Security attribute design method, device and equipment for peripherals in chip and medium

Abstract

The embodiment of the invention discloses a security attribute design method and device for peripherals in a chip, equipment and a medium. The method comprises the following steps: acquiring a first logic address of a physical address corresponding to a current peripheral, and adding a second logic address corresponding to the physical address; respectively setting a first security attribute and a second security attribute of the first logic address and a third security attribute and a fourth security attribute of the second logic address through the IDAU and the SAU; determining a first alternative security attribute of the first logic address according to the first security attribute and the second security attribute; determining a second alternative security attribute of the second logic address according to the third security attribute and the fourth security attribute; and determining a final security attribute of the physical address according to the first alternative security attribute and the second alternative security attribute. According to the method, the security attribute of the physical address is divided by adopting multiple logic addresses in the application layer, so that the number of SAUs required for setting the security attribute of the peripheral can be reduced, and the utilization rate of the SAUs is improved.

Description

Technical Field

[0001] The present invention relates to the technical field of chip design, and in particular to a method, device, equipment and medium for designing security attributes of peripherals in a chip. Background Art

[0002] With the development of intelligent technology, the programs in the chip application layer are becoming more and more complex and diversified, and the processor is also facing the problem of security management of a large number of programs. The V8-M architecture of the chip ARM has added a new security extension of trustzone based on the previous V6-M and V7-M, which is used to introduce the concepts of "secure state" and "unsecure state" in the kernel, thereby realizing the secure program management of the processor.

[0003] In the prior art, a security attribute unit (SAU) is required in the trustzone of a processor to correspond to the security configuration of a peripheral access area. For a static random access memory (SRAM), its security attributes can be defined according to a single page (PAGE). Taking a 256K area as an example, each PAGE is 2K, and 128 SAUs are required to set the security attributes of each PAGE.

[0004] However, the SAU resources inside the chip are limited and insufficient to match such a large number of peripherals in chip applications. Summary of the invention

[0005] The present invention provides a method, device, equipment and medium for designing security attributes of peripherals in a chip, so as to improve the utilization rate of SAU and set security attributes for a large number of peripherals in the chip under the premise of limited SAU resources.

[0006] According to one aspect of the present invention, a method for designing security attributes of peripherals in a chip is provided, wherein the peripherals in the chip have physical addresses, and the chip accesses the peripherals corresponding to the physical addresses, and the method comprises:

[0007] Obtaining a first logical address of a physical address corresponding to a current peripheral device, and adding a second logical address corresponding to the physical address according to an alias zone strategy;

[0008] Setting a first security attribute and a second security attribute of the first logical address respectively through an information domain attribute unit IDAU and a security attribute unit SAU;

[0009] Setting the third security attribute and the fourth security attribute of the second logical address respectively through the IDAU and the SAU;

[0010] Determining a first candidate security attribute for the first logical address based on the first security attribute and the second security attribute;

[0011] Determine a second candidate security attribute for the second logical address according to the third security attribute and the fourth security attribute;

[0012] According to the first candidate security attribute of the first logical address and the second candidate security attribute of the second logical address, a final security attribute of the corresponding physical address is determined.

[0013] Optionally, the method includes:

[0014] When accessing the target physical address of the current peripheral device, obtaining the target logical address in the access request;

[0015] Obtaining target candidate security attributes corresponding to the target logical address;

[0016] The target candidate security attribute is determined as the final security attribute for accessing the target physical address.

[0017] Optionally, the method includes:

[0018] When the first security attribute and the second security attribute are both non-safe, the first candidate security attribute is non-safe;

[0019] When the first security attribute and / or the second security attribute is security, the first candidate security attribute is security;

[0020] When the third security attribute and the fourth security attribute are both non-safe, the second candidate security attribute is non-safe;

[0021] When the third security attribute and / or the fourth security attribute is secure, the second candidate security attribute is secure.

