Apparatus and method for memory system verification

Abstract

A data processing apparatus is provided for verifying a memory system. A processing circuit system issues multiple memory access requests to multiple addresses in the memory. A trust point circuit system receives the memory access requests from the processing circuit system via a first set of intermediate circuits. A secure channel circuit system implements secure communication of the mapping relationship between the multiple addresses from the processing circuit system to the trust point circuit system. The trust point circuit system determines, based on the mapping relationship, whether the addresses in the memory corresponding to the memory access requests received via the first set of intermediate circuits have a predetermined relationship.

Description

[0001] This invention relates to data processing systems. Specifically, it is relevant to the field of memory systems, and particularly to their verification.

[0002] In data processing systems, different components can be manufactured by different companies and combined to create a single system (such as a system-on-a-chip or SoC). Therefore, situations can arise where one component must trust a second component, even if the second component (not to mention its trustworthiness) was unknown during the design of the first component. This is particularly problematic in security systems where the integrity or security of data can be compromised by malicious third parties or poorly programmed components.

[0003] From a first exemplary configuration, a data processing apparatus is provided, comprising: a processing circuit system adapted to issue multiple memory access requests to multiple addresses in a memory; a trust point circuit system configured to receive the memory access requests from the processing circuit system via a first set of intermediate circuits; and a secure channel circuit system configured to implement secure communication of the correspondence between the multiple addresses from the processing circuit system to the trust point circuit system, wherein the trust point circuit system is adapted to determine, based on the correspondence, whether the addresses in the memory of the memory receiving the memory access request via the first set of intermediate circuits have a predetermined relationship.

[0004] From a second exemplary configuration, a data processing method is provided, the data processing method comprising: issuing a plurality of memory access requests to a plurality of addresses in memory; receiving the memory access request from a processing circuit system via a first set of intermediate circuits at a trusted point circuit system; implementing secure communication to establish a correspondence between the plurality of addresses from the processing circuit system to the trusted point circuit system; and determining, based on the correspondence, whether the addresses in the memory of the memory for which the memory access request was received via the first set of intermediate circuits has a predetermined relationship.

[0005] From a third exemplary configuration, a data processing apparatus is provided, the data processing method apparatus comprising: means for issuing a plurality of memory access requests to a plurality of addresses in a memory; means for receiving the memory access requests from the processing circuit system via a first set of intermediate circuits; means for secure communication for establishing a correspondence between the plurality of addresses from the means for issuing the plurality of memory access requests to the means for receiving the memory access requests; and means for determining, based on the correspondence, whether the addresses in the memory of the memory receiving the memory access requests via the first set of intermediate circuits have a predetermined relationship.

[0006] The present invention will be further described by way of example only, with reference to embodiments shown in the accompanying drawings, wherein: Figure 1A An example of an aliasing attack is shown; Figure 1B An example of a redirection attack is shown; Figure 1C An example of an interconnect corruption attack is shown; Figure 2 A system-on-a-chip including apparatus is schematically illustrated according to some embodiments; Figure 3 An overview of the verification process based on some implementation schemes is presented; Figure 4 This is a flowchart of the first phase of the verification process, based on some implementation plans; Figure 5 This is a flowchart of the second phase of the verification process, based on some implementation schemes; Figure 6 This is a flowchart of the third phase of the verification process, based on some implementation schemes; and Figure 7 This is a flowchart of a runtime test covering the verification process, according to some embodiments.

[0007] Before discussing the implementation scheme with reference to the accompanying drawings, the following description of the implementation scheme and its associated advantages is provided.

[0008] According to an exemplary configuration, a data processing apparatus is provided, comprising: a processing circuit system adapted to issue a plurality of memory access requests to a plurality of addresses in a memory; a trust point circuit system configured to receive the memory access requests from the processing circuit system via a first set of intermediate circuits; and a secure channel circuit system configured to implement secure communication of a mapping relationship between the plurality of addresses from the processing circuit system to the trust point circuit system, wherein the trust point circuit system is adapted to determine, based on the mapping relationship, whether the addresses in the memory of the memory receiving the memory access request via the first set of intermediate circuits have a predetermined relationship.

[0009] The trust point circuitry acts as a hardware proxy, mediating between the memory and processing circuitry. By issuing multiple memory access requests intercepted by the trust point circuitry with predetermined correspondences to the memory, the intercepted memory access requests can be examined to determine if the same predetermined correspondence can be inferred. If the correspondence cannot be inferred from the relationship between the intercepted memory access requests, it can be assumed that the circuitry (the first set of intermediate circuitry) through which the memory access request passed is not functioning correctly, and memory aliasing can be allowed, for example, to access secret or privileged data. A secure channel is used to transmit the (true) correspondence from the processing circuitry to the trust point circuitry, making the relationship verifiable. There are multiple ways in which the predetermined correspondence can be expressed. In some implementations, the relationship is the same as the correspondence. For example, if the memory access requests are made with a specific span, the same span can be represented in the correspondence. In other implementations, the underlying memory can use memory striping to distribute workloads across multiple memories. In such cases, the address of the intercepted memory access request will be a multiple of the span value, corresponding to the number of memories across which the memory access request is distributed.

[0010] In some examples, data transmitted via a secure channel is unaffected by the configuration of the first set of intermediate circuits. There are multiple ways to implement a secure channel. In some examples, the secure channel avoids or does not use the first set of intermediate circuits, making it impossible for the first set of intermediate circuits to affect any communication transmitted along the secure channel. In other examples, the secure channel may use intermediate circuits and, alternatively, encryption, where each of the processing circuitry and the trust point circuitry system has access to a decryption key that enables secure transmission of communication without interception or modification by the intermediate circuitry. In some examples, the secure channel uses the structure of intermediate circuits but is unaffected by any software configuration of the intermediate circuits. For example, communication transmitted via a secure channel may be unaffected by the software configuration of the intermediate circuits that could affect normal memory access.

