A secure chip architecture with dual-core trusted execution

Abstract

The present invention discloses a dual-core trusted execution security chip architecture, which adopts a layered bus design. The first-layer AHB bus is in a completely isolated security world, completely isolating the TEE processor core world from the REE processor core world, ensuring the security of the TEE security core data. All slave devices of the second-layer AHB bus can be accessed by the TEE processor core, and the REE processor core can limit the access rights to the slave devices of the second-layer AHB bus through IOPMP. The third-layer AHB bus is connected to the peripheral IP through the secure APB bus and the non-secure APB bus. At the same time, the TEE processor core and the REE processor core communicate with each other through the second-layer AHB bus based on the Mailbox communication mechanism, solving the technical problem that the existing TEE hardware SoC architecture is difficult to ensure the data security of the TEE security core and the efficient operation of the REE computing core.

Description

Technical Field

[0001] The present invention relates to the field of chip technology, and in particular to a dual-core trusted execution security chip architecture. Background Art

[0002] The TEE (Trusted Execution Environment) system consists of two components: the REE (Rich Execution Environment, also known as the Universal Execution Environment) and the TEE (Trusted Execution Environment). At the SoC level, since a TEE system has two different execution environments, it is very suitable to use two CPUs to run these two environments. The parallelism of the dual cores also improves the performance of the SoC (System on Chip).

[0003] The existing TEE hardware SoC architecture uses a 32-bit MCU to execute sensitive data and programs, and a RISC-V processor capable of running 64-bit programs. Within the SoC, the MCU uses an isolated bus to strongly isolate sensitive data from the REE, improving data security. However, the 32-bit MCU, which maintains complete security isolation within the entire SoC system, is only used during the sBL (start bootloader) and ZSBL (zeroth stage boot loader) stages of the boot process. After the FSBL (first stage boot loader), the RISC-V processor begins TEE program execution, and no communication channel is established between the two heterogeneous processors. Consequently, it is difficult to ensure both the data security of the TEE security core and the efficient operation of the REE computing core. Summary of the Invention

[0004] The embodiment of the present invention provides a dual-core trusted execution security chip architecture, which is used to solve the technical problem that the existing TEE hardware SoC architecture is difficult to ensure the data security of the TEE security core and the efficient operation of the REE computing core.

[0005] In view of this, a first aspect of the present invention provides a dual-core trusted execution security chip architecture, including a TEE processor core and a REE processor core;

[0006] The TEE processor core is in an isolated internal environment and is used to perform SoC secure boot tasks and handle communication transactions with the REE processor core;

[0007] The REE processor core is in an open environment and uses IOPMP to constrain access rights;

[0008] The TEE processor core is connected to the boot memory block, the zero-stage boot loader block, and the REE processor core boot unit through the first-layer AHB bus. The boot memory block is used to store the original boot program, and the zero-stage boot loader block is used to store the zero-stage boot program.

[0009] Both the REE processor core and the TEE processor core are connected to the second layer AHB bus;

[0010] The second layer AHB bus connects to the encryption core hardware unit, which restricts the access rights of the REE processor core through IOPMP;

[0011] The second layer AHB bus connects to the processor's main memory, which is used to store program codes running in the TEE and REE environments.

[0012] The TEE processor core and the REE processor core communicate with each other through the second layer AHB bus based on the Mailbox communication mechanism;

[0013] The second layer AHB bus is connected to the third layer AHB bus, and the third layer AHB bus is connected to the peripheral IP through the secure APB bus and the non-secure APB bus.

[0014] Optionally, the peripherals include secure peripherals and non-secure peripherals, the secure peripherals include secure serial ports and secure timers, the non-secure peripherals include non-secure serial ports and non-secure timers, the secure peripherals are connected to the third-layer AHB bus through the secure APB bus, and the non-secure peripherals are connected to the third-layer AHB bus through the non-secure APB bus.

