WO2019161577A1 - 一种安全芯片 - Google Patents

一种安全芯片 Download PDF

Info

Publication number
WO2019161577A1
WO2019161577A1 PCT/CN2018/077994 CN2018077994W WO2019161577A1 WO 2019161577 A1 WO2019161577 A1 WO 2019161577A1 CN 2018077994 W CN2018077994 W CN 2018077994W WO 2019161577 A1 WO2019161577 A1 WO 2019161577A1
Authority
WO
WIPO (PCT)
Prior art keywords
circuit
security
chip
security chip
circuit module
Prior art date
Application number
PCT/CN2018/077994
Other languages
English (en)
French (fr)
Inventor
王良清
李亚明
刘华预
Original Assignee
深圳国微技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 深圳国微技术有限公司 filed Critical 深圳国微技术有限公司
Publication of WO2019161577A1 publication Critical patent/WO2019161577A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/70—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer
    • G06F21/71—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure computing or processing of information
    • G06F21/72—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure computing or processing of information in cryptographic circuits
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/70—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer
    • G06F21/71—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure computing or processing of information
    • G06F21/76—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure computing or processing of information in application-specific integrated circuits [ASIC] or field-programmable devices, e.g. field-programmable gate arrays [FPGA] or programmable logic devices [PLD]

