RSIC-V CPU security chip based on authority management

Abstract

The invention discloses an RSIC-V CPU security chip based on authority management, and belongs to the technical field of security startup. Comprising an embedded RSIC-V CPU core, and the embedded RSIC-V CPU core is connected with an ROM authority management module, a safety management system register and a safety authority management module. The ROM authority management module is connected with the secure ROM firmware; the security authority management module is connected with a plurality of security modules; when users with different identities access the secure ROM firmware, identity recognition is carried out, and security services with different levels are provided according to the permission of the recognized user identities. According to the method, only the request passing signature verification and security authority management authentication is allowed to access the security module, the service uniqueness of the security module is ensured, the chip security module can be pertinently accessed only through authorized upper software, the access is non-direct access, security service is carried out through ROM firmware, and a service result is fed back to the upper software, so that the security module can be accessed in a targeted manner. The security of the security module is ensured from the circuit, and the attack difficulty of the chip is greatly increased.

Description

Technical Field

[0001] The present invention relates to the technical field of secure booting, and in particular to an RSIC-V CPU security chip based on authority management. Background Art

[0002] The Internet of Things technology is developing rapidly. IoT devices are being implemented in smart homes, smart healthcare, smart cities, wearables and other fields at an accelerated pace. Terminal products integrating IoT devices are increasing rapidly. According to the Global Mobile Communications Association, the total number of IoT devices in the world will exceed 5.3 billion by 2030. IoT devices often work in untrusted physical environments. More and more IoT devices are being maliciously attacked to obtain sensitive information or data due to the lack of hardware security reinforcement measures. Summary of the invention

[0003] The purpose of the present invention is to overcome the deficiencies of the prior art and provide a RSIC-V CPU security chip based on rights management.

[0004] The objective of the present invention is achieved through the following technical scheme: an RSIC-V CPU security chip based on authority management, comprising an embedded RSIC-V CPU core, wherein the embedded RSIC-V CPU core is connected to a ROM authority management module, a security management system register and a security authority management module; the ROM authority management module is connected to a security ROM firmware; the security authority management module is connected to a plurality of security modules; identity recognition is performed when users with different identities access the security ROM firmware, and different levels of security services are provided according to the authority of the identified user identity.

[0005] Preferably, the security management system register includes a system register component and a security feature management module; the security feature management module includes a security feature comparison module; one end of the security feature comparison module is connected to the same number of security feature ID configuration registers and security feature ID request registers, and the other end of the security feature comparison module is connected to the embedded RSIC-V CPU core; during the initialization process of the security ROM firmware, the system register component is configured, and each security feature ID configuration register and security feature ID request register are initialized and configured; when the upper-layer software needs to access the security feature, the corresponding security feature ID request register is configured through the security interface, and a security feature authentication is requested. If the authentication is passed, the security feature service request is accepted and the security feature is executed. If the authentication is not passed, the security ROM firmware refuses to provide the security feature service; after the upper-layer software completes the access, the security ROM firmware clears the corresponding security feature ID request register to close the access rights of the security ROM firmware and the security module.

[0006] Preferably, if the signature verification passes and the security feature authentication passes, the hardware circuit allows reading the ROM data at the requested address; if either the security feature authentication and the signature verification fails, reading the ROM data at the requested address is not allowed, and the hardware circuit returns all-0 ROM data to the embedded RSIC-V CPU core.

[0007] Preferably, if the signature verification passes and the security feature authentication passes, the hardware circuit switch is turned on to allow the embedded RSIC-V CPU core to read and write the registers of each security module; if either the security feature authentication or the signature verification fails, the hardware circuit switch is turned off, and the embedded RSIC-V CPU core cannot read and write the registers of each security module, and thus cannot access each security module, and all requests for illegal access to the security module are blocked.

