A data isolation encryption system based on FSMC and AXI bus
By designing a data isolation and encryption system based on FSMC and AXI bus in the field of SOC, using high-speed parallel bus to realize the physical isolation of data, and encrypting it through the SMX module, the data isolation and encryption method in the prior art is solved Security and throughput issues achieve high security, high performance, portable data isolation and encryption effects.
Patent Information
- Application Number
- CN202111617478.5
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2021-12-28
- Publication Date
- 2025-02-07
- Estimated Expiration
- 2041-12-28
AI Technical Summary
The prior art is difficult to realize high-security, high-performance, portable data isolation and encryption methods in the SOC field, especially in large-scale data transmission, and it is difficult to ensure physical isolation and high throughput of data.
Design a data isolation and encryption system based on FSMC and AXI bus. Through the combination of STM32, conversion module, DBram module, Bram Controller module, SMX module and ZYNQ CPU module, the high-speed parallel bus can be used to achieve the physical isolation of the data. Encryption processing is performed through the SMX module.
It realizes a high-security, high-performance, portable data isolation and encryption method, which can ensure high throughput and be difficult to monitor in large-scale data transmission, and is suitable for the core areas of data security.
Smart Images
Figure CN114329543B_ABST
Abstract
Description
Technical Field
[0001] The invention relates to the field of storage, and in particular to a data isolation encryption system based on FSMC and AXI bus. Background Art
[0002] As the requirements for privacy protection and data security are gradually increasing in daily life and work, the requirements for data security management and information confidentiality are becoming increasingly important in government offices, national defense and military industries, and core security fields. In addition, with the specific implementation of the 2.0 security protection specification, data security and confidentiality requirements are also receiving more and more attention. In the SOC field, the AXI bus is currently widely used, and the FSMC bus method for inter-chip communication currently has high advantages in throughput, cost-effectiveness, and universal portability. Based on the advantages of the AXI bus and the FSMC bus, they can be applied to data security management and information confidentiality, thereby realizing a highly secure, high-performance, and portable data isolation encryption method. Summary of the invention
[0003] The technical problem to be solved by the present invention is to provide a data isolation encryption system based on FSMC and AXI bus. The data flow of the entire system is based on the AXI bus and the FSMC bus. Both buses are high-speed parallel buses. Physical isolation of plaintext and ciphertext data can ensure higher throughput in large-scale data transmission and is difficult to monitor, thereby realizing a highly secure, high-performance, and portable data isolation encryption method.
[0004] In order to solve the technical problem, the technical solution adopted by the present invention is: a data isolation encryption system based on FSMC and AXI bus, including STM32, a conversion module, a DBram module, a Bram Controller module, a SMX module and a ZYNQ CPU module, the STM32 is connected to the conversion module through the FSMC interface, the conversion module is connected to the DBram module, the conversion module converts the data sent by the STM32 into a Bram timing and stores it in the DBram module, the other end of the DBram module is connected to the BramController module, the Bram Controller module is used to control the access timing, the Bram Controller module is connected to the AXIM interface of the SMX module through the AXI bus, the AXIS interface of the SMX module is connected to the ZYNQ CPU module through the AXI bus, the SMX module encrypts the data and transmits the encrypted data to the ZYNQ CPU module.
[0005] Furthermore, the SMX module has a register configuration interface, which is connected to the ZYNQ CPU module through the Bram Controller module. The Bram Controller module simulates the configuration registers of the SMX as Bram for configuration. The Bram Controller is connected to the AXI bus as an AXI Slave device and is controlled by the ZYNQ CPU.
[0006] Furthermore, the data bus between FSMC and DBram is laid out to the middle layer in the Layout stage.
[0007] Furthermore, a plurality of control signals are provided to identify data states, and level signals are used to control the data communication process.
[0008] Furthermore, the control signal includes an encryption flag, a decryption flag, a data completion flag, and a data busy flag. Data transmission is initiated by the FSMC end, and the ZYNQ CPU passively receives data. The FSMC end configures the data communication mode and status, and the ZYNQ CPU sets the SMX module register according to the status of the FSMC end control signal.
[0009] Furthermore, data processing adopts streaming mode transmission, and DBram is logically divided into multiple areas for parallel data buffering.
