Integrated circuit, resource access control method, device and medium

Abstract

The embodiment of the invention discloses an integrated circuit, a resource access control method, equipment and a medium, and the method comprises the steps: in response to a received resource access request sent by a requester, based on pre-configured access authority control information, determining whether the requester has an access authority for a resource party corresponding to an access address requested by the requester, and obtaining a first determination result; and in response to the request party having the access authority to the resource party, determining whether the request party has the operation authority to the access address based on pre-configured security control information and security attribute information in the resource access request to obtain a second determination result, and processing the resource access request based on the second determination result, according to the invention, the security of functions with high security level requirements can be effectively guaranteed, and the information security and the function security can be improved.

Description

Technical Field

[0001] The present disclosure relates to computer technology and security technology, and in particular to an integrated circuit and resource access control method, device and medium. Background Art

[0002] With the development of chip technology and autonomous driving technology, vehicles can provide more and more driving-related functions and smart cockpit functions. With the continuous improvement of the computing power of smart driving chips, multiple operating systems (OS) can be run on one chip (i.e. single chip), centrally realizing the driving-related functions and smart cockpit functions of the vehicle, realizing chip resource sharing, and improving the reuse efficiency of chips and peripheral circuits, which helps to reduce the overall chip cost of the vehicle cockpit.

[0003] Among the vehicle's driving-related functions, different functions may have different requirements for security levels. In the scenario where a single chip runs multiple operating systems to implement driving-related functions and smart cockpit functions, different functions have different security level requirements, and the operating systems that implement different functions have correspondingly different information security requirements. Summary of the invention

[0004] In order to solve the above technical problems, the embodiments of the present disclosure provide an integrated circuit and a resource access control method, device and medium.

[0005] In one aspect of an embodiment of the present disclosure, an integrated circuit is provided, comprising a plurality of hardware modules and a resource access control device, wherein the plurality of hardware modules and the resource access control device are connected via a bus; at least one hardware module among the plurality of hardware modules is correspondingly configured to at least one operating system;

[0006] The resource access control device is configured to:

[0007] In response to receiving a resource access request sent by a requester, the resource access request includes: a requester identifier, security attribute information and an access address; wherein the requester identifier is used to identify the requester that initiates the resource access request, the requester is one of the at least one hardware module, and the requester is configured to a corresponding operating system;

[0008] Based on pre-configured access permission control information, determining whether the requesting party has access permission to the resource party corresponding to the access address, and obtaining a first determination result, wherein the resource party is a hardware module other than the at least one hardware module among the multiple hardware modules;

[0009] In response to the first determination result that the requesting party has access rights to the resource party, determining whether the requesting party has operation rights to the access address based on pre-configured security control information and the security attribute information, to obtain a second determination result;

[0010] Based on the second determination result, the resource access request is processed.

[0011] Another aspect of the embodiments of the present disclosure provides a resource access control method, including:

[0012] In response to receiving a resource access request, the resource access request includes: a requester identifier, security attribute information and an access address; wherein the requester identifier is used to identify the requester initiating the resource access request, and the requester is configured to a corresponding operating system;

[0013] Based on pre-configured access permission control information, determining whether the requesting party has access permission to the resource party corresponding to the access address, and obtaining a first determination result;

[0014] In response to the first determination result that the requesting party has access rights to the resource party, determining whether the requesting party has operation rights to the access address based on pre-configured security control information and the security attribute information, to obtain a second determination result;

[0015] Based on the second determination result, the resource access request is processed.

[0016] Another aspect of the embodiments of the present disclosure provides a computer-readable storage medium, wherein the storage medium stores a computer program, and when the computer program is executed, it is used to implement the method described in any of the above embodiments of the present disclosure.

[0017] Another aspect of the embodiments of the present disclosure provides a computer program product, which is used to implement the method described in any of the above embodiments when the instruction processor in the computer program product executes it.

[0018] In another aspect of the embodiments of the present disclosure, an electronic device is provided, comprising: a processor, a memory, and a resource access control device;

[0019] The memory is used to store the processor executable instructions;

[0020] The processor is used to read the executable instructions from the memory and execute the instructions to control the resource access control device to execute the method for implementing any of the above embodiments.

[0021] Based on the embodiment of the present disclosure, the integrated circuit includes multiple hardware modules and a resource access control device. The multiple hardware modules are connected to the resource access control device through a bus. At least one of the multiple hardware modules is configured to at least one operating system. When any hardware module configured to the operating system requests to access a resource at an access address, the requester initiates a resource access request and carries its own security attribute information through the resource access request. The resource access request is sent to the resource access control device. The resource access control device determines whether the requester has access rights to the resource corresponding to the access address based on the pre-configured access right control information, thereby realizing the authentication of the requester, and can limit the access of the non-secure world to the secure world, or the lower security in the secure world, etc. The access of modules at a lower security level to modules at a higher security level effectively ensures the security of functions with higher security requirements. If the requester has access rights to the resource, it determines whether the requester has the operation rights to the access address based on the pre-configured security control information and the security attribute information of the requester, and processes the resource access request accordingly, thereby realizing the restriction of the operation rights of the requester to the resource it requests to access. On the one hand, from the perspective of information security, it can effectively avoid the leakage of privacy data, and from the perspective of functional safety, it can effectively avoid the rewriting of important data related to security functions, thereby improving the security of functions. On the other hand, it can avoid the resource competition problem caused by operating systems that do not have operation rights accessing the same resource at the same time, effectively ensuring the real-time and security of related functions. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] Figure 1 It is an exemplary application diagram of an embodiment of the present disclosure.

[0023] Figure 2 It is a schematic diagram of the structure of an integrated circuit provided by an exemplary embodiment of the present disclosure.

[0024] Figure 3 is a schematic diagram of the structure of an integrated circuit provided by another exemplary embodiment of the present disclosure.

[0025] Figure 4 It is a schematic diagram of access rights for a resource party or its accessible address space in an embodiment of the present disclosure.

[0026] Figure 5 is a schematic diagram of the structure of an integrated circuit provided by yet another exemplary embodiment of the present disclosure.

[0027] Figure 6 is a schematic structural diagram of an integrated circuit provided by yet another exemplary embodiment of the present disclosure.

[0028] Figure 7 It is a flowchart of a resource access control method provided by an exemplary embodiment of the present disclosure.

[0029] Figure 8 It is a flowchart of a resource access control method provided by another exemplary embodiment of the present disclosure.

[0030] Fig. 9 It is a flowchart of a resource access control method provided by yet another exemplary embodiment of the present disclosure.

[0031] Fig.10 It is a flowchart of a resource access control method provided by yet another exemplary embodiment of the present disclosure.

[0032] Fig.11 It is a flowchart of a resource access control method provided by yet another exemplary embodiment of the present disclosure.

[0033] Fig.12 It is a flowchart of a resource access control method provided by another exemplary embodiment of the present disclosure.

[0034] Fig.13 It is a schematic diagram of the structure of an electronic device provided by an exemplary embodiment of the present disclosure. DETAILED DESCRIPTION

[0035] To explain the present disclosure, example embodiments of the present disclosure will be described in detail below with reference to the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present disclosure, rather than all of the embodiments. It should be understood that the present disclosure is not limited to the example embodiments.

[0036] It should be noted that the relative arrangement of components and steps, the numerical expressions and numerical values ​​set forth in these embodiments do not limit the scope of the present disclosure unless specifically stated otherwise.

[0037] Application Overview

[0038] With the development of chip technology and autonomous driving technology, vehicles can provide more and more driving-related functions and smart cockpit functions. Among them, driving-related functions include instrument display, autonomous driving perception and control, autonomous driving decision-making and execution, etc., and smart cockpit functions include entertainment, map navigation and other functions. Among these driving-related functions and smart cockpit functions, different functions may have different requirements for safety levels. Among them, driving-related functions involve driving safety and require a higher safety level. For example, instrument display functions, autonomous driving perception and control functions usually require ASIL-B safety level, and autonomous driving decision-making and execution functions usually require ASIL-D safety level; while smart cockpit functions have relatively low requirements for safety level. The corresponding functions can be realized by running multiple operating systems that meet the requirements on a single chip (which can be called a cabin-driving integrated chip) that realizes driving-related functions and smart cockpit functions to ensure the safety of related functions; at the same time, multiple operating systems can improve the reuse efficiency of chips and peripheral circuits through chip resource sharing, and reduce the overall chip cost of the vehicle cockpit.

[0039] However, in the scenario where a single chip runs multiple operating systems to implement driving-related functions and smart cockpit functions, different functions have different security level requirements, and the operating systems that implement different functions have different information security requirements. How to manage the permissions of the resources in the chip accessed by different operating systems to ensure the corresponding functional safety and information security is a technical problem that needs to be solved urgently.

[0040] Example Applications

[0041] The embodiments of the present disclosure can be applied to any device that provides different functions through different applications, such as vehicles, mobile terminals, and servers, where the requirements for security levels of multiple different functions are different or not completely the same. For example, in a vehicle, multiple driving-related functions such as instrument display, entertainment, map navigation, driver monitoring, and assisted driving may be provided, and the requirements for security levels of different functions may be different.

[0042] Figure 1 FIG. 1 is an exemplary application diagram of an embodiment of the present disclosure. Figure 1 As shown, taking the application of the embodiment of the present disclosure to a vehicle as an example, a heterogeneous system on chip (SOC) 102 is provided in the electronic system of the vehicle, and multiple operating systems 104 that can run on the SOC 102 are installed, and different operating systems can be used to implement corresponding functions in driving-related functions.

[0043] The SOC 102 may include: processor resources 1022 , hardware resources 1024 and a resource access control device 1026 .

[0044] The processor resources 1022 may include a central processing unit (CPU) and at least one of the following types of processors: a graphics processing unit (GPU), an application specific integrated circuit (ASIC), a tensor processing unit (TPU), a deep learning processing unit (DPU), a neural processing unit (NPU), a digital signal processor (DSP), etc. In the embodiment of the present disclosure, the processor resources 1022 may include processors of different types and numbers according to actual needs, and the embodiment of the present disclosure does not limit this.

[0045] The hardware resources 1024 may include but are not limited to at least one of the following: memory resources, cache resources, storage resources, register resources, interface resources, etc. Among them, memory resources may include but are not limited to random access memory (RAM), for example. Cache resources may include but are not limited to cache memory, for example. Storage resources may include but are not limited to solid state drives (SSD), universal flash storage (Universal Flash Storage, UFS), embedded Multi Media Cards (Embedded Multi Media Card, eMMC), secure digital cards (Secure Digital Card, SD) cards, flash memory, etc. Interface resources are input / output (I / O) interfaces connected to external devices. In the embodiment of the present disclosure, the hardware resources 1024 may include different types and different quantities of hardware according to actual needs, and the embodiment of the present disclosure does not limit this.

