A secure access method, integrated circuit and computer readable storage medium

Abstract

The present invention discloses a security access method, an integrated circuit and a computer-readable storage medium. The method includes: obtaining a security flag signal and a slave identification information of a current access event; then, determining the target slave module to be accessed and the security attributes of the target slave module according to the slave identification information; finally, judging whether the security attributes of the target slave module meet the security attribute requirements of the current access event according to the security flag signal, and generating a security interrupt event if the security attributes of the target slave do not meet the security attribute requirements of the current access event. A more effective slave security access control scheme is implemented, which improves the individual security access control capability of each device on the bus and enhances the security protection strength of its key sensitive data.

Description

Technical Field

[0001] The present invention relates to the field of communication technology, and in particular to a secure access method, an integrated circuit and a computer-readable storage medium. Background Art

[0002] In existing MCU (Microcontroller Unit) / SOC (System on Chip) application scenarios, key sensitive data needs to be protected for the purpose of information confidentiality and preventing hacker attacks. For example, in scenarios such as biometric information collection systems, vehicle-mounted electronic systems, and industrial control systems, each device under the system needs to be individually and effectively controlled for security access. However, in existing MCU / SOC products, security access control can only be performed on the entire APB bus and all peripheral devices under the APB bus through security gating from the AHB (Advanced high-performance bus) to the APB (Advanced peripheral bus), but individual security access control cannot be performed on individual devices on the APB bus.

[0003] Therefore, it can be seen that the security access control scheme of MCU / SOC for downstream peripheral devices in the prior art has technical defects of poor security and low flexibility. Summary of the invention

[0004] In order to solve the above technical defects in the prior art, the present invention proposes a secure access method, which includes:

[0005] Obtain the security flag signal of the current access event and the slave identity information;

[0006] Determine the target slave module to be accessed and the security attribute of the target slave module according to the slave identity information;

[0007] It is determined whether the security attribute of the target slave module meets the security attribute requirement of the current access event according to the security flag signal; if the security attribute of the target slave module does not meet the security attribute requirement of the current access event, a security interrupt event is generated.

[0008] Optionally, before obtaining the security mark signal of the current access event and the slave identity information, the method further includes:

[0009] The security attribute of at least one preset slave module is set, wherein the at least one preset slave module includes the target slave module.

[0010] Optionally, the setting of the security attribute of at least one preset slave module includes:

[0011] In the secure and privileged mode, security attribute data is written to the at least one preset slave module, where the security attribute data is used to define a security attribute of the at least one preset slave module.

[0012] Optionally, the setting of the security attribute of at least one preset slave module includes:

[0013] A code option related to the security attribute is extracted from the flash memory, and the security attribute of the at least one preset slave module is set according to the code option.

[0014] Optionally, judging whether the security attribute of the target slave module meets the security attribute requirement of the current access event according to the security flag signal includes:

[0015] Determine whether the current access event is a secure access event or a non-secure access event according to the security flag signal;

[0016] When the current access event is a non-secure access event and the security attribute of the target slave module is secure, determining that the security attribute of the target slave module does not meet the security attribute requirement of the current access event;

[0017] When the current access event is a non-secure access event and the security attribute of the target slave module is non-secure, determining that the security attribute of the target slave module meets the security attribute requirement of the current access event;

[0018] When the current access event is a secure access event and the security attribute of the target slave module is secure, determining that the security attribute of the target slave module meets the security attribute requirement of the current access event;

[0019] When the current access event is a secure access event and the security attribute of the target slave module is non-secure, it is determined that the security attribute of the target slave module does not meet the security attribute requirement of the current access event.

[0020] Optionally, when the security attribute of the target slave module does not meet the security attribute requirement of the current access event, the method further includes:

[0021] Generate error data;

[0022] The error data is transmitted to a preset host module, wherein the preset host module is connected to the target slave module via a bus bridge.

[0023] The present invention also proposes an integrated circuit, which includes a first bus, a second bus and a bus bridge for connecting the first bus and the second bus, wherein the first bus is connected to a processor and a memory, the memory stores a computer program that can be run on the processor, and the second bus is connected to at least one slave module, characterized in that when the processor executes the computer program, the steps of the security access method described in any one of the above items are implemented.

[0024] Optionally, the processor includes a slave security attribute control circuit, wherein the slave security attribute control circuit includes at least a first multiplexer, and an output end of the first multiplexer is used to connect a register of the at least one slave module;

[0025] The input end of the first multiplexer is used to input security attribute data, and the first multiplexer is used to write the security attribute data into the register of the at least one slave module to set the security attribute of the at least one preset slave module;

[0026] Alternatively, the input end of the first multiplexer is used to connect to a flash memory and obtain a code option related to the security attribute from the flash memory, and the first multiplexer is used to write the code option into a register of the at least one slave module to set the security attribute of the at least one preset slave module.

