A method based on hardware isolation execution environment

Abstract

The present invention discloses a method for isolating execution environment based on hardware. By adding a data arbitration module to the chip transmission channel and combining it with a physical switch, the device can completely cut off the data input channel of the execution environment when the execution environment parses data, and absolutely isolate the execution environment to meet the customer's requirements for the reliability of data processing content. At the same time, it can also ensure that when there are multiple sending chips sending data, the execution environment does not need to be changed, further ensuring the stability and isolation effect of the execution environment; and solving the problem that data information in various field environments is not interfered by external connections when processing data.

Description

Technical Field

[0001] The present invention relates to the technical field of data transmission security, and in particular to a method based on hardware isolation execution environment. Background Art

[0002] At present, in order to meet the needs of high real-time business information and reduce the purchase cost at the implementation site, some communication transmission equipment adopts a multi-core operation mechanism, separates the business module and analysis module of the communication information, uses some low-performance chips to complete the simple processing or forwarding of data services, and uses high-performance or other special chips to implement the data analysis part involving complex calculations, so as to complete the processing of data information. For example, the common DSP+ARM combination architecture on the market, in which the ARM chip has a relatively strong transaction management function and can be used to run interfaces and applications, etc. Its advantages are mainly reflected in the control aspect, while the DSP chip is mainly used for calculation, such as encryption and decryption, modulation and demodulation, etc., and its advantages are powerful data processing capabilities and high operating speed. For some specific algorithms, such as data filtering and image processing, if they are placed on DSP, the efficiency will be 60% higher. At this time, ARM resources can be saved for more applications, so the overall performance of the system will be greatly improved.

[0003] At present, data communication is mostly carried out directly between chips. If the execution environment needs to be isolated, it is mostly done by writing software functions to isolate the execution environment. The sending chip includes a sending module and a receiving module. The sending module contains data blocks 1, 2, and 3 to simulate the sending scenario. The sending module sends data block 1 to the receiving chip. After the receiving chip completes the processing, it sends the processing result to the receiving module. When the receiving module receives the data, the sending module sends data block 2. In this way, a data sending and processing process is completed, and the execution environment is isolated in terms of software functions.

[0004] Although the isolation of the execution environment is completed through software functions, the independence of the execution environment is effectively guaranteed, but there is still a channel for data downlink, and the execution environment cannot be absolutely isolated.

[0005] On the other hand, when multiple transmitting chips send data to a receiving chip, additional processing is required at the receiving chip, such as the need to add additional peripheral interfaces to receive the data, the need to write additional programs to store the data, and so on. The programming of receiving chips such as DSP and FPGA is relatively complicated, which further affects the stability of the receiving chip program and the isolation effect of the receiving chip. Summary of the invention

[0006] In order to overcome the problems existing in the prior art, the present invention aims to provide a method for isolating the execution environment based on hardware. By adding a data arbitration module during the transmission process and combining a physical switch, the data input channel of the execution environment can be completely cut off when the execution environment parses data, and the execution environment can be absolutely isolated; at the same time, it can also ensure that when there are multiple sending chips sending data, the execution environment does not need to be changed, further ensuring the stability and isolation effect of the execution environment. While effectively ensuring the real-time nature of on-site business data, it meets the customer's requirements for the reliability of data processing content.

[0007] To achieve the above object, the present invention provides the following technical solution: a method based on hardware isolation execution environment, comprising the following steps:

[0008] S1: The sending chip sends data to the data arbitration module;

[0009] S2: The data arbitration module determines whether there is data to be processed in the received data;

[0010] S3: Detect whether the physical switch K1 is closed. If the switch is closed, data transmission can be carried out. If the switch is open, data transmission cannot be carried out. The physical switch K1 needs to be closed first.

[0011] S4: Send the data to be processed to the receiving chip, which processes the data;

[0012] S5: Open the physical switch K1 and close the physical switch K2;

[0013] S6: After the receiving chip has processed the data, it sends the data back to the data arbitration module;

[0014] S7: data arbitration module performs data distribution;

[0015] S8: Open the physical switch K2 and close the physical switch K1;

[0016] S9: The program jumps to S2 and waits for the next set of data to be processed.

[0017] The present invention is further configured as follows: the sending chip comprises a sending module and a receiving module, the sending module is used to send data in the sending chip to the data arbitration module, and the receiving module is used to receive data sent back by the data arbitration module.

[0018] The present invention is further configured as follows: the data arbitration module includes a data sending channel, a data receiving channel, a physical switch K1 and a physical switch K2; the data sending channel is connected to the sending module of the sending chip to realize data transmission between the sending chip and the data arbitration module; the data receiving channel is connected to the receiving module of the sending chip to realize data transmission from the data receiving channel to the receiving module of the sending chip.

