WO2018090596A1 - 一种检测安全芯片工作状态的方法及检测电路 - Google Patents

一种检测安全芯片工作状态的方法及检测电路 Download PDF

Info

Publication number
WO2018090596A1
WO2018090596A1 PCT/CN2017/086212 CN2017086212W WO2018090596A1 WO 2018090596 A1 WO2018090596 A1 WO 2018090596A1 CN 2017086212 W CN2017086212 W CN 2017086212W WO 2018090596 A1 WO2018090596 A1 WO 2018090596A1
Authority
WO
WIPO (PCT)
Prior art keywords
signal
unit
circuit
security chip
delay
Prior art date
Application number
PCT/CN2017/086212
Other languages
English (en)
French (fr)
Inventor
王浩沣
鹿甲寅
马崇良
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Publication of WO2018090596A1 publication Critical patent/WO2018090596A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/70—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer
    • G06F21/71—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure computing or processing of information
    • G06F21/72—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure computing or processing of information in cryptographic circuits
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/57—Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F1/00—Details not covered by groups G06F3/00 - G06F13/00 and G06F21/00
    • G06F1/04—Generating or distributing clock signals or signals derived directly therefrom
    • G06F1/06—Clock generators producing several clock signals
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F11/00—Error detection; Error correction; Monitoring
    • G06F11/30—Monitoring
    • G06F11/3003—Monitoring arrangements specially adapted to the computing system or computing system component being monitored
    • G06F11/3024—Monitoring arrangements specially adapted to the computing system or computing system component being monitored where the computing system component is a central processing unit [CPU]
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F11/00—Error detection; Error correction; Monitoring
    • G06F11/30—Monitoring
    • G06F11/3058—Monitoring arrangements for monitoring environmental properties or parameters of the computing system or of the computing system component, e.g. monitoring of power, currents, temperature, humidity, position, vibrations
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F11/00—Error detection; Error correction; Monitoring
    • G06F11/30—Monitoring
    • G06F11/34—Recording or statistical evaluation of computer activity, e.g. of down time, of input/output operation ; Recording or statistical evaluation of user activity, e.g. usability assessment
    • G06F11/3466—Performance evaluation by tracing or monitoring
    • G06F11/348—Circuit details, i.e. tracer hardware
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F11/00—Error detection; Error correction; Monitoring
    • G06F11/30—Monitoring
    • G06F11/34—Recording or statistical evaluation of computer activity, e.g. of down time, of input/output operation ; Recording or statistical evaluation of user activity, e.g. usability assessment
    • G06F11/3466—Performance evaluation by tracing or monitoring
    • G06F11/3495—Performance evaluation by tracing or monitoring for systems
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/70—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer
    • G06F21/71—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure computing or processing of information
    • G06F21/75—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure computing or processing of information by inhibiting the analysis of circuitry or operation
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/03—Indexing scheme relating to G06F21/50, monitoring users, programs or devices to maintain the integrity of platforms
    • G06F2221/034—Test or assess a computer or a system

