WO2024046125A1 - 硬件加密模块、芯片及加密方法 - Google Patents

硬件加密模块、芯片及加密方法 Download PDF

Info

Publication number
WO2024046125A1
WO2024046125A1 PCT/CN2023/113292 CN2023113292W WO2024046125A1 WO 2024046125 A1 WO2024046125 A1 WO 2024046125A1 CN 2023113292 W CN2023113292 W CN 2023113292W WO 2024046125 A1 WO2024046125 A1 WO 2024046125A1
Authority
WO
WIPO (PCT)
Prior art keywords
encryption
address
read
instruction
external
Prior art date
Application number
PCT/CN2023/113292
Other languages
English (en)
French (fr)
Inventor
孙军
陈佳俊
沈天平
郭佳敏
Original Assignee
华润微集成电路(无锡)有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华润微集成电路(无锡)有限公司 filed Critical 华润微集成电路(无锡)有限公司
Publication of WO2024046125A1 publication Critical patent/WO2024046125A1/zh

Links

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/10—Protecting distributed programs or content, e.g. vending or licensing of copyrighted material ; Digital rights management [DRM]
    • G06F21/12—Protecting executable software
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/70—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer
    • G06F21/78—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure storage of data
    • G06F21/79—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure storage of data in semiconductor storage media, e.g. directly-addressable memories
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F3/00—Input arrangements for transferring data to be processed into a form capable of being handled by the computer; Output arrangements for transferring data from processing unit to output unit, e.g. interface arrangements
    • G06F3/06—Digital input from, or digital output to, record carriers, e.g. RAID, emulated record carriers or networked record carriers

