A multi-granularity memory detection method, memory device and electronic device
By dividing the SoC chip memory module into multiple submodules and using the March C-algorithm for multi-grain detection, the memory module failure and hardware Trojan attack detection efficiency are solved, and flexible detection solutions are realized to adapt to different security needs and improve The safety and detection efficiency of the equipment are achieved.
Patent Information
- Application Number
- CN202110112979.1
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2021-01-27
- Publication Date
- 2024-12-31
- Estimated Expiration
- 2041-01-27
AI Technical Summary
The prior art cannot effectively detect and prevent faults and hardware Trojan attacks in SoC chip memory modules, resulting in changes in device functions or leakage of user information. The traditional detection methods are inefficient and cannot flexibly configure detection granularity, which cannot meet different security needs.
Using multi-grained memory detection method, the memory module is divided into multiple submodules, and sampling and detection is performed based on preset detection strategies and granular parameters. The memory unit is detected using March C-algorithm to achieve flexible detection coverage and time complexity configuration, adapting to Different attack levels and protection requirements.
It improves the flexibility and efficiency of memory detection, balances system overhead, can detect faults and attacks at runtime, extends the security of the device to the entire life cycle, and adapts to the dynamically changing memory detection needs.
Smart Images
Figure CN112685241B_ABST
Abstract
Description
Technical Field
[0001] The present application relates to the technical field of integrated circuit verification and testing, and more specifically, to a multi-granularity memory detection method, a memory device, and an electronic device. Background Art
[0002] With the rapid development of IoT technology, IoT devices are widely used. According to McKinsey's 2019 analysis report, 25 billion devices were connected to the Internet in 2015, and by 2025, this number will exceed 40 billion. Users use IoT devices to make life convenient and fast; IoT devices rely on users to collect user personal information (such as contacts, location, health information, etc.) while providing users with various services. The close connection between "people" and "things" has become a distinctive feature of today's society. However, close connections not only provide convenience to life, but also bring a certain degree of security threats.
[0003] System on Chip (SoC) is the hardware foundation of IoT devices. Memory, as an important component of SoC chips, will change the function of the device, leak the user's personal information, or even cause loss of life and property to the user if it contains faults or is attacked by hardware Trojans. Summary of the invention
[0004] In view of this, the present application provides a multi-granularity memory detection method, a memory device, and an electronic device, and the scheme is as follows:
[0005] A multi-granularity memory detection method, when a Soc chip is running, the memory detection method is used to detect a memory module in the Soc chip, the memory module is divided into a plurality of memory sub-modules, and the memory sub-module includes a plurality of memory units;
[0006] The memory detection method comprises:
[0007] When there is a new memory detection task, determine whether the memory detection condition is met;
[0008] If yes, obtain the memory detection strategy and the corresponding configuration granularity parameters;
[0009] Based on the memory detection strategy and the granularity parameter, a sampling detection is performed on the memory units in the memory submodule.
[0010] Preferably, in the above memory detection method, the method for determining whether there is a new memory detection task includes:
[0011] Scan security policy engine;
[0012] Based on the scanning result, it is determined whether there is a new memory detection task.
[0013] Preferably, in the above-mentioned memory detection method, if the security policy engine obtains a trigger condition for triggering a new memory detection task, a flag bit representing that there is a new memory detection task is generated.
[0014] Preferably, in the above memory detection method, the method for determining whether the memory detection condition is met includes:
[0015] Determining whether the memory module is responding to a read or write operation of the bus;
[0016] If yes, the memory detection condition is met.
[0017] Preferably, in the above memory detection method, the method of dividing the memory module into a plurality of memory sub-modules includes:
[0018] A storage space consistent with the bus bit width is used as a memory unit, and n memory units are used as a memory sub-module, where n is a positive integer greater than 1.
