Secure isolation method, apparatus, and computer system

Abstract

A security isolation method, device and computer system. The security isolation device comprises a request detection module and a selection module. The request detection module is configured to receive an access request from an access device, the access request carrying operation information of the access device and security level related information of the access device, the security level related information of the access device being used to indicate the security level of the access device, and the operation information being used to indicate the operation of the access device. The selection module is configured to isolate the access request in the case that the operation of the access device is a write operation or an RFO operation, and the security level of the access device meets a security isolation condition. The above scheme can realize the safe interaction of data between devices of multiple security levels, and improve the system performance.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of automatic driving, and more particularly, to a safety isolation method, device and computer system. BACKGROUND

[0002] With the increasing complexity of automotive electronic systems, in order to improve the safety of the automobile, in the field of automatic driving, when the system is designed for functional safety, the system needs to be analyzed for hazards and evaluated for risks in the design stage of the automotive product, to identify the hazards of the system, and to evaluate the risk level of the hazards. The higher the risk, the higher the corresponding safety level. The concept of automotive safety integrity level (ASIL) is introduced in the road vehicle functional safety standard ISO26262, which is used to evaluate the safety level of the automobile, and defines four different ASILs: ASIL A, ASIL B, ASIL C and ASIL D. Among them, ASIL A is the lowest safety level, and ASIL D is the highest safety level. In addition, if it is a quality management (QM) level, it is not related to safety, and does not require corresponding safety requirements.

[0003] In a system containing multiple different ASILs, the devices corresponding to each ASIL are strictly limited in the isolation domain of the same ASIL safety level, and the devices corresponding to different ASILs cannot interact with each other, to ensure that the devices corresponding to high ASIL are not disturbed, and to ensure the safety of the system. However, a large amount of data interaction is also required between devices corresponding to different ASILs, and the above-mentioned solution will result in inefficient interaction between devices corresponding to different ASILs, affecting the overall performance of the system, and even leading to the inability of the final automotive product to achieve the expected function. SUMMARY

[0004] The present application provides a safety isolation method, device and computer system, which can realize the safe interaction of data between devices of multiple safety levels and improve the performance of the system.

[0005] In a first aspect, a safety isolation device is provided, comprising a request detection module and a selection module, wherein the request detection module is configured to receive an access request from an access device, the access request carrying operation information of the access device and safety level related information of the access device, the safety level related information of the access device being used to indicate the safety level of the access device, and the operation information being used to indicate the operation of the access device; and the selection module is configured to isolate the access request in a case where the operation of the access device is a write operation or a read for ownership (RFO) operation with permission acquisition, and the safety level of the access device meets a safety isolation condition.

[0006] Optionally, the apparatus can be applied in a computer system, for example, a system in an unmanned system.

[0007] When the computer system is a system in an unmanned system, the travel of the unmanned system can be controlled through the computer system.

[0008] It should be understood that in the present application, the higher the safety level is, the higher the safety degree is.

[0009] The operation information of the access device can be an operation code (opcode) of the access device.

[0010] According to the scheme of the embodiments of the present application, by analyzing the access request, the access device meeting the isolation condition is prevented from rewriting the accessed data, the efficient data interaction between devices of different safety levels is realized while meeting the functional safety requirement of the computer system, and the system performance is improved.

[0011] With reference to the first aspect, in some implementations of the first aspect, the selection module is further configured to: in a case where the operation of the access device is a non-write operation and a non-RFO operation, or the safety level of the access device does not meet the safety isolation condition, allow the access request.

[0012] With reference to the first aspect, in some implementations of the first aspect, the access request further includes safety level related information of the accessed data, the safety level related information of the accessed data is used to indicate the safety level of the accessed data, and the apparatus further includes a comparison module, the comparison module is configured to determine that the safety level of the access device meets the safety isolation condition, wherein the safety level of the access device meeting the safety isolation condition includes that the safety level of the access device is lower than the safety level of the accessed data.

[0013] If the access device of the low safety level rewrites the accessed data of the high safety level, when the access device of the high safety level uses the rewritten accessed data, the functional safety requirement of the access device of the high safety level cannot be met, resulting in system failure. According to the scheme of the embodiments of the present application, the access device of the low safety level rewriting the accessed data of the high safety level can be prevented, the device of the low safety level affecting the device of the high safety level can be avoided, the efficient data interaction between devices of different safety levels in the computer system can be realized, and the system performance is improved.

[0014] With reference to the first aspect, in some implementations of the first aspect, the safety level related information of the accessed data includes an address of the accessed data, and the comparison module is configured to determine that the safety level of the access device is lower than the safety level of the accessed data according to the address of the accessed data.

[0015] According to the scheme of the embodiment of the present application, the comparison of the security level of the access device and the security level of the accessed data can be realized based on the address, which is simple and convenient.

[0016] With reference to the first aspect, in some implementations of the first aspect, the comparison module is configured to: determine the first address according to a first mapping relationship, wherein the first address comprises one or more addresses corresponding to the data of the first security level, the first security level comprises one or more security levels higher than the security level of the access device, and the first mapping relationship is used to indicate a correspondence between the security level of the data and the address of the data; and if the address of the accessed data matches the address in the first address, it is determined that the security level of the access device is lower than the security level of the accessed data.

[0017] For example, the security level of the access device is ASIL C, and the first security level comprises ASIL D. For another example, the security level of the access device is ASIL B, and the first security level comprises ASIL C and ASIL D.

[0018] According to the scheme of the embodiment of the present application, the address of the accessed data can be matched with the addresses corresponding to the plurality of security levels at the same time, the processing speed is improved, and the efficient interaction of the data is further ensured.

[0019] With reference to the first aspect, in some implementations of the first aspect, the comparison module is further configured to: obtain the first mapping relationship from a register group.

[0020] The plurality of isolated domains in the computer system can be determined by a plurality of register information. The plurality of isolated domains are used to isolate devices and data of different security levels. The register information comprises address domain attributes of the security level corresponding to the isolated domain. The first mapping relationship can comprise address domain attributes of the security level corresponding to the plurality of isolated domains. The address domain attributes of the security level corresponding to the isolated domain can comprise the security level corresponding to the isolated domain, the starting address of the isolated domain, and the space size of the isolated domain. The addresses in the address domain of each security level can be continuous addresses or a plurality of discontinuous addresses.

[0021] According to the scheme of the embodiment of the present application, the first mapping relationship is obtained from the register, which can reduce the storage space and is simple and convenient in implementation.