Definitions

  • Embodiments of the present invention relate to the field of information security technologies, and in particular, to a method, a detection circuit, and a security chip for detecting an operating state of a security chip.
  • the security chip performs high-reliability encryption on the data stored in the security chip, making it difficult to be illegally stolen.
  • the operating environment for example, the electrical environment
  • Circuitry within the chip eg, CPU circuit, encryption and decryption circuit, random number generation circuit, etc.
  • the circuit operation within the security chip may be abnormal, which may result in data leakage stored by the security chip.
  • various sensors are integrated in the security chip to monitor various environmental components (such as voltage, temperature, light, and clock information) of the working environment in which the security chip operates, and then pass various environmental components.
  • the signal processing module performs analysis to determine whether the working environment of the security chip is reasonable, and if not, alarms.
  • the monitoring of each of the above environmental components is performed independently within the security chip.
  • a voltage sensor is used to monitor voltage
  • a temperature sensor is used to monitor temperature
  • a light sensor is used to monitor incident light.
  • Frequency sensors are used to monitor clock information.
  • Each type of sensor is independent of each other. All types of sensors are based on analog circuits.
  • the area of the analog circuit is generally not significantly reduced as the process evolves. Therefore, the larger the area of the analog circuit, the easier the analog circuit is to be identified in the security chip layout, and there is a higher risk of being attacked.
  • Embodiments of the present invention provide a method and a detection circuit for detecting an operating state of a security chip, which are used to solve the problem that the larger the area of the analog circuit in the prior art is, the analog circuit is more easily recognized in the security chip layout, and the present invention has a higher The risk of being attacked.
  • an embodiment of the present invention provides a circuit for detecting an operating state of a security chip, including: a first registration unit, a trigger unit and a delay unit connected to the first registration unit, and a routing unit connected to the delay unit, and selecting a second register unit connected to the path unit, the second register unit is connected to the trigger unit; wherein the first register unit is configured to acquire the first signal according to the trigger signal input to the first register unit when the clock signal is valid, and The first signal is output to the delay unit and the second logic gate unit; the delay unit is configured to delay the first signal by different time periods to generate a plurality of delay signals, and generate multiple numbers according to the plurality of delay signals when the clock signal is valid a second signal; a routing unit for selecting a second signal from the plurality of second signals and The selected second signal is output to the second register unit; the second register unit is configured to generate a third signal according to the received second signal when the clock signal is valid, and output the third signal to the trigger unit; triggering And a unit, configured
  • An embodiment of the present invention provides a circuit for detecting an operating state of a security chip, including: a first registration unit, a trigger unit and a delay unit connected to the first registration unit, a routing unit connected to the delay unit, and a routing unit a second register unit, the second register unit is connected to the trigger unit; the embodiment of the invention delays the first signal to obtain a plurality of delay signals, and generates a plurality of second signals according to the plurality of delay signals, by using a plurality of second signals Selecting a second signal in the signal, outputting the selected second signal to the second register unit to obtain a third signal, and performing a logic operation on the third signal and the first signal to obtain a level signal, and Determining whether to output an alarm signal according to the level signal, since each unit in the embodiment of the present invention can be implemented by a digital circuit, the size of the circuit can be reduced, thereby making the circuit difficult to be in the layout of the security chip. Identification, improve the reliability of the security chip, so it can be determined by judging the delay
  • the routing unit is specifically configured to: receive a selection for indicating a second signal selected from the second signals generated by each third registration unit And a signal for indicating a second signal selected from the second signals generated by each of the third registration units according to the selection signal.
  • the performance boundary of the circuit is determined by the delay of the first signal. Therefore, the difference in delay of the first signal may cause the circuit to have different performance boundaries, so that the detection security chip in different working states may be made at different performance boundaries.
  • the working state circuit can detect in time whether the working state is a normal working state of the security chip.
  • the triggering unit is specifically configured to: output an alarm when the level signal is a high level signal signal.
  • the delay unit includes at least one third registration unit, and a delay link connected to each of the at least one third register unit; wherein the delay link is for delaying the first signal for different time periods to generate a plurality of delay signals and transmitting the plurality of delay signals Up to a different third register unit; each third register unit for receiving a delay signal, and generating a second signal according to the delayed signal transmitted to the third register unit when the clock signal is active.
  • the circuit further includes an inverting unit and an inverting unit.
  • the output terminal is connected to the input end of the first register unit, the input end of the inverting unit is connected to the output end of the first register unit, and the inverting unit is configured to invert the first signal outputted from the output end of the first register unit, and then input To the input of the first register unit. Therefore, it is ensured that the signals of the input end and the output end of the first register unit are in the opposite state; when the clock signal is at the rising edge, the first register unit moves the value of the input end to the output end, thereby implementing one flip of the output end signal.
  • the delay link includes a plurality of delay elements, each Delay The late element is configured to delay the signal input to the delay element by a preset period such that the first signal passes through a different number of delay elements to generate a delayed signal of a different time period.
  • the first register unit, the second register unit, and the first The three register units all use D flip-flops; the routing unit uses a MUX multiplexer.
  • the logic gate unit adopts an exclusive OR gate circuit.
  • the circuit further includes: a fourth register unit, a fifth a register unit and a first logic gate unit; wherein the fourth register unit is connected to the second register unit, the fifth register unit, and the first logic gate unit; wherein the fourth register unit is configured to receive the third output of the second register unit a signal, and generating a fourth signal when the clock signal is active, and outputting the fourth signal to the fifth register unit and the first logic gate unit; and a fifth register unit for receiving the fourth signal output by the fourth register unit, and When the clock signal is valid, generating a fifth signal according to the fourth signal, and outputting the fifth signal to the first logic gate unit; the first logic gate unit is configured to generate a trigger signal according to the fourth signal and the fifth signal, the trigger signal It is used to indicate that the components inside the circuit are normal, and the circuit can be detected in time by setting the fourth register unit, the fifth register unit and the first logic gate unit;
  • the triggering unit includes the second logic gate unit and the alarm unit
  • the second logic gate unit is connected to the first registration unit
  • the alarm unit is connected to the second logic gate unit
  • the second logic gate unit is further connected to the second registration unit; wherein the second logic gate unit is used for The three signals and the first signal perform a logic operation to acquire a level signal, and send a level signal to the alarm unit; and an alarm unit for determining whether to output an alarm signal according to the level signal.
  • an embodiment of the present invention provides a method for detecting an operating state of a security chip, which is applied to a circuit for detecting an operating state of a security chip.
  • the method provided by the embodiment of the present invention includes: when the clock signal is valid, according to the input to the detection security
  • the trigger signal of the circuit of the working state of the chip acquires the first signal; delaying the first signal to obtain a plurality of delayed signals, wherein delays of each of the plurality of delayed signals are different; acquiring according to the plurality of delayed signals a plurality of second signals; selecting a second signal from the plurality of second signals, generating a third signal according to the selected second signal when the clock signal is active; and performing the first signal and the third signal when the clock signal is valid
  • the signal performs a logic operation to acquire a level signal; and determines whether to output an alarm signal according to the level signal.
  • the method provided by the embodiment of the present invention further includes: receiving A selection signal of a second signal is selected from the second signals, and a second signal is selected from the plurality of second signals according to the selection signal.
  • the method further includes: inverting the first signal outputted at the current time to determine the next moment input Trigger signal to the security chip.
  • determining whether to output an alarm signal according to the level signal includes : When the level signal is high level, the alarm signal is output.
  • the method provided by the embodiment of the present invention further includes: When the clock signal is valid, the fifth signal is generated according to the third signal; when the clock signal is valid, the sixth signal is generated according to the fifth signal; and the trigger signal for indicating that the component of the circuit is normal is generated according to the fifth signal and the sixth signal.
  • an embodiment of the present invention provides a protection circuit for a security chip, where the protection circuit of the security chip is applied to a security chip, where the security chip includes at least one detection circuit, wherein any one of the detection circuits is configured to detect the detection circuit.
  • the environment of the range; the detecting circuit adopts the circuit for detecting the working state of the security chip as described in any one of the first aspect to the seventh possible implementation of the first aspect, and determines whether to issue an alarm signal according to the environmental state;
  • the circuit for detecting the working state of the security chip has the same working condition as the security chip, and the working conditions include at least the clock cycle of the clock signal, the power source, and the temperature.
  • An embodiment of the present invention provides a protection circuit for a security chip.
  • the protection circuit of the security chip is applied to a security chip.
  • the security chip includes at least one detection circuit, and any one of the detection circuits is configured to detect that the detection circuit detects a preset range.
  • the detecting circuit adopts the circuit for detecting the working state of the security chip described in any one of the first aspect to the seventh possible implementation of the first aspect, the detecting The circuit of the working state of the security chip can automatically complete the detection that the working state of the security chip is in a safe state according to the working state of the security chip, and the components in the circuit for detecting the working state of the security chip adopt digital The circuit, therefore, is not affected by aging and changes in the operating state; at the same time, since the digital circuit can be made small enough in the circuit for detecting the working state of the security chip, the number of circuits for detecting the working state of the security chip in the security chip is set.
  • the at least one circuit for detecting the working state of the security chip in the security chip can generate an alarm in time when the security chip is subjected to a change in the local working condition.
  • the security chip provided by the embodiment of the present invention changes in the entire working environment where the security chip is located. It can also be alerted in time.
  • the two or more detection circuits are located at different positions.
  • the circuit for detecting the working state of the security chip has its detected range, when any part of the working state of the security chip changes Time (for example, a certain part of the security chip is attacked, so that the local voltage changes, but the voltage of other positions of the security chip does not change), and the security chip located in the layout can detect the change of the working state in time.
  • the alarm unit issues an alarm signal in time.
  • the embodiment of the present invention provides a security chip detection method, which is applied to a security chip according to the third aspect of the present invention or the first possible implementation manner of the third aspect, where the method includes: Determining, according to the input selection signal, a target third registration unit selected by each detection circuit; the selection signal is used to instruct the routing unit to select the target third registration unit from the at least one third registration unit; After the chip is started, if any one of the detection circuits has an alarm signal, it indicates that the security chip is currently working under unsafe working conditions.
  • the method provided by the embodiment of the present invention further includes: acquiring at least one detection circuit The working state of each detecting circuit at the current time; according to the relationship between the working state of the current time of each detecting circuit and the performance boundary of the detecting circuit, each detecting circuit determines whether to issue an alarm signal.
  • each detecting circuit determines whether to issue an alarm signal, including: when at least one detecting circuit has a working state in which the current detecting current of the first detecting circuit is outside the performance boundary of the first detecting circuit, then A detecting circuit sends an alarm signal, and the first detecting circuit is any one of the at least one detecting circuit.
  • each detecting circuit determining whether to issue an alarm signal, further comprising: when at least one detecting circuit exists, a working state of the first detecting circuit is located at the first detecting circuit Within the performance boundary, the first detection circuit does not issue an alarm signal, and the first detection circuit is any one of the at least one detection circuit.
  • any one of the detection circuits is present in the at least one detection circuit After the alarm signal is sent, the method provided by the embodiment of the present invention further includes: resetting the security chip by using a preset protection measure to restore the security chip to an initial state.
  • FIG. 1 is a schematic diagram of detection in a security chip provided in the prior art
  • FIG. 2a is a schematic structural diagram 1 of a circuit for detecting an operating state of a security chip according to an embodiment of the present invention
  • FIG. 2b is a schematic structural diagram 2 of a circuit for detecting an operating state of a security chip according to an embodiment of the present invention
  • FIG. 3 is a schematic structural diagram 3 of a circuit for detecting an operating state of a security chip according to an embodiment of the present invention
  • FIG. 4 is a schematic structural diagram 4 of a circuit for detecting an operating state of a security chip according to an embodiment of the present invention
  • FIG. 5 is a schematic structural diagram 5 of a circuit for detecting an operating state of a security chip according to an embodiment of the present disclosure
  • FIG. 6 is a schematic structural diagram 6 of a circuit for detecting an operating state of a security chip according to an embodiment of the present invention
  • FIG. 7 is a timing diagram of a level signal output by a second logic gate unit when a frequency of a clock signal changes according to an embodiment of the present invention
  • FIG. 8 is a timing diagram of a level signal output by a second logic gate unit when a voltage/temperature changes according to an embodiment of the present invention
  • FIG. 9 is a schematic flowchart diagram of a method for detecting an operating state of a security chip according to an embodiment of the present invention.
  • FIG. 10 is a schematic diagram of an example of use of a detection circuit according to an embodiment of the present invention.
  • FIG. 11 is a schematic diagram of a method for detecting a security chip according to an embodiment of the present invention.