[0010] Furthermore, two partitions are set as data buffers, and the two partitions are identified by level signals. When the FSMC transmits, the data busy flag is detected to determine whether the data can be cached in the idle partition for data buffering. When the SMX module processes the data, it processes the data according to the data completion flag of the FSMC end of each partition to ensure that the FSMC and SMX are processed in parallel.
[0011] Furthermore, during the migration process, the partition size and the cache capacity of each partition are dynamically adjusted according to the module rate of FSMC and SMX.
[0012] Beneficial effects of the present invention: The present invention proposes a data isolation encryption system based on FSMC and AXI bus. Data isolation is physically achieved, and the scheme has strong portability and universal interfaces. It can be used in various fields such as military secrets and commercial secrets by replacing the algorithm core. It is a universal data isolation encryption method. The multi-buffer ping-pong mechanism can be dynamically matched according to the algorithm and chip frequency, speed, and bus width. It has good product prospects and good application prospects in the core field of data security. BRIEF DESCRIPTION OF THE DRAWINGS
[0013] Figure 1 It is a principle block diagram of the present invention;
[0014] Figure 2 A schematic diagram for simulating the configuration register of SMX as Bram for configuration;
[0015] Figure 3 Flowchart for data encryption;
[0016] Figure 4 A schematic diagram of data transmission according to a control signal identifier;
[0017] Figure 5 A schematic diagram of setting up two data buffers. DETAILED DESCRIPTION
[0018] The present invention will be further described below in conjunction with the accompanying drawings and specific embodiments.
[0019] Example 1
[0020] This embodiment proposes a data isolation method based on FSMC (static memory control interface) and AXI bus, using ZYNQ 7000 series FPGA and STM32 chip for data communication. STM32 is a clear area, generating data plaintext, and the data accessed by the CPU end of ZYNQ is a secret area, that is, the result after the SMX module operation. The algorithm cannot be reverse cracked from the system level, and the algorithm IP core can be quickly and flexibly replaced, with good versatility. The entire module data flow is based on the AXI bus and FSMC bus, both of which are high-speed parallel buses. Ensuring the physical isolation of data plaintext and ciphertext can ensure high throughput in large-scale data transmission and is difficult to monitor. Thereby realizing a highly secure, high-performance, and portable data isolation encryption method, which can be widely used in the field of data security, and can be used as a general IP core in the SOC field, with broad market prospects.
[0021] The AXI system bus is the most important part of the AMBA (Advanced Microcontroller Bus Architecture) 3.0 protocol. It is an on-chip bus oriented to high performance, high bandwidth, and low latency. It connects multiple AXI Master devices to multiple AXI Slave devices, and implements address and data transmission between multiple memory-mapped devices. The SMX of this method has data communication interfaces AXIS, AXIM, and register configuration interfaces Register. The data communication interfaces AXIS and AXIM are connected to the AXI bus through the Slave and Master ports of AXI. The ZYNQ CPU accesses the AXIMaster port of SMX through the AXI bus to read or send data. The SMX module register configuration is controlled by the Bram (Block RAM) access timing (hereinafter referred to as Bram controller), that is, the configuration register of SMX is simulated as Bram for configuration ( Figure 2 ). BramController is connected to the AXI bus as an AXI Slave device and controlled by the ZYNQ CPU. Since register configuration does not require a high throughput, Bram access is simpler than AXI bus timing. This design can be accessed internally through the AXI bus according to this method, or directly constructed through external access to configure Bram timing, which has high flexibility and scalability.
[0022] This embodiment is described as Figure 1 As shown, it includes STM32, conversion module, DBram module, Bram Controller module, SMX module and ZYNQ CPU module. The STM32 is connected to the conversion module through the FSMC interface, and the conversion module is connected to the DBram module. The conversion module converts the data sent by the STM32 into Bram timing and stores it in the DBram module. The other end of the DBram module is connected to the Bram Controller module. The Bram Controller module is used to control the access timing. The Bram Controller module is connected to the AXIM interface of the SMX module through the AXI bus. The AXIS interface of the SMX module is connected to the ZYNQ CPU module through the AXI bus. The SMX module encrypts the data and transmits the encrypted data to the ZYNQ CPU module.
[0023] The SMX module has a register configuration interface, which is connected to the ZYNQ CPU module through the Bram Controller module. The Bram Controller module simulates the configuration register of the SMX as Bram for configuration. The Bram Controller is connected to the AXI bus as an AXI Slave device and is controlled by the ZYNQ CPU. Figure 2 As shown, it is a schematic diagram of simulating the configuration register of SMX as Bram for configuration. In this way, it can be accessed internally through the AXI bus according to this method, and can also be configured by directly constructing the Bram timing through external access, which has high flexibility and scalability.