[0022] With reference to the first aspect, in some implementations of the first aspect, the selection module is further configured to: in a case where the operation of the access device is a write operation or an RFO operation, and the security level of the access device meets the security isolation condition, report a security interrupt.

[0023] According to the scheme of the embodiment of the present application, by reporting the security interrupt, the software is informed of the security error, which can ensure that the software is visible and avoid system hanging.

[0024] With reference to the first aspect, in some implementations of the first aspect, the request detection module is further configured to: determine whether the check information is the same as the content of the access request, and in a case where the check information is the same as the content of the access request, the operation of the access device is a write operation or an RFO operation, and the security level of the access device meets the security isolation condition, isolate the access request. The check information is obtained by copying the content of the access request.

[0025] According to the scheme of the embodiments of the present application, by checking the access request, the access request with errors can be isolated, and the reliability of data interaction is ensured.

[0026] With reference to the first aspect, in some implementations of the first aspect, the request detection module is further configured to: determine whether the security level of the access device is lower than or equal to the preset security level, and in a case where the security level of the access device is lower than or equal to the preset security level, the operation of the access device is a write operation or an RFO operation, and the security level of the access device meets the security isolation condition, isolate the access request.

[0027] According to the scheme of the embodiments of the present application, in a case where the security level of the access device is higher than the preset security level, the subsequent steps are not performed. For example, the access request is directly allowed, the processing speed is improved, and the efficient interaction of data is further ensured.

[0028] The second aspect provides a computer system, comprising a security isolation device and an access device, wherein the access device is configured to: send an access request, wherein the access request carries operation information of the access device and security level related information of the access device, the security level related information of the access device is used to indicate the security level of the access device, and the operation information is used to indicate the operation of the access device; and the security isolation device is configured to: receive the access request, and in a case where the operation of the access device is a write operation or an RFO operation, and the security level of the access device meets the security isolation condition, isolate the access request.

[0029] With reference to the second aspect, in some implementations of the second aspect, the security isolation device is further configured to: in a case where the operation of the access device is a non-write operation and a non-RFO operation, or the security level of the access device does not meet the security isolation condition, allow the access request.

[0030] In some implementations of the second aspect, the access request further includes security level related information of the accessed data, the security level related information of the accessed data is used to indicate a security level of the accessed data, and the security level of the access device satisfies the security isolation condition includes that the security level of the access device is lower than the security level of the accessed data. In a third aspect, a security isolation method is provided. The method includes receiving an access request from an access device, the access request carrying operation information of the access device and security level related information of the access device, the security level related information of the access device being used to indicate a security level of the access device, and the operation information being used to indicate an operation of the access device; and isolating the access request in a case where the operation of the access device is a write operation or a read for ownership (RFO) operation with authority, and the security level of the access device satisfies a security isolation condition.

[0031] According to the scheme of the embodiments of the present application, by analyzing the access request, the access device satisfying the isolation condition is prevented from rewriting the accessed data, efficient data interaction between devices of different security levels in the computer system is realized, and system performance is improved while meeting the functional safety requirements of the computer system.

[0032] In some implementations of the third aspect, the method further includes allowing the access request in a case where the operation of the access device is a non-write operation or a non-RFO operation, or the security level of the access device does not satisfy the security isolation condition.

[0033] In some implementations of the third aspect, the access request further includes security level related information of the accessed data, the security level related information of the accessed data is used to indicate a security level of the accessed data, and the security level of the access device satisfies the security isolation condition includes that the security level of the access device is lower than the security level of the accessed data.

[0034] If the access device of the low security level rewrites the accessed data of the high security level, when the access device of the high security level uses the rewritten accessed data, the functional safety requirement of the access device of the high security level cannot be met, resulting in system failure. According to the scheme of the embodiments of the present application, the access device of the low security level is prevented from rewriting the accessed data of the high security level, the device of the low security level is prevented from affecting the device of the high security level, efficient data interaction between devices of different security levels in the computer system is realized, and system performance is improved.

[0035] In some implementations of the third aspect, the security level related information of the accessed data includes an address of the accessed data, and the security level of the access device being lower than the security level of the accessed data includes determining, according to the address of the accessed data, that the security level of the access device is lower than the security level of the accessed data.

[0036] According to the scheme of the embodiments of the present application, the comparison of the security level of the access device and the security level of the accessed data can be realized based on the address, which is simpler and more convenient.

[0037] With reference to the third aspect, in some implementations of the third aspect, the determining that the security level of the access device is lower than the security level of the accessed data according to the address of the accessed data comprises: determining a first address according to a first mapping relationship, wherein the first address comprises one or more addresses corresponding to data of a first security level, the first security level comprises one or more security levels higher than the security level of the access device, and the first mapping relationship is used to indicate a correspondence between the security level of the data and the address of the data; and if the address of the accessed data matches an address in the first address, it is determined that the security level of the access device is lower than the security level of the accessed data.

[0038] According to the scheme of the embodiments of the present application, the address of the accessed data can be matched with the addresses corresponding to the plurality of security levels at the same time, the processing speed is improved, and the efficient interaction of the data is further ensured.

[0039] With reference to the third aspect, in some implementations of the third aspect, the method further comprises: obtaining the first mapping relationship from a register group.

[0040] According to the scheme of the embodiments of the present application, the first mapping relationship is obtained from the register, the storage space can be reduced, and the implementation is simpler and more convenient.

[0041] With reference to the third aspect, in some implementations of the third aspect, the method further comprises: in a case where the operation of the access device is a write operation or an RFO operation, and the security level of the access device meets the security isolation condition, reporting a security interrupt.

[0042] According to the scheme of the embodiments of the present application, by reporting the security interrupt, the software is informed of the security error, which can ensure that the software is visible and avoid system hanging.

[0043] With reference to the third aspect, in some implementations of the third aspect, the method further comprises: determining whether check information and the content of the access request are the same, and in a case where the check information and the content of the access request are the same, the operation of the access device is a write operation or an RFO operation, and the security level of the access device meets the security isolation condition, isolating the access request. The check information is obtained by copying the content of the access request.

[0044] According to the scheme of the embodiments of the present application, by checking the access request, the access request with errors can be isolated, and the reliability of the data interaction is ensured.

[0045] With reference to the third aspect, in some implementations of the third aspect, the method further includes: determining whether the security level of the access device is lower than or equal to the preset security level, and when the security level of the access device is lower than or equal to the preset security level, the operation of the access device is a write operation or an RFO operation, and the security level of the access device meets the security isolation condition, isolating the access request.