  • first”, “second”, “third” and the like defined before the electronic component in the embodiment of the present invention are used to distinguish a plurality of similar electronic components, and are not limited words, for example, “the first”.
  • a third register unit "only refers to one of the third register units, and does not represent the first third register unit.”
  • an embodiment of the present invention provides a circuit for detecting an operating state of a security chip, including: a first registration unit 101, a trigger unit 105 and a delay unit 102 connected to the first registration unit 101, and connected to the delay unit 102.
  • the routing unit 103, the second registration unit 104 connected to the routing unit 103, and the second registration unit 104 are connected to the trigger unit 105;
  • the first register unit 101 is configured to: when the clock signal is valid, acquire the first signal according to the trigger signal input to the first register unit 101, and output the first signal to the delay unit 102 and the second logic gate unit 104;
  • the delay unit 102 is configured to delay the first signal by different time periods to generate a plurality of delay signals, and generate a plurality of second signals according to the plurality of delay signals when the clock signal is valid;
  • the routing unit 103 is configured to use multiple A second signal is selected from the second signal, and the selected second signal is output to the second register unit 104.
  • the second register unit 104 is configured to generate a third signal according to the received second signal when the clock signal is valid. And outputting the third signal to the trigger unit 105.
  • the trigger unit 105 is configured to perform a logic operation on the third signal and the first signal to acquire a level signal, and determine whether to output an alarm signal according to the level signal.
  • An embodiment of the present invention provides a circuit for detecting an operating state of a security chip, including: a first registration unit, a trigger unit and a delay unit connected to the first registration unit, a routing unit connected to the delay unit, and a routing unit a second register unit, the second register unit is connected to the trigger unit; the embodiment of the invention delays the first signal to obtain a plurality of delay signals, and generates a plurality of second signals according to the plurality of delay signals, by using a plurality of second signals Selecting a second signal in the signal, outputting the selected second signal to the second register unit to obtain a third signal, and performing a logic operation on the third signal and the first signal to obtain a level signal, and Determining whether to output an alarm signal according to the level signal, since each unit in the embodiment of the present invention can be implemented by a digital circuit, the size of the circuit can be reduced, thereby making the circuit difficult to be in the layout of the security chip.
  • each digital circuit is an active device
  • the signal transmission of the active device The operation state of the circuit for detecting the working state of the security chip provided by the embodiment of the present invention is determined to be normal by the influence of the temperature, the voltage, the process, and the like, so that the delay of the transmission of the first signal on the delay link is determined. Working conditions.
  • the delay unit 102 includes at least one third registration unit 1021, and a delay link 1022 connected to each of the at least one third registration unit 1021;
  • the delay link 1022 is configured to delay the first signal by different time periods to generate a plurality of delay signals, and transmit the plurality of delay signals to different third register units;
  • Each of the third registering units is configured to receive the delayed signal, and generate a second signal according to the delayed signal transmitted to the third registering unit when the clock signal is valid.
  • the trigger unit 105 includes a second logic gate unit 1051 and an alarm unit 1052, wherein the second logic gate unit 1051 is connected to the first registration unit 101, and the alarm unit 1052 and the second logic gate unit 1051 is connected, and the second logic gate unit 1051 is further connected to the second registration unit 104;
  • the second logic gate unit 1051 is configured to perform a logic operation on the third signal and the first signal to acquire a level signal, and send the level signal to the alarm unit 1052.
  • the alarm unit 1052 is configured to be used according to the level. The signal determines if an alarm signal is output.
  • the first signal is transmitted to each third registration unit through the delay link, so that each third registration The unit generates a second signal according to the received first signal when the clock signal is valid, and then the routing unit selects a second signal from the second signal generated by each third register unit, and selects the second signal The signal is output to the second register unit. Since the delay signal of the plurality of different time periods generated after the first signal passes through the delay link, the delay of the delay signal input to each third register unit is also different.
  • the second signal finally generated by the three registering units has different delays, so that the delay of the signal input to the second registering unit can be changed by the routing unit, thus changing the performance boundary of the circuit for detecting the operating state of the security chip.
  • Delay signals at different time periods result in different performance boundaries for circuits that detect the operational state of the security chip.
  • the embodiment of the present invention may be specifically implemented by the routing unit.
  • the routing unit 103 is configured to use the at least one third registration unit according to the selection signal.
  • the target third register unit is selected to change the performance boundary of the circuit that detects the operational state of the security chip.
  • the alarm unit 1052 provided by the embodiment of the present invention is specifically configured to: when the level signal is a high level signal, output an alarm signal.
  • the circuit provided by the embodiment of the present invention further includes an inverting unit 107.
  • the output end of the inverting unit 107 is connected to the input end of the first register unit, and the inverting unit 107 is The input terminal is connected to the output end of the first register unit, and the inverting unit 107 is configured to invert the first signal outputted from the output end of the first register unit and then input to the input end of the first register unit. This ensures that the state between the signal input by the first register unit and the first signal of the output is in the opposite state.
  • the inverting unit in the embodiment of the present invention may be implemented by using an inverter.
  • the input end of the inverter is connected to the output end of the first register unit, and the output end of the inverter is connected to the input end of the first register unit.
  • the delay link includes a plurality of delay elements, each delay element is configured to delay a signal input to the delay element by a preset period, so that the first signal passes through different ones.
  • the delay elements of the number are generated to generate delayed signals for different time periods.
  • each third register unit can collect the delay signal transmitted through the delay link, in the embodiment of the present invention, when there is one delay element between each adjacent two third register units, the present invention is implemented.
  • the number of delay elements in the example is equal to the number of third registration units.
  • the number of delay elements is one.
  • the number of delay elements in the embodiment of the present invention may be based on the number of delay elements existing between each adjacent two third registration units and a third registration unit that is the shortest from the first registration unit (distance from the first registration unit)
  • the shortest third register unit can be understood as the shortest delay time in receiving the delayed signal.
  • the third register unit such as the third register unit 10211 in FIG. 4) is determined by the number of delay elements between the first register unit.
  • the delay element in the embodiment of the present invention is used to delay the first signal passing through the preset period.
  • the specific structure of the delay element is not limited in the embodiment of the present invention, as long as the delay element can delay the first signal passing through it. It is sufficient to set the period.
  • the delay element in the embodiment of the present invention may employ a buffer (BUFFER).
  • the time period in the embodiment of the present invention refers to the time when the first signal output by the first registration unit is transmitted to the input end of each third registration unit via the delay link.
  • the time period 1 may indicate the time when the first signal output by the first registration unit is transmitted to the first third registration unit 10211 via the delay link 1022
  • the time period 2 may represent the first registration unit.
  • the time period during which the outputted first signal is transmitted to the second third register unit 10212 via the delay link, for example, if the first signal output by the first registration unit 101 passes through 5 delay elements on the delay link (Fig.
  • the number of delay elements in the actual circuit needs to be transmitted to the first third registration unit 10211 according to the performance boundary of the circuit for detecting the working state of the security chip, then the time period 1 can indicate that the first signal is delayed by 5
  • the preset period is transmitted to the third register unit 10211. If the first signal output by the first register unit is transmitted to the third register unit 10212 via 10 delay elements on the delay link, the time period 2 may indicate that the first signal is delayed. Ten preset cycles are transmitted to the third register unit 10212. Similarly, there are five delay elements between the third register unit 10211 and the third register unit 10212.
  • the number of the delay elements included in each time period is not limited, and the period in which the first signal is delayed may be selected and set according to actual needs.
  • Each delay element is configured to delay the first signal by a predetermined period.
  • the number of delay elements between each two adjacent third registration units 1021 may be the same or different, and this embodiment of the present invention Not limited.
  • the first register unit, the second register unit, and the third register unit all adopt a D flip-flop.
  • the output end of the D flip-flop is the Q end
  • the input end is the D end
  • the trigger end R is used to receive the clock signal.
  • the routing unit in the embodiment of the present invention is specifically configured to determine the target third registration unit from the at least one third registration unit. Therefore, any routing unit capable of implementing the foregoing functions may be provided as an embodiment of the present invention.
  • the routing unit exemplarily, the routing unit in the embodiment of the present invention uses a MUX multiplexer.
  • the first register unit, the second register unit, and the third register unit use the same clock signal and have the same voltage and temperature.
  • any one of the register units in the embodiment of the present invention may be composed of one register unit, or may be composed of two or more register units to satisfy the actually required register unit, which is arbitrary in the embodiment of the present invention.
  • a logic gate unit may be composed of one logic gate unit or may be composed of two or more register units to satisfy a practically required logic gate unit.
  • Any one of the MUX multiplexers in the embodiment of the present invention may be a MUX.
  • the multiplexer is configured by the two or more MUX multiplexers to meet the actual needs of the MUX multiplexer, and may be set according to actual use requirements, which is not limited in the embodiment of the present invention.
  • the second logic gate unit and the first logic gate unit adopt an exclusive OR gate circuit.
  • the third signal and the first signal have two states of high level or low level, if the alarm is set
  • the high level signal (1) that receives the output of the second logic gate unit is alarmed when it is not alarmed, it is defined as "the low level signal (0) that receives the output of the second logic gate unit is not Alarms
  • the circuit for detecting the working state of the security chip has the following alarm states, as shown in Table 1-1.
  • the circuit provided by the embodiment of the present invention further includes:
  • a fourth register unit 108 configured to receive the third signal output by the second registration unit 104, and generate a fourth signal when the clock signal is valid And outputting the fourth signal to the fifth register unit 109 and the first logic gate unit 110;
  • the fifth register unit 109 is configured to receive the fourth signal output by the fourth register unit 108, and generate a fifth signal according to the fourth signal when the clock signal is valid, and output the fifth signal to the first logic gate unit 110;
  • the first logic gate unit 110 is configured to generate a trigger signal according to the fourth signal and the fifth signal, where the trigger signal is used to indicate that the circuit inside the circuit is normal.
  • FIG. 6 shows a specific circuit of a circuit for detecting an operating state of a security chip according to an embodiment of the present invention, which is hereinafter referred to as an OCM (Operating Condition Monitor), and 1 in FIG.
  • the output signal of the first flip-flop 601 is output from the Q terminal of the first flip-flop 601 to one input terminal of the first exclusive OR gate circuit 605.
  • the first register unit 101 shown in FIG. 2a to FIG. 5 can be implemented by the first flip-flop 601 in FIG. 6, and each third register unit can be implemented by the third flip-flop 6031 in FIG.
  • the routing unit 103 can be implemented by the multiplexer 603 in FIG. 6,
  • the second registration unit 104 can be implemented by the second flip-flop 604 in FIG. 6, and the second logic gate circuit 1051 can pass the first in FIG.
  • the XOR gate circuit 605 is implemented.
  • the fourth register unit 108 can be implemented by the fourth flip-flop 608 in FIG. 6.
  • the fifth register unit 109 can be implemented by the fifth flip-flop 609 and the first logic gate circuit 110 can pass.
  • the second exclusive OR gate circuit 610 is implemented.
  • the fourth flip-flop 608, the fifth flip-flop 609, and the second exclusive OR gate circuit 610 are used to determine whether the device inside the OCM circuit is normal.
  • the change of the working state of the OCM circuit in the embodiment of the present invention may be caused by energy injection by means of laser, electromagnetic induction or the like.
  • the sensor portion of the circuit includes a first flip-flop 601 to a target third flip-flop (such as the third flip-flop 60213 in FIG. 6).
  • the D-end of the first third flip-flop (such as the third flip-flop 60211 in FIG. 6) is reached. End), if the error between the signal delay of the delayed signal input to the third flip-flop 60211 and the clock period of the clock signal is less than the preset error (ie, the signal delay and the clock period of the clock signal are slightly smaller than the clock of the clock signal) Cycle), then the first signal output by the Q terminal of the first flip-flop 601 is in the second third flip-flop (such as the third flip-flop 60212 in FIG. 6) to the M-th third flip-flop (as shown in FIG. 6).
  • the delay of the third flip-flop 6021M increases step by step and is greater than the clock period of the clock signal.
  • delay signals delayed by different time periods may be input into each third trigger, and then each third trigger generates a second signal and passes
  • the multiplexer 603 selects a second signal from the second signal generated by each of the third flip-flops, and transmits the second signal to the D terminal of the second flip-flop 604; then, the second flip-flop 604 is valid at the clock signal At this time, a third signal is generated, and the third signal is output to the first exclusive OR gate circuit 605 through the Q terminal of the second flip-flop 604.
  • the appropriate target third trigger can be selected by the multiplexer 603 to change the boundary of the performance of the target PVTF (Process, Voltage, Temperature, Frequency, Process, Voltage, Temperature, Frequency) monitored by the detection circuit (ie, OCM).
  • the detection circuit ie, OCM.
  • the performance boundary of the circuit ie, OCM.
  • the clock signal in the embodiment of the present invention refers to a high level state in each clock cycle
  • the output signal of each register can be determined according to the inversion of the input signal at the moment when the clock signal is at the rising edge.
  • the embodiment of the present invention only uses the third flip-flop 60213 as an example to illustrate a timing diagram of a level signal output by the first logic unit when the frequency of the OCM circuit changes, since it works for each third register unit.
  • the principle and the process are the same as the third trigger 60213. Therefore, the embodiment of the present invention is described by taking the third trigger 60213 as an example, and does not have any indicative meaning.
  • the circuit for detecting the working state of the security chip caused by the timing change of the third flip-flop 60213 under the frequency change of the clock signal and the temperature/voltage change will be respectively described below with reference to FIG. 7 and FIG. Example.
  • FIG. 7 is a timing diagram showing an alarm of an alarm unit when a frequency of a clock signal changes in an embodiment of the present invention:
