A self-protected DMA controller and control method

Abstract

The present application relates to the technical field of chip security, and particularly relates to a self-protecting DMA controller and a control method, wherein the DMA controller comprises a sending engine and a receiving engine, the receiving engine comprises a configuration unit, a detection unit and an exception detection rule library; the configuration unit is configured to respond to a configuration instruction and configure a detection strategy and a filtering strategy based on the configuration instruction; the detection unit is connected with the configuration unit and the exception detection rule library, and is configured to call a data packet level exception rule table in the exception detection rule library according to the configured detection strategy, and detect a data packet received by the receiving engine based on the data packet level exception rule table to obtain a detection result; and the receiving engine is configured to dispose the data packet according to the filtering strategy and the detection result, and the disposal mode comprises normal sending or discarding. The present application can detect the maliciousness of the transmitted data packet, so as to realize the safe transmission of data.

Description

Technical Field

[0001] This invention relates to the field of chip security technology, and in particular to a self-protection DMA controller and control method. Background Technology

[0002] A DMA controller (DMAC) is a dedicated controller that implements direct access mechanisms for data transfer. It can perform four types of direct data transfer: memory-to-peripheral, memory-to-memory, peripheral-to-memory, and peripheral-to-peripheral. However, existing DMA controllers simply transfer data unconditionally based on I / O requests and lack self-protection against threats. Summary of the Invention

[0003] Since existing DMA controllers lack self-protection capabilities, which may lead to malicious data being transferred from peripherals to memory for execution, this invention provides a self-protecting DMA controller and control method that can detect the malice of transmitted data packets, thereby achieving secure data transmission and ensuring the legality and security of the data.

[0004] In a first aspect, embodiments of the present invention provide a self-protected DMA controller, comprising:

[0005] The receiving engine includes a configuration unit, a detection unit, and an anomaly detection rule base;

[0006] The configuration unit is used to respond to configuration commands and configure detection and filtering strategies based on the configuration commands;

[0007] The anomaly detection rule base stores a data packet-level anomaly rule table;

[0008] The detection unit is connected to both the configuration unit and the anomaly detection rule base. It is used to call the data packet level anomaly rule table in the anomaly detection rule base according to the configured detection strategy, and to detect the data packets received by the receiving engine based on the data packet level anomaly rule table to obtain the detection result.

[0009] The receiving engine is used to process data packets according to the detection results and the filtering strategy, including normal transmission or dropping.

[0010] Optionally, the detection strategy includes the device port type, packet type, and time period to be detected.

[0011] Optionally, the information recorded in the data packet-level anomaly rule table includes anomaly detection rules, anomaly type, anomaly threat level, and anomaly determination criteria;

[0012] The filtering strategy is based on the handling of abnormal threat levels.

[0013] Optionally, the DMA controller further includes:

[0014] A descriptor recorder, connected to the detection unit, is used to modify the received descriptor;

[0015] A data buffer, connected to the detection unit, is used to buffer data packets received by the receiving engine;

[0016] The detection unit is also configured to set the descriptor recorder according to the detection result, so that the descriptor recorder records the detection result in the receive descriptor corresponding to the data packet;

[0017] The receiving engine processes data packets according to the detection results and the filtering strategy, including processing data packets cached in the data buffer according to the receiving descriptor and the filtering strategy.

[0018] Optionally, the DMA controller further includes:

[0019] The alarm handling unit is used to generate and report alarms when the data packet is handled in a manner other than normal transmission.

[0020] Optionally, the DMA controller further includes:

[0021] An anomaly record storage unit is connected to the detection unit;

[0022] The detection unit is also used to generate an anomaly record report after an anomaly is detected, and store it in the anomaly record storage unit.

[0023] Secondly, embodiments of the present invention also provide a self-protected DMA controller control method, implemented using a self-protected DMA controller as described in any of the preceding claims, comprising:

[0024] The configuration unit responds to configuration commands and configures detection and filtering strategies based on the configuration commands.

