A DDR rights management method and device
By establishing a correspondence between DDR and the security control unit, the authority management of the DDR data path is realized, and the problems of complex security control of bus structure and difficult to achieve CPU and DDR security control in the prior art are solved, and the security control efficiency and DDR channel bandwidth performance.
Patent Information
- Application Number
- CN202010547055.X
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2020-06-16
- Publication Date
- 2025-01-03
- Estimated Expiration
- 2040-06-16
AI Technical Summary
In the prior art, the strong coupling of safety control based on the bus structure and the bus resulted in the inability to achieve unified management of the multi-stage cascade bus structure, the software design was complex, and the shortest path connection between the CPU and DDR could not be achieved in the high-performance SoC architecture. , increasing the FIFO storage cost and processor cycle of data security information.
By establishing the correspondence between the DDR and the security control unit of the double-rate synchronous dynamic random memory, the security control unit is used to manage the DDR data path permissions to realize the binding between security control and DDR, which is not related to the bus level design and the software design is simple. .
The independent management of security control and DDR is realized, which reduces the complexity of software design, avoids the impact of bus performance, and improves the efficiency of security control and DDR channel bandwidth performance.
Smart Images
Figure CN113806791B_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the field of computer technology, and in particular to a DDR authority management method and device. Background Art
[0002] The existing solution is based on the bus structure, and the security control is strongly coupled with the bus. The security control of the multi-level cascade bus structure will be distributed and cannot be managed uniformly, and the software design is complex. At the same time, in some high-performance SoC architectures, the CPU and DDR are connected by the shortest path. In this case, the security control of the CPU cannot be achieved.
[0003] In the design, when there are many bus levels, it is necessary to increase the FIFO storage of information required for data security, which increases the cost; if multiple cycles are required when performing a security processor, the cascading will increase the processor cycle and affect the bus performance. Summary of the invention
[0004] The embodiment of the present invention provides a DDR authority management method and device, which are used to establish a universal hardware architecture, bind security control to DDR, have nothing to do with bus level design, and have simple software design.
[0005] A first embodiment of the present invention provides a DDR rights management method, characterized in that the method includes:
[0006] Establishing a corresponding relationship between a double rate synchronous dynamic random access memory DDR and a security control unit;
[0007] Based on the established corresponding relationship, the DDR data path is managed by the security control unit.
[0008] Optionally, the correspondence between the DDR and the security control unit is a one-to-one correspondence.
[0009] Optionally, before establishing the corresponding relationship between the double data rate synchronous dynamic random access memory DDR and the security control unit, the method further includes:
[0010] A bus arbitration logic is established based on any DDR data front end, and the right to use the bus is acquired according to the established bus arbitration logic.
[0011] Optionally, when the instruction port transmits a write command, the DDR data path is managed by the security control unit, including:
[0012] Perform write address processing according to the address of the write command, and write the result of the write address processing into the first first-in-first-out FIFO memory;
[0013] Performing a safety check on the write command and writing the safety check result into the second FIFO memory;
[0014] After the data corresponding to the write command is sent, data scrambling is performed on the data corresponding to the write command through the data written in the first FIFO memory and the second FIFO memory.
[0015] Optionally, when the instruction port transmits a write command, the DDR data path is managed by the security control unit, further comprising:
[0016] If the security detection result of the current write command is permission access failure, the data corresponding to the write command is masked and the write response channel permission access failure flag signal of the AXI bus is output.
[0017] Optionally, when the instruction port transmits a read command, the DDR data path is managed by the security control unit, including:
[0018] Performing read address processing according to the address of the read command, and performing security detection on the read command to obtain a flag signal of whether the permission access of the read command is successful;
[0019] Writing the result of the read address processing, the flag signal of the read command, and the token corresponding to the read command into the third FIFO memory;
[0020] When the data read port responds to data, the result of the corresponding read address processing and the flag signal of the read command are queried through the token token for descrambling, and the flag signal is output.
[0021] A second embodiment of the present invention provides a DDR rights management device, the device comprising:
[0022] A security control unit, used for establishing a corresponding relationship with a double data rate synchronous dynamic random access memory DDR; and
[0023] Based on the established corresponding relationship, the DDR data path is managed for rights.