  • Dr the transmission delay of the first signal outputted by the Q terminal of the first flip-flop 601 on the delay link 6022 is recorded as Dr, as shown in FIG. 7 and FIG.
  • the symbol in 8 is indicated by the arrow of Dr.
  • each delay element in the delay link 6022, and the inverter 607 are active devices, the signal transmission delay of the active device is affected by the PVT, and therefore, when the PVT is deteriorated
  • the time delay of the transmission of the first signal on the delay link 6022 will become larger, denoted as Dm, as indicated by the arrow labeled Dm in FIG.
  • the first signal outputted by the Q terminal (output terminal) of the first flip-flop 601 is flipped once at each rising edge of the clock signal (Clk_i) (such as Clk_i and the first trigger in FIGS. 7 and 8). Timing diagram of the /Q terminal.
  • the first flip-flop /Q terminal is at a high level before time 1. Therefore, when the clock signal enters time 1, the signal output by the first flip-flop / Q terminal is The high level becomes a low level, as shown in FIG. 7 as the signal outputted from the first flip-flop/Q terminal between time 1 and time 2).
  • the signal outputted by the Q terminal of the first flip-flop 601 passes through the delay link 6022 and is transmitted to the D terminal (input terminal) of the third flip-flop 60213.
  • the D-terminal of the third flip-flop 60213 The signal is transmitted to the Q terminal (output) of the third flip-flop 60213.
  • the signal outputted from the Q terminal of the third flip-flop 60213 at time 1 is at a high level.
  • the signal outputted by the Q terminal of the third flip-flop 60213 is still at a low level, at time 3, the signal outputted by the Q terminal of the third flip-flop 60213 is also a low level, and therefore, the first trigger
  • the delay of the 601 to the third flip-flop 60213 exceeds one clock cycle, and since the third flip-flop 60213 cannot be consistent with the state of the first signal outputted by the Q-end of the first flip-flop 601 in one clock cycle, the input is made to The signal of the D terminal of the second flip-flop 604 is not synchronized with the state of the signal output from the Q terminal of the second flip-flop 604 and the output of the first signal by the Q terminal of the first flip-flop 601 under the trigger of the clock signal. Therefore, at time 4, the first exclusive OR gate circuit 605 outputs a high level signal as shown in FIG.
  • the signal input to the first exclusive OR circuit 605 by the Q terminal of the first flip flop is a low level signal
  • the Q terminal of the second flip flop is input to the first exclusive OR gate circuit 605.
  • the signal in the middle is a low level signal. Therefore, the level signal outputted by the first exclusive OR gate circuit 605 between time 3 and time 4 (one clock cycle) is a low level signal, and the alarm unit 606 does not issue an alarm signal.
  • the Q terminal of the second flip-flop is input to the first exclusive OR.
  • the signal of the gate circuit 605 is a low level signal, so the level signal output by the first exclusive OR gate circuit 605 is high level between time 4 and time 5, and therefore, at time 4, the alarm unit 606 issues an alarm signal.
  • FIG. 8 is an operation diagram when the OCM circuit causes a delay link delay to become large in a voltage drop, a temperature change, or the like.
  • the operating state of the OCM circuit is normal (ie, the temperature and voltage are both within the rated range), and therefore, between the time 0 and the time 1 due to the first trigger
  • the delay of the first signal (high level signal) outputted by the Q terminal of 601 is Dr, and the D terminal of the third flip-flop 60213 should maintain the state consistent with the first signal after the delay D is passed, so at the time Dr Between time 1 + Dr, the signal outputted from the D terminal of the third flip-flop 60213 is a high level signal.
  • the first signal input after the delay link is between time 1 and time 2
  • the signal to the D terminal of the third flip-flop 60213 is still a low level signal.
  • the signal outputted from the Q terminal of the second flip-flop 604 is high at time 1.
  • the level signal is converted to a low level signal.
  • the signal outputted by the Q terminal of the second flip-flop 604 is converted from a low level signal to a high level signal, since the input of the first exclusive OR gate circuit 605 is the signal of the Q terminal of the second flip-flop 604, respectively.
  • the first signal outputted by the Q terminal of the first flip-flop 601 therefore, between time 0 and time 1, as can be seen from FIG.
  • the signal of the Q terminal of the second flip-flop 604 and the signal of the Q terminal of the first flip-flop 601 The states are consistent and are all high level signals. Therefore, the level signal output by the first exclusive OR gate circuit 605 is a low level signal, and the alarm circuit 606 does not issue an alarm signal.
  • the signal of the Q terminal of the second flip-flop 604 and the signal state of the Q terminal of the first flip-flop 601 are both low-level signals, and therefore, the first exclusive OR gate circuit 605 outputs The level signal is a low level signal, and the alarm circuit 606 does not issue an alarm signal.
  • the alarm unit 606 does not issue an alarm signal between time 0 and time 2.
  • the transmission delay of the first signal on the delay link is increased due to the operating state (eg, voltage drop or temperature degradation) of the OCM circuit, such as Dm in FIG. 8, such that the first flip-flop 601
  • the delay of the first signal outputted by the Q terminal through the delay link to the D terminal of the third flip-flop 60213 becomes larger (it can be known from FIG. 8 that the delay is 1-Dr+Dm), since Dm is larger than Dr, therefore
  • the delay of the first signal outputted by the Q terminal of a flip-flop 601 through the delay link to the D terminal of the third flip-flop 60213 exceeds one clock cycle.
  • the third flip-flop 60213 cannot maintain the state of the first signal outputted by the first flip-flop 601 in one clock cycle, as can be seen from FIG. 8, at time 3, due to the first flip-flop
  • the state of the first signal outputted by the Q terminal of 601 is a high level signal, and since the OCM circuit delay becomes large, the state of the signal outputted by the D terminal of the third flip-flop 60213 at time 3 is a low level signal, at the moment
  • the signal outputted by the Q terminal of the third flip-flop 60213 is also a low-level signal, so that the signal outputted from the Q terminal of the second flip-flop 604 at time 3 is converted from a high level to a low level.
  • the signal outputted by the Q terminal of the first flip-flop 601 is a low level signal
  • the signal outputted by the Q terminal of the second flip-flop 604 is a low level signal, and therefore, at the moment Between 3 and 4, the first XOR gate circuit 605 outputs a low level signal, and the alarm circuit 606 does not issue an alarm signal.
  • the first signal outputted by the Q terminal of the first flip-flop 601 is a high level signal
  • the signal outputted by the Q terminal of the second flip-flop 604 is a low level signal, therefore, the first The level signal output by the XOR gate circuit is a high level signal, and the alarm unit 606 issues an alarm signal.
  • the embodiment of the present invention provides a method for detecting the working state of a security chip, which is applied to the above-mentioned circuit for detecting the working state of the security chip. As shown in FIG. 9, the method provided by the embodiment of the present invention includes:
  • S906. Determine, according to the level signal, whether to output an alarm signal.
  • step S904 the method provided by the embodiment of the present invention further includes: before step S904:
  • the selection signal carries the identifier of each third registration unit, or in actual use, the selection unit includes multiple paths, and each path is connected to a third registration unit. Of course, the selection signal can be carried in this time. The identification of the path to which the target third registration unit is connected.
  • the method further includes:
  • step S906 can be specifically implemented by:
  • the method further includes:
  • an embodiment of the present invention provides a protection circuit for a security chip.
  • the protection circuit of the security chip is applied to a security chip.
  • the security chip includes at least one detection circuit protection circuit, wherein any one detection circuit is used for detecting The environmental state in the preset range; wherein the preset range can be determined according to the detection capability of each detection circuit, and whether an alarm signal is issued according to the environmental state; the detection circuit is as shown in FIG. 2a, FIG. 2b to FIG.
  • the circuit for detecting the working state of the security chip has the same environmental state as the security chip, and the environmental state includes at least a clock cycle of the clock signal, a power source, a temperature, and a laser.
  • the number of the security chip including at least one detecting circuit is not limited.
  • the detecting circuit may be used to detect the working state of the entire security chip. Whether it is a normal working condition, it is also possible to detect whether the working state of any one of the working states in which the security chip is located (also referred to as a local) is a normal working condition, and when any one of the detecting circuits issues an alarm signal, the security is indicated.
  • the working state of the chip is abnormal working conditions.
  • the circuit for detecting the working state of the security chip is applied as a digital circuit to the security circuit.
  • the same working clock signal, power network, temperature and other working conditions are shared with other working circuits in the security chip (for example, CPU circuit, encryption and decryption engine circuit, random number generation circuit, etc.).
  • the input of each flip-flop in any one of the detecting circuits is a clock signal system working clock in which the security chip is in an operating state
  • the monitoring object of any one of the detecting circuits includes: a clock signal of the security chip, a system clock frequency, an operating voltage, and a working Temperature, and whether there is energy injection such as laser.
  • the level signal output by the second logic gate unit of the detecting circuit is a high level signal, and therefore, the alarm unit issues an alarm. signal.
  • each source device in the detecting circuit adopts a digital circuit, so that the size of the detecting circuit can be reduced, so that two or more detecting circuits can be arranged in the security chip, so that when the working state of the security chip is only Local changes (such as laser, electromagnetic local ion voltage change caused by electromagnetic injection), but this change does not cause changes in the entire working state of the security chip (for example, a part of the security chip is attacked to cause voltage rise) However, the voltage does not affect the entire security chip, or the sensor in the security chip is not detected. Not only can the alarm signal be sent through the detection circuit located in the local range to detect the local working state abnormality.
  • Local changes such as laser, electromagnetic local ion voltage change caused by electromagnetic injection
  • the embodiment of the present invention can generate an alarm signal when an abnormality occurs in the working state of the security chip by integrating a plurality of detecting circuits in the security chip.
  • the embodiment of the present invention provides a method for detecting a security chip protection circuit, which is applied to the protection circuit of the security chip shown in FIG. 10, and the method provided by the embodiment of the present invention includes:
  • S1101 Set a target third registration unit selected by each detection circuit according to the input selection signal; the selection signal is used to instruct the routing unit to select the target third registration unit from the at least one third registration unit.
  • the method provided by the embodiment of the present invention further includes:
  • S1103 Acquire an operating state of a current time of each detection circuit in at least one detection circuit.
  • Each detecting circuit determines whether to issue an alarm signal according to a relationship between an operating state at which the current time of each detecting circuit is located and a performance boundary of the detecting circuit.
  • step S1104 in the embodiment of the present invention may be implemented by the following steps:
  • the first detecting circuit when the working state of the current detecting time of the first detecting circuit in the at least one detecting circuit is outside the performance boundary of the first detecting circuit, the first detecting circuit sends an alarm signal, and the first detecting circuit is the at least Any one of the detection circuits.
  • the first detecting circuit in the at least one detecting circuit When the working state of the first detecting circuit in the at least one detecting circuit is located within the performance boundary of the first detecting circuit, the first detecting circuit does not issue an alarm signal, and the first detecting circuit is at least one detecting circuit. Any one of the detection circuits.
  • each detection circuit has multiple performance boundaries, and the performance boundary may be specifically determined by a delay signal input by the target third registration unit selected by the routing unit in each detection circuit.
  • each security chip can also have a performance boundary, wherein the performance boundary of the security chip can be specifically determined by referring to the rated voltage, the rated temperature, and the like of each security chip.
  • the horizontal axis represents the PVT (process, voltage, temperature) plane
  • the vertical axis represents the clock frequency of the security chip
  • any point in the coordinate system indicates the operating frequency of the security chip during operation and PVT conditions.
  • curve 1201 represents the performance boundary of the security chip
  • curve 1202 represents the performance boundary of any circuit that detects the operational state of the security chip.
  • the working state of the security chip when it is within the performance boundary of the circuit for detecting the working state of the security chip, that is, when it is located at point A as shown in FIG. 11, it indicates that the working condition of the security chip is normal. Then, each of the security chip operating state circuits in the security chip does not issue an alarm signal.
  • the working state of the security chip when the working state of the security chip is outside the curve 1202 and is located in the curve 1201, that is, point B as shown in FIG. 11, although the working state of the security chip is a normal condition, the working state of the security chip is detected.
  • the circuit sends an alarm signal. This is because it is possible that the local working state of the security chip changes, but this change does not affect the overall working state of the security chip. Therefore, as long as the circuit detecting the working state of the security chip detects the location The working state is an abnormal working condition, that is, an alarm signal is issued.
  • the circuit for detecting the working state of the security chip must issue an alarm signal.
  • the method provided by the embodiment of the present invention further includes:
  • S1105 Perform preset protection measures to reset the security chip so that the data stored by the security chip is not leaked.
  • the preset protection measure in the embodiment of the present invention may be a working circuit (including a CPU circuit, an encryption and decryption circuit, and a random number generation circuit) for resetting the entire security chip, so that the security signal is in an initial state.
  • the initial state does not contain any sensitive information, and all data in the bank is erased.
  • embodiments of the present application can be provided as a method, system, or computer program product. Therefore, the embodiments of the present application may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware. Moreover, embodiments of the present application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) including computer usable program code.
  • computer-usable storage media including but not limited to disk storage, CD-ROM, optical storage, etc.
  • Embodiments of the present application are described with reference to flowchart illustrations and/or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present application. It will be understood that each flow and/or block of the flowchart illustrations and/or FIG.
  • These computer program instructions can be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing device to produce a machine for the execution of instructions for execution by a processor of a computer or other programmable data processing device.
  • These computer program instructions can also be stored in a computer or other programmable data processing device.
  • the computer readable memory that operates in a fixed manner, such that the instructions stored in the computer readable memory produce an article of manufacture comprising an instruction device implemented in a block or a block and/or a block diagram of a flowchart or The functions specified in multiple boxes.
  • These computer program instructions can also be loaded onto a computer or other programmable data processing device such that a series of operational steps are performed on a computer or other programmable device to produce computer-implemented processing for execution on a computer or other programmable device.
  • the instructions provide steps for implementing the functions specified in one or more of the flow or in a block or blocks of a flow diagram.