[0027] Optionally, the processor includes a slave safety event interrupt circuit, wherein the slave safety event interrupt circuit includes an XOR gate circuit, a first multi-input AND gate circuit, a second multi-input AND gate circuit and a second multiplexer;

[0028] The XOR gate circuit, the first multi-input AND gate circuit and the second multi-input AND gate circuit are connected in series in sequence, and the second multiplexer is connected between the first multi-input AND gate circuit and the second multi-input AND gate circuit, wherein one input end of the XOR gate circuit is used to input the instruction of the security flag signal of the current access event, and the other input end of the XOR gate circuit is used to input the security attribute data of the target slave module. When the security attribute of the target slave module does not meet the security attribute requirements of the current access event, the XOR gate circuit outputs a high level, triggering the first multi-input AND gate circuit to generate a security interrupt event, and triggering the second multi-input AND gate circuit to generate a security interrupt signal through the security interrupt event.

[0029] Optionally, the processor further includes a slave error reporting circuit, wherein the slave error reporting circuit includes a third multi-input AND gate circuit, a third multiplexer, a fourth multiplexer, a fifth multiplexer, a first register, and a second register;

[0030] The input end of the third multi-input AND gate circuit is used to input a slave selection signal and a slave selection signal, and the output end of the third multi-input AND gate circuit is connected to the selection end of the fourth multiplexer;

[0031] One input end of the fourth multiplexer is connected to the output end of the third multiplexer, another input end of the fourth multiplexer is used to input a first level signal, the output end of the fourth selector is connected to the input end of the first register, the output end of the first register is respectively connected to one input end of the third multiplexer and the selection end of the fifth multiplexer, and another input end of the third multiplexer is used to input a second level signal;

[0032] The selection end of the third multiplexer and an input end of the fifth multiplexer are respectively used to input the security event, another input end of the fifth multiplexer is used to input the second level signal, the output end of the fifth multiplexer is connected to the input end of the second register, the output end of the second register is used to output error data, and the clock input end of the second register is connected to the clock input end of the first register.

[0033] The present invention also proposes a computer-readable storage medium, characterized in that a security access program is stored on the computer-readable storage medium, and when the security access program is executed by a processor, the steps of the security access method as described in any one of the above items are implemented.

[0034] The beneficial effect of the present invention is that by obtaining the security flag signal and slave identification information of the current access event; then, determining the target slave module to be accessed and the security attribute of the target slave module according to the slave identification information; finally, judging whether the security attribute of the target slave module meets the security attribute requirements of the current access event according to the security flag signal, if the security attribute of the target slave does not meet the security attribute requirements of the current access event, a security interrupt event is generated. A more effective slave security access control scheme is implemented, which improves the individual security access control capability of each device on the bus and enhances the security protection strength of its key sensitive data. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] The present invention will be further described below with reference to the accompanying drawings and embodiments, in which:

[0036] Figure 1 is a flowchart of a secure access method according to an embodiment of the present invention;

[0037] Figure 2 is a structural block diagram of a secure access system according to an embodiment of the present invention;

[0038] Figure 3 A circuit diagram for setting security attributes of a slave module provided by an embodiment of the present invention;

[0039] Figure 4 is another circuit diagram for setting security attributes of a slave module provided by an embodiment of the present invention;

[0040] Figure 5 This is a slave safety event interrupt circuit diagram provided by an embodiment of the present invention;

[0041] Figure 6 This is a slave error reporting circuit diagram provided by an embodiment of the present invention;

[0042] Figure 7 This is a slave error reporting timing diagram provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0043] It should be understood that the specific embodiments described herein are only used to explain the present invention, and are not used to limit the present invention.

[0044] In the subsequent description, the suffixes such as "module", "component" or "unit" used to represent elements are only used to facilitate the description of the present invention, and have no specific meanings. Therefore, "module", "component" or "unit" can be used in a mixed manner.

[0045] Figure 1 1 is a flow chart of an embodiment of a secure access method of the present invention. In this embodiment, a secure access method is proposed, and the method includes the following steps:

[0046] S1, obtaining the security sign signal of the current access event and the slave identity information;

[0047] S2. Determine the target slave module to be accessed and the security attribute of the target slave module according to the slave identity information;

[0048] S3. Determine whether the security attribute of the target slave module meets the security attribute requirement of the current access event according to the security flag signal; if the security attribute of the target slave module does not meet the security attribute requirement of the current access event, generate a security interrupt event.

[0049] It should be noted that the security access method proposed in this embodiment is applicable to existing integrated circuits such as MCU (Microcontroller Unit) or SOC (System on Chip) or SIP (System in a Package). For example, the security access method is applied to the main control chip of application scenarios such as biological information acquisition system, vehicle-mounted electronic system, or industrial control system. Specifically, considering the security protection requirements for key sensitive data, the security access method proposed in this embodiment is mainly applicable to the security access control of APB (Advanced Peripheral Bus) slaves in each integrated circuit, wherein the APB slaves in this embodiment include but are not limited to ADC (nalog to digital converter), DAC (digital to nalog converter), UART (Universal Asynchronous Receiver / Transmitte), SPI (Serial Peripheral Interface), I2C (Inter-Integrated Circuit, two-wire synchronous serial bus), timer and other functional modules.

[0050] Optionally, the security access method proposed in this embodiment is also applicable to MCU or SOC chips developed based on a CPU (central processing unit) and AHB5 (Advanced High Performance Bus) bus with TrustZone (a system-wide security method for the ARM platform) or similar trusted execution environment functions.