[0024] Optionally, the device further comprises:
[0025] The bus arbitration unit is used to establish a bus arbitration logic at any DDR data front end and obtain the right to use the bus according to the established bus arbitration logic.
[0026] Optionally, the safety control unit includes:
[0027] A first address processing unit, used for performing write address processing according to the address of the write command;
[0028] A first first-in-first-out FIFO memory is used to store data according to the result of write address processing;
[0029] A first safety detection unit, used for performing safety detection on a write command;
[0030] A second FIFO memory is used to store the safety detection result of the write command;
[0031] The write data security processing unit is used to scramble the data corresponding to the write command through the data written in the first FIFO memory and the second FIFO memory after the data corresponding to the write command is sent.
[0032] Optionally, the safety control unit also includes:
[0033] A second address processing unit, used for performing read address processing according to the address of the read command;
[0034] A second security detection unit is used to perform security detection on the read command to obtain a flag signal indicating whether the permission access of the read command is successful;
[0035] A third FIFO memory is used to store the result of the read address processing, the flag signal of the read command and the token corresponding to the read command;
[0036] The read data security processing unit is used to query the corresponding read address processing result and the flag signal of the read command through the token token when the data read port responds to data, perform descrambling, and output the flag signal.
[0037] The embodiment of the present invention establishes a corresponding relationship between a double rate synchronous dynamic random access memory DDR and a security control unit, and manages the authority of the DDR data path through the security control unit, thereby establishing a universal hardware architecture, binding security control to DDR, being independent of bus level design, and simplifying software design.
[0038] The above description is only an overview of the technical solution of the present invention. In order to more clearly understand the technical means of the present invention, it can be implemented according to the contents of the specification. In order to make the above and other purposes, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are listed below. BRIEF DESCRIPTION OF THE DRAWINGS
[0039] Various other advantages and benefits will become apparent to those of ordinary skill in the art by reading the detailed description of the preferred embodiments below. The accompanying drawings are only for the purpose of illustrating the preferred embodiments and are not to be considered as limiting the present invention. Moreover, the same reference symbols are used throughout the accompanying drawings to represent the same components. In the accompanying drawings:
[0040] Figure 1 This is a schematic diagram of the framework structure of the device according to the second embodiment of the present invention;
[0041] Figure 2It is a schematic diagram of the structure of a safety control unit according to an embodiment of the present invention. DETAILED DESCRIPTION
[0042] The exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although the exemplary embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be limited by the embodiments set forth herein. On the contrary, these embodiments are provided to enable a more thorough understanding of the present disclosure and to fully convey the scope of the present disclosure to those skilled in the art.
[0043] A first embodiment of the present invention provides a DDR rights management method, the method comprising:
[0044] Establishing a corresponding relationship between a double rate synchronous dynamic random access memory DDR and a security control unit;
[0045] Based on the established corresponding relationship, the DDR data path is managed by the security control unit.
[0046] Optionally, the correspondence between the DDR and the security control unit is a one-to-one correspondence.
[0047] In this embodiment, by establishing a corresponding relationship between the double-rate synchronous dynamic random access memory DDR and the security control unit, and managing the authority of the DDR data path through the security control unit, a universal hardware architecture is established, so that the security control is bound to the DDR, which is independent of the bus level design and simple in software design.
[0048] Optionally, before establishing the corresponding relationship between the double data rate synchronous dynamic random access memory DDR and the security control unit, the method further includes:
[0049] A bus arbitration logic is established based on any DDR data front end, and the right to use the bus is acquired according to the established bus arbitration logic.
[0050] Specifically, in this embodiment, by adding bus arbitration logic before the DDR controller, the conflict of bus use rights in the case of multiple DDRs is avoided.
[0051] Optionally, when the instruction port transmits a write command, the DDR data path is managed by the security control unit, including:
[0052] Perform write address processing according to the address of the write command, and write the result of the write address processing into the first first-in-first-out FIFO memory;
[0053] Performing a safety check on the write command and writing the safety check result into the second FIFO memory;
[0054] After the data corresponding to the write command is sent, data scrambling is performed on the data corresponding to the write command through the data written in the first FIFO memory and the second FIFO memory.