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer Hardware Design (AREA)
  • General Physics & Mathematics (AREA)
  • Computer Security & Cryptography (AREA)
  • Software Systems (AREA)
  • Mathematical Physics (AREA)
  • Quality & Reliability (AREA)
  • Computing Systems (AREA)
  • Semiconductor Integrated Circuits (AREA)
  • Electronic Switches (AREA)

Abstract

一种检测安全芯片工作状态的方法及检测电路，涉及信息安全技术领域，用以解决现有技术中模拟电路的面积越大使得模拟电路容易在安全芯片版图中被识别出来，存在较高的被攻击风险的问题，包括：第一寄存单元(101)，触发单元(105)、延迟单元(102)、选路单元(103)以及第二寄存单元(104)，所述第二寄存单元(104)与所述触发单元(105)连接；通过将第一信号在延迟单元(102)中进行延迟，然后获取第二信号，然后根据第二信号获取第三信号，将第一信号和第三信号进行逻辑运算，输出电平信号以触发报警单元(1052)，由于各个单元均可通过数字电路实现，因此可减小电路的尺寸，使得该电路不易在安全芯片的版图中被识别，提高安全芯片的可靠性。

Description

一种检测安全芯片工作状态的方法及检测电路
本申请要求于2016年11月15日提交中国专利局、申请号为201611021892.9、发明名称为“一种检测安全芯片工作状态的方法及检测电路”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本发明实施例涉及信息安全技术领域，尤其涉及一种检测安全芯片工作状态的方法、检测电路及安全芯片。
背景技术
安全芯片是对存储在安全芯片里的数据进行高可靠性的加密处理，使这些数据很难被非法窃取，其工作时所处的工作环境(Operating Condition)(例如，电气环境)需要保证该安全芯片内的电路(例如，CPU电路、加解密电路、随机数生成电路等)正常运转。一旦该安全芯片工作的电气环境的某个参数超过安全芯片内的电路的耐受阈值，则安全芯片内的电路运转可能会发生异常，此种情况下可能会导致安全芯片所存储的数据泄露。
目前，安全芯片内集成了各类传感器(sensor)，分别用于监测安全芯片工作时所处的工作环境的各个环境分量(例如，电压、温度、光和时钟信息)，然后将各个环境分量通过信号处理模块进行分析，判断该安全芯片所处的工作环境是否合理，若不合理则报警。但是，目前安全芯片内部对上述各个环境分量的监测都是独立进行的，示例性的，如图1所示，例如，使用电压传感器监控电压，使用温度传感器监控温度，使用光传感器监控入射光，使用频率传感器用来监控时钟信息，各个类型的传感器之间相互独立，各类传感器均以模拟电路为主。
但是，模拟电路的面积一般不能够随工艺演进而明显减小，因此模拟电路的面积越大使得模拟电路更容易在安全芯片版图中被识别出来，存在较高的被攻击风险。
发明内容
本发明的实施例提供一种检测安全芯片工作状态的方法及检测电路，用以解决现有技术中模拟电路的面积越大使得模拟电路更容易在安全芯片版图中被识别出来，存在较高的被攻击风险的问题。
为达到上述目的，本发明的实施例采用如下技术方案：
第一方面，本发明实施例提供一种检测安全芯片工作状态的电路，包括：第一寄存单元，与第一寄存单元连接的触发单元和延迟单元，与延迟单元连接的选路单元，与选路单元连接的第二寄存单元，第二寄存单元与触发单元连接；其中，第一寄存单元，用于在时钟信号有效时，根据输入至第一寄存单元的触发信号获取第一信号，以及将第一信号输出至延迟单元和第二逻辑门单元；延迟单元，用于将第一信号延迟不同时间段以产生多个延迟信号，并在时钟信号有效时，根据多个延迟信号生成多个第二信号；选路单元，用于从多个第二信号中选择一个第二信号，并将 所选择的第二信号输出至所述第二寄存单元；第二寄存单元，用于在时钟信号有效时，根据接收的第二信号生成第三信号，并将第三信号输出至触发单元；触发单元，用于对第三信号和第一信号进行逻辑运算，获取电平信号，并根据电平信号确定是否输出报警信号。
本发明实施例提供一种检测安全芯片工作状态的电路，包括：第一寄存单元，与第一寄存单元连接的触发单元和延迟单元，与延迟单元连接的选路单元，与选路单元连接的第二寄存单元，第二寄存单元与触发单元连接；本发明实施例将第一信号进行延迟以获取多个延迟信号，并根据多个延迟信号生成多个第二信号，通过从多个第二信号中选择一个第二信号，并将所选择的第二信号输出至第二寄存单元获取第三信号，并对所述第三信号和所述第一信号进行逻辑运算，获取电平信号，并根据所述电平信号确定是否输出报警信号，由于本发明实施例中的各个单元均可以通过数字电路来实现，因此可以减小该电路的尺寸，从而使得该电路不易在安全芯片的版图中被识别，提高安全芯片的可靠性，因此可以通过判断第一信号在延迟链路上传输的时延，来确定本发明实施例提供的检测安全芯片工作状态的电路所处的工作状态是否为正常工作条件。
结合第一方面，在第一方面的第一种可能的实现方式中，选路单元具体用于：接收用于指示从每个第三寄存单元生成的第二信号中选择一个第二信号的选择信号，根据选择信号用于指示从每个第三寄存单元生成的第二信号中选择一个第二信号。该电路的性能边界由第一信号的时延确定，因此，第一信号的延迟不同可以使得该电路具有不同的性能边界，这样可以使得在不同的性能边界时使得处于不同工作状态的检测安全芯片工作状态的电路能够及时检测出该工作状态是否为安全芯片正常的工作状态。
结合第一方面或第一方面的第一种可能的实现方式，在第一方面的第二种可能的实现方式中，触发单元具体用于：在电平信号为高电平信号时，输出报警信号。
结合第一方面至第一方面的第二种可能的实现方式中任意一种可能的实现方式，在第一方面的第三种可能的实现方式中，延迟单元包括至少一个第三寄存单元，以及与至少一个第三寄存单元中每个第三寄存单元相连的延迟链路；其中，延迟链路，用于将第一信号延迟不同时间段以产生多个延迟信号，并将多个延迟信号传送至不同的第三寄存单元；每个第三寄存单元，用于接收延迟信号，以及在时钟信号有效时，根据传输至第三寄存单元的延迟信号生成第二信号。
结合第一方面至第一方面的第三种可能的实现方式中任意一种可能的实现方式，在第一方面的第四种可能的实现方式中，电路还包括反相单元，反相单元的输出端接第一寄存单元的输入端，反相单元的输入端接第一寄存单元的输出端，反相单元用于将第一寄存单元的输出端输出的第一信号进行反相，然后输入至第一寄存单元的输入端。由此保证第一寄存单元的输入端与输出端的信号一致保持相反状态；当时钟信号处于上升沿瞬间时，第一寄存单元将输入端的值搬移到输出端，从而实现输出端信号的一次翻转。
结合第一方面至第一方面的第三种可能的实现方式中任意一种可能的实现方式，在第一方面的第四种可能的实现方式中，延迟链路包括多个延迟元件，每个延 迟元件用于将输入至该延迟元件的信号延迟预设周期，以使得第一信号经过不同个数的延迟元件后生成不同时间段的延迟信号。
结合第一方面至第一方面的第四种可能的实现方式中任意一种可能的实现方式，在第一方面的第五种可能的实现方式中，第一寄存单元、第二寄存单元以及第三寄存单元均采用D触发器；选路单元采用MUX复用器。
结合第一方面至第一方面的第五种可能的实现方式中任意一种可能的实现方式，在第一方面的第六种可能的实现方式中，逻辑门单元采用异或门电路。
结合第一方面至第一方面的第六种可能的实现方式中任意一种可能的实现方式，在第一方面的第七种可能的实现方式中，电路还包括：第四寄存单元、第五寄存单元和第一逻辑门单元；其中，第四寄存单元与第二寄存单元、第五寄存单元以及第一逻辑门单元连接；其中，第四寄存单元用于接收第二寄存单元输出的第三信号，以及在时钟信号有效时生成第四信号，以及将第四信号输出至第五寄存单元以及第一逻辑门单元；第五寄存单元，用于接收第四寄存单元输出的第四信号，以及在时钟信号有效时，根据第四信号生成第五信号，并将第五信号输出至第一逻辑门单元；第一逻辑门单元，用于根据第四信号和第五信号生成触发信号，触发信号用于表明电路内部的元件正常，通过设置第四寄存单元、第五寄存单元和第一逻辑门单元这样可以及时检测电路内部的电路是否处于正常状态，以保种检测安全芯片工作状态的电路正常运行。
结合第一方面至第一方面的第七种可能的实现方式中任意一种可能的实现方式，在第一方面的第八种可能的实现方式中，触发单元包括第二逻辑门单元和报警单元，其中，第二逻辑门单元和第一寄存单元相连，报警单元和第二逻辑门单元相连，第二逻辑门单元还与第二寄存单元相连；其中，第二逻辑门单元，用于对第三信号和第一信号进行逻辑运算，获取电平信号，并将电平信号发送至所述报警单元；报警单元，用于根据电平信号确定是否输出报警信号。
第二方面，本发明实施例提供一种检测安全芯片工作状态的方法，应用于检测安全芯片工作状态的电路中，本发明实施例提供的方法包括：在时钟信号有效时，根据输入至检测安全芯片工作状态的电路的触发信号获取第一信号；将第一信号进行延迟，以获取多个延迟信号，其中，多个延迟信号中每个延迟信号的时延均不同；根据多个延迟信号获取多个第二信号；从多个第二信号中选择一个第二信号，在时钟信号有效时，根据所选择的第二信号生成第三信号；在时钟信号有效时，对第一信号和第三信号进行逻辑运算，获取电平信号；根据电平信号确定是否输出报警信号。
结合第二方面，在第二方面的第一种可能的实现方式中，在从多个第二信号中选择一个第二信号之前，本发明实施例提供的方法还包括：接收用于指示从多个第二信号中选择一个第二信号的选择信号，根据选择信号从多个第二信号中选择一个第二信号。
结合第二方面或第二方面的第一种可能的实现方式，在第二方面的第二种可能的实现方式中，根据输入至检测安全芯片工作状态的电路的触发信号获取第一信号之后，该方法还包括：将当前时刻输出的第一信号进行反相，以确定下一时刻输入 至安全芯片的触发信号。
结合第二方面至第二方面的第二种可能的实现方式中任意一种可能的实现方式，在第二方面的第三种可能的实现方式中，根据电平信号确定是否输出报警信号，包括：在电平信号为高电平信号时，则输出报警信号。
结合第二方面至第二方面的第三种可能的实现方式中任意一种可能的实现方式，在第二方面的第四种可能的实现方式中，本发明实施例提供的方法还包括：在在时钟信号有效时，根据第三信号生成第五信号；在时钟信号有效时，根据第五信号生成第六信号；根据第五信号和第六信号生成用于表明电路的元件正常的触发信号。
第三方面，本发明实施例提供一种安全芯片的保护电路，该安全芯片的保护电路应用于安全芯片中，安全芯片包括至少一个检测电路，其中，任意一个检测电路用于检测该检测电路检测范围内的环境状态；检测电路采用如第一方面至第一方面的第七种可能的实现方式中任意一项所描述的检测安全芯片工作状态的电路，并根据环境状态判断是否发出报警信号；检测安全芯片工作状态的电路与安全芯片具有相同的工作条件，工作条件至少包括时钟信号的时钟周期、电源、温度。
本发明实施例一种安全芯片的保护电路，该安全芯片的保护电路应用于安全芯片中，该安全芯片中包括至少一个检测电路，任意一个检测电路用于检测该检测电路检测预设范围内的环境状态，并根据环境状态确定是否发出报警信号，由于该检测电路采用第一方面至第一方面的第七种可能的实现方式中任意一项所描述的检测安全芯片工作状态的电路，该检测安全芯片工作状态的电路能够根据安全芯片所处的工作状态，自动完成实现对安全芯片所处工作状态是都处在安全状态的检测，由于检测安全芯片工作状态的电路内的元器件均采用数字电路，因此，不受老化、工作状态变化的影响；同时，由于检测安全芯片工作状态的电路中采用数字电路可以做的足够小，这样设置在安全芯片内的检测安全芯片工作状态的电路的数量不受安全芯片尺寸所限制，同时在安全芯片内摆放至少一个检测安全芯片工作状态的电路在安全芯片遭到局部工作条件变化时可以及时产生报警，当然，本发明实施例提供的安全芯片在安全芯片所处的整个工作环境发生变化时也可以及时报警。
结合第三方面，在第三方面的第一种可能的实现方式中，当安全芯片中存在两个或两个以上的检测电路时，该两个或两个以上的检测电路位于不同的位置，通过将检测安全芯片工作状态的电路摆放在安全芯片内的不同位置，由于每个检测安全芯片工作状态的电路均有其所检测的范围，这样当安全芯片的任意一个局部的工作状态发生变化时(例如，安全芯片的某一个局部遭到攻击，使得该局部电压发生变化，但是安全芯片其他位置的电压未发生变化)，位于该布局内的安全芯片则可以及时检测到工作状态发生变化，并当该工作状态的变化所引起的电平信号能够触发报警单元时，该报警单元及时发出报警信号。
第四方面，本发明实施例提供一种安全芯片的检测方法，应用于如本发明实施例第三方面或第三方面的第一种可能的实现方式所描述的安全芯片中，该方法包括：根据输入的选择信号，设定每个检测电路所选择的目标第三寄存单元；该选择信号用于指示选路单元从至少一个第三寄存单元中选择目标第三寄存单元；在安全 芯片启动后，若至少一个检测电路中存在任意一个检测电路发出报警信号，则表明安全芯片当前时刻工作在不安全的工作条件下。
结合第四方面，在第四方面的第一种可能的实现方式中，在至少一个检测电路中存在任意一个检测电路发出报警信号之前，本发明实施例提供的方法还包括：获取至少一个检测电路中每个检测电路当前时刻所处的工作状态；根据每个检测电路当前时刻所处的工作状态与检测电路的性能边界之间的关系，每个检测电路判断是否发出报警信号。
结合第四方面或第四方面的第一种可能的实现方式中，在第四方面的第二种可能的实现方式中，根据每个检测电路当前时刻所处的工作状态与所述检测电路的性能边界之间的关系，每个检测电路判断是否发出报警信号，包括：当至少一个检测电路中存在第一检测电路当前时刻所处的工作状态位于第一检测电路的性能边界外时，则第一检测电路发出报警信号，第一检测电路为至少一个检测电路中任意一个检测电路。
结合第四方面至第四方面的第二种可能的实现方式中任意一种可能的实现方式，在第四方面的第三种可能的实现方式中，根据每个检测电路当前时刻所处的工作状态与所述检测电路的性能边界之间的关系，每个检测电路判断是否发出报警信号，还包括：当至少一个检测电路中存在第一检测电路当前时刻所处的工作状态位于第一检测电路的性能边界内，则第一检测电路不发出报警信号，第一检测电路为至少一个检测电路中任意一个检测电路。
结合第四方面至第四方面的第三种可能的实现方式中任意一种可能的实现方式，在第四方面的第四种可能的实现方式中，在至少一个检测电路中存在任意一个检测电路发出报警信号之后，本发明实施例提供的方法还包括：采取预设保护措施对安全芯片进行复位，以使得所述安全芯片恢复至初始状态。
附图说明
图1为现有技术中提供的安全芯片内的检测示意图；
图2a为本发明实施例提供的一种检测安全芯片工作状态的电路的结构示意图一；
