Access control method, system, storage medium, electronic device and system on chip

Abstract

The present disclosure relates to an access control method, system, storage medium, electronic device and system on chip, which monitors data access requests sent by a host device to a memory controller, so as to protect memory data access. The method comprises: in response to the memory controller receiving an access request, determining the category of the host device sending the access request; and in the case that the access control unit is in an enabled state, determining whether the access request is an allowable access request based on the category of the host device; if the access request is the allowable access request, allowing the access request; and if the access request is not the allowable access request, rejecting the access request and performing a corresponding operation based on the category of the access request.

Description

Technical Field

[0001] This disclosure relates to the field of computer technology, and more specifically, to an access control method, system, storage medium, electronic device, and system-on-a-chip. Background Technology

[0002] With the rapid development of mobile internet and the Internet of Things (IoT), the number of smart devices connected to the network is increasing. Ensuring that the behavior and data access of these smart devices are secure and authorized, and protecting data resources from being stolen, is a growing concern for consumers and software solution providers. In some existing technologies, secure access to smart devices is implemented at multiple layers, such as the network layer, application layer, and hardware layer.

[0003] In related technologies, there are various ways to achieve secure access to smart devices at the hardware level. For example, encryption and decryption of critical system-level data can be achieved by using an external encryption chip; or by adding relevant components to the embedded processor to protect and authorize access.

[0004] However, as smart devices become increasingly complex, their system-on-a-chip (SoC) contains various other main components besides the processor. Therefore, security measures focused solely on the processor are insufficient, and methods that rely on external encryption chips to encrypt and decrypt critical system-level data are costly and also inadequate. Summary of the Invention

[0005] The purpose of this disclosure is to provide an access control method, system, storage medium, electronic device, and system-on-a-chip, which monitors data access requests sent from the host device to the memory controller by setting an access control unit in the memory controller, thereby achieving the purpose of protecting memory data access.

[0006] To achieve the above objectives, according to a first aspect of this disclosure, an access control method is provided, applied to any one of at least one access control unit, said at least one access control unit being deployed in a memory controller, the method comprising:

[0007] In response to the memory controller receiving an access request, the type of the master device that sent the access request is determined; and,

[0008] When the access control unit is enabled, it is determined whether the access request is an allowable access request based on the category of the master device;

[0009] If the access request is an allowable access request, then the access request is allowed;

[0010] If the access request is not an allowed access request, the access request is rejected, and the corresponding operation is performed based on the category of the access request.

[0011] Optionally, determining whether the access request is an allowable access request based on the category of the master device includes:

[0012] If the master device is the target master device, then based on the first information carried in the access request, it is determined whether the access request is the allowed access request;

[0013] If the master device is not the target master device, then based on the second information carried in the access request and the preset configuration of the target access control unit, it is determined whether the access request is the allowable access request;

[0014] The target master device is a master device that includes a security control mechanism, and the target access control unit is an access control unit in an enabled state.

[0015] Optionally, the first information includes at least an access identifier and an access request address;

[0016] The step of determining whether an access request is an allowable access request based on the first information carried in the access request includes:

[0017] Determine whether the access identifier is a secure access identifier;

[0018] If the access identifier is a secure access identifier, then the access request is determined to be an allowed access request;

[0019] If the access identifier is not a secure access identifier, then determine whether the access request address includes the target protected area; and,

[0020] If the access request address does not include the target protected area, the access request is determined to be an allowed access request; if the access request address includes the target protected area, the access request is determined not to be an allowed access request.

[0021] Optionally, the second information includes at least an access request address, and the preset configuration reflects at least the access mode of the master device to the memory region of the memory controller, wherein the memory region includes a protected region and a non-protected region;

[0022] The step of determining whether the access request is an allowable access request based on the second information carried in the access request and the preset configuration of the target access control unit includes:

[0023] Based on the access pattern, determine whether the non-target master device is a device allowed to access the protected area;

[0024] If the non-target master device is a device that is allowed to access the protected area, then the access request is determined to be an allowed access request;

[0025] If the non-target master device is not a device authorized to access the protected area, then determine whether the access request address includes the target protected area; and,

[0026] If the access request address does not include the target protected area, the access request is determined to be an allowed access request; if the access request address includes the target protected area, the access request is determined not to be an allowed access request.

[0027] Optionally, each of the at least one access control unit includes at least one register, and the preset configuration of each access control unit is determined based on the configuration of configuration items for the corresponding at least one register;

[0028] The preset configuration also reflects at least one of the following: the overall control enable of the at least one access control unit, the interrupt control and status identifier of the at least one access control unit, the base address of the secure memory, the data length of the secure memory, the information feedback of the unauthorized access request, the address identifier of the unauthorized access request, and the information feedback of the unauthorized read access request.