[0011] In some examples, the trust point circuitry system is adapted to determine the address range of the memory addressed by the memory access request and provide that address range to the processing circuitry system via the secure channel; and the processing circuitry system is adapted to determine whether the memory includes invalid addresses based on the address range. Upon receiving the memory access request, the trust point circuitry system determines the range of memory addresses associated with the memory access request. This range may represent, for example, the minimum and maximum addresses addressed by the memory access request. This address range is provided to the processing circuitry system via the secure channel so that the address range cannot be modified by any intermediate circuit in the first set of intermediate circuits. Using this information, the processing circuitry system determines whether the memory includes one or more invalid addresses. Specifically, the address range determined by the trust point circuitry system may indicate that one or more addresses are invalid. This can be performed using range information from a single trust point circuitry, or it can be determined based on multiple ranges provided by multiple trust point circuitries.

[0012] In some examples, an invalid address is an address associated with multiple memories. One example of an invalid address is an address associated with multiple memories. Specifically, multiple memories can cover the same address if two trust point circuits each indicate overlapping ranges. This would be an indication of memory aliasing, where, for example, a secure region of a memory is mapped onto a non-secure region of a memory that can be accessed by a malicious agent. Note that there are valid cases where ranges can overlap. For example, in the case of memory striping, the boundaries of addresses accessed by each memory can overlap. However, even in this case, a single address should not be directed toward multiple memories.

[0013] In some examples, an invalid address is a memory-irrelevant address. Another example of an invalid address is a memory-irrelevant address. Specifically, if the memory range provided by each trust point circuit in the trust point circuitry reveals many gaps in the entire memory address space, this indicates that a particular address is not booting into any particular memory. Such a situation can be considered so unusual that it should be flagged as an error. Specifically, such a situation can indicate that an attacker has booted an address into private memory that the attacker can observe or modify. Such a situation can also indicate that an attacker has configured the interconnect to discard all writes to that location and respond to all reads with a constant value (e.g., 0).

[0014] In some examples, the trust point circuitry is adapted to signal an error in response to receiving a subsequent memory request for an address outside the specified address range. After determining the memory address range associated with the memory connected to the trust point circuitry, if the trust point circuitry receives a later / additional memory request for an address outside this range, this indicates that the intermediate circuitry directing the memory access request is not functioning correctly. Specifically, this is because the trust point circuitry is receiving a memory access request for memory it cannot control. This could be an indication of memory aliasing, and thus an error signal (e.g., by triggering an exception or fault, or by disconnecting or restricting the use of the intermediate circuitry).

[0015] In some examples, the data processing apparatus includes a generating circuit system for generating pseudo-random numbers based on a seed value to perform an integrity check. The numbers generated by the generating circuit system are not truly random. Specifically, the generated numbers have the appearance of randomness, but are based on a provided seed value. Therefore, although a series of outputs from the generating circuit system has the appearance of randomness, this randomness can be predicted or reproduced if the same seed value is provided. In this way, the generating circuit system can be used to perform an integrity check. This is because the output of the generating circuit system is unknown to the intermediate circuit system. However, after generating a “random” series of numbers, the same series of numbers can be regenerated by restoring the seed value. Thus, a set of “random” data can be generated where the unpredictability of the output makes it difficult to predict the data in advance. To check that the data has not changed, it is only necessary to restore the seed value and regenerate the output, comparing these outputs with the received data. The two sets of numbers should match because they were generated using the same seed value.

[0016] In some examples, the trust point circuitry system is adapted to forward requests to memory via a second set of intermediate circuits. Therefore, the trust point circuitry system acts as a mediator not only between the processing circuitry system and the memory, but also between the first and second sets of intermediate circuits. This allows the trust point circuitry system to participate in checking the validity of both sets of intermediate circuits. Note that when multiple trust point circuits are provided, such as when testing multiple memory ports, each trust point circuitry can forward requests in parallel via its corresponding second set of intermediate circuits.

[0017] In some examples, the second set of intermediate circuitry includes a memory controller. The memory controller may provide one or more ports to which memory, such as DRAM, is connected. Specifically, the memory controller may be responsible for receiving memory requests and sending a series of signals corresponding to the memory request to execute the request.

[0018] In some examples, the integrity check includes a second set of integrity checks; and the trust point circuitry system is adapted to perform the second set of integrity checks on a predetermined address in the memory by: setting the seed value to a predetermined value; transmitting a memory write request including the pseudo-random number to the predetermined address via the second set of intermediate circuitry; resetting the seed value to the predetermined value; transmitting a memory read request to the predetermined address in the memory via the second set of intermediate circuitry; and comparing the result of the memory read request with the pseudo-random number. One of the checks included in the integrity check is the second set of integrity checks, which is responsible for checking the integrity of the second set of intermediate circuitry. This is achieved by setting the seed value of the generation circuitry system to a predetermined value. The trust point circuitry system then transmits the memory write request to the memory via the second set of intermediate circuitry. The write request causes it to write the data value generated by the generation circuitry system using the seed value to the memory. After the write request is issued, the seed value in the generation circuitry system is reset to the predetermined value. After resetting the seed value, the next value generated by the generation circuitry system will correspond to the data written to the memory. Therefore, when a memory read request is issued to the same address provided for the write request, the returned data should correspond to the next value obtained by the generation circuitry system. The two values ​​are compared to determine if a match exists. If such a match occurs, it indicates that the integrity of the second set of intermediate circuits is intact, verifying that the write request was complied with (e.g., the correct data was written without modification). Since the written data is "random," it cannot be predicted by the second set of intermediate circuits, which lack access to the seed value. However, since the generator is pseudo-random, the value can be recreated to test the value stored in memory. Therefore, it is not necessary to keep a copy of the generated value—only the seed value needs to be kept. As explained earlier, this test can be performed in parallel across each trust point circuit and its corresponding second set of intermediate circuits.