[0022] Optionally, the method further includes:

[0023] When performing secure and non-secure alternating access to the current peripheral, the first security attribute of the first logical address is set to secure and the third security attribute of the second logical address is set to non-secure through the IDAU;

[0024] Setting the fourth security attribute of the second logical address to non-secure by SAU;

[0025] The physical address of the current peripheral device is accessed alternately through the first logical address and the second logical address, so as to perform secure and non-secure alternate access to the current peripheral device.

[0026] Optional, current peripherals include: Flash, Read-Only Memory ROM, Static Random Access Processor SRAM, and peripheral devices.

[0027] Optionally, the peripheral devices include: an integrated circuit bus I2C device, an improved internal integrated circuit bus I3C device, a serial peripheral interface SPI device, and a universal asynchronous receiver and transmitter UART.

[0028] According to another aspect of the present invention, a device for designing security attributes of a peripheral in a chip is provided, wherein the peripheral in the chip has a physical address, and the chip accesses the peripheral corresponding to the physical address, and the device comprises:

[0029] A logical address adding module, used for acquiring a first logical address of a physical address corresponding to a current peripheral device, and adding a second logical address corresponding to the physical address according to an alias zone strategy;

[0030] A security attribute first setting module, used to set a first security attribute and a second security attribute of a first logical address respectively through an information domain attribute unit IDAU and a security attribute unit SAU;

[0031] A second security attribute setting module, used for setting a third security attribute and a fourth security attribute of the second logical address through the IDAU and the SAU respectively;

[0032] A first security attribute determination module, configured to determine a first candidate security attribute of the first logical address according to the first security attribute and the second security attribute;

[0033] A second security attribute determination module, configured to determine a second candidate security attribute of the second logical address according to the third security attribute and the fourth security attribute;

[0034] The security attribute final determination module is used to determine the final security attribute of the corresponding physical address according to the first candidate security attribute of the first logical address and the second candidate security attribute of the second logical address.

[0035] According to another aspect of the present invention, an electronic device is provided, the electronic device comprising:

[0036] at least one processor; and

[0037] a memory communicatively connected to the at least one processor; wherein,

[0038] The memory stores a computer program that can be executed by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the security attribute design method of the peripheral device in the chip described in any embodiment of the present invention.

[0039] According to another aspect of the present invention, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the security attribute design method for peripherals in a chip described in any embodiment of the present invention when executed.

[0040] According to another aspect of the present invention, a computer program product is provided, comprising a computer program, wherein when the computer program is executed by a processor, the method for designing security attributes of peripherals in a chip according to any embodiment of the present invention is implemented.

[0041] According to another aspect of the present invention, a method for a computer to access a peripheral device is provided, wherein the computer uses the security attribute design method for a peripheral device in a chip provided by any embodiment of the present invention to design security attributes, and the method includes:

[0042] When the computer accesses the target physical address of the current peripheral device, the target logical address in the access request is obtained;

[0043] Obtaining target candidate security attributes corresponding to the target logical address;

[0044] The target candidate security attribute is determined as the final security attribute for accessing the target physical address.

[0045] In the technical solution of the embodiment of the present invention, the peripheral in the chip has a physical address, and the chip accesses the physical address corresponding to the peripheral, obtains the first logical address of the physical address corresponding to the current peripheral, and adds the second logical address corresponding to the physical address according to the alias zone strategy; sets the first security attribute and the second security attribute of the first logical address respectively through the information domain attribute unit IDAU and the security attribute unit SAU; sets the third security attribute and the fourth security attribute of the second logical address respectively through IDAU and SAU; determines the first alternative security attribute of the first logical address according to the first security attribute and the second security attribute; determines the second alternative security attribute of the second logical address according to the third security attribute and the fourth security attribute; determines the final security attribute of the corresponding physical address according to the first alternative security attribute of the first logical address and the second alternative security attribute of the second logical address, which solves the problem of low SAU utilization when setting regional security attributes for peripherals in the chip, and divides the security attributes of the physical address by using multiple logical addresses at the application layer, so as to reduce the number of SAUs required for setting the security attributes of the peripherals, improve the SAU utilization, and set the security attributes for the chip's large peripherals under the premise of limited SAU resources.

