TWI384382B - Embedded protection device for protecting software content and its protection method - Google Patents

Description

Embedded protection device for protecting software content and protection method thereof

The invention relates to a protection technology, in particular to an embedded protection device for protecting software content and a protection method thereof.

In this era of advanced information technology, information, communication networks and consumer electronics are indispensable tools for modern people to exchange information and process data. In view of this, related product manufacturers are not eager to carry out research and development design for this huge consumer business opportunity, and can produce information equipment that meets the needs of consumers, so that most consumers will be favored in this product field. Being in a leading position, and thus improving the competitiveness of the company itself, has made the competition among manufacturers of related products more intense.

In addition to investing in product competition, these product manufacturers share a common belief that if the product is to be competitive, the added function of the product must be more humanized, so that most consumers can accept it. The key to this is the embedded software contained inside the information device. This soft system is written inside the hardware (called firmware), which is responsible for hardware drive, program control and interface processing. A full-featured embedded software can enhance the value and competitive advantage of information devices, and may also increase the chances of the software being copied. This will cause the legitimate software manufacturer to suffer huge losses of profits, which will hinder the future. The development of other embedded software.

In the past, most of the software or firmware protection methods were encrypted by encryption technology, serial number protection, software delivery authorization, and security concerns in the development of software products, including improper access and development of developers during the development period. The pirated behavior of the software, the security of the software distribution authorization, and the use of the software after circulation, etc., are likely to cause the software protection method to be cracked. On the other hand, in terms of firmware, the protection mechanism is even weaker, and almost all hardware and firmware programs can be used without any authorization.

Although in order to solve the above problems, some patents have proposed a security device that uses only a linear feedback displacement register to generate a virtual random random number, but this design has a disadvantage because it has periodicity, so After every few cycles, the same number of random numbers will continue to be generated. This way there is still the risk of being suspected of being cracked.

Accordingly, the present invention has been made in view of the above-mentioned problems, and provides an embedded protection device for protecting software content and a protection method thereof, which can improve the conventional disadvantages.

The main object of the present invention is to provide an embedded protection device for protecting software content and a protection method thereof, which is to be Ronald. Levist, Adi. Samuel and Leonard. The Adelman (RSA) algorithm is implemented by hardware cooperative encryption and decryption, which makes the embedded firmware better protected by security.

To achieve the above objective, the present invention provides an embedded protection device for protecting software content, including a random random number generation module, which continuously generates a virtual random according to an authorization code transmitted by a firmware program when executed by a processor. Random number; a random public-private key generation module, which is connected to a random random number generation module, and uses the received virtual random random number pair authorization code to generate a public key and a private key by using an RSA algorithm, and a random public-private key generation module Connected to a random access memory module, the memory module can store the received authorization code, and its corresponding virtual random number, public key, private key. The above three modules are all connected to an encryption and decryption module, and the encryption and decryption module uses the received virtual random random number, public key and private key to store the authorization code and virtual random random number in the random access memory module. The public key and the private key are encrypted, and the encrypted data is formed and transmitted to the firmware program. When the authorization check is performed, the encryption and decryption module receives the encrypted data transmitted by the firmware program to decrypt and decode the data. After the result is output to the random access memory module, it is compared with the authorization code, virtual random number, public key and private key stored therein to control the execution state of the firmware program; finally, there is an output. The interface module is connected to the processor, the encryption and decryption module and the random access memory module, and serves as an interface for transferring data between the module and the processor.

The invention also provides a method for protecting the content of the software. Firstly, according to the authorization code transmitted by the firmware program, a virtual random random number is continuously generated, and then an encryption process is executed, which firstly uses the virtual random random number to authorize the authorization code. The public key and the private key are generated by the RSA algorithm, and then the authorization code and its corresponding virtual random random number, private key and public key are stored, and then the authorization code and its corresponding virtual random random number, public key and private key are encrypted. After forming an encrypted data, it is passed to the firmware program, and the encryption process ends. Then, an authorization process is executed, which first receives the encrypted data transmitted by the firmware program, and decrypts, and compares the decoded result value with the authorization code and its corresponding virtual random random number, public key and private key. To obtain a comparison result, it is then determined whether the comparison result can be authorized, and if so, the firmware program is executed, and the encryption process described above is repeated; if not, the firmware program cannot be executed.

