CN112687318B

CN112687318B - Fuse reading method, controller and chip for resisting data tampering and template attack

Info

Publication number: CN112687318B
Application number: CN202011642230.XA
Authority: CN
Inventors: 岳高宇; 艾金鹏
Original assignee: Espressif Systems Shanghai Co Ltd
Current assignee: Espressif Systems Shanghai Co Ltd
Priority date: 2020-12-31
Filing date: 2020-12-31
Publication date: 2023-07-25
Anticipated expiration: 2040-12-31
Also published as: CN112687318A

Abstract

The invention relates to the field of digital chip design, in particular to a fuse reading method for resisting data tampering and template attack. And when the data block corresponding to the stored data is read, generating a random data block number sequence and a random byte number sequence. Different reading operations are adopted according to the data type of the current data block, and the method specifically comprises the following steps: reading a data block corresponding to the stored data according to the random data block number sequence; within a data block, byte data is read according to the order of the random byte number sequence. After the reading operation is finished, sequentially stored storage data are obtained in the storage unit. The invention also includes a fuse controller that performs the reading method and a digital chip that includes the fuse controller, the fuses, and the memory cells. The invention utilizes the double random sequence, the random reading period length, the data scrambling and the RS error correction coding, can effectively resist the template attack without increasing the area burden caused by extra data transmission, and also provides a fuse data tamper-proof scheme.

Description

Fuse reading method, controller and chip for resisting data tampering and template attack

Technical Field

The invention relates to the field of digital chip design, in particular to a fuse reading method, a controller and a chip for resisting data tampering and template attack.

Background

Many electronic devices currently choose to store important system parameters, key data used in encryption and decryption processes, in fuse devices in consideration of data security. It is often necessary to design a fuse controller to perform the data writing to and the data reading from the fuses.

The system parameters influence whether each component of the system can work normally, and an attacker can cause the read parameters to be wrong by controlling the voltage of the electronic equipment when the fuse wire controller reads the data, so that the normal working state of the equipment is damaged. For example, a certain chip is divided into a vip version and a normal version, and the functions of the modules with different open versions are different. And the chip identifies the current chip version by reading the system parameters after power-on, so as to determine whether to open vip permission. If the system parameters are tampered in the process of reading the system parameters by the fuse controller, the electronic device cannot correctly distinguish the chip versions. The reliability problems caused thereby tend to affect the praise of the product.

The other potential safety hazard is that the key data stored in the fuse is read by the controller and provided for the encryption and decryption module. The encryption and decryption algorithm is more and more complex in design at present, the difficulty that an attacker wants to acquire the key by breaking the encryption and decryption module is high, and the defending measures for various attack means are also endless. The attacker in turn takes the hands of the process of reading the key from the fuse controller. The fuse controller may leave various forms of information, such as power consumption, electromagnetic radiation, runtime, etc., during the process of reading the key data. This information can be collected and analyzed and used to recover the key information stored in the fuses.

For the transmission of the key data, the traditional direct copying mode can be easily broken through by the template attack, so that some defending modes for the template attack exist, such as adding random factors in the copying process, so that the data is copied in a random sequence.

In the data transmission method, a random sequence input is added, and after a random sequence with a certain length is given, the data of a source address is copied to a destination address in a random sequence. Thus, the transmission process is different and unpredictable every time, and a large amount of statistical information of power consumption cannot be obtained during attack.

However, at present, the efficiency and accuracy of template attack are continuously improved, and the security of such a method is still insufficient, because an attacker can accurately model by only setting all key data to the same value during modeling. In the case of attack, because the power consumption information obtained in one data transmission and copy process may reveal all the transmitted data information under ideal conditions, an attacker cannot obtain the correct sequence, but can obtain all the data, and the attack and the cracking can be completed only by exhausting for a certain number of times.

Thus, such purely random-factor-added defenses, while being somewhat secure, are still at risk.

Disclosure of Invention

The invention aims to provide a fuse reading method, a controller and a chip for resisting data tampering and template attack, which mainly solve the problems in the prior art and have higher security. On one hand, the data can be prevented from being tampered to cause equipment errors; on the other hand, even if the template attack can perfectly analyze the data read by the fuse controller, it is still difficult to obtain any key information.

In order to achieve the above object, the present invention provides a method for reading a fuse against data tampering and template attack, for safely reading stored data stored in a fuse device, wherein a data type of the stored data includes key data or system parameter data, and the method for reading the fuse includes:

generating a random data block number sequence for randomizing the reading sequence of the data blocks according to the number of the data blocks corresponding to the stored data;

generating a random byte number sequence for randomizing a reading order of the byte data of each data block according to the number of bytes contained in the data block;

judging the data type of the current data block, and adopting different reading operations aiming at different data types;

the read operation includes:

reading the storage data according to the random data block number sequence by taking the data block as a unit;

reading the byte data in the order of the random byte number sequence within one of the data blocks;

and after reading one data block, storing the read byte data in a storage unit according to the sequence of the byte data in the fuse device until all the data blocks are read, and obtaining the sequentially stored storage data in the storage unit.