[0025] The configured detection strategy is read through the detection unit;

[0026] Receive data packets through the receiving engine;

[0027] The detection unit loads the stored data packet-level anomaly rule table according to the detection strategy, and detects the received data packets based on the data packet-level anomaly rule table to obtain the detection results.

[0028] The receiving engine processes data packets based on the detection results and the filtering strategy, including normal transmission or dropping.

[0029] Optionally, if the self-protected DMA controller includes a data buffer, then the data packet received by the receiving engine is the data packet buffered by the data buffer;

[0030] If the self-protected DMA controller includes a descriptor logger, then the control method, after detecting the received data packet and obtaining the detection result, and before processing the data packet according to the detection result and the filtering strategy, further includes:

[0031] The descriptor recorder is set according to the detection results by the detection unit;

[0032] The detection results are recorded in the receive descriptor corresponding to the data packet using the descriptor recorder.

[0033] The step of processing data packets based on the detection results and the filtering strategy includes:

[0034] Read the receive descriptor and process the data packets according to the receive descriptor and the filtering strategy.

[0035] Optionally, if the self-protected DMA controller includes an alarm handling unit, then the control method further includes:

[0036] The alarm handling unit generates and reports alarms when the data packets are handled in a manner other than normal transmission.

[0037] Optionally, the control method further includes:

[0038] The detection unit generates an anomaly report when an anomaly is detected and stores it in a preset storage space.

[0039] This invention provides a self-protected DMA controller and control method. The receiving engine of the DMA controller includes a configuration unit, a detection unit, and an anomaly detection rule base. The configuration unit is used to configure the detection strategy and filtering strategy, and can modify the detection strategy and filtering strategy as needed. The detection unit is used to call the data packet-level anomaly rule table stored in the anomaly detection rule base according to the configured detection strategy to perform malicious detection on the transmitted data packets, so as to promptly detect malicious data and take corresponding actions according to the filtering strategy, thereby realizing secure data transmission and ensuring the legality and security of the transmitted data. Attached Figure Description

[0040] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0041] Figure 1 This is a schematic diagram of a self-protected DMA controller structure provided in an embodiment of the present invention;

[0042] Figure 2 This is a schematic diagram of the application state structure of a self-protecting DMA controller according to an embodiment of the present invention;

[0043] Figure 3 This is a flowchart illustrating the steps of a self-protected DMA controller control method according to an embodiment of the present invention;

[0044] Figure 4 This is a flowchart illustrating another self-protected DMA controller control method according to an embodiment of the present invention. Detailed Implementation

[0045] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are some embodiments of the present invention, but not all embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative effort are within the scope of protection of the present invention.

[0046] As mentioned earlier, a DMA controller (DMAC) is a dedicated controller that implements direct access mechanism for data transfer. Existing DMA controllers simply transfer data unconditionally according to I / O requests, lacking self-protection capabilities against threats. That is, they do not perform malicious detection on the transmitted data packets, potentially leading to the transfer of malicious data from peripherals to memory for execution. Therefore, this invention provides a DMA controller with hardware-level self-protection capabilities. During memory-to-peripheral, memory-to-memory, peripheral-to-memory, and peripheral-to-peripheral transfers, a built-in detection unit performs data security checks to ensure the legitimacy and security of the transmitted data.

[0047] The following describes the specific implementation of the above concept.

[0048] like Figure 1As shown, this embodiment of the invention provides a self-protecting DMA controller, including a sending engine and a receiving engine. The sending engine is used to obtain data packets from the memory and transmit them to the device port; the receiving engine is used to obtain data packets from the device port and transmit them to the memory.

[0049] The receiving engine includes a configuration unit, a detection unit, and an anomaly detection rule base;

[0050] The configuration unit is used to respond to configuration instructions and configure detection and filtering strategies based on the configuration instructions; the configuration instructions obtained by the configuration unit may come from the CPU.

[0051] The anomaly detection rule base stores a data packet-level anomaly rule table;

[0052] The detection unit is connected to both the configuration unit and the anomaly detection rule base. It is used to call the data packet level anomaly rule table in the anomaly detection rule base according to the detection strategy configured by the configuration unit, and to detect the data packets received by the receiving engine based on the data packet level anomaly rule table to obtain the detection result.