[0019] In some examples, the integrity check is performed on multiple addresses by executing multiple memory write requests, including the memory write request, followed by multiple memory read requests, including the memory read request; and the pseudo-random number is changed for each of the multiple memory write requests and each of the multiple memory read requests based on the seed value. The integrity check can be performed by issuing multiple memory write requests. In this case, a different value is obtained from the generation circuitry for each memory write request. After executing a series of write requests, the seed value is reset, and a corresponding series of read segment requests are issued to read data from memory. The result of each read request is then compared with each output of the generation circuitry to determine a match. If any mismatch exists, this indicates that the integrity of the second set of intermediate circuitry is invalid.

[0020] In some examples, integrity checks include a first set of integrity checks; and The processing circuitry is adapted to perform the first set of integrity checks on the predetermined address in the memory by: setting the seed value to the predetermined value; and transmitting a memory write request including the pseudo-random number to the trust point circuitry via the first set of intermediate circuits; and the trust point circuitry is adapted to perform the first set of integrity checks on the predetermined address in the memory by: resetting the seed value to the predetermined value; and The pseudo-random number in the memory write request received by the trust point circuit system is compared with the output of the generation circuit system. A first set of integrity checks can be performed as part of the integrity check. The first set of integrity checks examines the integrity of the first set of intermediate circuits. In this case, the processing circuit system issues a write request including a pseudo-random number to the trust point circuit system through the first set of intermediate circuits. Upon receiving the write request, the trust point circuit system compares the data value received in the write request with the output of the generation circuit system that resets the seed value. In this way, the integrity of the first set of intermediate circuits can be tested by determining whether the value sent by the processing circuit system in the write request corresponds to the same data value received by the trust point circuit system. Similarly, since the data value provided in the write request is "random," it cannot be predicted by the first set of intermediate circuits, which lacks access to the generation circuit system and its seed value. However, since the data value is pseudo-random, it can be regenerated given a seed value. Note that there are multiple ways in which both the processing circuit system and the trust point circuit system can use the generation circuit system. Each circuit system in the processing circuit system and the trust point circuit system may include its own generation circuit system configured in the same way. In this scenario, the seed value can be transmitted between the processing circuit system and the trust point circuit system via a secure channel to ensure that the data value generated at the trust point circuit system corresponds to the data value generated at the processing circuit system. Alternatively, a single generation circuit can be shared between each circuit system in the processing circuit system and the trust point circuit system, where each circuit system has secure access to the generation circuit system. Note that multiple trust points can be tested in parallel using the same seed across multiple trust point circuit systems.

[0021] In some examples, the trust point circuitry prevents the system from responding to a write request to the memory by writing data to that memory. Specifically, write requests that are not required as part of an integrity check do not actually involve physically writing data to the memory. After performing the integrity check, the trust point circuitry can ignore the memory write request.

[0022] In some examples, the data processing apparatus includes: a plurality of processing circuitry systems, wherein at most one of the processing circuitry systems is adapted to determine, based on the correspondence, whether the address in the memory for which the memory access request is received via the first set of intermediate circuits has the predetermined relationship; the at most one processing circuitry system is adapted to perform integrity checks in addition to the first set of integrity checks; and each processing circuitry system is adapted to perform the first set of integrity checks upon power-up. In these examples, a single processing circuitry system performs certain checks, while other checks are performed by each processing circuitry system. Specifically, one processing circuitry system is responsible for performing the first set of integrity checks upon power-up to determine that the path of the processing circuitry system through the first set of intermediate circuits is valid and to establish a global mapping of addresses to trusted points. Other tests need to be performed by only a single processing circuitry system. In this way, a series of tests yields a valid and verified conclusion about the memory system. At the same time, a single processing circuit system can be powered on and off and its access to the memory circuit system can be tested, even if the memory itself is currently in use (e.g., via other processing circuits that are already powered on).

[0023] In some examples, the trust point circuitry system is adapted to store at least one predetermined value in at least one corresponding predetermined location in the memory, calculate a set of integrity values ​​corresponding to the at least one predetermined value, and store the integrity values ​​respectively; and in response to a predetermined event, the trust point circuitry system is adapted to calculate another set of integrity values ​​based on the at least one predetermined value stored in the at least one corresponding predetermined location, and compare the other set of integrity values ​​with the first set of integrity values. After startup, multiple tests can be performed on a continuous basis to determine whether the memory system has been disturbed. Specifically, one test is to use so-called “canary lines” that are strategically written to memory regions. The contents of these lines can be predetermined or random. In either case, integrity values ​​corresponding to the data values ​​stored in the lines are generated. These integrity values ​​are then securely stored. In response to a predetermined event (such as the expiration of a timer, a period of no memory access, or an explicit signal from the processing circuitry system), one or more of these lines are accessed from memory, and the integrity values ​​are recalculated. The recalculated integrity values ​​should correspond to those integrity values ​​that have been securely stored. If not, this indicates that the data values ​​have been modified in memory.