[0046] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0048] Figure 1 is a flow chart of a method for designing security attributes of peripherals in a chip provided in an embodiment of the present invention;

[0049] Figure 2 This is a structural diagram of a security attribute design of a peripheral device in a chip provided according to an embodiment of the present invention;

[0050] Figure 3 is a schematic diagram of a SRAM security attribute design provided according to an embodiment of the present invention;

[0051] Figure 4 is a schematic diagram of the structure of a security attribute design device for a peripheral device in a chip provided according to an embodiment of the present invention;

[0052] Figure 5 is a flow chart of a method for a computer to access a peripheral device provided according to an embodiment of the present invention;

[0053] Figure 6 It is a structural schematic diagram of an electronic device for implementing the security attribute design method of a peripheral device in a chip according to an embodiment of the present invention. DETAILED DESCRIPTION

[0054] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0055] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0056] Figure 1 This is a flow chart of a method for designing security attributes of peripherals in a chip according to an embodiment of the present invention. This embodiment is applicable to the case of setting security attributes for peripherals in a chip. The method can be executed by a device for designing security attributes of peripherals in a chip. The device for designing security attributes of peripherals in a chip can be implemented in the form of hardware and / or software. The device for designing security attributes of peripherals in a chip can be configured in an electronic device such as a computer. In an application, the peripherals in the chip have physical addresses, and the chip accesses the corresponding physical addresses of the peripherals. Figure 1 As shown, the method includes:

[0057] Step 110: Obtain a first logical address of the physical address corresponding to the current peripheral device, and add a second logical address corresponding to the physical address according to the alias area policy.

[0058] The peripherals include, but are not limited to, Flash, ROM, SRAM, and peripherals. Peripherals include, but are not limited to, Inter-Integrated Circuit (I2C) devices, Improved Inter-Integrated Circuit (I3C) devices, Serial Peripheral Interface (SPI) devices, and Universal Asynchronous Receiver / Transmitter (UART).

[0059] For example, Figure 2 FIG. 1 is a structural diagram of a security attribute design of a peripheral device in a chip according to an embodiment of the present invention. Figure 2As shown in the figure, the chip's Advanced High Performance Bus (AHB) has four slaves mounted on it, namely FLASH, ROM, SRAM, and Peripheral. Peripheral has multiple low-speed peripherals mounted on it, including I2C, I3C, SPI, and UART.

[0060] When the application layer accesses the physical address of the peripheral, it is usually done in the form of a logical address. For example, for a 256K SRAM, when the security attribute is set with a 2K PAGE, the default logical address may be a starting address of 2000_0000 and an ending address of 2003_FFFF. The default logical address may be understood as the first logical address in the embodiment of the present invention.

[0061] A second logical address can be added based on the first logical address through an alias zone policy. The second logical address can also be used to access the physical address corresponding to the first logical address. The difference is that the security attributes of accessing the physical address through the first logical address and the second logical address may be different.

[0062] The alias area strategy can be understood as: adding a logical address to the physical address, and the logical addresses are not repeated. The logical address is a virtual address, and usually the actual number of logical addresses is greater than the number of physical addresses. Exemplarily, the bits in the logical address that do not represent the physical address can be used to distinguish between different logical addresses. For example, the first logical address of the 256K SRAM has a starting address of 2000_0000 and an end address of 2003_FFFF. The second logical address of the 256K SRAM can be a starting address of 3000_0000 and an end address of 3003_FFFF. In other words, different logical addresses can be distinguished by one or more bits of the highest bit in the logical address. The number of data bits distinguished by the logical address may be related to the number of security areas that the peripheral needs to set specifically.

[0063] Step 120: Set the first security attribute and the second security attribute of the first logical address through the IDAU and the SAU respectively.

[0064] In practical applications, security attributes can be set for the first logical address according to specific requirements for accessing the peripheral device. When setting the security attributes, the first logical address can be set by the Information Domain Attribute Unit (IDAU) and the SAU respectively. The security attributes set by the IDAU and the SAU jointly determine the security attributes of the first logical address.

