CN113111395A

CN113111395A - Scrambling clock generation circuit

Info

Publication number: CN113111395A
Application number: CN202110423163.0A
Authority: CN
Inventors: 江国范; 孙向向
Original assignee: Qingxin Semiconductor Technology Shanghai Co ltd
Current assignee: Qingxin Semiconductor Technology Shanghai Co ltd
Priority date: 2021-04-20
Filing date: 2021-04-20
Publication date: 2021-07-13

Abstract

The invention provides a scrambling clock generating circuit, comprising: a pseudo-random number generator configured to generate a pseudo-random number from an original clock signal generated by an original clock; a scramble enable generator configured to generate an enable signal from an original clock signal and a pseudo-random number; and a final output clock configured to output the original clock signal as a final clock signal according to the enable signal.

Description

Scrambling clock generation circuit

Technical Field

The invention relates to the technical field of integrated circuits, in particular to a scrambling clock generating circuit.

Background

In recent years, with the development of technologies such as cloud computing, internet of things, mobile computing and the like and the continuous expansion of application fields, the modern information technology has more and more prominent leading role in social life. Meanwhile, the demand for information security is becoming stronger. In more and more fields such as financial bank cards, social security cards, computer security starting chips, vehicle-mounted MCU and the like, complex security tests need to be carried out on the chips. High security chips not only require faster response speed, but also need to resist various attacks, especially power attacks.

Energy attacks, also known as power consumption attacks, are one type of bypass attack. The method utilizes the correlation between the power consumption of the password equipment and the password algorithm, and obtains the key information by measuring the power consumption of the password equipment for multiple times and then carrying out statistical analysis.

The masking method is a method which is commonly used for resisting energy attack, and the method of masking the intermediate value of the encryption operation makes the attack difficult. However, the masking method requires significant modification of the existing encryption algorithm, and the hardware cost is large.

Clock scrambling is another method of attack resistance. The clock signal after the random scrambling processing is changed randomly, so that the current curve inside the security chip is not changed regularly any more but is changed randomly, the attack difficulty is improved, and the attack resistance of the security chip is improved.

Chinese patent CN105894079B proposes a clock scrambling circuit based on a phase delay unit. The method requires designing a delay unit including a plurality of delay gears. The hardware overhead of such custom circuit designs is large and the performance overhead brought by the scrambling clock cannot be accurately controlled.

Disclosure of Invention

It is an object of the present invention to provide a novel scrambled clock generation circuit that can implement a scrambled clock that can accurately control performance loss overhead through a digital circuit design method.

To solve the above technical problem, the present invention provides a scrambled clock generation circuit, including:

a pseudo-random number generator configured to generate a pseudo-random number from an original clock signal generated by an original clock;

a scramble enable generator configured to generate an enable signal from an original clock signal and a pseudo-random number; and

and a final output clock configured to output the original clock signal as a final clock signal according to the enable signal.

Optionally, in the scrambled clock generation circuit, the generating a pseudo random number according to the original clock signal by the pseudo random number generator includes:

the pseudo-random number generator generates a serial pseudo-random binary sequence, with 0's and 1's occurring randomly within the period length of the pseudo-random binary sequence 2^ 31-1.

Optionally, in the scrambling clock generation circuit, the pseudo-random number generator is based on a PRBS31 ═ X31+ X28+1 code pattern, and includes 32 delay units, and each delay unit includes a D flip-flop;

the output signal of the 1 st delay unit, the output signal of the 29 th delay unit and the output signal of the 32 th delay unit generate a pseudo-random binary sequence through two exclusive-OR gates;

the pseudo-random binary sequence is fed back to the input end of the 1 st delay unit to carry out cyclic shift.

Optionally, in the scrambled clock generation circuit, the original clock signal is generated by a phase-locked loop or a crystal oscillator, and one clock cycle of the original clock signal includes an active time of a high level and an active time of a low level, and the active time of the high level occupies 50% of the whole clock cycle.