In order to give the review board members a better understanding and understanding of the structural features and the efficacies of the present invention, please refer to the preferred embodiment diagrams and the detailed descriptions as follows:

Referring to FIG. 1 , when the embedded software in the memory 24 is used, that is, the firmware program, the memory 24 can be loaded into a processor 22 to execute the firmware program. It is electrically erasable programmable read only memory (EEPROM) or flash memory (Flash). The embedded protection device 10 of the present invention performs an authorization check when the processor 22 executes the firmware program, and the installation location thereof may be built in the processor 22 or integrated on the bus of the processor 22, the processor. 22 can be a central processing unit (CPU) or a digital signal processor (DSP). The protection device 10 includes a random random number generation module 12, which is based on an authorization code transmitted by the firmware program when executed by the processor 22, to continuously generate a non-periodic virtual random number; a random public and private key generation The module 14 is connected to the random random number generating module 12 and receives the virtual random random number. The random public and private key generating module 14 first checks whether the virtual random random number is a prime number, and if not, continues to select the next one. Parameters; if so, use this prime number by Ronald. Levist, Adi: Samuel and Leonard. The Adelman (RSA) algorithm generates a public key and a private key for the authorization code, and the random public and private key generation module 14 is connected to a random access memory module 18, and the memory module 18 can store the received authorization code, and Its corresponding virtual random random number, public key, private key. The three modules 12, 14, and 18 are all connected to an encryption and decryption module 16, and the encryption and decryption module 16 uses the received random random number, public key, and private key to store the random access memory module 18. The authorization code, the virtual random number, the public key, and the private key are encrypted, and the encrypted data is formed and transmitted to the firmware program. When the authorization check is performed, the encryption and decryption module 16 receives the encrypted data transmitted by the firmware. To perform decryption, and output the decoded result value to the random access memory module 18, and compare with the stored authorization code, virtual random random number, public key, and private key to control the toughness. The execution status of the program, and the comparison result is transmitted back to the firmware program through the output interface module 20 for authorization display; finally, there is an input/output interface module 20, which is connected to the processor 22 and the encryption and decryption module 16 And the random access memory module 18, and as an interface for transferring data between the modules 12, 14, 16, 18, 20 and the processor 22.

In the software part, when the firmware program is executed, the input/output interface module 20 can randomly insert a checkpoint as a random sampling basis for providing data communication between the hardware and software protocols, and cooperate with the random random number generation module 12 to obtain the current location. The generated virtual random number is used as the intermediate coefficient of the operation in the time-sharing fast Fourier conversion algorithm, the placement position parameter after the inspection, and the position delay parameter after the inspection. The interpretation of these three parameters described as follows:

(1) The intermediate coefficient of the operation in the fast Fourier transform algorithm: using the random checkpoint of the software backhaul, as the sampling time, the virtual random random number generated by the current random number generating module 12 is taken out as the fast Fourier transform In the algorithm, the eight coefficients required for the operation, each coefficient is one bit and a total of eight bits, and the octet is placed in the byte that is passed back to the software communication protocol.

(2) Post-inspection placement position parameter: Using the random checkpoint returned by the software, as the sampling time, the virtual random chaotic number generated by the current random number generating module 12 is taken out, as in the fast Fourier transform algorithm. One of the eight positions of the result of the operation, this position is represented by eight bits, and the octet is placed in the byte that is passed back to the software communication protocol.

(3) Post-check result placement position delay parameter: Using the random check point of the software back-transmission, as the sampling time, the virtual random random number generated by the current random number generating module 12 is taken out as a result of determining the result of the above-mentioned back-transfer check. The positional parameter, the first byte in the communication protocol that is passed back to the software, is represented by an octet and placed in the byte that is passed back to the software communication protocol.

The random random number generating module 12 of the present invention comprises a resetting device 26, a counting control module 28 and a linear feedback displacement temporary storage module 30. The counting control module 28 can calculate the number of clocks elapsed when the resetting device 26 is enabled to output a control signal, and the linear feedback displacement temporary storage module 30 can receive the control signal as a basis for delaying the value, and according to the control The signal and the authorization code continuously generate a virtual random number without periodicity. In this design, the random number is generated in order to perform the prime check on the back. If each check starts from the beginning, the prime number obtained each time will be the same, so a count control module 28 is used to control the periodicity of the random number. So that you don't check from the beginning when you do the quality check, so the prime number will be different each time.