[0029] Optionally, the protection region is determined based on a preset configuration of the base address of the secure memory corresponding to each of the at least one access control unit and the data length of the secure memory; the target protection region is determined based on a preset configuration of the base address of the secure memory corresponding to the target access control unit and the data length of the secure memory.

[0030] Optionally, performing the corresponding operation based on the category of the access request includes:

[0031] If the access request is a read request, then send feedback information to the master device and / or send a prompt information to the central processing unit;

[0032] If the access request is a write request, no operation is performed.

[0033] According to a second aspect of this disclosure, an access control system is provided, applied to any one of at least one access control unit, said at least one access control unit being deployed in a memory controller, the system comprising:

[0034] A category determination module is used to determine the category of the master device that sent the access request in response to the memory controller receiving the access request.

[0035] An access request determination module is used to determine whether an access request is an allowable access request based on the category of the master device when the access control unit is enabled.

[0036] An execution module is configured to allow the access request if it is an allowable access request, deny the access request if it is not an allowable access request, and perform a corresponding operation based on the category of the access request.

[0037] According to a third aspect of this disclosure, a computer-readable storage medium is provided having a computer program stored thereon that, when executed by a processor, implements the steps of the method described in any of the first aspects of this disclosure.

[0038] According to a fourth aspect of this disclosure, an electronic device is provided, comprising: a memory having a computer program stored thereon; and a processor for executing the computer program in the memory to implement the steps of the method according to any one of the first aspects of this disclosure.

[0039] According to a fifth aspect of this disclosure, a system-on-a-chip is provided, comprising at least one master device; a memory controller for controlling memory access of the at least one master device, the memory controller being configured with at least one access control unit, any one of the at least one access control unit being configured to perform the steps of the method as described in any one of the first aspects of this disclosure.

[0040] The above technical solution monitors access requests to the memory controller via an access control unit, allowing only secure access requests. This effectively protects every access to the memory space, thus protecting memory data access. Furthermore, deploying an access control unit on the memory controller provides chip-level protection, which is relatively easy to implement in chip design. Only the lowest-level technical personnel of the chip solution provider understand the protection principle. Therefore, this protection method offers excellent confidentiality and security at a low cost.

[0041] Other features and advantages of this disclosure will be described in detail in the following detailed description section. Attached Figure Description

[0042] The accompanying drawings are provided to further illustrate the present disclosure and form part of the specification. They are used together with the following detailed description to explain the present disclosure, but do not constitute a limitation thereof. In the drawings:

[0043] Figure 1This is a flowchart of an access control method provided according to one embodiment of the present disclosure;

[0044] Figure 2 This is a flowchart of determining whether an access request is an allowable access request according to one embodiment of the present disclosure;

[0045] Figure 3 This is another flowchart of determining whether an access request is an allowable access request, according to one embodiment of the present disclosure;

[0046] Figure 4 This is a block diagram of an access control system provided according to one embodiment of the present disclosure;

[0047] Figure 5 This is a block diagram of an electronic device provided according to one embodiment of the present disclosure;

[0048] Figure 6 This is a schematic diagram of the structure of a system-on-a-chip provided according to one embodiment of the present disclosure;

[0049] Figure 7 This is an exemplary flowchart of an access control method provided according to one embodiment of the present disclosure. Detailed Implementation

[0050] The specific embodiments of this disclosure will be described in detail below with reference to the accompanying drawings. It should be understood that the specific embodiments described herein are for illustration and explanation only and are not intended to limit this disclosure.

[0051] Figure 1 This is a flowchart of an access control method provided according to one embodiment of the present disclosure. In some embodiments, the method can be applied to any one of at least one access control unit, which is deployed in a memory controller. In some embodiments, each of the at least one access control unit may include at least one register. Specific details regarding the at least one register can be found in step 120 and its related description, and will not be repeated here. In some embodiments, the memory controller may be a DDR (DDR SDRAM, Double Data Rate Synchronous Dynamic Random Access Memory) memory controller, which may be deployed within a System on Chip (SoC). The DDR memory controller can control the data interaction between the various master devices and DDR memory devices within the SoC. For example, it controls data read and write access between the various master devices and memory devices. Specific details regarding the structure of the SoC can be found in […]. Figure 6 The details and related descriptions will not be repeated here.

[0052] like Figure 1As shown, the access control method may include steps 110 to 140. The access control method provided in this disclosure will be described in detail below with reference to steps 110 to 140.

[0053] Step 110: In response to the memory controller receiving an access request, determine the category of the master device that sent the access request.