Definitions

  • the present invention relates to the field of chips, and in particular to a security chip.
  • the security chip integrates the private hardware security circuits required by each customer according to different customers, such as customer-private cryptographic algorithm circuits, private key extraction and protection circuits, and private Data encryption storage circuits, private data download and management circuits, etc.
  • Key data such as the user's private key are stored in the chip's built-in non-volatile memory.
  • User-critical data from different customers is often stored in different data formats in different areas of the non-volatile memory, plus user rights management.
  • the circuit protects the respective data.
  • the private hardware security circuits required by each of the customers are integrated into the chip during the chip design phase. After the chip is produced, these circuits are fixed in the chip and cannot be changed.
  • the prior art security chip integrates the customized private hardware security circuits of the target customers into the chip during the chip design phase, and the user-critical data of each target customer is non-volatile in the chip design phase.
  • the storage area in the memory is divided, and then the hardware isolation circuit accessed by each customer storage area is added to realize the support of the security chip to multiple customers.
  • the customized private hardware security circuit is selected according to the customer identification number, and the private hardware security circuits of other customers do not work.
  • the customer can only access the memory area of the non-volatile memory that has been allocated during the chip design phase, and other areas in the non-volatile memory are not available.
  • the security chip of the prior art integrates the private hardware security circuits of each customer into the chip, and divides the non-volatile memory into regions of different customers, resulting in a relatively large area of the chip.
  • the cost of the chip is too high, and the hardware resource waste rate of the chip is also relatively high.
  • the key data of the user in the chip is likely to be cloned, which is not conducive to the security of the chip.
  • the customized hardware security circuits customized by customers are solidified in the security chip, with the development of information security technology, when customers need to update their private hardware security circuits, they need to re-develop chips, increase time and materials. cost. And if the customer's security requirements are updated through software, security will be reduced.
  • a security chip including a processor, a programmable circuit module, and a nonvolatile memory, the programmable circuit module and the nonvolatile memory being connected to the processor through a bus Connected, the programmable circuit module is configured to implement a hardware security circuit of the security chip according to a preset configuration file, where the non-volatile memory is used to store the preset configuration file.
  • the programmable circuit module is implemented using an eFPGA technology.
  • the security chip further includes a data interface connected to the processor through a bus.
  • the hardware security circuit includes one or more of a cryptographic algorithm circuit, a key extraction and protection circuit, a data encryption storage circuit, a data downloading and management circuit.
  • a security chip which includes a programmable circuit module and a non-volatile memory, and the programmable circuit module is configured to implement hardware security of the security chip according to a preset configuration file. And a non-volatile memory for storing the preset configuration file.
  • the programmable circuit module is implemented using an eFPGA technology.
  • the hardware security circuit includes one or more of a cryptographic algorithm circuit, a key extraction and protection circuit, a data encryption storage circuit, a data downloading and management circuit.
  • the programmable circuit module is also used to implement a processor, a bus, and a data interface circuit.
  • the security chip of the present invention replaces the hardware security circuit in the traditional security chip by using the programmable circuit module, and effectively realizes the full support of the security chip to the customized hardware security circuit customized by multiple customers, and supports the same.
  • the hardware safety circuit is updated and upgraded, and the user's key data is realized into the programmable circuit module, which not only reduces the cost of the chip, but also improves the security of the chip and prolongs the product cycle of the chip.
  • FIG. 1 is a schematic structural view of a prior art security chip.
  • FIG. 2 is a schematic structural diagram of a security chip according to Embodiment 1 of the present invention.
  • FIG. 3 is a schematic structural diagram of a security chip according to Embodiment 2 of the present invention.
  • a security chip 10 which includes a processor 11, a programmable circuit module 12, a non-volatile memory 13 and a data interface 14, and the programmable circuit module 12
  • the nonvolatile memory 13 and the data interface 14 are connected to the processor 11 via a bus.
  • the processor 11 is a master device on the internal bus of the security chip 10, for reading and executing instructions from the non-volatile memory 13, and completing the chip by reading and writing access to each module in the chip. Various functional operations.
  • the programmable circuit module 12 is configured to implement a hardware security circuit of the security chip according to a preset configuration file.
  • the programmable circuit module 12 is implemented using an eFPGA (embedded Field Programmable Gate Array) technology.
  • the hardware security circuit of the security chip may be one or more of a cryptographic algorithm circuit, a key extraction and protection circuit, a data encryption storage circuit, a data download and management circuit.
  • the non-volatile memory 13 is configured to store a configuration file of the programmable circuit module 12, and also stores user software programs and private data of a specific client.
  • the content and storage format in the non-volatile memory 13 are different for different customers, thereby ensuring the privacy and security of the customer data.
  • the data interface 14 is configured to implement data interaction between the security chip and an external circuit.
  • the configuration file of the programmable circuit module 12 can be downloaded to the non-volatile memory 13 through the data interface 14.
  • the non-volatile memory of the security chip divides the private areas of different customers, and the private areas of each customer are independent by hardware isolation protection circuits, and store respective user key data and software programs.
  • the programmable circuit module is integrated in the security chip of the embodiment of the present invention, and the customized private hardware security circuit of the specific customer and the key data of the user are implemented on the programmable circuit module, each of which The circuit of the programmable circuit module in the chip varies from customer to customer, thus ensuring the privacy and security of customer data.
  • a security chip 20 which includes a programmable circuit module 21 and a non-volatile memory 22, and the programmable circuit module 21 is configured according to a preset configuration file.
  • a hardware security circuit of the security chip is implemented, and the non-volatile memory 22 is configured to store the preset configuration file.
  • the hardware security circuit includes one or more of a cryptographic algorithm circuit, a key extraction and protection circuit, a data encryption storage circuit, a data download and management circuit.
  • the programmable circuit module 21 is implemented using eFPGA technology. Further, the programmable circuit module 21 is also used to implement circuits such as a processor, a bus, and a data interface.
  • the security chip of the present invention replaces the hardware security circuit in the traditional security chip by using the programmable circuit module, effectively realizes the full support of the security chip to the customized hardware security circuit customized by multiple customers, and supports the hardware security.
  • the update and upgrade of the circuit also realizes the user's key data into the programmable circuit module, which not only reduces the cost of the chip, but also improves the security of the chip and prolongs the product cycle of the chip.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Hardware Design (AREA)
  • Physics & Mathematics (AREA)
  • Theoretical Computer Science (AREA)
  • Mathematical Physics (AREA)
  • Computer Security & Cryptography (AREA)
  • Software Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Microelectronics & Electronic Packaging (AREA)
  • Storage Device Security (AREA)

Abstract

本发明公开了一种安全芯片，其包括处理器、可编程电路模块和非易失性存储器，所述可编程电路模块和所述非易失性存储器通过总线与所述处理器相连接，所述可编程电路模块用于根据预设的配置文件来实现所述安全芯片的硬件安全电路，所述非易失性存储器用于存储所述预设的配置文件。本发明的安全芯片安全性高且便于更新客户的私有安全电路。