[0046] The multiple operating systems 104 can respectively provide operating environments for upper-layer applications that implement different functions to implement the corresponding functions. Each operating system can manage and schedule corresponding processor resources and hardware resources according to the task processing requirements of the upper-layer applications it carries, and process the corresponding tasks. Since the driving-related functions and smart cockpit functions of the vehicle have different requirements for safety levels, the multiple operating systems 104 may include multiple operating systems that meet the safety level requirements of the corresponding functions, so that applications with different functions can perform better in the corresponding operating systems. For example, in a specific implementation example, the underlying real-time operating system (such as QNX, RTOS, AUTOSAR and other systems) can be used to carry applications and services related to driving-related functions that require high real-time performance, high reliability and strong safety, such as instrument display, automatic driving perception and control, automatic driving decision and execution, etc.; Linux, Android and other systems are used to carry applications and services related to smart cockpit functions that do not require high safety, such as infotainment. In the embodiment of the present disclosure, the types and number of operating systems specifically included in the multiple operating systems 104 can be set according to actual needs, and the embodiment of the present disclosure does not limit this.

[0047] In a specific implementation, the processor resources 1022 in the SOC 102 can be divided and isolated through hardware isolation technology to obtain multiple hosts; alternatively, the processor resources 1022 can be divided by virtualization technology or time-division multiplexing to obtain multiple virtual machines (VMs), and the multiple hosts and / or virtual machines can be respectively configured to corresponding operating systems, and corresponding security attribute information can be configured for the hosts and / or virtual machines respectively.

[0048] The hardware resources 1024 in the SOC 102 can be partitioned by hardware isolation technology, or the hardware resources 1024 in the SOC 102 can be partitioned by hardware virtualization technology (e.g., middle-layer software Hypervisor) when the vehicle electronic system is started, and appropriate amounts of memory, CPU, network, storage, and other hardware resources are allocated to the host or virtual machine running each operating system. By loading and running different operating systems 104 on each host or virtual machine, permission isolation of multiple operating systems 104 can be achieved, so that the software and hardware corresponding to each function implemented by different operating systems are isolated from each other, thereby ensuring the safety of driving-related functions.

[0049] When one of the hosts or virtual machines executes a task, it can act as a requester and initiate a resource access request, which includes a requester identifier, security attribute information pre-configured for the requester, and an access address; after the resource access control device 1026 receives the resource access request sent by the requester, it determines whether the requester has access rights to the resource party corresponding to the access address based on the pre-configured access permission control information, and obtains a first determination result; if the first determination result is that the requester has access rights to the resource party, it determines whether the requester has operation rights to the access address based on the pre-configured security control information and the above-mentioned security attribute information, and obtains a second determination result; based on the second determination result, the resource access request is processed accordingly.

[0050] This enables authentication of the requester, which can limit the access of the non-secure world to the secure world, or the access of the lower security level module in the secure world to the higher security level module, effectively ensuring the security of functions with higher security level requirements. In addition, it enables restrictions on the requester's operating authority to access the resources it requests. On the one hand, from the perspective of information security, it can effectively avoid the leakage of privacy data, and from the perspective of functional safety, it can effectively avoid the rewriting of important data related to the security function, thereby improving the safety of the function (such as the safety of vehicle driving). On the other hand, it can avoid resource competition problems caused by operating systems that do not have operating authority accessing the same resource at the same time, effectively ensuring the real-time and security of related functions.

[0051] Exemplary Systems

[0052] Figure 2 1 is a schematic diagram of the structure of an integrated circuit provided by an exemplary embodiment of the present disclosure. This embodiment can be applied to any device such as a mobile terminal, a server, a vehicle, etc. In the embodiment of the present disclosure, an integrated circuit applied to a vehicle is used as an example for explanation. For the implementation applied to other devices, reference can be made to the implementation. Figure 2 As shown, the integrated circuit of this embodiment includes multiple hardware modules 202 and a resource access control device 204, and the multiple hardware modules 202 and the resource access control device 204 are connected via a bus 206. At least one hardware module of the multiple hardware modules 202 is correspondingly configured to at least one operating system.

[0053] Optionally, in some implementations, the integrated circuit in the embodiments of the present disclosure may include, for example, a SOC or other heterogeneous multi-core chips. The hardware module 202 in the integrated circuit may include processor resources and hardware resources.

[0054] The processor resources may include: a CPU and a plurality of any of the following processors: a GPU, an ASIC, a TPU, a DPU, a NPU, a DSP, etc. The processor resources may include processors of different types and numbers according to actual needs, and the embodiments of the present disclosure do not limit this.

[0055] In a specific implementation, the processor resources can be divided and isolated by hardware isolation technology according to the specific type of each processor in the processor resources to obtain multiple hosts; or, the processor resources can be divided by virtualization technology or time division multiplexing to obtain multiple virtual machines, and the multiple hosts and / or virtual machines can be configured to the corresponding operating systems respectively. In a specific implementation, for a processor, such as a VPU, a BPU, etc., if it can be divided into different hardware channels by hardware isolation technology (i.e., a hard-isolated virtualization method), the processor can be divided into multiple hosts according to the channel dimension; for a processor, such as a DPU, if different hardware channels cannot be distinguished, the processor resources can be divided by virtualization technology or time division multiplexing to obtain multiple virtual machines. In the method, the processor resources are divided and isolated, or the multiple hosts and / or virtual machines obtained by division are at least one hardware module among the above-mentioned multiple hardware modules 202.

[0056] Hardware resources may include, but are not limited to, at least one of the following: memory resources, cache resources, storage resources, register resources, interface resources, etc., wherein the number of each type of hardware resources may be set according to actual needs, and the embodiments of the present disclosure do not limit this. Among them, memory resources may include, for example, but are not limited to random access memory. Cache resources may include, for example, but are not limited to cache memory. Storage resources may include, for example, but are not limited to solid-state hard drives, etc. Register resources may include at least one register for implementing different information configuration functions. Interface resources are I / O interfaces connected to external devices. In the embodiments of the present disclosure, hardware resources may include different types and quantities of hardware according to actual needs, and the embodiments of the present disclosure do not limit this.

[0057] In a specific implementation, hardware resources can be partitioned through hardware isolation technology, or hardware virtualization technology (for example, middle-layer software Hypervisor) can be used to partition hardware resources when the vehicle electronic system is started, and appropriate amounts of memory, CPU, network, storage, and other hardware resources can be allocated to the host or virtual machine running each operating system.

[0058] Multiple operating systems can be run on the integrated circuit, respectively providing a running environment for the upper-layer applications that implement the corresponding functions, so as to ensure that each task that implements the corresponding functions can be executed in an orderly and efficient manner, thereby realizing the corresponding functions. Each operating system can schedule the resources (including processor resources and hardware resources) in the integrated circuit to process the corresponding tasks according to the task processing requirements of the upper-layer applications it carries. Since the driving-related functions and smart cockpit functions of the vehicle may have different requirements for the safety level, the multiple operating systems may include operating systems that meet the safety level requirements of the corresponding functions used to implement, so that applications with different functions can perform better in the corresponding operating systems. For example, in a specific implementation example, the underlying real-time operating system can carry applications and services related to driving-related functions that require high real-time performance, high reliability and strong safety, such as instrument display, automatic driving perception and control, automatic driving decision and execution, etc.; and Linux, Android and other systems can carry applications and services related to smart cockpit functions that do not require high safety, such as infotainment, etc. The specific types and quantities involved in the multiple operating systems in the disclosed embodiment can be set according to actual needs, and the disclosed embodiment does not limit this.

[0059] Among them, each host or virtual machine, that is, each hardware module in the at least one hardware module mentioned above, can be used as a master device (Master), load and run different operating systems, and implement the permission isolation of multiple operating systems, so that the software and hardware corresponding to the functions implemented by different operating systems are isolated from each other, so that the security of different functions can be guaranteed when applied to vehicles. In a specific implementation, an intermediate layer software, such as a hypervisor or other permission management software for managing integrated circuits, can be used, or, after the initialization is completed during the startup process of the integrated circuit, a device ID that uniquely identifies the device is configured for each master device in the integrated circuit and set in the device. According to the master device obtained through hardware isolation technology or virtualization technology, the device ID can be a host ID (Master ID, MID) or a virtual host ID (VMID). Afterwards, each master device can be configured to the corresponding operating system by configuring registers, and the corresponding security attribute information can be configured for the master device configured to the corresponding operating system.

[0060] Among them, each hardware unit obtained by partitioning the hardware resources can be used as a slave device (Slave).

[0061] When the master device needs to execute a task corresponding to an application in the operating system, it can initiate a communication request (such as a resource access request) and control the operation of bus 206 to communicate and exchange data with the slave device (Slave), for example, reading and writing data to the slave device. At this time, the master device that initiates the communication request acts as the requester, and the slave device corresponding to the communication request acts as the resource party corresponding to this communication request.

[0062] Optionally, in some of the implementations, the bus 206 in the embodiment of the present disclosure may adopt a bus of any bus standard according to actual requirements, such as data transmission requirements, hardware connection conditions, etc. The bus standard may include, for example, but is not limited to an Advanced Micro-Controller Bus Architecture (AMBA) specification bus, a Peripheral Component Interface Express (PCIe) bus, or a bus of any other bus standard, etc. Among them. The AMBA specification bus may include, for example, but is not limited to at least one of the following buses: Advanced High-Performance Bus (AHB), Advanced Peripheral Bus (APB), Advanced Extensible Interface (AXI), AXI Coherency Extensions (ACE), Advanced System Bus (ASB), etc. The embodiment of the present disclosure does not limit the specific bus used.

[0063] The resource access control device 204 is configured as follows:

[0064] In response to receiving a resource access request sent by a requester, the resource access request includes a requester ID, security attribute information and an access address. The resource access request is used to request access to the access address, such as reading data in the access address, writing data to the access address, and so on. The requester is a hardware module in the at least one hardware module 202, and the requester is configured as a master device to the corresponding operating system. The requester ID is used to uniquely identify the requester that initiates the resource access request. The requester ID can be an MID or a VMID (hereinafter referred to as MID / VMID). Since each master device is configured to a corresponding operating system, the corresponding operating system can be uniquely determined based on the requester ID, thereby determining the master device and operating system that initiates the resource access request. In a specific implementation, when the requester divides the processor resources in a time-division multiplexing manner, since a requester can be configured to different operating systems in a time-division multiplexing manner, the requester ID corresponds to different operating systems in different time periods;

[0065] Based on the pre-configured access control information, determine whether the requester has access rights to the resource party corresponding to the access address in the resource access request, and obtain a first determination result, where the resource party is a slave device, which is a hardware module other than the requester among the multiple hardware modules 202;

[0066] In response to the first determination result that the requesting party has access rights to the resource party, determining whether the requesting party has operation rights to the access address in the resource access request based on pre-configured security control information and security attribute information in the resource access request, thereby obtaining a second determination result;

[0067] Based on the second determination result, the resource access request is processed.