[0065] Step 130: Set the third security attribute and the fourth security attribute of the second logical address through IDAU and SAU respectively.

[0066] In practical applications, security attributes can be set for the second logical address according to the specific requirements for accessing the peripheral device. The security attributes of the second logical address can be different from the security attributes of the first logical address. When setting the security attributes for the second logical address, the security attributes can be set separately through IDAU and SAU. The security attributes of the second logical address are jointly determined by the setting results of IDAU and SAU. In specific applications, by determining whether the first logical address or the second logical address is used when accessing the physical address, the security attributes of the physical address that is ultimately accessed can be determined.

[0067] Step 140: Determine a first candidate security attribute for the first logical address according to the first security attribute and the second security attribute.

[0068] Step 150: Determine a second candidate security attribute for the second logical address according to the third security attribute and the fourth security attribute.

[0069] In an embodiment of the present invention, a security attribute arbitration rule may be set, and based on the security attribute arbitration rule and in combination with the security attributes set by IDAU and SAU for the first logical address and the second logical address, the first alternative security attribute and the second alternative security attribute of the first logical address may be determined respectively.

[0070] The security attribute arbitration rule may be: when either IDAU or SAU sets the security attribute of the logical address to be secure, the security attribute of the logical address is secure; when both IDAU and SAU set the security attribute of the logical address to be non-secure, the security attribute of the logical address is non-secure.

[0071] Alternatively, the security attribute arbitration rule may be: when either IDAU or SAU sets the security attribute of the logical address to non-secure, the security attribute of the logical address is non-secure; when both IDAU and SAU set the security attribute of the logical address to secure, the security attribute of the logical address is secure.

[0072] Specific security attribute arbitration rules can be set according to specific circumstances. In an optional implementation of an embodiment of the present invention, the following security attribute arbitration rules can be adopted: when the first security attribute and the second security attribute of the first logical address are set to be non-secure respectively through IDAU and SAU, the first alternative security attribute of the first logical address is non-secure; when the first security attribute and / or the second security attribute of the first logical address are set to be secure through IDAU and SAU, the first alternative security attribute of the first logical address is secure; when the third security attribute and the fourth security attribute of the second logical address are set to be non-secure respectively through IDAU and SAU, the second alternative security attribute of the second logical address is non-secure; when the third security attribute and / or the fourth security attribute of the second logical address are set to be secure through IDAU and SAU, the second alternative security attribute of the second logical address is secure.

[0073] Step 160: Determine a final security attribute of the corresponding physical address according to the first candidate security attribute of the first logical address and the second candidate security attribute of the second logical address.

[0074] Based on the security attribute arbitration rules and the specific security attribute settings of the logical address by IDAU and SAU, the security attribute of the physical address can be determined. For example, IDAU sets the first security attribute of the first logical address to secure and the third security attribute of the second logical address to non-secure; when SAU sets the fourth security attribute of the second logical address to non-secure, when the physical address is accessed through the first logical address, since the first alternative security attribute is secure, the final security attribute of the physical address is secure; when the physical address is accessed through the second logical address, since the second alternative security attribute is non-secure, the final security attribute of the physical address is non-secure.

[0075] In the above example, regardless of whether the SAU sets the second security attribute of the first logical address, based on the security attribute arbitration rule and the setting of the IDAU, the first candidate security attribute of the first logical address is safe. Therefore, in the above example, the SAU may not set the security attribute for the second security attribute of the first logical address, which can further reduce the usage of the SAU.

[0076] In order to better illustrate the benefits of the method for designing security attributes of peripherals in a chip provided by an embodiment of the present invention, in an optional implementation of an embodiment of the present invention, the method further includes: when performing secure and non-secure alternating access to the current peripheral, setting the first security attribute of the first logical address to secure and the third security attribute of the second logical address to non-secure through IDAU; setting the fourth security attribute of the second logical address to non-secure through SAU; and alternately accessing the physical address of the current peripheral through the first logical address and the second logical address to perform secure and non-secure alternating access to the current peripheral.

