processing unit is connected with an on-chip bus and is used for controlling the SM2 encryption algorithm unit, the SM3 encryption algorithm unit and the SM4 encryption algorithm unit to realize data encryption, decryption and signature verification, the working mode of the true random number generator and the generation of the true random number are controlled, the working mode of the physical unclonable function circuit is controlled, a key generated by the physical unclonable function circuit is read, and the key is transmitted to the SM2 encryption algorithm unit, The SM3 encryption algorithm unit, the SM4 encryption algorithm unit or the AES encryption algorithm unit control the I2C interface, the UART interface and the SPI interface to realize communication with equipment outside a chip, and control the I/O interface to realize control over external equipment and control the work of the timer;

the dynamic memory is connected with the on-chip bus and used for storing temporary data in operation, the flash memory is connected with the on-chip bus and used for storing codes and constants, the SM2 encryption algorithm unit is connected with the on-chip bus and is used for realizing point operation and module operation of an elliptic curve, the SM3 encryption algorithm unit is connected with the on-chip bus and is used for realizing message expansion and iterative compression in SM3 cryptographic hash algorithm, message filling and message grouping are realized by the central processing unit, the central processing unit inputs a key and data needing to be encrypted or decrypted into a register through the chip, the SM4 encryption algorithm unit completes encryption or decryption operation, sending a data reading notification to the central processing unit through the on-chip bus, wherein the AES encryption algorithm unit is connected with the on-chip bus and is used for realizing the secret communication of data under the control of the central processing unit;

the true random number generator is connected with the on-chip bus and used for generating a true random number and storing the true random number in the flash memory, the true random number is used for generating the key, when the key is needed to be used, the true random number is input into the physical unclonable function circuit through the on-chip bus, the physical unclonable function circuit outputs a unique response sequence after receiving the true random number, the response sequence is used as the key, the physical unclonable function circuit is connected with the on-chip bus and used for chip authentication and key generation, the I2C interface, the UART interface and the SPI interface are all connected with the on-chip bus and used for realizing communication with a device outside the chip, and the I/O interface is connected with the on-chip bus and used for interacting with an external device, the JTAG interface is connected with the on-chip bus and used for on-line debugging of programs, and the timer is connected with the on-chip bus and used for realizing timing.

The Internet of things information security chip further comprises a phase-locked loop, wherein the phase-locked loop is connected with the on-chip bus and used for locking a clock phase and generating a clock signal with required frequency.

The information security chip of the internet of things further comprises a power management unit and a power management unit, wherein the power management unit is connected with an external power supply and used for supplying power to the information security chip of the internet of things.

In the internet of things information security chip, the external device comprises an external controller, a sensor, an LED, a buzzer and a key.

In the internet of things information security chip, the point operation comprises point multiplication, point addition and point doubling.

In the internet of things information security chip, the modular operation comprises modular addition, modular subtraction, modular multiplication and modular inversion.

The Internet of things information security chip has the following beneficial effects: because the encryption and decryption part for data with larger operation amount in the encryption and decryption process is completed by hardware, and the central processing unit is responsible for data processing and operation control with smaller operation amount, the method can reduce the chip area and reduce the power consumption on the premise of effectively improving the encryption and decryption speed, simultaneously a secret key in the encryption and decryption process is generated by the physical unclonable function circuit, input data required by the physical unclonable function circuit to generate the secret key is generated by the true random number generator, and the method can effectively resist invasive attack and avoid the secret key from being copied and stolen, meanwhile, the physical unclonable function circuit can also be used for chip uniqueness identification and authentication, so that the security level of the system is further improved, the encryption and decryption operation speed is higher, less hardware resource consumption and lower power consumption are realized, the key cannot be copied and stolen, and the security anti-counterfeiting level is higher.

Drawings

In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings used in the description of the embodiments or the prior art will be briefly described below, it is obvious that the drawings in the following description are only some embodiments of the present invention, and for those skilled in the art, other drawings can be obtained according to the drawings without creative efforts.

Fig. 1 is a schematic diagram of an internal structure of an information security chip of the internet of things according to an embodiment of the present invention.

Detailed Description

The technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the drawings in the embodiments of the present invention, and it is obvious that the described embodiments are only a part of the embodiments of the present invention, and not all of the embodiments. All other embodiments, which can be derived by a person skilled in the art from the embodiments given herein without making any creative effort, shall fall within the protection scope of the present invention.

In the embodiment of the information security chip of the internet of things, an internal structure schematic diagram of the information security chip of the internet of things is shown in fig. 1. In fig. 1, the internet of things information security chip includes a central processing unit CPU, a dynamic memory SRAM, a Flash memory Flash, an SM2 encryption algorithm unit 1 (i.e., a national secret SM2 asymmetric encryption algorithm unit), an SM3 encryption algorithm unit 2 (i.e., a national secret SM3 hash algorithm unit), an SM4 encryption algorithm unit 3 (i.e., an AM4 symmetric encryption algorithm unit), an AES encryption algorithm unit 4 (i.e., an AES symmetric encryption algorithm unit), a true random number generator TRNG, a physical unclonable function circuit PUF, an I2C interface 5, a UART interface 6, an SPI interface 7, an I/O interface 8, a JTAG interface 9, and a timer 10, which are interconnected through an on-chip bus.