[0068] Based on the embodiment of the present disclosure, the integrated circuit includes multiple hardware modules and a resource access control device. The multiple hardware modules are connected to the resource access control device through a bus. At least one of the multiple hardware modules is configured to at least one operating system. When any hardware module configured to the operating system requests to access a resource at an access address, the requester initiates a resource access request and carries its own security attribute information through the resource access request. The resource access request is sent to the resource access control device. The resource access control device determines whether the requester has access rights to the resource corresponding to the access address based on the pre-configured access right control information, thereby realizing the authentication of the requester, and can limit the access of the non-secure world to the secure world, or the lower security in the secure world, etc. The access of modules at a lower security level to modules at a higher security level effectively ensures the security of functions with higher security requirements. If the requester has access rights to the resource, it determines whether the requester has the operation rights to the access address based on the pre-configured security control information and the security attribute information of the requester, and processes the resource access request accordingly, thereby realizing the restriction of the operation rights of the requester to the resource it requests to access. On the one hand, from the perspective of information security, it can effectively avoid the leakage of privacy data, and from the perspective of functional safety, it can effectively avoid the rewriting of important data related to security functions, thereby improving the security of functions. On the other hand, it can avoid the resource competition problem caused by operating systems that do not have operation rights accessing the same resource at the same time, effectively ensuring the real-time and security of related functions.

[0069] Optionally, in some of the implementations, the security attribute information may include, but is not limited to, at least one of the following: security status information, data rights management (DRM) attribute information. The security status information is used to characterize the security attributes of the requester, that is, whether the requester originates from the secure world (SecureWorld), thereby characterizing whether the resource access request initiated by the requester is a secure operation or a non-secure operation. In some specific implementation examples, the specific value of the security status information may be the security status (Sec) identifier 1 or the non-security status (Non-sec) identifier 0, correspondingly indicating whether the resource access request sent by the requester is a secure operation or a non-secure operation. The DRM attribute information is used to characterize whether the requester has the DRM attribute. In some specific implementation examples, the specific value of the DRM attribute information may be preset to be the DRM attribute identifier 1 or 0, correspondingly indicating that the requester has the DRM attribute or does not have the DRM attribute.

[0070] Based on this embodiment, security attribute information may include security status information and DRM attribute information. Based on the security status information, it can be determined whether the resource access request initiated by the requesting party is a secure operation or a non-secure operation. Based on the DRM attribute information, it can be determined whether the requesting party has data permission management attributes. At the same time, the operating authority of the requesting party is controlled based on the security status information and DRM attribute information, which helps to more accurately restrict the operating authority of the requesting party, improve information security and functional security, and avoid resource competition problems caused by operating systems that do not have operating authority simultaneously accessing the same resource, thereby further improving the security of related functions.

[0071] Figure 3 FIG. 1 is a schematic diagram of the structure of an integrated circuit provided by another exemplary embodiment of the present disclosure. Figure 3 As shown, in Figure 2 On the basis of the illustrated embodiment, the integrated circuit of this embodiment further includes: a configuration register 208, which is configured to: configure security attribute information for each hardware module in the at least one hardware module 202, that is, the hardware module serving as the main device.

[0072] Optionally, the configuration register 208 may be further configured to: configure security attribute information for hardware modules serving as slave devices in the plurality of hardware modules 202 respectively.

[0073] In a specific implementation, register configuration 208 can be used to implement the security level requirements of the operating system running on each master device, and corresponding security attribute information can be configured for each master device, including: security status information (Sec identification / Non-sec identification), DRM attribute information (DRM attribute identification / non-DRM attribute identification). Similarly, according to the resource authority control requirements of each slave device, corresponding security attribute information can be configured for each slave device or each address space therein, including: security status information (Sec identification / Non-sec identification), DRM attribute information (DRM attribute identification / non-DRM attribute identification).

[0074] Based on this embodiment, after security attribute information is configured for each master device, when the master device initiates a resource access request for a slave device, it can carry its security attribute information through the resource access request to control access rights and operation rights for the resource access request, thereby improving the security of information in the slave device and the security of related functions.

[0075] After each master device is configured with security attribute information, when initiating a resource access request, the security attribute information of the master device can be carried through an existing signal in bus 206, or the security attribute information of the master device can be carried using a reserved signal bit in bus 206, based on the method of sending the resource access request and the specific bus standard adopted by bus 206. Alternatively, at least part of the security attribute information can be carried through other data in the resource access request, and other parts of the security attribute information can be carried through an existing signal or a reserved signal bit in bus 206. The embodiment of the present disclosure does not limit the specific method of carrying security attribute information through bus 206.

[0076] For example, in a specific implementation, when the requester and the resource party use the AMBA standard bus as the bus 206 to transmit a resource access request, the secure state information (Sec identification 1 or Non-sec identification 0) can be carried by the secure state read / write signal bit (secure bit) in the signals such as PPROT and HPROT in the bus APB or the signals such as Axprot in the bus AXI; or, the corresponding write / read transaction can be marked as a secure type by carrying the secure stream identifier (Secsid for a write / read transaction) in the bus AXI, and the non-secure stream identifier (NSID) in the bus AXI can be used to mark the current write / read transaction as a non-secure type. The requester ID (MID / VMID) and DRM attribute information (DRM attribute identification 1 / non-DRM attribute identification 0) can be transmitted through the signals such as NSAID and USER in the bus AXI, and the embodiments of the present disclosure do not limit this.

[0077] When DRM attribute information is transmitted through the NSAID signal in the AXI bus, since the DRM attribute information is used to identify whether the requester has DRM attributes, that is, to distinguish whether the operation corresponding to the resource access request is a DRM operation, it is sufficient to carry the DRM attribute identification 1 / non-DRM attribute identification 0 through 1 bit.

[0078] In the AMBA specification, USER is a custom signal, which is mainly used to transmit additional information. The User signal includes AMUSER and ARUSER, which are respectively related to the write address (AW) and read address (AR) channels. AWUSER is used for write operations, while ARUSER is used for read operations. These signals can be designed to transmit any user-defined information, such as control signals, status information or data identification, etc., so as to enhance the efficiency and functionality of transactions. In the disclosed embodiment, AMUSER or ARUSER can be used to carry DRM attribute information (DRM attribute identification 1 / non-DRM attribute identification 0) according to whether the operation type of the resource access request is a read operation or a write operation. By expanding the function of the USER signal, the transmission of the requester ID (MID / VMID) and the DRM attribute information can be realized, so that the DRM attribute information can be used for operation authority control later.

[0079] Optionally, in some of the implementations, the resource access request may further include an operation type ID, which is used to identify the operation type corresponding to the resource access request, and the operation type corresponding to the resource access request may include a read operation (Read, R) or a write operation (Write, W). In some specific implementation examples, the specific value of the operation type ID may be preset to be R, W or 0, 1, which correspondingly indicates that the operation type corresponding to the resource access request is a read operation or a write operation. The embodiments of the present disclosure do not limit the operation type represented by the operation type ID and the corresponding specific value.

[0080] Optionally, see Figure 3 In some implementations, the resource access control device 204 may include at least one of a system memory management unit (SMMU) 2042 and a permission control module (Firewall) 2044, that is, only the SMMU or the permission control module may be set in the integrated circuit, or the SMMU 2042 and the permission control module 2044 may be set at the same time to control resource access requests from different host devices and operating systems, and the embodiments of the present disclosure do not limit this.

[0081] In some specific implementation examples, according to actual needs, the number of resource access control devices 204 can be one or more, and each SMMU 2042 is connected to at least one master device via the bus 206 .

[0082] In some specific implementation examples, the number of the permission control module 2044 may also be one or more. In specific applications, the permission control module 2044 may be arranged on the resource side as a slave device, may be arranged on the request side as a master device, or may be independently arranged in any position between the request side and the resource side in the integrated circuit, and the disclosed embodiment does not limit this. In specific applications, when the permission control module 2044 is arranged on the slave device, a permission control module 2044 may be arranged in the upstream of each slave device or in each slave device according to actual needs, or the permission control module 2044 may be arranged only in the upstream of the slave device or in the slave device where the permission control module 2044 is required to perform permission control. When the permission control module 2044 is arranged on the master device, a permission control module 2044 may be arranged in the downstream of each master device or in each master device according to actual needs, or the permission control module 2044 may be arranged only in the downstream of the master-slave device or in the master device where the permission control module 2044 is required to perform permission control. The disclosed embodiment does not limit the deployment mode of the permission control module 2044.

[0083] Regarding SMMU 2042 and authority control module 2044, Figure 3 Only one implementation structure example is shown in the figure. For implementations in which the SMMU 2042 and the permission control module 2044 use other numbers, positions and structures, reference can be made to the implementation. For an implementation in which the resource access control device 204 only includes the SMMU 2042 and does not include the permission control module 2044, each slave device is directly connected to the SMMU 2042 via a bus.

[0084] Optionally, in some of the implementations, when the resource access control device 204 includes SMMU2042, the resource access request may include a stream ID (Stream ID, SID), security status information and an access address. The stream ID includes a requester ID and DRM attribute information based on a preset format, for example, the stream ID is a MID / VMID-DRM attribute identifier, that is, in this implementation, the requester can carry the DRM attribute information through the stream ID, and carry the security status information separately through the security status read / write signal bit in the signal. In some specific implementation examples, when the requester generates a resource access request, the DRM attribute information can be written into a preset position before the requester ID or after the requester ID in the stream ID according to a preset format. The embodiment of the present disclosure does not limit the specific position of the DRM attribute information in the stream ID.

[0085] Optionally, in some of the implementations, a unique Stream ID can be configured for each master device that uses SMMU for permission restriction by configuring register 208, that is, the MID / VMID of each master device and DRM attribute information indicating whether it has DRM attributes are encoded in a preset format to obtain a Stream ID.

[0086] Since the integrated circuit includes multiple master devices, each SMMU may be connected to multiple master devices through a bus, and each device uniquely corresponds to a MID / VMID, and thus uniquely corresponds to a streamID. The SMMU can distinguish the multiple master devices connected to it based on the streamID. In this implementation, different operating systems and their tasks for implementing corresponding functions can be distinguished through the MID / VMID in the Stream ID, and the DRM attributes of the master device can be distinguished through the DRM attribute information in the Stream ID.

[0087] In this embodiment, by extending the streamID, writing the requester ID and DRM attribute information in the streamID, and carrying the requester ID and DRM attribute information through the streamID, the transmission of the requester ID and DRM attribute information is realized. The SMMU can obtain the requester ID and DRM attribute information from the stream identifier for access control of the requester.