[0019] Preferably, in the above memory detection method, the method for obtaining the memory detection strategy and the corresponding configured granularity parameters includes:
[0020] Obtaining the memory detection policy and the granularity parameter from the security policy engine;
[0021] The memory detection strategy includes P granularity modes, which are sequentially the first granularity mode to the Pth granularity mode, where P is a positive integer greater than 1; the i-th granularity mode is randomly selected from each of the memory submodules. The memory units are tested. If the memory units extracted from the memory submodule are all error-free, it means that the memory submodule is fault-free, i is a positive integer not greater than P; n is the number of the memory units in the memory submodule.
[0022] Preferably, in the above memory detection method, the method of performing sampling detection on the memory units in the memory submodule includes:
[0023] Calculating a detection address range after the memory module is divided into a plurality of memory sub-modules;
[0024] After randomly sampling the addresses of the memory units to be detected in each of the memory submodules according to the granularity parameters, the memory units to be detected are detected and the detection results are recorded.
[0025] Preferably, in the above memory detection method, after randomly sampling the address of the memory unit to be detected in each of the memory submodules, the memory unit to be detected is detected, and the detection result is recorded, including:
[0026] After obtaining the address of the memory unit to be detected, backing up the memory data corresponding to the corresponding memory unit;
[0027] After completing the memory data backup, testing the memory unit to be tested;
[0028] After the detection of the current memory unit to be detected is completed, the backup memory data is written back, and the detection result is recorded, and the detection of the next memory unit to be detected is performed until all the memory units to be detected are detected.
[0029] Preferably, in the above memory detection method, it also includes:
[0030] After completing the detection of all the memory units to be detected, a detection result report is generated.
[0031] The present application also provides a memory device, which can be based on an external security policy engine, and the memory device includes:
[0032] A memory module, wherein the memory module is divided into a plurality of memory sub-modules, and the memory sub-modules include a plurality of memory units;
[0033] A control circuit, wherein the control circuit is used to respond to the control of the security policy engine, execute any one of the above-mentioned memory detection methods, and detect the memory module;
[0034] A memory access gating module is used to select and respond to an external bus request or a memory detection request of the security policy engine, and is also used to back up the data taken out by the control circuit from the memory unit to be detected when detecting the memory module.
[0035] The present application also provides an electronic device, which includes the memory device described above.
[0036] It can be seen from the above description that the technical solution of the present application is a multi-granularity security detection solution based on a preset memory detection strategy. In view of the problem that the memory module in the SoC chip is prone to faults and hardware Trojans and other attacks, the memory module is divided into multiple memory sub-modules, and the memory sub-module includes multiple memory units; the memory detection method includes: when there is a new memory detection task, judging whether the memory detection condition is met; if so, obtaining the memory detection strategy and the corresponding configured granularity parameters; based on the memory detection strategy and the granularity parameters, sampling detection is performed on the memory units in the memory sub-module. The technical solution of the present application separates the memory module to form multiple memory sub-modules, and samples the memory units in the memory sub-module based on the memory detection strategy and the granularity parameters to complete the sampling detection, and determines whether the memory module has a fault or is attacked at runtime according to the algorithm results. The technical solution of the present application is a runtime detection solution. Through a multi-granularity detection solution, different detection overhead requirements can be achieved, and the memory detection requirements that may change dynamically during operation can be flexibly adapted to improve detection flexibility and balance system overhead. BRIEF DESCRIPTION OF THE DRAWINGS
[0037] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the related technologies, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying any creative work.
[0038] The structures, proportions, sizes, etc. illustrated in the drawings of this specification are only used to match the contents disclosed in the specification so as to facilitate understanding and reading by persons familiar with this technology. They are not used to limit the conditions under which this application can be implemented, and therefore have no substantive technical significance. Any structural modification, change in proportion or adjustment of size, without affecting the effects and purposes that can be achieved by this application, should still fall within the scope of the technical contents disclosed in this application.
[0039] Figure 1 A flowchart of a multi-granularity memory detection method provided in an embodiment of the present application;
[0040] Figure 2 A schematic diagram of a flow chart of a method for sampling and detecting the memory units in the memory submodule provided in an embodiment of the present application;
[0041] Figure 3 A flow chart of a method for detecting a memory unit to be detected provided in an embodiment of the present application;
[0042] Figure 4 A schematic diagram of a flow chart of another multi-granularity memory detection method provided in an embodiment of the present application;
[0043] Figure 5 A schematic diagram of the structure of a memory device provided in an embodiment of the present application. DETAILED DESCRIPTION
[0044] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the embodiments in the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of this application.