[0024] In some examples, the set of integrity values ​​and another set of integrity values ​​are generated from at least one of the following: a hash value; a cyclic redundancy check value; a checksum; and a key hash message authentication code. The exact algorithm used to generate the integrity values ​​is one of the design choices, and several algorithms will be known to those skilled in the art.

[0025] In some examples, the first set of intermediate circuitry includes a switch. A switch can be used to transfer messages from one location to another. Typically, there are multiple possible sources and / or multiple possible destinations. This allows communication to be transmitted from any input to any output. Examples of switches include interconnects and buses.

[0026] In some examples, the multiple addresses of the memory access request issued by the processing circuitry are multiple logical addresses; and the multiple addresses of the memory access request received by the trust point circuitry are multiple physical addresses. In these examples, the address spaces of the logical addresses and the physical addresses are different. That is, logical addresses and physical addresses may ultimately refer to the same region of memory, but physical addresses may refer to specific circuitry, and logical addresses may be part of a different (e.g., larger) address space that can be translated into a physical address space.

[0027] The specific implementation scheme will now be described with reference to the accompanying drawings.

[0028] Intermediate circuitry systems, such as those in interconnected systems of requesters and subordinates, can be used to circumvent memory protection controls in order to access controlled areas of memory or otherwise compromise the system—whether maliciously or through various means due to poor programming. Figure 1A An aliasing attack (also known as a remapping attack) is illustrated. In this case, the intermediate circuitry system can take the form of a memory controller or an interconnect that acts as a mediator between the processing circuitry system and the memory. In this example, the virtual address space includes memory blocks used by the victim 30. This is mapped to a region of the physical DRAM 40. However, the insecure subsystem 10, which is an intermediate circuitry and can take the form of an interconnect or a memory controller, also causes this region of the DRAM 40 to be mapped to a second region 20 of the virtual address space. That is, the physical DRAM 40 can be accessed by either the victim's memory region 30 or the attacker's memory region 20. In this way, the protection established by the memory protection unit (MPU) can be ignored. Specifically, the attacker may have free access to their virtual address space region 20, thereby enabling them to read the physical DRAM 40 that the victim would consider secure.

[0029] Figure 1BAn example of a redirection attack is illustrated. Here, for example, the insecure subsystem 60 could take the form of an interconnect or other switch. Typically, the victim's address space 50 is mapped by the insecure subsystem 60 to a secure area of ​​DRAM 70. During this process, data sent to the victim's DRAM 70 is encrypted, making it inaccessible to another process. However, in this example, the insecure subsystem 60 causes the transaction to be instead transmitted to a DRAM area compromised by the attacker 80. If this DRAM were not encrypted, the attacker could freely read the transaction's contents at a later time.

[0030] Figure 1C An example of an interconnect corruption attack that can be used to corrupt data is shown. In this example, a processing element issues a write request to an insecure subsystem. The write request in this example is directed to an address that controls whether security is enabled, and the data value is set to true to indicate that security should be enabled. Here, there are several actions the insecure subsystem can take. For example, the insecure subsystem could disable a first-in-first-out (FIFO) queue or otherwise enable debug mode, which could lead to data corruption. Several possible outcomes can be achieved to prevent the enabled secure mode. In the first outcome, the data generated by the insecure subsystem is simply a write request, where the data is set to false instead of true. In this way, security is not enabled. The second outcome is simply to silently discard the write request. Therefore, the write request is not sent from the insecure subsystem to the DRAM, and thus the secure mode is not set to true.

[0031] It should be understood that other attacks can be performed to disrupt addressing or data writing processes.

[0032] Figure 2A system-on-a-chip (SoC) is shown that communicates with multiple memories 190a, 190b, and 190c via corresponding memory ports 180a, 180b, and 180c. The SoC communicates with the memories 190a, 190b, and 190c via memory controllers 170a, 170b, and 170c via ports 180a, 180b, and 180c. These memory controllers are considered untrusted because they may be provided by an entity different from the entity providing the other components of the SoC. Therefore, each memory port 180a, 180b, and 180c is associated with trust point circuitry 150a, 150b, and 150c, which is provided by the SoC provider. Trust point circuitry 150a, 150b, and 150c is connected to interconnect 140. Similarly, interconnect 140 is considered untrusted because it is not provided by the SoC provider. Also connected to the interconnect are one or more processing clusters 130a and 130b. In this example, two such clusters 130a and 130b are shown. The first cluster includes a pair of processing circuits in the form of CPUs 100a and 100b. Similarly, the second processing cluster 130b also includes a pair of CPUs 100c and 100d. Each CPU in CPUs 100a, 100b, 100c, and 100d executes management software that manages the execution of multiple tests to determine the trustworthiness of interconnect 140 and memory controllers 170a, 170b, and 170c. Note that in this example, each CPU in CPUs 100a, 100b, 100c, and 100d includes a corresponding memory protection unit (MPU) 120a, 120b, 120c, and 120d. The MPU is responsible for translating the logical memory addresses provided by the corresponding CPU into physical addresses that the memory controllers 170a, 170b, and 170c can understand. In addition, the MPU is responsible for implementing security elements, such as restricting which parts of memory 190a, 190b, and 190c can be accessed.