[0077] According to the foregoing, accessing the physical address of the current peripheral through the first logical address is safe, and accessing the physical address of the current peripheral through the second logical address is unsafe. Therefore, by alternately accessing the physical address of the current peripheral through the first logical address and the second logical address, secure and unsafe alternating access to the current peripheral can be achieved. The technical solution of the embodiment of the present invention only requires one SAU when performing secure and unsafe alternating access to the current peripheral, which is not achievable with the prior art.

[0078] For example, Figure 3 1 is a schematic diagram of a SRAM security attribute design according to an embodiment of the present invention. When performing secure and non-secure alternating accesses to a 256K SRAM PAGE, the prior art requires setting security attributes for each PAGE through 128 SAUs, i.e. Figure 3 Shown in the left part. Figure 3 The middle right part is the security attribute setting of SRAM implemented by the security attribute design method provided by the embodiment of the present invention. In the right part, only one SAU is needed to set the second logical address starting with 30 as non-secure, and by alternately accessing the first logical address starting with 20 and the second logical address starting with 30, the 256K SRAM secure and non-secure alternating access can be completed, which greatly improves the utilization rate of the SAU.

[0079] In the use of the technical solution provided by the embodiment of the present invention, the method includes: when accessing the target physical address of the current peripheral device, obtaining the target logical address in the access request; obtaining the target alternative security attribute corresponding to the target logical address; and determining the final security attribute of the target physical address access based on the target alternative security attribute.

[0080] For example, Figure 3 As shown in the right part of the middle, when accessing the physical address, the first logical address whose target logical address starts with 20 is used, and the security attribute of the physical address is secure. Alternatively, when accessing the physical address, the second logical address whose target logical address starts with 30 is used, and the security attribute of the physical address is non-secure.

[0081] In order to further explain the specific application of the security attribute design method of the peripheral device in the chip provided by the embodiment of the present invention, Figure 2 The chip structure shown in FIG. 1 is taken as an example to illustrate its security attribute design. Table 1 is a peripheral security attribute setting table provided according to an embodiment of the present invention. In Table 1, "S" means secure, "NS" means non-secure, and "X" means that the security attribute setting may not be performed, or the security attribute setting may be secure or non-secure.

[0082] As shown in Table 1, the physical address range of Flash is 0000_0000 to 0000_1FFF, IDAU sets the first logical address 0100_0000 to 0100_1FFF as a secure address, and the second logical address 0200_0000 to 0200_1FFF as a non-secure address. If SAU sets the second logical address 0200_0000 to 0200_1FFF as a secure address, the non-secure setting of IDAU will fail, and the final security attribute is secure. If SAU sets the second logical address 0200_0000 to 0200_1FFF as a non-secure address, when accessing the physical address of Flash through the second logical address 0200_0000 to 0200_1FFF, the security attribute is non-secure.

[0083] Table 1

[0084]

[0085]

[0086] The physical address range of ROM is 0000_0000 to 0000_1FFF. IDAU sets the first logical address 0300_0000 to 0300_1FFF as a secure address, and the second logical address 0400_0000 to 0400_1FFF as a non-secure address. If SAU sets the second logical address 0400_0000 to 0400_1FFF as a secure address, the non-secure setting of IDAU will fail, and the final security attribute will be secure. If SAU sets the second logical address 0400_0000 to 0400_1FFF as a non-secure address, when accessing the physical address of ROM through the second logical address 0400_0000 to 0400_1FFF, the security attribute is non-secure.

[0087] The physical address range of SRAM is 0000_0000 to 0000_1FFF. IDAU sets the first logical address 0500_0000 to 0500_1FFF as a secure address, and the second logical address 0600_0000 to 0600_1FFF as a non-secure address. If SAU sets the second logical address 0600_0000 to 0600_1FFF as a secure address, the non-secure setting of IDAU will fail, and the final security attribute will be secure. If SAU sets the second logical address 0600_0000 to 0600_1FFF as a non-secure address, when accessing the physical address of SRAM through the second logical address 0600_0000 to 0600_1FFF, the security attribute is non-secure.