[0088] Accordingly, in this embodiment, SMMU2042 is further configured to: obtain a flow identifier, security status information and access address from the resource access request respectively; and obtain a requester ID and DRM attribute information from the flow identifier based on a preset format.

[0089] Optionally, in some of the implementations, the access permission control information may include: a page table (Page Table) configured in SUMM for each requester in at least one requester. That is, the SMMU is pre-configured with page tables corresponding to each master device, each page table includes at least one accessible address space and access permission attribute information of each accessible address space, each accessible address space includes at least one access address, and the access permission attribute information is used to characterize the current operation permission restriction information. For example, in some of the specific implementation examples, the access permission attribute information may include but is not limited to at least one of the following: readable, writable, unreadable, unwritable, securely accessible, securely inaccessible, non-securely accessible, non-securely inaccessible, DRM attribute accessible, non-DRM attribute inaccessible, etc., and the embodiments of the present disclosure do not limit this. In a specific application, when a master device as a requester accesses a slave device as a resource, if the slave device does not allow the master device to access it, the accessible address space corresponding to the slave device is not included in the page table corresponding to the master device; if the master device is allowed to access the slave device, but the master device's operating authority on different accessible address spaces in the slave device is restricted, corresponding access permission attribute information can be set for each accessible address space, such as unreadable, unwritable, etc.; if the master device is allowed to access the slave device, but the access address requested by the master device is currently inaccessible (for example, being accessed by other master devices or an operating system), the access permission attribute information can be set for the corresponding accessible address space to be unreadable, unwritable, etc.

[0090] Optionally, in some of the implementations, the access permission attributes of each accessible address space may be determined based on the security attribute information of the resource party corresponding to each accessible address space according to the security requirements of the relevant functions and information protection, or further determined in combination with the current state of the corresponding resource party, for example, Figure 4 As shown, in a specific example, the access permission attributes of the resource party or its accessible address space are as follows:

[0091] When the security status information of the resource party or its accessible address space is marked as Sec, the access permission attributes of its accessible address space are securely accessible (including securely readable and securely writable), non-securely inaccessible (including non-securely unreadable and non-securely unwritable), and DRM attributes are inaccessible (including DRM attributes are unreadable and DRM attributes are unwritable). This means: only when the security status information in the resource access request is marked as Sec (indicating that the master device comes from the secure world or this operation is a secure operation) can the accessible address space be accessed (data can be read and written to the accessible address space), and when the security status information is marked as Non-sec (indicating that the master device comes from the non-secure world or this operation is a non-secure operation) and the DRM attribute information is DRM attributes (indicating that the master device has DRM attributes or this operation is a DRM attribute operation) can the accessible address space not be accessed (data cannot be read or written to the accessible address space);

[0092] When the security status information of the resource party or its accessible address space is marked as Non-sec, the access permission attributes of its accessible address space are securely accessible (including securely readable and securely writable), non-securely accessible (including non-securely readable and non-securely writable), DRM attributes are readable, and DRM attributes are not writable. This means: when the security status information in the resource access request is marked as Sec, the accessible address space can be accessed; when the security status information is marked as Non-sec, the accessible address space can be accessed; when the DRM attribute information is DRM attributes, data can be read from the accessible address space, but data cannot be written to the accessible address space;

[0093] When the DRM attribute information of the resource or its accessible address space is DRM attribute, the access permission attribute of its accessible address space is securely accessible (including securely readable and securely writable), non-securely inaccessible (including non-securely readable and non-securely inaccessible), and DRM attribute accessible (including DRM attribute readable and DRM attribute writable). It means: when the security status information in the resource access request is Sec, the accessible address space can be accessed; when the security status information is Non-sec, the accessible address space cannot be accessed; when the DRM attribute information is DRM attribute, the accessible address space can be accessed.

[0094] When a resource access request carries both security status information and DRM attribute information, and / or the resource party has both security status information and DRM attribute information, the access permission attributes of each accessible address space of the resource party can be determined according to preset rules. For example, it can be set that an accessible address space is determined to be accessible only when it is determined to be accessible based on all determination methods, or that an accessible address space is determined to be inaccessible only when it is determined to be inaccessible based on all determination methods.

[0095] In addition, SMMU can combine the current state of the resource party and set the access rights attribute of each accessible address space to inaccessible when a certain accessible address space is being accessed by other master devices, thereby avoiding resource competition and resource consistency problems caused by different master devices accessing the same resource. Therefore, through the dynamic setting of access rights control information by SMMU, the hardware resources in the integrated circuit can be accurately and effectively controlled, improving the security and resource utilization of the entire system.

[0096] In a specific implementation, a stream table entry (STE) can be used to record the page table identifier corresponding to each master device identifier, and the page table configured in the SMMU can be associated with the master device identifier (MID / VMID). In the SMMU, a page table is configured for each master device that only includes the accessible address space that each master device is allowed to access. In this way, each master device can only index the page table that it can access, and cannot access the page tables belonging to other master devices or the operating system.

[0097] Accordingly, in this embodiment, SMMU2042 is further configured as follows:

[0098] Obtaining an operation type ID from the resource access request, where the operation type ID is used to identify whether the operation type corresponding to the resource access request is a read operation or a write operation;

[0099] Obtain a first page table corresponding to the requester ID, where the first page table is a page table to which the requester has access rights. The first page table includes: at least one accessible address space corresponding to at least one resource party and access rights attribute information of each accessible address space;

[0100] Based on whether the access address in the resource access request belongs to at least one accessible address space in the first page table, determine whether the requester has access rights to the resource party, and obtain a first determination result. Specifically, if the access address in the resource access request belongs to at least one accessible address space in the first page table, it can be determined that the requester has access rights to the access address, and the page table entry corresponding to the access address can be indexed; otherwise, if the access address in the resource access request does not belong to at least one accessible address space in the first page table, it can be determined that the requester does not have access rights to the access address, and is not allowed to index the page table entry corresponding to the access address;

[0101] In response to the first determination result that the access address in the resource access request belongs to at least one accessible address space in the security control information, it is determined that the requesting party has access rights to the access address, and access rights attribute information of the target accessible address space to which the access address belongs is obtained from the security control information. The security control information may include access rights attribute information of the at least one accessible address space, wherein the target accessible address space is the accessible address space in the security control information that covers the access address in the resource access request;

[0102] Based on the access permission attribute information of the target accessible address space, the operation type ID in the resource access request, and one of the DRM attribute information and the security status information in the resource access request, determining whether the requesting party has the operation permission to perform the operation type identified by the operation type ID on the access address, that is, whether the requesting party has the permission to perform the requested read operation or write operation on the access address, to obtain a second determination result;

[0103] In response to the second determination result that the requesting party has the operation permission to perform the operation type identified by the above-mentioned operation type ID on the access address in the resource access request, the access address is converted from a virtual address (VirtualAddress, VA) to a physical address (Physical Address, PA) based on the first page table, and the resource access request is forwarded to the physical address so as to perform the operation requested by the resource access request on the physical address, that is, perform a corresponding data read operation or write operation on the access address.

[0104] Each page table in SUMM includes at least one page table entry (PTE), and each PTE represents a mapping rule between a virtual page and a physical page (Page, i.e., the smallest unit of VA to PA mapping). When the requesting party has the operation permission to perform the operation type identified by the above operation type ID on the access address in the resource access request, SMMU2042 can determine the actual PA to which the access address VA is mapped by looking up the PTE in the first page table corresponding to the requesting party, and then forward the resource access request to the PA.

[0105] Optionally, SMMU2042 can be further configured to: in response to a first determination result that the access address in the resource access request does not belong to at least one accessible address space in the security control information, determine that the requester does not have access rights to the access address; or, in response to a second determination result that the requester does not have permission to perform the operation type identified by the above operation type ID on the access address in the resource access request, reject the resource access request, and respond to the requester with an error message (response err) for the resource access request, and / or, if the operation type identified by the above operation type ID is a read operation, return all-0 data; if the operation type identified by the above operation type ID is a write operation, discard the data carried in the resource access request requested to be written to the above access address.

[0106] Based on this embodiment, the SMMU can obtain the requester ID from the flow identifier and index the corresponding first page table according to the requester ID to prevent the requester from accessing the page tables belonging to other master devices or operating systems, that is, to prevent the requester from accessing the address space allocated to other master devices or operating systems (that is, the hardware resources allocated to other master devices or operating systems). This can limit the access of the non-secure world to the secure world, or the access of devices with lower security levels in the secure world to hardware resources with higher security levels, which helps to ensure the requirements of different functions for functional safety levels; when the requester has access rights to the access address it requests, the requester's operation rights for the access address it requests are determined, which can prevent the requester from performing data read and write operations on the access address it requests that exceed its rights, thereby avoiding the information security caused thereby, and the functional safety of other master devices or operating systems caused by the leakage or rewriting of the data, which helps to improve the security and reliability of the entire system.

[0107] Figure 5 FIG. 1 is a schematic diagram of the structure of an integrated circuit provided by another exemplary embodiment of the present disclosure. Figure 5 As shown, in Figure 2-Figure 3On the basis of any of the illustrated embodiments, the resource access control device 204 includes a permission control module 2044, and when the permission control module 2044 is set on the resource side, the above-mentioned access permission control information may include: a list of requesters allowed to access the resource side, the requester list can be pre-configured through a configuration register, and the requester list includes at least one master device ID, each master device ID is used to uniquely identify a master device that can act as a requester.

[0108] In this implementation, the security status information (Sec identification 1 or Non-sec identification 0) can be carried by the security status read / write signal bits in the PPROT, HPROT and other signals in the bus APB or the Axprot and other signals in the bus AXI; or, the write / read transaction corresponding to the secsid identification of the write / read transaction carried in the bus AXI can be identified as belonging to the security type, and the write / read transaction can be identified as belonging to the non-security type by the NSID identification in the bus AXI. The requester ID (MID / VMID) and DRM attribute information (DRM attribute identification 1 / non-DRM attribute identification 0) can be transmitted through the NSAID, USER and other signals in the bus AXI, and the disclosed embodiment does not limit this.