[0033] Each of CPUs 100a, 100b, 100c, and 100d includes a secure channel to each of the trust point circuits 150a, 150b, and 150c. The secure channel enables the secure transmission of small amounts of configuration information to the trust point circuits 150a, 150b, and 150c. Specifically, the transmitted data cannot be intercepted or modified by, for example, interconnect 140. That is, interconnect 140 cannot modify data sent via the secure channel due to software / dynamic configuration values. In other embodiments, the secure channel traverses interconnect 140 and security is achieved through encryption. Specifically, each of the processing circuits 100a, 100b, 100c, and 100d may be able to encrypt messages that can be decrypted by the associated trust point circuits 150a, 150b, and 150c. In some other examples, the secure channel completely avoids interconnect 140 and provides a separate circuit system to enable secure communication.

[0034] In this embodiment, each of the CPUs 100a, 100b, 100c, and 100d includes pseudo-random number generators 110a, 110b, 110c, and 110d. Furthermore, each of the trust point circuits 150a, 150b, and 150c includes pseudo-random number generators 160a, 160b, and 160c. The pseudo-random number generators are capable of generating a stream of numbers with a random appearance. However, in reality, the stream of numbers is determined by a provided seed value. In this way, if the seed value is unknown, the stream of numbers originating from the pseudo-random number generator can be processed as random. However, if the seed value is known, a series of values ​​can be predicted. Therefore, if each of the pseudo-random number generators 110a, 110b, 110c, and 110d in the processing circuits 100a, 100b, 100c, and 100d matches the same seed value as the pseudo-random number generators 160a, 160b, and 160c in the trust point circuits 150a, 150b, and 150c, then each generator will produce the same stream of random numbers.

[0035] Figure 3An overview of the verification process is presented. The verification process consists of two sets of tests. The first set of tests is performed when the on-chip system boots up. This set of tests consists of three phases. The second set of tests is performed periodically while the system remains active and is used to provide continuous verification of the memory system. Within this overview, a pair of processing circuits (PE1, PE2) are provided. These are connected to an interconnect to which a first trust point circuit and a second trust point circuit (POT1, POT2) are provided. The trust point circuits (POT1, POT2) act as hardware verification proxies for the two physical memories (DRAM1, DRAM2). Specifically, the first trust point circuit (POT1) is associated with the first DRAM (DRAM1), and the second trust point circuit (POT2) is associated with the second DRAM (DRAM2). In this example, the interconnect circuitry system existing between the trust point circuits and the DRAMs, as well as the memory controller, is initially untrusted because they are provided by a third party.

[0036] The first phase is executed by a single processing circuit. Here, one or more access requests are sent to each of the trust point circuits. In some implementations, a series of access requests are set to cover the entire memory address space. Since each access request returns a predetermined amount of data, each address in the access request's address is separated by a span value. For example, each access request may return 64 bits of data. Therefore, each address in the access request's address is also separated by 64 bits – a span length. At the trust point circuit, each trust point circuit systematically checks the relationship between the received addresses. From the addresses of the access requests received at each trust point circuit, the span value (which can be transmitted via a secure channel) should be clear. For example, each address in the address may be separated by the same span value. In other examples, where memory striping can be used to evenly distribute memory addresses among multiple memories, each address in the access request received at one of the trust point circuits may be separated by a multiple of the span value. For example, in this example, two memories are provided. If memory striping is being used, the address received by each trust point circuit in the trust point circuit is expected to be twice the span value. Span values ​​can be transmitted using a secure channel, allowing the relationship to be checked at the trust point circuit. In addition to checking these relationships, each trust point circuit determines boundary information for the requests it receives. Specifically, each trust point circuit determines the upper and lower limits of each access request received by that trust point circuit. These are then transmitted back to the processing element (PE1) being tested. This information can also be transmitted using a secure channel. After receiving the boundary information, the processing element then determines the validity of the boundaries. Specifically, there should be no memory addresses that overlap (indicating aliasing is valid). Additionally, there should be no memory addresses with any gaps (i.e., no memory is applicable). Note that this is not necessarily as simple as determining whether the boundary information provided by each trust point circuit overlaps. Specifically, overlap can reasonably occur in the case of memory striping. Therefore, it is necessary to consider that despite features such as memory striping, there may be memory violations that could cause an address to reference multiple physical memories or an address not referencing any memory (for example).

[0037] Therefore, the first phase seeks to determine whether the received memory access requests have an appropriate pattern regarding their access addresses. The presence of inappropriate patterns (e.g., situations where the relationship between access requests cannot be determined or changes abruptly, or situations where certain memory addresses are associated with multiple memories or not associated with any memory) may indicate memory aliasing or other attacks performed at the interconnect.

[0038] The second phase considers the connectivity between the trust point circuitry and the DRAM. Specifically, each link between the trust point circuitry system and its associated memory is tested. Such tests can be performed in parallel. Here, the pseudo-random number generator of the trust point circuitry system is initialized to a given seed value. The same seed value can be issued to each trust point circuitry system. This is used to generate a stream of random numbers, which is then written to the associated DRAM. The pseudo-random number generator is then reinitialized with the seed value, and the data is read back. Each data item in the data items should correspond to the next value generated by the pseudo-random number generator. This allows it to be determined whether the data has been corrupted or altered, for example, by the memory controller. Specifically, if such a change has occurred, the data read back after reinitialization will not correspond to the output of the pseudo-random number generator. A span value indicating the extent to which a write request is made can be selected to implicitly perform DRAM content cleanup, which can be valuable for other security considerations, such as preventing cold start attacks. For example, the second phase can simply be used to determine whether aliasing is being performed or whether the data has been corrupted. The second phase can also confirm that the DRAM is 'alive' (e.g., it is not just ROM). In this scenario, a span can be set such that the write occurs on the first byte of each cache line (e.g., 64 bytes) or page (4kB) within the address range. However, the second phase can also be used to clean up the DRAM, making secret data from previous boot cycles invisible in the current boot cycle. In this case, the span can be configured such that the write is performed on every byte, and the data is 'zeroed out'.

