Access control method realized through hardware firewall and in-chip hardware firewall

Abstract

The embodiment of the invention provides an access control method realized through a hardware firewall and a hardware firewall in a chip, the method comprises the following steps: receiving an access request initiated by an access end to an accessed end through a firewall filter layer corresponding to the access end, the access request carrying a permission identifier and an access address; determining a target access area from a plurality of access areas of an accessed end corresponding to the firewall filter layer according to the access address; the access authority of the access request is determined according to the authority identification and the target access area, and each access area is pre-configured with a mapping relation between the authority identification allowed to be accessed and the corresponding access authority. Through the embodiment of the invention, the problems that a hardware firewall is single in function and limited in authority control and function security effect can be solved, the access end and the accessed end are controlled at the same time by setting the authority identifier and the corresponding access authority, and the information security and the function security of the whole chip system are improved.

Description

Technical Field

[0001] The present application relates to the field of hardware firewalls, and more specifically, to an access control method for a hardware firewall and an in-chip hardware firewall. Background Art

[0002] As the integration and performance of smart chips become higher and higher, the security threats they face are becoming more and more serious. When using high-performance chips, attackers may use software and hardware methods to implant dangerous codes into modules in low-security functional areas, thereby launching attacks from low-function security areas to high-function areas when the chip is running, tampering with relevant information and permissions, and damaging chip functions. If the attack spreads to the car control area, it may cause serious personal safety and property losses.

[0003] Firewalls usually filter transmission information based on security policies. The use of software-level firewalls alone has the disadvantages of low information filtering efficiency, poor stability, incomplete protection capabilities, and heavy load on the central processing unit (CPU). By integrating hardware firewall functions in the chip, the information filtering capability can be effectively improved, the CPU burden can be reduced, and the intrusion detection and protection functions can be enhanced. However, the hardware firewall functions in most chips are relatively simple, mainly restricting the process of CPU access to memory, and have less access control for other access terminals such as graphics processing unit (GPU), video processing unit (VPU), direct memory access (DMA) and other masters, and have no effect on the permission control of various peripherals of the chip except memory. The firewall is also relatively rough and simple in isolating memory information, divided into secure areas and non-secure areas, and has limited effect on the functional security of permission control and interaction of areas with multiple security levels, resulting in the inability to guarantee the security level of each area.

[0004] In summary, a solution is urgently needed to address the problem that hardware firewalls in related technologies have single functions and limited authority control and functional security effects. Summary of the invention

[0005] The embodiments of the present application provide an access control method implemented by a hardware firewall and an in-chip hardware firewall, so as to at least solve the problem in the related art that the hardware firewall has simple functions and limited authority control and functional security effects.

[0006] According to one embodiment of the present application, there is provided an access control method implemented by a hardware firewall, the method comprising: receiving an access request initiated by an access end to an accessed end through a firewall filtering layer corresponding to the access end, wherein the access request carries an authority identifier and an access address; determining a target access area from a plurality of access areas of the accessed end corresponding to the firewall filtering layer according to the access address; determining access rights of the access request according to the authority identifier and the target access area, wherein each access area is pre-configured with a mapping relationship between an authority identifier for allowed access and a corresponding access right.

[0007] According to another embodiment of the present application, there is provided an in-chip hardware firewall, comprising: a plurality of firewall filter layers, wherein each firewall filter layer corresponds to one or more access terminals, each firewall filter layer corresponds to a plurality of access areas, and each access area is pre-configured with a mapping relationship between a permission identifier for permitted access and a corresponding access permission;

[0008] The firewall filtering layer is used to receive an access request for accessing the visited end from the corresponding access end, and determine the target access area from multiple access areas of the corresponding visited end according to the authority identifier and access address carried in the access request, and determine the access rights of the access request according to the authority identifier and the target access area.

[0009] According to another embodiment of the present application, a computer-readable storage medium is provided, in which a computer program is stored, wherein the computer program executes the steps of any of the above method embodiments when executed by a processor.

[0010] According to another embodiment of the present application, an electronic device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor is configured to run the computer program to execute the steps in any one of the above method embodiments.

