WO2018090932A1 - 一种集成有安全组件的终端芯片 - Google Patents

一种集成有安全组件的终端芯片 Download PDF

Info

Publication number
WO2018090932A1
WO2018090932A1 PCT/CN2017/111140 CN2017111140W WO2018090932A1 WO 2018090932 A1 WO2018090932 A1 WO 2018090932A1 CN 2017111140 W CN2017111140 W CN 2017111140W WO 2018090932 A1 WO2018090932 A1 WO 2018090932A1
Authority
WO
WIPO (PCT)
Prior art keywords
power
interface
terminal chip
security component
application processor
Prior art date
Application number
PCT/CN2017/111140
Other languages
English (en)
French (fr)
Inventor
尹飞飞
刘宇
鹿甲寅
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to EP17872149.4A priority Critical patent/EP3534289B1/en
Priority to KR1020197016888A priority patent/KR102225283B1/ko
Priority to JP2019546965A priority patent/JP6814305B2/ja
Publication of WO2018090932A1 publication Critical patent/WO2018090932A1/zh
Priority to US16/412,932 priority patent/US11436376B2/en

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/70—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer
    • G06F21/71—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure computing or processing of information
    • G06F21/75—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure computing or processing of information by inhibiting the analysis of circuitry or operation
    • G06F21/755—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure computing or processing of information by inhibiting the analysis of circuitry or operation with measures against power attack
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/70—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer
    • G06F21/71—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure computing or processing of information
    • G06F21/72—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure computing or processing of information in cryptographic circuits
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/70—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer
    • G06F21/71—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure computing or processing of information
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/70—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer
    • G06F21/71—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure computing or processing of information
    • G06F21/75—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure computing or processing of information by inhibiting the analysis of circuitry or operation
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/70—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer
    • G06F21/81—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer by operating on the power supply, e.g. enabling or disabling power-on, sleep or resume operations
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/21—Indexing scheme relating to G06F21/00 and subgroups addressing additional information or applications relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/2107—File encryption