[0051] In one embodiment, reference Figure 2The structural block diagram of the security access system of one embodiment of the present invention is shown. In this embodiment, the CPU and multiple AHB hosts connect multiple AHB slaves and multiple AHB-APB bridges through the AHB5 bus matrix; in this embodiment, the AHB-APB bridge is used to realize the bridge between the AHB5 bus matrix and the APB bus, so that multiple APB slaves can be connected to the CPU and each AHB host through the APB bus, the AHB-APB bridge and the AHB5 bus matrix in sequence. It can be seen that, unlike the solution in the prior art that only performs security access control on the entire APB bus and all peripheral devices under the APB bus through the security gating of the AHB-APB bridge, this embodiment performs independent security access control on each device at the lower end of the APB bus.

[0052] In a specific embodiment, when the CPU or AHB host initiates a read or write access to an APB slave, the security flag signal HNONSEC of the read or write access event is transmitted to the APB slave under each bridge module through multiple AHB-APB bridges, and the security attribute of each access of the APB slave by the AHB host is determined in combination with the APB slave selection signal PSEL generated by the AHB-APB bridge. At the same time, the security attribute register of the APB slave represents the security attribute of the APB slave. If it is determined that the security attribute of the instruction obtained by the CPU or AHB host is inconsistent with the security attribute of the APB slave being accessed, a security interrupt event is generated and can be selectively reported to the CPU, and an APB bus error signal is generated. At this time, the values ​​read by the APB bus are all 0. In this way, the CPU and the AHB host are prevented from illegally accessing each APB slave, and the security protection of each APB slave is effectively achieved. The beneficial effect of this embodiment is that the security flag signal of the read and write access event is transmitted to the APB slave under each bridge module through the AHB-APB bridge, and combined with the APB slave selection signal PSEL generated by the AHB-APB bridge, the security attribute of each access of the AHB host to the APB slave is judged, thereby realizing independent security access control of each APB slave by the AHB host. On the one hand, the accuracy of the AHB host's security access control over the APB slave is improved. On the other hand, when security access control is performed on a single APB slave, it is avoided to affect the security access control of other APB slaves, thereby improving the execution efficiency of security access control.

[0053] In one embodiment, before obtaining the security flag signal of the current access event and the slave identity information, the method further includes: setting the security attribute of at least one preset slave module, wherein the security attribute preset methods of the slave module include two methods, one is to change the security attribute register of the slave module through instructions of the secure and privileged mode, and the other is to change the security attribute register of the slave module through code option mapping from the flash memory. In this embodiment, the at least one preset slave module includes a target slave module.

[0054] In one embodiment, the security attribute of at least one preset slave module is set, wherein a method is to write security attribute data to the at least one preset slave module in a secure and privileged mode, wherein the security attribute data is used to define the security attribute of the at least one preset slave module. It is understandable that, according to actual security control requirements, in the secure and privileged mode, corresponding security attribute data is written to each APB slave, thereby facilitating the AHB host to independently perform security access control on each APB slave.

[0055] In one embodiment, the security attributes of at least one preset slave module are set, wherein another method is to extract code options related to the security attributes in the flash memory, and set the security attributes of the at least one preset slave module according to the code options. Similarly, it can be understood that the code options related to the security attributes of each APB slave are extracted in the flash memory, and the security attributes of each APB slave are set according to each code option, so as to facilitate the AHB host to independently perform security access control on each APB slave. Optionally, in the process of setting security attributes for multiple APB slaves, one or both of the above two security attribute setting methods are used to set the security attributes of each APB slave; optionally, the corresponding security attribute setting method is determined according to the functional type of the APB slave; optionally, the security attribute setting method of each APB slave under it is determined according to the security access control requirements of the AHB host.

[0056] It should be noted that, in one embodiment, the TrustZone of the CPU is used to define the security attributes of the AHB host. Every time the CPU or AHB host initiates an APB slave access, it drives the HNONSEC signal of the AHB5 bus at the same time. As an example, when the HNONSEC signal is '1', it indicates a non-secure access, and when the HNONSEC signal is '0', it indicates a secure access. It should also be noted that the HPROT[1] signal of the AHB5 bus represents the privileged mode ('1') and the non-privileged mode ('0'). After passing through the AHB-APB bridge, HNONSEC and HPROT[1] correspond to PPROT[1] and PPROT[0] of the APB bus respectively. Since HNONSEC and HPROT[1] are both address phase signals, the logic of the AHB-APB bridge remains consistent with other bus control signals.

[0057] Specifically, based on the above control mechanism, the above two methods for setting the security attributes of the slave module are respectively described below in combination with two circuit diagrams.

[0058] Figure 3 This is a circuit diagram for setting the security attributes of a slave module provided by an embodiment of the present invention, which can be used to set the security attributes of a slave module. The slave security attribute control circuit shown in the figure includes at least a first multiplexer 10, the output end of the first multiplexer 10 is used to connect to the register 43 of the at least one slave module; the input end of the first multiplexer 10 is used to input security attribute data PWDATA, and the first multiplexer 10 is used to write the security attribute data into the register 43 of the at least one slave module to set the security attributes of the at least one preset slave module.