[0045] As described in the background technology, if there is a fault or it is attacked by hardware Trojans, it will change the function of the device, or leak the user's personal information, and even cause loss of life and property to the user. Therefore, how to detect memory devices in system-on-chip chips, which are prone to faults and attacks by hardware Trojans, is an urgent problem to be solved in the field of integrated circuit verification and testing technology.
[0046] Research shows that when the trigger circuit of the hardware Trojan is implanted in the cache, when a specific address in the cache is accessed N times, the hardware Trojan is activated and the confidential information in the critical memory is leaked. This hardware Trojan is specially designed and cannot be detected by the inherent security policy of the CPU. This type of attack can be detected by the read / write and then verify read and write technology.
[0047] The related technology lists various types of hardware Trojans in the memory, as well as their fault behaviors and triggering methods, and introduces the traditional March algorithm for detecting hardware Trojans in the memory, that is, in post-silicon testing, by sequentially writing 0, reading 0, writing 1, and reading 1 operations on certain units in the memory to determine whether there is a fault in the unit.
[0048] Memory faults can be divided into the concepts and implementation methods of static faults and dynamic faults, and different March algorithms are designed for detection according to the characteristics of the two faults. However, with the increase in the types of memory faults and the complexity of memory attacks, the detection efficiency and overhead of the post-silicon March algorithm will increase linearly with the increase in memory density and scale, and it is impossible to fully detect runtime faults and attacks in the memory. Therefore, the development of flexible runtime memory detection has gradually become a trend in memory detection.
[0049] You can also add marker bits to the data in the memory, formulate marker bit propagation rules, and detect memory corruption attacks by adding marker bit checks in the processor core.
[0050] At present, in chip memory detection technology, memory attacks and protection requirements are diverse. If only one granularity detection method is applied, errors may occur in the detection results for memories that require fine detection granularity. For memories that require coarse detection granularity, additional power consumption or performance overhead may be incurred on the system. If the system can flexibly configure the granularity of memory detection according to the attack level and protection requirements, a balance can be achieved between device security and performance overhead. In addition, a large number of faults or attacks use runtime conditions or device aging models to bypass traditional post-silicon testing. A runtime detection solution must be deployed to extend secure memory detection to the entire device life cycle.
[0051] The existing related memory detection mainly adopts the post-silicon testing method, which is unable to perform runtime detection, and the security policies contained in the architecture that supports runtime detection are mostly unable to be flexibly configured, which greatly limits the memory detection capability of the architecture. In addition, the efficiency and system overhead of conventional memory detection solutions will increase linearly with the growth of memory size, and the granularity cannot be flexibly selected according to protection needs and resource conditions. In order to achieve a compromise between security and performance, the technical solution of the present application is a multi-granularity memory detection solution based on Match C-sampling, which can realize multi-granularity memory detection according to the security policy content when the SoC is deployed and running, and determine whether the system memory has inherent faults or is attacked at runtime and causes failures.
[0052] Based on the above description, the technical solution of the embodiment of the present application mainly solves the problems related to low detection efficiency and high overhead of memory failures and runtime attacks in SoC chips. The technical solution of the present application provides a multi-granularity memory security detection solution based on a preset memory detection strategy. In view of the problem that the memory in the system-on-chip chip is prone to failure and attacks such as hardware Trojans, the memory module is separated to form multiple memory sub-modules. Based on the memory detection strategy and the granularity parameters, a multi-granularity memory unit sampling solution is provided to sample and detect the memory units in the memory sub-modules, which can improve the detection flexibility and balance the system overhead.
[0053] The technical solution of the present application can realize multi-granularity memory module detection by online configuration of the memory detection strategy and the granularity parameters, express and map the relationship between detection coverage, time complexity, etc. through strategy parameters, and flexibly balance detection efficiency and overhead.