Optionally, in the scrambled clock generation circuit, the scrambling enable generator includes:

a counter configured to generate a count value and determine whether the count value is equal to a set value, if so, output a count signal equal to 1, otherwise, output a count signal equal to 0;

and an AND gate circuit configured to AND-operate the count signal and the pseudo random number to generate an enable signal, the enable signal being 1 if both the count signal and the pseudo random number are 1, and the enable signal being 0 if not.

Optionally, in the scrambling clock generating circuit, the scrambling enable generator includes a first scrambling circuit, and the first scrambling circuit includes:

the modulo-two counter is configured to jump once when encountering a rising edge of an original clock signal so as to output a first sequence signal which alternately appears in a cycle of 0 and 1, wherein the counting signal is 1 when the first sequence signal is equal to 1, and the counting signal is 0 otherwise;

a first AND gate configured to AND the count signal generated by the modulo-two counter with the pseudo-random number.

Optionally, in the scrambling clock generating circuit, the scrambling enable generator further includes a second scrambling circuit, where the second scrambling circuit includes:

a modulo four counter, configured to make one transition when encountering the rising edge of the original clock signal, so as to output a second sequence signal which alternately appears in cycles of 0, 1, 2 and 3;

a judgment circuit configured to make the count signal 1 when detecting that the second sequence signal is equal to 3, and to make the count signal 0 otherwise;

and a second AND gate configured to AND-operate the count signal generated by the judgment circuit with the pseudo random number.

Optionally, in the scrambled clock generation circuit, the method further includes:

an inverter configured to invert the enable signal;

the high-level effective time of the output of the first AND gate accounts for 25% of the whole clock period, and the high-level effective time of the output of the second AND gate accounts for 12.5% of the whole clock period.

and the mode selector is configured to select the enabling signal output by the first AND gate to be provided to the inverter or select the enabling signal output by the second AND gate to be provided to the inverter.

Optionally, in the scrambled clock generating circuit, the original clock is connected to the asynchronous bus bridge, the system bus, the CPU, the DMA, and the on-chip memory, so as to provide the original clock signal to the asynchronous bus bridge, the system bus, the CPU, the DMA, and the on-chip memory;

the final output clock is connected with the asynchronous bus bridge and the safety subsystem so as to provide a final clock signal to the asynchronous bus bridge and the safety subsystem;

the safety subsystem comprises an encryption and decryption module and is communicated with a system bus through an asynchronous bus bridge;

the security subsystem works in a scrambling clock domain according to a final clock signal so as to improve the capability of resisting energy attack;

the system bus, the CPU, the DMA and the on-chip memory work in a non-scrambling clock domain according to an original clock signal;

the asynchronous bus bridge communicates data according to the unscrambled clock domain and the scrambled clock domain.

In the scrambling clock generating circuit provided by the invention, the pseudo-random number generator is used for generating the pseudo-random number according to the original clock signal, the scrambling enable generator is used for generating the enable signal according to the original clock signal and the pseudo-random number, the final output clock is used for outputting the original clock signal as the final clock signal according to the enable signal, the pseudo-random number generator and the scrambling enable generator are both realized by digital circuits, the whole circuit is realized by the digital circuits, and the circuit cost is low.

Drawings

FIG. 1 is a schematic diagram of scrambled clock generation circuitry according to an embodiment of the present invention;

FIG. 2 is a schematic diagram of a scrambled clock generation circuit according to an embodiment of the present invention;

FIG. 3 is a diagram of a scrambled clock generation circuit applied to a system on chip according to an embodiment of the present invention;

FIG. 4 is a diagram illustrating original clock waveforms of a scrambled clock generation circuit according to an embodiment of the present invention;

FIG. 5 is a diagram illustrating a scrambled clock waveform of a scrambled clock generation circuit according to an embodiment of the present invention;

FIG. 6 is a waveform diagram of a first scrambling circuit of the scrambled clock generation circuit according to an embodiment of the present invention;

FIG. 7 is a waveform diagram of a second scrambling circuit of the scrambled clock generation circuit according to an embodiment of the present invention;

shown in the figure: 10-original clock; 20-a pseudo-random number generator; 30-scrambling enable generator.