[0054] In some embodiments, the master device may refer to a master device included within the SOC chip. In some embodiments, the master device may include at least one of the following: a CPU (Central Processing Unit), an NPU (neural-network processing unit) acceleration engine, an AI (Artificial Intelligence) acceleration engine, non-volatile memory, and DMA (Direct Memory Access). In some embodiments, the access request may be a data read and / or write access request, and the memory controller can control the master device's read and / or write operations on the DDR memory device by receiving the access request sent by the master device. In some embodiments, the DDR memory device may be an external memory device of the SOC chip.

[0055] In some embodiments, the categories of master devices can be divided according to preset rules. In some embodiments, the categories of master devices can be divided by whether or not they include security control mechanisms. In some embodiments, master devices can include target master devices and non-target master devices, wherein target master devices can be master devices that include security control mechanisms, and non-target master devices can be master devices that do not include security control mechanisms. In some embodiments, target master devices can include at least a CPU and DMA.

[0056] In some embodiments, the access request sent by the master device (i.e., the target master device) including the security control mechanism carries an access identifier. In some embodiments, the access identifier may reflect whether the corresponding access request is a secure access. For specific details regarding the access identifier, please refer to step 210 and its related description, which will not be repeated here.

[0057] Step 120: When the access control unit is enabled, determine whether the access request is an allowable access request based on the category of the master device.

[0058] In some embodiments, the access control unit being in an enabled state indicates that the access control unit is in an active state. In this state, the access control unit can determine whether an access request is an allowable access request based on the type of the master device. In some embodiments, if at least one access control unit is not in an enabled state, the corresponding access can be performed directly based on the access request. In some embodiments, an allowable access request can refer to an access request that allows normal read and write access to memory.

[0059] In some embodiments, if the host device is the target host device, the access control unit can determine whether the access request is an allowable access request based on the first information carried in the access request. In some embodiments, the first information may include at least an access identifier and an access request address. For specific details on determining whether an access request is an allowable access request based on the first information, please refer to [link to relevant documentation]. Figure 2 The details and related descriptions will not be repeated here.

[0060] In some embodiments, if the master device is not the target master device, the access control unit can determine whether the access request is an allowable access request based on the second information carried in the access request and the preset configuration of the target access control unit. In some embodiments, the target access control unit is an access control unit in an enabled state. In some embodiments, the second information may include at least the access request address. Based on the access request address, it can be quickly determined whether the access area of ​​the access request address is the target protection area, thereby improving the efficiency of determining the allowable access request of the target / non-target master device. In some embodiments, the first information and the second information may also include at least one of the following: read / write type, master device number, read / write data length, and read / write information, etc. The read / write type can be used to quickly determine the type of the current access request, so that different operations can be performed on read and write operations when it is subsequently determined that the current access request is not an allowable access request. The master device number can be used to quickly determine the master device that issued the current access request, so that if the access request corresponding to the master device is not an allowable access request, interrupt control can be quickly performed on the master device based on the master device number.

[0061] In the embodiments of this specification, since the access request issued by the target master device contains an access identifier, and the access identifier can directly reflect whether the access request is a secure access request, further, by directly determining the access request as an allowable access request when it is reflected as a secure access request; and by initiating the determination of whether it is an allowable access request only when it is reflected as not a secure access request, the access control process of the target master device for access requests is simplified, and the efficiency of the target master device for secure access control is improved.

[0062] Meanwhile, by implementing different procedures for determining permissible access requests for different types of master devices, the security access control process for master devices can be simplified, and the efficiency of the access control unit in controlling the security access of master devices can be improved.

[0063] In some embodiments, the preset configuration can at least reflect the access pattern of the host device to the memory regions of the memory controller. In some embodiments, the memory regions can include protected regions and unprotected regions. Correspondingly, the preset configuration can at least reflect the access pattern of the host device to the protected regions and unprotected regions of the memory controller. The access pattern can reflect access permissions, i.e., read / write operation permissions. In some embodiments, the access pattern can at least include: only protected regions can be read / write operations, only unprotected regions can be read / write operations, or both protected and unprotected regions can be read / write operations. In some embodiments, the protected region can be a secure memory region of at least one access control unit, and correspondingly, the unprotected region is a region of memory regions other than the secure memory region. In some embodiments, the protected region can be determined by the preset configuration of at least one access control unit. For specific details on determining the protected region, please refer to step 230 and its related description, which will not be repeated here.

[0064] In the embodiments described in this specification, since non-target master devices do not contain access identifiers, the access control unit cannot directly determine whether an access request issued by a non-target master device is an allowable access request based on the access identifier. Therefore, for non-target master devices, the access control unit can utilize pre-configuration to determine whether an access request is an allowable access request, thereby simplifying the security access control process for access requests from non-target master devices and improving the efficiency of security access control for non-target master devices.