[0054] In order to make the above-mentioned objects, features and advantages of the present application more obvious and easy to understand, the present application is further described in detail below in conjunction with the accompanying drawings and specific implementation methods.
[0055] like Figure 1 As shown, Figure 1A flow chart of a multi-granularity memory detection method provided in an embodiment of the present application is provided. When a Soc chip is running, the memory detection method is used to detect a memory module in the Soc chip. The memory module is divided into a plurality of memory sub-modules, and the memory sub-module includes a plurality of memory units. The memory detection method includes:
[0056] Step S11: When there is a new memory detection task, determine whether the memory detection condition is met.
[0057] Step S12: If yes, obtain the memory detection strategy and the corresponding configured granularity parameters.
[0058] If the memory detection condition is not met, after the timer waits for a certain period of time, it is confirmed again whether there is a new memory detection task.
[0059] Step S13: Based on the memory detection strategy and the granularity parameter, perform sampling detection on the memory units in the memory submodule.
[0060] In the memory detection method described in the embodiment of the present application, if Figure 1 As shown, the method for determining whether there is a new memory detection task includes:
[0061] Step S101: Scan the security policy engine.
[0062] Step S102: Based on the scanning result, determine whether there is a new memory detection task.
[0063] If the security policy engine obtains a trigger condition for triggering a new memory detection task, a flag bit indicating that a new memory detection task exists is generated. When the flag bit is detected, it indicates that a new memory detection task exists. If the flag bit cannot be detected, it indicates that there is no new memory detection task. If there is a new memory detection task, step S11 is executed. If there is no new memory detection task, subsequent system operations are completed normally.
[0064] In the memory detection method described in the embodiment of the present application, the method for determining whether the memory detection condition is met includes: determining whether the memory module is responding to the read and write operations of the bus; if so, the memory detection condition is met; otherwise, the memory detection condition is not met. It should be noted that the method for determining whether the memory detection condition is met includes but is not limited to the above method, and may also be other methods, such as determining whether the memory detection condition is met based on whether a detection instruction input by the user is received.
[0065] In the memory detection method of the embodiment of the present application, the method of dividing the memory module into a plurality of memory sub-modules includes: taking a storage space consistent with the bus width as a memory unit, taking n memory units as a memory sub-module, where n is a positive integer greater than 1. If the bus width is 23 bits, a 32-bit storage space is taken as a memory unit.
[0066] In the memory detection method of the embodiment of the present application, the method for obtaining the memory detection strategy and the corresponding configuration granularity parameters includes: obtaining the memory detection strategy and the granularity parameters from the security policy engine. Wherein, the memory detection strategy includes P granularity modes, the P granularity modes are sequentially from the 1st granularity mode to the Pth granularity mode, P is a positive integer greater than 1; the i-th granularity mode is randomly selected from each of the memory submodules The memory units are tested. If the memory units extracted from the memory submodule are all error-free, it means that the memory submodule is fault-free, i is a positive integer not greater than P; n is the number of the memory units in the memory submodule.
[0067] like Figure 2 As shown, Figure 2 A flow chart of a method for sampling and detecting the memory unit in the memory submodule provided in an embodiment of the present application, the method comprising:
[0068] Step S21: calculating the detection address range after the memory module is divided into a plurality of memory sub-modules.
[0069] Step S22: after randomly sampling the addresses of the memory cells to be detected in each of the memory submodules according to the granularity parameters, the memory cells to be detected are detected, and the detection results are recorded.
[0070] In the memory detection method described in the embodiment of the present application, after randomly sampling the address of the memory unit to be detected in each of the memory submodules, the memory unit to be detected is detected, and the method of recording the detection result is as follows: Figure 3 shown.
[0071] like Figure 3 As shown, Figure 3 A flow chart of a method for detecting a memory unit to be detected provided in an embodiment of the present application, the method comprising:
[0072] Step S31: after acquiring the address of the memory unit to be detected, backing up the memory data corresponding to the corresponding memory unit.
[0073] Step S32: After completing the memory data backup, the memory unit to be detected is detected.
[0074] Step S33: After completing the detection of the current memory unit to be detected, write back the backup memory data, record the detection result, and perform the detection of the next memory unit to be detected until all the memory units to be detected are detected.