[0011] In the embodiment of the present application, security control of the access end and the accessed end is achieved simultaneously by setting the permission identifier and the access area, and the access permission is determined according to the permission identifier of the access end and the access address of the accessed end, thereby improving the information security and functional security of the entire chip system, and solving the problem of single hardware firewall function and limited permission control and functional safety in related technologies. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] Figure 1 It is a hardware structure block diagram of the access control method of the hardware firewall of the embodiment of the present application;

[0013] Figure 2 is a flow chart of an access control method of a hardware firewall according to an embodiment of the present application;

[0014] Figure 3 is a structural schematic diagram of an automotive intelligent chip system according to an embodiment of the present application;

[0015] Figure 4 It is a flowchart of implementing access control through a page table in the related art;

[0016] Figure 5 It is a flowchart of access control when the page table is tampered according to an embodiment of the present application;

[0017] Figure 6 1 is a flow chart of implementing access control through a hardware firewall according to an embodiment of the present application (I);

[0018] Figure 7 2 is a flow chart of implementing access control through a hardware firewall according to an embodiment of the present application;

[0019] Figure 8 is a schematic diagram of the structure of an on-chip hardware firewall according to an embodiment of the present application;

[0020] Fig. 9 is a schematic diagram of configuring multiple access terminal authority identifiers according to an embodiment of the present application;

[0021] Fig.10 It is a detailed flowchart of firewall access control according to an embodiment of the present application. DETAILED DESCRIPTION

[0022] The embodiments of the present application will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0023] It should be noted that the terms "first", "second", etc. in the specification and claims of this application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence.

[0024] The method embodiments provided in the embodiments of the present application can be executed in a mobile terminal, a computer terminal or a similar computing device. Taking running on a computer terminal as an example, Figure 1 : is a hardware structure block diagram of the access control method of the hardware firewall of the embodiment of the present application, such as Figure 1 As shown, the hardware board may include one or more ( Figure 1 Only one is shown in the figure) a processor 12 (the processor 12 may include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device) and a memory 14 for storing data, wherein the mobile terminal may also include a transmission device 16 for communication functions and an input and output device 18. It can be understood by those skilled in the art that Figure 1The structure shown is for illustration only and does not limit the structure of the mobile terminal. Figure 1 More or fewer components as shown, or with Figure 1 Different configurations are shown.

[0025] The memory 14 can be used to store computer programs, for example, software programs and modules of application software, such as the computer program corresponding to the access control method of the hardware firewall in the embodiment of the present application. The processor 12 executes various functional applications and the access control method of the hardware firewall by running the computer program stored in the memory 14, that is, to implement the above method. The memory 14 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some examples, the memory 14 may further include a memory remotely arranged relative to the processor 12, and these remote memories can be connected to the mobile terminal via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0026] The transmission device 16 is used to receive or send data via a network. The specific example of the above network may include a wireless network provided by a communication provider. In one example, the transmission device 16 includes a network adapter (Network Interface Controller, referred to as NIC), which can be connected to other network devices through a base station so as to communicate with the Internet. In one example, the transmission device 16 can be a radio frequency (Radio Frequency, referred to as RF) module, which is used to communicate with the Internet wirelessly.

[0027] In one embodiment of the present application, a method for access control of a hardware firewall is provided. Figure 2 is a flowchart of an access control method for a hardware firewall according to an embodiment of the present application, such as Figure 2 As shown, the process includes the following steps:

[0028] Step S202, receiving an access request initiated by the access end to the accessed end through the firewall filtering layer corresponding to the access end, wherein the access request carries an authority identifier and an access address;

[0029] Step S204, determining a target access area from a plurality of access areas of the accessed terminal corresponding to the firewall filtering layer according to the access address;

[0030] Step S206: determining the access rights of the access request according to the permission identifier and the target access area, wherein each access area is pre-configured with a mapping relationship between the permission identifier allowed to access and the corresponding access rights.

[0031] In the embodiment of the present application, through steps S202 to S206, the problem of single hardware firewall function and limited authority control and functional security in related technologies can be solved. By setting authority identification and access areas to control the access end and the accessed end at the same time, the information security and functional security of the chip can be effectively improved, and the theft of sensitive information and authority control and intrusion into key security areas by external attacks can be reduced.

[0032] In an exemplary embodiment, before step S202, the filtering function of the firewall needs to be configured, which may specifically include the following steps:

[0033] Set the firewall filter layer corresponding to each device type according to the device type of the access end;

[0034] Configuring a plurality of access zones for each of the firewall filter layers, wherein the plurality of access zones have different address ranges;

[0035] A mapping relationship between an access permission identifier and the access permission is configured for each access area.

[0036] Furthermore, taking Double Data Rate SDRAM (DDRSDRAM) DDR memory as an example, DDR is the accessed end, and DDR can be divided into Region0 and Region1. Region0 has a high security level, and Region1 has a low security level, which is used for data sharing.

[0037] In an embodiment of the present application, by assigning memory access permissions and memory attributes to each area, user applications can be prevented from damaging data used by the operating system; untrusted applications can be prevented from accessing protected memory areas for the purpose of infringing intellectual property rights; memory areas can be defined as read-only to protect important data; abnormal access is blocked, and storage protection, peripheral protection, and privileged code access control protection are provided.