Specifically, the SM4 encryption algorithm unit 3 is provided with a register (not shown in the figure), and the central processing unit CPU can directly access and control each module. The central processing unit CPU is a low-power consumption embedded processor, and can adopt a central CK802, an ARM Cortex-M0 and the like. The central processing unit CPU is connected with the on-chip bus and is used for controlling the SM2 encryption algorithm unit 1, the SM3 encryption algorithm unit 2 and the SM4 encryption algorithm unit 3 to realize data encryption, decryption and signature verification, controlling the working mode of the true random number generator TRNG and the generation of the true random number, controlling the working mode of the physical unclonable function circuit PUF and reading a key generated by the physical unclonable function circuit PUF, transmitting the key to the SM2 encryption algorithm unit 1, the SM3 encryption algorithm unit 2, the SM4 encryption algorithm unit 3 or the AES encryption algorithm unit 4, controlling the I2C interface 5, the UART interface 6 and the SPI interface 7 to realize communication with devices outside the chip, controlling the I/O port 8 to realize the control of the external devices and the operation of the timer, wherein the content of the communication can be original data, encrypted data, decrypted data, other data and the like, and realizing accurate timing and the like.

It should be noted that in this embodiment, the external device includes an external controller, a sensor, an LED, a buzzer, a key, and the like, and certainly, in practical applications, the type of the external device may be correspondingly expanded according to specific situations.

In this embodiment, the dynamic memory SRAM is connected to the on-chip bus and used to store the temporary data in operation, and the Flash memory Flash is connected to the on-chip bus and used to store the code and the constant. The SM2 encryption algorithm unit 1, the SM3 encryption algorithm unit 2 and the SM4 encryption algorithm unit 3 are core security units, and realize secure communication of data mainly under the control of a central processing unit CPU.

Specifically, the SM2 encryption algorithm unit 1 is connected with an on-chip bus and is used for realizing point operation and modular operation of an elliptic curve, wherein the point operation comprises point multiplication, point addition and point doubling; the modulo operation includes modulo addition, modulo subtraction, modulo multiplication, and modulo inversion. Each operation can be independently called by the central processing unit CPU, and the flexibility is strong. The SM2 encryption algorithm unit 1 and the SM3 encryption algorithm unit 2 can realize functions of encryption, decryption, key exchange, signature verification and the like in a matching way.

The SM3 encryption algorithm unit 2 is connected with an on-chip bus and used for realizing message expansion and iterative compression in an SM3 password hash algorithm, message filling and message grouping are realized by a Central Processing Unit (CPU), and software and hardware are cooperatively designed, so that the SM3 operation speed can be improved, the chip area and the power consumption can be reduced, and the application requirements of the Internet of things are met.

The SM4 encryption algorithm unit 3 and the AES encryption algorithm unit 4 both use symmetric cipher algorithms, and have the advantages of high speed and strong confidentiality. The central processing unit CPU inputs the key and the data to be encrypted or decrypted into a register of the SM4 encryption algorithm unit 3 through the chip, the SM4 encryption algorithm unit 3 completes the encryption or decryption operation and sends a data reading notice to the central processing unit CPU through the chip bus, and the AES encryption algorithm unit 3 is connected with the chip bus and used for realizing the secret communication of the data under the control of the central processing unit CPU.

The true random number generator TRNG is connected with a bus in a chip, when the internet of things information security chip is used for the first time, the true random number generator TRNG generates a true random number used for generating a secret key, the true random number is stored in a Flash memory Flash, when the secret key needs to be used, the true random number can be used as the input of a physical unclonable function circuit PUF, the physical unclonable function circuit PUF can output a unique response sequence, and the response sequence is the secret key. Because the key is related to factors such as process errors in the manufacturing process of the information security chip of the internet of things, the key generated by the physical unclonable function circuit PUF has the characteristics of intrusion attack prevention, copying incapability and the like. After the central processing unit CPU reads the key, it can encrypt and decrypt the data transmitted from the I2C interface 5, the UART interface 6, and the SPI interface 7, and transmit the encrypted and decrypted data through the I2C interface 5, the UART interface 6, and the SPI interface 7.

The physical unclonable function circuit PUF is connected with the on-chip bus and can also be used for chip authentication, namely the physical unclonable function circuit PUF can be used for chip authentication and key generation, and the unclonable characteristic enables the chip to have strong anti-counterfeiting effect. The I2C interface 5, the UART interface 6 and the SPI interface 7 are all connected with the on-chip bus and used for realizing communication with devices outside the chip, the I/O interface 8 is connected with the on-chip bus and used for interacting with the external devices, and the information security chip of the internet of things can also realize logic control, data operation and the like and carry out control and interaction through the I/O interface 8. JTAG interface 9 is connected with on-chip bus, is used for the online debugging of the procedure, can raise the programming efficiency effectively. The timer 10 is connected with an on-chip bus and used for realizing accurate timing.