Detailed Description

In the present invention, the embodiments are only intended to illustrate the aspects of the present invention, and should not be construed as limiting. In the present invention, the terms "a" and "an" do not exclude the presence of a plurality of elements, unless otherwise specified. It is further noted herein that in embodiments of the present invention, only a portion of the components or assemblies may be shown for clarity and simplicity, but those of ordinary skill in the art will appreciate that, given the teachings of the present invention, required components or assemblies may be added as needed in a particular scenario. Furthermore, features from different embodiments of the invention may be combined with each other, unless otherwise indicated. For example, a feature of the second embodiment may be substituted for a corresponding or functionally equivalent or similar feature of the first embodiment, and the resulting embodiments are likewise within the scope of the disclosure or recitation of the present application.

The scrambling clock generating circuit according to the present invention will be described in further detail with reference to the accompanying drawings and embodiments. Advantages and features of the present invention will become apparent from the following description and from the claims. It is to be noted that the drawings are in a very simplified form and are not to precise scale, which is merely for the purpose of facilitating and distinctly claiming the embodiments of the present invention.

Furthermore, features from different embodiments of the invention may be combined with each other, unless otherwise indicated. For example, a feature of the second embodiment may be substituted for a corresponding or functionally equivalent or similar feature of the first embodiment, and the resulting embodiments are likewise within the scope of the disclosure or recitation of the present application.

The core idea of the invention is to provide a novel scrambling clock generation circuit, which can accurately control the scrambling clock with performance loss overhead by a digital circuit design method.

To achieve the above idea, the present invention provides a scrambled clock generation circuit, comprising: a pseudo-random number generator configured to generate a pseudo-random number from an original clock signal generated by an original clock; a scramble enable generator configured to generate an enable signal from an original clock signal and a pseudo-random number; and a final output clock configured to output the original clock signal as a final clock signal according to the enable signal.

The present invention provides a scrambled clock generation circuit, as shown in fig. 1, including: an original clock 10 configured to generate an original clock signal; a pseudo-random number generator 20 configured to generate pseudo-random numbers from the raw clock signal; a scramble enable generator 30 configured to generate an enable signal from the original clock signal and the pseudo random number; and a final output clock (scramble clock 60) configured to output the original clock signal as a final clock signal upon receiving the enable signal. It should be noted that in some embodiments, the oscillating circuit implementing the original clock 10 may be separate from the scrambled clock generation circuit of the present invention. In this case, the scrambled clock generation circuit of the present invention receives an original clock signal from the outside and generates the scrambled clock 60 therefrom.

Fig. 1 is a circuit for generating a scrambled clock according to the present invention. The original clock 10 is used as a control clock for the pseudo-random number generator 20 to generate a random tap. The pseudo-random number generator 20 may be a conventional PRBS7, PRBS9, PRBS15, PRSB23, PRBS31, or the like, and may be a random number generator of a fixed code pattern or a random number generator of a specific code pattern. The longer the codeword, the better the random performance. In the scrambling clock generating circuit, the original clock signal is generated by a phase-locked loop or a crystal oscillator, and one clock cycle of the original clock signal comprises high-level effective time and low-level effective time, and the proportion of the high-level effective time occupying the whole clock cycle is about 50%.

In one embodiment of the present invention, in the scrambled clock generation circuit, the pseudo random number generator 20 generating the pseudo random number according to the original clock signal includes: the pseudo-random number generator 20 generates a serial pseudo-random binary sequence, with 0's and 1's occurring randomly within the period length of the pseudo-random binary sequence 2^ 31-1.

In an embodiment of the present invention, in the scrambled clock generation circuit, as shown in fig. 2, the pseudo-random number generator 20 is based on a PRBS31 ═ X31+ X28+1 code pattern, the pseudo-random number generator 20 includes 32 delay units, and the delay units include D flip-flops; the output signal of the 1 st delay unit, the output signal of the 29 th delay unit and the output signal of the 32 th delay unit generate a pseudo-random binary sequence through two exclusive-OR gates; the pseudo-random binary sequence is fed back to the input end of the 1 st delay unit to carry out cyclic shift.

