Terminal chip integrated with security element

The present application provides example terminal chips. One example terminal chip includes a security element, an application processor, and an interface module configured to transfer information between the application processor and the security element. The terminal chip includes a first power interface configured to receive power outside the terminal chip. A first power input port of the security element is connected to the first power interface, and at least one of the application processor or the interface module is connected to the first power interface. In the example terminal chip, a power supply port of the security element is connected to a power supply port of the application processor or the interface module of the terminal chip.

TECHNICAL FIELD

The present invention relates to the chip field, and in particular, to terminal integrated with a security element.

BACKGROUND

With performance improvement of intelligent terminals and popularity of Internet applications, people usually use a wireless network of an intelligent terminal to perform online payment or another financial activity in daily life. To reduce accompanying financial security risks, the intelligent terminal is usually provided with a security element. A coprocessor, a security application for encryption, decryption, and authentication, and a corresponding protocol platform are usually embedded into the security element. The security element provides identity authentication and information encryption services for a user of the intelligent terminal in a financial transaction process.

A SIM card is a relatively common security element distributed by an operator and may be used for identity authentication. In addition, a USB key management client may be stored in the SIM card to meet a network bank function requirement of each bank. The SIM card is generally connected to a system in an intelligent terminal by using a dedicated slot on the intelligent terminal.

With advancement in production processes, in recent years, a security element is fastened in an independent chip form together with another component such as a processor chip of an intelligent terminal, to a backplane of the intelligent terminal, and is referred to as an embedded security element (eSE for short) chip in the industry. A function of the embedded security element chip is basically the same as that of the SIM card. However, the embedded security element chip is customized by a terminal device manufacturer; therefore, an interface and a communications module of the embedded security element chip can be flexibly disposed, so as to interwork and share data with another chip and component in the intelligent terminal.

Both the embedded security element chip and the processor chip are powered by a power management chip in the intelligent terminal. Currently, there is an attack manner referred to as power supply pin burr injection. An attacker performs voltage burr injection by using a power supply pin of the embedded security element chip. The voltage burr injection causes a temporary fluctuation on a voltage signal on the power supply pin. This temporary fluctuation causes a drift on threshold voltage of a transistor in the chip; therefore, sampling input time of some triggers are abnormal. Consequently, the triggers enter an error state and a misoperation is caused. The attacker may establish, based on the misoperation caused, a model for analysis, so as to discover important security information hidden in the embedded security element chip and violate user benefits.

Therefore, it is necessary to provide a solution to prevent security information leakage when a security element encounters a power supply attack.

SUMMARY

Embodiments of the present invention provide a terminal chip. The terminal chip includes a security element, an application processor, and an interface module configured to transfer information between the application processor and the security element. The terminal chip includes a first power interface configured to receive power outside the terminal chip. A first power input port of the security element is connected to the first power interface, and a power supply port of at least one of the application processor or the interface module is connected to the first power interface.

In the terminal chip in the embodiments of the present invention, the power supply port of the security element is connected to the power supply port of the application processor or the interface module of the terminal chip. Therefore, when a power supply attack occurs, power supply causes abnormality of the application processor or the interface module of the terminal chip at the same time. Because of the abnormity of the application processor and the interface module, information in the security element cannot be correctly obtained from external. Consequently, an attacker cannot obtain sensitive information from the security element by performing the power supply attack.

The terminal chip includes a plurality of interface modules, such as a bus and a memory controller. At least one of the application processor, the memory, or the memory controller is connected to the first power interface.

The first power interface is a digital power interface.

The terminal chip further includes a second power interface, and the second power interface is an analog power supply. The security element further includes an analog power supply port, and the analog power supply port is connected to the analog power interface.

The terminal chip further includes a high-speed interface physical layer circuit, a phase-locked loop circuit, and an electrically programmable fuse circuit, and at least one of the high-speed interface physical layer circuit, the phase-locked loop circuit, or the electrically programmable fuse circuit is connected to the analog power interface. The analog power supply port is connected to the analog power interface. Therefore, when the power supply attack is initiated from the analog power interface, damages of the high-speed interface physical layer circuit, the phase-locked loop circuit, or the electrically programmable fuse circuit can affect normal operation of the application processor, so that it is more difficult for the attacker to obtain the sensitive information from the security element.