[0075] like Figure 3 As shown, it also includes:
[0076] Step S34: after completing the detection of all the memory cells to be detected, a detection result report is generated.
[0077] In the memory detection method described in the embodiment of the present application, the specific detection process is a multi-granularity March algorithm based on sampling, and the detection granularity parameter is defined as the detection detail of the memory unit in the memory submodule, which is represented by the sampling rate. Detecting the memory unit is to perform March detection on the memory unit.
[0078] Among them, the March algorithm is a general memory fault detection algorithm. Compared with other memory fault detection algorithms, such as the scanning image method (memoryscan MSAN), the checkerboard algorithm (Checkboard), the galloping pattern algorithm (GALPAT), etc., the March algorithm has a more flexible test method and a higher fault coverage rate. The March algorithm writes different values to different memory cells and reads them out to compare with the expected values to determine whether there is a fault in the memory cell. Depending on the fault model in the memory, the writing and reading methods of the March algorithm are also different. The March algorithm has good scalability, so it has derived multiple versions of the March algorithm, including MATS, MATS+, MATS++, March X, MarchY, March C-, March A and other algorithms. Different versions of the March algorithm have different fault coverage rates for different fault models. Since the time complexity of the March C-algorithm is moderate, and it can detect multiple types of memory faults. Comprehensive considerations. Therefore, the March C-algorithm is selected as the memory detection algorithm in this patent.
[0079] Set the memory depth N to an integer multiple of n, based on the P-medium granularity mode defined in this application, as follows:
[0080] The first granularity mode: n memory cells in each memory submodule are extracted for March detection. If the extracted memory cells in the memory submodule are all free of errors, it indicates that the memory submodule is free of faults.
[0081] The second granularity mode: randomly extract n / 2 memory cells from each memory submodule to perform March detection. If all the memory cells extracted from the memory submodule are error-free, it indicates that the memory submodule is fault-free.
[0082] The third granularity mode: randomly extracting n / 4 memory cells from each memory submodule to perform March detection. If all the memory cells extracted from the memory submodule are error-free, it indicates that the memory submodule is fault-free.
[0083] The fourth granularity mode: randomly extract n / 8 memory cells from each memory submodule to perform March detection. If all the memory cells extracted from the memory submodule are error-free, it indicates that the memory submodule is fault-free.
[0084] …
[0085] Pth granularity mode: randomly extract from each memory submodule The memory units are subjected to March detection. If the memory units extracted from the memory submodule are all free of errors, it indicates that the memory submodule is free of faults.
[0086] From the above description, it can be seen that in various granularity modes, the granularity G is:
[0087]
[0088] The larger the granularity G is, the more detailed the detection is. Taking n=8 as an example, the granularities of the first granularity mode to the Pth granularity mode are shown in Table 1 below.
[0089] Table 1
[0090] Granularity Mode 1 Second Granularity Mode The third granularity mode The fourth granularity mode Granularity 1 0.5 0.25 0.125
[0091] The March C-algorithm is executed during the detection process, and the process is as follows:
[0092] The time complexity of the March C-algorithm is 10N, and it can detect AF, SAF (Stuck-at Fault), TF (Transition Fault), CFin (Inversion Coupling Fault), and CFid (idempotent Coupling Fault) contained in the memory module. The specific detection process of the algorithm is as follows:
[0093] ①(w0); ②↑(r0, w1); ③↑(r1, w0); ④↓(r0, w1); ⑤↓(r1, w0); ⑥↓(r0);
[0094] Among them, "w" represents a write operation; "r" represents a read operation. "w0" represents writing 0 to a memory cell; "w1" represents writing 1 to a memory cell; "r0" represents reading 0 from a memory cell; "r1" represents reading 1 from a memory cell. "↑" represents an operation from a low-address memory cell to a high-address memory cell; "↓" represents an operation from a high-address memory cell to a low-address memory cell.