[0015] Optionally, the IOPMP includes four storage domains, each storage domain has eight table entries, and each table entry has a CFG register and an ADDR register.

[0016] Optionally, there are multiple IOPMPs, and the multiple IOPMPs are cascaded.

[0017] Optionally, the Mailbox communication mechanism adopts a multi-level access control mechanism. In the multi-level access control mechanism, for service requests initiated by the REE processor core process, the TEE processor core configures a multi-level access control policy, where the multi-level access control policy includes a low-security direct access policy, a medium-security integrity authentication policy, and a high-security encryption authentication policy.

[0018] Optionally, the encryption core hardware unit adopts RSA hardware encryption.

[0019] Optionally, the RSA hardware encryption algorithm of the encryption core hardware unit is implemented using the Montgomery algorithm, and pseudo-random calculation is added to the modular exponentiation calculation.

[0020] Optionally, the encryption core hardware unit adopts AES hardware encryption or SHA1 hardware encryption.

[0021] From the above technical solutions, it can be seen that the dual-core trusted execution security chip architecture provided by the present invention has the following advantages:

[0022] The dual-core trusted execution security chip architecture provided by the present invention adopts a layered bus design with a total of three bus layers. The first-layer AHB bus is in a completely isolated secure world. The TEE processor core, as the master device, accesses all devices under the first-layer AHB bus. The first-layer AHB bus does not provide access rights to devices other than the TEE processor core, completely isolating the TEE processor core world from the REE processor core world, thereby ensuring the security of the TEE security core data. All slave devices of the second-layer AHB bus can be accessed by the TEE processor core, and the REE processor core can limit access rights to the slave devices of the second-layer AHB bus through IOPMP. The third-layer AHB bus connects to peripheral IPs through a secure APB bus and a non-secure APB bus. At the same time, the TEE processor core and the REE processor core communicate between cores through the second-layer AHB bus based on the Mailbox communication mechanism, thereby solving the technical problem that the existing TEE hardware SoC architecture is difficult to ensure the data security of the TEE security core and the efficient operation of the REE computing core.

[0023] At the same time, the dual-core trusted execution security chip architecture provided by the present invention restricts the access rights of the REE processor core through IOPMP, thereby further improving the operational efficiency of the REE computing core.

[0024] Furthermore, the dual-core trusted execution security chip architecture provided by the present invention, by designing a Mailbox communication mechanism with multi-level access control, allocates different security levels for access according to the security of data communication, optimizes the secure communication between the dual cores, and enables the security chip architecture to have better security guarantees and computing performance. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying any creative work.

[0026] Figure 1 A framework diagram of a dual-core trusted execution security chip architecture provided by the present invention;

[0027] Figure 2This is a schematic diagram of the IOPMP internal list distribution provided by the present invention. DETAILED DESCRIPTION

[0028] In order to enable those skilled in the art to better understand the solutions of the present invention, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts shall fall within the scope of protection of the present invention.

[0029] For easier understanding, see Figure 1 The present invention provides an embodiment of a dual-core trusted execution security chip architecture, including a TEE processor core (i.e., a TEE CPU) and an REE processor core (i.e., a REE CPU). The TEE processor core is the TEE security core, and the REE processor core is the REE computing core. The TEE processor core and the REE processor core use the E902 RISC-V processor core.

[0030] The TEE processor core is in an internal isolated environment (Isolated System), used to perform SoC secure boot work and handle communication transactions with the REE processor core, such as obtaining ID and encryption and decryption transactions.

[0031] The REE processor core is in an open environment and uses IOPMP (input and output device physical memory protection mechanism) to restrict access rights.