[0046] According to the scheme of the embodiments of the present application, when the security level of the access device is higher than the preset security level, the subsequent steps are not performed. For example, the access request is directly allowed, the processing speed is improved, and the efficient interaction of data is further ensured. BRIEF DESCRIPTION OF DRAWINGS

[0047] Figure 1 is a schematic block diagram of a computer system provided by an embodiment of the present application;

[0048] Figure 2 is a schematic block diagram of a security isolation device provided by an embodiment of the present application;

[0049] Figure 3 is a schematic block diagram of another computer system provided by an embodiment of the present application;

[0050] Figure 4 is a schematic flow chart of a security isolation method provided by an embodiment of the present application;

[0051] Figure 5 is a schematic block diagram of a computer system provided by an embodiment of the present application. DETAILED DESCRIPTION

[0052] The technical solutions in the present application will be described below with reference to the drawings.

[0053] The computer system of the embodiments of the present application can be applied to an automatic driving system.

[0054] Figure 1 is a schematic diagram of a computer system provided by an embodiment of the present application.

[0055] The computer system includes a plurality of devices of different security levels. Figure 1The illustrated computer system includes a central processing unit (CPU). The central processing unit can be coupled with a bus. The bus can be a bus on a chip, such as a network on chip (NOC). The central processing unit can be one or more, each of which can include one or more processor cores. There is a point of coherence (PoC) after the CPU, which is used to guarantee cache coherency, and consistent information can be observed for all CPUs in the system.

[0056] The bus on a chip can be coupled with a memory, a subsystem (subsys), and peripherals.

[0057] The memory can contain instructions (e.g., program logic) that can be executed by the processor to perform various functions of the vehicle.

[0058] Illustratively, the memory can store data, in addition to instructions, such as road maps, route information, the location, direction, speed, and other such vehicle data of the vehicle, and other information. Such information can be used by the vehicle and the computer system during operation of the vehicle in autonomous, semi-autonomous, and / or manual modes.

[0059] In embodiments of the application, functions of the vehicle can be controlled based on inputs received from various subsystems and from peripherals. The subsystems can include one or more devices.

[0060] The vehicle can interact with external sensors, other vehicles, other computer systems, or users through peripherals. Among other things, the peripherals can include a wireless communication system, an on-board computer, a microphone, and / or a speaker.

[0061] In some embodiments, the peripherals can provide a means for the vehicle to interface with a user. For example, the on-board computer can provide information to a user of the vehicle. In other cases, the peripherals can provide a means for the vehicle to communicate with other devices located within the vehicle. For example, the microphone can receive audio (e.g., voice commands or other audio input) from a user of the vehicle. Similarly, the speaker can output audio to a user of the vehicle.

[0062] The wireless communication system can wirelessly communicate with one or more devices directly or via a communication network. For example, the wireless communication system can use 3G cellular communication; for example, code division multiple access (CDMA), EVD0, global system for mobile communications (GSM) / general packet radio service (GPRS), or 4G cellular communication, for example, long term evolution (LTE); or 5G cellular communication. The wireless communication system can communicate with wireless local area networks (WLANs) using wireless fidelity (WiFi).

[0063] In some embodiments, the wireless communication system can communicate directly with devices using infrared links, Bluetooth, or ZigBee; other wireless protocols, such as various vehicle communication systems, for example, the wireless communication system 141 can include one or more dedicated short range communications (DSRC) devices, which can include public and / or private data communications between vehicles and / or roadside stations.

[0064] Optionally, the input / output (I / O) interface can include one or more input / output devices, such as a wireless communication system, an on-board computer, a microphone, and a speaker, within a set of peripheral devices.

[0065] Optionally, the above components are only an example, and in actual applications, components in each of the above modules can be added or deleted according to actual needs, Figure 1 It should not be understood as a limitation on the embodiments of the present application.

[0066] When the computer system is in an autonomous driving system, the (partitioned) isolation of the devices of different security levels and the data of different security levels of the computer system is essentially the isolation of the devices of different security levels in the autonomous driving system. The security levels can include: QM, ASIL A, ASIL B, ASIL C, and ASIL D.

[0067] For an automatic driving system, in the case of a device including multiple ASIL safety levels, in the function safety strategy, the device of ASIL D needs to ensure that 99% of faults can be detected and processed, and the device of ASIL B only ensures that 90% of faults can be detected and processed. After the data of an address is rewritten by the device of a low ASIL safety level, the data of the address is processed according to the function safety requirement of the low safety level during the rewriting process. When the device of a high ASIL safety level uses the data rewritten by the device of a low safety level, the device of the high ASIL safety level bears a higher error probability and cannot meet the error detection rate requirement of the device of the high ASIL safety level.

[0068] For example, for a vehicle chip system with a display device, the safety level of the display chip related to the display device can be ASIL B, and the safety level of the control chip related to the control device can be ASIL D. The display device has higher fault tolerance when processing data, and occasional errors in data only cause a certain pixel error in the displayed image, which has little effect on the overall visual impression. If the instruction data is incorrect when the control device processes the data, the control function may be disordered, and even system crashes may occur. In the above vehicle chip system, if the instruction storage space in the control chip is rewritten by the display chip, the instruction storage space will process data according to the ASIL B safety level during the rewriting process, that is, the error detection rate of the data in the storage space is only 90%. If the control chip uses the storage space, it bears a higher error probability and cannot meet the 99% error detection rate requirement corresponding to the ASIL D safety level of the control chip.

[0069] Therefore, in order to realize safe driving, it is necessary to realize the isolation of devices of different safety levels, while ensuring efficient data interaction, and the device of a high safety level will not be affected by the device of a low safety level, thereby improving the overall performance of the system.

[0070] The safety isolation method of the embodiments of the present application will be described in detail below. Figures 2 to 4 The safety isolation method of the embodiments of the present application will be described in detail below.

[0071] Figure 2 is a schematic block diagram of a safety isolation device according to an embodiment of the present application. The safety isolation device can be applied to a computer system. The computer system includes multiple devices of different safety levels, for example, Figure 1 devices in the computer system. The computer system can be a vehicle electronic system, and the safety levels can be the safety levels of the vehicle electronic system, which can include QM, ASIL A, ASIL B, ASIL C, and ASIL D.