[0019] The present invention is further configured as follows: the data sending channel is also connected to the physical switch K1, so as to realize the transmission of data in the data arbitration module from the data sending channel to the physical switch K1; the physical switch K1 is connected to the receiving chip, so as to realize the transmission of data from the physical switch K1 to the receiving chip; the receiving chip is also connected to the physical switch K2, so that the data processed by the receiving chip is transmitted from the receiving chip to the physical switch K2; the physical switch K2 is connected to the data receiving channel, so as to realize the transmission of data from the physical switch K2 to the data receiving channel.

[0020] The present invention is further configured as follows: when the physical switch K1 is in an open state, data cannot be transmitted from the physical switch K1 of the data arbitration module to the receiving chip, and at this time the physical switch K2 must be in a closed state; when the physical switch K1 is in a closed state, data can be transmitted from the physical switch K1 to the receiving chip, and at this time the physical switch K2 must be in an open state.

[0021] The present invention is further configured as follows: when the physical switch K2 is in an open state, data cannot pass through the physical switch K2 from the receiving chip, and at this time the physical switch K1 must be in a closed state; when the physical switch K2 is in a closed state, data can pass through the physical switch K2 from the receiving chip, and at this time the physical switch K1 must be in an open state.

[0022] The above technical solution can be achieved by adding a data arbitration module to the chip transmission channel, combined with a physical switch, so that when the execution environment parses data, the data input channel of the execution environment can be completely cut off, thereby absolutely isolating the execution environment.

[0023] The present invention is further configured as follows: the step S2 specifically includes storing the data received by the data arbitration module in the form of a queue in the memory, and recording the source of the received data information, and determining whether there is data in the memory that needs to be processed.

[0024] It should be noted that the arbitration module processes data through a queue pool and records the queue being processed. Take the processing of two sending chips as an example. If the data of queue 1 sent by sending module 1 is currently processed, the arbitration module receives the data sent by sending module 1 as the data to be processed, and needs to close the physical switch K1 to send the data to the receiving chip; and the data sent by sending module 2 needs to wait until the receiving chip has processed it, and then return the data to the arbitration module for processing.

[0025] The present invention is further configured as follows: the sending of data to the receiving chip in step S4 is specifically to extract data information in sequence from the data queue stored in the memory of the data arbitration module for sending, and record the information source of the data.

[0026] The present invention is further configured as follows: the data arbitration module in step S7 performs data distribution, specifically, performs data distribution according to the data information source recorded in step S4, and sends the processed data back to the sending chip to which it belongs.

[0027] The present invention is further configured as follows: the method based on a hardware isolation execution environment can be applied to a situation where multiple sending chips send data.

[0028] It should be noted that an alternative solution of the present invention includes a transmitting chip and a receiving chip; there is a transmitting channel D1 between the transmitting chip and the receiving chip, which is used to send the data of the transmitting chip to the receiving chip for processing; there is a transmitting channel D2 between the transmitting chip and the receiving chip, which is used to send the data processed by the receiving chip to the transmitting chip. After the transmitting chip sends the data to the receiving chip, the driver of the transmitting data end of the transmitting chip is turned off, and after the transmitting chip receives the processing result of the receiving chip, the driver of the transmitting data end of the transmitting chip is turned on to complete the next data processing, thereby isolating the execution environment.

[0029] During the working process, follow the steps below:

[0030] S1: The sending chip sends data to the data arbitration module; the sending chip sends data from the sending module to the data sending channel of the data arbitration module.

[0031] S2: The data arbitration module determines whether there is data to be processed in the received data; the data in the data sending channel is stored in the memory in the form of a queue, and the information source of the received data is recorded to determine whether there is data to be processed in the memory.

[0032] S3: Check whether the physical switch K1 is closed. If so, proceed to the next step; if not, close the physical switch K1 first. When the physical switch K1 is closed, the physical switch K2 must be open.

[0033] S4: Send data to the receiving chip, which processes the data; extract the first packet of data information from the data queue stored in the memory of the data arbitration module and send it to the receiving chip, and record the information source of this packet of data.

[0034] S5: Open the physical switch K1 and close the physical switch K2;

[0035] S6: After the receiving chip has processed the data, it sends the data back to the data arbitration module;

[0036] S7: the data arbitration module performs data distribution; according to the data information source recorded in step S4, data distribution is performed, and the processed data is sent back to the sending chip to which it belongs;

[0037] S8: Open the physical switch K2 and close the physical switch K1;

[0038] S9: The program jumps to S2 and waits for the next set of data to be processed.