[0053] The receiving engine is used to process data packets according to the detection results and the filtering strategy. The processing methods include normal transmission or discarding. That is, for data packets with no abnormal detection results, they can continue to be transmitted to the corresponding memory according to their designated position. For data packets with abnormal detection results, the filtering strategy can be used to select whether to continue to be transmitted to the corresponding memory according to their designated position or to discard the data packet, so as to avoid introducing malicious data.

[0054] The DMA controller receiving engine provided in this embodiment of the invention incorporates a configuration unit, a detection unit, and an anomaly detection rule base. The configuration unit configures detection and filtering strategies, which can be modified as needed. The detection unit monitors the configuration unit; if changes are detected, it reads the configuration unit and reloads the detection unit. The anomaly detection rule base stores a specially maintained data packet-level anomaly rule table, which can also be adjusted and updated according to actual conditions. Once determined, the table is loaded by the detection unit. The detection unit, according to the detection strategy and based on the data packet-level anomaly rule table, detects received data packets. Before processing the data packets (i.e., before sending them to a designated memory), the detection results are obtained to identify anomalies in the transmitted data. The receiving engine processes the data packets based on the detection results and the filtering strategy, either sending the data packets normally or discarding them, thereby achieving secure data transmission and ensuring the legality and security of the transmitted data. This invention separates the configuration unit, detection unit, and anomaly detection rule base, which not only facilitates modifying strategies and updating the data packet-level anomaly rule table but also helps improve processing efficiency and reduce delays caused by malicious detection of transmitted data packets.

[0055] Optionally, the configuration unit configures a detection strategy, which includes the device port type, data packet type, and time period to be detected.

[0056] The above embodiments can be configured with multi-dimensional detection strategies. These dimensions include device port type, data packet type, and time period. Device port type refers to the type of device port to be detected; for example, only data packets originating from the network card can be detected. Data packet type, or detection granularity, refers to whether all data packets are detected or only specific types are detected; for example, only data packets from the external network can be detected. Time period refers to the time interval to be detected; detection can be performed throughout the entire time period or only during a specific time period. When the detection unit performs detection according to the configured strategy, for cases where detection is not required, the received data packets can be sent normally without detection to reduce latency. By flexibly configuring specific detection strategies, this self-protective DMA controller can perform detection for different application scenarios, adapting to the needs of different application scenarios.

[0057] Optionally, the anomaly detection rule base stores a data packet-level anomaly rule table, and the information recorded in the data packet-level anomaly rule table includes anomaly detection rules, anomaly types, anomaly threat levels, and anomaly determination criteria;

[0058] Among them, the anomaly detection rule is preferably a kernel-level packet-level anomaly detection rule. The specific anomaly detection rule or detection method adopted can refer to existing technologies to perform comprehensive and in-depth detection on the received packets, promptly detect potential anomalies, and provide corresponding anomaly types, anomaly threat levels, anomaly judgment criteria, etc.

[0059] Accordingly, the detection unit detects data packets based on the data packet-level anomaly rule table, that is, it detects data packets by means of the anomaly detection rules recorded in the data packet-level anomaly rule table, and determines the anomaly type and corresponding anomaly threat level in the data packet according to the anomaly determination criteria.

[0060] Furthermore, the filtering strategy is based on the handling method of abnormal threat level classification. For example, abnormal threat levels can be divided into 1-5, with the highest threat level set to 5 and the lowest to 1. The filtering strategy can be set to discard data packets with an abnormal threat level of 3 or higher, and send data packets with an abnormal threat level of 3 or higher normally. In other embodiments, other forms of abnormal threat levels can also be classified, and the filtering strategy for different abnormal threat levels can be adjusted according to actual needs.

[0061] Using the above embodiments, data packets with low threat levels can still be sent normally. In other words, the filtering strength can be set according to actual needs, avoiding the immediate discarding of data packets once they are judged to be abnormal, and reducing data loss caused by misjudgment and other situations.