[0072] A plurality of isolated domains can be configured in the computer system, each of which corresponds to a safety level. The plurality of isolated domains are used to achieve the safety isolation between devices and data of different safety levels. The plurality of isolated domains can be configured according to the function safety requirement of the system. The isolated domains can be configured for all devices and all data in the computer system to achieve the safety isolation between devices of different safety levels, and / or achieve the safety isolation between devices and data of different safety levels. Alternatively, the isolated domains can also be configured only for part of the devices to achieve the isolation between the devices in the isolated domains and the devices outside the isolated domains. For example, the isolated domains are configured for the devices corresponding to ASIL D and the devices corresponding to ASIL C, and the isolated domains are not configured for the devices of other safety levels. Alternatively, the isolated domains can also be configured only for part of the data to achieve the isolation between the data in the isolated domains and the devices outside the isolated domains.

[0073] The safety isolation apparatus includes a request detection module 210 and a selection module 220.

[0074] The request detection module 210 receives an access request from an access device.

[0075] The access request carries operation information of the access device and safety level related information of the access device. For example, the access request carries the operation information of the access device and the safety level related information of the access device in a payload.

[0076] The safety level related information of the access device is used to indicate the safety level of the access device, and the operation information is used to indicate the operation of the access device. For example, the operation information can be an operation code (opcode).

[0077] Exemplarily, the request detection module 210 can decode the access request to obtain the operation information of the access device and the safety level related information of the access device. In this case, the request detection module 210 can also be referred to as a request decoder (RD) module.

[0078] Alternatively, the access request received by the request detection module 210 can be a decoded access request.

[0079] The selection module 220 isolates the access request in the case that the operation of the access device is a write operation or a read for ownership (RFO) operation, and the safety level of the access device meets the safety isolation condition.

[0080] In particular, the selection module 220 can be configured to route the access request. For example, the selection module 220 can be a multiplexer (MUX). The MUX can be configured to route the access request.

[0081] Isolating the access request means that the access device is not allowed to access the accessed data. For example, the selection module 220 can not route the access request to the accessed data. The computer system can further comprise a default slave. For example, the default slave can be an error handling device. The selection module 220 can route the access request to the default slave.

[0082] In particular, the security level of the access device satisfying the security isolation condition comprises that the security level of the access device is lower than a second security level. The second security level can be a fixed value or a variable value. The second security level can be related to the security level of the accessed data. For example, the second security level can be the security level of the accessed data.

[0083] Optionally, the access request further comprises security level related information of the accessed data. The security level related information of the accessed data is configured to indicate the security level of the access device. The security level of the access device satisfying the security isolation condition comprises that the security level of the access device is lower than the security level of the accessed data.

[0084] In embodiments of the present application, the higher the security level, the higher the security level.

[0085] In the case that the operation of the access device A is an RFO operation, the access device A can read the accessed data and obtain exclusive permission of the accessed data. The address of the accessed data is address A. The access device A can modify the data in the cache corresponding to the address A. In the case that the access device A obtains the exclusive permission of the accessed data, when the access device B needs to read the data corresponding to the address A, the access device B initiates monitoring and obtains the data in the cache of the access device A. That is, the data obtained by the access device B is the data modified by the access device A. In the case that the security level of the access device A is lower than the security level of the accessed data, the data obtained by the access device B is the data modified by the access device with a lower security level. If the security level of the access device B is the same as the security level of the accessed data, the functional safety requirement of the access device B cannot be met, for example, the error detection rate of the access device B cannot be guaranteed, resulting in system failure.

[0086] In the case that the operation of the access device A is a non-RFO read operation, the access device B can read the accessed data, instead of obtaining the data in the cache of the access device A. In this way, the access device A cannot affect other access devices by modifying the content in the cache of the access device A.

[0087] Therefore, by isolating the RFO operation request of the access device which meets the safety isolation condition, the modification of the data of the high safety level which leads to the failure to meet the system functional safety can be avoided.

[0088] Optionally, the selection module 220 can also allow the access request in the case that the operation of the access device is a non-write operation and a non-RFO operation, or the safety level of the access device does not meet the safety isolation condition.

[0089] Allowing the access request means allowing the access device to access the accessed data. For example, the selection module 220 can route the access request to the accessed data.

[0090] That is, in the case that the operation of the access device is a non-write operation and a non-RFO operation, for example, in the case that the operation of the access device is a non-RFO read operation, the selection module 220 can route the access request to the accessed data.

[0091] Or, in the case that the safety level of the access device does not meet the safety isolation condition, for example, in the case that the safety level of the access device is higher than or equal to the safety level of the accessed data, the selection module 220 can route the access request to the accessed data.

[0092] In this way, the access request which does not meet the safety isolation condition and the access request of the non-RFO read operation can be released. For example, the access device is allowed to perform the write operation or the RFO operation on the data of the same safety level or the low safety level, and the access device is allowed to perform the non-RFO read operation on the accessed data.

[0093] Further, the computer system can also include a functional safety module, for example, a functional safety CPU. The selection module 220 can also report a safety interrupt to the functional safety module to inform that a safety error has occurred, so that the system hang-up can be avoided, and the software can be visible, and the integrity of the functional safety is guaranteed.

[0094] Optionally, the safety isolation apparatus can also include a comparison module 230. The comparison module 230 can be used to determine whether the safety level of the access device is lower than the safety level of the accessed data. If the safety level of the access device is lower than the safety level of the accessed data, the comparison module 230 can output an isolation valid signal to the selection module 220.

[0095] Specifically, under the triggering of the isolation valid signal, for example, the output level of the isolation valid signal is high, the selection module 220 can isolate the access request. Figure 2In some embodiments, "0" can be understood as a low level, and "1" can be understood as a high level. In the absence of receiving the isolation valid signal, for example, the output level of the isolation valid signal is low, the selection module 220 can allow the access request.

[0096] The comparison module 230 can determine whether the security level of the access device is lower than the security level of the accessed data under the triggering of the enable signal.

[0097] The enable signal can be sent by the request detection module 210 to the comparison module 230.

[0098] Optionally, the security level related information of the accessed data includes the address of the accessed data. The comparison module 230 can determine whether the security level of the access device is lower than the security level of the accessed data according to the address of the accessed data. The comparison module 230 can also be referred to as an address comparison (AC) module.

[0099] If the request detection module can be used to decode the access request, the address of the accessed data can be obtained by the request detection module, as shown in Figure 2 The request detection module can transmit the address of the accessed data to the comparison module. It should be understood that the address of the accessed data can also be decoded by other devices in the computer system and then transmitted to the comparison module.