Further, the fuse reading method includes:

generating a random number of a reading period before each reading of the byte data;

the reading the byte data in the order of the random byte number sequence includes: the read cycle of the fuse device is updated and then the byte data is read from the fuse device in coordination with the read cycle.

Further, when the stored data is the system parameter data, the reading the byte data in the order of the random byte number sequence includes:

re-reading each data block, calculating a check value of the read byte data, and storing the check value until the reading times are greater than or equal to a reading times threshold value;

comparing whether all the stored check values are consistent, if so, continuing to read the next data block; and if the byte data corresponding to the check value is not consistent, the reading is stopped, and the equipment is required to be restarted.

Further, the threshold number of readings is 3.

Further, the check value is a CRC check value.

Further, when the stored data is the key data, the reading the byte data in the order of the random byte number sequence includes:

before reading one data block, generating a random byte number for randomly selecting and scrambling the byte data according to the byte length contained in the data block;

each time one byte data is read, interference is applied to the read byte data, and corresponding scrambling byte data is obtained;

comparing the byte number of the byte data read currently with the random byte number, and if the byte number is equal, storing the scrambled byte data in a storage unit according to the sequence of the byte data in the fuse device; otherwise, the byte data are stored in a storage unit according to the sequence of the byte data in the fuse device;

after the reading of a complete data block is finished, the original data corresponding to the data block is analyzed by utilizing the error correction code in the byte data, and the byte data is stored in a storage unit according to the sequence of the byte data in the fuse device, so that the reading of the data block is finished.

Further, the error correction code is generated by an RS error correction algorithm.

Further, in the RS error correction algorithm, each 44 bytes of the stored data contains 32 bytes of the original data and 12 bytes of error correction code.

The invention also provides a fuse controller against data tampering and template attacks, characterized in that it is adapted to perform the method for reading fuses against data tampering and template attacks according to claim 1.

The invention also provides a digital chip, which is characterized by comprising: a fuse controller adapted to perform the method of reading fuses against data tampering and template attacks of claim 1; a fuse device adapted to store key data or system parameter data; and a storage unit adapted to store the key data or the system parameter data read out by the fuse controller.

In view of the above technical features, the present invention has the following advantages:

1, the invention adopts double random sequences, greatly increasing the difficulty of an attacker to acquire the sequence of the real sequences through an exhaustion method.

2. The random reading period length adopted by the invention ensures that the time length of reading each byte by the fuse controller is different, and the power consumption and the running time data obtained by the same data sequence under multiple template attacks are completely different by combining the double random sequence reading, so that the template attacks can be effectively resisted.

3. The invention applies interference operation to the read data, and the extra power consumption caused by the interference operation further reduces the efficiency of template attack.

4. The invention utilizes the error correction capability of the RS code, and in the process of reading the data block, random 1 byte errors are transmitted backwards within the error correction capability range of the RS code, namely, the data is distorted in the subsequent data processing process, so that the template attack is invalid in the subsequent process.

And 5, the invention provides a tamper-proof technology of fuse data, and the tamper-proof difficulty of the data is improved by a double random sequence, a random reading period length and a comparison mode after CRC check values are calculated after multiple readings. An attacker must hit the same data for the same tampering every time in multiple random reads, so that the tampering can be successful.

Drawings

FIG. 1 is a flow chart of a preferred embodiment of a fuse read method of the present invention that is resistant to data tampering and template attacks;

fig. 2 is a schematic diagram of a digital chip performing a fuse reading method against data tampering and template attacks according to the present invention.

In the figure, a 100-fuse controller, 200-fuse device, 300-memory cell.

Detailed Description

The invention is further described below in conjunction with the detailed description. It is to be understood that these examples are illustrative of the present invention and are not intended to limit the scope of the present invention. Further, it is understood that various changes and modifications may be made by those skilled in the art after reading the teachings of the present invention, and such equivalents are intended to fall within the scope of the claims appended hereto.

Referring to fig. 1, the invention discloses a fuse reading method for resisting data tampering and template attack, which is used for safely reading storage data stored in a fuse device, including key data or system parameter data. The key data is composed of original data and error correction codes of the original data, and the system parameter data contains only the original data. The error correction algorithm used for the key data is an RS algorithm, specifically, an algorithm that contains 32 bytes of original data and 12 bytes of error correction code per 44 bytes of stored data, and is capable of correcting 6 byte errors.

Among them, protection is focused on reading prevention for key data, because once the key is compromised, sensitive encrypted information is exposed. Protection is important for system parameters against tampering, as the system data itself generally does not require the need for confidentiality, but once tampered with may adversely affect the configuration of the system.