[0062] Optionally, the DMA controller further includes a descriptor recorder connected to the detection unit for modifying the receive descriptor;

[0063] The detection unit is further configured to set the descriptor logger according to the detection results, so that the descriptor logger records the detection results in the receive descriptor corresponding to the data packet. The detection results can be recorded in the anomaly flag field specified in the receive descriptor. When the receiving engine reads the receive descriptor and reads the data packet from the specified peripheral address based on the receive task in the receive descriptor, the anomaly flag field in the receive descriptor can be set to normal, indicating that there are no anomalies in the currently transmitted data.

[0064] Furthermore, the DMA controller also includes:

[0065] A data buffer, connected to the detection unit, is used to cache data packets received by the receiving engine, so that the detection unit can detect the data packets cached in the data buffer based on the data packet-level anomaly rule table and obtain the detection result.

[0066] Accordingly, the receiving engine processes the data packets according to the detection results and the filtering strategy, including processing the data packets cached in the data buffer according to the receiving descriptor and the filtering strategy.

[0067] The above embodiments record the detection results in the receive descriptor corresponding to the data packet. The receiving engine can determine the detection results given by the detection unit by reading the receive descriptor, so as to combine the filtering strategy and perform the corresponding processing method on the data packet. This can effectively improve the processing efficiency of the receiving engine for data packets and also help reduce latency.

[0068] Furthermore, the detection results may include: whether it is abnormal and / or the level of abnormal threat, and preferably also include the type of abnormality.

[0069] Optionally, the DMA controller further includes an alarm handling unit, used to generate and report an alarm report when the receiving engine handles data packets in a manner other than normal transmission. The alarm report may include detection results and handling methods, and preferably also includes detection time.

[0070] The above embodiments include an alarm handling unit to report user data packet detection results and their processing destination in cases outside of normal transmission. This dedicated alarm handling unit helps reduce latency.

[0071] Furthermore, the alarm handling unit can generate an alarm report based on the received descriptor.

[0072] Determining the detection result quickly by reading the receive descriptor also helps to improve processing speed and reduce latency.

[0073] Optionally, the DMA controller further includes: an anomaly record storage unit connected to the detection unit;

[0074] The detection unit is also used to generate an anomaly record report after an anomaly is detected, and store it in the anomaly record storage unit.

[0075] In the above embodiments, the DMA controller has a built-in anomaly record storage unit for storing anomaly record reports. The anomaly record report may include information such as anomaly type, anomaly threat level, anomaly determination basis, data packet source device port type and name, and data packet source time, so as to facilitate manual traceability and analysis afterward.

[0076] Furthermore, the anomaly record storage unit is also connected to the alarm handling unit to obtain and store alarm reports generated by the alarm handling unit, so as to record the various alarm reports reported.

[0077] Furthermore, the alarm handling unit can also generate an alarm report based on the anomaly record report stored in the anomaly record storage unit. The generated alarm report may include information such as the source device port of the data packet and the source time of the data packet, so as to enrich the reporting content.

[0078] Optionally, the receiving engine processes the data packets, and the processing method may also include storing them in a preset storage space, that is, storing data packets with abnormal detection results in a preset memory instead of discarding them directly, so that users can view them.

[0079] When the DMA controller includes an anomaly recording storage unit, the preset memory can be set as the anomaly recording storage unit, that is, storing abnormal data packets into the anomaly recording storage unit built into the DMA controller. In use, the user can obtain anomaly recording reports, alarm reports, and abnormal data packets by reading the anomaly recording storage unit, enabling subsequent analysis and tracing.

[0080] Optionally, such as Figure 1 and Figure 2 As shown, the receiving engine further includes a data receiving unit, a data sending unit, and a control / status logic unit; wherein, the control / status logic unit is used to respond to transmission requests, start the receiving engine, and, after processing the data packets buffered in the data buffer, send back a transmission completion notification; the data receiving unit is used to read the receive descriptor and, based on the receive task in the receive descriptor, receive data packets from the specified device port; the data sending unit is used to read the receive descriptor and, based on the receive descriptor, send the buffered data packets normally to the specified address.