Definitions

  • the present invention relates to the field of chips, and in particular to a terminal chip integrated with a security component.
  • smart terminals With the improvement of the performance of smart terminals and the popularity of Internet applications, financial activities such as online payment through the wireless network of smart terminals have become part of people's daily lives.
  • security components often have built-in coprocessors, security applications for encryption and decryption and authentication, and corresponding protocol platforms.
  • the security component provides authentication and information encryption services for users of the smart terminal during the financial transaction process.
  • SIM card is a relatively common security component that is distributed by operators and can be used for authentication.
  • the U shield management client can be saved in the SIM card to meet the functional needs of the online banking of major banks.
  • the SIM card is generally connected to the system in the smart terminal through a dedicated slot on the smart terminal.
  • the security component is fixed in the form of a separate chip together with other components such as the processor chip of the intelligent terminal in the smart terminal, and the industry calls it an embedded security component.
  • embedded security component eSE for short
  • the function of the embedded security component chip is basically the same as that of the SIM card.
  • the embedded security component chip is customized by the terminal device manufacturer, its interface and communication module can be more flexibly set to interwork and share with other chips and components in the smart terminal.
  • Both the embedded security component chip and the processor chip are powered by the power management chip in the smart terminal.
  • power pin burr injection causes a voltage glitch injection through the power pins of the embedded security component chip.
  • the voltage glitch injection causes a short-term fluctuation of the voltage signal on the power supply pin. This short-term fluctuation causes the threshold voltage of the on-chip transistor to drift, causing the sampling input time of some flip-flops to be abnormal, eventually causing the trigger to enter an erroneous state, resulting in Misoperation.
  • the attacker can use the generated misoperation to perform modeling analysis, and thus may find important security information hidden in the embedded security component chip, which harms the user's interests.
  • the embodiment of the invention provides a terminal chip.
  • the terminal chip includes a security component, an application processor, and an interface module for communicating information between the application processor and the security component.
  • the terminal chip is provided with a first power interface for receiving power from outside the terminal chip.
  • a first power port of the security component is connected to the first power interface, and a power port of at least one of the application processor and the interface module is connected to the first power interface.
  • the power port of the security component is connected to the application processor of the terminal chip or the power port of the interface module. Therefore, when a power attack occurs, the power supply may cause an abnormality in the application processor or the interface module of the terminal chip.
  • the abnormality of the application processor and the interface module may result in the information in the security component not being correctly acquired by the outside, so that an attacker cannot obtain sensitive information in the security component through a power attack.
  • the terminal chip includes a plurality of interface modules, such as a bus and a memory controller, and at least one of the application processor, the memory, and the memory controller is connected to the first power interface.
  • a plurality of interface modules such as a bus and a memory controller
  • the first power interface is a digital power interface.
  • the terminal chip is further provided with a second power interface, and the second power interface is an analog power source.
  • the security component also includes an analog power port that is connected to the analog power interface.
  • the terminal chip further includes a high speed interface physical layer circuit, a phase locked loop circuit, and an electrical programming fuse circuit, at least one of the high speed interface physical layer circuit, the phase locked loop circuit, and the electrically programmed fuse circuit being connected to the An analog power interface is connected to the analog power interface. Therefore, when the power attack is initiated from the analog power interface, the damage of the high-speed interface physical layer circuit, the phase-locked loop circuit or the electrical programming fuse circuit can also affect the normal operation of the application processor, thereby improving the attacker. The difficulty of getting sensitive information from security components.
  • the lowest timing margin in the security component is greater than the lowest timing margin of the application processor or interface module connected to the first power interface, thereby ensuring that the application processor or interface module is in the power supply. An exception will occur first under the attack.
  • a system for secure verification is provided in the security component.
  • the security component includes a coprocessor, a secure bus, and a module for encryption and decryption and authentication.
  • FIG. 1 is a schematic diagram of a terminal device according to an embodiment of the present invention.
  • FIG. 1 is a schematic structural diagram of a terminal device according to an embodiment of the present invention.
  • the terminal device includes a terminal chip 10, an off-chip memory 20, and a power management unit 30 (PMU).
  • the terminal chip 10 is provided with an application processor 12, a bus 14 (Bus), a memory controller 16, and a security component 18.
  • the application processor 12 is generally a so-called Central Processing Unit (CPU) for performing tasks according to instructions of various applications.
  • the application processor 12 interacts with other modules within the host chip 10 via a bus 14.
  • the application processor 12 when an application having security requirements accesses the security component, the application processor 12 writes the access request to the off-chip memory 20 through the memory controller 16, and The security component 18 is notified to extract the access request from the off-chip memory 20 via the memory controller 16.
  • the security component 18 When the security component 18 has data to be passed back to the application processor 12, the security component 18 also writes the backhaul data to the off-chip memory 20 through the memory controller 16, and notifies the The application processor 12 extracts the backhaul data from the off-chip memory 20.
  • the security component 18 is similar in function to the security component described in the background section for providing security services such as authentication, encryption and decryption for tasks with security requirements under the security system.
  • the security component The various modules of 18 are integrated within the terminal chip and interact with the application processor 12 and off-chip memory 20 via a unique interface.
  • the security component 18 of the embodiment of the present invention includes a coprocessor 182, an interaction interface 183, a secure memory 184, a storage plus descrambling module 185, a security bus 186, and a sensor module 187.
  • the coprocessor 182 is configured to coordinate and schedule various tasks under the security system.
  • An IPC (Inter-Process Communication) module 1832 and a shared cache 1834 are provided in the interaction interface 183.
  • the IPC module is configured to send an interrupt request to the application processor 12 or the coprocessor 182, and the shared cache 1834 is configured to simultaneously cache the request to be executed for the application processor 12 or the coprocessor 182. data.
  • the shared cache 1834 is the only data interface that all security components 18 have with the outside world. When the interrupt chip 10 has request data to be processed by the security component 18, the request data is generally first saved in the off-chip memory 20, and then the request is sent by the application processor 12 over the bus. Data is written to the shared cache 1834 and an interrupt request is sent to the coprocessor 182 via the bus 13 and the IPC module 1832.
  • the coprocessor 182 After receiving the interrupt request, the coprocessor 182 extracts the request data from the shared cache and executes a corresponding task. After the coprocessor 182 performs the completion of the request data, the processing result may be written into the shared cache 1834, and then the IPC module is instructed to send an interrupt request through the bus 14 to notify the application processor 12 to extract the location. Describe the processing results.
  • Interrupt requests cause the receiver to interrupt the currently ongoing operation or application.
  • Security-related applications such as online payments, financial transactions, etc., often have high-priority requirements. Therefore, by interrupting the request, it can be ensured that the coprocessor in the security component 18 can extract and execute the request data in the cache 1834 in a high priority manner.
  • the secure memory 184 acts as dedicated memory for the coprocessor 182 for system or platform code.
  • the secure memory 184 is generally provided with two kinds of memories, a ROM (Read-Only Memory) and a RAM (Ramdom Access Memory). Among them, ROM is used to store the code of security system startup, self-test and initialization; RAM is used to store security application code and data such as security-related operating system software.
  • the verification module 185 is configured to perform an identity verification related operation according to the request data received from the shared cache 1834, such as generating a random number, key management, encryption and decryption, and the like.
  • the security bus 186 is configured to provide bus services for modules within the security component 18.
  • the sensor module 187 includes a digital sensor and an analog sensor for detecting that the security component 18 is subject to an illegal physical intrusion and issuing an alert to the coprocessor 182.