[0055] Specifically, in this embodiment, when the instruction port transmits a write command, the security control unit performs permission management on the DDR data path, such as Figure 2 As shown, including:
[0056] First, the write command transmitted by the instruction port performs a specific algorithm on the write command address to generate a scrambling factor for data scrambling, and writes the scrambling factor and write command attributes into their respective FIFOs;
[0057] Then, after the data corresponding to the write command is sent, the data will be scrambled using the write scrambling factor stored in the FIFO and the write command attribute.
[0058] Optionally, when the instruction port transmits a write command, the DDR data path is managed by the security control unit, further comprising:
[0059] When the security detection result of the current write command is permission access failure, the data corresponding to the write command is shielded and a permission access failure flag signal corresponding to the AXI bus B channel is output.
[0060] If the command corresponding to the scrambling factor generator is a permission access failure, the write byte mask flag corresponding to the write data channel is set to be fully masked and the AXI bus B channel response failure is output.
[0061] In summary, the embodiments of the present invention utilize the seriality of sending or responding to data after sending a command, and use idle time to complete security judgment. The security attributes are calculated while the data is being transmitted, and the transmitted data is processed, thereby realizing the concurrency of security attribute calculation of the command and data processing without affecting the DDR channel bandwidth performance.
[0062] A second embodiment of the present invention provides a DDR rights management method, the method comprising:
[0063] Establishing a corresponding relationship between a double rate synchronous dynamic random access memory DDR and a security control unit;
[0064] Based on the established corresponding relationship, the DDR data path is managed by the security control unit.
[0065] Optionally, the correspondence between the DDR and the security control unit is a one-to-one correspondence.
[0066] In this embodiment, by establishing a corresponding relationship between the double-rate synchronous dynamic random access memory DDR and the security control unit, and managing the authority of the DDR data path through the security control unit, a universal hardware architecture is established, so that the security control is bound to the DDR, which is independent of the bus level design and simple in software design.
[0067] Optionally, before establishing the corresponding relationship between the double data rate synchronous dynamic random access memory DDR and the security control unit, the method further includes:
[0068] A bus arbitration logic is established based on any DDR data front end, and the right to use the bus is acquired according to the established bus arbitration logic.
[0069] Specifically, in this embodiment, by adding bus arbitration logic before the DDR controller, the conflict of bus use rights in the case of multiple DDRs is avoided.
[0070] Optionally, when the instruction port transmits a read command, the DDR data path is managed by the security control unit, including:
[0071] Perform read address processing according to the address of the read command, and perform security detection on the read command to obtain a flag signal indicating whether the read command access permission is successful;
[0072] Writing the result of the read address processing, the flag signal of the read command, and the token corresponding to the read command into the third FIFO memory;
[0073] When the data read port responds to data, the result of the corresponding read address processing and the flag signal of the read command are descrambled through the token query, and the flag signal is output.
[0074] Specifically, different from the above-mentioned embodiment, this embodiment corresponds to the case of a read command. When the instruction port transmits a read command, the security control unit performs permission management on the DDR data path, including:
[0075] like Figure 2 As shown, first, the read command processes the address with a scrambling factor generator to generate a scrambling factor for data descrambling, and at the same time performs access permission detection on the command and outputs a permission access success flag signal, and stores the scrambling factor, permission access success flag, and token in the FIFO.
[0076] When responding to data, the corresponding scrambling factor and the permission access success flag are queried through the token in the response data to descramble the response data, and at the same time, the permission access success is output for the response of the AXI bus R channel.
[0077] In summary, a general hardware architecture is established through the method of this embodiment, so that the security control is bound to the DDR, which is independent of the bus level design, the software design is simple, and each security control is object-oriented (corresponding to the DDR);
[0078] The embodiment of the present invention utilizes the seriality of sending or responding to data after a command is sent, and uses idle time to complete security judgment. The security attribute is calculated while the data is transmitted, and the transmitted data is processed, thereby realizing the concurrency of the security attribute calculation of the command and the data processing, without affecting the DDR channel bandwidth performance.
[0079] The DDR data path is managed through the security control unit to integrate scrambling, encryption and decryption functions on the read and write data paths. It has strong scalability and supports out-of-order read operations without affecting the DDR channel bandwidth performance.