[0038] In an exemplary embodiment, each firewall can support 4 filter layers and 9 access regions, but the present application is not limited thereto.

[0039] In an exemplary embodiment, step S204 may include the following steps:

[0040] Step S2042, matching the access address with the address range of each access area in the multiple access areas respectively;

[0041] Step S2044: determine an access area whose address range includes the access address as a target access area.

[0042] In an exemplary embodiment, step S204 may further include:

[0043] Step S2046, when the address ranges of the multiple access areas do not include the access address, a preset basic access area is determined as the target access area, wherein the basic access area is a part of the access area of ​​the accessed end, and the basic access area is pre-configured with a mapping relationship between the permission identifier allowed to access and the corresponding access permission.

[0044] In an exemplary embodiment, step S206 may include: querying the pre-configured mapping relationship according to the target access area, and determining the access right corresponding to the permission identifier as the access right of the access request.

[0045] Furthermore, in the access area, only the permission identifiers for allowed access can be configured, or all IDs for allowed access and IDs for denied access can be configured. The access rights corresponding to the IDs for allowed access are read / write / read and write, and the access rights corresponding to the IDs for denied access are not read and write.

[0046] In another exemplary embodiment, the access request also carries the security attributes of the access terminal or service module. Further, step S206 may include the following steps:

[0047] Step S2062, when the security attribute is secure, determining that the access permission of the access request is a predetermined permission corresponding to the target access area;

[0048] Step S2064, when the security attribute is non-secure, query the pre-configured mapping relationship according to the target access area, and determine the access permission corresponding to the permission identifier as the access permission of the access request.

[0049] Furthermore, each access area can perform unified access control for access terminals (masters) with higher security levels. According to the security level of each access area, the corresponding predetermined permissions (i.e., the highest access permissions) can be set to non-readable, read-only, readable and writable, etc., which can more quickly determine access permissions and improve the response speed of access requests. For other non-secure access terminals / business modules, fine-grained control is performed through permission identification to ensure the security control effect.

[0050] Through the embodiments of the present application, group control and granularity control methods can be supported, which can effectively reduce the complexity of permission control, improve the control accuracy of address ranges, and reduce resource usage.

[0051] In an exemplary embodiment, the method further comprises:

[0052] If the access permission of the access request is determined to be not readable or writable, denying the access request;

[0053] In a case where the access right of the access request is determined to be at least one of read or write, the access request is permitted.

[0054] In an exemplary embodiment, the access terminal includes one or more business modules; the access terminals and / or business modules with the same access rights have the same permission identifiers; the access terminals and / or business modules with different access rights have different permission identifiers.

[0055] Furthermore, in order to facilitate the management of access rights, a preset number of permission identifiers may be set. When the number of access terminals is less than the preset number, a different permission identifier may be assigned to each access terminal. However, when the number of access terminals is large, access terminals with the same security level or access rights may be grouped together, and a permission identifier may be assigned to each group. If an access terminal contains business modules with different security levels, a permission identifier needs to be configured for each business module.

[0056] In an exemplary embodiment, according to a preset security level specification, the chip system is divided into multiple preset functional safety level domains, wherein each functional safety level domain includes multiple access terminals and multiple accessed terminals; each functional safety level domain has a hardware firewall, wherein the hardware firewall is used to perform access control on the accessed terminals within the corresponding functional safety level domain; the permission identifier of the access terminal and / or business module is configured by the business module with the highest security level in the functional safety level domain.

[0057] Furthermore, taking the field of automotive smart chips as an example, the preset safety level specification may be the Automotive Safety Integration Level (ASIL).

[0058] In an embodiment of the present application, a hardware firewall is configured for each functional safety level domain, and the mapping relationship between the access area (region), identification (ID) and corresponding access rights of each hardware firewall is configured respectively, thereby achieving hardware isolation and control of domains with different functional safety levels, thereby preventing areas with high functional safety from being affected by areas with low functional safety, and also preventing high functional safety services from being affected by low functional safety services.

[0059] In an exemplary embodiment, before step S204, the method further includes: converting the virtual address in the access request into a physical address through a page table in a memory management unit (Memory Management Unit, MMU) or a system memory management unit (System Memory Management Unit, SMMU), wherein the access address is a physical address.

[0060] In this embodiment, the MMU / SMMU can convert virtual addresses and physical addresses and control access through the page table. It maps virtual addresses of user state, kernel state, and peripherals respectively, converts them to corresponding physical addresses, and sets permission attributes in the page table to perform access control and regional isolation.