[0032] The TEE processor core connects to the BootROM, the Zero-Stage Bootloader (ZSBL RAM), and the REE processor core boot unit (BootREE) via the first-layer AHB bus (FL-AHB BUS). The BootROM stores the original boot program, while the ZSBL RAM stores the zero-stage boot program. Connecting the BootROM, ZSBL RAM, and REE processor core boot unit (BootREE) under the first-layer AHB bus forms a completely isolated SRAM, the secure isolated system, enabling secure and isolated data storage. The first-layer AHB bus resides within the isolated system. Within the secure world, the TEE processor core can act as a master device to access all devices under the first-layer AHB bus, such as the BootROM. However, the first-layer AHB bus does not provide access rights except to the master device (i.e., the TEE processor core). Therefore, the Isolated System is a secure, isolated environment where internal data cannot be directly accessed, ensuring the data security of the TEE security core. Meanwhile, the REE processor core boot unit (BootREE) can be controlled by the TEE processor core to complete the booting of the REE processor core.

[0033] Both the REE processor core and the TEE processor core are connected to the second layer AHB bus (denoted as SL-AHB BUS).

[0034] The second layer AHB bus connects to the crypto core hardware unit (Crypto core), which restricts the access rights of the REE processor core through IOPMP. All slave devices (such as Figure 1 The TEE processor core can access the main memory, non-secure network port ETH0, and secure network port ETH1. At the same time, the REE processor core uses IOPMP to restrict the REE processor core's access to slave devices on the Layer 2 AHB bus.

[0035] The Crypto Core hardware unit (Crypto Core) can implement RSA hardware encryption using the Montgomery algorithm and incorporates pseudo-random calculations into modular exponentiation calculations to effectively improve security. The Crypto Core hardware unit (Crypto Core) can also use AES hardware encryption or SHA1 hardware encryption.

[0036] The second layer AHB bus connects the processor to the main memory (Main Memory), which is used to store program codes running in the TEE and REE environments.

[0037] The TEE and REE processor cores communicate with each other via the Layer 2 AHB bus based on the Mailbox communication mechanism. The TEE processor core uses the T2R Mailbox (a secure CPU to non-secure CPU communication mailbox) to transmit data to the REE processor core, while the REE processor core uses the R2T Mailbox (a non-secure CPU to secure CPU communication mailbox) to transmit data to the TEE processor core.

[0038] The second layer AHB bus is connected to the third layer AHB bus, and the third layer AHB bus is connected to the peripheral IP through the secure APB bus and the non-secure APB bus. The secure APB bus and the non-secure APB bus are constrained by the peripheral ID of the access master device (TEE processor core and REE processor core). If the peripheral ID of the access master device is a secure peripheral, it is connected to the third layer AHB bus through the secure APB bus. If the peripheral ID of the access master device is a non-secure peripheral, it is connected to the third layer AHB bus through the non-secure APB bus. Figure 1 As shown, the secure peripherals include a secure serial port (S-USI1) and a secure timer (S-TIM0), and the non-secure peripherals include a non-secure serial port (N-USI0) and a non-secure timer (NS-TIM1). The secure peripherals (S-USI1 and S-TIM0) are connected to the third-layer AHB bus through the secure APB bus (TL-AHB2APB0), and the non-secure peripherals (N-USI0 and NS-TIM1) are connected to the third-layer AHB bus through the non-secure APB bus (TL-AHB2APB1).

[0039] In one embodiment, Figure 2 As shown in the figure, IOPMP consists of four memory domains (MDs), each of which has eight entries. Each entry has a CFG register and an ADDR register. The implementation of IOPMP is as follows:

[0040] First, during the SoC secure boot process, complete the configuration of the table entries under each storage domain of IOPMP, such as Figure 2 As shown, IOPMP has four MDs: MD0, MD1, MD2, and MD3. Each MD has eight entries: Entry0, Entry1, ..., Entry7. Each entry has a CFG register and an ADDR register, which respectively implement address range constraints.

[0041] Each master device input to IOPMP has a SourceID (SID for short). IOPMP will complete the reading of MD permissions based on the SID. To reduce IOPMP resource usage and bus latency, IOPMP can index up to four SIDs and has a total of four different storage domains.