  • the coprocessor 182 protects sensitive information in the security component by means of resetting or clearing registers.
  • the terminal chip 10 is further provided with a power interface 17.
  • the power interface 17 can be a pin of the terminal chip 10.
  • the power interface 17 is connected to the power management unit 30 for receiving power from the power management unit 30 and supplying power to a plurality of modules in the terminal chip 10.
  • the power port of the security component 18 is connected to the power interface 17 for connecting through the power interface 17 Power is collected to meet the power needs of the various modules within the security component 18.
  • a voltage input of at least one of the application processor 12, the bus 14 and the memory controller 16 is coupled to the power interface 17 for receiving power through the power interface 17 for meeting respective power needs. Therefore, when an attacker initiates a power attack through the power interface 17, the application processor 12, the bus 14 or the memory controller 16 will first generate an abnormality, so that the attacker cannot obtain accurate feedback information of the security component 18, thereby avoiding information leakage.
  • the minimum timing margin in each register array inside the security component 18 is made larger than the application connected to the power interface 17.
  • timing margin is introduced here.
  • Integrated circuits such as Field-Programmable Gate Array (FPGA) are very common combinations in current integrated circuits and can be used to transfer instructions and data.
  • FPGAs are widely used in terminal modules for functional modules including processors, buses, and memory controllers.
  • the security components in the embodiments of the present invention also include corresponding integrated circuits of coprocessors, security buses, and storage controls, and naturally include various FPGAs.
  • Registers are the basic unit in an FPGA. During the operation of the FPGA, digital signals are passed between registers. As shown in FIG. 2, register D1 passes a signal of 0 or 1 to register D2. Registers D1 and D2 operate under the control of a uniform clock signal. The clock signal shown in Figure 2 has three rising edges, Edge0, Edge1, and Edge2. Register D1 begins transmitting the signal on the rising edge Edge0. Since there is a delay in the process of latching the data by the register, in order to ensure that the register D2 can properly latch the signal, the signal needs to arrive at the register D2 a certain time before the rising edge Edge1 arrives. The "advance time" can be regarded as "sequence margin".
  • the register D2 can correctly latch the signal sent by the register D1. If the size of the timing margin does not satisfy the time when the register D2 latches the signal, that is, when the rising edge Edge1 arrives, the register D2 does not successfully latch the signal issued by the register D1, and the signal finally latched by the register D2 may have an error.
  • the timing margin that can satisfy the normal operation has a minimum value, that is, under normal operation, as long as To meet the minimum timing margin, then two adjacent registers can correctly pass signals to each other.
  • designing the integrated circuit will ensure that the timing margin can meet the requirements.
  • the signal transfer between two adjacent registers creates an additional delay, resulting in insufficient timing margin. Therefore, the larger the timing margin, the stronger the ability of the register array to withstand power attacks.
  • a stricter standard is applied to the timing margin of each register array in the security component 18 during the design phase to ensure the lowest in the security component 18.
  • the timing margin is greater than the lowest timing margin of the bus, memory controller, or application processor that is also connected to power interface 17.
  • the bus, the memory controller, or the application processor may have an abnormality in the register array.
  • the external information path of the security component 18 may be confusing under the power attack, and the attacker does not have an attack.
  • the method obtains sensitive information in the security component 18 by abnormal feedback of the power attack.
  • the application processor 12, the bus 14 and the memory controller are In addition to the 16th, the working state of other interface modules in the terminal chip can directly affect the data entering and leaving the security component 18, and connecting the power supply port of the interface module and the security component to the same power pin, The technical effect of the present invention is achieved.
  • the data sent by the register D1 to the register D2 is subjected to two delays before reaching the register D2.
  • the register D1 starts triggering the transmission of the data at the time of Edge0, and the data is officially left from the register D1 after a certain time t1, where the time t1 is caused by the propagation of the register D1 itself.
  • the time t1 is named as the transmission delay.
  • the path of the signal on the path between the register D1 and the register D2 will take time. There will also be various logic devices between the register D1 and the register D2, and the signals will also consume time through these logic devices. .
  • the time consumed by the signal on the path between the registers D1 and D2 is added to the time consumed by the logic device between the registers D1 and D2 to obtain the time t2 as a path. Delay.
  • the signal Edge0 is transmitted by the register D1, and the register D2 is reached after the time t1+t2. Since the time interval between Edge0 and Edge1 is fixed, increasing the timing margin can be achieved by shortening the time t1+t2. To shorten the time t1+t2, a more sensitive register can be selected to shorten the transmission delay t1, or to simplify the logic between registers to shorten the path delay t2.
  • the terminal chip will have two power interfaces, namely a digital power interface and an analog power interface.
  • the digital power interface is generally connected to a digital voltage of 0.8v (16nm, 0.8v under the new 28nm process, other old process data supply voltage may be greater than 0.8v), used for application processor, bus and memory control in the terminal chip
  • Digital functional devices such as devices provide power. So the power interface described above is actually a digital power interface.
  • important components such as coprocessors, authentication modules, and safety buses within the security component are inputs that require digital power. Therefore, it is very important to prevent power attacks initiated from the digital power side.
  • the analog power interface is generally connected to the analog voltage of 1.8v (1.8v under the new process of 16nm and 28nm, and the power supply voltage of other old process data may be higher than 1.8v). It is generally used for the physical layer of the high-speed interface of the chip memory in the terminal chip. Analog devices such as DDR-phy, Phase Locked Loop (PLL), and efuse circuits (electrically programmed fuses) provide power. In the security component 18, the analog power input is often required for monitoring and sensing circuits, and these circuits do not involve the processing and storage of sensitive information. Therefore, an attacker's power attack from an analog power source does not pose a significant risk of compromise.
  • PLL Phase Locked Loop
  • the security component As an integrated module built into the terminal chip, the security component has a small area in the terminal chip. Therefore, the security component as a whole generally has only two power input ports, an analog power input and a digital power input.
  • the digital power input and the analog power input are respectively connected to a digital power interface and an analog power interface of the terminal chip.
  • the terminal chip should consider the wiring needs, and it is possible to have multiple digital power inputs or multiple analog power terminals.
  • the bus, the memory controller or the application processor of the terminal chip and the digital power input of the security component are connected to the same digital power interface, thereby preventing information in the security component.
  • the lowest timing margin of the module connected to the digital power interface in the security component is greater than the minimum timing margin of the bus, the storage controller or the application processor of the terminal chip, which can better serve of Security effect.
  • the function module that receives the analog power input in the terminal chip may interfere with the attacker's function through the terminal chip if an abnormality occurs under power attack.
  • the module steals sensitive information within the security component. Therefore, in a special scenario, some function modules of the terminal chip that receive the analog power input may be connected to the same analog power interface, and the lowest timing of the corresponding module of the security component may be selected. The amount is greater than the lowest timing margin of other modules connected to the analog power interface.
  • the disclosed system can be implemented in other ways.
  • the device embodiments described above are merely illustrative.
  • the division of the modules is only a logical function division.
  • there may be another division manner for example, multiple units or components may be combined or Can be integrated into another system, or some features can be ignored or not executed.
  • the mutual coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection through some interface, device or unit, and may be in an electrical, mechanical or other form.
  • the modules described as separate components may or may not be physically separate.
  • the components displayed as modules may or may not be physical units, that is, may be located in one place, or may be distributed to multiple network nodes. Some or all of the nodes may be selected according to actual needs to achieve the purpose of the solution of the embodiment.
  • each functional module in each embodiment of the present invention may be integrated into one processing unit, or each module may exist physically separately, or two or more modules may be integrated into one unit.
  • the above integrated unit can be implemented in the form of hardware or in the form of a software functional unit.