The stored data is stored in the fuse unit, organized in data blocks, and stored in a plurality of different data blocks when the number of stored data is larger than the size of one data block. The process of reading the stored data may be broken down into one or more read actions in units of data blocks.

Referring to fig. 1, a flow of reading stored data in the present embodiment is shown.

Step S101 is the start of a stored data reading flow, the stored data being read in units of data blocks.

In step S102, a random sequence of data block numbers for randomizing the reading order of the data blocks is generated before reading the byte data in the fuse device. The random data block number sequence is generated according to the number of data blocks corresponding to the stored data, and the block numbers of the data blocks are in one-to-one correspondence with the values in the random data block number sequence. Then, a data block that has not been read is selected in the order indicated in the sequence of random data block numbers.

As shown in step S103, within the same data block, a random byte number sequence for randomizing the reading order of the byte data is generated. The random byte number sequence is generated according to the size of the data block, and the byte numbers of the byte data are in one-to-one correspondence with the values in the random byte number sequence. The random byte number sequences and the random data block number sequences form a double random sequence in the embodiment, and the difficulty of an attacker to acquire the sequence of the real sequence through an exhaustion method is greatly increased.

In step S104, different protection strategies are selected according to whether the key data or the system parameter data is stored in the data block. A mechanism based on CRC check contrast is used for system parameter data to contain content tampering. The scrambling mechanism based on the RS error correction code is used for preventing the content from being leaked for the key data, and particularly, the extra power consumption caused by scrambling operation further reduces the efficiency of the template attack, and random 1 byte errors are transmitted backwards in the process of reading the data block, namely, the data is distorted in the subsequent data processing process, so that the template attack is invalid in the subsequent process. The scrambling mechanism based on the RS error correction code can effectively interfere with template attack on the premise of not increasing extra data carrying overhead.

The protection of the system parameter data is composed of steps S105 to S112, and specifically includes:

in step S105, reading of byte data from the data block of the fuse device is started in accordance with the order indicated in the random byte number sequence. Before each reading of the byte data, a random number of a reading period is generated, the reading period of the fuse device is updated, and then the byte data is read from the fuse device in cooperation with the reading period. In this way, the power consumption, run-time data obtained under multiple template attacks for the same data sequence will also be quite different.

The read byte data is stored in the memory cells in the order of the byte data in the fuse device in step S106.

If the byte data of the current data block is not completely read as shown in step S107, the process goes to step S105 to continue reading. After all the byte data in the data block are read, the process proceeds to step S108, where the CRC check value of all the byte data in the data block is calculated and stored.

In step S109, it is determined whether the number of reads of the same data block is equal to or greater than a threshold number of reads.

In one embodiment, the threshold number of reads is 3, that is, 3 times for each data block is repeated, and 3 CRC check value calculations are performed. Therefore, in the implementation, it is compared whether the number of reads corresponding to the current data block is greater than or equal to 3. If the step S105 is needed to be returned, the data block is repeatedly read to perform the next CRC check value calculation, the step S110 is firstly to regenerate a random byte number sequence, and then the step S105 is returned, so that even if the same data block is read, the byte data reading sequence is different, and the capability of resisting the template attack is improved. Otherwise, when the CRC check value is greater than or equal to 3 times, in step S111, it is compared whether all the stored CRC check values are identical. If the stored data is not consistent in the read process, the process proceeds to step S112, where the byte data corresponding to the CRC check value is discarded, the read is exited, and the device is required to be restarted. If so, the current data block is considered to be correctly read and not tampered with, and the process proceeds to step S121. For an attacker, only 3 tampering operations hit the same system parameter, and the tampering results are consistent, the fuse controller can be spoofed.

The protection of the key data is composed of steps S113 to S120, and specifically includes:

step S113, a random byte number for randomly selecting the scrambled byte data is generated according to the byte length contained in the data block. The random byte number corresponds to one of the byte numbers of all byte data in the data block.

Then in step S114, reading of one byte of data from the data block of the fuse device is started in accordance with the order indicated in the random byte number sequence. Before each reading of byte data, a random number of a reading period is generated, the reading period of the fuse device is updated, and then the byte data is read from the fuse device in cooperation with the reading period. In this way, the power consumption, run-time data obtained under multiple template attacks for the same data sequence will also be quite different.

For each byte data read, an interference is applied in step S115 to generate a scrambled byte data. The specific scrambling method may be to generate a random number of one byte and perform a logic operation with each byte of data.

Comparing the byte number of the byte data currently read with the random byte number in step S116, and if the byte numbers are equal, storing the erroneous scrambled byte data in the memory cell in the order of the byte data in the fuse device in step S117; in contrast, in step S118, the correct unscrambled byte data is stored in the memory cells in the order of the byte data in the fuse device.