[0059] Based on the above circuit structure, a first method for setting the security attribute of the slave module is proposed, which is changed by the write instruction of the CPU's secure and privileged mode. For example, the write instruction is transmitted through the AHB5 bus, the AHB-APB bridge and the APB bus, and the write instruction is used to change the security attribute SEC of the APB slave inside the APB slave. Specifically, the control end of the first multiplexer 10 can be connected to a multi-input AND gate circuit. When the APB slave selection signal PSEL, the APB slave read-write signal PWRITE, the APB slave selection signal PENABLE, and the APB slave definition signal PPROT[0] connected to the input end of the multi-input AND gate circuit are all '1' and PPROT[1] is '0', it represents a secure and privileged mode write operation. At this time, the output of the multi-input AND gate circuit is '1', and the register of the APB slave module (also called "APB slave security attribute register SEC") locks the write data PWDATA (security attribute data in this embodiment) of the APB bus in SEC, thereby realizing the change of the security attribute of the APB slave.

[0060] Figure 4 Another circuit diagram for setting the security attribute of a slave module provided by an embodiment of the present invention can also be used to set the security attribute of a slave module. The input end of the first multiplexer 10 is used to connect to a flash memory and obtain a code option related to the security attribute from the flash memory, and the first multiplexer 10 is used to write the code option into the register 43 of the at least one slave module to set the security attribute of the at least one preset slave module.

[0061] Based on the above circuit structure, a second method for setting the security attributes of the slave module is proposed, and the APB slave security attributes are changed by mapping the code options. The control end of the first multiplexer 10 is connected to the mapping control module. First, the mapping control module generates a single mapping pulse after the system is powered on, and then latches the code options related to the APB slave security attributes in the flash memory into the register of the APB slave module. It should be noted that if the code options are to be modified, a series of decryption processes are required and can only be performed in the security privilege mode, thereby ensuring the security and flexibility of the MCU / SOC chip during secondary development.

[0062] After completing the setting of the security attributes of the slave module based on one of the above two methods, the security attributes of the APB slave are determined by the value of the register of the APB slave module. Specifically, when the value of the register of the APB slave module is '0', it indicates that the APB slave has a security attribute. At this time, only security instructions can read and write access; and when the value of the register of the APB slave module is '1', it indicates that the APB slave has a non-security attribute. At this time, only non-security instructions can read and write access.

[0063] In one embodiment, after the security attributes of the slave module are identified, it is determined whether the security attributes of the target slave module meet the security attribute requirements of the current access event based on the security flag signal, wherein the current access event is determined to be a secure access event or a non-secure access event based on the security flag signal.

[0064] Specifically, judging whether the security attribute of the target slave module meets the security attribute requirement of the current access event is divided into the following four situations:

[0065] Scenario 1: when the current access event is a non-secure access event and the security attribute of the target slave module is secure, it is determined that the security attribute of the target slave does not meet the security attribute requirement of the current access event;

[0066] Scenario 2: when the current access event is a non-secure access event and the security attribute of the target slave module is non-secure, it is determined that the security attribute of the target slave module meets the security attribute requirement of the current access event;

[0067] Scenario three: when the current access event is a secure access event and the security attribute of the target slave module is secure, it is determined that the security attribute of the target slave module meets the security attribute requirement of the current access event;

[0068] Scenario 4: when the current access event is a secure access event and the security attribute of the target slave module is non-secure, it is determined that the security attribute of the target slave module does not meet the security attribute requirement of the current access event.

[0069] The beneficial effect of this embodiment is that it determines whether the security attributes of each target slave module meet the security attribute requirements of the current access event through the security flag signal, realizes differentiated security access control of each target slave module, associates each target slave module with its access event, and improves the control efficiency and accuracy of each access event.

[0070] Specifically, refer to Figure 5 The slave security event interrupt circuit diagram provided by an embodiment of the present invention is shown, which can be used to generate a security interrupt signal. The slave security event interrupt circuit includes an XOR gate circuit 20, a first multi-input AND gate circuit 30, a second multi-input AND gate circuit 31 and a second multiplexer 11; the XOR gate circuit 20, the first multi-input AND gate circuit 30 and the second multi-input AND gate circuit 31 are connected in series in sequence, and the second multiplexer 11 is connected between the first multi-input AND gate circuit 30 and the second multi-input AND gate circuit 31, wherein one input end of the XOR gate circuit 20 is used to input the instruction PPROT of the security flag signal of the current access event, and the other input end of the XOR gate circuit 20 is used to input the security attribute data of the target slave module (that is, the data stored in the slave security attribute register SEC), when the security attribute of the target slave module does not meet the security attribute requirements of the current access event, the XOR gate circuit 20 outputs a high level, triggering the first multi-input AND gate circuit 30 to generate a security interrupt event SEC_EVENT, and triggering the second multi-input AND gate circuit 31 to generate a security interrupt signal SEC_INT through the security interrupt event.

[0071] Specifically, in combination with the above four determinations, the following respectively describes whether a security interrupt is generated and error data is generated:

[0072] In case 1, when a non-secure instruction (PPROT[1] is '1') performs read and write access to the secure APB slave (SEC is '0'), the value read by the APB slave is all '0' and a security event SEC_EVENT is generated. By setting the security event interrupt enable signal SEC_IE, a security interrupt SEC_INT is generated and reported to the CPU.