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Computer Hardware Design (AREA)
  • Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • Software Systems (AREA)
  • Computer Security & Cryptography (AREA)
  • General Physics & Mathematics (AREA)
  • Mathematical Physics (AREA)
  • Health & Medical Sciences (AREA)
  • Bioethics (AREA)
  • General Health & Medical Sciences (AREA)
  • Storage Device Security (AREA)
  • Semiconductor Integrated Circuits (AREA)

Abstract

本发明提供一种终端芯片。所述终端芯片包括安全组件，应用处理器，以及用于在所述应用处理器和所述安全组件之间传递信息的接口模块，所述终端芯片上设有第一电源接口，用于从所述终端芯片外部接收电力，所述安全组件的第一供电端口被连接到所述第一电源接口，所述应用处理器和所述接口模块中的至少一个被连接到所述第一电源接口。在本发明的终端芯片中，所述安全组件的电源端口与终端芯片的应用处理器或接口模块的电源端口连接到一起。因此，当发生电源攻击时，电源攻击会使得应用处理器或者接口模块发生异常，从而导致所述安全组件内的信息无法被外部正确获取。

Description

一种集成有安全组件的终端芯片 技术领域
本发明涉及芯片领域，尤其涉及一种集成有安全组件的终端芯片。
背景技术
随着智能终端的性能的提升，以及互联网应用的普及，通过智能终端的无线网络进行在线支付等金融活动已经成了人们日常生活的一部分。为了降低随之而来的金融安全风险，智能终端一般都要搭配安全组件。所述安全组件往往内置协处理器、用于加解密和验证的安全应用以及对应协议平台。所述安全组件在金融交易过程中，为智能终端的用户提供身份验证和信息加密的服务。
SIM卡是一种比较常见的安全组件，其由运营商分发，可以用于身份验证。甚至，可以在SIM卡中保存U盾管理客户端，用来满足各大银行的网络银行的功能需要。SIM卡一般都是通过智能终端上的专用插槽，来与智能终端中的系统连接。
随着生产工艺的进步，近来又出现了将安全组件以独立芯片的形式与智能终端的处理器芯片等其他组件一起固定在智能终端内的背板上，业界将其称为内嵌式安全组件(Embedded Security Element，简称eSE)芯片。内嵌式安全组件芯片的功能与SIM卡基本一致。不过，由于内嵌式安全组件芯片是由终端设备制造商订制，因此其接口和通信模块可以更灵活的设置，以便与智能终端内的其他芯片和组件互通和共享。
内嵌式安全组件芯片和处理器芯片都通过智能终端内的电源管理芯片供电。现在存在一种攻击方式，名叫电源管脚毛刺注入。攻击者通过在内嵌式安全组件芯片的电源管脚做电压毛刺注入。电压毛刺注入使得电源管脚上的电压信号产生短暂波动，这种短暂波动会造成芯片内晶体管的阈值电压发生漂移，使得一些触发器的采样输入时间异常，最终导致触发器进入错误的状态，产生误操作。攻击者可以利用产生的误操作进行建模分析，进而可能会发现隐藏在内嵌式安全组件芯片中的重要安全信息，损害用户利益。
因此，有必要提供一种解决方案，避免安全组件在受到电源攻击时泄露安全信息。
发明内容
本发明实施例提供了一种终端芯片。所述终端芯片包括安全组件、应用处理器，以及用于在所述应用处理器和所述安全组件之间传递信息的接口模块。所述终端芯片上设有第一电源接口，用于从所述终端芯片外部接收电力。所述安全组件的第一供电端口被连接到所述第一电源接口，所述应用处理器和所述接口模块中的至少一个的电源端口被连接到所述第一电源接口。
在本发明实施例的终端芯片中，所述安全组件的电源端口与终端芯片的应用处理器或接口模块的电源端口连接到一起。因此，当发生电源攻击时，电源同时会使得终端芯片的应用处理器或者接口模块发生异常。所述应用处理器和所述接口模块的异常会导致所述安全组件内的信息无法被外部正确获取，使得攻击者无法通过电源攻击获取安全组件内的敏感信息。
所述终端芯片包括多个接口模块，比如总线和内存控制器，所述应用处理器、所述内存和所述内存控制器中的至少一个被连接到所述第一电源接口。
所述第一电源接口为数字电源接口。
所述终端芯片还设有第二电源接口，所述第二电源接口为模拟电源。所述安全组件还包括模拟电源端口，所述模拟电源端口被连接至所述模拟电源接口。
所述终端芯片还包括高速接口物理层电路、锁相环电路以及电编程熔丝电路，所述高速接口物理层电路、锁相环电路以及电编程熔丝电路中的至少一个被连接至所述模拟电源接口，所述模拟电源端口被连接至所述模拟电源接口。从而当所述电源攻击从所述模拟电源接口发起时，所述高速接口物理层电路、锁相环电路或电编程熔丝电路的损坏，也能够影响应用处理器的正常工作，从而提高攻击者从安全组件中获取敏感信息的难度。
为了进一步提高安全性，所述安全组件中的最低时序余量大于被连接到所述第一电源接口上的应用处理器或接口模块的最低时序余量，从而保证应用处理器或者接口模块在电源攻击下会先发生异常。
所述安全组件中设有用于安全验证的系统。
所述安全组件中包括协处理器，安全总线，以及用于加解密、身份验证的模块。
附图说明
为了更清楚地说明本发明实施例的技术方案，下面将对本发明实施例中所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图仅仅是本发明的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动的前提下，还可以根据这些附图获得其他的附图。
图1是本发明实施例的终端设备的示意图；
图2是有关集成电路中的“时序余量”的指示图。
具体实施方式
图1是本发明实施例的终端设备的架构示意图。如图所示，所述终端设备包括终端芯片10，片外内存20以及电源管理单元30(Power Management Unit，简称PMU)。所述终端芯片10内设有应用处理器12，总线14(Bus),内存控制器16，以及安全组件18。