[0081] The above embodiments employ relatively separate and independent units to implement the function of the receiving engine. The relatively independent hardware design is conducive to improving processing speed and reducing data transmission delay caused by processing errors and detection. This enables the DMA controller to directly intervene in data transmission at the hardware level, quickly filter out problematic data packets, and meet the needs of real-time transmission as much as possible.

[0082] It should be noted that the self-protecting DMA controller provided by this invention can use a conventional transmission engine, such as... Figure 1 and Figure 2As shown, the sending engine may include a control / status logic unit, a descriptor recorder, and a data buffer. The control / status logic unit is used to respond to transmission requests, start the sending engine, and, after processing the data packets buffered in the data buffer, provide a transmission completion notification. The data buffer is used to buffer data packets. The descriptor recorder is used to read the transmission descriptor corresponding to the data packet. The sending engine may also take an unconventional form, such as adding a detection unit, and can be modified according to actual needs.

[0083] Please refer to Figure 3 This invention provides a self-protected DMA controller control method, which is implemented using a self-protected DMA controller as described in any of the above embodiments, and includes the following steps:

[0084] Step 300: The configuration unit responds to the configuration command and configures the detection and filtering strategies based on the configuration command; the configuration command may come from the CPU.

[0085] Step 302: Read the configured detection strategy through the detection unit;

[0086] Step 304: Receive data packets through the receiving engine;

[0087] Step 306: The detection unit loads the stored data packet-level anomaly rule table according to the detection strategy, and detects the received data packets based on the data packet-level anomaly rule table to obtain the detection result;

[0088] Step 308: The receiving engine processes the data packets according to the detection results and the filtering strategy. The processing methods include normal transmission or dropping.

[0089] The above embodiments provide a self-protected DMA controller control method. This control method can receive data packets through the receiving engine of the DMA controller, detect them, and process them to achieve secure data transmission. Furthermore, the method loads the stored data packet-level anomaly rule table according to the detection strategy, and detects the received data packets based on the data packet-level anomaly rule table to obtain the detection results. The detection strategy, anomaly rules, and filtering strategy can be set according to actual needs, making it easy to adjust and more adaptable.

[0090] Optionally, the detection strategy includes the device port type, packet type, and time period to be detected.

[0091] Optionally, the information recorded in the data packet-level anomaly rule table includes anomaly detection rules, anomaly type, anomaly threat level, and anomaly determination criteria;

[0092] The filtering strategy is based on the handling of abnormal threat levels.

[0093] Optionally, if the self-protected DMA controller includes a data buffer, the data packets received by the receive engine from the device port can be cached in the data buffer;

[0094] If the self-protected DMA controller includes a descriptor recorder, then the control method, after step 306 and before step 308, further includes:

[0095] The descriptor recorder is set according to the detection results by the detection unit;

[0096] The detection results are recorded in the receive descriptor corresponding to the data packet using the descriptor recorder.

[0097] Accordingly, step 308 includes:

[0098] The receiving engine reads the receiving descriptor and processes the corresponding data packets according to the receiving descriptor and the filtering strategy.

[0099] In the above embodiments, this control method utilizes the detection results recorded by the receive descriptor. The detection results may include whether the data is abnormal and / or the level of threat. Essentially, it adds information bits for recording detection results to the original receive descriptor. In use, the DMA controller determines the address of the transmitted data packet based on the receive descriptor and simultaneously determines the detection result of that data packet, obtaining information such as whether the data in the packet is abnormal and the level of threat. This information is then used in conjunction with the configured filtering strategy to process the data packet. This method requires less processing and has a faster processing speed, improving the processing speed of the receive engine for data packets and reducing latency caused by data detection.

[0100] Optionally, if the self-protected DMA controller includes an alarm handling unit, then the control method further includes:

[0101] The alarm handling unit generates and reports alarm reports when the data packet is handled in a manner other than normal transmission. The alarm report may include the detection result and the handling method, and preferably also includes the detection time.

