Disclosure of Invention
In view of this, in order to solve one of the technical problems in the related art to a certain extent, it is necessary to provide a method, a system and a platform for designing physical protection for key signals in an SSD host chip, so as to enhance the physical security protection of the SSD host chip.
The invention provides a physical protection design method for key signals in an SSD main control chip, which comprises the following steps:
determining the number of metal layers according to the number of security levels of key signals related to data security;
Searching a path of a key signal in an SSD chip design netlist, and designing a wiring corresponding to the key signal into a corresponding metal layer according to the security level of the key signal, wherein the wiring corresponding to the key signal with higher security level is designed into a deeper metal layer.
According to the scheme, the wiring corresponding to the key signals can be specially designed, the wiring corresponding to the key signals with low safety level is designed into the metal layer closer to the surface layer, the wiring corresponding to the key signals with high safety level is designed into the metal layer closer to the deep layer, an attacker needs to penetrate or cut through the upper metal layer of the multi-layer chip to obtain the wiring design of the deepest layer, and after reaching the bottom layer, the upper connecting structure is almost completely damaged, the chip can fail, so that the difficulty of attacking the SSD main control chip is improved.
The invention provides a physical protection design method for key signals in an SSD main control chip, which comprises the following steps:
Forming a key safety signal list of different safety levels according to the safety levels of the key signals related to the data safety, and recording the design paths of the key signals in the RTL code into the key safety signal list of different safety levels;
importing an RTL code into a logic synthesis tool (Design compiler) to complete circuit integration and generate an SVF file and an SSD chip design netlist, wherein the SVF file records the mapping relation from the RTL code to a netlist unit;
Outputting a total list of key safety signal positions according to the path information of the key signals recorded in the key safety signal lists with different safety levels in RTL codes and according to the mapping relation from the RTL codes recorded in the SVF file to the netlist unit, wherein the total list of key safety signal positions records the positions of all the key signals in the netlist;
Dividing the total list of the positions of the key safety signals into position sub-lists with different safety levels according to the safety levels to which the key signals belong, wherein each position sub-list records the positions of the signals to be protected with the corresponding safety levels in the netlist;
the position sub-list of each security level is sequentially imported into a chip layout tool;
and the chip layout tool performs layout design on the wiring corresponding to the signals in the position sub-list according to the configured metal layer allowing the wiring of each security level, wherein the wiring corresponding to the key signals with higher security level is designed into the deeper metal layer.
According to the scheme, only the key signals and the security levels of the key signals are determined, the wirings corresponding to the key signals can be automatically designed specifically, the wirings corresponding to the key signals with low security levels are designed into the metal layers closer to the surface layers, the wirings corresponding to the key signals with high security levels are designed into the metal layers deeper, a great deal of manpower is saved, the risk brought by subjective experience is avoided, an attacker attacks the SSD main control chip, the attacker needs to penetrate or cut through the upper metal layers of the multi-layer chip to obtain the deepest wiring design, and at the moment, after reaching the bottom layer, the upper connecting structure is almost completely damaged, the chip is invalid, so that the difficulty of the SSD main control chip being attacked is improved.
Detailed Description
The following description of the embodiments of the present invention will be made clearly and completely with reference to the accompanying drawings, in which it is apparent that the embodiments described are only some embodiments of the present invention, but not all embodiments. All other embodiments, which can be made by those skilled in the art based on the embodiments of the invention without making any inventive effort, are intended to fall within the scope of the invention. It is to be understood that the drawings are designed solely for the purposes of illustration and not as a definition of the limits of the invention.
As shown in fig. 1, the method for designing physical protection for key signals in the SSD master control chip according to the first embodiment of the invention includes the following steps:
s101, determining the number of metal layers according to the number of security levels of key signals related to data security.
The key signals related to the data safety are different according to the functions, the importance degrees of the key signals are all different, and the safety level of the key signals is determined according to the importance degrees. In general, the chip global security world's switch enable switch signal and the chip root key signal may be the highest security level signal, which is the first security level, the random number generated by the chip random number generator is the second security level, which is the second security level, the user derived key is the third security level, which is the third security level, and so on.
Generally, the number of metal layers is consistent with the number of security levels of the key signal.
S102, searching a path of a key signal in an SSD chip design netlist, and designing a wiring corresponding to the key signal into a corresponding metal layer according to the security level of the key signal, wherein the wiring corresponding to the key signal with higher security level is designed into the deeper metal layer.