[0024] In this embodiment, the DBram module is a dual-port block storage Ram (Dual Block Ram), port A is connected to the BramController, and the BramController is connected to the AXI Master of SMX through the AXI bus. The B port of the DBram is connected to the FSMC through the conversion module, thus forming a complete data path. Figure 3 Taking data encryption as an example, data is sent from the outside through the FSMC interface, and then converted to Bram timing through the conversion module and stored in DBram through port B. The ZYNQ CPU confirms that the data has been stored in DBram according to the custom control port status, and then configures the SMX register, sets the data to be input from the DBram end, and transmits it to the ZYNQ CPU after SMX encryption. The data is sent from the A port of DBram to the Bram Controller, and then encrypted from the SMX Master to the SMX Slave, and the ZYNQ CPU reads the result of the SMX module. The ZYNQ CPU has no data path with DBram, so it cannot directly access DBram and must go through the SMX module. After the data passes through the SMX module, it becomes ciphertext, which ensures that the plaintext and ciphertext are physically isolated, and the ZYNQ CPU and FSMC cannot obtain the plaintext and ciphertext at the same time. FSMC is a 32-bit high-speed parallel bus. When designing PCB, it is recommended to layout the data bus of FSMC and DBram to the middle layer in the Layout stage (bus connection when designing PCB board), so as to increase the difficulty of data monitoring and cracking and ensure data security.
[0025] In the data communication process, since the signal response speed is higher than reading the content in DBram, the use of level signal control can greatly improve the efficiency, so multiple control signals are required to identify the data status. That is, multiple control signals are set to identify the data status, and the level signal is used to control the data communication process.
[0026] Specifically, the control signals include encryption flag, decryption flag, data completion flag, and data busy flag. Data transmission is initiated by the FSMC end, and the ZYNQ CPU passively receives data. The FSMC end configures the data communication mode and status. The ZYNQ CPU sets the SMX module register according to the status of the FSMC end control signal.
[0027] like Figure 4 As shown in the figure, taking an encrypted communication as an example, the FSMC sets the communication mode (state S00), and the ZYNQ CPU configures the SMX to the encryption mode according to the state set by the FSMC. The data direction is from the AXI Master of the SMX to the AXI Slave (state S01). After the configuration is completed (state S02), the FSMC performs plaintext data transmission according to the state set by the ZYNQ CPU (state S03). After the transmission is completed, the Finish signal corresponding to the FSMC is set (state S04). The ZYNQ CPU sets the Busy signal of the SMX end according to the Finish signal of the FSMC, and reads the data through the SMX module (state S05). At this time, the data becomes ciphertext. After ZYNQ takes the data (state S06), it sets the Finish signal set by the FSMC end to continue processing the data transmission completion\continue to send. The FSMC jumps to S02 / S00 according to the Finish signal of the ZYNQ end, thus completing the entire data transmission process.
[0028] In this embodiment, data processing adopts stream mode transmission, and the DBram is logically divided into multiple areas for parallel data buffering.
[0029] like Figure 5 As shown in the figure, two partitions are set as data buffers, and the two partitions are identified by level signals. When FSMC is transmitting, it detects the data busy mark to determine whether the data can be cached in the idle partition for data buffering. When the SMX module processes the data, it processes the data according to the data completion mark of the FSMC end of each partition, ensuring that FSMC and SMX are processed in parallel, greatly improving the data communication efficiency (such as Figure 5 ), if Buffer1 is in the Finish state and Buffer2 is in the Busy state, Data Flow1 and Data Flow4 will be processed in parallel. In addition, during the migration process, the partition size and the cache capacity of each partition can be dynamically adjusted according to the module rate of FSMC and SMX to achieve the highest utilization and throughput.
[0030] This embodiment also verifies the method.
[0031] First, read the DBram data through the ZYNQ CPU. In the Linux configuration file generated according to the HDF file (the description file generated according to the hardware design), the DBram-related hardware resources cannot be seen. Therefore, DBram must read or send data through SMX to confirm the physical isolation of plaintext and ciphertext data.
[0032] verify Figure 2 SMX register reading and writing, the SMX register is configured through the Bram Controller connected to the ZYNQ CPU. After configuration, the expected state requirements are achieved, proving that the method through the Bram Controller SMX register is feasible.