[0088] The physical address range of Peripheral is 0000_0000 to 0000_1FFF. IDAU sets the first logical address 0700_0000 to 0700_1FFF as a secure address, and the second logical address 0800_0000 to 0800_1FFF as a non-secure address. If SAU sets the second logical address 0800_0000 to 0800_1FFF as a secure address, the non-secure setting of IDAU will fail, and the final security attribute will be secure. If SAU sets the second logical address 0800_0000 to 0800_1FFF as a non-secure address, when accessing the physical address of Peripheral through the second logical address 0800_0000 to 0800_1FFF, the security attribute is non-secure.

[0089] In such Figure 2 In the chip shown, the security attribute settings of all peripherals can be achieved through only 4 SAUs, and the utilization rate of SAU is greatly improved without affecting the performance of the processor.

[0090] It should be noted that low-speed peripherals usually use AHB2APB to bridge the APB bus. Figure 2 The I2C, I3C, UART, and SPI in the AHB2APB are connected via the APB bus.

[0091] According to the technical solution of this embodiment, the peripherals in the chip have physical addresses, and the chip accesses the physical addresses corresponding to the peripherals. The first logical address of the physical address corresponding to the current peripheral is obtained, and the second logical address corresponding to the physical address is added according to the alias zone strategy; the first security attribute and the second security attribute of the first logical address are set respectively through the information domain attribute unit IDAU and the security attribute unit SAU; the third security attribute and the fourth security attribute of the second logical address are set respectively through IDAU and SAU; the first alternative security attribute of the first logical address is determined according to the first security attribute and the second security attribute; the second alternative security attribute of the second logical address is determined according to the third security attribute and the fourth security attribute; the final security attribute of the corresponding physical address is determined according to the first alternative security attribute of the first logical address and the second alternative security attribute of the second logical address, which solves the problem of low SAU utilization when setting regional security attributes for peripherals in the chip, and divides the security attributes of the physical address by using multiple logical addresses at the application layer, so as to reduce the number of SAUs required for setting the security attributes of the peripherals, improve the SAU utilization, and set the security attributes for a large number of peripherals of the chip under the premise of a limited number of SAU resources.

[0092] Figure 41 is a schematic diagram of a device for designing security attributes of peripherals in a chip according to an embodiment of the present invention. The peripherals in the chip have physical addresses, and the chip accesses the corresponding physical addresses of the peripherals. Figure 4 As shown, the device includes: a logical address adding module 410, a first security attribute setting module 420, a second security attribute setting module 430, a first security attribute determining module 440, a second security attribute determining module 450 and a final security attribute determining module 460. Among them:

[0093] The logical address adding module 410 is used to obtain the first logical address of the physical address corresponding to the current peripheral device, and add the second logical address corresponding to the physical address according to the alias area strategy;

[0094] A security attribute first setting module 420, configured to respectively set a first security attribute and a second security attribute of a first logical address through an information domain attribute unit IDAU and a security attribute unit SAU;

[0095] The second security attribute setting module 430 is used to set the third security attribute and the fourth security attribute of the second logical address through the IDAU and the SAU respectively;

[0096] A security attribute first determination module 440, configured to determine a first candidate security attribute of the first logical address according to the first security attribute and the second security attribute;

[0097] A second security attribute determination module 450, configured to determine a second candidate security attribute of the second logical address according to the third security attribute and the fourth security attribute;

[0098] The security attribute final determination module 460 is used to determine the final security attribute of the corresponding physical address according to the first candidate security attribute of the first logical address and the second candidate security attribute of the second logical address.

[0099] Optionally, the device comprises:

[0100] A target logical address acquisition module is used to acquire the target logical address in the access request when accessing the target physical address of the current peripheral device;

[0101] A security attribute information acquisition module is used to obtain target candidate security attributes corresponding to the target logical address;

[0102] The final security attribute determination module is used to determine the target candidate security attribute as the final security attribute of the target physical address access.