[0039] In summary, the beneficial effects of the above technical solution of the present invention are as follows:

[0040] 1. The present invention adds a data arbitration module to the chip transmission channel and combines it with a physical switch to completely cut off the data input channel of the execution environment when the execution environment parses data, thereby absolutely isolating the execution environment.

[0041] 2. The present invention can ensure that when there are multiple sending chips sending data, the execution environment does not need to be modified, further ensuring the stability and isolation effect of the execution environment. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings required for describing the embodiments are briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0043] Figure 1 It is a schematic diagram of the structure of the present invention;

[0044] Figure 2 The figure is an overall flow chart of the method of the present invention. DETAILED DESCRIPTION

[0045] In order to enable those skilled in the art to better understand the technical solution of the present invention, the technical solution of the present invention is clearly and completely described below in conjunction with the accompanying drawings of the present invention. Based on the embodiments in this application, other similar embodiments obtained by ordinary technicians in this field without making creative work should all fall within the scope of protection of this application. In addition, the directional words mentioned in the following embodiments, such as "up", "down", "left", "right", etc., are only reference to the directions of the accompanying drawings. Therefore, the directional words used are used to illustrate rather than limit the invention.

[0046] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by those skilled in the art to which this application belongs. The terms used herein in the specification of this application are only for the purpose of describing specific embodiments and are not intended to limit this application.

[0047] It should be noted that when an element is considered to be "connected" to another element, it can be directly connected to the other element, or connected to the other element through an intermediate element. The "connection" in the following embodiments should be understood as "electrical connection", "communication connection", etc. if the connected circuits, modules, units, etc. have electrical signals or data transmission between each other.

[0048] Example:

[0049] like Figure 1 , Figure 2 As shown, it is a preferred embodiment of the present invention, taking two sending chips as an example, including a sending chip C1, a sending chip C2 and a data arbitration module; the present invention is further described in conjunction with the workflow diagram of the present invention:

[0050] like Figure 1 As shown, the sending modules of the sending chips C1 and C2 are connected to the data sending channel of the data arbitration module 3 to realize the transmission of data from the sending modules of the sending chips C1 and C2 to the data sending channel of the data arbitration module 3.

[0051] The data sending channel of the data arbitration module 3 is connected to the physical switch K1, and the physical switch K1 is connected to the receiving chip, so that data is transmitted from the data sending channel of the data arbitration module 3 to the receiving chip through the physical switch K1; the physical switch K1 is used to control the closing of data from the data sending channel of the data arbitration module 3 to the receiving chip; the receiving chip is connected to the physical switch K2, and the physical switch K2 is connected to the data receiving channel of the data arbitration module 3, so that data is transmitted from the receiving chip to the data receiving channel through the physical switch K2.

[0052] The data receiving channel of the data arbitration module 3 is connected to the receiving module of the sending chip C1 and the receiving module of the sending chip C2, so as to realize data transmission from the data receiving channel of the data arbitration module 3 to the receiving module of the sending chip C1 or the receiving module of the sending chip C2.

[0053] like Figure 2 As shown, a method based on hardware isolation execution environment described in the present invention includes the following steps:

[0054] S1: The sending chip C1 and the sending chip C2 send data from the sending module to the data sending channel of the data arbitration module 3.

[0055] S2: The data arbitration module 3 determines whether there is data to be processed in the received data; stores the data in the data sending channel in the form of a queue in the memory, and records the information source of the received data, and determines whether there is data to be processed in the memory.

[0056] It should be noted that the data arbitration module 3 processes data through a queue pool and records the queue being processed. When the data of queue 1 sent by the sending module 1 is currently processed, the data sent by the sending module 1 received by the data arbitration module 3 is the data to be processed, and the physical switch K1 needs to be closed to send the data to the receiving chip; and the data sent by the sending module 2 needs to wait until the receiving chip has processed it, and then return the data to the data arbitration module 3 for processing.

[0057] S3: Detect whether the physical switch K1 is closed. If so, proceed to the next step; when the physical switch K1 is closed, the physical switch K2 must be open.

[0058] S4: Send data to the receiving chip, which processes the data; extract the first packet of data information from the data queue stored in the memory of the data arbitration module 3 and send it to the receiving chip, and record the information source of this packet of data.

[0059] S5: Open the physical switch K1 and close the physical switch K2;

[0060] S6: After the receiving chip has processed the data, it sends the data back to the data arbitration module 3;

[0061] S7: the data arbitration module 3 performs data distribution; according to the data information source recorded in step S4, data distribution is performed, and the processed data is sent back to the sending chip C1 or the sending chip C2 to which it belongs.