[0100] Exemplarily, the comparison module 230 can determine the security level of the accessed data according to the first mapping relationship, and then determine whether the security level of the access device is lower than the security level of the accessed data. The first mapping relationship is used to indicate the correspondence between the address of the data and the security level of the data.

[0101] The first mapping relationship can be stored in the security isolation device, or can be stored in the register in the computer system.

[0102] Optionally, the comparison module 230 can obtain the first mapping relationship from the register.

[0103] A plurality of isolation domains in the computer system can be determined by a plurality of sets of register information. The register information includes the attribute of the address domain of the security level corresponding to the isolation domain. The first mapping relationship can be the address domain attribute of the security level corresponding to the plurality of isolation domains. The address domain attribute of the security level corresponding to one isolation domain can include the security level corresponding to the isolation domain, the base address of the isolation domain, and the size of the isolation domain. The addresses in the address domain corresponding to each security level can be continuous addresses, or a plurality of discontinuous addresses.

[0104] It should be understood that the content of the register information can be set by a user, and embodiments of the present application do not limit the specific content of the register information.

[0105] Optionally, the comparison module 230 can perform the following steps to determine whether the security level of the access device is lower than the security level of the accessed data.

[0106] (1) Determine a first address according to a first mapping relationship. The first address includes one or more addresses corresponding to data of a first security level. The first security level includes one or more security levels higher than the security level of the access device.

[0107] For example, the security level of the access device is ASIL C, and the first security level includes ASIL D. For another example, the security level of the access device is ASIL B, and the first security level includes ASIL C and ASIL D.

[0108] Specifically, the comparison module 230 can obtain the starting address of the isolation domain corresponding to the first security level and the space size of the isolation domain corresponding to the first security level from the register.

[0109] The first security level can be determined by the comparison module 230. Alternatively, the first security level can also be obtained by the request detection module 210. Specifically, the access request is processed by the request detection module, the security level higher than the security level of the access device is determined as the first security level, and the first security level is transmitted to the AC module.

[0110] (2) If the address of the accessed data matches the address in the first address, it is determined that the security level of the access device is lower than the security level of the accessed data. The address of the accessed data matches the address in the first address can also be referred to as the address of the accessed data hits the address in the first address.

[0111] By configuring address regions of different security levels through the register machine group, the system can be simplified without using page tables and the like.

[0112] Optionally, the request detection module 210 can be used to determine whether the operation of the access device is a write operation or an RFO operation. For example, Figure 2 The request detection module 210 can judge the "operation code".

[0113] If the operation of the access device is a write operation or an RFO operation, the request detection module can output an enable signal to the comparison module 230 to enable the comparison module 230.

[0114] Optionally, the request detection module 210 can also be configured to determine whether the security level of the access device meets a preset condition. If the security level of the access device meets the preset condition and the operation of the access device is a write operation or an RFO operation, the request detection module 210 can send an enable signal to the comparison module 230 to enable the comparison module 230. For example, the security level of the access device is ASIL D, the operation of the access device is a write operation, and the security level of the access device is lower than ASIL D. In this case, the request detection module 210 can send an enable signal to the comparison module 230. Figure 2 In the above example, the determination of the security level is to determine whether the security level of the access device meets the preset condition.

[0115] For example, the preset condition can be lower than a preset security level. For example, the preset security level can include ASIL D, and if the operation of the access device is a write operation and the security level of the access device is lower than ASIL D, the request detection module can output an enable signal to the comparison module. For another example, the preset security level can include ASIL D, and if the operation of the access device is an RFO operation and the security level of the access device is lower than ASIL D, the request detection module can output an enable signal to the comparison module.

[0116] Optionally, the request detection module 210 can also be configured to determine whether the access request is valid. As shown in Figure 2 In the above example, the determination of the validity is to determine whether the access request is valid. If the access request is valid and the operation of the access device is a write operation or an RFO operation, the request detection module 210 can send an enable signal to the comparison module 230. In the case where the request detection module 210 is also configured to determine whether the security level of the access device meets the preset condition, the request detection module 210 can send an enable signal to the comparison module 230 in the case where the security level of the access device meets the preset condition, the operation of the access device is a write operation or an RFO operation, and the access request is valid. The enable signal is the isolation check enable signal in Figure 2 The isolation check enable signal is high, which can be understood as that the security check in the request detection module fails and the comparison module 230 needs to perform further security check.

[0117] If the access request is invalid, the comparison module 230 can send a signal to the selection module 220 to isolate the access request by the selection module 220. Alternatively, if the access request is invalid, the request detection module 210 can send a signal to the selection module 220 to isolate the access request by the selection module 220.

[0118] Optionally, the request detection module 210 can also be configured to determine whether the check information is the same as the content of the access request. The check information is obtained by copying the content of the access request. For example, the check information is obtained by copying the operation information of the access device, the security level related information of the accessed data, and the security level related information of the access device in the access request.

[0119] If the check information is different from the content of the access request, the request detection module 210 can send a signal to the selection module 220, and the selection module 220 isolates the access request. Alternatively, the request detection module 210 can send a signal to the selection module 220 through the comparison module 230, and the selection module 220 isolates the access request.

[0120] In an implementation mode, the RD module can parse the information carried in the access request, and identify whether the information other than the address information meets the isolation requirement. For example, Figure 2 The "and processing" in the "and processing" judges whether the security level, operation code and validity meet the isolation requirement. The AC module can be used for comparing the address information, that is, comparing the security level of the access device, so that multiple addresses can be compared at the same time, that is, the address of the accessed data is compared with multiple addresses stored in the register at the same time. For example, in the comparison module, the address comparison can be implemented in the address hit configurable window, and different security levels can set different address hit configurable windows, so that the address of the accessed data can be compared in multiple windows at the same time, which can improve the efficiency.

[0121] If the access device of the low security level overwrites the accessed data of the high security level, when the access device of the high security level uses the overwritten accessed data, the functional safety requirement of the access device of the high security level cannot be met, which leads to system failure. In the embodiment of the application, the devices and data of the computer system are divided according to the security level, so that the devices and data of different security levels can be isolated. By analyzing the access request, the access device meeting the isolation condition is prevented from overwriting the accessed data, the efficient data interaction between the devices of different security levels in the computer system is realized while meeting the functional safety requirement of the computer system, and the system performance is improved. For example, the access device of the low security level is prevented from overwriting the accessed data of the high security level, and the device of the low security level is prevented from affecting the device of the high security level.