[0042] After reading the MD permissions of the corresponding SID, IOPMP will process the table entries under the corresponding MD in parallel to determine whether the requested address is hit. If it is hit, the requested address is valid and the signal output is completed according to the bus protocol of the second AHB bus. If it is not hit, an abnormal interrupt signal is generated, indicating illegal access.

[0043] Since IOPMP can be cascaded to achieve finer-grained security access control, when a single IOPMP is not sufficient to constrain the security scope, it can be expanded by cascading multiple IOPMPs.

[0044] In a dual-core system-on-chip architecture, communication between processors is the key to data communication, event control, and resource sharing necessary to achieve efficient SoC performance. When multiple cores share resources, resources need to be synchronized to avoid shared resource conflicts. Therefore, in order to fully utilize the advantages of the dual-core architecture, effective coordination between cores is essential. The conventional Mailbox communication mechanism mainly completes data exchange between devices, but for IoT security devices, the security of data communication between the two cores needs to be considered. To this end, in the present invention, the Mailbox communication mechanism adopts a multi-level access control mechanism for the security of data communication. In the multi-level access control mechanism, for service requests initiated by the REE processor core process, the TEE processor core configures a multi-level access control policy, wherein the multi-level access control policy includes a low-security direct access policy, a medium-security integrity authentication policy, and a high-security encryption authentication policy. For direct access, no access control is required for REE core processes. The TEE security core directly provides services for the REE core, requiring only that the process comply with the dual-core communication protocol. For integrity authentication, access to the REE core requires identity authentication and integrity verification when the REE core process accesses secure zone resources, ensuring that the process code or data has not been maliciously tampered with. For encryption authentication, access to the REE core requires integrity authentication and communication data encryption, including key access, fingerprint extraction, password extraction or modification, and secure zone data updates. Communication data encryption is performed by the crypto core hardware unit (Crypto Core).

[0045] The dual-core architecture uses shared memory for communication. Dual-core processes can read and write data in shared memory according to a mutually agreed-upon interaction protocol. This shared memory-based communication method offers high transmission efficiency and large data volumes. Shared memory uses a FIFO read / write mechanism. To address shared memory read / write consistency and protect the TEE security core's data in the shared area, a shared memory block is allocated for the REE compute core and the TEE security core.

[0046] The two cores not only require shared memory as a transmission medium but also a fast interrupt notification mechanism. The two cores notify each other via IPC interrupts. The interrupts of both cores have the highest priority within their respective domains and are connected to the fast interrupt interfaces of each core, ensuring efficient and real-time communication between the two cores. When the REE compute core needs to send an interrupt notification, it generates an interrupt to the TEE security core through the interrupt set register. Upon receiving the interrupt, the TEE security core clears the interrupt signal through the interrupt clear register and returns an interrupt response signal to the REE compute core.

[0047] The dual-core communication protocol uses a request-response interaction method, with shared memory serving as the data exchange area. Typically, the REE compute core acts as the requester of the protocol, while the TEE security core acts as the responder. When the REE compute core needs to initiate a security service request to the TEE security core, it first initializes the shared memory array pointer, allocates a free area, prepares the command field and data segment for the service, writes the data to the free memory area, and writes the command field and data address and data length to shared memory. It then sends an IPC interrupt and waits for the TEE security core to return an interrupt response.

[0048] The dual-core trusted execution security chip architecture provided by the present invention adopts a layered bus design with a total of three bus layers. The first-layer AHB bus is in a completely isolated secure world. The TEE processor core, as the master device, accesses all devices under the first-layer AHB bus. The first-layer AHB bus does not provide access rights to devices other than the TEE processor core, completely isolating the TEE processor core world from the REE processor core world, thereby ensuring the security of the TEE security core data. All slave devices of the second-layer AHB bus can be accessed by the TEE processor core, and the REE processor core can limit access rights to the slave devices of the second-layer AHB bus through IOPMP. The third-layer AHB bus connects to peripheral IPs through a secure APB bus and a non-secure APB bus. At the same time, the TEE processor core and the REE processor core communicate between cores through the second-layer AHB bus based on the Mailbox communication mechanism, thereby solving the technical problem that the existing TEE hardware SoC architecture is difficult to ensure the data security of the TEE security core and the efficient operation of the REE computing core.