[0095] Based on the above description, we can know that the actual meaning of operations ① to ⑥ of the March C-algorithm is:
[0096] ①↑(w0): operate from the low address to the high address of the memory cell, and write 0 in sequence;
[0097] ②↑(r0, w1): Operate from the low address of the memory cell to the high address, read the 0 written in the previous step, and then write 1;
[0098] ③↑(r1, w0): Operate from the low address of the memory cell to the high address, read the 1 written in the previous step, and then write 0;
[0099] ④↓(r0, w1): Operate from the high address of the memory cell to the low address, read the 0 written in the previous step, and then write 1;
[0100] ⑤↓(r1, w0): Operate from the high address of the memory cell to the low address, read the 1 written in the previous step, and then write 0;
[0101] ⑥↓(r0): Operate from the high address of the memory cell to the low address, and read the 0 written in the previous step in sequence;
[0102] Depending on the type of fault, the data read out during the operation will be different. Therefore, by executing this algorithm, memory faults can be detected and the types of memory faults can be distinguished.
[0103] As mentioned above, the memory depth is set to N, and taking the number of memory cells in each memory sub-module n=8 as an example, the comparison results of fault coverage, check coverage and algorithm complexity under different granularity modes are shown in Table 2 below.
[0104] Table 2
[0105] Fault Coverage Check coverage Algorithm complexity Granularity Mode 1 100％ 100％ 10N Second Granularity Mode 100％ 50％ 5N The third granularity mode 100％ 25％ 2.5N The fourth granularity mode 67％ 12.5％ 1.25N
[0106] During detection, different granularity changes can be configured in real time through security policies based on the fault coverage, coverage requirements and resource conditions to complete the corresponding memory checks.
[0107] Based on the above description, the specific execution process of the memory detection method described in this application can be as follows: Figure 4 As shown, Figure 4 A flowchart of another multi-granularity memory detection method provided in an embodiment of the present application.
[0108] From the above description, it can be seen that the present application provides a multi-granularity memory module security detection method based on a preset detection strategy, which can be used for the problem that the memory module in the system-on-chip chip is prone to failure and is attacked by hardware Trojans, etc. By configuring the detection strategy during the operation of the SoC, the memory module is divided into blocks, divided into multiple memory sub-modules, and the March-C algorithm with the required granularity sampling is executed on each memory sub-module to complete the runtime security detection in turn, and determine whether the system memory module has a fault or is attacked at runtime based on the algorithm results. The memory detection method described in the technical solution of this application can flexibly adapt to different memory detection needs and balance the overhead.
[0109] Based on the above embodiments, another embodiment of the present application further provides a memory device, such as Figure 5 As shown, Figure 5 A schematic diagram of the structure of a memory device provided in an embodiment of the present application, wherein the memory device can be based on an external security policy engine SPC, and the memory device 11 shown includes:
[0110] A memory module 12, wherein the memory module 12 is divided into a plurality of memory sub-modules, and the memory sub-modules include a plurality of memory units;
[0111] A control circuit 13, wherein the control circuit 13 is used to respond to the control of the security policy engine, execute the memory detection method described in the above embodiment, and detect the memory module 12;
[0112] The memory access gating module 14 is used to select and respond to an external bus request or a memory detection request of the security policy engine SPC, and is also used to back up the data taken out by the control circuit 13 from the memory unit to be detected when the memory module 12 is detected.
[0113] like Figure 5As shown, the memory access gating module 14 includes: a gating device Test_MUX, a gating device Reg_MUX, a first judging unit judge1, a second judging unit judge2 and a data register. The data register is connected to the gating device Reg_MUX through the port PORT10_REG. The first judging unit judge1 is connected to the gating device Test_MUX through the port PORT0_MEM, and is connected to the gating device Reg_MUX through the port PORT0_REG, and can respond to bus system access. The interface that responds to bus system access is also connected to the control circuit 13. The first judging unit judge1 is also connected to the port reg_runinto of the control circuit 13. The second judging unit judge2 is connected to the gating device Test_MUX through the port PORT1_MEM, and is connected to the gating device Reg_MUX through the port PORT1_REG, and can receive the security policy engine SPC detection and control signal. The interface that receives the security policy engine SPC detection and control signal is also connected to the control circuit 13. The gating device Test_MUX is connected to the memory module 12 and is also connected to the port test_now of the control circuit 13. The gating device Reg_MUX is connected to the port copy_remove of the control circuit 13. The control circuit 13 is connected with an address register.