[0073] In the second scenario, when a non-secure instruction (PPROT[1] is '1') performs read and write access to an APB slave with non-secure attributes (SEC is '1'), the access is executed normally and no security event SEC_EVENT is generated;

[0074] Scenario 3: When the security instruction (PPROT[1] is '0') performs read and write access to the APB slave with non-security attributes (SEC is '1'), the value read by the APB slave is all '0' and a security event SEC_EVENT is generated. By setting the security event interrupt enable signal SEC_IE, the security interrupt SEC_INT is generated and reported to the CPU.

[0075] In case 4, when the security instruction (PPROT[1] is '0') performs read and write access to the APB slave with security attributes (SEC is '0'), the access is executed normally and the security event SEC_EVENT is not generated.

[0076] In one embodiment, when the security attribute of the target slave module does not meet the security attribute requirements of the current access event, error data is generated, and at the same time, the error data is transmitted to the preset host module, wherein the preset host module is connected to the target slave module via a bus bridge. The beneficial effect of this embodiment is that by judging whether the security attribute of each target slave module meets the security attribute requirements of the current access event through a security flag signal, and determining whether to generate a security event based on the compliance, differentiated security access control of each target slave module is achieved, each target slave module is associated with its access event, and the control efficiency and accuracy of each access event are improved.

[0077] In one embodiment, Figure 6 The slave error reporting circuit diagram provided by an embodiment of the present invention is shown, which can be used to generate an error signal. The slave error reporting circuit includes a third multi-input AND gate circuit 33, a third multiplexer 13, a fourth multiplexer 14, a fifth multiplexer 15, a first register 41 and a second register 42, wherein:

[0078] The input end of the third multi-input AND gate circuit 33 is used to input the slave selection signal PSEL and the slave enable signal PENABLE, and the output end of the third multi-input AND gate circuit 33 is connected to the selection end of the fourth multiplexer;

[0079] One input end of the fourth multiplexer 14 is connected to the output end of the third multiplexer 13, the other input end of the fourth multiplexer 14 is used to input a first level signal, the output end of the fourth multiplexer 14 is connected to the input end of the first register 41, the output end of the first register 41 is respectively connected to one input end of the third multiplexer 13 and the selection end of the fifth multiplexer 15, and the other input end of the third multiplexer 13 is used to input a second level signal, wherein the first level signal is 1 and the second level signal is 0;

[0080] The selection end of the third multiplexer 13 and an input end of the fifth multiplexer 15 are respectively used to input the security event SEC_EVENT, the other input end of the fifth multiplexer 15 is used to input the second level signal, the output end of the fifth multiplexer 15 is connected to the input end of the second register 42, the output end of the second register 42 is used to output error data, the clock input end of the second register 42 is connected to the clock input end of the first register 41, wherein the second level signal is 0.

[0081] In one embodiment, reference Figure 7 The slave error timing diagram provided by one embodiment of the present invention is shown. In the timing diagram, from top to bottom, the PCLK (bus clock) waveform, PADDR (APB address bus) waveform, PSEL (secondary decoding signal of the AHB-APB bridge) waveform, PENABLE (the second clock cycle of an APB transmission) waveform, PREADY (extended APB transmission) waveform, PSLVERR (transmission failure) waveform, and SEC_EVENT (security event) waveform are depicted respectively. Among them, the generation of the security event SEC_EVENT will also cause an APB bus error. At the same time, the security event SEC_EVENT will pull down the PREADY of the APB bus in the second cycle of the read and write access to the APB slave, and pull up the PSLVERR of the APB bus in the third cycle. It can be seen that Figure 6 The waveform characteristics shown are consistent with the error reporting timing of the APB bus protocol. The APB bus errors will be reported to the CPU and AHB host step by step through the AHB-APB bridge.

[0082] The beneficial effect of this embodiment is that by obtaining the security flag signal and slave identification information of the current access event; then, determining the target slave module to be accessed and the security attributes of the target slave module according to the slave identification information; finally, judging whether the security attributes of the target slave module meet the security attribute requirements of the current access event according to the security flag signal, if the security attributes of the target slave do not meet the security attribute requirements of the current access event, a security interrupt event is generated. A more effective slave security access control scheme is implemented, which improves the individual security access control capability of each device on the bus and enhances the security protection strength of its key sensitive data.

[0083] In one embodiment, the present invention also proposes an integrated circuit, which includes a first bus, a second bus and a bus bridge for connecting the first bus and the second bus, the first bus is connected to a processor and a memory, the memory stores a computer program that can be run on the processor, the second bus is connected to at least one slave module, and the processor implements the steps of the security access method described in any one of the above items when executing the computer program.

[0084] Optionally, the integrated circuit may be an MCU, a SOC, a SIP or other integrated circuits.

[0085] Figure 3 The invention is a circuit diagram for setting the security attribute of a slave module according to an embodiment of the security access method of the present invention. The slave security attribute control circuit of the integrated circuit comprises at least a first multiplexer 10, the output end of the first multiplexer 10 is used to connect the register 43 of the at least one slave module; the input end of the first multiplexer 10 is used to input security attribute data PWDATA, and the first multiplexer 10 is used to write the security attribute data into the register 43 of the at least one slave module to set the security attribute of the at least one preset slave module.