[0049] At the same time, the dual-core trusted execution security chip architecture provided by the present invention restricts the access rights of the REE processor core through IOPMP, thereby further improving the operational efficiency of the REE computing core.

[0050] Furthermore, the dual-core trusted execution security chip architecture provided by the present invention, by designing a Mailbox communication mechanism with multi-level access control, allocates different security levels for access according to the security of data communication, optimizes the secure communication between the dual cores, and enables the security chip architecture to have better security guarantees and computing performance.

[0051] As described above, the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit the same. Although the present invention has been described in detail with reference to the above embodiments, those skilled in the art should understand that the technical solutions described in the above embodiments can still be modified, or some of the technical features thereof can be replaced by equivalents. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A dual-core trusted execution security chip system, characterized in that: Including TEE processor core and REE processor core; The TEE processor core is in an isolated internal environment and is used to perform SoC secure boot tasks and handle communication transactions with the REE processor core; The REE processor core is in an open environment and uses IOPMP to constrain access rights; The TEE processor core is connected to the boot memory block, the zero-stage boot loader block, and the REE processor core boot unit through the first-layer AHB bus. The boot memory block is used to store the original boot program, and the zero-stage boot loader block is used to store the zero-stage boot program. Both the REE processor core and the TEE processor core are connected to the second layer AHB bus; The second layer AHB bus connects to the encryption core hardware unit, which restricts the access rights of the REE processor core through IOPMP; The second layer AHB bus connects to the processor's main memory, which is used to store program codes running in the TEE and REE environments. The TEE processor core and the REE processor core communicate with each other through the second layer AHB bus based on the Mailbox communication mechanism; The second layer AHB bus is connected to the third layer AHB bus, and the third layer AHB bus is connected to the peripheral IP through the secure APB bus and the non-secure APB bus; The Mailbox communication mechanism adopts a multi-level access control mechanism. In this multi-level access control mechanism, for service requests initiated by the REE processor core process, the TEE processor core configures a multi-level access control policy. The multi-level access control policy includes a low-security direct access policy, a medium-security integrity authentication policy, and a high-security encryption authentication policy.

2. The dual-core trusted execution security chip system according to claim 1, characterized in that: Peripherals include secure peripherals and non-secure peripherals. Secure peripherals include secure serial ports and secure timers. Non-secure peripherals include non-secure serial ports and non-secure timers. Secure peripherals are connected to the third-layer AHB bus through the secure APB bus, and non-secure peripherals are connected to the third-layer AHB bus through the non-secure APB bus.

3. The dual-core trusted execution security chip system according to claim 1, characterized in that: IOPMP consists of four storage domains, each storage domain has eight table entries, and each table entry has a CFG register and an ADDR register.

4. The dual-core trusted execution security chip system according to claim 3, characterized in that: There are multiple IOPMPs, and multiple IOPMPs are cascaded.

5. The dual-core trusted execution security chip system according to claim 1, characterized in that: The encryption core hardware unit uses RSA hardware encryption.

6. The dual-core trusted execution security chip system according to claim 5, characterized in that: The RSA hardware encryption algorithm of the encryption core hardware unit is implemented using the Montgomery algorithm, and pseudo-random calculation is added to the modular exponentiation calculation.

7. The dual-core trusted execution security chip system according to claim 1, characterized in that: The encryption core hardware unit uses AES hardware encryption or SHA1 hardware encryption.

Images