[0122] Figure 3 is a schematic structural diagram of the computer system of the embodiment of the application. The computer system includes a security isolation device and an access device. The access device can be Figure 1 the device in the computer system.

[0123] When the access device initiates an access request, the access request is transmitted on the address bus with a hardware signal. When the hardware signal passes through the security isolation device, the security isolation device performs a security check on the hardware signal.

[0124] The position of the security isolation device can be allocated according to the functional safety requirement of the computer system.

[0125] In a possible implementation, the security isolation device can be directly connected with the access device, that is, the security isolation device can be located at the source end of the access request. In this case, the security isolation can be directly performed after the access request is issued.

[0126] As shown in (a) of FIG. 1, the access device is a CPU, and the security isolation device can be connected with the CPU. The CPU represents a plurality of CPU cores. Since the isolation is implemented based on the address, if the security request passing through the security isolation device reaches the PoC, the PoC can maintain the consistency of the access request passing through the isolation according to the address. For example, the security isolation is completed after the last level cache of the CPU, and the consistency maintenance of the cache between different security levels is implemented, so that the data cached in the cache is guaranteed to meet the system functional safety, that is, for the address in the memory, the stored data meets the system functional safety. Figure 3 In a possible implementation, the security isolation device can be directly connected with the access device, that is, the security isolation device can be located at the source end of the access request. In this case, the security isolation can be directly performed after the access request is issued.

[0127] In a possible implementation, the security isolation device can be directly connected with the access device, that is, the security isolation device can be located at the source end of the access request. In this case, the security isolation can be directly performed after the access request is issued.

[0128] Specifically, the security isolation device can be connected with the accessed device that has a security isolation requirement. Alternatively, it can be understood that the security isolation device can be connected with the accessed device that stores data of a high security level.

[0129] For example, the access device can include a plurality of CPUs, and the accessed device can include a memory, an IO device, and a register. The data stored in the memory, the IO, and the register is ASIL D, and then the security isolation device can be arranged at the input end of the device storing the data corresponding to ASIL D.

[0130] Figure 3 As shown in (b) of FIG. 1, the memory, the IO device, and the register are ASIL D, and the security isolation device can be arranged at the input end of the three devices.

[0131] In a possible implementation, the security isolation device can be located between the source end and the destination end of the access request, that is, the security isolation device can neither be connected with the accessed device nor be connected with the access device. ​

[0132] Alternatively, the access device can be connected to the bus via a secure isolation device.

[0133] like Figure 3 As shown in (c), the computer system bus can be a ring bus, and a security isolation device can be connected to the ring bus to ensure that all access requests are functionally safe before entering the bus. During data exchange throughout the system, only functionally safe access requests can exchange data; non-safe access requests can only exchange data within subsystems. When a computer system includes multiple subsystems, this reduces the design complexity of the subsystems. For example, a unified design of the subsystem interfaces reduces design complexity.

[0134] The following is combined Figure 4 The security isolation method of the embodiments of this application will be described. Figure 4 The security isolation method shown can be provided by Figure 2 or Figure 3 The security isolation device in the system is used to perform the operation. Repeated descriptions are appropriately omitted in the following description of the security isolation method according to embodiments of this application.

[0135] Figure 4 The security isolation method shown can be applied to a computer system that includes multiple devices and security isolation mechanisms with different security levels. The computer system can be an in-vehicle electronic system, and the security level can be the same as that of an in-vehicle electronic system, including: QM, ASIL A, ASIL B, ASIL C, and ASIL D.

[0136] Figure 4 The method 100 shown includes steps 110 to 120, which are described in detail below.

[0137] 110. The access device sends an access request, and the security isolation device receives the access request from the access device.

[0138] The access request includes information about the operation of the accessed device and information about the security level of the accessed device.

[0139] Security level information for accessing the device indicates its security level. Operation information indicates the operations required to access the device. For example, operation information can be an opcode.

[0140] The security isolation device can decode the access request to obtain the operation information of the accessed device and the security level information of the accessed device.

[0141] Alternatively, the access request received by the security isolation device can be a decoded access request.

[0142] Optionally, the method 100 further comprises step 111.

[0143] 111, the secure isolation device determines whether the operation of the access device is a write operation or an RFO operation.

[0144] Optionally, the method 100 further comprises step 112.

[0145] 112, the secure isolation device determines whether the security level of the access device meets the security isolation condition.

[0146] Specifically, the security level of the access device meeting the security isolation condition includes that the security level of the access device is lower than a second security level, which can be a fixed value or a variable value. The second security level can be related to the security level of the accessed data. For example, the second security level can be the security level of the accessed data.

[0147] Optionally, the access request further comprises security level related information of the accessed data. The security level related information of the accessed data is used to indicate the security level of the accessed device. The security level of the access device meeting the security isolation condition includes that the security level of the access device is lower than the security level of the accessed data.

[0148] Further, the security level related information of the accessed data comprises the address of the accessed data. Whether the security level of the access device is lower than the security level of the accessed data can be determined according to the address of the accessed data.

[0149] Illustratively, the security level of the accessed data can be determined according to a first mapping relationship, and then it is determined whether the security level of the access device is lower than the security level of the accessed data. The first mapping relationship is used to indicate the correspondence between the address of the data and the security level of the data.

[0150] The first mapping relationship can be stored in the secure isolation device or in the register in the computer system.

[0151] Optionally, whether the security level of the access device is lower than the security level of the accessed data can be determined by the following steps.

[0152] (1) Determine a first address according to a first mapping relationship. The first address comprises one or more addresses corresponding to a first security level. The first security level comprises one or more security levels higher than the security level of the access device.

[0153] For example, the security level of the accessing device is ASIL C, and the first security level includes ASIL D. For another example, the security level of the accessing device is ASIL B, and the first security level includes ASIL C and ASIL D.

[0154] (2) If the address of the accessed data matches the address in the first address, it is determined that the security level of the accessing device is lower than the security level of the accessed data. The address of the accessed data matches the address in the first address can also be referred to as the address of the accessed data hits the address in the first address.

[0155] Optionally, the method 100 can further include step 113.

[0156] 113, the security isolation device determines whether the security level of the accessing device meets the preset condition.

[0157] For example, the preset security level can include ASIL D, if the operation of the accessing device is a write operation, and the security level of the accessing device is lower than ASIL D, the request detection module can output an enable signal to the comparison module. For another example, the preset security level can include ASIL D, if the operation of the accessing device is an RFO operation, and the security level of the accessing device is lower than ASIL D, the request detection module can output an enable signal to the comparison module.