Definitions

  • the invention relates to the field of integrated circuit design, and in particular to a hardware encryption module, chip and encryption method.
  • the implementation of hardware encryption has the characteristics of fast encryption speed, good hardware security, no storage resources, and easy use. It effectively makes up for the shortcomings of software encryption methods, better protects the software intellectual property rights in the chip, and avoids plagiarism. risk.
  • the purpose of the present invention is to provide a hardware encryption module, chip and encryption method to solve the problem of insufficient security of hardware encryption in the prior art.
  • a hardware encryption module which at least includes:
  • Control unit and storage unit the storage unit includes a program area and a data area;
  • the control unit is connected to the storage unit and receives external instructions, determines the encryption status based on the encryption value in the encryption bit address of the storage unit, and generates a control sequence to control erasure of the storage unit based on the external erase instruction, Based on the encryption state and external read and write instructions, a control sequence is generated to control the reading and writing of the storage unit; wherein, when in the encryption mode, only the encrypted reading of the program area is prohibited and the writing of the encrypted bit address is prohibited. operate.
  • control unit includes an instruction parsing subunit and a timing generation subunit;
  • the instruction parsing subunit is connected to the timing generation subunit, generates a program area erasure control signal or a data area erasure control signal based on an external erasure instruction, and generates read and write based on the encryption state and the external read and write instructions. control signal;
  • the timing generation subunit connects the storage unit and the instruction parsing subunit, determines the encryption status based on the encryption value in the encryption bit address, and generates the storage unit based on the control signal output by the instruction parsing subunit. control timing.
  • the instruction parsing subunit includes an address judgment unit and a control signal generation unit;
  • the address judgment part judges the address in the external read and write instructions
  • the control signal generation part is connected to the output end of the address judgment part and the timing generation sub-unit, and generates an erasure control signal based on an external erase command, based on the judgment of the external read and write command and the address judgment part.
  • the result and the encryption status generate corresponding read and write control signals.
  • the timing generation subunit includes an encryption status judgment unit and a control timing generation unit;
  • the encryption status determination unit is connected to the storage unit and determines the encryption status based on a comparison result between the encryption value in the encryption bit address and a preset value;
  • the control timing generation unit is connected to the output end of the instruction analysis subunit, and generates the control timing of the storage unit based on the control signal output by the instruction analysis subunit.
  • the data area includes a TRIM area and a user area.
  • the encryption bit address is located in the program area.
  • the encryption bit address is located at the bottom of the program area.
  • the present invention also provides a chip, which at least includes: the above hardware encryption module.
  • an encryption method which at least includes:
  • a program area erase control signal or a data area erase control signal is generated based on the external erase instruction, and the entire program area is erased or erased based on the program area erase control signal.
  • the data area erasure control signal erases the entire data area;
  • the encryption status and the address where the write operation is to be performed are judged. If the address where the write operation is to be performed in the encryption mode is the encryption bit address, writing is prohibited; otherwise, based on the external
  • the write instruction performs a write operation on the corresponding address in the storage unit;
  • the encryption status and the address to be read are judged.
  • the address to be read out is located in the program area of the storage unit, then the encrypted value in the corresponding address is read; otherwise, the actual value in the corresponding address in the storage unit is processed based on the external read instruction. read operation.
  • the encryption bit address is located at the bottom of the program area.
  • the method for determining the encryption status includes: comparing the encrypted value in the encryption bit address with a preset value. If the two match, the encryption mode is in place; otherwise, the encrypted value is in the decryption mode.
  • the hardware encryption module, chip and encryption method of the present invention have the following beneficial effects:
  • the hardware encryption module, chip and encryption method of the present invention set two erasure modes: program area erasure and data area erasure, which simplify the operation process while satisfying user usage scenarios; at the same time, this invention
  • the invention sets the encryption bit address in the program area.
  • the user When erasing the encryption bit, the user must erase the entire program to prevent forced decryption caused by individually erasing the encryption bit.
  • the hardware encryption module, chip and encryption method of the present invention determine the encryption status and address in the write mode. In the encryption mode, the user cannot write the encryption bit address to prevent the encryption bit data from being rewritten. Perform forced decryption.
  • the hardware encryption module, chip and encryption method of the present invention determine the encryption status and address in the read mode.
  • the data area is not affected by the encryption status and correct data can be read at any time; the program area is in the decryption mode. can be read correctly, otherwise the encrypted value in the corresponding address is read.
  • the hardware encryption module, chip and encryption method of the present invention abandon the super reading mode (the program area and data area can be read correctly regardless of whether it is in encryption mode), effectively improving the security of the chip.
  • All burning instructions (or burning protocols) in the hardware encryption module, chip and encryption method of the present invention can be made public, which facilitates users to develop their own burning tooling and greatly improves the application flexibility of the product; at the same time, strict encryption logic Software that can protect the program area very well will minimize the possibility of being decrypted and read.
  • Figure 1 shows a schematic structural diagram of a hardware encryption module according to an embodiment of the present invention.
  • Figure 2 shows a schematic structural diagram of a hardware encryption module according to another embodiment of the present invention.
  • Figure 3 shows a schematic structural diagram of the instruction parsing subunit of the present invention.
  • FIG. 4 shows a schematic structural diagram of the timing generation subunit of the present invention.
  • Figure 5 shows a schematic diagram of the principle of the encryption method of the present invention.
  • Hardware encryption device 11 Control Department 111 Instruction parsing unit 112 Timing generation unit 12 Storage Department 121 program area 122 TRIM area 123 user area 2 Hardware encryption module 21 control unit 211 Instruction parsing subunit 211a Address Determination Department 211b control signal generation part 212 Timing generation subunit 212a Encryption status judgment part 212b control timing generation part 22 storage units 221 program area 222 data area 222a TRIM area 222b user area
  • a hardware encryption device 1 includes a control part 11 and a storage part 12 .
  • the control unit 11 includes an instruction analysis unit 111 and a timing generation unit 112.
  • the instruction analysis unit 111 analyzes external input instructions; the timing generation unit 112 generates the said timing based on the signal output by the instruction analysis unit 111.
  • the storage unit 12 is divided into a program area 121, a TRIM area 122 and a user area 123, and an encryption bit address is planned in the TRIM area 122.
  • the hardware the control unit 11
  • the hardware the control unit 11
  • the hardware the control unit 11
  • the hardware the control unit 11
  • the hardware the control unit 11
  • the hardware the control unit 11
  • the hardware the control unit 11
  • the hardware the control unit 11
  • the hardware the control unit 11
  • the hardware the control unit 11
  • the timing generating unit 112 When executing the erase instruction of the storage unit 12 , the timing generating unit 112 generates a corresponding timing to erase any address of the storage unit 12 .
  • the timing generating unit 112 When executing the write instruction of the storage unit 12 , the timing generating unit 112 generates a corresponding timing to write to any address of the storage unit 12 .
  • the read instructions of the storage unit 12 When executing the read instructions of the storage unit 12, it can be divided into normal mode and super mode; in the normal mode, the data read by the storage unit 12 is restricted by the encryption state, and when the chip is in the decryption mode, the storage unit 12 Data at any address can be read normally. When the chip is in encryption mode, data at any address in the storage unit 12 cannot be read normally. In super mode, regardless of whether the chip is in an encryption state, the storage unit 12 can be read at any time. The data in the address can be read correctly. Entering the super mode requires special instructions to be sent externally. This mode is mainly designed to meet the requirement that the user still needs to access the TRIM area 122 or the user area when the chip is encrypted. 123 to meet special scenario requirements for access.
  • the hardware encryption device 1 has the following problems during its working process: 1) The user can forcibly decrypt the chip by directly erasing the encrypted value in the encrypted bit address and powering on again. 2) The user can rewrite the encrypted bit data by rewriting the encrypted bit address and powering on, thereby forcibly decrypting the chip. 3) Through the analysis of the chip input signal, there is still a chance of obtaining a special instruction to enter the super mode, thereby creating the risk of leaking secrets. 4) The burning instruction (or burning protocol) of the hardware encryption device 1 cannot be made public (if it is made public, the encryption function will be in vain, and the program area can be burned or the software code of the program area can be read), so the user cannot Perform software and hardware development on chips.
  • another embodiment of the present invention proposes a hardware encryption module, chip and encryption method.
  • the specific solution is as described below.
  • the hardware encryption module 2 includes:
  • Control unit 21 and storage unit 22 The storage unit 22 includes a program area 221 and a data area 222.
  • control unit 21 is connected to the storage unit 22 and receives external instructions, determines the encryption status based on the encryption value in the encryption bit address of the storage unit 22, and generates control data based on the external erase instruction.
  • the control sequence for erasing the storage unit 22 is based on the encryption state and external read and write instructions to generate a control sequence for controlling the reading and writing of the storage unit 22. control timing; wherein, when in the encryption mode, only the program area is encrypted and read and the writing operation of the encrypted bit address is prohibited.
  • the external instructions include an external erase instruction, an external write instruction, and an external read instruction;