[0065] In some embodiments, each of the at least one access control unit may include at least one register, and the preset configuration of each access control unit is determined based on the configuration of the configuration items of the corresponding at least one register. In some embodiments, the preset configuration may also reflect at least one of the following: overall control enable of the at least one access control unit, interrupt control and status flag of the at least one access control unit, base address of secure memory, data length of secure memory, information feedback of unauthorized access requests, address flag of unauthorized access requests, and information feedback of unauthorized read access requests. By setting at least one register, the configuration items of the at least one register can be flexibly configured; for example, the base address and data length of secure memory can be flexibly configured to flexibly adjust the size and position of the protected area of ​​the at least one access control unit.

[0066] In some embodiments, the overall control enable of at least one access control unit can be used to reflect the control over the operation or effectiveness (i.e., enable) of the entire access control unit. In some embodiments, the interrupt control and status flags of at least one access control unit can reflect the interrupt control and status flags performed on the access control unit when a non-allowed access request is generated. In some embodiments, the base address of the secure memory and the data length of the secure memory can reflect the address of the protected region. In some embodiments, the information feedback of the non-allowed access request can reflect the identifier of the host device and the read / write data length when a non-allowed read / write access is generated. In some embodiments, the address identifier of the non-allowed access request can reflect the identifier of the address information of the non-allowed read / write access when a non-allowed read / write access is generated. In some embodiments, the information feedback of the non-allowed read access request can reflect the fixed data sent by the DDR controller to the host device when a non-allowed read access is generated. In some embodiments, each of at least one register includes a corresponding configuration item, and configuring the configuration item of at least one register can determine the preset configuration of the access control unit.

[0067] Step 130: If the access request is an allowable access request, then allow the access request.

[0068] Step 140: If the access request is not an allowed access request, then the access request is rejected, and the corresponding operation is performed based on the category of the access request.

[0069] In some embodiments, the security access control unit may reject an access request if it is not an allowed access request, and send feedback information to the master device and / or a prompt message to the central processing unit if the access request is a read request. In some embodiments, the feedback information may be determined by a preset configuration, for example, by a configuration for feedback on non-allowed read access requests. The feedback information may be preset fixed data. By sending feedback and prompt messages, the security control controller can be promptly notified, thus protecting the data.

[0070] In some embodiments, the security access control unit may not perform any operation if the access request is a write request.

[0071] Figure 2 This is a flowchart for determining whether an access request is an allowable access request, according to one embodiment of the present disclosure.

[0072] Step 210: Determine whether the access identifier is a secure access identifier.

[0073] Step 220: If the access identifier is a secure access identifier, then the access request is determined to be an allowed access request.

[0074] Step 230: If the access identifier is not a secure access identifier, then determine whether the access request address includes the target protected area.

[0075] Step 240: If the access request address does not include the target protected area, determine that the access request is an allowed access request; if the access request address includes the target protected area, determine that the access request is not an allowed access request.

[0076] Referring to Table 1, which shows a description of the configuration items of various registers of the access control module shown in some embodiments of this specification.

[0077] Table 1:

[0078]

[0079]

[0080] As mentioned above, access modes can at least include: read / write operations only on protected areas, read / write operations only on unprotected areas, and read / write operations on both protected and unprotected areas. In some embodiments, access modes can be divided into write access mode and read access mode. Write access mode can at least include: write operations only on protected areas, write operations only on unprotected areas, and write operations on both protected and unprotected areas. Read access mode can at least include: read operations only on protected areas, read operations only on unprotected areas, and read operations on both protected and unprotected areas.

[0081] In some embodiments, write access modes and read access modes can be configured using different registers. For example, referring to Table 1 above, the write access modes for master device 0, master device 1, ..., master device N can be configured using SACUx_Master0_WRMODE, SACUx_Master1_WRMODE, ..., SACUx_MasterN_WRMODE. Similarly, the read access modes for master device 0, master device 1, ..., master device N can be configured using SACUx_Master0_RDMODE, SACUx_Master1_RDMODE, ..., SACUx_MasterN_RDMODE.

[0082] In some embodiments, different registers can be configured with corresponding preset values ​​to implement different write access modes and read access modes. For example, still using the example in Table 1 above, the SACUx_Master0_WRMODE register can be configured with preset values ​​of 0, 1, or 2. The write access modes of master device 0 then correspond to: "Write operations can only be performed on protected areas," "Write operations can only be performed on unprotected areas," or "Write operations can be performed on both protected and unprotected areas," respectively. Similarly, the preset values ​​configured for registers SACUx_Master1_WRMODE, ..., SACUx_MasterN_WRMODE and their corresponding write access modes can be the same as those for register SACUx_Master0_WRMODE, and will not be repeated here.