所述应用处理器12，一般即为所谓的中央处理器(Central Process ing Unit，简称CPU)，用于按照各种应用程序的指示执行任务。所述应用处理器12通过总线14与所述主芯片10内的其他模块进行交互。在可选择实施例中，当具有安全需求的应用程序要访问所述安全组件时，所述应用处理器12将所述访问请求通过所述内存控制器16写入所述片外内存20，并通知所述安全组件18通过所述内存控制器16从所述片外内存20中提取所述访问请求。当所述安全组件18有数据要回传给所述应用处理器12时，所述安全组件18也通过所述内存控制器16将回传数据写入所述片外内存20，并通知所述应用处理器12从所述片外内存20中提取所述回传数据。
所述安全组件18在功能上与背景技术部分记述的安全组件相似，用于在安全系统下针对有安全需求的任务提供认证、加解密等安全服务。在本发明实施例中，所述安全组件 18的各个模块被集成于所述终端芯片内部，并通过唯一的接口与所述应用处理器12和片外内存20进行数据交互。如图1所示，本发明实施例的安全组件18包括协处理器182，交互接口183，安全内存184，存储加解扰模块185，安全总线186，以及感应器模块187。
所述协处理器182，用于在安全系统下协调和调度各种任务。
所述交互接口183中设有IPC(Inter-Process Communication，进程间通信)模块1832，以及共享缓存1834。IPC模块用于向所述应用处理器12或者所述协处理器182发送中断请求，所述共享缓存1834则用于同时为所述应用处理器12或者所述协处理器182缓存待执行的请求数据。所述共享缓存1834是所有安全组件18与外界唯一的数据接口。当所述中断芯片10有请求数据需要所述安全组件18处理时，所述请求数据一般都会首先被保存在所述片外内存20中，然后由所述应用处理器12通过总线将所述请求数据写入到所述共享缓存1834中，并通过所述总线13和所述IPC模块1832向所述协处理器182发送中断请求。所述协处理器182接收到所述中断请求后，就从所述共享缓存中提取所述请求数据，并执行对应的任务。当所述协处理器182执行完成所述请求数据后，可以将处理结果写入所述共享缓存1834中，然后命令IPC模块，通过总线14发送中断请求，来通知所述应用处理器12提取所述处理结果。
中断请求，顾名思义，会使得接收方中断当前正在进行的操作或者应用。与安全相关的应用，比如在线支付、金融交易等，往往具有高优先级的需求。因此，通过中断请求的方式能保证所述安全组件18中的协处理器可以用高优先级地方式提取所述缓存1834中的请求数据并执行。
所述安全内存184，作为所述协处理器182的专用内存，用于系统或平台代码。所述安全内存184中一般设有ROM(Read-Only Memory，只读存储器)和RAM(Ramdom Access Memory，随即接入存储器)两种存储器。其中，ROM用来保存安全系统启动、自检及初始化的代码；RAM则用来存储安全相关的操作系统软件等安全应用代码和数据。
所述验证模块185，用于根据接收自所述共享缓存1834的请求数据，执行身份验证相关的工作，比如生成随机数、密钥管理、加解密等。
所述安全总线186，用于为所述安全组件18内的模块提供总线服务。
所述感应器模块187包括数字感应器和模拟感应器，用于检测所述安全组件18受到非法物理入侵，并发出告警给所述协处理器182。所述协处理器182会采用复位或者清除寄存器等方式保护安全组件中的敏感信息。
当然，除上述模块之外，终端芯片和所述安全组件内还有很多其他功能模块，在这里不一一进行介绍。
在本发明实施例中，所述终端芯片10上还设有电源接口17。在可选择的实施方式中，所述电源接口17可以为所述终端芯片10的一支管脚。所述电源接口17与所述电源管理单元30连接，用于自所述电源管理单元30处接收电力，并将电力供应给所述终端芯片10中的多个模块。
所述安全组件18的电源端口与所述电源接口17相连，用于通过所述电源接口17接 收电力，以满足所述安全组件18内部的各个模块的电力需要。同时，所述应用处理器12、总线14以及内存控制器16中的至少一个的电压输入端与所述电源接口17相连，用于通过所述电源接口17接收电力用于满足各自的电力需要。从而当有攻击者通过电源接口17发动电源攻击时，应用处理器12、总线14或内存控制器16就会先发生异常，导致攻击者无法获得安全组件18的准确反馈信息，避免了信息泄露。
为了更好地避免安全组件17在电源攻击下信息泄露的问题，在本发明实施例中，使得所述安全组件18内部各个寄存器阵列中的最小时序余量大于与所述电源接口17相连的应用处理器12、总线14或者内存控制器16的最小时序余量。通过这种方法，使得当有电源攻击时，所述应用处理器12、总线14或者内存控制器16中会有寄存器阵列先出现异常。
为了便于理解本发明实施例的技术内容，这里介绍一下时序余量的概念。
现场可编程逻辑门阵列(Field-Programmable Gate Array，简称FPGA)等集成电路是当前集成电路中非常常用的组合方式，可以用于传递指令和数据。FPGA在终端芯片内更是被广泛应用于包括处理器、总线和内存控制器在内的功能模块中。本发明实施例中的安全组件中也包括协处理器、安全总线和存储控制的相应集成电路，自然也包括了各种FPGA。
寄存器是FPGA中的基本单元，在FPGA运作的过程中，数字信号在一个个寄存器间传递。如图2所示，寄存器D1向寄存器D2传递信号0或者1。寄存器D1和D2均在统一的时钟信号的控制下工作。在图2中所示的时钟信号有三个上升沿，分别是Edge0、Edge1和Edge2。寄存器D1在上升沿Edge0开始发送所述信号。由于寄存器在锁存所述数据的过程中会存在延时，为了保证寄存器D2能正确地锁存所述信号，所述信号需要在上升沿Edge1到来之前再提前一段时间到达寄存器D2。所述的“提前一段时间”即可以被视作“时序余量”。如果时序余量的大小能满足寄存器D2在上升沿Edge1到来前锁存所述信号，则所述由寄存器D2就能正确的锁存寄存器D1发出的信号。如果时序余量的大小没有满足寄存器D2锁存所述信号的时间，即上升沿Edge1到来时寄存器D2没有成功锁存寄存器D1发出的信号，则寄存器D2最终锁存的信号可能会发生错误。