  • the external erase instruction includes an erase area (program area or data area) and an erase area.
  • Operation information includes a write address and write operation information;
  • the external read instruction includes a read address and read operation information.
  • the control unit 21 includes an instruction parsing subunit 211 and a timing generation subunit 212.
  • the instruction parsing subunit 211 is connected to the timing generation subunit 212, generates a program area erasure control signal or a data area erasure control signal based on the external erasure instruction, and generates a program area erasure control signal or a data area erasure control signal based on the encryption status and the external read and write Commands (external write command, external read command) generate read and write control signals (write control signal, read control signal).
  • the timing generation subunit 212 is connected to the storage unit 22 and the instruction parsing subunit 211.
  • the instruction parsing subunit 211 includes an address determination unit 211a and a control signal generation unit 211b.
  • the address judgment part 211a judges the address in the external read and write instructions to distinguish whether the address to be written or read externally is located in the program area 221 or the data area 222, and outputs a corresponding judgment signal.
  • the control signal generation part 211b is connected to the output end of the address judgment part 211a and the timing generation sub-unit 212, and generates an erasure control signal based on the external erase command.
  • the erasure control signal is a program area erase
  • the program area erasure control signal is used to erase the entire program area 221
  • the data area erasure control signal is used to erase the entire data area 222. , that is, the erasure operation can only be performed on the entire area of the program area 221 or the data area 222, and cannot erase a specific address;
  • the control signal generation unit 211b is also based on the external read and write instructions and the judgment of the address judgment unit 211a The result and the encryption status generate corresponding read and write control signals.
  • the timing generation subunit 212 includes an encryption status determination unit 212a and a control timing generation unit 212b.
  • the encryption status determination unit 212a is connected to the storage unit 22 and determines the encryption status based on a comparison result between the encryption value in the encryption bit address and a preset value.
  • the encryption value in the encryption bit address is compared with a preset value, When the preset values match (are consistent or satisfy a predetermined relationship), it is determined to be in encryption mode; otherwise, it is determined to be in decryption mode; the corresponding encryption status signal is output and fed back to the instruction parsing subunit 211 .
  • the control timing generation unit 212b is connected to the output end of the instruction parsing sub-unit 211, and generates the control signal (erasure control signal, write control signal or read control signal) based on the control signal output by the instruction parsing sub-unit 211.
  • the control timing of the storage unit 22 is described, and then the read, write and erase operations of the storage unit 22 are completed.
  • the encryption status judgment unit 212a may be disposed in the instruction parsing subunit 211 as needed. Or it can be set independently in the control unit 21, which is not limited to this embodiment.
  • the storage unit 22 is controlled by the control unit 21 and is used to store programs and data.
  • the storage unit 22 is a flash memory.
  • any memory type that can implement the present invention is applicable to the present invention, and will not be described in detail here.
  • the storage unit 22 is divided into a program area 221 and a data area 222; further, in this embodiment, the data area 222 is divided into a TRIM area 222a and a user area 222b.
  • the program area 221 is used to store programs developed by users
  • the TRIM area 222a is used to store calibration data when the chip manufacturer leaves the factory
  • the user area 222b is used to store user-defined data.
  • the data area 222 can be divided into different areas as needed to implement specific storage functions, which is not limited to this embodiment.
  • the encryption bit address is located in the program area 221. If you want to erase the encrypted value in the encryption bit address, you need to erase other information in the program area 221 at the same time. , even if it is decrypted, the information in the program area no longer exists, and the information in the program area 221 (including but not limited to the program code) cannot be obtained, further avoiding the risk of leakage and improving security.
  • the encryption bit address is set at the bottom of the program area 221, that is, the last one written In actual use, if the space occupied by each program code can be determined, the encryption bit address can be set at any position of the program area 221 without affecting the operation of the program code. This is not the case. Examples are limited.
  • the present invention also provides an encryption method.
  • the encryption method is implemented based on the hardware encryption module 2 .
  • any hardware that can implement this method is suitable for the present invention, and is not limited to this embodiment.
  • the encryption method at least includes:
  • the encrypted value in the encrypted bit address of the storage unit 22 is read by the control unit 21, and the read encrypted value in the encrypted bit address is compared with a preset value. , if the two match (consistent or satisfy a predetermined relationship), it means that it is in encryption mode, otherwise it means that it is in decryption mode; a corresponding encryption status signal is generated.
  • the judgment of the encryption status is completed by the timing generation subunit 212.
  • any circuit that can judge the encryption status based on the encryption value in the read encryption bit address can Applicable to the present invention, it is not limited to this embodiment.
  • a program area erasure control signal or a data area erasure control signal is generated based on the external erasure instruction, and the entire program area 221 is erased based on the program area erasure control signal.
  • the entire data area 222 is erased or erased based on the data area erasure control signal.
  • the control unit 21 when the external command is an erase command, and the external command includes erase area and erase operation information, then the control unit 21 generates a program area erasure control signal or data based on the external command. If the program area erasure control signal is generated, the program area 221 will be erased based on the corresponding control timing; if the data area erasing control signal is generated, the data area 222 will be erased based on the corresponding control timing. to erase.
  • the present invention only sets two erasing modes: program area erasing and data area erasing; among them, program area erasing only erases all program area addresses, and data area erasing only erases all program area addresses.
  • the encryption bit address of the present invention is located in the program area 221 (further, located at the bottom of the program area 221), so the user must erase the entire program while erasing the encryption bits. This prevents forced decryption by individually erasing encryption bits.
  • the encryption status and the address where the write operation is to be performed are judged. If the address where the write operation is to be performed in encryption mode is the encryption bit address, writing is prohibited; otherwise, based on the The external write command performs a write operation on the corresponding address in the storage unit 22 .
  • the encryption status and the write address are judged respectively.
  • the encryption status is first judged. If it is in the decryption mode, based on the external write The instruction performs a write operation on the corresponding address in the storage unit 22 (whether it is a program area or a data area); if it is in the encryption mode, it further determines the address where the write operation is to be performed. The address where the write operation is to be performed is encrypted. bit address, the write operation is prohibited. If the address to perform the write operation is an unencrypted bit address, the corresponding address in the storage unit 22 (whether it is the program area or the data area) is written based on the external write instruction.
  • the present invention determines the encryption status and address in the write mode.
  • the user In the encryption mode, the user cannot perform a write operation on the encrypted bit address to prevent forced decryption by rewriting the encrypted bit data.
  • the encryption status and the read address are respectively judged.
  • the address to be read out is first judged.
  • the address to be read is located at In the data area 222, Then based on the external read instruction, the corresponding address in the data area 222 is read out to obtain the corresponding actual value; if the read address is located in the program area 221, the encryption status is further judged, If it is in the decryption mode, the corresponding address in the program area 221 is read based on the external read instruction, and the corresponding actual value is obtained. If it is in the encryption mode, the program area is read based on the external read instruction. Read the corresponding address in 221 to obtain the corresponding encrypted value.
  • the present invention judges the encryption status and address in the read mode; the data area is not affected by the encryption status, and correct data can be read at any time; the program area can be read correctly in the decryption mode.
  • encryption mode read the encrypted value of the corresponding address.
  • the present invention abandons the super reading mode and effectively improves the security of the chip. All burning instructions (or burning protocols) in the present invention can be made public, and users can develop their own burning tools based on the burning instructions to improve the application flexibility of the product; at the same time, because the program area is encrypted, the Risk of program area being decrypted and read.
  • the present invention also provides a chip, which at least includes the hardware encryption module 2, and the hardware encryption module 2 is used to implement encryption protection for the chip.
  • the hardware encryption module 2 is used to implement encryption protection for the chip.
  • any electronic product that requires encryption protection can use the hardware encryption module 2 of the present invention, which will not be described in detail here.
  • the present invention provides a hardware encryption module, chip and encryption method, including: a control unit and a storage unit, the storage unit includes a program area and a data area; the control unit is connected to the storage unit and receives An external instruction determines the encryption status based on the encryption value in the encryption bit address of the storage unit, generates a control sequence to control erasure of the storage unit based on an external erase instruction, and generates a control sequence based on the encryption status and external read and write instructions.
  • the main protection object of the hardware encryption module, chip and encryption method of the present invention is the program.
  • the hardware encryption module, chip and encryption method of the present invention prevent users from forcibly decrypting by directly erasing the encryption bit address and powering on again; and prevent the user from forcibly decrypting by rewriting the encryption bit address and powering on again. behavior; the super read mode is abandoned, effectively improving the security of the chip; the product has high application flexibility and high security. Therefore, the present invention effectively overcomes various shortcomings in the prior art and has high industrial utilization value.