[0061] In an exemplary embodiment, the access end (master) may include at least one of the following: a central processing unit (CPU), a graphics processing unit (GPU), a video processor (VPU), a storage device, a neural network processor (NPU), a hardware security module (HSM), a security encryption and decryption engine, a direct memory access (DMA), and an external device.

[0062] Furthermore, the access terminal may also include an image signal processing (Image Signal Process, referred to as ISP), a digital signal processing (Digital Signal Processing, referred to as DSP), and a data processing unit (Data Process Unit, referred to as DPU).

[0063] In an exemplary embodiment, the accessed end may include at least one of the following: a storage device and a peripheral register.

[0064] In an exemplary embodiment, the hardware firewall may support a bypass debugging mode, and debug the system functions by bypassing the firewall, thereby reducing the complexity of troubleshooting;

[0065] In an exemplary embodiment, the hardware firewall can support an error reporting mechanism, and can report the error location and access information (address, attributes, etc.) in a timely and accurate manner to improve diagnostic efficiency. Furthermore, the firewall can also record and report rejected access requests so that users can promptly discover and handle potential risk issues.

[0066] Through the embodiments of the present application, the functions of access control and permission setting can be achieved, the problems of simple hardware firewall functions and limited permission control and functional safety in related technologies can be solved, and precise control can be performed on permissions of different functional security level domains and secure / non-secure services, thereby improving the information security and functional safety of the entire chip system.

[0067] The embodiments of the present application can be applied to multifunctional high-performance integrated chips, especially in the field of chip security protection, including but not limited to cockpit chips, autonomous driving chips, mobile phone chips, computer chips, artificial intelligence chips, etc. Taking the field of automotive smart chips as an example, the current automotive smart chip systems mainly include digital instrument systems, assisted driving systems, and infotainment systems, etc., and different systems have different functions and security levels.

[0068] Figure 3 is a schematic diagram of the structure of the automotive intelligent chip system according to an embodiment of the present application, such as Figure 3 As shown in the figure, automotive smart chip systems can be divided into the following functional safety level domains according to their functions and safety attributes:

[0069] High performance computing domain 32, automotive regulation domain (ASIL-B) 34, automotive regulation domain (ASIL-D) 36 and safety island (ASIL-D) 38.

[0070] In this embodiment, the high-performance computing domain 32 only involves information security, the automotive domain (ASIL-B), automotive domain (ASIL-D) and safety island (ASIL-D) involve functional safety, and the safety island (ASIL-D) has the highest safety level.

[0071] In this embodiment, each domain contains a high-computing-power CPU, GPU, storage devices, NPU devices, multi-channel display interfaces, and supports a variety of rich automotive peripherals, and can support various complex functions such as 3D graphics display, deep learning, computer vision, audio and video encoding and decoding, etc.

[0072] In this embodiment, the hardware of the high-performance computing domain 32 is a high-performance A-core processor and various peripheral modules. The A-core high-performance processor has a lower security level, but has relatively strong performance and computing power. It runs a high-performance operating system (HLOS) such as Linux or Android, which is mainly responsible for running high-computing functions such as entertainment systems, instrument displays, and environmental perception.

[0073] In this embodiment, the automotive domain (ASIL-B) 34 is composed of four real-time computing R cores, on which the FreeRTOS operating system runs, and is mainly responsible for sensor signal acquisition, body comfort system, regulatory control, air conditioning windows and suspension control and other functions.

[0074] In this embodiment, the automotive domain (ASIL-D) 36 uses two R cores for dual-core locking to achieve ASIL-D functional safety, and runs the automotive general control system AUTOSAR OS on it. It is mainly responsible for functions with particularly high safety requirements, such as vehicle control, power control, energy management and chassis functions.

[0075] In this embodiment, the safety island (ASIL-D) 38 also uses two R cores for dual-core locking to achieve ASIL-D functions. All its system components are independent of other domains and are not affected by the functions of other domains. It mainly performs safety monitoring and key data storage.

[0076] Applying the access control method in any of the above application embodiments to the automotive smart chip system can ensure that each domain does not affect each other's functional safety level during the interaction process. By setting the permission identification (ID) and access rights, the high-performance computing domain can be controlled not to affect the functional safety area, and the low-functional safety domain can access the high-functional safety domain, allowing reading but not writing. Furthermore, if reading causes other side effects, such as reading the first-in-first-out queue (First In First Out, referred to as FIFO), access should be prohibited. At the same time, the services within the same functional safety domain can be distinguished, and isolation can be achieved between low-functional safety services and high-functional safety services.