从上述描述中不难看出，对于设定好的两个相邻的寄存器及其之间的组合逻辑来说，能满足正常工作的时序余量是存在最小值的，即在正常工作下，只要满足最小时序余量，那么两个相邻的寄存器就可以彼此正确的传递信号。在正常的情况下，设计集成电路都会保证时序余量能够满足要求。但是，在受到电源攻击的情况下，两个相邻寄存器间的信号传递就会产生额外的延时，从而导致时序余量不足。因此，时序余量越大，寄存器阵列承受电源攻击的能力就越强。
在本发明实施例中，在满足正常工作的最低时序余量的前提下，在设计阶段就对安全组件18内的各个寄存器阵列的时序余量采用更严格的标准，保证安全组件18中的最低时序余量大于同样被连接到电源接口17的总线、内存控制器或应用处理器的最低时序余量。通过这样的方式，当发生电源攻击时，总线、内存控制器或应用处理器会有寄存器阵列先发生异常，结果就是在电源攻击下所述安全组件18的对外信息路径会发生混乱，攻击者没有办法通过电源攻击的异常反馈获得所述安全组件18中的敏感信息。
当然，在可选择的实施例中，如果除所述应用处理器12、总线14和所述内存控制器 16之外，终端芯片中还有其他接口模块的工作状态能直接影响数据进出所述安全组件18，将所述接口模块和所述安全组件的供电端口连接至同一个电源管脚上，一样能实现本发明的技术效果。
在应用处理器、总线、内存控制器以及安全组件18这样的功能模块中，往往会有多个寄存器阵列。
在图2中，所述寄存器D1向所述寄存器D2发送的数据在到达寄存器D2之前要经过两段延时。寄存器D1在Edge0的时刻开始触发所述数据的发送，在经过某个很小的时间t1之后才会使得所述数据从寄存器D1正式离开，这里的时间t1是由寄存器D1本身带来的传播时延，在本发明实施例中，时间t1被命名为发送时延。信号在寄存器D1和到达所述寄存器D2之间的路径上的路径会消耗时间，所述寄存器D1和所述寄存器D2之间还会设有各种逻辑器件，信号通过这些逻辑器件也会消耗时间。在本发明实施例中，把所述信号在所述寄存器D1和D2间的路径上消耗的时间，与通过所述寄存器D1和D2间的逻辑器件所消耗的时间相加得到时间t2，作为路径时延。由此，所述信号Edge0被寄存器D1发送，要经过时间t1+t2才能达到所述寄存器D2。由于Edge0和Edge1之间的时间间隔是固定的，因此，要增大时序余量可以通过缩短所述时间t1+t2来实现。要缩短所述时间t1+t2，可以选用更敏感的寄存器，来缩短发送时延t1，或者，简化寄存器之间的逻辑器件，来缩短路径时延t2。
在实际产品中，终端芯片会有两种电源接口，分别是数字电源接口和模拟电源接口。数字电源接口在一般接0.8v的数字电压(16nm，28nm新工艺下是0.8v，其他老工艺数据电源电压可能会大于0.8v)，用于为终端芯片中的应用处理器、总线和存储控制器等数字功能器件提供电力。所以上文所述的电源接口其实就是一个数字电源接口。对于所述安全组件来说，安全组件内部的协处理器、验证模块和安全总线等重要器件都是需要数字电源的输入。因此，防止从数字电源侧发起的电源攻击有非常重要的意义。
模拟电源接口一般接1.8v的模拟电压(16nm、28nm新工艺下是1.8v，其它老工艺数据电源电压可能会比1.8v高)，一般用于为终端芯片内的芯片存储器的高速接口物理层电路(DDR-phy)、锁相环电路(Phase Locked Loop，简称PLL)以及efuse电路(电编程熔丝)等模拟器件提供电力。而安全组件18中则往往是监控和感应电路等需要模拟电源输入，这些电路不涉及敏感信息的处理和存放。因此，攻击者从模拟电源发起的电源攻击并不会造成很大的泄密风险。
安全组件作为终端芯片内置的集成模块，其本身面积在终端芯片中的占比很小。因此，安全组件作为一个整体一般来说仅拥有两个电源输入端口，分别为模拟电源输入和数字电源输入。所述数字电源输入和所述模拟电源输入被分别连接所述终端芯片的数字电源接口和模拟电源接口。终端芯片要考虑布线需要，有可能有多个数字电源输入端，或者多个模拟电源端。无论如何，按照上文实施例中所述，将终端芯片的总线、存储控制器或应用处理器与所述安全组件的数字电源输入连接至同一个数字电源接口上，能防止安全组件中的信息泄露。并且，使得所述安全组件内的接在所述数字电源接口上的模块的最低时序余量大于所述终端芯片的总线、存储控制器或应用处理器的最低时序余量，能起到更好的 安全效果。
不过，终端芯片中的接收模拟电源输入的功能模块，比如芯片存储器的高速接口物理层电路、锁相环电路或eFuse电路，如果在电源攻击下发生异常，也会干扰攻击者通过终端芯片的功能模块窃取安全组件内的敏感信息。因此，在特殊场景下，也可以选择将终端芯片的某些接收模拟电源输入的功能模块与所述安全组件接在同一个模拟电源接口上，并使得所述安全组件的对应模块的最低时序余量大于接在所述模拟电源接口上的其他模块的最低时序余量。
在本申请所提供的实施例中，应该理解到，所揭露的系统可以通过其它的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，例如，所述模块的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，装置或单元的间接耦合或通信连接，可以是电性，机械或其它的形式。
所述作为分离部件说明的模块可以是或者也可以不是物理上分开的，作为模块显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络节点上。可以根据实际的需要选择其中的部分或者全部节点来实现本实施例方案的目的。
另外，在本发明各个实施例中的各功能模块可以集成在一个处理单元中，也可以是各个模块单独物理存在，也可以两个或两个以上模块集成在一个单元中。上述集成的单元既可以采用硬件的形式实现，也可以采用软件功能单元的形式实现。
以上所述，以上实施例仅用以说明本发明的技术方案，而非对其限制；尽管参照前述实施例对本发明进行了详细的说明，本领域的普通技术人员应当理解：其依然可以对前述各实施例所记载的技术方案进行修改，或者对其中部分技术特征进行等同替换；而这些修改或者替换，并不使相应技术方案的本质脱离本发明各实施例技术方案的精神和范围。