[0086] In the integrated circuit, based on the above circuit structure, a first method for setting the security attribute of the slave module is proposed, which is changed by the write instruction of the CPU's security and privileged mode. For example, the write instruction is transmitted through the AHB5 bus, the AHB-APB bridge and the APB bus, and the write instruction is used to change the security attribute SEC of the APB slave inside the APB slave. Specifically, the control end of the first multiplexer 10 can be connected to a multi-input AND gate circuit. When the APB slave selection signal PSEL, the APB slave read-write signal PWRITE, the APB slave selection signal PENABLE, and the APB slave definition signal PPROT[0] connected to the input end of the multi-input AND gate circuit are all '1' and PPROT[1] is '0', it represents a write operation in a secure and privileged mode. At this time, the output of the multi-input AND gate circuit is '1', and the register of the APB slave module (also called "APB slave security attribute register SEC") locks the write data PWDATA (security attribute data in this embodiment) of the APB bus in SEC, thereby realizing the change of the security attribute of the APB slave.

[0087] like Figure 4 As shown, in the integrated circuit, the input end of the first multiplexer 10 is used to connect to the flash memory and obtain the code option related to the security attribute from the flash memory, and the first multiplexer 10 is used to write the code option into the register 43 of the at least one slave module to set the security attribute of the at least one preset slave module.

[0088] In this integrated circuit, based on the above circuit structure, a second method for setting the security attributes of the slave module is proposed, and the APB slave security attributes are changed by mapping the code options. The control end of the first multiplexer 10 is connected to the mapping control module. First, the mapping control module generates a single mapping pulse after the system is powered on, and then latches the code options related to the APB slave security attributes in the flash memory into the register of the APB slave module. It should be noted that if the code options are to be modified, a series of decryption processes are required and can only be performed in the security privilege mode, thereby ensuring the security and flexibility of the MCU / SOC chip during secondary development.

[0089] In this integrated circuit, after the setting of the security attributes of the slave module is completed based on one of the above two methods, the security attributes of the APB slave are determined by the value of the register of the APB slave module. Specifically, when the value of the register of the APB slave module is '0', it means that the APB slave has a security attribute, and at this time, only security instructions can read and write access; and when the value of the register of the APB slave module is '1', it means that the APB slave has a non-security attribute, and at this time, only non-security instructions can read and write access.

[0090] In one embodiment, after the security attributes of the slave module are identified, it is determined whether the security attributes of the target slave module meet the security attribute requirements of the current access event based on the security flag signal, wherein the current access event is determined to be a secure access event or a non-secure access event based on the security flag signal.

[0091] Specifically, judging whether the security attribute of the target slave module meets the security attribute requirement of the current access event is divided into the following four situations:

[0092] Scenario 1: when the current access event is a non-secure access event and the security attribute of the target slave module is secure, it is determined that the security attribute of the target slave does not meet the security attribute requirement of the current access event;

[0093] Scenario 2: when the current access event is a non-secure access event and the security attribute of the target slave module is non-secure, it is determined that the security attribute of the target slave module meets the security attribute requirement of the current access event;

[0094] Scenario three: when the current access event is a secure access event and the security attribute of the target slave module is secure, it is determined that the security attribute of the target slave module meets the security attribute requirement of the current access event;

[0095] Scenario 4: when the current access event is a secure access event and the security attribute of the target slave module is non-secure, it is determined that the security attribute of the target slave module does not meet the security attribute requirement of the current access event.

[0096] The beneficial effect of this embodiment is that it determines whether the security attributes of each target slave module meet the security attribute requirements of the current access event through the security flag signal, realizes differentiated security access control of each target slave module, associates each target slave module with its access event, and improves the control efficiency and accuracy of each access event.

[0097] like Figure 5As shown, in the integrated circuit, the slave security event interrupt circuit includes an XOR gate circuit 20, a first multi-input AND gate circuit 30, a second multi-input AND gate circuit 31 and a second multiplexer 11; the XOR gate circuit 20, the first multi-input AND gate circuit 30 and the second multi-input AND gate circuit 31 are connected in series in sequence, and the second multiplexer 11 is connected between the first multi-input AND gate circuit 30 and the second multi-input AND gate circuit 31, wherein one input end of the XOR gate circuit 20 is used to input the instruction PPROT of the security flag signal of the current access event, and the other input end of the XOR gate circuit 20 is used to input the security attribute data of the target slave module (that is, the data stored in the slave security attribute register SEC). When the security attribute of the target slave module does not meet the security attribute requirements of the current access event, the XOR gate circuit 20 outputs a high level, triggering the first multi-input AND gate circuit 30 to generate a security interrupt event SEC_EVENT, and triggering the second multi-input AND gate circuit 31 to generate a security interrupt signal SEC_INT through the security interrupt event.

[0098] Specifically, in combination with the above four determinations, the following respectively describes whether a security interrupt is generated and error data is generated:

[0099] In case 1, when a non-secure instruction (PPROT[1] is '1') performs read and write access to the secure APB slave (SEC is '0'), the value read by the APB slave is all '0' and a security event SEC_EVENT is generated. By setting the security event interrupt enable signal SEC_IE, a security interrupt SEC_INT is generated and reported to the CPU.

[0100] In the second scenario, when a non-secure instruction (PPROT[1] is '1') performs read and write access to an APB slave with non-secure attributes (SEC is '1'), the access is executed normally and no security event SEC_EVENT is generated;

[0101] Scenario 3: When the security instruction (PPROT[1] is '0') performs read and write access to the APB slave with non-security attributes (SEC is '1'), the value read by the APB slave is all '0' and a security event SEC_EVENT is generated. By setting the security event interrupt enable signal SEC_IE, the security interrupt SEC_INT is generated and reported to the CPU.