[0077] Figure 4 It is a flowchart of implementing access control through page tables in related technologies, such as Figure 4 As shown in the figure, MMU / SMMU converts virtual addresses and physical addresses and controls access through page tables. It maps virtual addresses of user state, kernel state, and peripherals, converts them to corresponding physical addresses, and sets permission attributes in the page table to perform access control and regional isolation.

[0078] Furthermore, the memory and page table are managed by the operating system (OS) running on the A core. The access scope and permission control of the access source are completed by the OS operating the page table, including the page table of MMU and SMMU. The page table is stored in DDR, and the cache storing the page table in MMU is the translation look-aside buffer (TLB). The page table control permissions include data read, write, and executable. The first two correspond to the data path, and the latter corresponds to the instruction path.

[0079] Figure 5 is a schematic diagram of the access control process when the page table is tampered according to an embodiment of the present application, such as Figure 5 As shown, the left side is an example of directly accessing the memory after querying the page table, and the right side is an example of accessing the memory through the firewall after querying the page table.

[0080] In this embodiment, when the page table function is normal and has not been tampered with, when the non-secure access end (master) accesses the memory, it will first use the MMU to query the page table. If the access address is in the non-secure area, the MMU will convert the virtual address into a physical address to access the data in the non-secure area of ​​the memory. If the access address is in the secure area, the MMU will deny the non-secure access end access according to the page table permission attributes, thereby completing the access isolation between the secure area and the non-secure area.

[0081] In this embodiment, when the MMU / SMMU page table permissions are illegally tampered with, if the memory is directly accessed after querying the page table, the non-secure access end can access the secure data in the DDR through the tampered page table, thereby bringing security risks.

[0082] In this embodiment, if a firewall is used to perform access filtering on the DDR interface, for a non-secure access end, even if the page table is illegally tampered with, its access to secure data will still be blocked, and it can only access specific areas to which it has permission.

[0083] Through the embodiments of the present application, data security protection is further strengthened from the accessed end, and security risks generated in the data transfer process (such as illegal tampering of the page table) can be avoided.

[0084] Figure 6 1 is a flow chart (I) of implementing access control through a hardware firewall according to an embodiment of the present application, which is applied to a high-performance computing domain. Figure 6 As shown, in the high-performance computing domain (core A), the firewall can perform permission control on the process of different access terminals accessing the computing domain DDR.

[0085] In this embodiment, the access end in the high-performance computing domain includes: A core processor, secure OS, non-secure OS, hardware security module HSM, encryption and decryption engine, direct memory access DMA; the accessed end includes DDR and peripherals.

[0086] In this embodiment, the memory DDR is divided into a secure access area (region) and a non-secure access area by a firewall, thereby achieving physical isolation of secure data and non-secure data.

[0087] Furthermore, the memory DDR can be divided into multiple access regions with different security levels, and distinguished by numbers "region+number", where region0 can be a preset basic access region. This application does not limit the number of access regions.

[0088] In this embodiment, the A core processor has two states: secure state and non-secure state, namely secure OS and non-secure OS. The secure state can access the entire DDR data, while the non-secure state can only access non-secure data and is prohibited from reading and writing secure data.

[0089] In this embodiment, security modules such as the hardware security module HSM and the encryption and decryption engine are mainly responsible for high-security information and encryption and decryption services. They have a high security level and can access the entire DDR data normally. Non-security modules such as DMA are mainly responsible for moving data and can only operate on non-security data. Reading and writing of security data is prohibited.

[0090] In the embodiment of the present application, the information security within the high-performance computing domain can be protected by a hardware firewall, ensuring that secure data cannot be obtained / destroyed by non-secure access terminals.

[0091] Figure 7 This is a flow chart (II) of implementing access control through a hardware firewall according to an embodiment of the present application, which is applied to high-performance computing domains and automotive domains (ASIL-B). Figure 7 The figure shows the firewall read and write permission control when the high-performance computing domain (A core) and the automotive domain (R core) simultaneously access the DDR in the automotive domain (ASIL-B).

[0092] In this embodiment, a hardware firewall is provided in each of the high-performance computing domain and the automotive domain (ASIL-B) for performing access control on the accessed end in the current domain.

[0093] In this embodiment, the DDR in the automotive domain (ASIL-B) is divided into two parts, Region 0 has a high security level, and Region 1 has a low security level, which is used for data sharing. However, this application is not limited to this, and the number of access areas and the corresponding security level can be adjusted according to actual needs.

[0094] In this embodiment, when core A and DMA in the high-performance computing domain access the memory of the automotive domain (ASIL-B), the firewall will control the access area and permissions based on the access source. Since the security level of core A is lower than that of the automotive domain, the firewall can be configured as follows: core A can only read Region0 and cannot write to Region0, but can freely read and write Region1, which facilitates data interaction with core R.