Claims (10)

  1. 一种终端芯片，其特征在于，包括安全组件，应用处理器，以及用于在所述应用处理器和所述安全组件之间传递信息的接口模块，所述终端芯片上设有第一电源接口，用于从所述终端芯片外部接收电力，所述安全组件的第一供电端口被连接到所述第一电源接口，所述应用处理器和所述接口模块中的至少一个被连接到所述第一电源接口。
  2. 如权利要求1所述的终端芯片，其特征在于，所述终端芯片包括多个所述接口模块，所述多个接口模块中的至少一个被连接到所述第一电源接口。
  3. 如权利要求1或2所述的终端芯片，其特征在于，所述接口模块为总线或内存控制器。
  4. 如权利要求1-3中任一项所述的终端芯片，其特征在于，所述第一电源接口为数字电源接口。
  5. 如权利要求1-4中任一项所述的终端芯片，其特征在于，所述终端芯片还设有第二电源接口，所述第二电源接口为模拟电源。
  6. 如权利要求5所述的终端芯片，其特征在于，所述第一供电端口为数字电源端口，所述安全组件还包括模拟电源端口，所述模拟电源端口被连接至所述模拟电源接口。
  7. 如权利要求6所述的终端芯片，其特征在于，所述终端芯片还包括高速接口物理层电路、锁相环电路以及电编程熔丝电路，所述高速接口物理层电路、锁相环电路以及电编程熔丝电路中的至少一个被连接至所述模拟电源接口。
  8. 如权利要求1-7中任一项所述的终端芯片，其特征在于，所述安全组件中的最低时序余量大于被连接到所述第一电源接口上的应用处理器或接口模块的最低时序余量。
  9. 如权利要求1-8中任一项所述的终端芯片，其特征在于，所述安全组件中设有用于安全验证的系统。
  10. 如权利要求1-9中任一项所述的终端芯片，其特征在于，所述安全组件中包括协处理器，安全总线，以及用于加解密、身份验证的模块。
PCT/CN2017/111140 2016-11-15 2017-11-15 一种集成有安全组件的终端芯片 WO2018090932A1 (zh)

Priority Applications (4)

Application Number Priority Date Filing Date Title
EP17872149.4A EP3534289B1 (en) 2016-11-15 2017-11-15 Terminal chip integrated with security component
KR1020197016888A KR102225283B1 (ko) 2016-11-15 2017-11-15 보안 요소가 집적된 단말 칩
JP2019546965A JP6814305B2 (ja) 2016-11-15 2017-11-15 セキュリティ要素と一体化される端末チップ
US16/412,932 US11436376B2 (en) 2016-11-15 2019-05-15 Terminal chip integrated with security element

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201611006033.2 2016-11-15
CN201611006033.2A CN108073830B (zh) 2016-11-15 2016-11-15 一种集成有安全组件的终端芯片

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US16/412,932 Continuation US11436376B2 (en) 2016-11-15 2019-05-15 Terminal chip integrated with security element

Publications (1)

Publication Number Publication Date
WO2018090932A1 true WO2018090932A1 (zh) 2018-05-24

Family

ID=62146089

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2017/111140 WO2018090932A1 (zh) 2016-11-15 2017-11-15 一种集成有安全组件的终端芯片

Country Status (6)

Country Link
US (1) US11436376B2 (zh)
EP (1) EP3534289B1 (zh)
JP (1) JP6814305B2 (zh)
KR (1) KR102225283B1 (zh)
CN (1) CN108073830B (zh)
WO (1) WO2018090932A1 (zh)

Families Citing this family (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
FR3060161A1 (fr) * 2016-12-08 2018-06-15 Orange Technique de gestion d'un droit d'acces a un service pour un dispositif communicant
CN113158260B (zh) * 2021-03-30 2023-03-31 西南电子技术研究所（中国电子科技集团公司第十研究所） SoC芯片内部数据分级防护电路