[0158] Optionally, the method 100 can further include step 114.

[0159] 114, the security isolation device determines whether the access request is valid.

[0160] If the access request is invalid, the access request is isolated.

[0161] Optionally, the method 100 can further include step 115.

[0162] 115, the security isolation device determines whether the verification information is the same as the content of the access request. The verification information is obtained by copying the content of the access request. For example, the verification information is obtained by copying the operation information of the accessing device, the security level related information of the accessed data, and the security level related information of the accessing device in the access request. If the verification information is different from the content of the access request, the access request is isolated.

[0163] 120, the security isolation device isolates the access request in the case that the operation of the accessing device is a write operation or an RFO operation, and the security level of the accessing device meets the security isolation condition.

[0164] Specifically, the security isolation device can be configured to route the access request. For example, a multiplexer (MUX) can be included in the security isolation device.

[0165] Isolating the access request can mean that the access device is not allowed to access the accessed data. For example, the security isolation device can not route the access request to the accessed data. The computer system can further include a default slave. For example, the default slave can be an error handling device. The security isolation device can route the access request to the default slave.

[0166] Alternatively, step 120 can further include that the security isolation device allows the access request in a case that the operation of the access device is a non-write operation and a non-RFO operation, or the security level of the access device does not satisfy the security isolation condition.

[0167] Allowing the access request means that the access device is allowed to access the accessed data. For example, the security isolation device can route the access request to the accessed data.

[0168] That is, in a case that the operation of the access device is a non-write operation and a non-RFO operation, for example, in a case that the operation of the access device is a non-RFO read operation, the security isolation device can route the access request to the accessed data.

[0169] Alternatively, in a case that the security level of the access device does not satisfy the security isolation condition, for example, in a case that the security level of the access device is higher than or equal to the security level of the accessed data, the security isolation device can route the access request to the accessed data.

[0170] In this way, the access request that does not satisfy the security isolation condition and the access request of the non-RFO read operation can be allowed. For example, the access device is allowed to perform a write operation or an RFO operation on data of the same security level or a lower security level, and the access device is allowed to perform a non-RFO read operation on the accessed data.

[0171] Further, the computer system can further include a functional safety module, for example, a functional safety CPU. The security isolation device can further report a safety interrupt to the functional safety module to inform that a safety error has occurred, so that it can be ensured that the system will not be hung up, and it is visible to the software, and the integrity of the functional safety is ensured.

[0172] In a case that the method 100 includes step 113, step 120 can be that, in a case that the security level of the access device satisfies the preset condition, the operation of the access device is a write operation or an RFO operation, and the security level of the access device satisfies the security isolation condition, the access request is isolated.

[0173] The step 111, the step 112 and the step 113 can be executed simultaneously or in a certain order.

[0174] For example, the step 113 and the step 111 are executed, and in the case that the security level of the accessed device meets the preset condition and the operation of the accessed device is a write operation or an RFO operation, the step 112 is executed. For another example, the step 113 is executed, and in the case that the security level of the accessed device meets the preset condition, the step 111 is executed. In the case that the operation of the accessed device is a write operation or an RFO operation, the step 112 is executed.

[0175] In the case that the method 100 includes the step 114, if the access request is valid, the step 120 can be executed.

[0176] It should be understood that the step 111, the step 112, the step 113 and the step 114 can be executed simultaneously or in a certain order.

[0177] In the case that the method 100 includes the step 115, if the verification information is the same as the content of the access request, the step 120 can be executed.

[0178] In the case that the method 100 includes the steps 114 and 115, if the access request is valid and the verification information is the same as the content of the access request, the step 120 can be executed. If the accessed data of the high security level is rewritten by the accessed device of the low security level, when the accessed device of the high security level uses the rewritten accessed data, the functional safety requirement of the accessed device of the high security level cannot be met, which leads to system failure. In the embodiment of the present application, the devices and data of the computer system are divided according to the security level, which can isolate the devices and data of different security levels. By analyzing the access request, the accessed data meeting the isolation condition is prevented from being rewritten by the accessed device, the efficient data interaction between the devices of different security levels in the computer system is realized, and the system performance is improved. For example, the accessed data of the high security level is prevented from being rewritten by the accessed device of the low security level, and the device of the low security level is prevented from affecting the device of the high security level.

[0179] According to the scheme of the embodiment of the present application, the data of the high security level is prevented from being rewritten by the device of the low security level, the system functional safety is ensured, and the non-RFO read operation of any security level is allowed. The write operation and the RFO operation of the accessed device on the data of the same security level or the low security level are allowed, the efficient interaction of the data in the system is realized, and the system performance is ensured.

[0180] Figure 5is a schematic block diagram of a computer system of an embodiment of the present application. The computer system comprises a plurality of devices of different security levels, for example, Figure 5 The access device 510 and the security isolation apparatus 520 shown in FIG. 5. It should be understood that the computer system and the security isolation apparatus introduced below can perform the corresponding steps of the communication method of the embodiments of the present application, and the repeated description is appropriately omitted below when introducing the computer system and the security isolation apparatus of the embodiments of the present application.

[0181] The access device 510 is configured to send an access request. The access request carries operation information of the access device and security level related information of the access device, and the security level related information of the access device is used to indicate the security level of the access device, and the operation information is used to indicate the operation of the access device.

[0182] The security isolation apparatus 520 is configured to receive the access request, and in the case that the operation of the access device is a write operation or an RFO operation, and the security level of the access device meets the security isolation condition, isolate the access request. Isolating the access request means not allowing the access device to access the accessed data.

[0183] Optionally, the security isolation apparatus 520 is further configured to, in the case that the operation of the access device is a non-write operation or a non-RFO operation, or the security level of the access device does not meet the security isolation condition, allow the access request. Allowing the access request means allowing the access device to access the accessed data.

[0184] Optionally, the access request further comprises security level related information of the accessed data, the security level related information of the accessed data is used to indicate the security level of the accessed data, and the security level of the access device meeting the security isolation condition comprises that the security level of the access device is lower than the security level of the accessed data.

[0185] Those skilled in the art can clearly understand that the units and algorithm steps of the examples described in combination with the embodiments disclosed herein can be realized by electronic hardware or a combination of computer software and electronic hardware. Whether the functions are realized in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of the present application.