After one byte of the stored data (scrambled byte data or byte data) is stored in the storage unit, it is determined in step S119 whether a complete data block has been read, and if there are more bytes to be read, the process returns to step S114 to continue reading.

After the data of the complete data block composed of the scrambled data and the number of bytes is obtained, the error correction process is completed by step S120. Because the key data comprises two parts of original data and error correction codes, and the number of the scrambled byte data is smaller than the number of bytes which can be corrected by the error correction codes, the scrambled byte data is repaired into correct byte data through the RS decoding module. In the original data portion analyzed by the byte data, the byte data is stored in the memory cell in the order of the fuse device, and the reading of one of the data blocks is completed, and the process proceeds to step S121.

Step S121 applies the system parameter data and the key data at the same time, and after the fuse device finishes the reading operation of the current data block and is ready to read the next data block, it proceeds to step S122.

In step S122, it is checked whether all the data blocks corresponding to the stored data have been read, and if there are not yet read data blocks, the next not yet read data block is selected according to the order indicated in the random data block number sequence, and the process goes to step S103 to start reading. Otherwise, as shown in step S123, it is considered that the reading of all the stored data has been completed, and the reading process is exited.

The preferred embodiment of the invention further comprises a fuse controller for resisting data tampering and template attack, and the fuse reading method for resisting data tampering and template attack in the embodiment is implemented.

Referring to fig. 2, a digital chip according to a preferred embodiment of the present invention further includes a fuse controller 100, a fuse device 200 and a memory cell 300. The fuse controller 100 is configured to perform the fuse reading method against data tampering and template attack in the above-described embodiment. The fuse device 200 is used to store key data or system parameter data in the above-described embodiments. The memory unit 300 is used to store key data or system parameter data read out after the fuse reading method is performed by the fuse controller 100, and operating parameters such as a saved CRC check value or the like required when various types of fuse controllers 100 perform the reading method.

The foregoing description is only of the preferred embodiments of the present invention and is not intended to limit the scope of the invention, and all equivalent structures or equivalent processes using the descriptions and drawings of the present invention or directly or indirectly applied to other related technical fields are included in the scope of the invention.

Claims

1. A fuse reading method against data tampering and template attack for securely reading stored data stored in a fuse device, the data type of the stored data including key data or system parameter data, the fuse reading method comprising:

generating a random data block number sequence for randomizing the reading sequence of the data blocks according to the number of the plurality of data blocks corresponding to the stored data;

the read operation includes:

when the stored data is the system parameter data, reading the byte data according to the sequence of the random byte number sequence;

writing the byte data into the continuous addresses according to the actual sequence, and calculating the check value of the byte data in the continuous addresses after all bytes are read;

comparing whether all the stored check values are consistent, if so, continuing to read the next data block; if the byte data corresponding to the check value is not consistently discarded, the reading is stopped, and the equipment is required to be restarted; and

storing the read byte data in a storage unit according to the sequence of the byte data in the fuse device after reading one data block, and obtaining the sequentially stored storage data in the storage unit after all the data blocks are read;

when the stored data is the key data, generating a random byte number according to the size of the current data block;

reading the byte data according to the random byte number sequence, and applying interference to the read byte data to obtain erroneous byte data;

comparing the byte number of the byte data read currently with the random byte number, and if the byte number is equal, storing the scrambled byte data in a storage unit according to the sequence of the byte data in the fuse device; otherwise, the byte data are stored in a storage unit according to the sequence of the byte data in the fuse device; and

and after the reading of one complete data block is finished, analyzing the original data corresponding to the data block by utilizing the error correction code in the byte data, storing the original data in a storage unit according to the sequence of the byte data in the fuse device, and obtaining the storage data stored in sequence in the storage unit after the reading of all the data blocks is finished.

2. The method of claim 1, wherein reading the byte data in the order of the random byte number sequence comprises:

generating a random number of a reading period;

the read cycle of the fuse device is updated and then the byte data is read from the fuse device in coordination with the read cycle.

3. The method for reading fuses against data tampering and template attacks according to claim 1, wherein the threshold number of reads is 3.

4. The method of claim 1, wherein the check value is a CRC check value.

5. The method of claim 1, wherein the error correction code is generated by an RS error correction algorithm.

6. The method for reading fuses against data tampering and template attacks according to claim 5, wherein the RS error correction algorithm comprises 32 bytes of the original data and 12 bytes of error correction codes per 44 bytes of the stored data.

7. A fuse controller resistant to data tampering and template attacks, characterized by being adapted to perform the method of fuse reading resistant to data tampering and template attacks of claim 1.

8. A digital chip, comprising: a fuse controller adapted to perform the method of reading fuses against data tampering and template attacks of claim 1; a fuse device adapted to store key data or system parameter data; and a storage unit adapted to store the key data or the system parameter data read out by the fuse controller.