Hardware modules such as a Central Processing Unit (CPU), an SM2 encryption algorithm unit 1, an SM3 encryption algorithm unit 2, an SM4 encryption algorithm unit 3, an AES encryption algorithm unit 4 and the like are integrated in the information security chip of the Internet of things. In the process of secret communication, the data encryption and decryption part with large computation amount is completed by hardware, and the central processing unit CPU is responsible for data processing and computation control with small computation amount. Meanwhile, a secret key in the encryption and decryption process is generated by the physical unclonable function circuit PUF, and input data required by the physical unclonable function circuit PUF for generating the secret key is generated by the true random number generator TRNG. Meanwhile, the physical unclonable function circuit PUF can also be used for chip uniqueness identification and authentication, and the safety anti-counterfeiting grade of the system is further improved.

The information security chip of the Internet of things further comprises an I2C interface 5, a UART interface 6, an SPI interface 7, an I/O port 8, a timer 10 and the like, and can meet application requirements on various occasions. The central processing unit CPU can independently access the SM2 encryption algorithm unit 1, the SM3 encryption algorithm unit 2, the SM4 encryption algorithm unit 3, the AES encryption algorithm unit 4, the true random number generator TRNG and the physical unclonable function circuit PUF, thereby effectively improving the flexibility and the application range of the chip and having strong flexibility. The encryption and decryption operation speed is high; less hardware resource consumption and lower power consumption; keys cannot be copied and stolen; the information security chip of the Internet of things can achieve uniqueness identification and cannot be cloned.

In this embodiment, the information security chip of the internet of things further includes a phase-locked loop 11, and the phase-locked loop 11 is connected to the on-chip bus and is configured to lock a clock phase and generate a clock signal with a desired frequency. This thing networking information security chip still includes power management unit 12, and power management unit 12 is integrated in this thing networking information security chip's inside, and power management unit 12 connects external power source, is used for supplying power for this thing networking information security chip, guarantees the job stabilization of chip.

In summary, the present invention provides an information security chip of internet of things, which integrates a 32-bit low power consumption processor (central processing unit CPU), an SM2 encryption algorithm unit 1, an SM3 encryption algorithm unit 2, an SM4 encryption algorithm unit 3, an AES encryption algorithm unit 4, a true random number generator TRNG, a physical unclonable function circuit PUF, a timer 10, and a peripheral interface. The invention has the advantages of high encryption and decryption operation speed, less hardware resource consumption, lower power consumption, no duplication and stealing of keys and higher security level.

The above description is only for the purpose of illustrating the preferred embodiments of the present invention and is not to be construed as limiting the invention, and any modifications, equivalents, improvements and the like that fall within the spirit and principle of the present invention are intended to be included therein.

Claims

1. An information security chip of the Internet of things is characterized by comprising a central processing unit, a dynamic memory, a flash memory, an SM2 encryption algorithm unit, an SM3 encryption algorithm unit, an SM4 encryption algorithm unit, an AES encryption algorithm unit, a true random number generator, a physical unclonable function circuit, an I2C interface, a UART interface, an SPI interface, an I/O interface, a JTAG interface and a timer, wherein a register is arranged in the SM4 encryption algorithm unit, the central processing unit is connected with an on-chip bus and is used for controlling the SM2 encryption algorithm unit, the SM3 encryption algorithm unit and the SM4 encryption algorithm unit to realize encryption, decryption and signature verification of data, controlling the working mode of the true random number generator and the generation of the true random number, controlling the working mode of the physical unclonable function circuit and reading a key generated by the physical unclonable function circuit, and transmitting the key to the SM2 encryption algorithm unit, The SM3 encryption algorithm unit, the SM4 encryption algorithm unit or the AES encryption algorithm unit control the I2C interface, the UART interface and the SPI interface to realize communication with equipment outside a chip, and control the I/O interface to realize control over external equipment and control the work of the timer;

2. The internet of things information security chip of claim 1, further comprising a phase-locked loop connected to the on-chip bus for locking a clock phase and generating a clock signal of a desired frequency.

3. The information security chip of the internet of things of claim 2, further comprising a power management unit, wherein the power management unit is connected with an external power supply and used for supplying power to the information security chip of the internet of things.

4. The Internet of things information security chip of claim 3, wherein the external device comprises an external controller, a sensor, an LED, a buzzer and a key.

5. The Internet of things information security chip of claim 4, wherein the point operations comprise point multiplication, point addition and point doubling.

6. An internet of things information security chip as claimed in any one of claims 1 to 5, wherein the modular operation comprises modular addition, modular subtraction, modular multiplication and modular inversion.