[0102] The alarm handling unit reports and notifies the CPU, allowing the operating system kernel to read the abnormal alarm information from the abnormal record storage unit via the bus and issue a system-level alarm.

[0103] The above embodiments can promptly report when abnormal detection results occur, so as to notify users of the detection results of the data packet and the handling method.

[0104] Optionally, the control method further includes:

[0105] The detection unit generates an anomaly report when an anomaly is detected and stores it in a preset storage space.

[0106] If the self-protected DMA controller includes an exception record storage unit, the generated exception record report can be stored in the exception record storage unit for the user to view.

[0107] Furthermore, step 308 processes the data packets. The processing method may also include storing the data packets in a preset storage space. The preset storage space may be a built-in abnormal record storage unit or a specified peripheral device, so as to retain data packets in which the detection results are abnormal.

[0108] Please refer to Figure 4 This invention provides a self-protected DMA controller control method, which employs, as shown in the following embodiments: Figure 2 The self-protected DMA controller implementation shown includes the following steps:

[0109] Step 400: The configuration unit responds to the configuration command and configures the detection strategy and filtering strategy based on the configuration command;

[0110] Step 402: Read the configured detection strategy through the detection unit;

[0111] Step 404: Receive data packets through the receiving engine and buffer them in the data buffer;

[0112] In this step, the receiving engine reads the receiving descriptor, reads data from the specified peripheral based on the receiving task in the receiving descriptor, and adds an exception flag bit to the receiving descriptor, which is initially set to no exception, that is, it indicates that the current DMA transmission data packet has no exception before detection.

[0113] Step 406: The detection unit loads the stored data packet level anomaly rule table according to the detection strategy, and detects the data packets cached in the data buffer based on the data packet level anomaly rule table to obtain the detection result. The descriptor logger is set according to the detection result, and an anomaly record report is generated and stored in the preset storage space after an anomaly is detected.

[0114] In this step, the data packets to be detected are cached in the data buffer. The detection is based on the pre-built data packet level anomaly rule table to discover potential anomaly types, threat levels, and anomaly judgment criteria in the data packets. If an anomaly is found, the relevant abnormal data packets and anomaly information can be recorded to facilitate alarms and subsequent tracing.

[0115] Step 408: Record the detection result in the receive descriptor corresponding to the data packet using the descriptor recorder;

[0116] If an anomaly is detected in this step, it is marked in the anomaly flag bit in the receive descriptor, so that the receive engine can filter the data packets in the next step.

[0117] Step 410: Read the receiving descriptor through the receiving engine, and process the data packets cached in the data buffer according to the receiving descriptor and the filtering strategy. The processing methods include normal transmission, storage in a preset storage space, or discarding.

[0118] This step checks for abnormalities in data packets based on the abnormal status flags in the receive descriptor. Then, it filters the data packets based on the filtering policy, discarding or storing abnormal or high-threat data packets in a preset storage space instead of storing them in the memory location specified in the receive descriptor.

[0119] Step 412: The alarm handling unit generates and reports an alarm report when the data packets cached in the data buffer are handled in a manner other than normal transmission.

[0120] This step can generate an alarm based on the abnormal status flag in the receive descriptor and the recorded abnormal information, and report the abnormality to the CPU. The CPU can then display the abnormal information.

[0121] In summary, the embodiments of the present invention have at least the following beneficial effects:

[0122] 1. In this embodiment of the invention, a self-protecting DMA controller and control method are provided, which can perform packet-level anomaly detection on data packets transmitted through the DMA controller according to configuration instructions, can detect threats in a timely manner, block the spread of malicious data, realize security protection based on hardware-level real-time threat blocking, and prevent threats from running in the host.

[0123] 2. In this embodiment of the invention, a self-protected DMA controller and control method are provided, which records the detection result in the receive descriptor corresponding to the data packet, thereby improving the processing speed and reducing the delay caused by detection;

[0124] 3. In this embodiment of the invention, a self-protecting DMA controller and control method are provided, which generates and reports an alarm report when the data packet is handled in a manner other than normal transmission, so as to notify the user of the detection results and handling method in a timely manner;

[0125] 4. In this embodiment of the invention, a self-protecting DMA controller and control method are provided. After an abnormality is detected, an abnormality record report is generated and stored in a preset storage space for users to view. It can also further store data packets of detected abnormalities for users to analyze.