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Software Systems (AREA)
  • Computer Hardware Design (AREA)
  • Computer Security & Cryptography (AREA)
  • Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Multimedia (AREA)
  • Technology Law (AREA)
  • Human Computer Interaction (AREA)
  • Storage Device Security (AREA)

Abstract

本发明提供一种硬件加密模块、芯片及加密方法，包括：控制单元及存储单元；控制单元连接存储单元，并接收外部指令，基于存储单元的加密位地址中的加密值判断加密状态，并基于外部擦除指令产生控制存储单元擦除的控制时序，基于加密状态及外部读写指令产生控制存储单元读写的控制时序；其中，在处于加密模式时，仅对程序区加密读出并禁止对加密位地址进行写入操作。本发明所有加密行为只对所述程序区有效，对数据区无效；防止用户通过直接擦除加密位地址并重新上电进行强行解密；防止用户通过对加密位地址重新写入并上电进行强行解密；舍弃超级读取模式，有效提高芯片的安全性；产品的应用灵活性高、安全性高。

Description

硬件加密模块、芯片及加密方法 技术领域
本发明涉及集成电路设计领域，特别是涉及一种硬件加密模块、芯片及加密方法。
背景技术
随着近年来信息安全的概念被社会各界广泛提及，芯片的加密功能作为用户保护自身产品数据安全的一种直接而有效的途径，越来越得到重视。
软件加密方法凭借其实现简单的特性，被广泛应用；现有的软件加密一般为在芯片存储区域固定位置增加加密标识，若加密标识有效，则烧录器要么直接不作读取动作直接返回加密数值，要么依然读取但是返回值还是加密数值；这种软件加密方式非常容易被破解，安全性极低，同时存在速度慢、占用存储资源等缺点。
硬件加密的实现具有加密速度快、硬件安全性好、不占用存储资源、使用方便等特点，有效的弥补了软件加密方法的不足，更好的保护了芯片内的软件知识产权，避免被抄袭的风险。
因此，如何加强硬件加密的安全性，已成为本领域技术人员亟待解决的技术问题之一。
应该注意，上面对技术背景的介绍只是为了方便对本申请的技术方案进行清楚、完整的说明，并方便本领域技术人员的理解而阐述的。不能仅仅因为这些方案在本申请的背景技术部分进行了阐述而认为上述技术方案为本领域技术人员所公知。
发明内容
本发明的目的在于提供一种硬件加密模块、芯片及加密方法，用于解决现有技术中硬件加密安全性不足的问题。
为实现上述目的及其他相关目的，本发明提供一种硬件加密模块，所述硬件加密模块至少包括：
控制单元及存储单元，所述存储单元包括程序区及数据区；
所述控制单元连接所述存储单元，并接收外部指令，基于所述存储单元的加密位地址中的加密值判断加密状态，并基于外部擦除指令产生控制所述存储单元擦除的控制时序，基于所述加密状态及外部读写指令产生控制所述存储单元读写的控制时序；其中，在处于加密模式时，仅对所述程序区加密读出并禁止对所述加密位地址进行写入操作。
可选地，所述控制单元包括指令解析子单元及时序发生子单元；
所述指令解析子单元连接所述时序发生子单元，基于外部擦除指令产生程序区擦除控制信号或数据区擦除控制信号，并基于所述加密状态及所述外部读写指令产生读写控制信号；
所述时序发生子单元连接所述存储单元及所述指令解析子单元，基于所述加密位地址中的加密值判断加密状态，并基于所述指令解析子单元输出的控制信号产生所述存储单元的控制时序。
更可选地，所述指令解析子单元包括地址判断部及控制信号产生部；
所述地址判断部对所述外部读写指令中的地址进行判断；
所述控制信号产生部连接于所述地址判断部及所述时序发生子单元的输出端，基于外部擦除指令产生擦除控制信号，基于所述外部读写指令、所述地址判断部的判断结果及所述加密状态产生对应读写控制信号。
更可选地，所述时序发生子单元包括加密状态判断部及控制时序产生部；
所述加密状态判断部连接所述存储单元，基于所述加密位地址中的加密值与预设值的比较结果对所述加密状态进行判断；
所述控制时序产生部连接于所述指令解析子单元的输出端，基于所述指令解析子单元输出的控制信号产生所述存储单元的控制时序。
可选地，所述数据区包括TRIM区域及用户区域。
更可选地，所述加密位地址位于所述程序区内。
更可选地，所述加密位地址位于所述程序区底部。
为实现上述目的及其他相关目的，本发明还提供一种芯片，所述芯片至少包括：上述硬件加密模块。
为实现上述目的及其他相关目的，本发明还提供一种加密方法，所述加密方法至少包括：
上电后获取加密位地址中的加密值，基于所述加密位地址中的加密值判断并更新加密状态；
当接收到外部擦除指令时，基于所述外部擦除指令产生程序区擦除控制信号或数据区擦除控制信号，并基于所述程序区擦除控制信号对整个程序区进行擦除或基于所述数据区擦除控制信号对整个数据区进行擦除；
当接收到外部写入指令时，对加密状态及要执行写入操作的地址进行判断，若在加密模式下要执行写入操作的地址为加密位地址，则禁止写入；否则基于所述外部写入指令对存储单元中对应地址进行写入操作；
当接收到外部读出指令时，对所述加密状态及要执行读出操作的地址进行判断，若在加 密模式下要执行读出操作的地址位于所述存储单元的程序区，则读出对应地址中的加密值；否则基于所述外部读出指令对所述存储单元中对应地址中的实际值进行读出操作。
更可选地，所述加密位地址位于所述程序区底部。
可选地，判断加密状态的方法包括：将所述加密位地址中的加密值与预设值进行比较，若两者匹配则处于加密模式，反之则处于解密模式。
如上所述，本发明的硬件加密模块、芯片及加密方法，具有以下有益效果：
1、本发明的硬件加密模块、芯片及加密方法在擦除模式下，设置程序区擦除和数据区擦除两种擦除方式，在满足用户使用场景的同时，简化了操作流程；同时本发明将加密位地址设置在程序区内，用户在擦除加密位的同时必须将程序全部擦除，防止通过单独擦除加密位导致的强制解密情况。
2、本发明的硬件加密模块、芯片及加密方法在写入模式下，对加密状态及地址进行判定，在加密模式下用户无法对加密位地址进行写入操作，防止通过改写加密位数据的方式进行强行解密。
3、本发明的硬件加密模块、芯片及加密方法在读出模式下，对加密状态及地址进行判定，数据区不受加密状态影响，在任何时候都可以读到正确数据；程序区在解密模式下可以被正确读取，否则读出对应地址中的加密值。
4、本发明的硬件加密模块、芯片及加密方法舍弃超级读取模式(无论是否处于加密模式，程序区和数据区均可被正确读出)，有效提高芯片的安全性。
5、本发明的硬件加密模块、芯片及加密方法中所有烧录指令(或烧录协议)均可以公开，方便用户开发自己的烧录工装，大大提高产品的应用灵活性；同时严密的加密逻辑可以很好的保护程序区的软件，将被解密读取的可能降到最低。
附图说明
图1显示为本发明一实施例的硬件加密模块的结构示意图。
图2显示为本发明另一实施例的硬件加密模块的结构示意图。
图3显示为本发明的指令解析子单元的结构示意图。
图4显示为本发明的时序发生子单元的结构示意图。
图5显示为本发明的加密方法的原理示意图。
元件标号说明
1                      硬件加密装置
11                     控制部