[0008] Preferably, the system register component includes a PLL setting register, a GPIO setting register, and a clock configuration register. Preferably, it also includes a PLL phase-locked loop component, a CRG clock reset generation component, a POR power-on reset component, a VDT voltage detection component, an OCB on-chip cache component, an OTP one-time programming device component, an OTP controller component and multiple peripheral modules; the PLL phase-locked loop component is used to provide a clock; the CRG clock reset generation component is used to provide the clock and reset required by each chip component; the POR power-on reset component is used to provide a power-on reset; the VDT voltage detection component is used to monitor the power supply status of each chip; the OCB on-chip cache component is used as a shared on-chip data cache resource pool; the OTP one-time programming device component is used to store a chip key, a chip ID and an analog IP check value; the OTP controller component is used to control the OTP one-time programming device component and provide read and write control timing and power-on information reading for the OTP one-time programming device component.

[0009] Preferably, the peripheral modules include a UART module, an I2C module, an SPI module, and a JTAG module.

[0010] Preferably, the security module includes an SM2 component, an SM3 component, an SM4 component and a TRNG true random number component that integrate the national secret algorithm.

[0011] Preferably, it also includes a high-speed interface component, an image processing component and an AI component.

[0012] Preferably, the high-speed interface components include PCIe components, NVMe components, DDR components, and USB components.

[0013] The beneficial effects of the present invention are: 1) Security feature permission management is performed for several different security feature ID registers. Differentiated and proactive security management is performed through security layering and feature division. Reasonable authorization and timely revocation of permissions are performed, so as to achieve security management from the source and manage hardware security features and security modules.

[0014] 2) All security features are initialized and managed by the ROM firmware, which provides security services to the upper-level software. The ROM firmware cannot be tampered with, ensuring the tamper-proof nature of the security firmware from the chip circuit.

[0015] 3) Only requests that have passed signature verification and security feature ID matching authentication are allowed to access ROM data, ensuring the security of ROM data acquisition.

[0016] 4) Only requests that pass signature verification and security permission management authentication are allowed to access security modules such as SM2, SM3, SM4, true random number modules, etc., which ensures the uniqueness of the security module's services. Only authorized upper-layer software can access the chip security module in a targeted manner. This access is not direct access, but security services are performed through ROM firmware, and the service results are fed back to the upper-layer software, which ensures the security of the security module from a circuit perspective and greatly increases the difficulty of chip attacks. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] Figure 1 This is the principle block diagram of the RSIC-V CPU security chip based on permission management; Figure 2 This is the principle block diagram of the safety management system register. DETAILED DESCRIPTION

[0018] The technical solution of the present invention will be clearly and completely described below in conjunction with the embodiments. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present invention.

[0019] The present invention provides a complete and secure hardware startup solution based on authority management and a national secret security algorithm service solution for chip hardware-level security startup technology. Access requests that have not passed the signature verification and security authority management authentication cannot access ROM data, thereby ensuring the physical security of ROM data to the greatest extent, and access requests that have not passed the signature verification and security authority management authentication cannot access the security module. Therefore, even if a CPU is exploited by an attacker due to a security vulnerability, the attacker cannot crack the key or decrypt the data because he cannot obtain security services, which greatly increases the difficulty of the chip being attacked.

[0020] See also Figure 1-Figure 2The present invention provides a technical solution: an RSIC-V CPU security chip based on authority management, comprising an embedded RSIC-V CPU core, wherein the embedded RSIC-V CPU core is connected to a ROM authority management module, a security management system register and a security authority management module; the ROM authority management module is connected to a security ROM firmware; the security authority management module is connected to a plurality of security modules; when users with different identities access the security ROM firmware, identity recognition is performed, and different levels of security services are provided according to the authority of the recognized user identity.

[0021] In this embodiment, the chip security firmware function is carried by the secure ROM firmware, and a circuit-level hardware security reinforcement solution based on permission management is proposed. Identity recognition is performed when users with different identities access the secure ROM firmware, and different levels of security services are provided according to the permissions of the identified user identities.