[0095] In this embodiment, when the R core accesses the vehicle-specification domain memory, it can freely read and write Region0 and Region1 because the safety level is ASIL-B and meets the requirements.

[0096] In another exemplary embodiment, memory access by an R core in the automotive domain (ASIL-B) to a higher level safety domain (such as the automotive domain ASIL-D) is restricted by a firewall within the automotive domain (ASIL-D).

[0097] Furthermore, the firewall is controlled according to the permission identification (ID) of the access source, which can be achieved by setting different permission tags for the A core and the R core.

[0098] In the embodiment of the present application, hardware isolation of domains with different functional safety levels can be achieved through a hardware firewall, thereby ensuring functional safety, that is, areas with high functional safety cannot be affected by areas with low functional safety, and functional safety areas cannot be affected by computing domains.

[0099] Figure 8 It is a structural diagram of an in-chip hardware firewall according to an embodiment of the present application.

[0100] like Figure 8 As shown, the hardware firewall in the chip includes: multiple firewall filter layers (Filter0 to Filter3). Each firewall filter layer corresponds to a different type of access terminal. For example, the firewall filter layer corresponding to the CPU is Filter0, the firewall filter layer corresponding to the GPU is Filter1, the firewall filter layer corresponding to the DMA / DPC is Filter2, and Filter3 is not shown. The present application is not limited to this, and the number of firewalls and the corresponding access terminal types can be adjusted according to actual needs.

[0101] In this embodiment, each firewall filter layer corresponds to one or more access terminals, each of the firewall filter layers corresponds to multiple access areas, and each of the access areas is pre-configured with a mapping relationship between a permission identifier for allowed access and corresponding access rights.

[0102] In this embodiment, the firewall filtering layer is used to receive an access request for accessing the accessed end from the corresponding access end, and determine the target access area from multiple access areas of the corresponding accessed end according to the permission identifier and access address carried in the access request, and determine the access rights of the access request according to the permission identifier and the target access area.

[0103] Furthermore, each access area corresponds to an address range of the accessed end (such as DDR memory), and the address ranges corresponding to the access areas in different firewall filtering layers may overlap. Figure 8The corresponding DDR address range of region1 and region3 is A1 to A2.

[0104] In an exemplary embodiment, the firewall can be set to support 4 filter layers (Filter) and 9 access areas (regions). The Filter external access terminal (master), such as CPU, GPU, DPC, VPU, etc., can confirm whether it can read and write the corresponding access area based on the access address and ID.

[0105] In an exemplary embodiment, a common basic access area (such as region0) can be set for multiple firewall filter layers, and addresses that are not in the range of Region1 to Region8 belong to region0. Further, the basic access area can be set to the lowest authority, retaining only the read and write authority of the data sharing area, but the present application is not limited to this, and the authority content can be adjusted according to actual needs.

[0106] In an exemplary embodiment, the hardware firewall is located between the accessed end and the Network On Chip (NoC); the hardware firewall and the accessed end are in the same functional safety level domain, and the functional safety level domain is divided according to a preset safety level specification.

[0107] Furthermore, a firewall filter layer can be set at the interface of the memory DDR. The on-chip network will send the access request to the firewall filter layer corresponding to the access end according to the device type of the access end, and control and filter the access rights through the firewall filter layer.

[0108] In an exemplary embodiment, the firewall filtering layer further includes: an access register for storing mapping relationships between corresponding permission identifiers and access permissions allowed in the multiple access areas, respectively.

[0109] In an exemplary embodiment, if a region is to restrict access to a certain ID and deny access to other IDs, the region must cross all valid filters. Each region can control all 16 IDs.

[0110] Furthermore, if the number of access terminals is greater than a preset number, such as 16, multiple access terminals with the same authority can share one ID. Access terminals with the same ID can be divided into different filtering layers according to device type.

[0111] In an exemplary embodiment, access can be divided into secure access and non-secure access, and its security attributes are determined by the access end or business module that initiates the access request. Generally, the firewall controls the permission of secure access as read / write; for non-secure access, it is necessary to further control the permission as read / write based on the ID.

[0112] In an exemplary embodiment, the ID of each access terminal is software configurable, that is, it can be statically configured when the system starts.

[0113] Fig. 9 FIG. 1 is a schematic diagram of configuring multiple access terminal authority identifiers according to an embodiment of the present application. Fig. 9 As shown, the permission identification (ID) of the access end in each functional safety level domain is configured by the business module with the highest security level in the domain, namely, the IDs_conf module.