[0083] Similarly, the SACUx_Master0_RDMODE register can be configured with a default value of 0, 1, or 2, which corresponds to the read access mode of master device 0 as: "read operations can only be performed on protected areas", "read operations can only be performed on unprotected areas", or "read operations can be performed on both protected and unprotected areas". Likewise, the default values ​​configured for registers SACUx_Master1_RDMODE, ..., SACUx_MasterN_RDMODE and their corresponding write access modes can be the same as those for register SACUx_Master0_RDMODE, and will not be elaborated further here.

[0084] In some embodiments, a security access identifier indicates that the access request is a secure access. In some embodiments, the protected region can be determined based on a preset configuration of the base address of each corresponding secure memory in at least one access control unit and the data length of the secure memory. For example, assuming the memory controller includes four security access control units (SACUs), namely SACU0, SACU1, SACU2, and SACU3, the configuration items SACU0_BASE and SACU0_LEN in the registers of SACU0 are configured to define an address range of (SACU0_BASE to SACU0_BASE + SACU0_LEN), then this address range is secure memory 0; the configuration items SACU1_BASE and SACU1_LEN in the registers of SACU1 are configured to define an address range of (SACU1_BASE to SACU1_BASE + SACU0_LEN). If the address range is U1_LEN, then that address range is safe memory 1; if the configuration items SACU2_BASE and SACU2_LEN in the SACU2 registers are configured to limit the address range to (SACU2_BASE~SACU2_BASE+SACU2_LEN), then that address range is safe memory 2; if the configuration items SACU3_BASE and SACU3_LEN in the SACU3 registers are configured to limit the address range to (SACU3_BASE~SACU3_BASE+SACU3_LEN), then that address range is safe memory 3. Therefore, the protected region is the area corresponding to safe memory 0 to 3, and the unprotected region is the area of ​​memory other than safe memory 0 to 3.

[0085] In some embodiments, the target protection region can be determined based on a preset configuration of the base address of the secure memory corresponding to the target access control unit and the data length of the secure memory. For example, taking the above example of the protection region, if access control units SACU0 and SACU2 are enabled, then SACU0 and SACU2 are the target access control units, and correspondingly, the target protection region includes secure memories 0 and 2 corresponding to SACU0 and SACU2.

[0086] To more clearly and completely illustrate the access control process shown in some embodiments of this disclosure, the following will be used... Figure 7 Let's take an example to illustrate this, where, Figure 7The illustrated process is executed based on the four access control units included in the memory controller of the example described above. Specifically, the access control method of this disclosure can be executed for any one of SACU0, SACU1, SACU2, and SACU3. Assuming that SACU0 and SACU2 are enabled, taking SACU0 as an example, SACU0 can determine the category of the master device sending the access request in response to the memory controller receiving an access request. Since SACU0 is enabled, SACU0 can execute different access control processes for the access request based on the category of the master device.

[0087] Specifically, when the target master device is identified, it is determined whether the access identifier of the access request is a secure access identifier. If the access identifier is a secure access identifier, the access request is allowed to perform normal read and write access to memory. If the access identifier is not a secure access identifier, it is determined whether the access request address includes the target protected area "Secure Memory 0" corresponding to SACU0. If it does not include it, the access request is allowed to perform normal read and write access to memory. If it does include it, access is not allowed (i.e., the access request is denied). It is also determined whether the access request is a read operation or a write operation. If the access request is a read operation, feedback information is sent to the master device. If the access request is a write operation, there is no actual write operation, i.e., no write operation is performed.

[0088] If the primary device is not the target primary device, determine whether the non-target primary device is a device that is allowed to access the protected area. If the non-target primary device is a device that is allowed to access the protected area, then the access request is allowed to perform normal read and write access to memory. If the non-target primary device is not a device that is allowed to access the protected area, then determine whether the access request address includes the target protected area "Secure Memory 0" corresponding to SACU0. If it does not include it, then the access request is allowed to perform normal read and write access to memory. If it does include it, then access is not allowed (i.e., the access request is denied), and determine whether the access request is a read operation or a write operation. If the access request is a read operation, send feedback information to the primary device. If the access request is a write operation, there is no actual write operation, i.e., no write operation is performed.

[0089] Similarly, SACU2 can execute the same access control flow as SACU0, except that the target protected area is the security memory 2 corresponding to SACU2. For SACU1 and SACU3, since neither is enabled, they cannot execute different access control flows for access requests based on the master device category. Regarding... Figure 7 The specific details of each step have been explained above and will not be repeated here.