[0109] Accordingly, in this embodiment, the authority control module 2044 is further configured as follows:

[0110] Obtain the requester ID, security status information, DRM attribute information, resource party ID, operation type ID and access address from the resource access request respectively. The resource party ID is used to identify the resource party requested by the resource access request, and the operation type ID is used to identify whether the operation type corresponding to the resource access request is a read operation or a write operation;

[0111] Based on whether the requester ID is included in the list of requesters allowed to access the resource in the access permission control information, determine whether the requester has access permission to the resource, and obtain a first determination result. Specifically, if the requester ID is included in the list of requesters, it can be determined that the requester has access permission to the resource, and the resource access request can be allowed to enter the resource; otherwise, if the requester ID is not included in the list of requesters, it can be determined that the requester does not have access permission to the resource, and the resource access request is not allowed to enter the resource;

[0112] In response to the first determination result that the requester ID is included in the requester list, it is determined that the requester has access rights to the resource party, and the access right attribute information of the target accessible address space to which the access address in the resource access request belongs in the security control information is obtained. In this embodiment, the security control information includes access right attribute information of at least one accessible address space, each of which includes at least one access address, and the target accessible address space is the accessible address space in the security control information that covers the access address in the resource access request. In the security control information, the access right attribute information of each accessible address space can be determined based on the security attribute information of the corresponding resource party, or further combined with the current status of the accessible address space. For details, please refer to the above Figure 4 The description in the illustrated embodiment will not be repeated here;

[0113] Determine, based on the access permission attribute information of the target accessible address space, the operation type ID in the resource access request, and one of the DRM attribute information and the security status information in the resource access request, whether the requesting party has the operation permission to perform the operation type identified by the operation type ID on the access address, to obtain a second determination result;

[0114] In response to the second determination result that the requester has the operation permission to perform the operation type identified by the operation type ID on the access address, the resource access request is forwarded to the access address in the resource access request so that the operation requested by the resource access request can be performed on the access address, that is, a corresponding data read operation or write operation can be performed on the access address.

[0115] Optionally, the permission control module 2044 can be further configured as follows: in response to the first determination result that the requester ID is not included in the requester list, it can be determined that the requester does not have access rights to the resource party; or, in response to the second determination result that the requester does not have permission to perform the operation type identified by the operation type ID on the access address, the resource access request is rejected, an error message (response err) can be responded to the requester for the resource access request, and / or, if the operation type identified by the above operation type ID is a read operation, all-0 data can be returned; if the operation type identified by the above operation type ID is a write operation, the data requested to be written to the above access address carried in the resource access request is discarded.

[0116] Based on this embodiment, the permission control module can determine whether the requester has access rights to the resource party based on a pre-configured requester list, thereby preventing the requester from accessing hardware resources configured for other master devices or operating systems. This can limit the access of the non-secure world to the secure world, or the access of devices with lower security levels in the secure world to hardware resources with higher security levels, which helps to ensure the functional safety level requirements of different functions; when the requester has access rights to the access address it requests, the requester's operating rights to the access address are determined, which can prevent the requester from performing data read and write operations on the access address it requests that exceed its authority, thereby avoiding the information security caused thereby, as well as the functional safety of other master devices or operating systems caused by the leakage or rewriting of the data, which helps to improve the security and reliability of the entire system.

[0117] Figure 6 FIG. 1 is a schematic diagram of the structure of an integrated circuit provided by another exemplary embodiment of the present disclosure. Figure 6 As shown, in Figure 2-Figure 3 Based on any of the illustrated embodiments, the resource access control device 204 includes a permission control module 2044, and when the permission control module 2044 is set on the requesting party, the above-mentioned access permission control information may include: a list of resource parties allowed to be accessed by the requesting party, and the resource party list can be pre-configured through a configuration register, and the resource party list includes at least one slave device ID, and each slave device ID is used to uniquely identify a slave device that can serve as a resource party.

[0118] In this implementation, in this implementation, the security status information (Sec identification 1 or Non-sec identification 0) can be carried by the security status read / write signal bit in the PPROT, HPROT and other signals in the bus APB or the Axprot and other signals in the bus AXI; or, the write / read transaction corresponding to the secsid identification of the write / read transaction carried in the bus AXI belongs to the security type, and the NSID identification in the bus AXI belongs to the non-security type. The requester ID (MID / VMID) and DRM attribute information (DRM attribute identification 1 / non-DRM attribute identification 0) can be transmitted through the NSAID, USER and other signals in the bus AXI, and the embodiments of the present disclosure do not limit this.

[0119] Accordingly, in this embodiment, the authority control module 2044 is further configured as follows:

[0120] Obtain the requester ID, security status information, DRM attribute information, resource party ID, access address and operation type ID from the resource access request respectively. The resource party ID is used to identify the resource party requested by the resource access request, and the operation type ID is used to identify whether the operation type corresponding to the resource access request is a read operation or a write operation;

[0121] Based on whether the pre-configured resource party list includes the resource party ID in the resource access request, determine whether the requesting party has access rights to the resource party, and obtain a first determination result. Specifically, if the resource party list includes the resource party ID in the resource access request, it is determined that the requesting party has access rights to the resource party, and the resource access request can be allowed to enter the resource party; otherwise, if the resource party list does not include the resource party ID in the resource access request, it is determined that the requesting party does not have access rights to the resource party, and the resource access request is not allowed to enter the resource party;

[0122] In response to the first determination result that the resource party list includes the resource party ID, it is determined that the requesting party has access rights to the resource party, and the access right attribute information of the target accessible address space to which the access address in the resource access request belongs in the pre-configured security control information is obtained. Among them, the security control information may include access right attribute information of at least one accessible address space corresponding to each resource party ID in the resource party list, and the access right attribute information may include operation permission attributes and DRM attributes. The target accessible address space is the accessible address space in the security control information that covers the access address in the resource access request. In the security control information, the access right attribute information of each accessible address space can be determined based on the security attribute information of the corresponding resource party, or further combined with the current state of the accessible address space. For details, please refer to the records in the above embodiment, which will not be repeated here;

[0123] Determine, based on the access permission attribute information of the target accessible address space, the operation type ID in the resource access request, and one of the DRM attribute information and the security status information in the resource access request, whether the requesting party has the operation permission to perform the operation type identified by the operation type ID on the access address, to obtain a second determination result;

[0124] In response to the second determination result that the requester has the operation permission to perform the operation type identified by the operation type ID on the access address, the resource access request is forwarded to the access address in the resource access request so as to perform the operation requested by the resource access request on the access address.

[0125] Optionally, the permission control module 2044 can be further configured to: in response to the first determination result that the resource party list does not include the resource party ID in the resource access request, determine that the requesting party does not have access rights to the resource party, or, in response to the second determination result that the requesting party does not have permission to perform the operation type identified by the operation type ID on the access address, reject the resource access request, and respond to the requesting party with an error message (response err) for the resource access request, and / or, if the operation type identified by the above operation type ID is a read operation, all-0 data can be returned, and if the operation type identified by the above operation type ID is a write operation, discard the data carried in the resource access request requesting to write to the above access address.

[0126] Based on this embodiment, the permission control module can determine whether the requester has access rights to the resource party based on a pre-configured resource party list, thereby preventing the requester from accessing hardware resources configured for other master devices or operating systems. This can limit the access of the non-secure world to the secure world, or the access of devices with lower security levels in the secure world to hardware resources with higher security levels, which helps to ensure the functional safety level requirements of different functions; when the requester has access rights to the access address it requests, the requester's operating rights to the access address are determined, which can prevent the requester from performing data read and write operations on the access address it requests that exceed its authority, thereby avoiding the information security caused thereby, as well as the functional safety of other master devices or operating systems caused by the leakage or rewriting of the data, which helps to improve the security and reliability of the entire system.

[0127] It should be noted that when the resource access control device 204 includes both the SMMU 2042 and the permission control module 2044, the master device that uses the SMMU 2042 for permission control (at this time, the stream identifier and DRM attribute information are configured in the master device), the master device that uses the permission control module for permission control (at this time, the master device identifier, security status information and DRM attribute information are configured in the master device) or the slave device can be configured through the configuration register 208 according to actual needs, or all master devices can be configured to use the SMMU 2042 for permission control, or all master devices can be configured to use the permission control module 2044 for permission control. In actual applications, dynamic configuration can be performed according to needs, and the embodiments of the present disclosure do not limit this. When the resource access control device 204 includes both SMMU2042 and permission control module 2044, if one of SMMU2042 and permission control module 2044 is used for permission control, the other one of SMMU2042 and permission control module 2044 can be bypassed, that is, the other one of SMMU2042 and permission control module 2044 is bypassed.

[0128] In some of the implementations, in the case where bus 206 adopts a PCIe bus, virtualization technology can be used to configure a host (hardware path) connected to the PCIe bus into multiple virtual machines, so that multiple flow identifiers can be configured corresponding to the multiple virtual machines, and resource access requests of the multiple virtual machines can be controlled through SMMU2042; in the case where bus 206 adopts an AMBA bus, resource access requests of each host or virtual machine can be controlled through SMMU2042 or the permission control module 2044, and the embodiments of the present disclosure do not limit this.

[0129] Exemplary Methods

[0130] Figure 7 This is a flowchart of a resource access control method provided by an exemplary embodiment of the present disclosure. This embodiment can be applied to any device equipped with a chip, such as a mobile terminal, a server, a vehicle, etc., and can be specifically applied to an integrated circuit in a device. In the embodiment of the present disclosure, an integrated circuit applied to a vehicle is used as an example for explanation. For implementation applied to other devices, reference can be made to the implementation. Figure 7 As shown, the resource access control method of this embodiment includes the following operations:

[0131] 302, in response to receiving a resource access request, the resource access request includes: a requester ID, security attribute information and an access address.

[0132] The resource access request is used to request access to the access address, such as reading data from the access address or writing data to the access address, etc. The requester ID is used to identify the requester that initiates the resource access request, and the requester is configured to the corresponding OS.

[0133] Optionally, in some of the implementations, the integrated circuit in the embodiments of the present disclosure may include, for example, a SOC or other heterogeneous multi-core chip. In some of the implementations, the integrated circuit may include processor resources and hardware resources. Among them, the processor resources may include: a CPU and a plurality of any of the following types of processors: a GPU, an ASIC, a TPU, a DPU, a NPU, a DSP, etc. The processor resources may include processors of different types and numbers according to actual needs, and the embodiments of the present disclosure are not limited to this.

[0134] In a specific implementation, the processor resources can be divided and isolated according to the specific type of each processor in the processor resources through hardware isolation technology to obtain multiple hosts; or, the processor resources can be divided by virtualization technology or time division multiplexing to obtain multiple virtual machines, and the multiple hosts and / or virtual machines can be respectively configured to corresponding operating systems.

[0135] Hardware resources may include but are not limited to at least one of the following: memory resources, cache resources, storage resources, register resources, interface resources, etc., wherein the number of each type of hardware resources may be set according to actual needs, and the embodiments of the present disclosure do not limit this. In a specific implementation, the hardware resources may be partitioned by hardware isolation technology, or the hardware resources may be partitioned by hardware virtualization technology when the vehicle electronic system is started, and appropriate amounts of memory, CPU, network, storage, and other hardware resources may be allocated to the host or virtual machine running each operating system.

[0136] Multiple operating systems can run on an integrated circuit, each providing an operating environment for upper-level applications that implement corresponding functions, to ensure that each task that implements the corresponding function can be executed in an orderly and efficient manner, thereby realizing the corresponding function.