[0062] S8: Open the physical switch K2 and close the physical switch K1;

[0063] S9: The program jumps to S2 and waits for the next set of data to be processed.

[0064] It should be noted that when the physical switch K1 is in an open state, data cannot be transmitted from the physical switch K1 of the data arbitration module 3 to the receiving chip, and at this time the physical switch K2 must be in a closed state; when the physical switch K1 is in a closed state, data can be transmitted from the physical switch K1 to the receiving chip, and at this time the physical switch K2 must be in an open state.

[0065] When the physical switch K2 is in an open state, data cannot pass through the physical switch K2 from the receiving chip, and the physical switch K1 must be in a closed state at this time; when the physical switch K2 is in a closed state, data can pass through the physical switch K2 from the receiving chip, and the physical switch K1 must be in an open state at this time.

[0066] In summary, the present invention provides a method for isolating the execution environment based on hardware. By adding a data arbitration module during the transmission process and combining a physical switch, the data input channel of the execution environment can be completely cut off when the execution environment parses data, and the execution environment can be absolutely isolated. At the same time, it can also ensure that when there are multiple sending chips sending data, the execution environment does not need to be modified, further ensuring the stability and isolation effect of the execution environment. While effectively ensuring the real-time nature of on-site business data, it meets the customer's requirements for the reliability of data processing content.

[0067] Finally, it should be noted that the above content is only used to illustrate the technical solution of the present invention, and its description is relatively specific and detailed, but it cannot be understood as limiting the scope of the invention patent. It should be pointed out that for ordinary technicians in this field, several modifications and improvements can be made without departing from the concept of this application, which all belong to the protection scope of this application. Therefore, the protection scope of the patent of this application shall be based on the attached claims.

Claims

1. A method based on hardware isolation execution environment, characterized in that: The following steps are involved: S1: The sending chip sends data to the data arbitration module; S2: The data arbitration module determines whether there is data to be processed in the received data; S3: Detect whether the physical switch K1 is closed. If the switch is closed, data transmission can be carried out. If the switch is open, data transmission cannot be carried out. The physical switch K1 needs to be closed first. S4: Send the data to be processed to the receiving chip, which processes the data; S5: Open the physical switch K1 and close the physical switch K2; S6: After the receiving chip has processed the data, it sends the data back to the data arbitration module; S7: Data arbitration module performs data distribution; S8: Open the physical switch K2 and close the physical switch K1; S9: The program jumps to S2 to wait for the next set of data to be processed; The sending chip includes a sending module and a receiving module, wherein the sending module is used to send the data in the sending chip to the data arbitration module, and the receiving module is used to receive the data sent back by the data arbitration module; The data arbitration module includes a data transmission channel, a data receiving channel, a physical switch K1 and a physical switch K2; the data transmission channel is connected to the transmission module of the transmission chip, and the data receiving channel is connected to the receiving module of the transmission chip; The data transmission channel is also connected to the physical switch K1, and the physical switch K1 is connected to the receiving chip; the receiving chip is also connected to the physical switch K2, and the physical switch K2 is connected to the data receiving channel.

2. A method based on hardware isolation execution environment according to claim 1, characterized in that: When the physical switch K1 is in an open state, the physical switch K2 must be in a closed state; when the physical switch K1 is in a closed state, the physical switch K2 must be in an open state.

3. A method based on hardware isolation execution environment according to claim 2, characterized in that: When the physical switch K2 is in an open state, the physical switch K1 must be in a closed state; when the physical switch K2 is in a closed state, the physical switch K1 must be in an open state.

4. The method according to claim 1, characterized in that: The step S2 is specifically that the data arbitration module processes the received data by means of a queue pool and records the queue being processed; The data arbitration module stores the data in the data transmission channel in the form of a queue in the memory, and records the information source of the received data to determine whether there is data in the memory that needs to be processed.

5. The method according to claim 1, characterized in that: The sending of the data to be processed to the receiving chip in step S4 specifically involves sequentially extracting data information from the data queue stored in the memory of the data arbitration module and sending the data to the receiving chip for data processing, and recording the information source of the data.

6. The method according to claim 5, characterized in that: The data arbitration module in step S7 performs data distribution, specifically, performs data distribution according to the data information source recorded in step S4, and sends the processed data back to the sending chip to which it belongs.

7. A method based on a hardware isolated execution environment according to any one of claims 1 to 6, characterized in that: The method based on hardware isolation execution environment can be applied to the situation where multiple sending chips send data.

Images