More preferably, the step further comprises designing the wirings corresponding to the signals of the front and rear stages of the key signals into the corresponding metal layers. The higher the security level, the more the number of signal stages that need to be protected before and after the key signal corresponds. Therefore, the possibility that an attacker reversely acquires the key signal through the front-stage signal and the rear-stage signal of the key signal can be prevented, the physical safety of the key signal is improved, and the protection range of the key signal is enlarged.
According to the method, the wiring corresponding to the key signal can be specially designed, the wiring corresponding to the key signal with low safety level is designed into the metal layer closer to the surface layer, the wiring corresponding to the key signal with high safety level is designed into the metal layer closer to the deep layer, an attacker needs to penetrate or cut through the upper metal layer of the multi-layer chip to obtain the deepest wiring design, at the moment, after the bottom layer is reached, the upper connecting structure is almost completely damaged, the chip is invalid, and therefore the difficulty of attacking the SSD main control chip is improved.
As shown in fig. 2, the method for designing physical protection for key signals in the SSD master control chip according to the second embodiment of the invention includes the following steps:
S201, forming a key safety signal list of different safety levels according to the safety levels of the key signals related to the data safety, and recording the design paths of the key signals in the RTL code into the key safety signal list of different safety levels.
After finishing the RTL code of the SSD main control chip, a key safety signal list with different safety levels can be formed according to the safety levels of key signals related to data safety, and the design path of the key signals in the RTL code is recorded into the key safety signal list with different safety levels, wherein the key signals can be register signals in the RTL design.
S202, importing the RTL codes into a logic synthesis tool (Design compiler) to complete circuit synthesis and generate SVF files and SSD chip design netlists, wherein the SVF files record the mapping relation of the RTL codes to netlist units.
S203, outputting a total list of key safety signal positions according to the path information of the key signals recorded in the key safety signal lists with different safety levels in RTL codes and according to the mapping relation between the RTL codes recorded in SVF files and netlist units, wherein the total list of key safety signal positions records the positions of all the key signals in the netlist.
After this step, it may further include receiving the front and rear several-stage signals in the critical signal as safety signals and the front and rear several-stage signals are consistent with the safety level of the critical signal, and then adding the front and rear several-stage signals and the critical signal together into the critical safety signal list to obtain a total list of signal positions of the signals in the netlist that ultimately need to be protected.
Specifically, the more the number of signal stages to be included in the front and rear signals corresponding to the key signals with higher security level is, the wider the protection range of the key signals is. Therefore, the possibility that an attacker reversely acquires the key signal through the front-stage signal and the rear-stage signal of the key signal can be prevented, and the physical safety of the key signal is improved.
S204, splitting the total list of the positions of the key safety signals into position sub-lists with different safety levels according to the safety levels, wherein each position sub-list records the positions of the signals to be protected with the corresponding safety levels in the netlist.
Split into a first security level location sub-list, a second security level location sub-list. The sub-list of locations for each security level records the locations in the netlist of the signals that ultimately need to be protected for the corresponding security level.
S205, the position sub-list of each security level is sequentially imported into the chip layout tool.
And S206, carrying out layout design on the wiring corresponding to the signals in the position sub-list by the chip layout tool according to the configured metal layers allowing the wiring in each security level, wherein the wiring corresponding to the key signals with higher security level is designed into the deeper metal layers.
The embodiment only needs to determine which key signals and the security level of the key signals, the routing corresponding to the key signals can be specially designed automatically, the routing corresponding to the key signals with low security level is designed into the metal layer closer to the surface layer, the routing corresponding to the key signals with high security level is designed into the metal layer closer to the deep layer, a great deal of manpower is saved, the risk brought by subjective experience is avoided, an attacker attacks the SSD main control chip, the attacker needs to penetrate or cut through the upper metal layer of the multi-layer chip, the deepest routing design can be obtained, at this time, after reaching the bottom layer, the upper connecting structure is almost completely damaged, the chip can fail, and therefore the difficulty of the SSD main control chip being attacked is improved.
Fig. 3 is a block diagram of an embodiment of a design platform 100 for physically protecting key signals in an SSD host chip according to the present invention, where the platform 100 may include a processor 10, a storage device 20, and a computer program, such as a design program, stored in the storage device 20 and capable of running on the processor 10.