A Pseudo-Random Binary Sequence (PRBS) refers to a Pseudo-Random Sequence that contains only 0 and 1. If a sequence is, on the one hand, predeterminable and is produced and reproduced repeatedly; on the one hand, it has the random property (i.e. statistical property) of a random sequence, so called pseudo-random sequence. The pseudo-random signal differs from the random signal in that: random signals are unpredictable, but the values of the random signals at the future time can only be described in a statistical sense; the pseudorandom sequence is not substantially random, but is a deterministic periodic signal known to both the transmitter and the receiver, and is called a pseudorandom sequence because it exhibits the statistical properties of a white noise sample sequence and appears to an audience who does not know its generation method as a true random sequence. The theoretical development of the pseudo-random binary sequence is relatively mature. The realization is simple and convenient, and the length of the shift register can be 2 by using n stages of shift registers^n-1The M sequence of (1). In different applications, different requirements are imposed on the period length of the random sequence generated by the linear feedback shift register. With the increase of m, the consumption of logic resources inside the FPGA by the linear feedback shift register is increased linearly, and the longest sequence period of the output of the linear feedback shift register is increased exponentially, which is very beneficial for practical application. When m is 63. The period of the maximum length sequence can reach 9.22337 x 10^18, if the CLK frequency is 50MHz, the repetition period exceeds 5800 years. In most practical applications, such sequence lengths are quite abundant.

In an embodiment of the present invention, in the scrambled clock generation circuit, the scrambling enable generator 30 includes: a counter configured to generate a count value and determine whether the count value is equal to a set value, if so, output a count signal equal to 1, otherwise, output a count signal equal to 0; and an AND gate circuit configured to AND-operate the count signal and the pseudo random number to generate an enable signal, the enable signal being 1 if both the count signal and the pseudo random number are 1, and the enable signal being 0 if not.

In an embodiment of the present invention, in the scrambling clock generating circuit, the scrambling enable generator 30 includes a first scrambling circuit 302, and the first scrambling circuit 302 includes: a modulo-two counter 320 configured to make one transition when encountering a rising edge of the original clock signal to output a first sequence signal appearing in an alternating cycle of 0 and 1, where the count signal is 1 when the first sequence signal is equal to 1, and otherwise the count signal is 0; a first and gate 322 configured to and the count signal generated by the modulo-two counter with the pseudo random number.

In an embodiment of the present invention, in the scrambling clock generating circuit, the scrambling enable generator 30 further includes a second scrambling circuit 303, and the second scrambling circuit includes: a modulo four counter 330 configured to make one transition when encountering a rising edge of the original clock signal to output a second sequence of signals alternately occurring in cycles of 0, 1, 2, and 3; a judging circuit 331 configured to make the count signal 1 when detecting that the second sequence signal is equal to 3, and to make the count signal 0 otherwise; and a second and gate 332 configured to and the count signal generated by the judgment circuit with the pseudo random number.

The scramble enable generator 30 is a counter-based low hardware overhead circuit. For example, the scramble enable generator may be a 2-bit counter, counting at 0- >1- >2- >3- >0- >1- >2- >3- >1 … cycles. When the counter jumps to 3, the output tap of the pseudo-random generator may now be enabled as the clock gating cell 50. Theoretically, the output tap of the pseudo random number generator 20 is a random 0 or 1, but the probability of 0 or 1 occurring is 50%. And the 2-bit counter jumps to 3 to select the output tap, so the probability of occurrence of high-level pulse enable is 1/4 × 50% — 12.5%. The high level pulse enables are inverted, which corresponds to the gating of the original clock 10 controlled with an enable probability of 87.5%, resulting in the scrambled clock 60; the performance of the scrambled clock 60 is about 87.5% of the original clock 10, i.e., a performance overhead of 12.5%. If a 1-bit counter is used, the performance of the resulting scrambled clock is approximately 75% of the original clock, i.e., a performance overhead of 25%. The performance overhead of the scrambling clock can be controlled by employing different counters. Software may generate a variety of different scrambling clocks through the mode control terminal.