111                    指令解析单元
112                    时序发生单元
12                     存储部
121                    程序区
122                    TRIM区
123                    用户区
2                      硬件加密模块
21                     控制单元
211                    指令解析子单元
211a                   地址判断部
211b                   控制信号产生部
212                    时序发生子单元
212a                   加密状态判断部
212b                   控制时序产生部
22                     存储单元
221                    程序区
222                    数据区
222a                   TRIM区域
222b                   用户区域
具体实施方式
以下通过特定的具体实例说明本发明的实施方式，本领域技术人员可由本说明书所揭露的内容轻易地了解本发明的其他优点与功效。本发明还可以通过另外不同的具体实施方式加以实施或应用，本说明书中的各项细节也可以基于不同观点与应用，在没有背离本发明的精神下进行各种修饰或改变。
请参阅图1～图5。需要说明的是，本实施例中所提供的图示仅以示意方式说明本发明的基本构想，遂图式中仅显示与本发明中有关的组件而非按照实际实施时的组件数目、形状及尺寸绘制，其实际实施时各组件的型态、数量及比例可为一种随意的改变，且其组件布局型 态也可能更为复杂。
如图1所示为本发明一实施例的一种硬件加密装置1，包括控制部11及存储部12。其中，所述控制部11包括指令解析单元111及时序发生单元112，所述指令解析单元111对外部输入指令进行解析；所述时序发生单元112基于所述指令解析单元111输出的信号产生所述存储部12的控制时序。所述存储部12划分为程序区121、TRIM区122及用户区123，加密位地址被规划在所述TRIM区122中。
在芯片上电完成后，硬件(所述控制部11)将立刻读取所述加密位地址中的加密值并进行判定，如果所述加密位地址中的加密值与硬件设计时设定的加密值相一致，则芯片处于加密模式，否则芯片处于默认解密模式。在执行所述存储部12的擦除指令时，所述时序发生单元112产生相应时序对所述存储部12的任意地址进行擦除。在执行所述存储部12的写入指令时，所述时序发生单元112产生相应时序对所述存储部12任意地址进行写入。在执行所述存储部12的读取指令时，可分为正常模式和超级模式；正常模式下，所述存储部12读取数据受加密状态限制，当芯片处于解密模式下所述存储部12任意地址中的数据可被正常读取，当芯片处于加密模式下所述存储部12任意地址中的数据无法被正常读取；超级模式下，无论芯片是否处于加密状态，所述存储部12任意地址中的数据都可以被正确读取，超级模式的进入需要外部发送特殊指令，该模式的设计主要用于满足在芯片加密的情况下，用户仍需对所述TRIM区122或所述用户区123进行访问的特殊场景需求。
但是所述硬件加密装置1在工作过程中存在以下问题：1)用户可通过直接擦除加密位地址中的加密值，并重新上电的方式，进而实现对芯片的强行解密。2)用户可通过对加密位地址重新写入并上电的方式，改写加密位数据，进而实现对芯片的强行解密。3)通过对芯片输入信号的分析，仍有几率获取进入超级模式的特殊指令，从而产生泄密的风险。4)所述硬件加密装置1的烧录指令(或烧录协议)无法公开(若公开则加密功能形同虚设，可以对程序区进行烧录，也可以读取程序区的软件代码)，因此用户无法对芯片进行软硬件开发。
为了提高上述实施例中所述硬件加密装置1的安全性和灵活性的问题，本发明另一实施例提出一种硬件加密模块、芯片及加密方法，具体方案如下文所述。
如图2所示，本发明还提供一种硬件加密模块2，所述硬件加密模块2包括：
控制单元21及存储单元22，所述存储单元22包括程序区221及数据区222。
如图2所示，所述控制单元21连接所述存储单元22，并接收外部指令，基于所述存储单元22的加密位地址中的加密值判断加密状态，并基于外部擦除指令产生控制所述存储单元22擦除的控制时序，基于所述加密状态及外部读写指令产生控制所述存储单元22读写的控 制时序；其中，在处于加密模式时，仅对所述程序区加密读出并禁止对所述加密位地址进行写入操作。
具体地，在本实施例中，所述外部指令包括外部擦除指令、外部写入指令及外部读出指令；所述外部擦除指令中包含擦除区域(程序区或数据区)及擦除操作信息；所述外部写入指令中包含写入地址及写入操作信息；所述外部读出指令中包含读出地址及读出操作信息。
具体地，在本实施例中，所述控制单元21包括指令解析子单元211及时序发生子单元212。所述指令解析子单元211连接所述时序发生子单元212，基于所述外部擦除指令产生程序区擦除控制信号或数据区擦除控制信号，并基于所述加密状态及所述外部读写指令(外部写入指令、外部读出指令)产生读写控制信号(写入控制信号、读出控制信号)。所述时序发生子单元212连接所述存储单元22及所述指令解析子单元211，在上电后基于所述加密位地址中的加密值判断所述存储单元的加密状态，并记录该加密状态，或更新已记录的加密状态，基于所述指令解析子单元211输出的控制信号产生所述存储单元22的控制时序。
更具体地，如图3所示，作为示例，所述指令解析子单元211包括地址判断部211a及控制信号产生部211b。所述地址判断部211a对所述外部读写指令中的地址进行判断，以区分外要执行写入或读出的地址位于所述程序区221还是数据区222，并输出相应的判断信号。所述控制信号产生部211b连接于所述地址判断部211a及所述时序发生子单元212的输出端，基于所述外部擦除指令产生擦除控制信号，所述擦除控制信号为程序区擦除控制信号或数据区擦除控制信号，所述程序区擦除控制信号用于对整个程序区221进行擦除操作，所述数据区擦除控制信号用于对整个数据区222进行擦除操作，即擦除操作只能对程序区221或数据区222的整个区域进行，无法对特定地址进行擦除；所述控制信号产生部211b还基于外部读写指令、所述地址判断部211a的判断结果及所述加密状态产生对应读写控制信号。
更具体地，如图4所示，作为示例，所述时序发生子单元212包括加密状态判断部212a及控制时序产生部212b。所述加密状态判断部212a连接所述存储单元22，基于所述加密位地址中的加密值与预设值的比较结果对所述加密状态进行判断，当所述加密位地址中的加密值与所述预设值匹配(一致或满足预定关系)时判定处于加密模式，否则判定处于解密模式；输出相应的加密状态信号并反馈至所述指令解析子单元211。所述控制时序产生部212b连接于所述指令解析子单元211的输出端，基于所述指令解析子单元211输出的控制信号(擦除控制信号、写入控制信号或读出控制信号)产生所述存储单元22的控制时序，进而完成所述存储单元22的读写擦操作。
需要说明的是，所述加密状态判断部212a可根据需要设置于所述指令解析子单元211中 或独立设置于所述控制单元21中，不以本实施例为限。
如图2所示，所述存储单元22受所述控制单元21的控制，用于存储程序和数据。