[0039] The third phase is executed by each processing circuit upon power-up. This can be when the entire system starts up, but it can also be delayed by some processing circuits. In this case, one or more write requests are issued from the processing circuit system to each trust point circuit. Each write request in the write request obtains the next value from the pseudo-random number generator of the processing element. The trust point circuit system is initialized to use the same random seed value, such that the number generated by its pseudo-random number generator will correspond to the number provided at the processing circuit. In this way, the trust point circuit system can check the validity of each data element in the data element provided in the write request to determine whether any corruption has occurred, for example, at the interconnect. Note that the seed value of the pseudo-random number generator can be transmitted via a secure channel. The trust point circuit system causes the write request to be canceled (e.g., not forwarded to memory). Therefore, the third phase can be executed at any time when the processing circuit is powered on, because the memory that is being used by other processing circuits will not be physically changed due to this test. The trust point circuit can check that the received write request has an appropriate span value (given the considerations mentioned above) and that the write request was issued over the entire space covered by that trust point circuit.

[0040] Runtime checks are performed periodically during system execution. Specifically, as a first test, if an additional access request is issued to memory from any processing element via the trust point circuitry system, the trust point circuitry system will determine whether the access address in the additional access request corresponds to a boundary calculated for the trust point circuitry system during the first phase. If the trust point circuitry receives an additional access request that exceeds this boundary, this indicates that the trust point circuitry system has received a memory access request that it should not have made. This can indicate an aliasing attack and thus trigger an error. Figure 3 The second runtime test shown is the use of the so-called canary lines. This involves writing data to one or more policy locations in memory or by tracking data written to these locations externally. Policy locations can include the beginning and end of memory, random locations within memory, and near the boundaries of memory segments belonging to different entities or having different permissions. Integrity check algorithms are used to generate integrity values ​​for the written data. Examples of such algorithms include hash algorithms, as well as CRC and HMAC algorithms. Such algorithms produce integrity values ​​that change even with minor changes to the underlying data. This integrity value is securely stored. For example, these can be stored within the storage circuitry of a trust point circuitry system, or securely stored in main memory. In either case, at specific intervals, the trust point circuitry system reads back those memory lines and re-executes the integrity check. The recalculated integrity value should match the stored value. If not, this indicates that the data stored in memory has been modified. Therefore, an error (such as an exception) is raised. Note that in Figure 3 In the example, only a single trust point circuit is shown performing boundary checks and canary line checks. However, these checks can be performed by each trust point circuit with respect to its own memory.

[0041] Figure 4A flowchart 400, illustrating the first phase of verification according to some implementation schemes, is shown in detail. The process begins at step 405, where an access request is issued to one or more memory addresses, each memory address separated by a span value. At step 410, the request is received at the relevant trust point circuitry. At step 415, configuration information is received via a secure channel. This configuration information includes the span values ​​and other information necessary to verify the validity of the relationship between the memory addresses received at the trust point circuitry. For example, this may include information such as whether memory striping is valid and the number of other memory cells present. At step 420, the upper and lower limits of the addresses mentioned in the memory access request are determined. At step 425, the configuration information is used to determine whether the relationship between the addresses in the memory access request is valid. In other words, given the configuration of the system, it is determined whether the relationship between the addresses in the received request corresponds to the relationship in the outgoing request issued by the processing circuitry system. Note that an incomplete match may exist because addresses may have been translated between address spaces. If not, at step 430, the test fails and an error is raised. This may take the form of raising an exception, for example. If the relationship is deemed valid, at step 435, the relationship validity and boundary information are transmitted to the processing element / processing circuit that issued the access request. At step 440, the processing circuit that received the validity and boundary information from each trust point circuit determines whether any memory address exists in the address space that is not mapped to one of the memories. For example, if an address is found that leads to two or zero memories, the test fails, and an error is raised at step 445. Otherwise, the test passes at step 450.

[0042] The relationship between the addresses of consecutive requests can be expected to be as follows: Address = Previous Address + Span When using striping, the relationship between the addresses of consecutive requests can be expected as follows: Address = Previous Address + Span * N (considering linear striping across N DRAM ports) As another example, when using hash-based striping, the relation could be: Address mod span * N = Previous address mod span * N + span * N (considering hash-based striping across N DRAM ports) Figure 5Flowchart 500 illustrates an example of the second phase of the validity test. The process begins at step 505, where the pseudo-random number generator used by the trust point circuit is initialized with a seed value. The exact seed value used is not important, provided it is known. Note that this test can be performed in parallel by each trust point circuit. Multiple pseudo-random number generators at multiple trust point circuits can use the same seed value, or each trust point circuit can use a single generator. At step 510, the loop counter (n) is initialized to 0. At step 515, the pseudo-random number generator obtains the next output and sends this output to the memory as a write request. In practice, such write requests can be expected to pass through one or more other intermediate circuits, such as the memory controller. At step 520, it is determined whether the loop counter has reached a given value (N), which corresponds to the number of write requests to be issued. If the number of write requests has not yet been met, the process proceeds to step 525, where the loop counter (n) is incremented, and the process proceeds to step 515. Otherwise, the process proceeds to step 530, where the pseudo-random number generator is reinitialized with the previous seed value. Therefore, the series of numbers generated by the pseudo-random number generator will correspond to the numbers previously generated at step 515. At step 535, the loop counter (n) is reset to 0. At step 540, a read request is then issued by the trust point circuitry. A read request is issued to an address in memory that corresponds to one of the addresses for which a write request was previously issued in step 515. In other words, the read request issued in step 540 reads the data written in the previous step 515. At step 545, the next number is obtained by the pseudo-random number generator. Step 550 then determines whether there is a match between the output of the pseudo-random number generator and the number already obtained by the read request. Theoretically, the two numbers should match since the same seed value is used. If no match is found, at step 555, the test fails and an error is raised. This is because the value stored in memory is perceived to be corrupted. If a match is found, at step 560, it is determined whether the loop continues. If the loop continues, the process proceeds to step 565, where the loop counter (n) increments, and the process proceeds to step 540 to issue the next read request. Otherwise, if no failure occurs, the test passes at step 570.