[0137] Among them, each host or virtual machine, that is, each hardware module in the at least one hardware module mentioned above, can be used as a main device to load and run different operating systems to implement permission isolation of multiple operating systems, so that the software and hardware corresponding to the functions implemented by different operating systems are isolated from each other, so that the security of related functions can be guaranteed when applied to vehicles. In a specific implementation, an intermediate layer software, such as Hypervisor, can be used to manage the permission management software of the integrated circuit, or, after the initialization is completed during the startup process of the integrated circuit, a device ID that uniquely identifies the device is configured for each main device in the integrated circuit and set in the device. According to the main device obtained through hardware isolation technology or virtualization technology, the device ID can be a host ID or a virtual host ID. Afterwards, each main device can be configured to the corresponding operating system by configuring registers, and the corresponding security attribute information can be configured for the main device configured to the corresponding operating system.

[0138] Among them, each hardware unit obtained by partitioning the hardware resources can be used as a slave device.

[0139] When the master device needs to execute the task corresponding to the application in the operating system, it can initiate a communication request (such as a resource access request) and control the bus operation to communicate and exchange data with the slave device, for example, to read and write data to the slave device. At this time, the master device that initiates the communication request acts as the requester, and the slave device corresponding to the communication request acts as the resource party corresponding to this communication request.

[0140] The above-mentioned requester ID can be MID or VMID (hereinafter referred to as MID / VMID). Since each main device is configured to a corresponding operating system, the corresponding operating system can be uniquely determined based on the requester ID, thereby determining the main device and operating system that initiated the resource access request.

[0141] 304 , based on pre-configured access permission control information, determine whether the requesting party has access permission to the resource party corresponding to the access address in the resource access request, and obtain a first determination result.

[0142] 306. In response to the first determination result that the requesting party has access rights to the resource party, based on the pre-configured security control information and the security attribute information in the resource access request, determine whether the requesting party has operation rights to the access address in the resource access request, and obtain a second determination result.

[0143] 308. Based on the second determination result, process the resource access request.

[0144] Based on the embodiments of the present disclosure, authentication of the requester is achieved, and the access of the non-secure world to the secure world, or the access of the lower security level module in the secure world to the higher security level module can be restricted, thereby effectively ensuring the security of functions with higher security level requirements; if the requester has access rights to the resource party, then based on the pre-configured security control information and the security attribute information of the requester, it is determined whether the requester has the operation authority to the access address, and the resource access request is processed accordingly, thereby achieving the restriction of the operation authority of the requester to the resource requested to access. On the one hand, from the perspective of information security, it can effectively avoid the leakage of privacy data, and from the perspective of functional safety, it can effectively avoid the rewriting of important data related to the security function, thereby improving the security of the function. On the other hand, it can avoid the resource competition problem caused by operating systems that do not have operation authority accessing the same resource at the same time, effectively ensuring the real-time and security of related functions.

[0145] Optionally, in some of the implementations, in the resource access control method of any embodiment of the present disclosure, the resource access request may also include an operation type ID, and the operation type ID is used to identify the operation type corresponding to the resource access request, and the operation type corresponding to the resource access request may include read (Read, R) or write (Write, W). In some specific implementation examples, the specific value of the operation type ID can be preset to be R, W or 0, 1, which corresponds to the operation type corresponding to the resource access request is read or write. The embodiment of the present disclosure does not limit the operation type represented by the operation type ID and the corresponding specific value.

[0146] Optionally, in some of the implementations, the security attribute information may include, but is not limited to, at least one of the following: security status information, DRM attribute information. The security status information is used to characterize the security attributes of the requester, that is, whether the requester originates from the secure world (Secure World), thereby characterizing whether the resource access request initiated by the requester is a secure operation or a non-secure operation. In some specific implementation examples, the specific value of the security status information may be the security status (Sec) identifier 1 or the non-security status (Non-sec) identifier 0, correspondingly indicating whether the resource access request sent by the requester is a secure operation or a non-secure operation. The DRM attribute information is used to characterize whether the requester has the DRM attribute. In some specific implementation examples, the specific value of the DRM attribute information may be preset to be the DRM attribute identifier 1 or 0, correspondingly indicating that the requester has the DRM attribute or does not have the DRM attribute.

[0147] Figure 8 It is a flow chart of a resource access control method provided by another exemplary embodiment of the present disclosure. In some of the implementations, the above-mentioned resource access control method can be applied to SMMU, that is, SMMU can be set in an integrated circuit to execute the above-mentioned resource access control method embodiment. In this implementation, the above-mentioned resource access request may include a flow identifier, security status information and an access address. Among them, the flow identifier includes a requester ID and DRM attribute information based on a preset format, that is, in this implementation, the DRM attribute information is carried by the flow identifier. In some specific implementation examples, the DRM attribute information can be written into a preset position before the requester ID or after the requester ID in the flow identifier according to a preset format. The embodiment of the present disclosure does not limit the specific position of the DRM attribute information in the flow identifier.

[0148] like Figure 8 As shown in the above Figure 7 Based on the embodiment shown, this embodiment further includes the following operations after operation 302:

[0149] 402, respectively obtain the flow identifier, security status information and access address from the resource access request.

[0150] 404: Obtain the requester ID and DRM attribute information from the stream identifier based on a preset format.

[0151] Based on this embodiment, by extending the streamID, writing the requester ID and DRM attribute information in the streamID, and carrying the requester ID and DRM attribute information through the streamID, the transmission of the requester ID and DRM attribute information is realized. The SMMU can obtain the requester ID and DRM attribute information from the stream identifier for access control of the requester.

[0152] Optionally, in some of the implementations, the access permission control information may include: page tables configured in SUMM for each of the at least one requesting party. Each page table includes at least one accessible address space and access permission attribute information of each accessible address space, and the access permission attribute information is used to characterize the current operation permission restriction information. For example, in some of the specific implementation examples, the access permission attribute information may include but is not limited to at least one of the following: readable, writable, unreadable, unwritable, securely accessible, securely inaccessible, non-securely accessible, non-securely inaccessible, DRM attribute accessible, non-DRM attribute inaccessible, etc., and the embodiments of the present disclosure do not limit this. In a specific application, when a master device as a requester accesses a slave device as a resource, if the slave device does not allow the master device to access it, the accessible address space corresponding to the slave device is not included in the page table corresponding to the master device; if the master device is allowed to access the slave device, but the master device's operating authority on different accessible address spaces in the slave device is restricted, corresponding access permission attribute information can be set for each accessible address space, such as unreadable, unwritable, etc.; if the master device is allowed to access the slave device, but the access address requested by the master device is currently inaccessible (for example, being accessed by other master devices or an operating system), the access permission attribute information can be set for the corresponding accessible address space to be unreadable, unwritable, etc.

[0153] Optionally, in some of the implementations, the access permission attributes of each accessible address space can be determined based on the security attribute information of the resource party corresponding to each accessible address space according to the security requirements of related functions and information protection, or further determined in combination with the current status of the corresponding resource party. For details, please refer to the relevant introduction in the above embodiments, which will not be repeated here.

[0154] Fig. 9 FIG. 1 is a flow chart of a resource access control method provided by another exemplary embodiment of the present disclosure. Fig. 9 As shown, in Figure 8 On the basis of the illustrated embodiment, in this embodiment, operation 402 may further include: obtaining an operation type ID from the resource access request, where the operation type ID is used to identify the operation type corresponding to the resource access request.

[0155] Accordingly, in this embodiment, operation 304 may specifically include the following operations:

[0156] 3042, obtain a first page table corresponding to the requester ID, where the first page table is a page table to which the requester has access rights.

[0157] The first page table includes: at least one accessible address space corresponding to at least one resource party and access permission attribute information of each accessible address space.

[0158] 3044. Determine whether the requesting party has access rights to the resource party based on whether the access address belongs to at least one accessible address space in the first page table, and obtain a first determination result.

[0159] In some implementations of this embodiment, the security control information may include access permission attribute information of the at least one accessible address space.

[0160] Accordingly, see Fig. 9 In this embodiment, operation 306 may specifically include the following operations:

[0161] 3062, in response to the first determination result that the access address in the resource access request belongs to at least one accessible address space in the security control information, determining that the requesting party has access rights to the access address, and obtaining access rights attribute information of the target accessible address space to which the access address belongs from the security control information.

[0162] The target accessible address space is the accessible address space in the security control information that covers the access address in the resource access request.

[0163] Specifically, if the access address in the resource access request belongs to at least one accessible address space in the first page table, it can be determined that the requester has access rights to the access address, and the page table entry corresponding to the access address can be indexed; otherwise, if the access address in the resource access request does not belong to at least one accessible address space in the first page table, it can be determined that the requester does not have access rights to the access address, and indexing the page table entry corresponding to the access address is not allowed.

[0164] 3064, based on the access permission attribute information of the target accessible address space, the operation type ID in the resource access request, and one of the DRM attribute information and security status information in the resource access request, determine whether the requesting party has the permission to perform the operation type identified by the above operation type ID on the access address, that is, whether the requesting party has the permission to perform the requested read operation or write operation on the access address, and obtain a second determination result.

[0165] Optionally, see Fig. 9 , in some implementations, Figure 8 Based on the illustrated embodiment, operation 308 may specifically include the following operations:

[0166] 3082, in response to the second determination result that the requesting party has the operation permission to perform the operation type identified by the above-mentioned operation type ID on the access address in the resource access request, the access address is converted from a virtual address to a physical address based on the first page table, and the resource access request is forwarded to the physical address so as to perform the operation requested by the resource access request on the physical address.

[0167] Optionally, in Fig. 9 Based on the illustrated embodiment, operation 308 may further include the following operations:

[0168] In response to the first determination result that the access address in the resource access request does not belong to at least one accessible address space in the security control information, it is determined that the requester does not have access rights to the access address, or, in response to the second determination result that the requester does not have permission to perform the operation type identified by the above operation type ID on the access address in the resource access request, the resource access request is rejected, and an error message may be responded to the requester for the resource access request, and / or, if the operation type identified by the above operation type ID is a read operation, all-0 data may be returned, and if the operation type identified by the above operation type ID is a write operation, the data requested to be written to the above access address carried in the resource access request is discarded.

[0169] Optionally, in other implementations, other hardware for implementing permission control may be provided in the integrated circuit, hereinafter referred to as a permission control module, to execute the above resource access control method embodiment. In a specific application, the permission control module may be provided in a slave device as a resource party, or in a master device as a request party, or may be independently provided in any position between the request party and the resource party in the integrated circuit, and the embodiments of the present disclosure do not limit this.

[0170] Fig.10 FIG. 1 is a flow chart of a resource access control method provided by another exemplary embodiment of the present disclosure. This embodiment can be applied to a permission control module. Fig.10 As shown in the above Figure 7 Based on the embodiment shown, this embodiment further includes the following operations after operation 302:

[0171] 502, respectively obtain the requester ID, security status information, DRM attribute information, resource party ID and access address from the resource access request.