A computer program can be stored in the storage device 20 and can be executed by the processor 10 to implement the methods described in the first and second embodiments.
The processor 10 may be a Central Processing Unit (CPU), but may also be other general purpose processors, digital Signal Processors (DSPs), application Specific Integrated Circuits (ASICs), field Programmable Gate Arrays (FPGAs) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general purpose processor may be a microprocessor or any conventional processor or the like that is a control center of the platform 100 that interfaces and lines to various portions of the entire platform 100.
The storage device 20 may be used to store the computer program and/or module, and the processor 10 implements various functions of the platform by running or executing the computer program and/or module stored in the storage device 20, and invoking data stored in the storage device 20. The storage device 20 may mainly include a storage program area which may store an operation platform, programs required for at least one function, and the like, and a storage data area which may store data created according to the use of the mobile phone, and the like. In addition, the storage device 20 may include a high-speed random access memory device, and may also include a non-volatile memory device, such as a hard disk, memory, a plug-in hard disk, a smart memory card, a secure digital card, a flash memory card, at least one magnetic disk storage device, a flash memory device, or other non-volatile solid state storage device.
Fig. 4 is a schematic structural diagram of a first embodiment of a system 200 for physically protecting and designing key signals in an SSD main control chip provided by the invention, where the system 200 for physically protecting and designing key signals in an SSD main control chip may include a determining module 211 and a wiring module 212.
The determining module 211 is configured to determine the number of metal layers according to the number of security levels of the key signal related to data security;
the routing module 212 is configured to search a path of a key signal in an SSD chip design netlist and design a trace corresponding to the key signal into a corresponding metal layer according to a security level to which the key signal belongs, where the trace corresponding to the key signal with a higher security level is designed into a deeper metal layer.
Further, the wiring module 212 is further configured to design the wirings corresponding to the signals of the front and rear stages of the key signals into the corresponding metal layers.
Further, the higher the security level, the more the number of signal stages that need to be protected before and after the key signal corresponds.
Fig. 5 is a schematic structural diagram of a second embodiment of a system 200 for physically protecting and designing key signals in an SSD main control chip provided by the invention, where the system 200 for physically protecting and designing key signals in an SSD main control chip may include a forming module 221, a reading module, a circuit synthesis module 222, an output module 223, a splitting module 224, an importing module 225, and a wiring module 226.
The forming module 221 is configured to form a list of key security signals with different security levels according to the security levels of the key signals related to data security, and record a design path where the key signals are located in the RTL code into the list of key security signals with different security levels;
The circuit synthesis module 222 is configured to import the RTL code into a logic synthesis tool (Design compiler) to complete circuit synthesis and generate an SVF file and an SSD chip design netlist, where the SVF file records a mapping relationship between the RTL code and the netlist unit;
the output module 223 is configured to output a total list of positions of the key security signals according to path information of the key signals in the RTL codes recorded in the key security signal lists with different security levels and according to a mapping relationship between the RTL codes recorded in the SVF file and the netlist unit, where the total list of positions of the key security signals records positions of all the key signals in the netlist;
The splitting module 224 is configured to split the total list of positions of the key security signals into sub-lists of positions of different security levels according to the security levels to which the key signals belong, where each sub-list of positions records the positions of signals to be protected of the corresponding security level in the netlist;
the importing module 225 is configured to import the chip layout tool sequentially from the sub-list of locations of each security level;
And the wiring module 226, the chip layout tool performs layout design on the wiring corresponding to the signals in the position sub-list according to the metal layer of the wiring allowed by each configured security level, wherein the wiring corresponding to the key signal with higher security level is designed into the deeper metal layer.
Further, the system 200 also includes an inclusion module and a location list module.
The inclusion module is used for receiving a plurality of front and rear level signals in the key signals as safety signals before the total list of the positions of the key safety signals is split into position sub-lists with different safety levels according to the safety levels, and the front and rear level signals are consistent with the safety levels of the key signals;
And the position list module is used for adding the front and rear stages of signals and the key signals into a key safety signal list together to obtain a signal position total list of the signals which are finally required to be protected in the netlist.
Further, the higher the security level, the more the number of signal stages that need to be protected before and after the key signal corresponds.
The foregoing description of the preferred embodiment of the invention is not intended to be limiting, but rather is intended to cover all modifications, equivalents, and alternatives falling within the spirit and principles of the invention.