[0114] The memory module includes the original one with AXI interface. The memory device 11 is controlled by the external security policy engine SPC for detection and feedback of the detection results to it, while retaining the original bus interface connected to AXI, which responds to the bus read and write requests of the original SoC system. The control circuit 13 is used to control the specific execution state of the memory detection, determine the detection and read and write conflicts, process redirection, etc. The functions of the memory access gating module 14 include selecting whether to respond to the external bus request or the memory detection request of the security policy engine SPC, and backing up the data of the unit to be tested. The specific method of memory detection during runtime is as follows: When a detection is started, the control circuit 13 takes out the data stored in the memory unit to be detected in the memory module 12 from the corresponding memory unit address, temporarily stores it in the data register of the memory access gating module 14, and then starts the detection. When the system bus is about to perform a read and write operation on the memory module 12, there are two operating conditions:
[0115] 1) When the object of the read / write operation is the memory unit being tested, the control circuit 13 redirects the read / write operation to the corresponding data register that has backed up the original data, and the memory unit being tested will continue to be tested by the security policy engine SPC. When the test is completed, the security policy engine SPC writes the value stored in the data register back to the memory unit that has completed the test, and outputs a flag signal to notify the memory device 11 to no longer redirect the read / write request of the system bus to the register.
[0116] 2) When the object of the read / write operation is not the memory unit being detected, the control circuit 13 will send a flag signal to the security policy engine SPC, interrupt the memory detection operation being executed and save the relevant state. Then the memory access gating module 14 responds to the read / write operation of the bus. When the read / write operation is completed, the security policy engine SPC continues the subsequent detection process, writes the value stored in the data register back to the memory unit that has completed the detection, and outputs a flag signal to notify the memory device 11 to no longer redirect the read / write request of the system bus to the register.
[0117] The memory device described in the embodiment of the present application can be used to implement the memory detection method described in the above embodiment. When performing memory detection, the memory module is divided into blocks and divided into multiple memory sub-modules. The March-C algorithm with the required granularity sampling is executed on each memory sub-module to complete the runtime security detection in turn. According to the algorithm result, it is determined whether the system memory module has a fault or is subject to a runtime attack. The memory detection method described in the technical solution of the present application can flexibly adapt to different memory detection requirements and balance the overhead.
[0118] Based on the above embodiment, another embodiment of the present application further provides an electronic device, wherein the electronic device includes the memory device described in the above embodiment. The electronic device includes but is not limited to electronic devices such as computers, smart phones, and wearable devices.
[0119] The electronic device has the memory device described in the above embodiment, divides the memory module into blocks, divides it into multiple memory sub-modules, executes the March-C algorithm with the required granularity sampling on each memory sub-module, completes the runtime security detection in turn, and determines whether the system memory module has a fault or is attacked at runtime based on the algorithm result. The memory detection method described in the technical solution of this application can flexibly adapt to different memory detection requirements and balance the overhead.
[0120] In this specification, each embodiment is described in a progressive, parallel, or progressive and parallel manner. Each embodiment focuses on the differences from other embodiments, and the same or similar parts between the embodiments can be referred to each other. For the electronic device and memory device disclosed in the embodiment, since they correspond to the memory detection method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the relevant part of the memory detection method.
[0121] It should be noted that in the description of the present application, it should be understood that the terms "upper", "lower", "top", "bottom", "inside", "outside" and the like indicate positions or positional relationships based on the positions or positional relationships shown in the drawings, which are only for the convenience of describing the present application and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore cannot be understood as a limitation on the present application. When a component is considered to be "connected" to another component, it may be directly connected to the other component or there may be a centrally arranged component at the same time.
[0122] It should also be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "comprises", "comprising" or any other variants thereof are intended to cover non-exclusive inclusion, so that an article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such article or device. In the absence of further restrictions, the elements defined by the sentence "comprising a ..." do not exclude the existence of other identical elements in the article or device including the above elements.