[0022] In some embodiments, the security management system register includes a system register component and a security feature management module; the security feature management module includes a security feature comparison module; one end of the security feature comparison module is connected to the same number of security feature ID configuration registers and security feature ID request registers, and the other end of the security feature comparison module is connected to the embedded RSIC-V CPU core; during the initialization process of the security ROM firmware, the system register component is configured, and each security feature ID configuration register and security feature ID request register are initialized and configured; when the upper-level software needs to access the security feature, the corresponding security feature ID request register is configured through the security interface to request security feature authentication. If the authentication passes, the security feature service request is accepted and the security feature is executed. If the authentication fails, the security ROM firmware refuses to provide security feature service; after the upper-level software access is completed, the security ROM firmware clears the corresponding security feature ID request register to close the access rights of the security ROM firmware and the security module.

[0023] In this embodiment, the security feature management module includes three parts: several groups of security feature ID configuration registers, several corresponding groups of security feature ID request registers and a security feature comparison module. The definition of the security feature ID configuration register is shown in Table 1. The register is reset to all 0s only by a POR hard reset at power-on, and can only be written when the sec_init_done register is 0. The active signal is 1 to activate the security feature ID. The security feature ID comparison module will initiate a comparison based on the group of security feature ID configuration registers. The sec_init_done register can only be reset by a POR reset and can only be configured to 1 by the CPU.

[0024] Table 1 The security feature ID request register is defined in Table 2. The 31st bit indicates the authentication result status bit. If it is 1, it means the authentication is successful and the security feature can be accessed. If it is 0, it means the authentication fails and the security feature cannot be accessed. The 30th bit indicates the authentication request initiation bit. If it is 1, it means the authentication request is initiated. The authenticated ID is bits 29 to 0.

[0025] Table 2 The security features are carried and managed by the security ROM firmware. During the initialization process of the security ROM, the system register components are configured, and each security feature ID register is initialized and configured. After the configuration is completed, the rom_sec_init_done register is written to 1 to indicate that the security firmware initialization is complete. During the service permission process, when the upper-layer software needs to access the security features, it configures its own security access ID request register through the security interface and sets the req bit to 1, indicating that it requests security feature authentication. The security interface writes the configuration value to the security feature ID request register and initiates a security feature authentication request, and checks the authentication request status bit of the security feature ID request register. If the bit is 1, it means that the authentication is passed, and the sec_acc_en signal is pulled high, the security feature service request is accepted and the security feature will be executed. If the status bit is 0, the ROM firmware refuses to provide security services. After the upper-layer software completes the access, the security ROM firmware clears the security feature ID request register to 0, closes the access rights of the ROM and security module, and needs to authenticate again when it needs to access next time, thereby realizing the access rights management of the security features.

[0026] In some embodiments, if the signature verification passes and the security feature authentication passes, the hardware circuit allows reading the ROM data at the requested address; if either the security feature authentication and the signature verification fails, reading the ROM data at the requested address is not allowed, and the hardware circuit returns all-0 ROM data to the embedded RSIC-V CPU core.

[0027] In this embodiment, after authentication, the sec_acc_en signal is pulled high, indicating that ROM data reading is allowed. At this time, the circuit allows reading the ROM data at the corresponding address. If the sec_acc_en signal is pulled low, it means that the current ROM reading is not authorized, and reading the ROM data at the corresponding address is not allowed. The hardware circuit returns all 0 ROM data to the CPU. Therefore, through hardware circuit security reinforcement, only trusted requests that pass security authentication can access ROM data, and the hardware circuit security reinforcement technology of ROM is realized.

[0028] In some embodiments, if the signature verification passes and the security feature authentication passes, the hardware circuit switch is turned on to allow the embedded RSIC-V CPU core to read and write the registers of each security module; if either the security feature authentication or the signature verification fails, the hardware circuit switch is turned off, and the embedded RSIC-V CPU core cannot read and write the registers of each security module, and therefore cannot access each security module, and all requests to illegally access the security module are blocked.