具体地，在本实施例中，所述存储单元22为闪存(flash)。在实际使用中，任意能实现本发明的存储器类型均适用于本发明，在此不一一赘述。
具体地，所述存储单元22划分为程序区221及数据区222；进一步，在本实施例中，所述数据区222划分为TRIM区域222a及用户区域222b。所述程序区221用于存放用户开发的程序，所述TRIM区域222a用于存放芯片生产商出厂时的校准数据，所述用户区222b用于存放用户自定义数据。在实际使用中，所述数据区222可根据需要划分为不同的区域以实现特定的存储功能，不以本实施例为限。
具体地，在本实施例中，所述加密位地址位于所述程序区221内，则想要擦除所述加密位地址中的加密值就需要同时擦除所述程序区221内的其它信息，即使解密了，程序区的信息也不存在了，也就无法获取所述程序区221中的信息(包括但不限于程序代码)，进一步避免泄密的风险，提高安全性。更具体地，由于程序代码必须是连续的，中间不能断开，为了确保所述程序区221的存储空间最大化，所述加密位地址设置于所述程序区221的底部，即最晚被写入的部分；在实际使用中，若能确定各程序代码占用的空间，在不影响程序代码运行的基础上也可将所述加密位地址设置于所述程序区221的任意位置，不以本实施例为限。
如图5所示，本发明还提供一种加密方法。在本实施例中所述加密方法基于所述硬件加密模块2实现。在实际使用中任意能实现本方法的硬件均适用于本发明，不以本实施例为限。所述加密方法至少包括：
1)上电后获取加密位地址中的加密值，基于所述加密位地址中的加密值判断并更新加密状态。
具体地，上电后，所述存储单元22的加密位地址中的加密值被所述控制单元21读取，并将读取到的所述加密位地址中的加密值与预设值进行比较，若两者匹配(一致或满足预定关系)则表示处于加密模式，反之则表示处于解密模式；产生相应的加密状态信号。
更具体地，在本实施例中，加密状态的判断由所述时序发生子单元212完成，在实际使用中，任意能基于读出的所述加密位地址中的加密值判断加密状态的电路均适用于本发明，不以本实施例为限。
21)当接收到外部擦除指令时，基于所述外部擦除指令产生程序区擦除控制信号或数据区擦除控制信号，并基于所述程序区擦除控制信号对整个程序区221进行擦除或基于所述数据区擦除控制信号对整个数据区222进行擦除。
具体地，当所述外部指令为擦除指令时，所述外部指令中包含擦除区域及擦除操作信息，则，所述控制单元21基于所述外部指令产生程序区擦除控制信号或数据区擦除控制信号，若产生程序区擦除控制信号则基于相应的控制时序对所述程序区221进行擦除；若产生数据区擦除控制信号则基于相应的控制时序对所述数据区222进行擦除。
具体地，本发明在擦除模式下，仅设置程序区擦除和数据区擦除两种擦除方式；其中，程序区擦除只擦除所有程序区地址，数据区擦除只擦除所有TRIM区域222a和用户区域222b的数据；用户无法随意设定擦除地址，在满足用户使用场景的同时，简化了操作流程。作为本发明的一种实现方式，本发明的所述加密位地址位于所述程序区221中(进一步，位于所述程序区221底部)，所以用户在擦除加密位的同时必须将程序全部擦除，防止了通过单独擦除加密位导致的强制解密情况。
22)当接收到外部写入指令时，对加密状态及要执行写入操作的地址进行判断，若在加密模式下要执行写入操作的地址为加密位地址，则禁止写入；否则基于所述外部写入指令对存储单元22中对应地址进行写入操作。
具体地，当所述外部指令为写入指令时，分别对加密状态及写入地址进行判断，在本实施例中，首先对加密状态进行判断，若处于解密模式，则基于所述外部写入指令对存储单元22(无论是程序区还是数据区)中对应地址进行写入操作；若处于加密模式，则进一步对要执行写入操作的地址进行判断，若要执行写入操作的地址是加密位地址，则禁止写入操作，若要执行写入操作的地址是非加密位地址则基于所述外部写入指令对存储单元22(无论是程序区还是数据区)中对应地址进行写入操作。
需要说明的是，在实际使用中，加密状态判断及地址判断不存在固定的先后顺序，也可以先进行地址判断再进行加密状态判断，或者加密状态判断与地址判断同时进行，能得到最终判断结果并产生相应控制信号即可，不以本实施例为限。
具体地，本发明在写入模式下，对加密状态和地址进行判断，在加密模式下用户无法对加密位地址进行写入操作，以防止通过改写加密位数据的方式进行强行解密。
23)当接收到外部读出指令时，对所述加密状态及要执行读出操作的地址进行判断，若在加密模式下要执行读出操作的地址位于所述存储单元22的程序区221，则读出对应地址中的加密值；否则基于所述外部读出指令对所述存储单元22中对应地址中的实际值进行读出操作。
具体地，当所述外部指令为读出指令时，分别对加密状态及读出地址进行判断，在本实施例中，首先对要执行读出操作的地址进行判断，若要读出的地址位于所述数据区222中， 则基于所述外部读出指令对所述数据区222中对应地址进行读出操作，获取相应的实际值；若要读出的地址位于所述程序区221中，则进一步对加密状态进行判断，若处于解密模式则基于所述外部读出指令对所述程序区221中对应地址进行读出操作，进而获取相应的实际值，若处于加密模式则基于所述外部读出指令对所述程序区221中对应地址进行读出操作，进而获取相应的加密值。
需要说明的是，在实际使用中，加密状态判断及地址判断不存在固定的先后顺序，也可以先进行加密状态判断再进行地址判断，或者加密状态判断与地址判断同时进行，能得到最终判断结果并产生相应控制信号即可，不以本实施例为限。
具体地，本发明在读出模式下，对加密状态和地址进行判断；数据区不受加密状态影响，在任何时候都可以读到正确数据；程序区在解密模式下可以被正确读取，在加密模式下读出对应地址的加密值。本发明舍弃了超级读取模式，有效提高芯片的安全性。本发明中所有烧录指令(或烧录协议)均可以公开，用户可基于所述烧录指令开发自己的烧录工装，提高产品的应用灵活性；同时由于所述程序区被加密，降低了程序区被解密读取的风险。
本发明还提供一种芯片，所述芯片至少包括所述硬件加密模块2，所述硬件加密模块2用于实现对所述芯片的加密保护。在实际使用中，任意需要进行加密保护的电子产品均可采用本发明的硬件加密模块2，在此不一一赘述。
综上所述，本发明提供一种硬件加密模块、芯片及加密方法，包括：控制单元及存储单元，所述存储单元包括程序区及数据区；所述控制单元连接所述存储单元，并接收外部指令，基于所述存储单元的加密位地址中的加密值判断加密状态，并基于外部擦除指令产生控制所述存储单元擦除的控制时序，基于所述加密状态及外部读写指令产生控制所述存储单元读写的控制时序；其中，在处于加密模式时，仅对所述程序区加密读出并禁止对所述加密位地址进行写入操作。本发明的硬件加密模块、芯片及加密方法主要保护对象为程序，所有加密行为只对所述程序区有效，对数据区无效；通过对存储单元的分区管理，使用户在加密模式下，依然可以实现对数据区的访问。本发明的硬件加密模块、芯片及加密方法防止了用户通过直接擦除加密位地址并重新上电，进行强行解密的行为；防止了用户通过对加密位地址重新写入并上电，进行强行解密的行为；舍弃了超级读取模式，有效提高了芯片的安全性；产品的应用灵活性高、安全性高。所以，本发明有效克服了现有技术中的种种缺点而具高度产业利用价值。
上述实施例仅例示性说明本发明的原理及其功效，而非用于限制本发明。任何熟悉此技术的人士皆可在不违背本发明的精神及范畴下，对上述实施例进行修饰或改变。因此，举凡 所属技术领域中具有通常知识者在未脱离本发明所揭示的精神与技术思想下所完成的一切等效修饰或改变，仍应由本发明的权利要求所涵盖。