To further improve security, a minimum timing margin in the security element is greater than a minimum timing margin of the application processor or the interface module connected to the first power interface, thereby ensuring that the application processor or the interface module firstly becomes abnormal under the power supply attack.

A system for security authentication is provided in the security element.

The security element includes a coprocessor, a security bus, and a module configured to perform encryption, decryption, and identity authentication.

DESCRIPTION OF EMBODIMENTS

FIG. 1is a schematic diagram of an architecture of a terminal device in an embodiment of the present invention. As shown in the figure, the terminal device includes a terminal chip10, an off-chip memory20, and a power management unit30(Power Management unit, PMU for short). The terminal chip10includes an application processor12, a bus14, a memory controller16, and a security element18.

The application processor12is usually a so-called central processing unit (Central Processing Unit, CPU for short), and is configured to perform tasks according to instructions from various application programs. The application processor12interacts with another module in the main chip10by using the bus14. In an optional embodiment, when an application program that has a security requirement needs to access the security element, the application processor12writes access request into the off-chip memory20by using the memory controller16, and instructs the security element18to extract, by using the memory controller16, the access request from the off-chip memory20. When the security element18needs to send data back to the application processor12, the security element18also writes the to-be-sent-back data into the off-chip memory20by using the memory controller16, and instructs the application processor12to extract the sent back data from the off-chip memory20.

The security element18has a function similar to that of the security element described in the Background section, and is configured to provide security services, such as authentication, encryption, and decryption, for a task that has a security requirement in a security system. In this embodiment of the present invention, modules of the security element18are integrated into the terminal chip and exchange data with the application processor12and the off-chip memory20through a unique interface. As shown inFIG. 1, the security element18in this embodiment of the present invention includes a coprocessor182, an interaction interface183, a secure memory184, an authentication module185, a security bus186, and a sensor module187.

The coprocessor182is configured to coordinate and schedule various tasks in the security system.

The interaction interface183includes an IPC (Inter-Process Communication, inter-process communication) module1832and a shared buffer1834. The IPC module is configured to send an interruption request to the application processor12or the coprocessor182, and the shared buffer1834is configured to buffer to-be-executed request data for the application processor12and the coprocessor182. The shared buffer1834is the unique data interface in the main chip10which leads to the security element18. When the terminal chip10has request data that needs to be processed by the security element18, the request data is usually first stored in the off-chip memory20; then, the application processor12writes the request data into the shared buffer1834by using the bus, and sends an interruption request to the coprocessor182by using the bus14and the IPC module1832. After receiving the interruption request, the coprocessor182extracts the request data from the shared buffer, and performs a corresponding task. After executing the request data, the coprocessor182may write a processing result into the shared buffer1834, and then instructs the IPC module to send, by using the bus14, an interruption request, to instruct the application processor12to extract the processing result.

The interruption request, as the name implies, makes a receiving side interrupt a currently on-going operation or application. A requirement of a security related application, such as an online payment or a financial transaction, usually has a high priority. Therefore, sending the interruption request can ensure that the coprocessor in the security element18can extract, in priority, the request data from the buffer1834and executes the request data.

As a dedicated memory of the coprocessor182, the secure memory184is configured to store system or platform code. Generally, the secure memory184includes two types of memories: ROM (Read-Only Memory, read-only memory) and RAM (Random Access Memory, random access memory). The ROM is configured to store code for startup, self-check, and initialization of the security system; and the RAM is configured to store security-related security application code and data in an operating system software.

The authentication module185is configured to perform, according to the request data received from the shared buffer1834, an operation related to identity authentication, such as random number generation, key management, encryption, and decryption.

The security bus186is configured to provide a bus service for the modules in the security element18.

The sensor module187includes a digital sensor and an analog sensor, and is configured to detect illegal physical intrusion into the security element18and send an alarm to the coprocessor182. The coprocessor182resets the system, clears a register, or performs another operation to protect sensitive information in the security element.

Certainly, in addition to the foregoing modules, there are many other function modules in the terminal chip and the security element, and details are not described herein.

In this embodiment of the present invention, the terminal chip10further includes a power interface17. In an optional implementation, the power interface17may be a pin of the terminal chip10. The power interface17is connected to the power management unit30, and is configured to receive power from the power management unit30and supply power to a plurality of modules in the terminal chip10.