图2b为本发明实施例提供的一种检测安全芯片工作状态的电路的结构示意图二；
图3为本发明实施例提供的一种检测安全芯片工作状态的电路的结构示意图三；
图4为本发明实施例提供的一种检测安全芯片工作状态的电路的结构示意图四；
图5为本发明实施例提供的一种检测安全芯片工作状态的电路的结构示意图五；
图6为本发明实施例提供的一种检测安全芯片工作状态的电路的结构示意图六；
图7为本发明实施例提供的在时钟信号的频率发生变化时第二逻辑门单元输出的电平信号的时序图；
图8为本发明实施例提供的在电压/温度发生变化时第二逻辑门单元输出的电平信号的时序图；
图9本发明实施例提供的一种检测安全芯片工作状态的方法的流程示意图；
图10为本发明实施例提供的检测电路的使用实例示意图；
图11为本发明实施例提供的安全芯片的检测方法的示意图。
具体实施方式
需要说明的是，本发明实施例中的电子元件前限定的“第一”、“第二”、“第三”等是为了对多个同类电子元件进行区分，不作为限定用语，例如“第一第三寄存单元”仅是指代其中的一个第三寄存单元，并不表示第一个第三寄存单元。
如图2a所示，本发明实施例提供一种检测安全芯片工作状态的电路，包括：第一寄存单元101，与第一寄存单元101连接的触发单元105和延迟单元102，与延迟单元102连接的选路单元103，与选路单元103连接的第二寄存单元104，第二寄存单元104与触发单元105连接；
其中，第一寄存单元101，用于在时钟信号有效时，根据输入至第一寄存单元101的触发信号获取第一信号，以及将第一信号输出至延迟单元102和第二逻辑门单元104；延迟单元102，用于将第一信号延迟不同时间段以产生多个延迟信号，并在时钟信号有效时，根据多个延迟信号生成多个第二信号；选路单元103，用于从多个第二信号中选择一个第二信号，并将所选择的第二信号输出至第二寄存单元104；第二寄存单元104，用于在时钟信号有效时，根据接收的第二信号生成第三信号，并将第三信号输出至触发单元105；触发单元105，用于对第三信号和第一信号进行逻辑运算，获取电平信号，并根据电平信号确定是否输出报警信号。
本发明实施例提供一种检测安全芯片工作状态的电路，包括：第一寄存单元，与第一寄存单元连接的触发单元和延迟单元，与延迟单元连接的选路单元，与选路单元连接的第二寄存单元，第二寄存单元与触发单元连接；本发明实施例将第一信号进行延迟以获取多个延迟信号，并根据多个延迟信号生成多个第二信号，通过从多个第二信号中选择一个第二信号，并将所选择的第二信号输出至第二寄存单元获取第三信号，并对所述第三信号和所述第一信号进行逻辑运算，获取电平信号，并根据所述电平信号确定是否输出报警信号，由于本发明实施例中的各个单元均可以通过数字电路来实现，因此可以减小该电路的尺寸，从而使得该电路不易在安全芯片的版图中被识别，提高安全芯片的可靠性，进一步由于，每个数字电路均为有源器件，有源器件的信号传输受到温度、电压以及工艺等的影响，因此可以通过判断第一信号在延迟链路上传输的时延，来确定本发明实施例提供的检测安全芯片工作状态的电路所处的工作状态是否为正常工作条件。
可选的，如图2b所示，延迟单元102包括至少一个第三寄存单元1021，以及与至少一个第三寄存单元1021中每个第三寄存单元相连的延迟链路1022；
其中，延迟链路1022，用于将第一信号延迟不同时间段以产生多个延迟信号，并将多个延迟信号传送至不同的第三寄存单元；
每个第三寄存单元，用于接收延迟信号，以及在时钟信号有效时，根据传输至所述第三寄存单元的延迟信号生成第二信号。
可选的，如图2b所示，触发单元105包括第二逻辑门单元1051和报警单元1052，其中，第二逻辑门单元1051和第一寄存单元101相连，报警单元1052和第二逻辑门单元1051相连，第二逻辑门单元1051还与第二寄存单元104相连；
其中，第二逻辑门单元1051，用于对第三信号和第一信号进行逻辑运算，获取电平信号，并将电平信号发送至报警单元1052；报警单元，1052用于根据所述电平信号确定是否输出报警信号。
由于不同时间段的延迟信号是本发明实施例提供的检测安全芯片工作状态的电路的性能边界指示，将第一信号通过延迟链路传递至每个第三寄存单元，以使得每个第三寄存单元在时钟信号有效时，根据接收到的第一信号产生第二信号，然后选路单元，从每个第三寄存单元生成的第二信号中选择一个第二信号，并将所选择的第二信号输出至第二寄存单元，由于第一信号经过延迟链路后产生的多个不同时间段的延迟信号，因此，输入至每个第三寄存单元的延迟信号的时延也不同，每个第三寄存单元最终生成的第二信号具有不同的时延，这样通过选路单元可以改变输入至第二寄存单元中的信号的时延，因此，改变了检测安全芯片工作状态的电路的性能边界。不同时间段的延迟信号导致检测安全芯片工作状态的电路的性能边界不同。
可选的，为了改变检测安全芯片工作状态的电路的性能边界，本发明实施例可以通过选路单元具体来实现，具体的，选路单元103用于根据选择信号从至少一个第三寄存单元中选择目标第三寄存单元，以改变检测安全芯片工作状态的电路的性能边界。
示例性的，本发明实施例提供的报警单元1052具体用于：在电平信号为高电平信号时，输出报警信号。
可选的，结合图2b，如图3所示，本发明实施例提供的电路还包括反相单元107，该反相单元107的输出端接第一寄存单元的输入端，反相单元107的输入端接第一寄存单元的输出端，反相单元107用于将第一寄存单元的输出端输出的第一信号进行反相，然后输入至第一寄存单元的输入端。这样可以保证第一寄存单元输入的信号和输出的第一信号之间的状态一致处于相反状态。
示例性的，本发明实施例中的反相单元可以采用反相器来实现。具体的，反相器的输入端接第一寄存单元的输出端，反相器的输出端接第一寄存单元的输入端。
可选的，结合图3，如图4所示，延迟链路包括多个延迟元件，每个延迟元件用于将输入至该延迟元件的信号延迟预设周期，以使得第一信号经过不同个数的延迟元件后生成不同时间段的延迟信号。
为确保每个第三寄存单元均能采集到经过延迟链路传递的延迟信号，因此，本发明实施例中，当每相邻两个第三寄存单元之间存在一个延迟元件时，本发明实施例中的延迟元件的数量等于第三寄存单元的数量。示例性的，当本发明实施例中仅存在一个第三寄存单元时，那么延迟元件的数量为1。
具体的，本发明实施例中延迟元件的数量可以根据每相邻两个第三寄存单元之间存在的延迟元件的数量以及距离第一寄存单元最短的一个第三寄存单元(距离第一寄存单元最短的一个第三寄存单元可以理解为接收延迟信号中时延时间最短的 第三寄存单元，如图4中的第三寄存单元10211)与第一寄存单元之间延迟元件的数量来确定。
本发明实施例中的延迟元件用于将经过其的第一信号延迟预设周期，本发明实施例对此延迟元件的具体结构不进行限定，只要延迟元件能够将经过其的第一信号延迟预设周期即可，示例性的，本发明实施例中的延迟元件可以采用缓冲器(BUFFER)。
本发明实施例中的时间段是指第一寄存单元输出的第一信号经过延迟链路传输至每个第三寄存单元输入端的时间。示例性的，如图4中，时间段1可以表示第一寄存单元输出的第一信号经过延迟链路1022传输至第一个第三寄存单元10211的时间，时间段2可以表示第一寄存单元输出的第一信号经过延迟链路传输至第二个第三寄存单元10212的时间段，示例性的，若第一寄存单元101输出的第一信号经过延迟链路上的5个延迟元件(图4处只是示例，实际电路中延迟元件的数量需要根据检测安全芯片工作状态的电路的性能边界而定)传输至第一第三寄存单元10211，那么时间段1可以表示将第一信号延迟5个预设周期传输至第三寄存单元10211，若第一寄存单元输出的第一信号经过延迟链路上的10个延迟元件传输至第三寄存单元10212，那么时间段2可以表示将第一信号延迟10个预设周期传输至第三寄存单元10212，同样，第三寄存单元10211和第三寄存单元10212之间存在5个延迟元件。
具体的，本发明实施例对每个时间段所包括的延迟元件的个数不进行限定，具体可以根据实际需要将第一信号所延迟的周期进行选择设置，可选的，本发明实施例中每个延迟元件用于将第一信号延迟预设周期，当然，每两个相邻的第三寄存单元1021之间的延迟元件的个数可以相同，也可以不相同，本发明实施例对此不进行限定。
可选的，第一寄存单元、第二寄存单元以及第三寄存单元均采用D触发器。其中，D触发器的输出端为Q端，输入端为D端，触发端R用于接收时钟信号。
可选的，本发明实施例中的选路单元具体用于从至少一个第三寄存单元中确定目标第三寄存单元，因此，只要能够实现上述功能的选路单元均可以作为本发明实施例提供的选路单元，示例性的，本发明实施例中的选路单元采用MUX复用器。
需要说明的是，本发明实施例中第一寄存单元、第二寄存单元以及第三寄存单元采用同一个时钟信号，具有相同的电压和温度。
需要说明的是，本发明实施例中的任意一个寄存单元可以由一个寄存单元构成，也可以由两个或两个以上的寄存单元构成满足实际所需的寄存单元，本发明实施例中的任意一个逻辑门单元可以由一个逻辑门单元构成或者也可以由两个或两个以上的寄存单元构成满足实际所需要的逻辑门单元，本发明实施例中的任意一个MUX复用器可以由一个MUX复用器构成，也可以由两个或两个以上的MUX复用器构成满足实际所需要的MUX复用器，具体的，可以根据实际使用需求设置，本发明实施例不作限定。
可选的，第二逻辑门单元和第一逻辑门单元采用异或门电路。
其中，第三信号和第一信号均存在高电平或者低电平两种状态，若设定报警电 路报警时定义为“接收到第二逻辑门单元输出的高电平信号(1)则报警”，不报警时定义为“接收到第二逻辑门单元输出的低电平信号(0)则不报警”，那么检测安全芯片工作状态的电路共有以下几种报警状态，具体如表1-1所示。
表1-1
Figure PCTCN2017086212-appb-000001
可选的，如图5所示，本发明实施例提供的电路还包括：
第四寄存单元108、第五寄存单元109和第一逻辑门单元110；其中，第四寄存单元108用于接收第二寄存单元104输出的第三信号，以及在时钟信号有效时生成第四信号，以及将第四信号输出至第五寄存单元109以及第一逻辑门单元110；
第五寄存单元109，用于接收第四寄存单元108输出的第四信号，以及在时钟信号有效时，根据第四信号生成第五信号，并将第五信号输出至第一逻辑门单元110；
第一逻辑门单元110，用于根据第四信号和第五信号生成触发信号，触发信号用于表明电路内部的电路正常。
如图6所示，图6示出了本发明实施例提供的一种检测安全芯片工作状态的电路的具体电路，以下简称OCM(Operating Condition Monitor，工作条件传感器)，在图6中的①表示第一触发器601的输出信号从第一触发器601的Q端输出至第一异或门电路605的一个输入端。图6中的a0到a1之间具有多个延迟元件，an-1到an之间具有多个延迟元件。
其中，图2a-图5中所示的第一寄存单元101可以通过图6中的第一触发器601来实现，每个第三寄存单元可以通过图6中的第三触发器6031来实现，选路单元103可以通过图6中的复用器603来实现，第二寄存单元104可以通过图6中的第二触发器604来实现，第二逻辑门电路1051可以通过图6中的第一异或门电路605来实现，第四寄存单元108可以通过图6中的第四触发器608来实现，第五寄存单元109可以通过第五触发器609来实现以及第一逻辑门电路110可以通过第二异或门电路610来实现。
其中，第四触发器608、第五触发器609以及第二异或门电路610用于确定OCM电路内部的器件是否正常。
本发明实施例中OCM电路所处的工作状态的改变，可以是激光、电磁感应等方式的能量注入所导致的。
在图6所示的电路中，电路的传感器部分包括第一触发器601到目标第三触发器(如图6中的第三触发器60213)。
当第一触发器601的Q端(输出端)输出的第一信号经过延迟链路产生的延迟信号到达第一个第三触发器(如图6中的第三触发器60211)D端(输入端)，若输入至该第三触发器60211的延迟信号的信号延迟与时钟信号的时钟周期之间的误差小于预设误差时(也即信号延迟与时钟信号的时钟周期略小于时钟信号的时钟周期)，那么第一触发器601的Q端输出的第一信号在第二个第三触发器(如图6中的第三触发器60212)至第M个第三触发器(如图6中的第三触发器6021M)的延迟逐级增大且均大于时钟信号的时钟周期。
当时钟信号的时钟频率(时钟频率＝1/时钟周期)突然升高(也即时钟信号的时钟周期突然降低时)或者本发明实施例提供的OCM电路的工作电压迅速下降时，复用器所选择的第二信号在一个时钟周期内将无法与第一触发器601输出的第一信号的状态保持一致，则第一异或门电路605输出高电平，报警单元606发出报警信号。
可选的，通过向选路单元输入不同的选择信号，即可以将延迟了不同时间段的延迟信号输入至每个第三触发器中，然后每个第三触发器生成第二信号，并通过复用器603从每个第三触发器生成的第二信号选择一个第二信号，并将该第二信号传输至第二触发器604的D端；然后，第二触发器604在时钟信号有效时，产生第三信号，并通过第二触发器604的Q端将第三信号输出至第一异或门电路605中。这样，可以通过复用器603选择合适的目标第三触发器以改变检测电路所监控的目标PVTF(Process，Voltage，Temperature，Frequency，工艺，电压，温度，频率)的性能的边界(也即OCM电路的性能边界)。
需要说明的是，本发明实施例中的时钟信号有效时是指在每个时钟周期的高电平状态，在时钟信号处于上升沿的瞬间每个寄存器的输出信号可以根据输入信号的翻转确定。
示例性的，本发明实施例仅以第三触发器60213为例说明OCM电路在频率改变时第一逻辑单元输出的电平信号的时序图，由于对于每个第三寄存单元而言，其工作原理和过程均与第三触发器60213相同，因此，本发明实施例以第三触发器60213为例说明，不具有任何指示性含义。
示例性的，以下将结合图7和图8分别介绍在时钟信号的频率改变和温度/电压改变下，第三触发器60213的时序变化所引起的检测安全芯片工作状态的电路是否发出报警信号的实例。
如图7示出了本发明实施例中在时钟信号的频率改变时报警单元报警的时序图：
当PVT(Process,Voltage,Temperature,工艺，电压，温度)正常时，第一触发器601的Q端输出的第一信号在该延迟链路6022上的传输延迟记为Dr，如图7和图8中的标识有Dr的箭头所示。
由于，图6中的第一触发器601、延迟链路6022中的每个延迟元件和反相器607都是有源器件，有源器件的信号传输延迟受PVT的影响，因此，当PVT恶化时，第一信号在延迟链路6022上传输的时延会变大，记为Dm，如图8的标识有Dm的箭头所示。
该OCM电路工作时，第一触发器601的Q端(输出端)输出的第一信号在时钟信号(Clk_i)的每个上升沿时翻转一次(如图7和图8中Clk_i和第一触发器/Q端的时序图。