[0126] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus.

[0127] Those skilled in the art will understand that all or part of the steps of the above method embodiments can be implemented by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When the program is executed, it performs the steps of the above method embodiments. The aforementioned storage medium includes various media that can store program code, such as ROM, RAM, magnetic disk, or optical disk.

[0128] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A self-protected DMA controller, comprising a transmit engine and a receive engine, characterized in that: The receiving engine includes a configuration unit, a detection unit, and an anomaly detection rule base; The configuration unit is used to respond to configuration commands and configure detection and filtering strategies based on the configuration commands; the anomaly detection rule base stores a packet-level anomaly rule table; the detection strategy includes the device port type, packet type, and time period to be detected; the information recorded in the packet-level anomaly rule table includes anomaly detection rules, anomaly type, anomaly threat level, and anomaly judgment criteria; the filtering strategy is based on the method of handling anomaly threat level classification. The detection unit is connected to both the configuration unit and the anomaly detection rule base. It is used to call the data packet level anomaly rule table in the anomaly detection rule base according to the configured detection strategy, and to detect the data packets received by the receiving engine based on the data packet level anomaly rule table to obtain the detection result. The receiving engine is used to process data packets according to the detection results and the filtering strategy, including normal transmission or dropping.

2. The DMA controller according to claim 1, characterized in that, Also includes: A descriptor recorder, connected to the detection unit, is used to modify the received descriptor; A data buffer, connected to the detection unit, is used to buffer data packets received by the receiving engine; The detection unit is also configured to set the descriptor recorder according to the detection result, so that the descriptor recorder records the detection result in the receive descriptor corresponding to the data packet; The receiving engine processes data packets according to the detection results and the filtering strategy, including processing data packets cached in the data buffer according to the receiving descriptor and the filtering strategy.

3. The DMA controller according to claim 2, characterized in that, Also includes: The alarm handling unit is used to generate and report alarms when the data packet is handled in a manner other than normal transmission.

4. The DMA controller according to claim 1, characterized in that, Also includes: An anomaly record storage unit is connected to the detection unit; The detection unit is also used to generate an anomaly record report after an anomaly is detected, and store it in the anomaly record storage unit.

5. A self-protected DMA controller control method, implemented using the self-protected DMA controller as described in any one of claims 1-4, comprising: The configuration unit responds to configuration commands and configures detection and filtering strategies based on the configuration commands. The configured detection strategy is read through the detection unit; Receive data packets through the receiving engine; The detection unit loads the stored data packet-level anomaly rule table according to the detection strategy, and detects the received data packets based on the data packet-level anomaly rule table to obtain the detection results. The receiving engine processes data packets based on the detection results and the filtering strategy, including normal transmission or dropping.

6. The control method according to claim 5, characterized in that, If the self-protected DMA controller includes a data buffer, then the data packet received by the receiving engine is the data packet buffered by the data buffer; If the self-protected DMA controller includes a descriptor logger, then the control method, after detecting the received data packet and obtaining the detection result, and before processing the data packet according to the detection result and the filtering strategy, further includes: The descriptor recorder is set according to the detection results by the detection unit; The detection results are recorded in the receive descriptor corresponding to the data packet using the descriptor recorder. The step of processing data packets based on the detection results and the filtering strategy includes: Read the receive descriptor and process the data packets according to the receive descriptor and the filtering strategy.

7. The control method according to claim 6, characterized in that, If the self-protected DMA controller includes an alarm handling unit, then the control method further includes: The alarm handling unit generates and reports alarms when the data packets are handled in a manner other than normal transmission.

8. The control method according to claim 7, characterized in that, The control method also includes: The detection unit generates an anomaly report when an anomaly is detected and stores it in a preset storage space.

Images