Description

一种安全芯片 技术领域
本发明涉及芯片领域，尤其涉及一种安全芯片。
背景技术
安全芯片中除了集成标准的通用硬件密码算法电路外，还会根据不同的客户集成各客户所要求的私有的硬件安全电路，比如客户私有的密码算法电路、私有的密钥提取和保护电路、私有的数据加密存储电路、私有的数据下载和管理电路等。而用户的私有密钥等关键数据都会存储在芯片的内置非易失性存储器中，不同客户的用户关键数据往往会以不同的数据格式存储在非易失性存储器的不同区域，外加用户权限管理电路保护各自的数据。其中的各客户所要求的私有的硬件安全电路在芯片设计阶段集成到芯片中，芯片生产出来以后这些电路固定存在于芯片之中不可更改。
如图1所示，现有技术的安全芯片在芯片设计阶段将各目标客户定制化的私有的硬件安全电路集成到芯片中，在芯片设计阶段将各目标客户的用户关键数据在非易失性存储器中的存储区域划分好，再加入各客户存储区域访问的硬件隔离电路，实现安全芯片对多客户的支持。在芯片生产出来以后，根据客户识别号选择该客户定制化的私有硬件安全电路工作，其他客户的私有硬件安全电路不工作。该客户只能访问非易失性存储器中在芯片设计阶段已经分配好的属于自己的存储区域，非易失性存储器中的其它区域不可用。
现有技术的安全芯片为了实现多客户的支持，将各客户的私有硬件安全电路都集成在芯片中，且将非易失性存储器划分为不同客户的区域，导致芯片的面积做得比较大，芯片成本过高，同时芯片的硬件资源浪费率也比较高。由于用户的关键数据存储在非易失性存储器中，导致芯片中用户的关键数据存在被克隆的风险，不利于芯片的安全性。此外由于各客户定制化的私有的硬件安全 电路是固化在安全芯片中的，随着信息安全技术的发展，当客户需要更新其私有的硬件安全电路时，就需要重新开发芯片，增加时间和物资成本。而如果通过软件实现客户安全需求的更新，则安全性会降低。
发明内容
本发明的目的是针对上述现有技术存在的缺陷，提供一种安全性高且便于更新客户的私有安全电路的安全芯片。
本发明实施例中，提供了一种安全芯片，其包括处理器、可编程电路模块和非易失性存储器，所述可编程电路模块和所述非易失性存储器通过总线与所述处理器相连接，所述可编程电路模块用于根据预设的配置文件来实现所述安全芯片的硬件安全电路，所述非易失性存储器用于存储所述预设的配置文件。
进一步地，所述可编程电路模块使用eFPGA技术实现。
进一步地，所述安全芯片还包括通过总线与所述处理器相连接的数据接口。
进一步地，所述硬件安全电路包括密码算法电路、密钥提取和保护电路、数据加密存储电路、数据下载和管理电路的一种或多种。
本发明实施例中，还提供了一种安全芯片，其包括可编程电路模块和非易失性存储器，所述可编程电路模块用于根据预设的配置文件来实现所述安全芯片的硬件安全电路，所述非易失性存储器用于存储所述预设的配置文件。
进一步地，所述可编程电路模块使用eFPGA技术实现。
进一步地，所述硬件安全电路包括密码算法电路、密钥提取和保护电路、数据加密存储电路、数据下载和管理电路的一种或多种。
进一步地，可编程电路模块还用于实现处理器、总线和数据接口电路。
与现有技术相比较，本发明的安全芯片采用可编程电路模块代替了传统安 全芯片中的硬件安全电路，有效的实现了安全芯片对多客户定制化的私有硬件安全电路的全面支持，同时支持硬件安全电路的更新升级，还把用户的关键数据实现到可编程电路模块中，不仅降低了芯片成本，还提高了芯片的安全性，延长了芯片的产品周期。
附图说明
图1是现有技术的安全芯片的结构示意图。
图2是本发明实施例一的安全芯片的结构示意图。
图3是本发明实施例二的安全芯片的结构示意图。
具体实施方式
以下结合具体实施例对本发明的实现进行详细描述。
实施例一
如图2所示，本发明实施例中，提供了一种安全芯片10，其包括处理器11、可编程电路模块12、非易失性存储器13和数据接口14，所述可编程电路模块12、所述非易失性存储器13和所述数据接口14通过总线与所述处理器11相连接。
所述处理器11，是所述安全芯片10内部总线上的主设备，用于从所述非易失性存储器13中读取指令并执行，通过对芯片中各模块的读写访问以完成芯片的各种功能操作。
所述可编程电路模块12用于根据预设的配置文件来实现所述安全芯片的硬件安全电路。所述可编程电路模块12使用eFPGA(embedded Field Programmable Gate Array，嵌入式现场可编程门陈列)技术实现。所述安全芯片的硬件安全电 路可以是密码算法电路、密钥提取和保护电路、数据加密存储电路、数据下载和管理电路的一种或多种。
所述非易失性存储器13用于存储所述可编程电路模块12的配置文件，还存储了特定客户的用户软件程序及私有数据。针对不同的客户，所述非易失性存储器13中的内容和存储格式都不相同，从而保证了客户数据的私密性和安全性。
所述数据接口14用于实现所述安全芯片与外部电路的数据交互。所述可编程电路模块12的配置文件可通过所述数据接口14来下载到所述非易失性存储器13中。
现有技术中，安全芯片的非易失性存储器为不同客户划分了各自的私有区域，各客户的私有区域通过硬件隔离保护电路实现各自独立，存储各自的用户关键数据及软件程序等。与现有技术不同的是，本发明实施例的安全芯片中集成了所述可编程电路模块，在可编程电路模块上实现特定客户的定制化的私有硬件安全电路以及用户的关键数据，每颗芯片中的可编程电路模块的电路因客户的不同而不同，从而保证了客户数据的私密性和安全性。
实施例二
如图3所示，本实施例中，提供了一种安全芯片20，其包括可编程电路模块21和非易失性存储器22，所述可编程电路模块21用于根据预设的配置文件来实现所述安全芯片的硬件安全电路，所述非易失性存储器22用于存储所述预设的配置文件。所述硬件安全电路包括密码算法电路、密钥提取和保护电路、数据加密存储电路、数据下载和管理电路的一种或多种。
所述可编程电路模块21使用eFPGA技术实现。进一步地，所述可编程电路模块21还用于实现处理器、总线和数据接口等电路。
需要说明的是，实施例二与实施例一基于同一发明构思，其采用的技术手 段和带来的技术效果与实施例一基本相同，此处不再赘述。
综上所述，本发明的安全芯片采用可编程电路模块代替了传统安全芯片中的硬件安全电路，有效的实现了安全芯片对多客户定制化的私有硬件安全电路的全面支持，同时支持硬件安全电路的更新升级，还把用户的关键数据实现到可编程电路模块中，不仅降低了芯片成本，还提高了芯片的安全性，延长了芯片的产品周期。
以上所述仅为本发明的较佳实施例而已，并不用以限制本发明，凡在本发明的精神和原则之内所作的任何修改、等同替换和改进等，均应包含在本发明的保护范围之内。