[0080] A third embodiment of the present invention provides a DDR rights management device, such as Figure 1 As shown, the device comprises:
[0081] A security control unit, used for establishing a corresponding relationship with a double data rate synchronous dynamic random access memory DDR; and
[0082] Based on the established corresponding relationship, the DDR data path is managed for rights. Specifically, in this embodiment, Figure 1 As shown, a general hardware architecture is established to bind the DDR to the security control unit. In this embodiment, the security control is matched one-to-one with the DDR using an object-oriented design method.
[0083] The device of the present invention establishes a corresponding relationship between a double rate synchronous dynamic random access memory DDR and a security control unit, and manages the authority of the DDR data path through the security control unit, thereby establishing a universal hardware architecture, binding the security control with the DDR, being independent of the bus level design, and simplifying the software design.
[0084] Optionally, the device further comprises:
[0085] The bus arbitration unit is used to establish a bus arbitration logic at any DDR data front end and obtain the right to use the bus according to the established bus arbitration logic.
[0086] Specifically, Figure 1 As shown, a bus arbitration logic is added before the DDR controller, and a security control unit is embedded between the arbitration and the DDR controller.
[0087] Optionally, the safety control unit includes:
[0088] A first address processing unit, used for performing write address processing according to the address of the write command;
[0089] A first first-in-first-out FIFO memory is used to store data according to the result of write address processing;
[0090] A first safety detection unit, used for performing safety detection on a write command;
[0091] A second FIFO memory is used to store the safety detection result of the write command;
[0092] The write data security processing unit is used to scramble the data corresponding to the write command through the data written in the first FIFO memory and the second FIFO memory after the data corresponding to the write command is sent.
[0093] Specifically, in this embodiment, if Figure 2 As shown, the security control unit includes a first address processing unit scrambling factor generator that calculates the write command address using a preset algorithm to generate a scrambling factor for data scrambling, and writes the write command write attribute and the scrambling factor into a first FIFO (first in first out) memory.
[0094] After the write command performs access authority authentication, a flag indicating whether the access authority is successful is written into the second FIFO memory;
[0095] The write data security processing unit will use the scrambling factor stored in the FIFO to scramble the data after the data corresponding to the write command is issued. If the access permission authentication detection command is an access failure, the write data byte enable bits of the write data corresponding to the write command will be masked and the access failure response required by the AXI bus B channel will be output.
[0096] Optionally, the safety control unit also includes:
[0097] A second address processing unit, used for performing read address processing according to the address of the read command;
[0098] A second security detection unit is used to perform security detection on the read command to obtain a flag signal indicating whether the permission access of the read command is successful;
[0099] The third FIFO memory is used to store the result of the read address processing, the flag signal of whether the permission access of the read command is successful, and the token corresponding to the read command;
[0100] The read data security processing unit is used to query the corresponding read address processing result and the read command permission access success flag signal through the token token when the data read port responds to data, and descramble it, and output the permission access success flag signal.
[0101] Specifically, in another optional embodiment of the present invention, as Figure 2As shown, the security control unit also includes a second address processing unit that generates a scrambling factor for data descrambling according to the read command address.
[0102] The second security detection unit is used to detect the access rights of the read command and output a flag signal indicating whether the access rights are successful, and store the scrambling factor, the flag indicating whether the access rights are successful, and the token in the third FIFO memory;
[0103] The read data security processing unit is used to query the corresponding read address processing result and the read command permission access success flag signal through the token token when the data read port responds to data, and descramble it, and output the permission access success flag signal.
[0104] In summary, the device of the present invention establishes a corresponding relationship between the double-rate synchronous dynamic random access memory DDR and the security control unit, and manages the authority of the DDR data path through the security control unit, thereby establishing a universal hardware architecture, binding the security control with the DDR, being independent of the bus level design, and simplifying the software design.
[0105] The device of the present invention utilizes the seriality of sending or responding to data after sending a command, and uses idle time to complete security judgment. The security attribute is calculated while the data is transmitted, and the transmitted data is processed, thereby realizing the concurrency of the security attribute calculation of the command and the data processing, without affecting the DDR channel bandwidth performance.