A power supply port of the security element18is connected to the power interface17, and is configured to receive power through the power interface17, so as to satisfy power requirements of the modules in the security element18. In addition, a voltage input end of at least one of the application processor12, the bus14, or the memory controller16is connected to the power interface17, and is configured to receive power through the power interface17, to satisfy a power requirement. In this way, when an attacker launches a power supply attack through the power interface17, the application processor12, the bus14, or the memory controller16becomes abnormal, so that the attacker cannot obtain correct feedback information from the security element18, thereby preventing information leakage.

To better prevent the security element18from leaking information under the power supply attack, in this embodiment of the present invention, a minimum timing margin of register arrays in the security element18is set to be greater than a minimum timing margin of the application processor12, the bus14, or the memory controller16that is connected to the power interface17. In this way, when the power supply attack occurs, a register array in the application processor12, the bus14, or the memory controller16becomes abnormal.

For ease of understanding the technical content of this embodiment of the present invention, a concept of the timing margin is described herein.

A field-programmable gate array (Field-Programmable Gate Array, FPGA for short) or another integrated circuit is a very common integrated circuit combination mode currently, and may be configured to transfer an instruction and data. The FPGA is widely applied to function modules including a processor, a bus, and a memory controller that are in a terminal chip. The security element in this embodiment of the present invention also includes integrated circuits corresponding to the coprocessor, the security bus, and memory control, and certainly includes various FPGAs.

A register is a basic unit in an FPGA. In a running process of the FPGA, a digital signal is transferred between registers. As shown inFIG. 2, a register D1transfers a signal0or1to a register D2. Both the register D1and D2operate under control of a same clock signal. The clock signal shown inFIG. 2includes three rising edges: an Edge0, an Edge1, and an Edge2. The register D1starts to send the signal at the rising edge Edge0. A delay exists in a process of latching data by a register; therefore, to ensure that the register D2can correctly latch the signal, the signal needs to arrive at the register D2ahead of a period of time before arrival of the rising edge Edge1. The “a period of time ahead” may be regarded as “a timing margin”. If a size of the timing margin allows that the register D2latches the signal before the arrival of the rising edge Edge1, the register D2can correctly latch the signal sent by the register D1. If the size of the timing margin does not satisfy a time for the register D2to latch the signal, that is, if the rising edge Edge1arrives before the register D2successfully latches the signal sent by the register D1, an error may occur when the signal is finally latched by the register D2.

It can be easily learned from the foregoing description that, for two adjacent registers that have been preset and combinational logic between the two adjacent registers, a timing margin that satisfies normal operation has a minimum value, that is, in the normal operation, the two adjacent registers can correctly transfer a signal to each other on the prerequisite that a minimum timing margin is satisfied. In a normal case, it is always ensured that a timing margin can satisfy a requirement in design of an integrated circuit. However, when the two adjacent registers encounter a power supply attack, an extra delay is generated during signal transfer between the two adjacent registers, and consequently, the timing margin becomes insufficient. Therefore, a larger timing margin indicates that the register array has a higher resistance to the power supply attack.

In this embodiment of the present invention, a stricter standard is used on a timing margin of each register array in the security element18in a design phase while the minimum timing margin required for normal operation is satisfied, so as to ensure that a minimum timing margin in the security element18is greater than a minimum timing margin of the bus, the memory controller, or the application processor that is also connected to the power interface17. In this way, when the power supply attack occurs, a register array of the bus, the memory controller, or the application processor becomes abnormal. Consequently, an external information path of the security element18becomes incorrect under the power supply attack, and the attacker cannot obtain the sensitive information in the security element18by using abnormality feedback to the power supply attack.

Certainly, in an optional embodiment, if an operating status of another interface module, in addition to the application processor12, the bus14, and the memory controller16, in the terminal chip, can directly affect writing data into or reading data from the security element18, connecting a power input port of the interface module and a power input port of the security element to a same power supply pin can also implement technical effects of the present invention.

Function modules such as the application processor, the bus, the memory controller, and the security element18usually include a plurality of register arrays.