[0102] In case 4, when the security instruction (PPROT[1] is '0') performs read and write access to the APB slave with security attributes (SEC is '0'), the access is executed normally and the security event SEC_EVENT is not generated.

[0103] In one embodiment, when the security attribute of the target slave module does not meet the security attribute requirements of the current access event, error data is generated, and at the same time, the error data is transmitted to the preset host module, wherein the preset host module is connected to the target slave module via a bus bridge. The beneficial effect of this embodiment is that by judging whether the security attribute of each target slave module meets the security attribute requirements of the current access event through a security flag signal, and determining whether to generate a security event based on the compliance, differentiated security access control of each target slave module is achieved, each target slave module is associated with its access event, and the control efficiency and accuracy of each access event are improved.

[0104] like Figure 6 As shown, in the integrated circuit, the slave error reporting circuit includes a third multi-input AND gate circuit 33, a third multiplexer 13, a fourth multiplexer 14, a fifth multiplexer 15, a first register 41 and a second register 42, wherein:

[0105] The input end of the third multi-input AND gate circuit 33 is used to input the slave selection signal PSEL and the slave enable signal PENABLE, and the output end of the third multi-input AND gate circuit 33 is connected to the selection end of the fourth multiplexer;

[0106] One input end of the fourth multiplexer 14 is connected to the output end of the third multiplexer 13, the other input end of the fourth multiplexer 14 is used to input a first level signal, the output end of the fourth multiplexer 14 is connected to the input end of the first register 41, the output end of the first register 41 is respectively connected to one input end of the third multiplexer 13 and the selection end of the fifth multiplexer 15, and the other input end of the third multiplexer 13 is used to input a second level signal, wherein the first level signal is 1 and the second level signal is 0;

[0107] The selection end of the third multiplexer 13 and an input end of the fifth multiplexer 15 are respectively used to input the security event SEC_EVENT, the other input end of the fifth multiplexer 15 is used to input the second level signal, the output end of the fifth multiplexer 15 is connected to the input end of the second register 42, the output end of the second register 42 is used to output error data, the clock input end of the second register 42 is connected to the clock input end of the first register 41, wherein the second level signal is 0.

[0108] In one embodiment, reference Figure 7The slave error timing diagram of an embodiment of the security access method of the present invention is shown. The integrated circuit operates according to the timing diagram, wherein the PCLK (bus clock) waveform, PADDR (APB address bus) waveform, PSEL (secondary decoding signal of the AHB-APB bridge) waveform, PENABLE (the second clock cycle of an APB transmission) waveform, PREADY (extended APB transmission) waveform, PSLVERR (transmission failure) waveform, and SEC_EVENT (security event) waveform are depicted from top to bottom. Among them, the generation of the security event SEC_EVENT will also cause an APB bus error. At the same time, the security event SEC_EVENT pulls down the PREADY of the APB bus in the second cycle of the read and write access to the APB slave, and pulls up the PSLVERR of the APB bus in the third cycle. It can be seen that Figure 6 The waveform characteristics shown are consistent with the error reporting timing of the APB bus protocol. The APB bus errors will be reported to the CPU and AHB host step by step through the AHB-APB bridge.

[0109] The beneficial effect of this embodiment is that by obtaining the security flag signal and slave identification information of the current access event; then, determining the target slave module to be accessed and the security attributes of the target slave module according to the slave identification information; finally, judging whether the security attributes of the target slave module meet the security attribute requirements of the current access event according to the security flag signal, if the security attributes of the target slave do not meet the security attribute requirements of the current access event, a security interrupt event is generated. A more effective slave security access control scheme is implemented, which improves the individual security access control capability of each device on the bus and enhances the security protection strength of its key sensitive data.

[0110] It should be noted that the above-mentioned integrated circuit embodiment and method embodiment belong to the same concept, and the specific implementation process is detailed in the method embodiment, and the technical features in the method embodiment are correspondingly applicable in this integrated circuit embodiment, which will not be repeated here.

[0111] In one embodiment, the present invention further proposes a computer-readable storage medium, characterized in that a security access program is stored on the computer-readable storage medium, and when the security access program is executed by a processor, the steps of the security access method as described in any one of the above items are implemented.

[0112] It should be noted that the above-mentioned computer-readable storage medium embodiment and the method embodiment belong to the same concept, and the specific implementation process is detailed in the method embodiment, and the technical features in the method embodiment are correspondingly applicable in the computer-readable storage medium embodiment, which will not be repeated here.

[0113] It should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the existence of other identical elements in the process, method, article or device including the element.

[0114] The serial numbers of the above embodiments of the present invention are only for description and do not represent the advantages or disadvantages of the embodiments.

[0115] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, a magnetic disk, or an optical disk), and includes a number of instructions for enabling a terminal (which can be a mobile phone, a computer, a server, an air conditioner, or a network device, etc.) to execute the methods described in each embodiment of the present invention.

[0116] The embodiments of the present invention are described above in conjunction with the accompanying drawings, but the present invention is not limited to the above-mentioned specific implementation modes, which are merely illustrative rather than restrictive. Under the guidance of the present invention, ordinary technicians in this field can also make many forms without departing from the scope of protection of the present invention and the claims, all of which are within the protection of the present invention.