[0090] Therefore, in the embodiments of this specification, by deploying at least one access control unit in the memory controller, when the memory controller receives a request to access memory, the target access control unit in the enabled state of at least one access control unit can control the secure access to its corresponding target protected area. Specifically, for access requests that are considered secure access, normal read and write access to memory is allowed; for access requests that are considered unauthorized access to the target secure memory area, they are blocked and feedback information is sent to the master device to protect the data. An unauthorized access request to the target secure memory area is defined as: an access identifier that is not a secure access identifier, and an access request address that includes the target protected area; or, an access request that is not issued by a device that is allowed to access the protected area, and an access request address that includes the target protected area.

[0091] Figure 3 This is another flowchart provided according to one embodiment of the present disclosure for determining whether an access request is an allowable access request.

[0092] Step 310: Based on the access mode, determine whether the non-target master device is a device that is allowed to access the protected area.

[0093] For specific details regarding the access modes, please refer to step 210 above and its related description. In some embodiments, when the access request is a read request, and the access mode is either read-only on the protected area or read-only on both the protected and unprotected areas, the non-target master device can be determined as a device permitted to access the protected area. In some embodiments, when the access request is a write request, and the access mode is either write-only on the protected area or write-only on both the protected and unprotected areas, the non-target master device can be determined as a device permitted to access the protected area.

[0094] Step 320: If the non-target master device is a device that is allowed to access the protected area, then the access request is determined to be an allowed access request.

[0095] Step 330: If the non-target master device is not a device that is allowed to access the protected area, then determine whether the access request address includes the target protected area.

[0096] Step 340: If the access request address does not include the target protected area, determine that the access request is the allowed access request; if the access request address includes the target protected area, determine that the access request is not the allowed access request.

[0097] For specific details regarding step 340, please refer to step 240 and its related description above, which will not be repeated here.

[0098] Figure 4 This is a block diagram of an access control system provided according to one embodiment of the present disclosure. The system is applied to any one of at least one access control unit, which is deployed within a memory controller. Figure 4 As shown, the system 400 includes:

[0099] Category determination module 410 is used to determine the category of the master device that sent the access request in response to the memory controller receiving the access request;

[0100] The access request determination module 420 is used to determine whether the access request is an allowable access request based on the category of the master device when the access control unit is enabled.

[0101] The execution module 430 is configured to allow the access request if the access request is an allowable access request, deny the access request if the access request is not an allowable access request, and perform a corresponding operation based on the category of the access request.

[0102] Optionally, the access request determination module 420 may be further used to:

[0103] If the host device is the target host device, the access request is determined to be an allowed access request based on the first information carried by the access request.

[0104] If the master device is not the target master device, then based on the second information carried in the access request and the preset configuration of the target access control unit, it is determined whether the access request is the allowable access request;

[0105] The target master device is a master device that includes a security control mechanism, and the target access control unit is an access control unit in an enabled state.

[0106] Optionally, the first information includes at least an access identifier and an access request address; the access request determination module 420 may further be used to:

[0107] Determine whether the access identifier is a secure access identifier;

[0108] If the access identifier is a secure access identifier, the access request is determined to be an allowed access request;

[0109] If the access identifier is not a secure access identifier, determine whether the access request address includes the target protected area; and,

[0110] If the access request address does not include the target protected area, the access request is determined to be an allowed access request; if the access request address includes the target protected area, the access request is determined not to be an allowed access request.

[0111] Optionally, the second information includes at least an access request address, and the preset configuration at least reflects the access mode of the master device to the memory region of the memory controller, the memory region including protected and unprotected regions; the access request determination module 420 may be further used for:

[0112] Based on the access pattern, determine whether the non-target master device is a device allowed to access the protected area;

[0113] If the non-target host device is a device that is allowed to access the protected area, the access request is determined to be the allowed access request;

[0114] If the non-target master device is not a device authorized to access the protected area, determine whether the access request address includes the target protected area; and,

[0115] If the access request address does not include the target protected area, the access request is determined to be an allowed access request; if the access request address includes the target protected area, the access request is determined not to be an allowed access request.

[0116] Optionally, each of the access control units includes at least one register, and the preset configuration of each access control unit is determined based on the configuration of configuration items for the corresponding at least one register;

[0117] The preset configuration also reflects at least one of the following: the overall control enable of the at least one access control unit, the interrupt control and status identifier of the at least one access control unit, the base address of the secure memory, the data length of the secure memory, the information feedback of the unauthorized access request, the address identifier of the unauthorized access request, and the information feedback of the unauthorized read access request.