Claims (15)

  1. 一种硬件加密模块，其特征在于，所述硬件加密模块至少包括：
    控制单元及存储单元，所述存储单元包括程序区及数据区；
    所述控制单元连接所述存储单元，并接收外部指令，基于所述存储单元的加密位地址中的加密值判断加密状态，并基于外部擦除指令产生控制所述存储单元擦除的控制时序，基于所述加密状态及外部读写指令产生控制所述存储单元读写的控制时序；其中，在处于加密模式时，仅对所述程序区加密读出并禁止对所述加密位地址进行写入操作。
  2. 根据权利要求1所述的硬件加密模块，其特征在于：所述控制单元包括指令解析子单元及时序发生子单元；
    所述指令解析子单元连接所述时序发生子单元，基于外部擦除指令产生程序区擦除控制信号或数据区擦除控制信号，并基于所述加密状态及所述外部读写指令产生读写控制信号；
    所述时序发生子单元连接所述存储单元及所述指令解析子单元，基于所述加密位地址中的加密值判断加密状态，并基于所述指令解析子单元输出的控制信号产生所述存储单元的控制时序。
  3. 根据权利要求2所述的硬件加密模块，其特征在于：所述指令解析子单元包括地址判断部及控制信号产生部；
    所述地址判断部对所述外部读写指令中的地址进行判断；
    所述控制信号产生部连接于所述地址判断部及所述时序发生子单元的输出端，基于外部擦除指令产生擦除控制信号，基于所述外部读写指令、所述地址判断部的判断结果及所述加密状态产生对应读写控制信号。
  4. 根据权利要求2所述的硬件加密模块，其特征在于：所述时序发生子单元包括加密状态判断部及控制时序产生部；
    所述加密状态判断部连接所述存储单元，基于所述加密位地址中的加密值与预设值的比较结果对所述加密状态进行判断；
    所述控制时序产生部连接于所述指令解析子单元的输出端，基于所述指令解析子单元输出的控制信号产生所述存储单元的控制时序。
  5. 根据权利要求1所述的硬件加密模块，其特征在于：所述数据区包括TRIM区域及用户区 域。
  6. 根据权利要求1-5任意一项所述的硬件加密模块，其特征在于：所述加密位地址位于所述程序区内。
  7. 根据权利要求6所述的硬件加密模块，其特征在于：所述加密位地址位于所述程序区底部。
  8. 一种芯片，其特征在于，所述芯片至少包括：如权利要求1-7任意一项所述的硬件加密模块。
  9. 一种加密方法，其特征在于，所述加密方法至少包括：
    上电后获取加密位地址中的加密值，基于所述加密位地址中的加密值判断并更新加密状态；
    当接收到外部擦除指令时，基于所述外部擦除指令产生程序区擦除控制信号或数据区擦除控制信号，并基于所述程序区擦除控制信号对整个程序区进行擦除或基于所述数据区擦除控制信号对整个数据区进行擦除；
    当接收到外部写入指令时，对加密状态及要执行写入操作的地址进行判断，若在加密模式下要执行写入操作的地址为加密位地址，则禁止写入；否则基于所述外部写入指令对存储单元中对应地址进行写入操作；
    当接收到外部读出指令时，对所述加密状态及要执行读出操作的地址进行判断，若在加密模式下要执行读出操作的地址位于所述存储单元的程序区，则读出对应地址中的加密值；否则基于所述外部读出指令对所述存储单元中对应地址中的实际值进行读出操作。
  10. 根据权利要求9所述的加密方法，其特征在于：所述加密位地址位于所述程序区中。
  11. 根据权利要求9或10所述的加密方法，其特征在于：判断加密状态的方法包括：将所述加密位地址中的加密值与预设值进行比较，若两者匹配则处于加密模式，反之则处于解密模式。
  12. 根据权利要求9所述的加密方法，其特征在于：在擦除模式下，仅设置程序区擦除和数据区擦除两种擦除方式，其中，程序区擦除只擦除所有程序区地址，数据区擦除只擦除所 有TRIM区域和用户区域的数据。
  13. 根据权利要求9所述的加密方法，其特征在于：当接收到外部写入指令时对加密状态进行判断，若处于解密模式，则基于所述外部写入指令对存储单元的程序区以及数据区中的对应地址进行写入操作。
  14. 根据权利要求13所述的加密方法，其特征在于，当接收到外部读出指令时，
    若要读出的地址位于所述数据区中，则基于所述外部读出指令对所述数据区中对应地址进行读出操作，获取相应的实际值；
    若要读出的地址位于所述程序区中，则进一步对加密状态进行判断：
    若处于解密模式则基于所述外部读出指令对所述程序区中对应地址进行读出操作，进而获取相应的实际值，
    若处于加密模式则基于所述外部读出指令对所述程序区中对应地址进行读出操作，进而获取相应的加密值。
  15. 根据权利要求9所述的加密方法，其特征在于，所述外部擦除指令中包含擦除区域及擦除操作信息；所述外部写入指令中包含写入地址及写入操作信息；所述外部读出指令中包含读出地址及读出操作信息。
PCT/CN2023/113292 2022-09-01 2023-08-16 硬件加密模块、芯片及加密方法 WO2024046125A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202211067892.8 2022-09-01
CN202211067892.8A CN117668779A (zh) 2022-09-01 2022-09-01 硬件加密模块、芯片及加密方法