[0114] In an exemplary embodiment, the entire system is divided into two parts: a high-performance computing domain (on the left) and an automotive-regulatory domain (on the right). A set of registers is set in each functional safety level domain to configure the IDs of all access terminals / business modules in the area.

[0115] Furthermore, in the high-performance computing domain, it can be configured by a hardware security module HSM with high security functions, and in the automotive domain, it can be configured by an R-core processor. This configuration is relatively flexible and versatile.

[0116] In an exemplary embodiment, the ID configuration of the high-performance computing domain (left) mainly involves information security, such as GPU, VPU, DMA, etc., and its ID can generally be determined before leaving the factory. The automotive domain (right) has high security requirements and mainly involves functional safety. The services of the access end include security and non-security services, and the services of different manufacturers are not the same. Therefore, the ID of the automotive domain does not need to be fixed and can be statically configured when the system starts.

[0117] In an exemplary embodiment, when the number of access terminals / business modules that require ID configuration is small, each module can be configured with a different ID. When there are many modules that require ID configuration, a group control method can be used to configure the same ID for business modules with the same access rights, thereby reducing the complexity of access control and permission determination.

[0118] Fig.10 FIG. 1 is a detailed flow chart of firewall access control according to an embodiment of the present application. Fig.10 As shown, the process includes the following steps:

[0119] Step S1001, for each access request coming in through the Filter, the address is compared starting from Region 1. If the address is located in the Region and the Region is valid in the current Filter, the next step is started.

[0120] Step S1002: If Region 1 does not match, then M+1, compare the next Region, and repeat the process in sequence. If all Regions cannot match, then use Region 0 to perform permission control on the Filter.

[0121] Step S1003, determine the security attribute of the access, if it is a secure state, read the access register of the region to check whether the current access is allowed, where 1 is allowed and 0 is denied.

[0122] Step S1004, if it is a non-secure access, determine whether the ID of the access source is configured in the region according to the access register of the region. If configured, further check the access rights of the ID, whether it is read / write or read-write.

[0123] In an exemplary embodiment, step S1001 and step S1002 may also specifically match the Region configured in the Filter, and when no Region is matched, the basic access region (Region 0) is used for permission control.

[0124] In this embodiment, the access register in step S1004 is configured only for the ID that is allowed to access the access area, and when the ID is not configured in the access area, the access request is rejected.

[0125] Through the embodiments of the present application, it is possible to filter the information of the accessed end, ensure the data security of key security areas, and prevent access rights from being tampered with. Fine-grained access control can be achieved through the combination of ID and Region, which can more safely and effectively protect access areas of different security levels.

[0126] An embodiment of the present application further provides a computer-readable storage medium, in which a computer program is stored, wherein the computer program executes the steps of any of the above method embodiments when executed by a processor.

[0127] In an exemplary embodiment, the computer-readable storage medium may include, but is not limited to, various media that can store computer programs, such as a USB flash drive, a read-only memory (ROM), a random access memory (RAM), a mobile hard disk, a magnetic disk or an optical disk.

[0128] An embodiment of the present application further provides an electronic device, including a memory and a processor, wherein a computer program is stored in the memory, and the processor is configured to run the computer program to execute the steps in any one of the above method embodiments.

[0129] In an exemplary embodiment, the electronic device may further include a transmission device and an input / output device, wherein the transmission device is connected to the processor, and the input / output device is connected to the processor.

[0130] For specific examples in this embodiment, reference may be made to the examples described in the above embodiments and exemplary implementation modes, and this embodiment will not be described in detail herein.

[0131] Obviously, those skilled in the art should understand that the above modules or steps of the present application can be implemented by a general computing device, they can be concentrated on a single computing device, or distributed on a network composed of multiple computing devices, they can be implemented by a program code executable by a computing device, so that they can be stored in a storage device and executed by the computing device, and in some cases, the steps shown or described can be executed in a different order from that herein, or they can be made into individual integrated circuit modules, or multiple modules or steps therein can be made into a single integrated circuit module for implementation. Thus, the present application is not limited to any specific combination of hardware and software.

[0132] The above description is only the preferred embodiment of the present application and is not intended to limit the present application. For those skilled in the art, the present application may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the principles of the present application shall be included in the protection scope of the present application.

Claims

1. An access control method implemented by a hardware firewall, characterized in that: The method comprises: Receiving, through a firewall filtering layer corresponding to the access end, an access request initiated by the access end to the accessed end, wherein the access request carries an authority identifier and an access address; Determine a target access area from a plurality of access areas of the accessed end corresponding to the firewall filtering layer according to the access address; The access permission of the access request is determined according to the permission identifier and the target access area, wherein each access area is pre-configured with a mapping relationship between the permission identifier allowed to access and the corresponding access permission.