[0172] The resource party ID is used to identify the resource party that the resource access request requests access.

[0173] Optionally, in some of the implementations, when the permission control module is set at the resource party, the above-mentioned access permission control information may include: a list of requesters allowed to access the resource party, the list of requesters including at least one master device ID, each master device ID is used to uniquely identify a master device that can serve as a requester.

[0174] Fig.11 FIG. 1 is a flow chart of a resource access control method provided by another exemplary embodiment of the present disclosure, and this embodiment can be applied to a permission control module set in a resource side. Fig.11 As shown, in Fig.10 Based on the illustrated embodiment, operation 502 may further include:

[0175] An operation type ID is obtained from the resource access request, where the operation type ID is used to identify the operation type corresponding to the resource access request.

[0176] Accordingly, see Fig.11 In this embodiment, operation 304 may specifically include the following operations:

[0177] 3046: Determine whether the requester has access rights to the resource party based on whether the requester ID is included in the list of requesters allowed to access the resource party in the access rights control information, and obtain a first determination result.

[0178] In some implementations of this embodiment, the security control information may include access permission attribute information of at least one accessible address space.

[0179] Optionally, in some of the implementations, the access permission attributes of each accessible address space can be determined based on the security attribute information of the resource party corresponding to each accessible address space according to the security requirements of related functions and information protection, or further determined in combination with the current status of the corresponding resource party. For details, please refer to the relevant introduction in the above embodiments, which will not be repeated here.

[0180] Accordingly, see Fig.11 In this embodiment, operation 306 may specifically include the following operations:

[0181] 3066, in response to the first determination result that the requester ID is included in the requester list, determining that the requester has access rights to the resource party, obtaining access rights attribute information of the target accessible address space to which the access address in the resource access request belongs in the security control information.

[0182] The target accessible address space is the accessible address space in the security control information that covers the access address in the resource access request.

[0183] 3068, based on the access permission attribute information of the target accessible address space, the operation type ID in the resource access request, and one of the DRM attribute information and security status information in the resource access request, determine whether the requesting party has the operation permission to perform the operation type identified by the above operation type ID on the access address.

[0184] Optionally, see Fig.11 In some implementations, operation 308 may specifically include the following operations:

[0185] 3084. In response to the second determination result that the requester has the operation permission to perform the operation type identified by the operation type ID on the access address, the resource access request is forwarded to the access address in the resource access request so as to perform the operation requested by the resource access request on the access address.

[0186] Optionally, in Fig.11 Based on the illustrated embodiment, operation 308 may further include the following operations:

[0187] In response to the first determination result that the requester ID is not included in the requester list, it can be determined that the requester does not have access rights to the resource party, or, in response to the second determination result that the requester does not have permission to perform the operation type identified by the operation type ID on the access address, the resource access request is rejected, and an error message can be responded to the requester for the resource access request, and / or, if the operation type identified by the above operation type ID is a read operation, all-0 data can be returned, and if the operation type identified by the above operation type ID is a write operation, the data requested to be written to the above access address carried in the resource access request is discarded.

[0188] Optionally, in some of the implementations, when the permission control module is set at the requesting party, the above-mentioned access permission control information may include: a list of resource parties that the requesting party is allowed to access, the resource party list including at least one slave device ID, and each slave device ID is used to uniquely identify a slave device that can serve as a resource party.

[0189] Fig.12 FIG. 1 is a flow chart of a resource access control method provided by another exemplary embodiment of the present disclosure, which can be applied to a permission control module set at the requesting party. Fig.12 As shown, in Fig.10 Based on the illustrated embodiment, operation 502 may further include: obtaining an operation type ID from the resource access request, where the operation type ID is used to identify the operation type corresponding to the resource access request.

[0190] Accordingly, see Fig.12 In this embodiment, operation 304 may specifically include the following operations:

[0191] 3048: Determine whether the requesting party has access rights to the resource party based on whether the resource party list includes the resource party ID in the resource access request, and obtain a first determination result.

[0192] In some implementations of this embodiment, the security control information may include access permission attribute information of at least one accessible address space corresponding to each resource party ID in the resource party list.

[0193] Optionally, in some of the implementations, the access permission attributes of each accessible address space can be determined based on the security attribute information of the resource party corresponding to each accessible address space according to the security requirements of related functions and information protection, or further determined in combination with the current status of the corresponding resource party. For details, please refer to the relevant introduction in the above embodiments, which will not be repeated here.

[0194] Accordingly, see Fig.12 In this embodiment, operation 306 may specifically include the following operations:

[0195] 3070, in response to the first determination result that the resource party list includes the resource party ID, determining that the requesting party has access rights to the resource party, and obtaining access rights attribute information of the target accessible address space to which the access address in the resource access request belongs in the security control information.

[0196] The target accessible address space is the accessible address space in the security control information that covers the access address in the resource access request.

[0197] 3072, based on the access permission attribute information of the target accessible address space, the operation type ID in the resource access request, and one of the DRM attribute information and security status information in the resource access request, determine whether the requesting party has the operation permission to perform the operation type identified by the above operation type ID on the access address.

[0198] Optionally, see Fig.12 In some implementations, operation 308 may specifically include the following operations:

[0199] 3086. In response to the second determination result that the requester has the operation permission to perform the operation type identified by the operation type ID on the access address, the resource access request is forwarded to the access address in the resource access request so as to perform the operation requested by the resource access request on the access address.

[0200] Optionally, in Fig.12 Based on the illustrated embodiment, operation 308 may further include the following operations:

[0201] In response to the first determination result that the resource party list does not include the resource party ID in the resource access request, it is determined that the requesting party does not have access rights to the resource party, or, in response to the second determination result that the requesting party does not have permission to perform the operation type identified by the operation type ID on the access address, the resource access request is rejected, and an error message can be responded to the requesting party for the resource access request, and / or, if the operation type identified by the above operation type ID is a read operation, all-0 data can be returned, and if the operation type identified by the above operation type ID is a write operation, the data carried in the resource access request and requested to be written to the above access address is discarded.

[0202] The exemplary method embodiment and the exemplary system embodiment described above correspond to each other in specific implementation, and the relevant contents may be mutually referenced and quoted; the beneficial technical effects of the exemplary method can refer to the corresponding beneficial technical effects of the exemplary system part described above, and will not be repeated here.

[0203] Exemplary Devices

[0204] In addition, an embodiment of the present disclosure further provides a vehicle, which may include the integrated circuit provided by any of the above embodiments.

[0205] In addition, an embodiment of the present disclosure further provides an electronic device, including: a processor, a memory, and a resource access control device;

[0206] A memory, configured to store instructions executable by the processor;

[0207] The processor is used to read the executable instructions from the memory and execute the instructions to control the resource access control device to execute the resource access control method of any embodiment of the present disclosure.

[0208] Fig.13 A structural diagram of an electronic device provided in an embodiment of the present disclosure includes at least one processor 11 , at least one memory 12 , and a resource access control device 13 connected via a bus 10 .

[0209] The processor 11 may be a central processing unit (CPU) or other forms of processing units having data processing capabilities and / or instruction execution capabilities, and may control other components in the electronic device to perform desired functions.

[0210] The memory 12 may include one or more computer program products, which may include various forms of computer-readable storage media, such as volatile memory and / or non-volatile memory. Volatile memory may include, for example, random access memory (RAM) and / or cache memory (cache), etc. Non-volatile memory may include, for example, read-only memory (ROM), hard disk, flash memory, etc. One or more computer program instructions may be stored on the computer-readable storage medium, and one of the processors 11 may execute one or more computer program instructions to implement the resource access control method and / or other desired functions of the various embodiments of the present disclosure described above.

[0211] In one example, the electronic device may further include: an input device 14 and an output device 15, and these components are interconnected via a bus system and / or other forms of connection mechanisms (not shown).

[0212] The input device 14 may include, for example, a touch screen, a voice input unit, a sensor, and the like.

[0213] The output device 15 can output various information to the outside, and may include, for example, a display, a speaker, a printer, a communication network and a remote output device connected thereto, and the like.

[0214] Of course, to simplify, Fig.13 Only some of the components related to the present disclosure in the electronic device are shown, and components such as a bus, an input / output interface, etc. are omitted. In addition, according to specific application situations, the electronic device may further include any other appropriate components.

[0215] Exemplary computer program products and computer-readable storage media

[0216] In addition to the above-mentioned methods and devices, embodiments of the present disclosure may also provide a computer program product, including computer program instructions, which, when executed by a processor, enable the processor to execute the steps of the resource access control method of various embodiments of the present disclosure described in the above-mentioned "Exemplary Method" section.

[0217] The computer program product may be written in any combination of one or more programming languages ​​to write program code for performing the operations of the disclosed embodiments, including object-oriented programming languages ​​such as Java, C++, etc., and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user computing device, partially on the user device, as a separate software package, partially on the user computing device and partially on a remote computing device, or entirely on a remote computing device or server.

[0218] In addition, an embodiment of the present disclosure may also be a computer-readable storage medium having computer program instructions stored thereon, which, when executed by a processor, enables the processor to execute the steps of the resource access control method of various embodiments of the present disclosure described in the above “Exemplary Method” section.

[0219] Computer readable storage media can adopt any combination of one or more readable media. The readable medium can be a readable signal medium or a readable storage medium. The readable storage medium is, for example, but not limited to, a system, device or device including electricity, magnetism, light, electromagnetic, infrared, or semiconductor, or any combination of the above. More specific examples (non-exhaustive list) of readable storage media include: an electrical connection with one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above.

[0220] The basic principles of the present disclosure are described above in conjunction with specific embodiments. However, the advantages, strengths, effects, etc. mentioned in the present disclosure are only examples and not limitations, and cannot be considered as necessary for each embodiment of the present disclosure. In addition, the specific details disclosed above are only for the purpose of illustration and ease of understanding, rather than limitation, and the above details do not limit the present disclosure to being implemented by adopting the above specific details.

[0221] Those skilled in the art may make various changes and modifications to the present disclosure without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the present disclosure claims and their equivalents, the present disclosure is also intended to include these modifications and variations.

Claims

1. An integrated circuit, comprising a plurality of hardware modules and a resource access control device, wherein the plurality of hardware modules are connected to the resource access control device via a bus; at least one of the plurality of hardware modules is configured to correspond to at least one operating system; The resource access control device is configured to: In response to receiving a resource access request sent by a requester, the resource access request includes: a requester identifier, security attribute information and an access address; wherein the requester identifier is used to identify the requester that initiates the resource access request, the requester is one of the at least one hardware module, and the requester is configured to a corresponding operating system; Based on pre-configured access permission control information, determining whether the requesting party has access permission to the resource party corresponding to the access address, and obtaining a first determination result, wherein the resource party is a hardware module other than the at least one hardware module among the multiple hardware modules; In response to the first determination result that the requesting party has access rights to the resource party, determining whether the requesting party has operation rights to the access address based on pre-configured security control information and the security attribute information, to obtain a second determination result; Based on the second determination result, the resource access request is processed.