Publications (1)

Publication Number Publication Date
WO2024046125A1 true WO2024046125A1 (zh) 2024-03-07

Family

ID=90066955

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2023/113292 WO2024046125A1 (zh) 2022-09-01 2023-08-16 硬件加密模块、芯片及加密方法

Country Status (2)

Country Link
CN (1) CN117668779A (zh)
WO (1) WO2024046125A1 (zh)

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20070133280A1 (en) * 2004-10-08 2007-06-14 Renesas Technology Corp. Semiconductor integrated circuit apparatus and electronic system
CN103377350A (zh) * 2012-04-23 2013-10-30 合肥科盛微电子科技有限公司 利用硬件加密模块实现嵌入式软件的代码保护的方法和装置
CN106919865A (zh) * 2017-03-02 2017-07-04 上海东软载波微电子有限公司 非易失性存储器数据加密系统

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20070133280A1 (en) * 2004-10-08 2007-06-14 Renesas Technology Corp. Semiconductor integrated circuit apparatus and electronic system
CN103377350A (zh) * 2012-04-23 2013-10-30 合肥科盛微电子科技有限公司 利用硬件加密模块实现嵌入式软件的代码保护的方法和装置
CN106919865A (zh) * 2017-03-02 2017-07-04 上海东软载波微电子有限公司 非易失性存储器数据加密系统

Also Published As

Publication number Publication date
CN117668779A (zh) 2024-03-08

Similar Documents

Publication Publication Date Title
US6457126B1 (en) Storage device, an encrypting/decrypting device and method of accessing a non-volatile memory
US8281411B2 (en) Security memory device and method for making same
US8316200B2 (en) Microcomputer, electronic instrument, and flash memory protection method
US8671242B2 (en) Boot block features in synchronous serial interface NAND
JPH08263361A (ja) フラッシュメモリカード
TW201337554A (zh) 程式化記憶胞與資料讀取方法、記憶體控制器與儲存裝置
US8607061B2 (en) Flash device security method utilizing a check register
JP2006350885A (ja) 半導体装置
JP2003140835A (ja) データ記憶装置
CN112100624A (zh) 一种固件保护方法、装置及终端设备
JP2015172959A (ja) フラッシュメモリのアクセス方法
US7054121B2 (en) Protection circuit for preventing unauthorized access to the memory device of a processor
WO2024046125A1 (zh) 硬件加密模块、芯片及加密方法
US20040186947A1 (en) Access control system for nonvolatile memory
JPWO2006040798A1 (ja) 半導体集積回路装置および電子システム
US6925569B2 (en) Secured microprocessor comprising a system for allocating rights to libraries
CN106934305B (zh) 一种嵌入式系统
JP2008027326A (ja) システムコントローラ、該システムコントローラを有するフラッシュメモリシステム、フラッシュメモリモジュールの制御方法
CN112507402A (zh) Flash存储器读保护处理方法及装置
JP4972410B2 (ja) フラッシュメモリ内でのアクセスを制御するための方法、およびこのような方法の実施のためのシステム
JP4031693B2 (ja) 不揮発性メモリおよびこれを有したデータ記憶装置
TWI789082B (zh) 具資訊安全之記憶卡裝置與應用其中的晶片控制方法
US20240004802A1 (en) Data security for memory and computing systems
TWI747270B (zh) 用來進行組態管理之方法以及資料儲存裝置及其控制器
JP4542556B2 (ja) 半導体記憶システム

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 23859159

Country of ref document: EP

Kind code of ref document: A1