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103034804A (zh) * 2012-12-11 2013-04-10 深圳国微技术有限公司 安全芯片及其攻击检测电路
CN103730161A (zh) * 2013-12-23 2014-04-16 深圳国微技术有限公司 一种安全芯片抗攻击的安全电路及采用该安全电路的安全芯片
CN204360420U (zh) * 2014-12-31 2015-05-27 上海动联信息技术股份有限公司 便携式nfc订单生成终端
CN106096457A (zh) * 2016-06-06 2016-11-09 合肥工业大学 一种安全芯片的抗时钟频率错误注入攻击的防御电路

Family Cites Families (14)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US6054893A (en) * 1997-04-10 2000-04-25 Institute Of Microelectronics Low current differential fuse circuit
US6594760B1 (en) * 1998-12-21 2003-07-15 Pitney Bowes Inc. System and method for suppressing conducted emissions by a cryptographic device
US6535986B1 (en) 2000-03-14 2003-03-18 International Business Machines Corporation Optimizing performance of a clocked system by adjusting clock control settings and clock frequency
DE10061998A1 (de) * 2000-12-13 2002-07-18 Infineon Technologies Ag Kryptographieprozessor
US6973565B2 (en) * 2001-05-09 2005-12-06 Safenet Canada, Inc. Biometrically secured memory IC
US20060059372A1 (en) * 2004-09-10 2006-03-16 International Business Machines Corporation Integrated circuit chip for encryption and decryption having a secure mechanism for programming on-chip hardware
CN101588643B (zh) 2008-05-19 2012-08-29 上海锦诺信息科技有限公司 一种带手机应用软件开发平台的卡片
JP5552027B2 (ja) * 2010-11-01 2014-07-16 ルネサスエレクトロニクス株式会社 半導体装置
US9231409B2 (en) * 2012-01-24 2016-01-05 Texas Instruments Incorporated Sourcing and securing dual supply rails of tamper protected battery backed domain
US8912814B2 (en) * 2012-11-12 2014-12-16 Chaologix, Inc. Clocked charge domain logic
US9268948B2 (en) * 2013-06-24 2016-02-23 Intel Corporation Secure access enforcement proxy
US9255968B2 (en) * 2013-11-22 2016-02-09 Altera Corporation Integrated circuit with a high-speed debug access port
US20160378344A1 (en) * 2015-06-24 2016-12-29 Intel Corporation Processor and platform assisted nvdimm solution using standard dram and consolidated storage
CN205158415U (zh) * 2015-12-08 2016-04-13 深圳中科讯联科技有限公司 智能卡

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103034804A (zh) * 2012-12-11 2013-04-10 深圳国微技术有限公司 安全芯片及其攻击检测电路
CN103730161A (zh) * 2013-12-23 2014-04-16 深圳国微技术有限公司 一种安全芯片抗攻击的安全电路及采用该安全电路的安全芯片
CN204360420U (zh) * 2014-12-31 2015-05-27 上海动联信息技术股份有限公司 便携式nfc订单生成终端
CN106096457A (zh) * 2016-06-06 2016-11-09 合肥工业大学 一种安全芯片的抗时钟频率错误注入攻击的防御电路

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP3534289A4 *

Also Published As

Publication number Publication date
US11436376B2 (en) 2022-09-06
CN108073830B (zh) 2021-05-18
EP3534289B1 (en) 2021-07-28
JP6814305B2 (ja) 2021-01-13
EP3534289A4 (en) 2019-11-13
JP2019534528A (ja) 2019-11-28
EP3534289A1 (en) 2019-09-04
KR20190077089A (ko) 2019-07-02
CN108073830A (zh) 2018-05-25
US20190266360A1 (en) 2019-08-29
KR102225283B1 (ko) 2021-03-09

Similar Documents

Publication Publication Date Title
EP2894588B1 (en) Data processing device, method for executing an application and computer program product
US7372304B2 (en) System and method for glitch detection in a secure microcontroller
Basak et al. A flexible architecture for systematic implementation of SoC security policies
TW201723949A (zh) 針對遺失的電子裝置停用行動付款
WO2018090932A1 (zh) 一种集成有安全组件的终端芯片
US11636231B2 (en) Methods and apparatus for in-memory device access control
US10496974B2 (en) Secure transactions with connected peripherals
US7823133B2 (en) Smart card device and method for debug and software development
KR20240064635A (ko) 신뢰 수준 향상을 위한 센서 정보를 이용하는 장치 및 방법
Huffmire et al. Hardware trust implications of 3-D integration
CN104199517A (zh) 一种基于国产处理器的异构可信冗余服务器系统
CN106548099A (zh) 一种电路系统安全保护的芯片
CN111512297A (zh) 数据中心中的可编程设备的安全性
CN111104696B (zh) 一种多路安全元件集群板卡
US10169616B1 (en) Cryptographic processing of data and instructions stored off-chip
EP3044721B1 (en) Automatic pairing of io devices with hardware secure elements
US11734457B2 (en) Technology for controlling access to processor debug features
CN112181860B (zh) 具有快闪存储器仿真功能的控制器及其控制方法
CN206100055U (zh) 基于arm嵌入式加密卡的大宗商品交易系统
US20240152925A1 (en) Methods and arrangements for credit card lock
Wang et al. A Secure Dual-Core Processor Design for Embedded Terminal Device
US20180076966A1 (en) Subscriber identification system
CN106504071A (zh) 基于嵌入式数据保护的交易系统

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 17872149

Country of ref document: EP

Kind code of ref document: A1

ENP Entry into the national phase

Ref document number: 2019546965

Country of ref document: JP

Kind code of ref document: A

NENP Non-entry into the national phase

Ref country code: DE

ENP Entry into the national phase

Ref document number: 20197016888

Country of ref document: KR

Kind code of ref document: A

ENP Entry into the national phase

Ref document number: 2017872149

Country of ref document: EP

Effective date: 20190527