[0029] In this embodiment, the sec_acc_en signal is logically operated with the chip select signal of the CPU register configuration bus of each security module such as SM2, SM3, SM4, TRNG, etc., so that when sec_acc_en is high, the hardware circuit switch is turned on to allow the CPU to read and write the registers of each security module. When sec_acc_en is low, the hardware circuit switch is turned off, and the CPU cannot read and write the registers of each security module, and cannot access each security module. Thus, the hardware circuit security reinforcement technology for the security module is realized, and all requests for illegal access to the security module are blocked. Only service requests that pass the signature verification and security feature ID authentication can be authorized to access the security module. In addition, while meeting the security characteristics, the circuit of this invention also has the advantage of convenient transplantation of circuit design, and the security module can be integrated between different SoC projects.

[0030] In some embodiments, the system register component includes a PLL setting register, a GPIO setting register, and a clock configuration register.

[0031] In this embodiment, if Figure 2 As shown in the figure, the security management system register component includes the system register component and the security feature management component. The system register component includes registers such as the PLL setting register, GPIO setting register, and clock configuration register (the system register component may also include other registers according to the actual design). Such registers are related to the realization and stability of the basic functions of the SoC. To ensure safety, this design only allows CPU Core0 to perform initialization configuration in machine mode and modify the configuration during dynamic operation. Other CPU cores and other modes cannot be configured to ensure the security of the system registers. In some embodiments, it also includes a PLL phase-locked loop component, a CRG clock reset generation component, a POR power-on reset component, a VDT voltage detection component, an OCB on-chip cache component, an OTP one-time programming device component, an OTP controller component and multiple peripheral modules; the PLL phase-locked loop component is used to provide a clock; the CRG clock reset generation component is used to provide the clock and reset required by each component of the chip; the POR power-on reset component is used to provide a power-on reset; the VDT voltage detection component is used to monitor the power supply status of each chip; the OCB on-chip cache component is used as a shared on-chip data cache resource pool; the OTP one-time programming device component is used to store a chip key, a chip ID and an analog IP check value; the OTP controller component is used to control the OTP one-time programming device component and provide read and write control timing and power-on information reading for the OTP one-time programming device component.

[0032] In this embodiment, the PLL component is used to provide the clock, the POR (Power On Reset, POR) component is used to provide the power-on reset, the (Clock Reset Generator, CRG) component is used to provide the clock and reset required by each chip component, the voltage detection component (VoltageDetector, VDT) is used to monitor the power supply status of each chip, the ROM component is used to load the on-chip CPU firmware after power-on, the DMA is used to move data, the one-time programming device component (One Time Programmable, OTP) is used to store information such as chip keys, chip IDs and analog IP check values ​​(in addition to other information), and the OTP controller component is used to control the OTP component and provide functions such as read and write control timing and power-on information reading for OTP. The on-chip buffer (OnChip Buffer, OCB) component is used as a shared on-chip data cache resource pool. Several peripheral modules such as UART, I2S, SPI, I2S and other modules.

[0033] In some embodiments, the peripheral modules include a UART module, an I2C module, an SPI module, and a JTAG module.

[0034] In some embodiments, the security module includes an SM2 component, an SM3 component, an SM4 component and a TRNG true random number component that integrate a national secret algorithm.

[0035] In some embodiments, a high-speed interface component, an image processing component, and an AI component are also included.

[0036] In some embodiments, the high-speed interface components include PCIe components, NVMe components, DDR components, and USB components.

[0037] In this embodiment, according to the requirements of customized SoC functions, the SoC chip may also include high-speed interface components such as PCIe, NVMe, DDR, USB, as well as image processing components, AI components, SM2, SM3, SM4, true random numbers and other components that integrate national secret algorithms.

[0038] The above is only a preferred embodiment of the present invention. It should be understood that the present invention is not limited to the form disclosed herein, and should not be regarded as excluding other embodiments, but can be used in various other combinations, modifications and environments, and can be modified within the scope of the concept described herein through the above teachings or the technology or knowledge of the relevant field. The changes and modifications made by those skilled in the art shall not deviate from the spirit and scope of the present invention, and shall be within the scope of protection of the claims attached to the present invention.