The following describes the operation process of the protection device of the present invention. Please refer to FIG. 1 and FIG. 2 simultaneously. First, as shown in step S10, the random random number generation module 12 continuously generates one according to the authorization code transmitted by the firmware program. A virtual random random number that does not have periodicity. Then, an encryption process is performed. First, as shown in step S12, the random public and private key generation module 14 receives the random virtual random number, and first checks whether the virtual random random number is a prime number. If not, as shown in step S14. Going back to step S12, the selection continues to receive the next parameter; if so, as shown in step S16, the public key and the private key are generated for the authorization code by the RSA algorithm using the prime number. After the step S16 is performed, the random access memory module 18 stores the received authorization code and its corresponding virtual random random number, private key and public key, as shown in step S18. Then, as shown in step S20, since the virtual random random number, the private key and the public key are continuously generated, the encryption and decryption module 16 can use the virtual random random number, the private key and the public key pair generated at this time to be randomly stored. The authorization code stored in the memory module 18 and its corresponding virtual random number, public key and private key are encrypted to form an encrypted data, which is then transmitted to the firmware program, and the encryption process ends. Then, an authorization process is performed. First, as shown in step S22, the encryption and decryption module 16 receives the encrypted data transmitted by the firmware program, decrypts the data, and transmits the decoded result value to the random access memory module 18. And comparing with the authorization code stored therein and its corresponding virtual random random number, public key and private key to obtain a comparison result, and the comparison result is transmitted back to the toughness through the output interface module 20 The program is authorized to display. Then, as shown in step S24, it is determined whether the authorization is possible by the comparison result. If yes, the firmware program is executed as shown in step S26, and the encryption process is repeated; if not, as shown in step S28. Unable to execute firmware.

When the comparison result is judged to be authorized, the encryption process is repeated, but during execution, since the process is not executed for the first time, the random access memory module 18 has an authorization code stored therein. No need to receive again, except the rest of the process is the same.

After the authorization process is completed, if the firmware is to be executed next time, the authorization process will be executed directly without starting from the encryption process.

The manner in which the random random number generation module 12 generates the virtual random random number is as shown in FIG. 3, and please refer to FIG. 1 at the same time. First, as shown in step S102, the reset device 26 is enabled. Then, as shown in step S104, the counting control module 28 can calculate the number of clocks elapsed when the resetting device 26 is enabled to output a control signal. Then, as shown in step S106, the linear feedback displacement temporary storage module 30 can receive the control signal as a basis for delaying the value, and continuously generate a virtual random random number without periodicity according to the control signal and the authorization code.

In summary, the present invention is a relatively practical invention in which the RSA algorithm is implemented by means of hardware cooperative encryption and decryption, thereby making the embedded firmware better protected by a security mechanism.

The above is only a preferred embodiment of the present invention, and is not intended to limit the scope of the present invention, so that the shapes, structures, features, and spirits described in the claims of the present invention are equally varied and modified. All should be included in the scope of the patent application of the present invention.

10. . . Embedded protection device

12. . . Random random number generation module

14. . . Random public and private key generation module

16. . . Add and decrypt module

18. . . Random access memory module

20. . . Input and output interface module

twenty two. . . processor

twenty four. . . Memory

26. . . Reset device

28. . . Counting control module

30. . . Linear feedback displacement temporary storage module

Figure 1 is a schematic diagram of the architecture of the device of the present invention.

Figure 2 is a schematic flow chart of the method of the present invention.

FIG. 3 is a schematic flow chart of a method for generating a virtual random random number according to the present invention.