Claims

1. A secure access method, characterized in that: The method comprises: Obtain the security flag signal of the current access event and the slave identity information; Determine the target slave module to be accessed and the security attribute of the target slave module according to the slave identity information; Determine whether the security attribute of the target slave module meets the security attribute requirement of the current access event according to the security flag signal, and generate a security interrupt event if the security attribute of the target slave module does not meet the security attribute requirement of the current access event; When initiating access to a slave module, the security attribute of each access to the slave module is determined in combination with the slave selection signal; Before obtaining the security mark signal of the current access event and the slave identity information, the method further includes: Setting a security attribute of at least one preset slave module, wherein the at least one preset slave module includes the target slave module; The step of setting the security attribute of at least one preset slave module comprises: In the secure and privileged mode, security attribute data is written to the at least one preset slave module, and the security attribute register of the slave module is changed through instructions of the secure and privileged mode, wherein the security attribute data is used to define the security attribute of the at least one preset slave module.

2. The secure access method according to claim 1, characterized in that: The step of judging whether the security attribute of the target slave module meets the security attribute requirement of the current access event according to the security flag signal includes: Determine whether the current access event is a secure access event or a non-secure access event according to the security flag signal; When the current access event is a non-secure access event and the security attribute of the target slave module is secure, determining that the security attribute of the target slave module does not meet the security attribute requirement of the current access event; When the current access event is a non-secure access event and the security attribute of the target slave module is non-secure, determining that the security attribute of the target slave module meets the security attribute requirement of the current access event; When the current access event is a secure access event and the security attribute of the target slave module is secure, determining that the security attribute of the target slave module meets the security attribute requirement of the current access event; When the current access event is a secure access event and the security attribute of the target slave module is non-secure, it is determined that the security attribute of the target slave module does not meet the security attribute requirement of the current access event.

3. The secure access method according to claim 2, characterized in that: When the security attribute of the target slave module does not meet the security attribute requirement of the current access event, the method further includes: Generate error data; The error data is transmitted to a preset host module, wherein the preset host module is connected to the target slave module via a bus bridge.

4. An integrated circuit, comprising a first bus, a second bus, and a bus bridge for connecting the first bus and the second bus, wherein the first bus is connected to a processor and a memory, the memory stores a computer program that can be run on the processor, and the second bus is connected to at least one slave module, characterized in that: The processor includes a slave security attribute control circuit, wherein the slave security attribute control circuit includes at least a first multiplexer, an output end of the first multiplexer is used to connect to a register of the at least one slave module; an input end of the first multiplexer is used to input security attribute data, and the first multiplexer is used to write the security attribute data into the register of the at least one slave module to set the security attribute of the at least one preset slave module; or, the input end of the first multiplexer is used to connect to a flash memory and obtain a code option related to the security attribute from the flash memory, and the first multiplexer is used to write the code option into the register of the at least one slave module to set the security attribute of the at least one preset slave module; When the processor executes the computer program, the steps of the secure access method according to any one of claims 1 to 3 are implemented.

5. The integrated circuit according to claim 4, characterized in that The processor comprises a slave safety event interrupt circuit, wherein the slave safety event interrupt circuit comprises an XOR gate circuit, a first multi-input AND gate circuit, a second multi-input AND gate circuit and a second multiplexer; The XOR gate circuit, the first multi-input AND gate circuit and the second multi-input AND gate circuit are connected in series in sequence, and the second multiplexer is connected between the first multi-input AND gate circuit and the second multi-input AND gate circuit, wherein one input end of the XOR gate circuit is used to input the instruction of the security flag signal of the current access event, and the other input end of the XOR gate circuit is used to input the security attribute data of the target slave module. When the security attribute of the target slave module does not meet the security attribute requirements of the current access event, the XOR gate circuit outputs a high level, triggering the first multi-input AND gate circuit to generate a security interrupt event, and triggering the second multi-input AND gate circuit to generate a security interrupt signal through the security interrupt event.

6. The integrated circuit according to claim 5, characterized in that The processor further includes a slave error reporting circuit, wherein the slave error reporting circuit includes a third multi-input AND gate circuit, a third multiplexer, a fourth multiplexer, a fifth multiplexer, a first register and a second register; The input end of the third multi-input AND gate circuit is used to input a slave selection signal and a slave selection signal, and the output end of the third multi-input AND gate circuit is connected to the selection end of the fourth multiplexer; One input end of the fourth multiplexer is connected to the output end of the third multiplexer, another input end of the fourth multiplexer is used to input a first level signal, the output end of the fourth multiplexer is connected to the input end of the first register, the output end of the first register is respectively connected to one input end of the third multiplexer and the selection end of the fifth multiplexer, and another input end of the third multiplexer is used to input a second level signal; The selection end of the third multiplexer and an input end of the fifth multiplexer are respectively used to input the security event, another input end of the fifth multiplexer is used to input the second level signal, the output end of the fifth multiplexer is connected to the input end of the second register, the output end of the second register is used to output error data, and the clock input end of the second register is connected to the clock input end of the first register.

7. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a security access program, which, when executed by a processor, implements the steps of the security access method according to any one of claims 1 to 3.

Images