[0123] The above description of the disclosed embodiments enables those skilled in the art to implement or use the present application. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present application. Therefore, the present application will not be limited to the embodiments shown herein, but will conform to the widest scope consistent with the principles and novel features disclosed herein.
Claims
1. A multi-granularity memory detection method, characterized in that: When the Soc chip is running, the memory detection method is used to detect the memory module in the Soc chip, the memory module is divided into multiple memory sub-modules, and the memory sub-module includes multiple memory units; The memory detection method comprises: When there is a new memory detection task, determine whether the memory detection condition is met; If yes, obtain the memory detection strategy and the corresponding configured granularity parameters, including: obtaining the memory detection strategy and the granularity parameters from the security policy engine; wherein the memory detection strategy includes P granularity modes, the P granularity modes are sequentially the 1st granularity mode to the Pth granularity mode, P is a positive integer greater than 1; the i-th granularity mode is randomly selected from each of the memory submodules The memory units are tested. If the memory units extracted from the memory submodule are all free of errors, it indicates that the memory submodule is free of faults, i is a positive integer not greater than P; n is the number of the memory units in the memory submodule; Based on the memory detection strategy and the granularity parameter, the memory units in the memory sub-module are sampled and detected; wherein the detection process performs a sampling-based multi-granularity March algorithm, and the detection granularity parameter is defined as the degree of detection detail of the memory units in the memory sub-module, which is represented by the sampling rate; and the detection of the memory units is to perform March detection on the memory units.
2. The memory detection method according to claim 1, characterized in that: Methods for determining whether there is a new memory detection task include: Scan security policy engine; Based on the scanning result, it is determined whether there is a new memory detection task.
3. The memory detection method according to claim 2, characterized in that: If the security policy engine obtains a trigger condition for triggering a new memory detection task, a flag bit indicating that there is a new memory detection task is generated.
4. The memory detection method according to claim 1, characterized in that: Methods for determining whether the memory detection condition is met include: Determining whether the memory module is responding to a read or write operation of the bus; If so, the memory detection condition is met.
5. The memory detection method according to claim 1, characterized in that: The method for dividing the memory module into a plurality of memory sub-modules comprises: A storage space consistent with the bus bit width is used as a memory unit, and n memory units are used as a memory sub-module, where n is a positive integer greater than 1.
6. The memory detection method according to any one of claims 1 to 5, characterized in that: The method for sampling and detecting the memory unit in the memory submodule includes: Calculating a detection address range after the memory module is divided into a plurality of memory sub-modules; After randomly sampling the addresses of the memory units to be detected in each of the memory submodules according to the granularity parameters, the memory units to be detected are detected and the detection results are recorded.
7. The memory detection method according to claim 6, characterized in that: After randomly sampling the addresses of the memory cells to be detected in each of the memory submodules, the memory cells to be detected are detected, and the detection results are recorded, including: After obtaining the address of the memory unit to be detected, backing up the memory data corresponding to the corresponding memory unit; After completing the memory data backup, testing the memory unit to be tested; After the detection of the current memory unit to be detected is completed, the backup memory data is written back, and the detection result is recorded, and the detection of the next memory unit to be detected is performed until all the memory units to be detected are detected.
8. The memory detection method according to claim 7, characterized in that: Also includes: After completing the detection of all the memory units to be detected, a detection result report is generated.
9. A memory device, characterized in that: The memory device can be based on an external security policy engine, and the memory device includes: A memory module, wherein the memory module is divided into a plurality of memory sub-modules, and the memory sub-modules include a plurality of memory units; A control circuit, wherein the control circuit is used to respond to the control of the security policy engine, execute the memory detection method according to any one of claims 1 to 8, and detect the memory module; A memory access gating module is used to select and respond to an external bus request or a memory detection request of the security policy engine, and is also used to back up the data taken out by the control circuit from the memory unit to be detected when detecting the memory module.
10. An electronic device, characterized in that: The electronic device comprises the memory device as claimed in claim 9.