In an embodiment of the present invention, in the scrambled clock generation circuit, the scrambled clock generation circuit further includes: an inverter 305 configured to invert the enable signal; the high-level effective time of the output of the first AND gate accounts for 25% of the whole clock period, and the high-level effective time of the output of the second AND gate accounts for 12.5% of the whole clock period.

In an embodiment of the present invention, in the scrambled clock generation circuit, the scrambled clock generation circuit further includes: a mode selector 304 configured to select the enable signal output by the first and gate to be provided to the inverter 305, or select the enable signal output by the second and gate to be provided to the inverter 305. The scramble enable generator 30 may include only the first scramble circuit 302, or only the second scramble circuit 303, or both the first scramble circuit 302 and the second scramble circuit 303 and select one of them to function according to the mode selector 304.

In one embodiment of the present invention, as shown in fig. 3, in the scrambled clock generation circuit, an original clock 10 is connected to the asynchronous bus bridge 200, the system bus 300, the CPU, the DMA, and the on-chip memory to provide the original clock signal to the asynchronous bus bridge 200, the system bus 300, the CPU, the DMA, and the on-chip memory; the final output clock (scrambled clock 60) is connected with the asynchronous bus bridge 200 and the security subsystem 100 to provide a final clock signal to the asynchronous bus bridge 200 and the security subsystem 100; the security subsystem 100 includes an encryption/decryption module, which communicates with a system bus 300 via an asynchronous bus bridge 200; the security subsystem 100 works in a scrambling clock domain according to a final clock signal so as to improve the capability of resisting energy attack; the system bus 300, the CPU, the DMA and the on-chip memory work in an unscrambled clock domain according to an original clock signal; the asynchronous bus bridge 200 communicates data according to an unscrambled clock domain and a scrambled clock domain.

In the scrambled clock generation circuit provided by the invention, the pseudo-random number generator 20 generates pseudo-random numbers according to an original clock signal, the scrambled enable generator 30 generates enable signals according to the original clock signal AND the pseudo-random numbers, AND finally outputs the original clock signal as a final clock signal according to the enable signals (for example, at the high-level moment of the enable signals, or vice versa, the operation can be realized by performing AND operation (AND) on the enable signals AND the original clock signal), the pseudo-random number generator 20 AND the scrambled enable generator 30 are both realized by digital circuits, the whole circuit is realized by the digital circuits, the circuit overhead is small, AND the performance overhead (such as 12.5%, 25% or other values) brought by the clocks can be accurately controlled.

RAW _ CLK is the RAW clock generated by a phase locked loop or a crystal oscillator, and is generally a desirable clock signal. Each original clock cycle comprises a high level active time and a low level active time, and the high level active time occupies the proportion of the whole clock cycle and is called a duty ratio. The duty cycle of fig. 4 is close to 50%.

As shown in fig. 5, Swallow _ CLK is the final output clock processed by the clock scrambling circuit. It can be seen that the high level pulses are randomly discarded: the timing of discarding is random and the format of the pulses discarded in succession is random, but the total proportion discarded is controllable.

Fig. 2 is an example of a pseudo-random number generator, and is a pseudo-random number generator based on the PRBS31 ═ X31+ X28+1 code pattern. PRBS, i.e., Pseudo-Random Binary Sequence, is a Pseudo-Random Binary Sequence. In the code stream, 0 and 1 occur randomly within the period length of 2^ 31-1.

The pseudo-random number generator 20 comprises 32 delay units of X0, X1, … X30 and X31; for example, 211X15 is the 16 th delay cell. In the present invention, the delay unit is a simple D flip-flop to implement a delay of one cycle of RAW _ CLK. 212 is the output tap of the first delay cell X0; 213 is the output tap of delay element X28; 214 is the output tap of delay unit X31; 212. 213, 214, through two exclusive or

gates

215 and 216, 217 is generated, so 217 is the output of the pattern generator PRBS31 ═ X31+ X28+ 1. 217 are fed back to the input of X0 to effect the cyclic shift. The probability of 0 and 1 occurring at 217 is 50%.