Claims (8)

  1. 一种安全芯片，其特征在于，包括处理器、可编程电路模块和非易失性存储器，所述可编程电路模块和所述非易失性存储器通过总线与所述处理器相连接，所述可编程电路模块用于根据预设的配置文件来实现所述安全芯片的硬件安全电路，所述非易失性存储器用于存储所述预设的配置文件。
  2. 如权利要求1所述的安全芯片，其特征在于，所述可编程电路模块使用eFPGA技术实现。
  3. 如权利要求1或2所述的安全芯片，其特征在于，所述安全芯片还包括通过总线与所述处理器相连接的数据接口。
  4. 如权利要求1或2所述的安全芯片，其特征在于，所述硬件安全电路包括密码算法电路、密钥提取和保护电路、数据加密存储电路、数据下载和管理电路的一种或多种。
  5. 一种安全芯片，其特征在于，包括可编程电路模块和非易失性存储器，所述可编程电路模块用于根据预设的配置文件来实现所述安全芯片的硬件安全电路，所述非易失性存储器用于存储所述预设的配置文件。
  6. 如权利要求5所述的安全芯片，其特征在于，所述可编程电路模块使用eFPGA技术实现。
  7. 如权利要求5或6所述的安全芯片，其特征在于，所述硬件安全电路包括密码算法电路、密钥提取和保护电路、数据加密存储电路、数据下载和管理电路的一种或多种。
  8. 如权利要求5或6所述的安全芯片，其特征在于，所述可编程电路模块还用于实现处理器、总线和数据接口电路。
PCT/CN2018/077994 2018-02-23 2018-03-05 一种安全芯片 WO2019161577A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201810155223.3A CN108280372A (zh) 2018-02-23 2018-02-23 一种安全芯片
CN201810155223.3 2018-02-23

Publications (1)

Publication Number Publication Date
WO2019161577A1 true WO2019161577A1 (zh) 2019-08-29

Family

ID=62808503

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2018/077994 WO2019161577A1 (zh) 2018-02-23 2018-03-05 一种安全芯片

Country Status (2)

Country Link
CN (1) CN108280372A (zh)
WO (1) WO2019161577A1 (zh)