[0118] Optionally, the protection region is determined based on a preset configuration of the base address of the secure memory corresponding to each of the at least one access control unit and the data length of the secure memory; the target protection region is determined based on a preset configuration of the base address of the secure memory corresponding to the target access control unit and the data length of the secure memory.

[0119] Optionally, the execution module 430 may be further configured to:

[0120] If the access request is a read request, send feedback information to the master device and / or send a prompt information to the central processing unit;

[0121] If the access request is a write request, no operation is performed.

[0122] Regarding the system in the above embodiments, the specific manner in which each module performs its operations has been described in detail in the embodiments related to the method, and will not be elaborated upon here.

[0123] Figure 5 This is a block diagram of an electronic device 500 provided according to one embodiment of the present disclosure. For example... Figure 5 As shown, the electronic device 500 may include a processor 501 and a memory 502. The electronic device 500 may also include one or more of a multimedia component 503, an input / output (I / O) interface 504, and a communication component 505.

[0124] The processor 501 controls the overall operation of the electronic device 500 to complete all or part of the steps in the access control method described above. The memory 502 stores various types of data to support the operation of the electronic device 500. This data may include, for example, instructions for any application or method operating on the electronic device 500, and application-related data such as contact data, sent and received messages, pictures, audio, video, etc. The memory 502 can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as Static Random Access Memory (SRAM), Electrically Erasable Programmable Read-Only Memory (EEPROM), Erasable Programmable Read-Only Memory (EPROM), Programmable Read-Only Memory (PROM), Read-Only Memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk. Multimedia component 503 may include a screen and an audio component. The screen may be, for example, a touchscreen, and the audio component is used to output and / or input audio signals. For example, the audio component may include a microphone for receiving external audio signals. The received audio signals may be further stored in memory 502 or transmitted via communication component 505. The audio component also includes at least one speaker for outputting audio signals. I / O interface 704 provides an interface between processor 501 and other interface modules, such as a keyboard, mouse, buttons, etc. These buttons may be virtual or physical buttons. Communication component 505 is used for wired or wireless communication between the electronic device 700 and other devices. Wireless communication may include Wi-Fi, Bluetooth, Near Field Communication (NFC), 2G, 3G, or 4G, or a combination of these. Therefore, the corresponding communication component 505 may include a Wi-Fi module, a Bluetooth module, or an NFC module.

[0125] In an exemplary embodiment, the electronic device 500 may be implemented by one or more application-specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field-programmable gate arrays (FPGAs), controllers, microcontrollers, microprocessors, or other electronic components to perform the access control method described above.

[0126] In another exemplary embodiment, a computer-readable storage medium including program instructions is also provided, which, when executed by a processor, implement the steps of the access control method described above. For example, the computer-readable storage medium may be the memory 502 including the program instructions described above, which may be executed by the processor 501 of the electronic device 500 to perform the access control method described above.

[0127] Figure 6 This is a schematic diagram of a system-on-a-chip (SoC) according to one embodiment of this disclosure. For example... Figure 6 As shown, the system-on-a-chip 600 may include:

[0128] At least one master device (in) Figure 6 In the diagram, they are represented by master device 1 to master device N respectively;

[0129] A memory controller 610 for controlling memory access of the at least one master device, wherein at least one access control unit is deployed in the memory controller 610. Figure 6 In the above, (represented by access control unit 1 to access control unit N respectively), any one of the at least one access control unit is used to execute the access control method provided in any embodiment of this disclosure. For specific details regarding the access control method executed by any access control unit, please refer to [link to relevant documentation]. Figure 1 The details and related descriptions will not be repeated here. In some embodiments, the system-on-a-chip 600 may further include a memory device 620, which can be used by at least one master device to read and write data.

[0130] Depend on Figure 6As shown, master devices 1 to N can send data read / write access requests to the memory controller 610, which controls the read / write operations of master devices 1 to N on the memory device 620. The memory controller 610 acts as a bridge between the various master devices and the memory device 620 within the system-on-a-chip 610; almost all data and program flows pass through this path. Therefore, deploying a secure access control unit in the memory controller 610, and having this unit execute the corresponding access control process, can effectively protect every access to the memory device, ensuring access security from the perspective of low-level memory data access protection. This memory data access protection mechanism is the most direct, easy to implement for chip design, and only the lowest-level technical personnel of the chip solution provider know how to control it, thus providing excellent confidentiality and security.

[0131] The preferred embodiments of this disclosure have been described in detail above with reference to the accompanying drawings. However, this disclosure is not limited to the specific details of the above embodiments. Within the scope of the technical concept of this disclosure, various simple modifications can be made to the technical solutions of this disclosure, and all such simple modifications fall within the protection scope of this disclosure.