[0033] The SMX (SM4 algorithm) standard data was tested through the script and was verified to be consistent with the national encryption standard data. The SMX module works normally and the data path is normal.
[0034] verify Figure 4 Both single-packet data (S06 jumps to S00) and multi-packet data (S06 jumps to S02) can complete all data transmission normally, confirming that the state machine jumps normally. Combined with the status register of SMX, data anomalies can be identified and processed, proving that the module is available and robust.
[0035] verify Figure 5 The performance of the double-buffered mechanism Data Flow1 and Data Flow4 (480Mbps) is 6 times higher than that of the single-buffered mechanism, which only uses Buffer1 to cache data (83Mbps).
[0036] The above description is only the basic principle and preferred embodiments of the present invention. Improvements and substitutions made by those skilled in the art based on the present invention belong to the protection scope of the present invention.
Claims
1. A data isolation encryption system based on FSMC and AXI bus, characterized by: It includes STM32, conversion module, DBram module, Bram Controller module, SMX module and ZYNQ CPU module. STM32 is connected to the conversion module through FSMC interface. The conversion module is connected to DBram module. The conversion module converts the data sent by STM32 into Bram timing and stores it in DBram module. The other end of DBram module is connected to Bram Controller module. Bram Controller module is used to control access timing. Bram Controller module is connected to AXIM interface of SMX module through AXI bus. AXIS interface of SMX module is connected to ZYNQ CPU module through AXI bus. SMX module encrypts data and transmits the encrypted data to ZYNQ CPU module. The DBram module is a dual-port block storage Ram. Port A is connected to the Bram Controller, and the Bram Controller is connected to the AXI Master of SMX through the AXI bus. Port B of DBram is connected to FSMC through a conversion module. Data is sent from the outside by the FSMC interface, and then converted into Bram timing by the conversion module and stored in DBram through port B. ZYNQ CPU confirms that the data has been stored in DBram according to the status of the custom control port, and then configures the SMX register, sets the data to be input from the DBram end, and is encrypted and transmitted to ZYNQ CPU through SMX; data is sent from port A of DBram to Bram Controller, and then encrypted and calculated from SMX Master to SMX Slave, and ZYNQ CPU reads the result of the calculation of the SMX module.
2. The data isolation encryption system based on FSMC and AXI bus according to claim 1, characterized in that: The SMX module has a register configuration interface, which is connected to the ZYNQ CPU module through the Bram Controller module. The Bram Controller module simulates the configuration registers of the SMX as Bram for configuration. The Bram Controller is connected to the AXI bus as an AXI Slave device and is controlled by the ZYNQ CPU.
3. The data isolation encryption system based on FSMC and AXI bus according to claim 1, characterized in that: The data bus between FSMC and DBram is laid out to the middle layer in the Layout stage.
4. The data isolation encryption system based on FSMC and AXI bus according to claim 1, characterized in that: Multiple control signals are provided to identify data status, and level signals are used to control the data communication process.
5. The data isolation encryption system based on FSMC and AXI bus according to claim 4 is characterized in that: The control signals include encryption flag, decryption flag, data completion flag, and data busy flag. Data transmission is initiated by the FSMC end, and the ZYNQ CPU passively receives data. The FSMC end configures the data communication mode and status. The ZYNQ CPU sets the SMX module register according to the status of the FSMC end control signal.
6. The data isolation encryption system based on FSMC and AXI bus according to claim 1, characterized in that: Data processing adopts streaming mode transmission, and DBram is logically divided into multiple areas for parallel data buffering.
7. The data isolation encryption system based on FSMC and AXI bus according to claim 6 is characterized in that: Set two partitions as data buffers, identify the two partitions through level signals, detect the data busy flag during FSMC transmission to determine whether the data can be cached in the free partition for data buffering, and when the SMX module processes the data, it processes the data according to the FSMC-end data completion flag of each partition to ensure that FSMC and SMX are processed in parallel.
8. The data isolation encryption system based on FSMC and AXI bus according to claim 6, characterized in that: During the migration process, the partition size and cache capacity of each partition are dynamically adjusted according to the module rate of FSMC and SMX.
Citation Information
Patent Citations
Electronic equipment
CN101996285A
Programmable logic device, control method and control system thereof, and video processor
CN111736792A