其中，由于在时刻1，时钟信号处于上升沿，第一触发器/Q端在时刻1之前为高电平，因此，当时钟信号进入时刻1时，第一触发器/Q端输出的信号由高电平变为低电平，如图7中所示的在时刻1和时刻2之间第一触发器/Q端输出的信号)。第一触发器601的Q端输出的信号经过延迟链路6022后传递到第三触发器60213的D端(输入端)，在时钟信号的每个上升沿时，第三触发器60213的D端的信号被传输至第三触发器60213的Q端(输出端)。
如图7所示，在时刻1时，由于第三触发器的D端的信号为高电平，因此在时刻1第三触发器60213的Q端输出的信号为高电平。
如图7中所示，在时刻0-时刻2，由于OCM电路的工作频率未发生改变，而在时刻2，OCM电路的工作频率变大(如图7中时刻2之后，每个时刻之间的周期变短)，在时刻2由于第三触发器60213的D端输入至其Q端的信号为低电平，因此在时刻2第三触发器Q端输出的信号为低电平。
在时刻3时，由于第三触发器60213的D端输出的信号依旧为低电平，因此在时刻3，第三触发器60213的Q端输出的信号也为低电平，因此，第一触发器601到第三触发器60213的延迟超过了一个时钟周期，由于第三触发器60213不能在一个时钟周期内与第一触发器601的Q端输出的第一信号的状态保持一致，使得输入至第二触发器604的D端的信号在时钟信号的触发下从第二触发器604的Q端输出的信号与第一触发器601的Q端输出第一信号的状态在一个时钟周期内不同步，因此，在时刻4第一异或门电路605输出高电平信号，如图7中所示。
在时刻3到时刻4之间，第一触发器的Q端输入至第一异或门电路605中的信号为低电平信号，第二触发器的Q端输入至第一异或门电路605中的信号为低电平信号，因此，第一异或门电路605在时刻3到时刻4(一个时钟周期)之间输出的电平信号为低电平信号，报警单元606不发出报警信号。
在时刻4和时刻5之间，由于第一触发器601的Q端输入至第一异或门电路605的电平信号为高电平信号，第二触发器的Q端输入至第一异或门电路605的信号为低电平信号，因此在时刻4到时刻5之间第一异或门电路605输出的电平信号为高电平，因此，在时刻4报警单元606发出报警信号。
需要说明的是，任意一个第三触发器的Q端到第二触发器603的时延均可以忽略。
如图8所示，(以目标第三触发器为第三触发器60213为例)，如图8为在OCM电路在电压降低、温度变化等导致延迟链路延迟变大时的工作示意。
在图8中，在时刻0到时刻2之间，该OCM电路所处的工作状态正常(即温度和电压均在额定范围内)，因此，在时刻0到时刻1之间由于第一触发器601的Q端输出的第一信号(高电平信号)的时延为Dr，第三触发器60213的D端在经过时延Dr之后，应该保持与第一信号一致的状态，因此在时刻Dr至时刻1+Dr之间，第三触发器60213的D端输出的信号为高电平信号。
在时刻1时，第三触发器60213的Q端时钟信号有效时，采集第三触发器60213的D端输出的信号的状态，即保持高电平状态，因此，在时刻1到时刻2之间第三触发器60213的Q端输出的信号为高电平状态。
在时刻1到时刻2之间，由于第一触发器601的Q端输出的第一信号为低电平信号，因此，在时刻1到时刻2之间，经过延迟链路后的第一信号输入至第三触发器60213的D端的信号依旧为低电平信号。
在时刻2，时钟信号有效时，由于第三触发器60213的Q端输出的信号由高电平信号转换为低电平信号，因此在时刻1第二触发器604的Q端输出的信号从高电平信号转化为低电平信号。在时刻2时，第二触发器604的Q端输出的信号从低电平信号转化为高电平信号，由于第一异或门电路605的输入分别为第二触发器604的Q端的信号和第一触发器601的Q端输出的第一信号，因此，在时刻0到时刻1之间，由图8可以知道，第二触发器604的Q端的信号和第一触发器601的Q端的信号状态一致，均为高电平信号，因此，第一异或门电路605输出的电平信号为低电平信号，该报警电路606不发出报警信号。
同时，在时刻1和时刻2之间，第二触发器604的Q端的信号和第一触发器601的Q端的信号状态一致，均为低电平信号，因此，第一异或门电路605输出的电平信号为低电平信号，该报警电路606不发出报警信号。
综上所述，可知在时刻0到时刻2之间，该报警单元606不发出报警信号。
在时刻2时，由于OCM电路所处的工作状态(例如，电压降低或温度恶化)使得第一信号在延迟链路上的传输延迟增大，如图8中的Dm，使得第一触发器601的Q端输出的第一信号经过延迟链路到达第三触发器60213的D端的时延变大(从图8中可以知道该时延为1-Dr+Dm)，由于Dm大于Dr，因此第一触发器601的Q端输出的第一信号经过延迟链路到达第三触发器60213的D端的时延超过了一个时钟周期。
因此，在时刻2之后，第三触发器60213不能在一个时钟周期内保持与第一触发器601输出的第一信号的状态一致，由图8可以知道，在时刻3时，由于第一触发器601的Q端输出的第一信号的状态为高电平信号，同时由于OCM电路时延变大，在时刻3第三触发器60213的D端输出的信号的状态为低电平信号，在时刻3第三触发器60213的Q端输出的信号也为低电平信号，因此在时刻3第二触发器604的Q端输出的信号由高电平转换为低电平。
在时刻3到时刻4之间，由于第一触发器601的Q端输出的第一信号为低电平信号，第二触发器604的Q端输出的信号为低电平信号，因此，在时刻3到时刻4之间，第一异或门电路605输出低电平信号，报警电路606不发出报警信号。
在时刻4到时刻5之间，由于第一触发器601的Q端输出的第一信号为高电平信号，第二触发器604的Q端输出的信号为低电平信号，因此，第一异或门电路输出的电平信号为高电平信号，报警单元606发出报警信号。
本发明实施例提供一种检测安全芯片工作状态的方法，应用于上述的检测安全芯片工作状态的电路，如图9所示，本发明实施例提供的方法包括：
S901、在时钟信号有效时，根据输入至检测安全芯片工作状态的电路的触发 信号获取第一信号。
S902、将所述第一信号进行延迟，以获取多个延迟信号，其中，所述多个延迟信号中每个延迟信号的时延均不同。
S903、根据多个延迟信号获取多个第二信号。
S904、从多个第二信号中选择一个第二信号，在时钟信号有效时，根据所选择的第二信号生成第三信号。
S905、在时钟信号有效时，对第一信号和第三信号进行逻辑运算，获取电平信号。
S906、根据电平信号确定是否输出报警信号。
进一步的，本发明实施例提供的方法在步骤S904之前还包括:
S907、接收选择信号，该选择信号用于指示选路单元从多个第二信号中选择一个第二信号。
其中，该选择信号中携带有每个第三寄存单元的标识，或者在实际使用中选择单元包括多个通路，每个通路连接一个第三寄存单元，当然，此时该选择信号中可以携带与目标第三寄存单元所连接的通路的标识。
S908、根据选择信号从多个第二信号中选择一个第二信号。
可选的，在步骤S901之后，所述方法还包括：
S909、将当前时钟周期输出的第一信号进行反相，以确定下一时钟周期输入至所述安全芯片的触发信号。
可选的，步骤S906具体可以通过以下方式实现：
S9061、在电平信号为高电平信号时，输出报警信号。
可选的，方法还包括：
S910、在时钟信号有效时,根据第三信号生成第五信号。
S911、在时钟信号有效时，根据所述第五信号生成第六信号。
S912、根据第五信号和第六信号生成触发信号，改触发信号用于表明电路的元件正常。
如图10所示，本发明实施例提供一种安全芯片的保护电路，该安全芯片的保护电路应用于安全芯片中，安全芯片包括至少一个检测电路保护电路，其中，任意一个检测电路用于检测预设范围内的环境状态；其中，预设范围可以根据每个检测电路的检测能力去确定，并根据环境状态判断是否发出报警信号；检测电路采用如图2a、图2b到图6所示的检测安全芯片工作状态的电路，该检测安全芯片工作状态的电路与安全芯片具有相同的环境状态，环境状态至少包括时钟信号的时钟周期、电源、温度以及激光。
需要说明的是，本发明实施例中对安全芯片包括至少一个检测电路的数量不进行限定，当该安全芯片仅包括一个检测电路时，该检测电路可以用于检测整个安全芯片所处的工作状态是否为正常工作条件，也可以检测该安全芯片所处的工作状态的任意一个区域(也称为局部)的工作状态是否为正常工作条件，当任意一个检测电路发出报警信号时，则说明该安全芯片所处的工作状态为非正常工作条件。
本发明实施例中将检测安全芯片工作状态的电路作为一个数字电路应用于安 全芯片中，与安全芯片中的其他工作电路(例如，CPU电路、加解密引擎电路、随机数生成电路等)共享相同的工作时钟时钟信号、电源网络、温度等工作条件。任意一个检测电路中的每个触发器的其输入为安全芯片所处工作状态的时钟信号系统工作时钟，任意一个检测电路所监控对象包括：安全芯片的时钟信号、系统时钟频率、工作电压、工作温度、以及是否有激光等能量注入。当时钟信号或工作电压或工作温度的综合水平超过电路任意一个检测电路的耐受极限时，该检测电路的第二逻辑门单元输出的电平信号为高电平信号，因此，报警单元发出报警信号。
本发明实施例中检测电路中每个源器件均采用数字电路，这样可以降低检测电路的尺寸，使得在安全芯片内可以布置2个或2个以上的检测电路，这样当安全芯片的工作状态仅在局部发生变化(例如激光、电磁注入导致的芯片局部电压、温度的变化)，但是该变化并未引起安全芯片整个工作状态的变化时，(例如，安全芯片的一个局部被攻击导致电压升高，但是该电压并未影响到整个安全芯片，或者安全芯片内的传感器未检测到)，不仅可以通过位于该局部范围内的检测电路发出报警信号，以检测局部的工作状态异常。
同时，本发明实施例通过在安全芯片内集成多个检测电路，也可以在安全芯片所处的工作状态发生异常时，发出报警信号。
本发明实施例提供一种安全芯片保护电路的检测方法，应用于如图10所示的安全芯片的保护电路中，本发明实施例提供的方法包括：
S1101、根据输入的选择信号，设定每个检测电路所选择的目标第三寄存单元；该选择信号用于指示选路单元从至少一个第三寄存单元中选择目标第三寄存单元。
S1102、在安全芯片启动后，若至少一个检测电路中存在任意一个检测电路发出报警信号，则表明安全芯片当前时刻工作在不安全的工作条件下。
可选的，在步骤S1102之前，本发明实施例提供的方法还包括：
S1103、获取至少一个检测电路中每个检测电路当前时刻所处的工作状态。
S1104、根据每个检测电路当前时刻所处的工作状态与所述检测电路的性能边界之间的关系，每个检测电路判断是否发出报警信号。
具体的，本发明实施例中的步骤S1104可以通过以下步骤实现：
S11041、当至少一个检测电路中存在第一检测电路当前时刻所处的工作状态位于所述第一检测电路的性能边界外时，则第一检测电路发出报警信号，第一检测电路为所述至少一个检测电路中任意一个检测电路。
S11042、当至少一个检测电路中存在第一检测电路当前时刻所处的工作状态位于第一检测电路的性能边界内，则第一检测电路不发出报警信号，第一检测电路为至少一个检测电路中任意一个检测电路。
需要说明的是，本发明实施例中每个检测电路均具有多个性能边界，其性能边界具体可以通过每个检测电路中选路单元所选择的目标第三寄存单元所输入的延迟信号来确定，当然，每个安全芯片也可以具有性能边界，其中，安全芯片的性能边界具体可以参考每个安全芯片的额定电压、额定温度等进行确定。
S11043、当至少一个检测电路中存在抵押检测电路当前时刻所处的工作状态位于第一检测电路的性能边界外，且位于安全芯片的性能边界内时，则第一检测电 路发出报警信号。
示例性的，如图11所示，在图11中横轴表示PVT(工艺、电压、温度)平面，纵轴表示安全芯片的时钟频率，坐标系中任意一点表示安全芯片工作时的工作频率和PVT条件。其中，曲线1201表示安全芯片的性能边界，曲线1202表示任意一个检测安全芯片工作状态的电路的性能边界。
第一方面，当安全芯片所处的工作状态处于检测安全芯片工作状态的电路的性能边界内时，即位于如图11中所示的A点时，则表示安全芯片所处的工作条件正常，则该安全芯片中的每个检测安全芯片工作状态电路均不发出报警信号。
第二方面，当安全芯片的工作状态位于曲线1202外且位于曲线1201内时，即如图11所示的B点，虽然安全芯片的所处的工作状态为正常条件，但是检测安全芯片工作状态的电路发出报警信号，这是由于，有可能安全芯片的局部工作状态发生变化，但这种变化并未影响到安全芯片整体的工作状态，因此，只要检测安全芯片工作状态的电路检测到所处的工作状态为非正常工作条件，即发出报警信号。
第三方面，当安全芯片的工作状态处在曲线1201外时，如图11中的C点，此时表明安全芯片可能出错，因此，检测安全芯片工作状态的电路必定会发出报警信号。
可选的，在步骤S1102之后，本发明实施例提供的方法还包括：
S1105、采取预设保护措施对安全芯片进行复位，以使得安全芯片所存储的数据不泄露。
示例性的，本发明实施例中的预设保护措施可以为复位整个安全芯片的工作电路(包括CPU电路、加解密电路、随机数生成电路)，使得安全信号处于初始状态。其中，该初始状态不包含任何敏感信息，擦除存储体中的所有数据。
以上所述，仅为本发明的具体实施方式，但本发明的保护范围并不局限于此，任何熟悉本技术领域的技术人员在本发明揭露的技术范围内，可轻易想到变化或替换，都应涵盖在本发明的保护范围之内。因此，本发明的保护范围应所述以权利要求的保护范围为准。
本领域内的技术人员应明白，本申请实施例可提供为方法、系统、或计算机程序产品。因此，本申请实施例可采用完全硬件实施例、完全软件实施例、或结合软件和硬件方面的实施例的形式。而且，本申请实施例可采用在一个或多个其中包含有计算机可用程序代码的计算机可用存储介质(包括但不限于磁盘存储器、CD-ROM、光学存储器等)上实施的计算机程序产品的形式。
本申请实施例是参照根据本申请实施例的方法、设备(系统)、和计算机程序产品的流程图和/或方框图来描述的。应理解可由计算机程序指令实现流程图和/或方框图中的每一流程和/或方框、以及流程图和/或方框图中的流程和/或方框的结合。可提供这些计算机程序指令到通用计算机、专用计算机、嵌入式处理机或其他可编程数据处理设备的处理器以产生一个机器，使得通过计算机或其他可编程数据处理设备的处理器执行的指令产生用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的装置。
这些计算机程序指令也可存储在能引导计算机或其他可编程数据处理设备以特 定方式工作的计算机可读存储器中，使得存储在该计算机可读存储器中的指令产生包括指令装置的制造品，该指令装置实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能。
这些计算机程序指令也可装载到计算机或其他可编程数据处理设备上，使得在计算机或其他可编程设备上执行一系列操作步骤以产生计算机实现的处理，从而在计算机或其他可编程设备上执行的指令提供用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的步骤。
显然，本领域的技术人员可以对本申请实施例进行各种改动和变型而不脱离本申请的精神和范围。这样，倘若本申请实施例的这些修改和变型属于本申请权利要求及其等同技术的范围之内，则本申请也意图包含这些改动和变型在内。