[0103] Optionally, the device comprises:

[0104] The security attribute arbitration rule setting module is used to determine that when both the first security attribute and the second security attribute are non-secure, the first alternative security attribute is non-secure; when the first security attribute and / or the second security attribute are secure, the first alternative security attribute is secure; when the third security attribute and the fourth security attribute are both non-secure, the second alternative security attribute is non-secure; when the third security attribute and / or the fourth security attribute are secure, the second alternative security attribute is secure.

[0105] Optionally, the device further includes:

[0106] The first alternate access setting module is used to set the first security attribute of the first logical address to be secure and the third security attribute of the second logical address to be non-secure through the IDAU when performing secure and non-secure alternate access to the current peripheral device;

[0107] Alternately access the second setting module, used for setting the fourth security attribute of the second logical address to non-secure through the SAU;

[0108] The physical address access module is used to alternately access the physical address of the current peripheral device through the first logical address and the second logical address, so as to perform secure and non-secure alternate access to the current peripheral device.

[0109] Optional, current peripherals include: Flash, Read-Only Memory ROM, Static Random Access Processor SRAM, and peripheral devices.

[0110] Optionally, peripheral devices include: integrated circuit bus I2C device, improved internal integrated circuit bus I3C device, serial peripheral interface SPI device, and universal asynchronous receiver and transmitter UART.

[0111] The device for designing security attributes of peripherals in a chip provided by an embodiment of the present invention can execute the method for designing security attributes of peripherals in a chip provided by any embodiment of the present invention, and has functional modules and beneficial effects corresponding to the execution method.

[0112] Figure 5 1 is a flow chart of a method for a computer to access a peripheral device according to an embodiment of the present invention. Figure 5 As shown, when a computer uses the security attribute design method for peripherals in a chip provided by any embodiment of the present invention to design security attributes, the method flow of the computer accessing the peripherals is as follows:

[0113] Step 510: When the computer accesses the target physical address of the current peripheral device, the target logical address in the access request is obtained.

[0114] Step 520: Obtain target candidate security attributes corresponding to the target logical address.

[0115] Specifically, the computer can obtain the security attribute information set by the IDAU and SAU for the target logical address. According to the security attribute information set by the IDAU and SAU, the target candidate security attribute corresponding to the target logical address is determined. When determining the target candidate security attribute, the judgment can be made in combination with the security attribute arbitration rule.

[0116] Step 530: Determine the target candidate security attribute as the final security attribute for accessing the target physical address.

[0117] The above-mentioned computer access peripheral method can realize normal access to peripherals on the basis of efficient use of SAU. In specific applications, by changing the logical address when accessing the target physical address, secure and non-secure alternating access to the target physical address can be realized, and the flexibility of access can be guaranteed on the basis of efficient use of SAU.

[0118] Figure 6 A schematic diagram of the structure of an electronic device 10 that can be used to implement an embodiment of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.

[0119] like Figure 6 As shown, the electronic device 10 includes at least one processor 11, and a memory connected to the at least one processor 11, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 11 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 12 or the computer program loaded from the storage unit 18 to the random access memory (RAM) 13. In the RAM 13, various programs and data required for the operation of the electronic device 10 can also be stored. The processor 11, the ROM 12, and the RAM 13 are connected to each other through a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0120] A number of components in the electronic device 10 are connected to the I / O interface 15, including: an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a disk, an optical disk, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0121] The processor 11 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microcontroller, etc. The processor 11 executes the various methods and processes described above, such as a security attribute design method for peripherals in a chip.

[0122] In some embodiments, the security attribute design method of the peripheral device in the chip can be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 18. In some embodiments, part or all of the computer program can be loaded and / or installed on the electronic device 10 via the ROM 12 and / or the communication unit 19. When the computer program is loaded into the RAM 13 and executed by the processor 11, one or more steps of the security attribute design method of the peripheral device in the chip described above can be performed. Alternatively, in other embodiments, the processor 11 can be configured to execute the security attribute design method of the peripheral device in the chip by any other appropriate means (for example, by means of firmware).

[0123] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0124] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer program is executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0125] In the context of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in combination with an instruction execution system, device or equipment. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0126] To provide interaction with a user, the systems and techniques described herein may be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).