[0043] Figure 6Flowchart 600 illustrates the process of the third phase of the validity test. The process begins at step 605, where the pseudo-random number generator of the processing circuit is initialized with a seed value. The exact seed value used is not important, provided it is known. Each processing circuit can perform this test in parallel, and therefore the same random number generator can be used if desired. At step 610, the loop counter (n) is initialized to 0. At step 615, the next output from the pseudo-random number generator is obtained, and this is sent to the trust point circuit system via a write request. Step 620 queries whether the loop should continue. If yes, then at step 625, the loop counter (n) is incremented, and the process returns to step 615. If the loop completes, then at step 630, the pseudo-random number generator of the trust point circuit system is initialized to the same seed value used in step 605. For example, the seed can be transmitted across a secure channel existing between the processing circuit system and the trust point circuit system. Therefore, the pseudo-random number generator of the trust point circuit system should produce the same series of numbers generated during step 615. At step 635, the loop counter is reset to 0 again, and at step 640, the trust point circuitry receives the next write request from the processing circuitry. At step 645, the next output of the pseudo-random number generator is obtained. At step 650, it is determined whether there is a match between the number generated by the local pseudo-random number generator in the trust point circuitry and the value written in the write request issued by the processing circuitry. If not, at step 655, the test fails and an error is raised. This is because the predictable data value has been corrupted during transmission (e.g., via an interconnect). If a match exists, at step 660, it is determined whether there are further iterations of the loop to be performed. If so, at step 665, the loop counter (n) is incremented, and the process returns to step 640. Otherwise, the test passes at step 670.

[0044] Note that in this example, the receiving process (steps 630 to 660) follows the output process (steps 605 to 620). However, it should be understood that these two processes can be performed in parallel. Specifically, the pseudo-random number generators used by the processing circuitry and the trust point circuitry system can be initialized simultaneously with the same seed value. The output from the PRNG can be obtained by the processing circuitry and sent to the trust point circuitry system in a write request (step 615), where the output can be received (step 640) and compared with the PRNG output (step 645). If no match is found, an error is raised (step 655). Otherwise, if there are multiple iterations of the loop to be executed, the process is repeated, where another output from the PRNG is sent to the trust point circuitry system and the trust point circuitry system compares the received data with the PRNG output. If all received packets have been confirmed as valid at the end of the loop, the test passes at step 670. In this way, only a single loop is required.

[0045] Figure 7Flowchart 700 is shown, illustrating the process of performing a runtime test. The process begins at step 705, where a canary line is written to memory. Such lines can be written to policy locations, such as locations more susceptible to corruption, locations near where sensitive data is stored, and locations on boundaries between memory regions with different permissions. At step 710, an integrity calculation is performed on the data written to memory. At step 715, the integrity data generated as a result of the integrity calculation is stored. This can be stored, for example, within the trust point circuitry itself. The remainder of flowchart 700 then involves a loop that can continue while the trust point circuitry is active. At step 720, it is determined whether an access request has been received. If so, it is determined whether the address referenced in the memory access request falls within the range calculated during the first phase of this trust point circuitry. If not, an error is raised at step 730 because the trust point circuitry received a memory access request it should not have received. Otherwise, the memory access request is satisfied at step 735, and the process proceeds to step 740. If no access request is received at step 720, the process also proceeds to step 740. At step 740, it is determined whether the timer has expired. Many runtime attacks can cause memory interruptions of hundreds of milliseconds and may corrupt multiple cache lines. Therefore, by setting a timer at a frequency lower than this and strategically placing data in the canary string, it is possible to determine with a reasonable probability whether data corruption has occurred. At step 740, if the timer has not expired, the process returns to step 720. Otherwise, at step 745, the data stored in the canary string is accessed. At step 750, an integrity calculation is performed on the data accessed from the memory in the canary string. At step 755, it is determined whether the result of the integrity calculation matches the stored integrity data. If not, an error is raised at step 760 to indicate that the data has been corrupted during storage. Otherwise, at step 765, the timer is reset and the process returns to step 720.

[0046] Therefore, the above description illustrates how a series of checks can be performed to allow for the trust of untrusted components of the memory system with a reasonable probability. This process keeps the various processing circuits online at all times and determines whether the interfaces between those processing circuits and the memory system are trustworthy without damaging the memory or requiring other processing circuits to be temporarily disabled to perform the tests.

[0047] In this application, the phrase "configured as..." is used to mean that the elements of the device have a configuration capable of performing the defined operation. In this context, "configuration" means the arrangement or manner of interconnection of hardware or software. For example, the device may have dedicated hardware that provides the defined operation, or a processor or other processing device may be programmed to perform the function. "Configured as" does not mean that the elements of the device need to be changed in any way to provide the defined operation.