As shown in fig. 2 and 6, the first scrambling circuit 302 is implemented based on a modulo two counter 320. 320 is a modulo two counter operating on RAW CLK. 324 is actually a 0- >1- >0- >1- >0- >1- > … sequence that transitions based on the rising edge of the RAW CLK clock, AND is logically anded with AND

gates

322, 324 AND 217, resulting in 325 enable control model. Probabilistically, the time for the high level to appear on the 325 signal accounts for 25% of the total time.

As shown in fig. 2 and 7, the second scrambling circuit 303 is implemented based on a modulo four counter 330. 330 is a modulo four counter operating on RAW CLK. 333 is actually a 0- >1- >2- >3- >0- >1- >2- > 3-3 … cyclic sequence that transitions based on the rising edge of the RAW _ CLK clock. 331 is a judgment circuit, and only 333 is "3", 334 outputs "1", otherwise "0" is outputted. The proportion of time that the high level appears at 334 is 25%. The logic AND operation is performed through AND

gates

332, 334 AND 217, resulting in 335 an enable control model. Since the probability of 0 and 1 occurring at 217 is 50% at any one time, 335 randomly removes the high pulse at 334 with a probability of 50%, as shown in fig. 7, the second pulse at 334 is swallowed. Thus, the proportion of time that the high level appears at 335 is 12.5%.

304 is an alternative selection circuit. When the mode control terminal is 1, 325 is selected, otherwise 335 is selected. By 305 we negate the output of 304. Thus, when the mode control terminal is 1, the proportion of time on the high level at 306 is 75%; otherwise, the high time ratio is 87.5%. 50 is a clock gating cell. The final scrambled clock can be generated by controlling 306 the original RAW CLK.

In summary, the above embodiments have described the different configurations of the scrambled clock generation circuit in detail, and it is needless to say that the present invention includes, but is not limited to, the configurations listed in the above embodiments, and any configuration that is changed based on the configurations provided in the above embodiments is within the scope of protection of the present invention. One skilled in the art can take the contents of the above embodiments to take a counter-measure.

The embodiments in the present description are described in a progressive manner, each embodiment focuses on differences from other embodiments, and the same and similar parts among the embodiments are referred to each other. For the system disclosed by the embodiment, the description is relatively simple because the system corresponds to the method disclosed by the embodiment, and the relevant points can be referred to the method part for description.

The above description is only for the purpose of describing the preferred embodiments of the present invention, and is not intended to limit the scope of the present invention, and any variations and modifications made by those skilled in the art based on the above disclosure are within the scope of the appended claims.

Claims

1. A scrambled clock generation circuit, comprising:

2. The scrambled clock generation circuit of claim 1, wherein the pseudo-random number generator generating the pseudo-random number from the raw clock signal comprises:

3. The scrambled clock generation circuit of claim 2, wherein the pseudo-random number generator is based on a PRBS31 ═ X31+ X28+1 pattern, the pseudo-random number generator comprising 32 delay cells, the delay cells comprising D flip-flops;

4. A scrambled clock generation circuit according to claim 1, wherein the original clock signal is generated by a phase locked loop or a crystal oscillator, the original clock signal having an active high time and an active low time in one clock cycle, the active high time occupying 50% of the total clock cycle.

5. The scramble clock generation circuit of claim 1, wherein the scramble enable generator comprises:

6. The scramble clock generation circuit of claim 5, wherein the scramble enable generator comprises a first scramble circuit, the first scramble circuit comprising:

7. The scramble clock generation circuit of claim 6, wherein the scramble enable generator further comprises a second scramble circuit, the second scramble circuit comprising:

8. The scrambled clock generation circuit of claim 7, further comprising:

an inverter configured to invert the enable signal;

9. The scrambled clock generation circuit of claim 8, further comprising:

10. The scrambled clock generation circuit of claim 1, wherein a raw clock is coupled to the asynchronous bus bridge, the system bus, the CPU, the DMA, and the on-chip memory to provide the raw clock signal to the asynchronous bus bridge, the system bus, the CPU, the DMA, and the on-chip memory;