[0127] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0128] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The client and server relationship is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services.

[0129] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0130] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A method for designing security attributes of peripherals in a chip, characterized in that: The peripheral device in the chip has a physical address, and the chip accesses the physical address corresponding to the peripheral device. The method includes: Obtaining a first logical address of a physical address corresponding to a current peripheral device, and adding a second logical address corresponding to the physical address according to an alias zone strategy; Setting a first security attribute and a second security attribute of the first logical address respectively through an information domain attribute unit IDAU and a security attribute unit SAU; Setting the third security attribute and the fourth security attribute of the second logical address respectively through the IDAU and the SAU; Determining a first candidate security attribute for the first logical address based on the first security attribute and the second security attribute; Determine a second candidate security attribute for the second logical address according to the third security attribute and the fourth security attribute; According to the first candidate security attribute of the first logical address and the second candidate security attribute of the second logical address, a final security attribute of the corresponding physical address is determined.

2. The method according to claim 1, characterized in that include: When accessing the target physical address of the current peripheral device, obtaining the target logical address in the access request; Obtaining target candidate security attributes corresponding to the target logical address; The target candidate security attribute is determined as a final security attribute for accessing the target physical address.

3. The method according to claim 1, characterized in that: include: When the first security attribute and the second security attribute are both non-safe, the first candidate security attribute is non-safe; When the first security attribute and / or the second security attribute is security, the first candidate security attribute is security; When the third security attribute and the fourth security attribute are both non-safe, the second candidate security attribute is non-safe; When the third security attribute and / or the fourth security attribute is secure, the second candidate security attribute is secure.

4. The method according to claim 3, characterized in that Also includes: When performing secure and non-secure alternating access to the current peripheral, the first security attribute of the first logical address is set to secure and the third security attribute of the second logical address is set to non-secure through the IDAU; Setting the fourth security attribute of the second logical address to non-secure by SAU; The physical address of the current peripheral device is accessed alternately through the first logical address and the second logical address, so as to perform secure and non-secure alternate access to the current peripheral device.

5. The method according to claim 1, characterized in that The current peripherals include: Flash memory, ROM, SRAM, and peripheral devices.

6. The method according to claim 5, characterized in that The peripheral devices include: an integrated circuit bus I2C device, an improved internal integrated circuit bus I3C device, a serial peripheral interface SPI device, and a universal asynchronous receiver-transmitter UART.

7. A device for designing security attributes of peripherals in a chip, characterized in that: The peripherals in the chip have physical addresses, and the chip accesses the corresponding physical addresses of the peripherals. The device comprises: A logical address adding module, used for acquiring a first logical address of a physical address corresponding to a current peripheral device, and adding a second logical address corresponding to the physical address according to an alias zone strategy; A security attribute first setting module, used to set a first security attribute and a second security attribute of a first logical address respectively through an information domain attribute unit IDAU and a security attribute unit SAU; A second security attribute setting module, used for setting a third security attribute and a fourth security attribute of the second logical address through the IDAU and the SAU respectively; A first security attribute determination module, configured to determine a first candidate security attribute of the first logical address according to the first security attribute and the second security attribute; A second security attribute determination module, configured to determine a second candidate security attribute of the second logical address according to the third security attribute and the fourth security attribute; The security attribute final determination module is used to determine the final security attribute of the corresponding physical address according to the first candidate security attribute of the first logical address and the second candidate security attribute of the second logical address.

8. An electronic device, characterized in that: The electronic device comprises: at least one processor; and a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the method for designing security attributes of peripherals in a chip according to any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the method for designing security attributes of peripherals in a chip according to any one of claims 1 to 6 when executed.

10. A method for accessing a peripheral device by a computer, characterized in that: The computer uses the security attribute design method for peripherals in a chip according to any one of claims 1 to 6 to design security attributes, the method comprising: When the computer accesses the target physical address of the current peripheral device, the target logical address in the access request is obtained; Obtaining target candidate security attributes corresponding to the target logical address; The target candidate security attribute is determined as the final security attribute for accessing the target physical address.

Images