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104486069A (zh) * 2014-12-23 2015-04-01 天津光电通信技术有限公司 一种基于fpga实现的gost加解密设备及其方法
CN204631874U (zh) * 2015-05-12 2015-09-09 兰州风颐电子科技有限公司 一种pcmcia加密卡
CN206147640U (zh) * 2016-09-28 2017-05-03 济南浪潮高新科技投资发展有限公司 一种基于国产fpga芯片的加解密电路板
CN106971110A (zh) * 2017-03-31 2017-07-21 山东超越数控电子有限公司 一种基于国产安全处理器的计算机主板架构及运行方法
CN106973056A (zh) * 2017-03-30 2017-07-21 中国电力科学研究院 一种面向对象的安全芯片及其加密方法

Family Cites Families (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101650697A (zh) * 2009-05-19 2010-02-17 上海闻泰电子科技有限公司 一种采用cpld实现数据加密的方法
EP2720167A1 (en) * 2012-10-11 2014-04-16 Nagravision S.A. Method and system for smart card chip personalization
CN103413164B (zh) * 2013-07-10 2017-08-25 上海新储集成电路有限公司 一种在智能卡芯片内用嵌入式可编程逻辑门阵列实现数据加解密功能的方法
CN105205416A (zh) * 2015-08-25 2015-12-30 浪潮集团有限公司 一种移动硬盘密码模块
CN105069380A (zh) * 2015-08-27 2015-11-18 浪潮集团有限公司 一种便携式密码模块
CN106682535A (zh) * 2017-03-16 2017-05-17 周清睿 系统级芯片
CN106991061A (zh) * 2017-03-31 2017-07-28 山东超越数控电子有限公司 一种sata硬盘密码模块及其工作方法

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104486069A (zh) * 2014-12-23 2015-04-01 天津光电通信技术有限公司 一种基于fpga实现的gost加解密设备及其方法
CN204631874U (zh) * 2015-05-12 2015-09-09 兰州风颐电子科技有限公司 一种pcmcia加密卡
CN206147640U (zh) * 2016-09-28 2017-05-03 济南浪潮高新科技投资发展有限公司 一种基于国产fpga芯片的加解密电路板
CN106973056A (zh) * 2017-03-30 2017-07-21 中国电力科学研究院 一种面向对象的安全芯片及其加密方法
CN106971110A (zh) * 2017-03-31 2017-07-21 山东超越数控电子有限公司 一种基于国产安全处理器的计算机主板架构及运行方法

Also Published As

Publication number Publication date
CN108280372A (zh) 2018-07-13

Similar Documents

Publication Publication Date Title
US11809584B2 (en) File system metadata protection
US8442235B2 (en) Extensible management of self-encrypting storage devices
US9432196B2 (en) Methods, apparatus, and systems for secure demand paging and other paging operations for processor devices
US9520994B2 (en) System and method for deriving secrets from a master key bound to an application on a device
US8190917B2 (en) System and method for securely saving and restoring a context of a secure program loader
US10474454B2 (en) System and method for updating a trusted application (TA) on a device
TW201535145A (zh) 使用保護讀取儲存器安全地儲存韌體數據之系統及方法
ES2617862T3 (es) Elemento seguro que comprende receptáculos separados y método correspondiente
JP6902584B2 (ja) ブートプログラム、情報処理装置、情報処理システム、情報処理方法、半導体装置、およびプログラム
JP2010510574A (ja) セキュアデバイス・システムにおけるフラッシュメモリ・ブロックの保護と方法
US7962746B2 (en) Computer system and program creating device
US20190012464A1 (en) Method and device for ensuring security of firmware of pos machine
TW201706899A (zh) 安全裝置及在其內提供安全服務至主機的方法、安全設備以及電腦軟體產品
US11126566B2 (en) Method and apparatus for sharing security metadata memory space
CN105830021B (zh) 可更新集成电路无线电
JP2016012335A (ja) 記憶装置及び記憶装置システム並びに情報端末
US20200065639A1 (en) Smart card
WO2017007620A1 (en) Separation of software modules by controlled encryption key management
CN111201553A (zh) 一种安全元件及相关设备
WO2019161577A1 (zh) 一种安全芯片
US20180004418A1 (en) Non-unified code and data decoding to provide execute-only memory
CN117094016B (zh) 基于国密Linux内核文件系统数据的加密方法及装置
JP6287284B2 (ja) Ｉｃチップ及びプログラム暗号化方法

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 18907307

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

32PN Ep: public notification in the ep bulletin as address of the adressee cannot be established

Free format text: NOTING OF LOSS OF RIGHTS PURSUANT TO RULE 112(1) EPC (EPO FORM 1205A DATED 23/12/2020)

122 Ep: pct application non-entry in european phase

Ref document number: 18907307

Country of ref document: EP

Kind code of ref document: A1