[0186] Those skilled in the art can clearly understand that, for the convenience and brevity of the description, the specific working process of the system, apparatus and unit described above can refer to the corresponding process in the foregoing method embodiments, which will not be described here.

[0187] In several embodiments provided in the present application, it should be understood that the disclosed system, device and method can be implemented in other manners. For example, the described device embodiments are merely schematic. The division of the units is merely logical function division. There can be other division manners in actual implementation. For example, a plurality of units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the displayed or discussed mutual couplings or direct couplings or communication connections can be indirect couplings or communication connections through some interfaces, devices or units, and can be in electrical, mechanical or other forms.

[0188] The units described as separate components can or can not be physically separate, and the components shown as units can or can not be physical units, i.e., can be located in one place, or can be distributed on a plurality of network units. Some or all of the units can be selected according to actual needs to achieve the purpose of the embodiment.

[0189] In addition, each functional unit in the various embodiments of the present application can be integrated into a processing unit, or each unit can be a physically separate unit, or two or more units can be integrated into one unit.

[0190] If the functions are realized in the form of software function units and sold or used as independent products, they can be stored in a computer readable storage medium. Based on this understanding, the technical solutions of the present application can be embodied in the form of a software product, and the computer software product is stored in a storage medium, and includes a number of instructions for causing a computer device (which can be a personal computer, a server, or an access network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present application. The foregoing storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and various media that can store program codes.

[0191] The above description is merely a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art can easily think of changes or replacements within the technical scope disclosed in the present application, which should be covered within the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.

Claims

1. A safety isolation device, characterized in that, It includes a request detection module, a selection module, and a comparison module, among which, The request detection module is used to: receive an access request from an access device, the access request carrying the operation information of the access device and the security level information of the access device, the security level information of the access device being used to indicate the security level of the access device, the security level being the security level of the vehicle electronic system, and the operation information being used to indicate the operation of the access device; The selection module is used to: isolate the access request when the operation of the accessing device is a write operation or a read RFO operation with permission acquisition, and the security level of the accessing device meets the security isolation condition. The access request also includes security level-related information of the accessed data, which is used to indicate the security level of the accessed data. The security isolation condition is that the security level of the accessing device is lower than the security level of the accessed data. Isolating the access request means that the accessing device is not allowed to access the accessed data. The comparison module is used to: determine whether the security level of the access device meets the security isolation conditions.

2. The apparatus as claimed in claim 1, characterized in that, The selection module is also used for: The access request is permitted if the operation on the accessing device is a non-write operation and a non-RFO operation, or if the security level of the accessing device does not meet the security isolation conditions.

3. The apparatus as described in claim 1, characterized in that, The security level information related to the accessed data includes the address of the accessed data, and the comparison module is used for: The security level of the accessing device is determined to be lower than the security level of the accessed data based on the address of the accessed data.

4. The apparatus as described in claim 3, characterized in that, The comparison module is used for: A first address is determined according to a first mapping relationship, wherein the first address includes one or more addresses corresponding to data of a first security level, the first security level includes one or more security levels higher than the security level of the access device, and the first mapping relationship is used to indicate the correspondence between the security level of the data and the address of the data; If the address of the accessed data matches the address in the first address, then it is determined that the security level of the accessing device is lower than the security level of the accessed data.

5. The apparatus as described in claim 4, characterized in that, The comparison module is also used for: Obtain the first mapping relationship from the register group.

6. The apparatus as claimed in any one of claims 1 to 5, characterized in that, The selection module is also used for: If the operation on the accessed device is a write operation or an RFO operation, and the security level of the accessed device meets the security isolation conditions, a security interruption is reported.

7. A computer system, characterized in that, Includes security isolation devices and access equipment, among which, The access device is used to: send an access request, wherein the access request carries the operation information of the access device and the security level information of the access device, the security level information of the access device is used to indicate the security level of the access device, the security level being the security level of the vehicle electronic system, and the operation information is used to indicate the operation of the access device; The security isolation device is used to: receive the access request, and isolate the access request when the operation of the accessing device is a write operation or a read RFO operation with permission acquisition, and the security level of the accessing device meets the security isolation condition. The access request also includes security level-related information of the accessed data, which is used to indicate the security level of the accessed data. The security isolation condition is that the security level of the accessing device is lower than the security level of the accessed data. Isolating the access request means that the accessing device is not allowed to access the accessed data.

8. The system as described in claim 7, characterized in that, The safety isolation device is also used for: The access request is permitted if the operation on the accessing device is a non-write operation and a non-RFO operation, or if the security level of the accessing device does not meet the security isolation conditions.

9. A secure isolation method, characterized in that, include: Receive an access request from an access device, the access request carrying the operation information of the access device and the security level information of the access device, the security level information of the access device being used to indicate the security level of the access device, the security level being the security level of the vehicle electronic system, and the operation information being used to indicate the operation of the access device; If the operation of the accessing device is a write operation or a read RFO operation with permission acquisition, and the security level of the accessing device meets the security isolation condition, the access request is isolated. The access request also includes security level-related information of the accessed data, which is used to indicate the security level of the accessed data. The security isolation condition is that the security level of the accessing device is lower than the security level of the accessed data. Isolating the access request means that the accessing device is not allowed to access the accessed data.

10. The method as described in claim 9, characterized in that, The method further includes allowing the access request if the operation of the accessing device is a non-write operation and a non-RFO operation, or if the security level of the accessing device does not meet the security isolation conditions.

11. The method as described in claim 10, characterized in that, The security level information related to the accessed data includes the address of the accessed data, and The security level of the accessing device is lower than the security level of the accessed data, including: The security level of the accessing device is determined to be lower than the security level of the accessed data based on the address of the accessed data.

12. The method as described in claim 11, characterized in that, The step of determining that the security level of the accessing device is lower than the security level of the accessed data based on the address of the accessed data includes: A first address is determined according to a first mapping relationship, wherein the first address includes one or more addresses corresponding to data of a first security level, the first security level includes one or more security levels higher than the security level of the access device, and the first mapping relationship is used to indicate the correspondence between the security level of the data and the address of the data; If the address of the accessed data matches the address in the first address, then it is determined that the security level of the accessing device is lower than the security level of the accessed data.

13. The method as described in claim 12, characterized in that, The method further includes: Obtain the first mapping relationship from the register group.

14. The method according to any one of claims 9 to 13, characterized in that, The method further includes: If the operation on the accessed device is a write operation or an RFO operation, and the security level of the accessed device meets the security isolation conditions, a security interruption is reported.

Images