[0048] While exemplary embodiments of the invention have been described in detail herein with reference to the accompanying drawings, it should be understood that the invention is not limited to those precise embodiments, and various changes, additions, and modifications can be made therein by those skilled in the art without departing from the scope and spirit of the invention as defined by the appended claims. For example, features of the dependent claims may be combined with features of the independent claims in various ways without departing from the scope of the invention.

Claims

1. A data processing apparatus, the data processing apparatus comprising: A processing circuit system adapted to issue multiple memory access requests to multiple addresses in the memory; A trust point circuit system, the trust point circuit system being used to receive the memory access request from the processing circuit system via a first set of intermediate circuits; as well as A secure channel circuit system is used to implement secure communication between the plurality of addresses from the processing circuit system to the trust point circuit system, wherein... The trust point circuit system is adapted to determine, based on the correspondence, whether the addresses in the memory of the memory access request received through the first set of intermediate circuits have a predetermined relationship.

2. The data processing apparatus according to claim 1, wherein Data transmitted through the secure channel is unaffected by the configuration of the first set of intermediate circuits.

3. The data processing apparatus according to claim 1 or 2, wherein The trust point circuitry is adapted to determine the address range of the memory addressed by the memory access request, and to provide the address range to the processing circuitry via the secure channel; and The processing circuit system is adapted to determine whether the memory includes invalid addresses based on the address range.

4. The data processing apparatus according to claim 3, wherein The invalid address is a memory-related address.

5. The data processing apparatus according to claim 3, wherein The invalid address is a memory-irrelevant address.

6. The data processing apparatus according to claim 3, wherein The trust point circuitry is adapted to signal an error in response to the trust point circuitry receiving an additional memory request for an address that falls outside the address range.

7. The data processing apparatus according to claim 1 or 2, wherein the data processing apparatus comprises: A generation circuit system for generating pseudo-random numbers based on a seed value to perform an integrity check.

8. The data processing apparatus according to claim 7, wherein The trust point circuit system is adapted to forward the request to the memory via a second set of intermediate circuits.

9. The data processing apparatus according to claim 8, wherein The second set of intermediate circuits includes a memory controller.

10. The data processing apparatus according to claim 8, wherein: The integrity check includes a second set of integrity checks; and The trust point circuit system is adapted to perform the second set of integrity checks on predetermined addresses in the memory as follows: Set the seed value to a predetermined value. The second set of intermediate circuits transmits a memory write request, including the pseudo-random number, to the predetermined address. Reset the seed value to the predetermined value. The memory read request is transmitted to the predetermined address in the memory via the second set of intermediate circuits, and The result of the memory read request is compared with the pseudo-random number.

11. The data processing apparatus according to claim 10, wherein The integrity check is performed on multiple addresses by executing multiple memory write requests, including the memory write request, followed by multiple memory read requests, including the memory read request; and Based on the seed value, the pseudo-random number is changed for each of the plurality of memory write requests and each of the plurality of memory read requests.

12. The data processing apparatus according to claim 7, wherein The integrity check includes a first set of integrity checks; and The processing circuitry system is adapted to perform the first set of integrity checks on predetermined addresses in the memory as follows: Set the seed value to a predetermined value, and The first set of intermediate circuits transmits a memory write request, including the pseudo-random number, to the trusted point circuit system; and The trust point circuit system is adapted to perform the first set of integrity checks on the predetermined address in the memory by: Reset the seed value to the predetermined value, and The pseudo-random number in the memory write request received by the trust point circuit system is compared with the output of the generation circuit system.

13. The data processing apparatus according to claim 12, wherein The trust point circuitry prevents the system from responding to write requests to the memory by writing data to the memory.

14. The data processing apparatus according to claim 12, wherein the data processing apparatus comprises: Multiple processing circuit systems, the multiple processing circuit systems including the processing circuit system, wherein At most one of the processing circuit systems is adapted to determine, based on the correspondence, whether the address in the memory of the memory access request received through the first set of intermediate circuits has the predetermined relationship. At most one of the processing circuitry systems is adapted to perform the integrity checks in addition to the first set of integrity checks; and Each processing circuit system in the processing circuit system is adapted to perform the first set of integrity checks after power-on.

15. The data processing apparatus according to claim 1 or 2, wherein The trust point circuit system is adapted to store at least one predetermined value in at least one corresponding predetermined location in the memory, calculate a set of integrity values ​​corresponding to the at least one predetermined value, and store the integrity values ​​respectively; and In response to a predetermined event, the trust point circuit system is adapted to calculate another set of integrity values ​​based on at least one predetermined value stored in the at least one corresponding predetermined location, and to compare the other set of integrity values ​​with the first set of integrity values.

16. The data processing apparatus according to claim 15, wherein The set of integrity values ​​and the additional set of integrity values ​​are generated by at least one of the following from the predetermined value: Hash value, Cyclic Redundancy Check (CRC) value, Checksum, and Key hash message authentication code.

17. The data processing apparatus according to claim 1 or 2, wherein The first set of intermediate circuits includes a switch.

18. The data processing apparatus according to claim 1 or 2, wherein The plurality of addresses in the memory access request issued by the processing circuit system are plurality of logical addresses; and The plurality of addresses of the memory access request received by the trust point circuit system are plurality of physical addresses.

19. A data processing method, the data processing method comprising: Issue multiple memory access requests to multiple addresses in memory; The memory access request is received from the processing circuit system at the trust point circuit system via a first set of intermediate circuits. as well as Secure communication is achieved between the multiple addresses of the processing circuit system and the trust point circuit system to establish a mapping relationship. as well as Based on the correspondence, it is determined whether the address in the memory of the memory access request received through the first set of intermediate circuits has a predetermined relationship.

Images