2. The method according to claim 1, characterized in that Before receiving, through the firewall filtering layer corresponding to the access terminal, an access request initiated by the access terminal to the accessed terminal, the method further includes: Set the firewall filter layer corresponding to each device type according to the device type of the access end; Configuring a plurality of access zones for each of the firewall filter layers, wherein the plurality of access zones have different address ranges; A mapping relationship between an access permission identifier and the access permission is configured for each access area.

3. The method according to claim 1, characterized in that: Determining a target access area from a plurality of access areas corresponding to the firewall filtering layer according to the access address includes: matching the access address with the address range of each access area in the plurality of access areas respectively; An access area whose address range includes the access address is determined as a target access area.

4. The method according to claim 3, characterized in that Also includes: When the address ranges of the multiple access areas do not include the access address, a preset basic access area is determined as the target access area, wherein the basic access area is a part of the access area of ​​the accessed end, and the basic access area is pre-configured with a mapping relationship between the permission identifier allowed to access and the corresponding access permission.

5. The method according to claim 1, characterized in that Determining the access permission of the access request according to the permission identifier and the target access area includes: The pre-configured mapping relationship is queried according to the target access area, and the access permission corresponding to the permission identifier is determined as the access permission of the access request.

6. The method according to claim 1, characterized in that Determining the access permission of the access request according to the permission identifier and the target access area includes: The access request also carries the security attributes of the access terminal or service module; In a case where the security attribute is secure, determining that the access permission of the access request is a predetermined permission corresponding to the target access area; In the case where the security attribute is non-secure, the pre-configured mapping relationship is queried according to the target access area, and the access permission corresponding to the permission identifier is determined as the access permission of the access request.

7. The method according to claim 1, characterized in that Also includes: If the access permission of the access request is determined to be not readable or writable, denying the access request; In a case where the access right of the access request is determined to be at least one of read or write, the access request is permitted.

8. The method according to claim 1, characterized in that The access terminal includes one or more service modules; The access terminals and / or business modules with the same access rights have the same permission identifiers; Access terminals and / or business modules with different access rights have different corresponding permission identifiers.

9. The method according to claim 8, characterized in that According to the preset safety level specification, the chip system is divided into a plurality of preset functional safety level domains, wherein each functional safety level domain includes a plurality of access terminals and a plurality of accessed terminals; Each functional safety level domain has a hardware firewall, wherein the hardware firewall is used to perform access control on the accessed end within the corresponding functional safety level domain; The permission identifier of the access terminal and / or business module is configured by the business module with the highest security level in the functional security level domain.

10. The method according to claim 1, characterized in that Before determining the access permission of the access request according to the permission identifier and the target access area, the method further includes: The virtual address in the access request is converted into a physical address through a page table in a memory management unit MMU or a system management unit SMMU, wherein the access address is a physical address.

11. The method according to any one of claims 1 to 10, characterized in that The access end includes at least one of the following: a central processing unit CPU, a graphics processing unit GPU, a video processing unit VPU, a storage device, a neural network processor NPU, a hardware security module HSM, a security encryption and decryption engine, a direct memory access DMA and an external device; The accessed end includes at least one of the following: a storage device and a peripheral register.

12. An on-chip hardware firewall, characterized in that: include: Multiple firewall filter layers, wherein each of the firewall filter layers corresponds to one or more access terminals, each of the firewall filter layers corresponds to multiple access areas, and each of the access areas is pre-configured with a mapping relationship between a permission identifier allowed to access and a corresponding access permission; The firewall filtering layer is used to receive an access request for accessing the visited end from the corresponding access end, and determine a target access area from multiple access areas of the corresponding visited end according to the permission identifier and access address carried in the access request, and determine the access rights of the access request according to the permission identifier and the target access area.

13. The hardware firewall according to claim 12, characterized in that: The hardware firewall is located between the accessed end and the on-chip network; The hardware firewall and the accessed end are in the same functional safety level domain, and the functional safety level domain is divided according to a preset security level specification.

14. The hardware firewall according to claim 12, characterized in that: The firewall filtering layer also includes: The access register is used to store the mapping relationship between the permission identifiers and access permissions corresponding to the multiple access areas.

15. A computer-readable storage medium, characterized in that: The storage medium stores a computer program, wherein the computer program executes the method described in any one of claims 1 to 11 when executed by a processor.

16. An electronic device comprising a memory and a processor, characterized in that: A computer program is stored in the memory, and the processor is configured to run the computer program to perform the method according to any one of claims 1 to 11.

Images