10. . . Embedded protection device

12. . . Random random number generation module

14. . . Random public and private key generation module

16. . . Add and decrypt module

18. . . Random access memory module

20. . . Input and output interface module

twenty two. . . processor

twenty four. . . Memory

26. . . Reset device

28. . . Counting control module

30. . . Linear feedback displacement temporary storage module

Claims (16)

An embedded protection device for protecting software content, which performs an authorization check when a processor executes a firmware program, the embedded protection device comprising: a random random number generation module, which is executed according to the firmware program Transmitting an authorization code to continuously generate a virtual random random number; a random public-private key generation module connecting the random random number generation module, and generating a public key for the authorization code by using the virtual random random number received a private key; a random access memory module connected to the random public and private key generation module, and storing the received authorization code, and the corresponding virtual random number, the public key, and the private key; The encryption and decryption module is connected to the random random number generation module, the random access memory module and the random public and private key generation module, and the encryption and decryption module utilizes the virtual random random number received, the public key The private key, the authorization code stored in the random access memory module, the virtual random number, the public key, and the private key are encrypted to form the encrypted data, and then transmitted to the firmware program. Executing When the check is performed, the encryption and decryption module receives the encrypted data transmitted by the firmware program for decryption, and outputs the decoded result value to the random access memory module, and the authorized identifier stored therein a code, the virtual random number, the public key, and the private key are compared to control an execution state of the firmware program; and an input/output interface module is connected to the processor, the encryption and decryption module, and The random access memory module is used as an interface between the module and the processor to transfer data to each other. The embedded protection device for protecting the software content according to the first aspect of the patent application, wherein when the firmware program is executed, the input/output interface module can be randomly inserted into the checkpoint to provide communication between the software and hardware protocols. Random sampling basis, and with the random random number generation module to obtain the virtual random random number generated at the moment. The embedded protection device for protecting the software content according to the first aspect of the patent application, wherein after the data in the random access memory module is compared, the comparison result can be returned through the input/output interface module. Passed to the firmware program for authorization display. The embedded protection device for protecting the software content according to the first aspect of the patent application, wherein the random public private key generation module generates the public key and the private key by using the prime number when the virtual random random number is a prime number. The embedded protection device for protecting software content according to claim 1, wherein the virtual random random number is not periodic. An embedded protection device for protecting software content as described in claim 1 of the patent scope, wherein the virtual random number is by Ronald Levist, Adi Samuel and Leonard Adelman (RSA) The algorithm generates the public key and the private key for the authorization code. The embedded protection device for protecting the software content according to the first aspect of the invention, wherein the random random number generation module comprises: a reset device; and a count control module, which is based on when the reset device is activated The passing clock number outputs a control signal; and a linear feedback displacement temporary storage module is configured to continuously generate the virtual random random number without periodicity according to the control signal and the authorization code. An embedded protection device for protecting software content as described in claim 1, wherein the processor is a central processing unit (CPU) or a digital signal processor (DSP). The embedded protection device for protecting software content according to claim 1, wherein the embedded protection device is built in the processor. An embedded protection device for protecting software content according to claim 1, wherein the embedded protection device is integrated on a busbar of the processor. A method for protecting software content, comprising the steps of: continuously generating a virtual random random number according to an authorization code transmitted by a firmware program; and performing an encryption process, the method comprising the steps of: utilizing the virtual random random number Generating a public key and a private key for the authorization code; storing the authorization code and the corresponding virtual random number, the private key and the public key; and the authorization code and the corresponding virtual random number, the public The key and the private key are encrypted to form an encrypted data, and then transmitted to the firmware program; and an authorization process is executed, which includes the following steps: receiving the encrypted data transmitted by the firmware program, decrypting, and decoding The result value is compared with the authorization code and the corresponding virtual random number, the public key and the private key to obtain a comparison result; and the comparison result is used to determine whether authorization is possible, and if , the firmware is executed, and the encryption process is repeated; if not, the firmware cannot be executed. For example, in the protection method of the protection software content described in claim 11, wherein the authorization process is completed, the method further includes a step, and the authorization process is performed again. The method for protecting the content of the protection software according to claim 11, wherein the step of generating the virtual random number includes the following steps: outputting a control signal according to the number of clocks passing through the reset; and according to the control The signal and the authorization code continuously generate the virtual random number without periodicity. For example, in the protection method of the protection software content described in claim 11, wherein the virtual random random number is a prime number, the public key and the private key are generated by using the prime number. The method for protecting the content of the protected software as described in claim 11 wherein the virtual random number is not periodic. The method for protecting the content of the protected software as described in claim 11, wherein the virtual random number is algorithmized by Ronald Levist, Adi Samuel and Leonard Adelman (RSA) algorithm The public key and the private key are generated for the authorization code.