[0106] The DDR data path is managed through the security control unit to integrate scrambling, encryption and decryption functions on the read and write data paths. It has strong scalability and supports out-of-order read operations without affecting the DDR channel bandwidth performance.
[0107] The safety control unit of the present invention is separated from the bus and has nothing to do with the SoC bus system architecture. The safety control unit and the DDR are object-oriented.
[0108] It should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the existence of other identical elements in the process, method, article or device including the element.
[0109] The serial numbers of the above embodiments of the present invention are only for description and do not represent the advantages or disadvantages of the embodiments.
[0110] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, a magnetic disk, or an optical disk), and includes a number of instructions for enabling a terminal (which can be a mobile phone, a computer, a server, an air conditioner, or a network device, etc.) to execute the methods described in each embodiment of the present invention.
[0111] The embodiments of the present invention are described above in conjunction with the accompanying drawings, but the present invention is not limited to the above-mentioned specific implementation modes, which are merely illustrative rather than restrictive. Under the guidance of the present invention, ordinary technicians in this field can also make many forms without departing from the scope of protection of the present invention and the claims, all of which are within the protection of the present invention.
Claims
1. A DDR rights management method, characterized in that: The method comprises: Establishing a corresponding relationship between a double rate synchronous dynamic random access memory DDR and a security control unit; Based on the established correspondence, the DDR data path is managed by the security control unit; Wherein, the correspondence between the DDR and the security control unit is a one-to-one correspondence; When the instruction port transmits a write command, the security control unit manages the permissions of the DDR data path, including: Perform write address processing according to the address of the write command, and write the result of the write address processing into the first first-in-first-out FIFO memory; Performing a safety check on the write command and writing the safety check result into the second FIFO memory; After the data corresponding to the write command is sent, data scrambling is performed on the data corresponding to the write command through the data written in the first FIFO memory and the second FIFO memory; In the case where the instruction port transmits a write command, the DDR data path is managed by the security control unit, which also includes: If the security detection result of the current write command is permission access failure, the data corresponding to the write command is masked and the write response channel permission access failure flag signal of the AXI bus is output; Alternatively, when the instruction port transmits a read command, the DDR data path is managed by the security control unit, including: Performing read address processing according to the address of the read command, and performing security detection on the read command to obtain a flag signal of whether the permission access of the read command is successful; Writing the result of the read address processing, the flag signal of the read command, and the token corresponding to the read command into the third FIFO memory; When the data read port responds to data, the result of the corresponding read address processing and the flag signal of the read command are queried through the token token for descrambling, and the flag signal is output.
2. The method according to claim 1, characterized in that Before establishing the corresponding relationship between the double data rate synchronous dynamic random access memory DDR and the security control unit, the method further includes: A bus arbitration logic is established based on any DDR data front end, and the right to use the bus is acquired according to the established bus arbitration logic.
3. A DDR rights management device, characterized in that: The device comprises: A security control unit, used for establishing a corresponding relationship with a double data rate synchronous dynamic random access memory DDR; and Based on the established correspondence, the DDR data path is managed for rights; Among them, the safety control unit includes: A first address processing unit, used for performing write address processing according to the address of the write command; A first first-in-first-out FIFO memory is used to store data according to the result of write address processing; A first safety detection unit, used for performing safety detection on a write command; A second FIFO memory is used to store the safety detection result of the write command; A write data security processing unit, used for scrambling the data corresponding to the write command through the data written in the first FIFO memory and the second FIFO memory after the data corresponding to the write command is issued; The safety control unit also includes: A second address processing unit, used for performing read address processing according to the address of the read command; A second security detection unit is used to perform security detection on the read command to obtain a flag signal indicating whether the permission access of the read command is successful; A third FIFO memory is used to store the result of the read address processing, the flag signal of the read command and the token corresponding to the read command; The read data security processing unit is used to query the corresponding read address processing result and the flag signal of the read command through the token token when the data read port responds to data, perform descrambling, and output the flag signal.
4. The device according to claim 3, characterized in that The device also includes: The bus arbitration unit is used to establish a bus arbitration logic at any DDR data front end and obtain the right to use the bus according to the established bus arbitration logic.