2. The circuit according to claim 1, further comprising: The configuration register is configured to: configure the security attribute information for the at least one hardware module.

3. The circuit according to any one of claims 1 to 2, wherein: The security attribute information includes at least one of the following: security status information, data authority management attribute information; the security status information is used to characterize the security attributes of the requesting party; the data authority management attribute information is used to characterize the data authority management attributes of the requesting party.

4. The circuit according to claim 3, wherein: The resource access control device includes at least one of a system memory management unit and a permission control module.

5. The circuit according to claim 4, wherein: When the resource access control device includes a system memory management unit, the resource access request includes: a flow identifier, the security status information and the access address; the flow identifier includes the requester identifier and the data authority management attribute information based on a preset format; The system memory management unit is further configured to: obtain the flow identifier, the security status information and the access address from the resource access request respectively; and obtain the requester identifier and the data authority management attribute information from the flow identifier based on the preset format.

6. The circuit according to claim 5, wherein: The system memory management unit is further configured to: Acquire an operation type identifier from the resource access request, where the operation type identifier is used to identify the operation type corresponding to the resource access request; Obtaining a first page table corresponding to the requester identifier, the first page table being a page table to which the requester has access rights, the first page table comprising: at least one accessible address space corresponding to at least one resource party and access right attribute information of each accessible address space; Determine whether the requesting party has access rights to the resource party based on whether the access address belongs to the at least one accessible address space, and obtain a first determination result; In response to the first determination result that the access address belongs to at least one accessible address space in the security control information, determining that the requesting party has access rights to the access address, and obtaining access rights attribute information of a target accessible address space to which the access address belongs from the security control information; wherein the security control information includes access rights attribute information of the at least one accessible address space; Based on the access permission attribute information of the target accessible address space, the operation type identifier, and one of the data permission management attribute information and the security status information, determining whether the requesting party has the operation permission to perform the operation type identified by the operation type identifier on the access address, to obtain the second determination result; In response to the second determination result that the requester has the operation permission to perform the operation type identified by the operation type identifier on the access address, the access address is converted from a virtual address to a physical address based on the first page table, and the resource access request is forwarded to the physical address so that the operation requested by the resource access request is performed on the physical address.

7. The circuit according to claim 4, wherein: When the resource access control device includes a permission control module, and the permission control module is arranged on the resource side, the permission control module is further configured as follows: Respectively obtaining the requester identifier, the security status information, the data authority management attribute information, the resource party identifier, the operation type identifier and the access address from the resource access request; the resource party identifier is used to identify the resource party requested to be accessed by the resource access request, and the operation type identifier is used to identify the operation type corresponding to the resource access request; Determine whether the requesting party has access rights to the resource party based on whether the requesting party identifier is included in the list of requesting parties allowed to access the resource party in the access rights control information, and obtain the first determination result; In response to the first determination result that the requester identifier is included in the requester list, determining that the requester has access rights to the resource party, obtaining access rights attribute information of the target accessible address space to which the access address belongs in the security control information; wherein the security control information includes access rights attribute information of the at least one accessible address space; Based on the access permission attribute information of the target accessible address space, the operation type identifier, and one of the data permission management attribute information and the security status information, determining whether the requesting party has the operation permission to perform the operation type identified by the operation type identifier on the access address, to obtain the second determination result; In response to the second determination result that the requester has permission to perform the operation type identified by the operation type identifier on the access address, the resource access request is forwarded to the access address so as to perform the operation requested by the resource access request on the access address.

8. The circuit according to claim 4, wherein: When the resource access control device includes a permission control module, and the permission control module is arranged at the requesting party, the permission control module is further configured as follows: Respectively obtaining the requester identifier, the security status information, the data authority management attribute information, the resource party identifier, the operation type identifier and the access address from the resource access request; the resource party identifier is used to identify the resource party requested to be accessed by the resource access request, and the operation type identifier is used to identify the operation type corresponding to the resource access request; Determine whether the requesting party has access rights to the resource party based on whether the resource party identifier is included in the resource party list, and obtain the first determination result; In response to the first determination result that the resource party list includes the resource party identifier, determining that the requesting party has access rights to the resource party, obtaining access rights attribute information of the target accessible address space to which the access address belongs in the security control information; wherein the security control information includes access rights attribute information of at least one accessible address space corresponding to each resource party identifier in the resource party list; Based on the access permission attribute information of the target accessible address space, the operation type identifier, and one of the data permission management attribute information and the security status information, determining whether the requesting party has the operation permission to perform the operation type identified by the operation type identifier on the access address, to obtain the second determination result; In response to the second determination result that the requester has permission to perform the operation type identified by the operation type identifier on the access address, the resource access request is forwarded to the access address so as to perform the operation requested by the resource access request on the access address.

9. A resource access control method, comprising: In response to receiving a resource access request, the resource access request includes: a requester identifier, security attribute information and an access address; wherein the requester identifier is used to identify the requester initiating the resource access request, and the requester is configured to a corresponding operating system; Based on pre-configured access permission control information, determining whether the requesting party has access permission to the resource party corresponding to the access address, and obtaining a first determination result; In response to the first determination result that the requesting party has access rights to the resource party, determining whether the requesting party has operation rights to the access address based on pre-configured security control information and the security attribute information, to obtain a second determination result; Based on the second determination result, the resource access request is processed.

10. The method according to claim 9, wherein: The security attribute information includes at least one of the following: security status information, data authority management attribute information; the security status information is used to characterize the security attributes of the requesting party; the data authority management attribute information is used to characterize the data authority management attributes of the requesting party.

11. The method according to claim 10, wherein: After receiving the resource access request, the method further includes: Acquire a flow identifier, the security status information and the access address from the resource access request respectively; the flow identifier includes the requester identifier and the data authority management attribute information based on a preset format; The requester identifier and the data authority management attribute information are obtained from the flow identifier based on the preset format.

12. The method according to claim 11, wherein: In response to receiving a resource access request, the method further includes: acquiring an operation type identifier from the resource access request, the operation type identifier being used to identify an operation type corresponding to the resource access request; Determining whether the requesting party has access rights to the access address based on pre-configured access rights control information to obtain a first determination result includes: Obtaining a first page table corresponding to the requester identifier, the first page table being a page table to which the requester has access rights, the first page table comprising: at least one accessible address space corresponding to at least one resource party and access right attribute information of each accessible address space; Determine whether the requesting party has access rights to the resource party based on whether the access address belongs to the at least one accessible address space, and obtain the first determination result; In response to the first determination result that the requesting party has access rights to the resource party, determining whether the requesting party has operation rights to the access address based on pre-configured security control information and the security attribute information includes: In response to the first determination result that the access address belongs to at least one accessible address space in the security control information, determining that the requesting party has access rights to the access address, and obtaining access rights attribute information of a target accessible address space to which the access address belongs from the security control information; wherein the security control information includes access rights attribute information of the at least one accessible address space; Based on the access permission attribute information of the target accessible address space, the operation type identifier, and one of the data permission management attribute information and the security status information, determine whether the requesting party has the operation permission to perform the operation type identified by the operation type identifier on the access address.

13. The method according to any one of claims 11-12, wherein: Processing the resource access request based on the second determination result includes: In response to the second determination result that the requester has the operation permission to perform the operation type identified by the operation type identifier on the access address, the access address is converted from a virtual address to a physical address based on the first page table, and the resource access request is forwarded to the physical address so that the operation requested by the resource access request is performed on the physical address.

14. The method according to claim 10, wherein: After receiving the resource access request, the method further includes: The requester identifier, the security status information, the data authority management attribute information, the resource party identifier and the access address are obtained from the resource access request respectively; the resource party identifier is used to identify the resource party requested to be accessed by the resource access request.

15. The method according to claim 14, wherein: After receiving the resource access request, the method further includes: Acquire an operation type identifier from the resource access request, where the operation type identifier is used to identify the operation type corresponding to the resource access request; Determining whether the requesting party has access rights to the access address based on pre-configured access rights control information to obtain a first determination result includes: Determine whether the requesting party has access rights to the resource party based on whether the requesting party identifier is included in the list of requesting parties allowed to access the resource party in the access rights control information, and obtain the first determination result; In response to the first determination result that the requesting party has access rights to the resource party, determining whether the requesting party has operation rights to the access address based on pre-configured security control information, the security attribute information, and the operation type identifier includes: In response to the first determination result that the requester identifier is included in the requester list, determining that the requester has access rights to the resource party, obtaining access rights attribute information of the target accessible address space to which the access address belongs in the security control information; wherein the security control information includes access rights attribute information of the at least one accessible address space; Based on the access permission attribute information of the target accessible address space, the operation type identifier, and one of the data permission management attribute information and the security status information, determine whether the requesting party has the operation permission to perform the operation type identified by the operation type identifier on the access address.

16. The method according to claim 14, wherein: After receiving the resource access request, the method further includes: Acquire an operation type identifier from the resource access request, where the operation type identifier is used to identify the operation type corresponding to the resource access request; Determining whether the requesting party has access rights to the access address based on pre-configured access rights control information to obtain a first determination result includes: Determine whether the requesting party has access rights to the resource party based on whether the resource party identifier is included in the resource party list, and obtain the first determination result; In response to the first determination result that the requesting party has access rights to the resource party, determining whether the requesting party has operation rights to the access address based on pre-configured security control information, the security attribute information, and the operation type identifier includes: In response to the first determination result that the resource party list includes the resource party identifier, determining that the requesting party has access rights to the resource party, obtaining access rights attribute information of the target accessible address space to which the access address belongs in the security control information; wherein the security control information includes access rights attribute information of at least one accessible address space corresponding to each resource party identifier in the resource party list; Based on the access permission attribute information of the target accessible address space, the operation type identifier, and one of the data permission management attribute information and the security status information, determine whether the requesting party has the operation permission to perform the operation type identified by the operation type identifier on the access address.

17. The method according to any one of claims 14 to 16, wherein: Processing the resource access request based on the second determination result includes: In response to the second determination result that the requester has permission to perform the operation type identified by the operation type identifier on the access address, the resource access request is forwarded to the access address so as to perform the operation requested by the resource access request on the access address.

18. A computer-readable storage medium, wherein the storage medium stores a computer program, and when the computer program is executed, it is used to implement the method according to any one of claims 9 to 17.

19. An electronic device comprising: Processor, memory and resource access control devices; The memory is used to store the processor executable instructions; The processor is used to read the executable instructions from the memory and execute the instructions to control the resource access control device to execute any method described in claims 9-17.

Images