Claims (19)

  1. 一种检测安全芯片工作状态的电路，其特征在于，包括：第一寄存单元，与所述第一寄存单元连接的触发单元和延迟单元，与所述延迟单元连接的选路单元，与所述选路单元连接的第二寄存单元，所述第二寄存单元与所述触发单元连接；
    其中，第一寄存单元，用于在时钟信号有效时，根据输入至所述第一寄存单元的触发信号获取第一信号，以及将所述第一信号输出至所述延迟单元和所述第二逻辑门单元；
    所述延迟单元，用于将所述第一信号延迟不同时间段以产生多个延迟信号，并在所述时钟信号有效时，根据所述多个延迟信号生成多个第二信号；
    所述选路单元，用于从所述多个第二信号中选择一个第二信号，并将所选择的第二信号输出至所述第二寄存单元；
    所述第二寄存单元，用于在所述时钟信号有效时，根据接收的第二信号生成第三信号，并将所述第三信号输出至所述触发单元；
    所述触发单元，用于对所述第三信号和所述第一信号进行逻辑运算，获取电平信号，并根据所述电平信号确定是否输出报警信号。
  2. 根据权利要求1所述的电路，其特征在于，所述选路单元具体用于：
    接收选择信号；所述选择信号用于指示从所述多个第二信号中选择一个第二信号；
    根据所述选择信号从所述多个第二信号中选择一个第二信号。
  3. 根据权利要求1或2所述的电路，其特征在于，所述延迟单元包括至少一个第三寄存单元，以及与至少一个第三寄存单元中每个第三寄存单元相连的延迟链路；
    其中，所述延迟链路，用于将所述第一信号延迟不同时间段以产生多个延迟信号，并将所述多个延迟信号传送至不同的第三寄存单元；
    所述每个第三寄存单元，用于接收延迟信号，以及在时钟信号有效时，根据传输至所述第三寄存单元的延迟信号生成第二信号。
  4. 根据权利要求1-3任意一项所述的电路，其特征在于，所述触发单元具体用于：
    在所述电平信号为高电平信号时，输出报警信号。
  5. 根据权利要求1-4任意一项所述的电路，其特征在于，所述电路还包括反相单元，所述反相单元的输出端接所述第一寄存单元的输入端，所述反相单元的输入端接所述第一寄存单元的输出端，
    所述反相单元用于将所述第一寄存单元的输出端输出的第一信号进行反相，然后输入至所述第一寄存单元的输入端。
  6. 根据权利要求1-5任意一项所述的电路，其特征在于，所述延迟链路包括多个延迟元件，每个延迟元件用于将输入至该延迟元件的信号延迟预设周期，以使得第一信号经过不同个数的延迟元件后生成不同时间段的延迟信号。
  7. 根据权利要求1-6任意一项所述的电路，其特征在于，所述电路还包括：
    第四寄存单元、第五寄存单元和第一逻辑门单元；其中，所述第四寄存单元与 所述第二寄存单元、所述第五寄存单元以及所述第一逻辑门单元连接；
    其中，所述第四寄存单元用于接收所述第二寄存单元输出的第三信号，以及在所述时钟信号有效时生成第四信号，以及将所述第四信号输出至所述第五寄存单元以及所述第一逻辑门单元；
    第五寄存单元，用于接收所述第四寄存单元输出的第四信号，以及在时钟信号有效时，根据所述第四信号生成第五信号，并将所述第五信号输出至所述第一逻辑门单元；
    所述第一逻辑门单元，用于根据所述第四信号和所述第五信号生成触发信号，所述触发信号用于表明所述电路内部的元件正常。
  8. 根据权利要求1-7任意一项所述的电路，其特征在于，所述触发单元包括第二逻辑门单元和报警单元，其中，所述第二逻辑门单元和所述第一寄存单元相连，所述报警单元和所述第二逻辑门单元相连，所述第二逻辑门单元还与所述第二寄存单元相连；
    其中，所述第二逻辑门单元，用于对所述第三信号和所述第一信号进行逻辑运算，获取电平信号，并将所述电平信号发送至所述报警单元；
    所述报警单元，用于根据所述电平信号确定是否输出报警信号。
  9. 一种检测安全芯片工作状态的方法，其特征在于，应用于检测安全芯片工作状态的电路中，所述方法包括：
    在时钟信号有效时，根据输入至所述检测安全芯片工作状态的电路的触发信号获取第一信号；
    将所述第一信号进行延迟，以获取多个延迟信号，其中，所述多个延迟信号中每个延迟信号的时延均不同；
    根据所述多个延迟信号获取多个第二信号；
    从所述多个第二信号中选择一个第二信号，在所述时钟信号有效时，根据所选择的第二信号生成第三信号；
    在所述时钟信号有效时，对所述第一信号和所述第三信号进行逻辑运算，获取电平信号；
    根据所述电平信号确定是否输出报警信号。
  10. 根据权利要求9所述的方法，其特征在于，在所述从所述多个第二信号中选择一个第二信号之前，所述方法还包括:
    接收选择信号，所述选择信号用于指示从所述多个第二信号中选择一个第二信号；
    根据所述选择信号从所述多个第二信号中选择一个第二信号。
  11. 根据权利要求9或10所述的方法，其特征在于，所述根据输入至所述检测安全芯片工作状态的电路的触发信号获取第一信号之后，所述方法还包括：
    将当前时钟周期输出的第一信号进行反相，以确定下一时钟周期输入至所述安全芯片的触发信号。
  12. 根据权利要求9-11任意一项所述的方法，其特征在于，所述根据所述电平信号确定是否输出报警信号，包括：
    在所述电平信号为高电平信号时，则输出报警信号。
  13. 根据权利要求9-12任意一项所述的方法，其特征在于，所述方法还包括：
    在所述时钟信号有效时,根据所述第三信号生成第五信号；
    在时钟信号有效时，根据所述第五信号生成第六信号；
    根据所述第五信号和所述第六信号生成触发信号，所述触发信号用于表明所述电路的元件正常。
  14. 一种安全芯片的保护电路，其特征在于，所述安全芯片的保护电路应用于安全芯片中，所述安全芯片包括至少一个检测电路，其中，任意一个所述检测电路用于检测所述检测电路检测预设范围内的环境状态，并根据所述环境状态确定是否发出报警信号；
    所述检测电路采用如权利要求1-8任意一项所述的检测安全芯片工作状态的电路，所述检测安全芯片工作状态的电路与所述安全芯片具有相同的环境状态，所述环境状态至少包括时钟信号的时钟周期、电源、温度。
  15. 一种安全芯片的保护电路的检测方法，其特征在于，应用于如权利要求14所述的安全芯片的保护电路中，所述方法包括：
    在安全芯片启动后，若所述至少一个检测电路中存在任意一个检测电路发出报警信号，则表明所述安全芯片当前时刻工作在不安全的工作条件下。
  16. 根据权利要求15所述的方法，其特征在于，在所述至少一个检测电路中存在任意一个检测电路发出报警信号之前，所述方法还包括：
    获取所述至少一个检测电路中每个检测电路当前时刻所处的工作状态；
    根据所述每个检测电路当前时刻所处的工作状态与所述检测电路的性能边界之间的关系，所述每个检测电路确定是否发出报警信号。
  17. 根据权利要求16所述的方法，其特征在于，所述根据所述每个检测电路当前时刻所处的工作状态与所述检测电路的性能边界之间的关系，所述每个检测电路确定是否发出报警信号，包括：
    当所述至少一个检测电路中存在第一检测电路当前时刻所处的工作状态位于所述第一检测电路的性能边界外时，则所述第一检测电路发出报警信号，所述第一检测电路为所述至少一个检测电路中任意一个检测电路。
  18. 根据权利要求16所述的方法，其特征在于，所述根据所述每个检测电路当前时刻所处的工作状态与所述检测电路的性能边界之间的关系，所述每个检测电路确定是否发出报警信号，还包括：
    当所述至少一个检测电路中存在第一检测电路当前时刻所处的工作状态位于所述第一检测电路的性能边界内，则所述第一检测电路不发出报警信号，所述第一检测电路为所述至少一个检测电路中任意一个检测电路。
  19. 根据权利要求15-18任意一项所述的方法，其特征在于，在所述至少一个检测电路中存在任意一个检测电路发出报警信号之后，所述方法还包括：
    采取预设保护措施对所述安全芯片进行复位，以使得所述安全芯片恢复至初始状态。
PCT/CN2017/086212 2016-11-15 2017-05-26 一种检测安全芯片工作状态的方法及检测电路 WO2018090596A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201611021892.9A CN108073831B (zh) 2016-11-15 2016-11-15 一种检测安全芯片工作状态的方法及检测电路
CN201611021892.9 2016-11-15

Publications (1)

Publication Number Publication Date
WO2018090596A1 true WO2018090596A1 (zh) 2018-05-24

Family

ID=60413061

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2017/086212 WO2018090596A1 (zh) 2016-11-15 2017-05-26 一种检测安全芯片工作状态的方法及检测电路

Country Status (4)

Country Link
US (1) US10489595B2 (zh)
EP (1) EP3321839A1 (zh)
CN (1) CN108073831B (zh)
WO (1) WO2018090596A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114722767A (zh) * 2022-05-13 2022-07-08 紫光同芯微电子有限公司 用于安全芯片混合布局的方法及装置

Families Citing this family (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109144912B (zh) * 2018-09-06 2021-09-07 晶晨半导体(上海)股份有限公司 获取存储模块通信接口边界的方法及系统
US10782346B2 (en) * 2019-01-20 2020-09-22 Texas Instruments Incorporated Enhanced fault detection of latched data
CN111123071A (zh) * 2019-12-19 2020-05-08 江西智慧云测安全检测中心有限公司 一种芯片安全检测用单点激光攻击注入测试装置
CN112558923B (zh) * 2020-12-04 2023-07-04 航天信息股份有限公司 用于测试随机数产生器中的错误注入参数的方法、装置、存储介质及设备
WO2022178793A1 (zh) * 2021-02-26 2022-09-01 华为技术有限公司 一种延迟补偿方法以及相关设备
CN114416432B (zh) * 2022-03-29 2022-07-08 山东云海国创云计算装备产业创新中心有限公司 一种芯片安全启动检测方法、装置、设备及介质

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1971530A (zh) * 2006-12-19 2007-05-30 威盛电子股份有限公司 数字式温度感测系统
CN102520754A (zh) * 2011-12-28 2012-06-27 东南大学 一种面向动态电压调节系统的片上监测电路
CN103605597A (zh) * 2013-11-20 2014-02-26 中国科学院数据与通信保护研究教育中心 一种可配置的计算机保护系统及保护方法
CN105159374A (zh) * 2015-08-31 2015-12-16 东南大学 面向超宽电压的在线监测单元及监测窗口自适应调节系统

Family Cites Families (16)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CA2857208C (en) * 2003-05-30 2018-09-04 Privaris, Inc. An in-circuit security system and methods for controlling access to and use of sensitive data
US7301831B2 (en) * 2004-09-15 2007-11-27 Rambus Inc. Memory systems with variable delays for write data signals
US20080148343A1 (en) * 2006-12-19 2008-06-19 International Business Machines Corporation Debugging security mechanism for soc asic
KR100887238B1 (ko) * 2007-08-10 2009-03-06 삼성전자주식회사 파이프라인 시스템의 동적 클럭 제어 장치 및 방법
EP2149886B1 (fr) 2008-07-30 2012-06-06 STMicroelectronics (Rousset) SAS Protection d'un circuit électronique à bascules contre des injections de fautes
KR101977733B1 (ko) * 2012-07-12 2019-05-13 삼성전자주식회사 오류 기반 공격의 검출 방법
US9607153B2 (en) * 2013-03-13 2017-03-28 Qualcomm Incorporated Apparatus and method for detecting clock tampering
US9310862B2 (en) * 2013-05-20 2016-04-12 Advanced Micro Devices, Inc. Method and apparatus for monitoring performance for secure chip operation
US9396360B2 (en) * 2013-06-27 2016-07-19 Advanced Micro Devices, Inc. System and method for secure control over performance state
US9436844B2 (en) * 2013-08-29 2016-09-06 Microsoft Technology Licensing, Llc Access enablement security circuit
US9087192B2 (en) * 2013-09-10 2015-07-21 Infineon Technologies Ag Electronic circuit and method for monitoring a data processing
US9716708B2 (en) * 2013-09-13 2017-07-25 Microsoft Technology Licensing, Llc Security certificates for system-on-chip security
US10146282B2 (en) * 2013-10-31 2018-12-04 Advanced Micro Devices, Inc. System and method for monitoring and controlling a performance state change
US20150186676A1 (en) * 2014-01-01 2015-07-02 Mohit Arora Real-time clock (rtc) modification detection system
EP2960665B1 (en) 2014-06-27 2017-05-24 Secure-IC SAS Device and method for calibrating a digital sensor
DE102015110144B8 (de) * 2015-06-24 2018-06-28 Infineon Technologies Ag Chip und Verfahren zum Testen einer Verarbeitungskomponente eines Chips

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1971530A (zh) * 2006-12-19 2007-05-30 威盛电子股份有限公司 数字式温度感测系统
CN102520754A (zh) * 2011-12-28 2012-06-27 东南大学 一种面向动态电压调节系统的片上监测电路
CN103605597A (zh) * 2013-11-20 2014-02-26 中国科学院数据与通信保护研究教育中心 一种可配置的计算机保护系统及保护方法
CN105159374A (zh) * 2015-08-31 2015-12-16 东南大学 面向超宽电压的在线监测单元及监测窗口自适应调节系统

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114722767A (zh) * 2022-05-13 2022-07-08 紫光同芯微电子有限公司 用于安全芯片混合布局的方法及装置

Also Published As

Publication number Publication date
CN108073831B (zh) 2020-07-24
CN108073831A (zh) 2018-05-25
US20180137283A1 (en) 2018-05-17
EP3321839A1 (en) 2018-05-16
US10489595B2 (en) 2019-11-26

Similar Documents

Publication Publication Date Title
WO2018090596A1 (zh) 一种检测安全芯片工作状态的方法及检测电路
KR101312978B1 (ko) 성능 모니터링을 위한 임계―경로 회로
TWI521378B (zh) 偵測錯誤注入的裝置與方法
US20200186553A1 (en) System monitor
EP3423849B1 (en) Ultra-fast autonomous clock monitoring circuit for safe and secure automotive applications
CN103198347A (zh) 安全设备防篡改电路
CN107533607B (zh) 通过信号延迟监测来进行攻击检测
JP2021047850A (ja) ゲートクロックを用いたデータサンプリング整合性検査の電子デバイスおよび方法
Sumathi et al. A review on HT attacks in PLD and ASIC designs with potential defence solutions
EP2580864B1 (en) Integrated circuit device, electronic device and method for detecting timing violations within a clock
US20180349650A1 (en) Security policy management for a plurality of dies in a system-on-chip
US9506983B2 (en) Chip authentication using scan chains
US11879938B2 (en) Method for detecting perturbations in a logic circuit and logic circuit for implementing this method
US7574314B2 (en) Spurious signal detection
CN114338463B (zh) 基于脉冲收缩延时链的安全检测电路、设备及检测方法
JP2018142816A (ja) ＰＵＦ（Ｐｈｙｓｉｃａｌｌｙ Ｕｎｃｌｏｎａｂｌｅ Ｆｕｎｃｔｉｏｎ）コード生成装置およびＰＵＦコード認証システム
CN111800272B (zh) 一种针对ro puf输出响应的可靠性自检电路及方法
US11132483B2 (en) Method and arrangement for forming an electronic circuit
Moein et al. Hardware Trojan identification and detection
JP2017173068A (ja) 試験回路
Voyiatzis et al. Detecting untestable hardware Trojan with non-intrusive concurrent on line testing
EP3321764A1 (en) Clock frequency detection method and apparatus
Tang et al. Built‐in self‐monitor‐based finite state machines Trojans detection and self‐lock defence
CN115080961A (zh) 故障注入攻击检测电路及方法、电子设备及介质
Joe et al. Enhanced Hardware Trojan Detection And Deactivation The Trojan Circuit

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 17871211

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 17871211

Country of ref document: EP

Kind code of ref document: A1