[0132] It should also be noted that the various specific technical features described in the above specific embodiments can be combined in any suitable manner without contradiction. In order to avoid unnecessary repetition, this disclosure will not describe the various possible combinations separately.

[0133] Furthermore, various different embodiments of this disclosure can be combined in any way, as long as they do not violate the spirit of this disclosure, they should also be regarded as the content disclosed in this disclosure.

Claims

1. An access control method characterized by, The method is applied to any one of at least one access control unit deployed in a memory controller, and comprises: in response to the memory controller receiving an access request, determining the category of a master device sending the access request; and in a case where the access control unit is in an enabled state, determining whether the access request is an allowable access request based on the category of the master device; if the access request is the allowable access request, allowing the access request; if the access request is not the allowable access request, rejecting the access request and performing a corresponding operation based on the category of the access request; the determining whether the access request is the allowable access request based on the category of the master device comprises: if the master device is a target master device, determining whether the access request is the allowable access request based on first information carried by the access request; if the master device is a non-target master device, determining whether the access request is the allowable access request based on second information carried by the access request and a preset configuration of a target access control unit; the target master device is a master device comprising a security control mechanism, and the target access control unit is an access control unit in the enabled state.

2. The method of claim 1, wherein, the first information at least comprises an access identifier and an access request address; the determining whether the access request is the allowable access request based on the first information carried by the access request comprises: determining whether the access identifier is a secure access identifier; if the access identifier is a secure access identifier, determining that the access request is the allowable access request; if the access identifier is not a secure access identifier, determining whether the access request address comprises a target protection area; and in a case where the access request address does not comprise the target protection area, determining that the access request is the allowable access request, and in a case where the access request address comprises the target protection area, determining that the access request is not the allowable access request.

3. The method of claim 1, wherein, the second information at least comprises an access request address, and the preset configuration at least reflects an access mode of the master device to a memory region of the memory controller, the memory region comprising a protection region and a non-protection region; the determining whether the access request is the allowable access request based on the second information carried by the access request and the preset configuration of the target access control unit comprises: based on the access mode, determining whether the non-target master device is a device allowed to access the protection region; if the non-target master device is the device allowed to access the protection region, determining that the access request is the allowable access request; if the non-target master device is not the device allowed to access the protection region, determining whether the access request address comprises a target protection area; and in a case where the access request address does not comprise the target protection area, determining that the access request is the allowable access request, and in a case where the access request address comprises the target protection area, determining that the access request is not the allowable access request.

4. The method of claim 3, wherein, Each of the access control units comprises at least one register, and preset configurations of each of the access control units are determined based on configurations of configuration items of the corresponding at least one register; The preset configurations further reflect at least one of the following: total control enable of the access control unit, interrupt control and status identification of the access control unit, base address of the secure memory, data length of the secure memory, information feedback of non-permitted access request, address identification of non-permitted access request, and information feedback of non-permitted read access request.

5. The method of claim 4, wherein, The protection region is determined based on the preset configurations of the base address of the corresponding secure memory and the data length of the secure memory in each of the access control units, and the target protection region is determined based on the preset configurations of the base address of the corresponding secure memory and the data length of the secure memory in the target access control unit.

6. The method of claim 4, wherein, The corresponding operation based on the category of the access request comprises: If the access request is a read request, feedback information is sent to the host device and / or prompt information is sent to a central processor; If the access request is a write request, no operation is performed.

7. An access control system characterized by, The system comprises: A category determination module configured to determine a category of a host device sending an access request in response to the memory controller receiving the access request; An access request determination module configured to determine whether the access request is a permissible access request based on the category of the host device in a case where the access control unit is in an enabled state; An execution module configured to allow the access request in a case where the access request is the permissible access request, and to reject the access request and perform a corresponding operation based on the category of the access request in a case where the access request is not the permissible access request; The access request determination module is further configured to: If the host device is a target host device, determine whether the access request is the permissible access request based on first information carried by the access request; If the host device is a non-target host device, determine whether the access request is the permissible access request based on second information carried by the access request and preset configurations of a target access control unit; The target host device is a host device comprising a security control mechanism, and the target access control unit is an access control unit in the enabled state.

8. A computer-readable storage medium having stored thereon a computer program, characterized in that, The program is executed by the processor to implement the steps of the method in any one of claims 1-6.

9. An electronic device, comprising: Comprise: A memory having a computer program stored thereon; A processor configured to execute the computer program in the memory to implement the steps of the method in any one of claims 1-6.

10. A system on chip, characterized in that At least one host device; A memory controller configured to control memory access of the at least one host device, the memory controller being deployed with at least one access control unit, and any one of the at least one access control unit being configured to implement the steps of the method in any one of claims 1-6.

Images