InFIG. 2, data sent by the register D1to the register D2is delayed twice before arriving at the register D2. The register D1starts to trigger sending of the data at the time point Edge0, and allows the data to actually depart from the register D1after a very short time period t1. The time period t1is a broadcast delay of the register D1. In this embodiment of the present invention, the time period t1is referred to as a sending delay. Time is consumed for sending a signal through the register D1and on a path from the register D1to the register D2. Various logic devices are further disposed between the register D1and the register D2, and time is also consumed for the signal to pass through these logic devices. In this embodiment of the present invention, a time period t2is obtained by adding the time consumed for sending the signal on the path between the registers D1and D2and the time consumed for the signal to pass through the logic devices between the registers D1and D2, and the t2is used as a path delay. Therefore, after being sent by the register D1at the Edge0, the signal can arrive at the register D2after a time period t1+t2. A time interval between the Edge0and the Edge1is fixed; therefore, a timing margin may be increased by shortening the time period t1+t2. To shorten the time period t1+t2, a more sensitive register may be chosen and used to shorten the sending delay t1, or a quantity of the logic devices between the registers may be reduced to shorten the path delay t2.

In an actual product, the terminal chip includes two types of power interfaces: digital power interface and analog power interface. The digital power interface is usually connected to digital voltage of 0.8 v (in new 16 nm and 28 nm processes, the digital voltage is 0.8 v, while in another old process, the digital power supply voltage may be greater than 0.8 v), and is configured to supply power to a digital function device in the terminal chip, such as the application processor, the bus, or the memory controller. Therefore, the power interface described above is actually a digital power interface. For the security element, all important devices in the security element, such as the coprocessor, the authentication module, and the security bus, need digital power supply input. Therefore, this is very important to prevent a power supply attack that launches from a digital power supply side.

The analog power interface is usually connected to analog voltage of 1.8 v (in the new 16 nm and 28 nm processes, the analog voltage is 1.8 v, while in another old process, the data power supply voltage may be greater than 1.8 v), and is usually configured to supply power to analog devices of a chip memory in the terminal chip, such as a high-speed interface physical layer circuit (DDR-phy), a phase-locked loop circuit (Phase Locked Loop, PLL for short), and an eFuse circuit (electrically programmable fuse). In the security element18, a monitor circuit, a sensing circuit, and the like usually need analog power input, and these circuits do not process or store sensitive information. Therefore, a power supply attack launched by an attacker from an analog power supply does not cause a very serious leakage risk.

The security element is used as an integrated module embedded in the terminal chip, and an area of the security element occupies a small proportion in the terminal chip. Therefore, the security element, as a whole, usually includes only two power input ports: an analog power input and a digital power input. The digital power input and the analog power input are connected to the digital power interface and the analog power interface of the terminal chip respectively. A wiring requirement of the terminal chip needs to be considered, and there may be a plurality of digital power input ports or a plurality of analog power supply ports. Anyhow, according to the description in the foregoing embodiments, connecting a digital power input of the bus, the memory controller, or the application processor of the terminal chip to a same digital power interface as the digital power input of the security element can prevent information in the security element from being leaked. In addition, a minimum timing margin of a module that is in the security element and that is connected to the digital power interface is greater than the minimum timing margin of the bus, the memory controller, or the application processor of the terminal chip. Therefore, a better security effect can be achieved.

In addition, if a function module that receives analog power input and that is in the terminal chip, such as the high-speed interface physical layer circuit, the phase-locked loop circuit, or the eFuse circuit in the chip memory, becomes abnormal under the power supply attack, the attacker is also interfered with when stealing the sensitive information from the security element by using the function module of the terminal chip. Therefore, in a special scenario, some function modules in the terminal chip that receive the analog power input may alternatively be connected to a same analog power interface as the security element, and a minimum timing margin of a corresponding module of the security element is set to be greater than a minimum timing margin of another module connected to the analog power interface.

The modules described as separate parts may or may not be physically separate, and parts displayed as modules may or may not be physical units, may be located in one position, or may be distributed on a plurality of network nodes. Some or all the nodes may be selected according to actual needs to achieve the objectives of the solutions of the embodiments.

In addition, function modules in the embodiments of the present invention may be integrated into one processing unit, or each of the modules may exist alone physically, or two or more modules are integrated into one module. The foregoing integrated unit may be implemented in a form of hardware, or may be implemented in a form of a software function unit.