Claims

1. A RSIC-V CPU security chip based on rights management, characterized in that: It includes an embedded RSIC-V CPU core, wherein the embedded RSIC-V CPU core is connected to a ROM authority management module, a security management system register, and a security authority management module; The ROM authority management module is connected to the secure ROM firmware; The security authority management module is connected to multiple security modules; when users with different identities access the security ROM firmware, identity recognition is performed, and different levels of security services are provided according to the authority of the recognized user identity.

2. The RSIC-V CPU security chip based on rights management according to claim 1, characterized in that: The security management system register comprises a system register component and a security feature management module; the security feature management module comprises a security feature comparison module; one end of the security feature comparison module is connected to the same number of security feature ID configuration registers and security feature ID request registers, and the other end of the security feature comparison module is connected to the embedded RSIC-V CPU core; during the initialization process of the security ROM firmware, the system register component is configured, and each security feature ID configuration register and security feature ID request register are initialized and configured; when the upper-layer software needs to access the security feature, the corresponding security feature ID request register is configured through the security interface, and the security feature authentication is requested. If the authentication is passed, the security feature service request is accepted and the security feature is executed. If the authentication is not passed, the security ROM firmware refuses to provide the security feature service; after the upper-layer software completes the access, the security ROM firmware clears the corresponding security feature ID request register to close the access rights of the security ROM firmware and the security module.

3. The RSIC-V CPU security chip based on rights management according to claim 2, characterized in that: If the signature verification passes and the security feature authentication passes, the hardware circuit allows reading the ROM data at the requested address; if either the security feature authentication or the signature verification fails, reading the ROM data at the requested address is not allowed, and the hardware circuit returns all-0 ROM data to the embedded RSIC-V CPU core.

4. The RSIC-V CPU security chip based on rights management according to claim 2, characterized in that: If the signature verification passes and the security feature authentication passes, the hardware circuit switch is turned on to allow the embedded RSIC-V CPU core to read and write the registers of each security module; if either the security feature authentication or the signature verification fails, the hardware circuit switch is turned off, and the embedded RSIC-V CPU core cannot read and write the registers of each security module, and cannot access each security module. All requests to illegally access the security module are blocked.

5. The RSIC-V CPU security chip based on rights management according to claim 2, characterized in that: The system register component includes a PLL setting register, a GPIO setting register, and a clock configuration register.

6. The RSIC-V CPU security chip based on rights management according to any one of claims 1 to 5, characterized in that: It also includes a PLL phase-locked loop component, a CRG clock reset generation component, a POR power-on reset component, a VDT voltage detection component, an OCB on-chip cache component, an OTP one-time programming device component, an OTP controller component and multiple peripheral modules; the PLL phase-locked loop component is used to provide a clock; the CRG clock reset generation component is used to provide the clock and reset required by each component of the chip; the POR power-on reset component is used to provide a power-on reset; the VDT voltage detection component is used to monitor the power supply status of each chip; the OCB on-chip cache component is used as a shared on-chip data cache resource pool; the OTP one-time programming device component is used to store a chip key, a chip ID and an analog IP check value; the OTP controller component is used to control the OTP one-time programming device component and provide read and write control timing and power-on information reading for the OTP one-time programming device component.

7. The RSIC-V CPU security chip based on rights management according to claim 6, characterized in that: The peripheral modules include a UART module, an I2C module, an SPI module, and a JTAG module.

8. The RSIC-V CPU security chip based on rights management according to any one of claims 1 to 5, characterized in that: The security module includes SM2 component, SM3 component, SM4 component and TRNG true random number component which integrate national secret algorithm.

9. The RSIC-V CPU security chip based on rights management according to any one of claim 15, characterized in that: It also includes high-speed interface components, image processing components and AI components.

10. The RSIC-V CPU security chip based on rights management according to claim 9, characterized in that: The high-speed interface components include PCIe components, NVMe components, DDR components, and USB components.

Images