Processor system, secure memory encryption method and system on chip

Abstract

The embodiment of the invention discloses a processor system, a secure memory encryption method and a system on chip, the processor system comprises an RISC processor and a memory encryption module; wherein a memory tracking module is arranged in the RISC processor, the memory tracking module is used for mapping a target memory access address corresponding to a secure memory access request to encryption key information, and the encryption key information at least comprises an acquisition mode of a memory encryption key corresponding to the target memory access address; and the memory encryption module acquires the encryption key information from the memory tracking module, acquires the memory encryption key through the acquisition mode in the encryption key information, and encrypts the secure memory corresponding to the target memory access address by using the memory encryption key. According to the technical scheme, a confidential calculation scheme of a processor system based on RISC-V can be realized.

Description

Technical Field

[0001] The present disclosure relates to the field of processor technology, and in particular to a processor system, a secure memory encryption method, and a system on chip. Background Art

[0002] As cloud services become more mature and complete, more and more cloud service users are worried that their data will be leaked or stolen. The traditional software and hardware security framework can no longer meet the deeper data security needs of users. In this context, mainstream server manufacturers in the industry have launched their own confidential computing solutions, the representative ones are the TDX confidential computing solution based on the X86 platform and the CCA confidential computing solution based on the ARM platform. As mainstream server chips, the encryption schemes for virtualized memory of the above-mentioned TDX confidential computing solution and CCA confidential computing solution can encrypt the memory used by each virtualized environment with different keys, which can resist attacks such as memory ROWHAMMER and COLD RESTART, and further protect user data in depth.

[0003] However, there is no similar solution for the RISC-V-based processor platform. Therefore, it is necessary to propose a confidential computing solution for the RISC-V-based processor platform to further improve the security of the RISC-V-based processor platform. Summary of the invention

[0004] Embodiments of the present disclosure provide a processor system, a secure memory encryption method, and a system on chip.

[0005] In a first aspect, an embodiment of the present disclosure provides a processor system, comprising: a RISC processor and a memory encryption module; wherein: The RISC processor is provided with a memory tracking module, and the memory tracking module is used to map a target memory access address corresponding to a secure memory access request to encryption key information, and the encryption key information at least includes a method for obtaining a memory encryption key corresponding to the target memory access address; The memory encryption module obtains the encryption key information from the memory tracking module, obtains the memory encryption key through the acquisition method in the encryption key information, and uses the memory encryption key to encrypt the secure memory corresponding to the target memory access address.

[0006] In a second aspect, an embodiment of the present invention provides a secure memory encryption method, which includes: A memory tracking module provided in the RISC processor maps the target memory access address to encryption key information after receiving the target memory access address corresponding to the secure memory access request, wherein the encryption key information at least includes a method for obtaining the memory encryption key corresponding to the target memory access address; The memory encryption module obtains the encryption key information from the memory tracking module; The memory encryption module obtains the memory encryption key through the acquisition method in the encryption key information; The memory encryption module uses the memory encryption key to encrypt the secure memory corresponding to the target memory access address.

[0007] In a third aspect, an embodiment of the present disclosure provides a system on chip, which includes: a processor system as described in any one of the first aspects.

[0008] The technical solution provided by the embodiments of the present disclosure may have the following beneficial effects: In this embodiment, for a processor system based on RISC-V, a memory tracking module is set in the RISC processor so that the memory tracking module can map the target memory access address corresponding to the secure memory access request to encryption key information, and the memory encryption key information at least includes a method for obtaining the memory encryption key corresponding to the target memory access address, and after the memory encryption module obtains the encryption key information from the memory tracking module, it uses the method for obtaining the memory encryption key in the encryption key information to obtain the memory encryption key, and uses the memory encryption key to encrypt the secure memory corresponding to the target memory access address, thereby realizing a confidential computing scheme for a processor system based on RISC-V. Since the design of the native processor is not modified, the confidential computing scheme further expands the existing SMMTT specification and complies with the elastic and scalable characteristics of RISC-V; in addition, since the target memory access address and the memory encryption key are associated with each other, different memory encryption keys can be set for different secure memories. Therefore, in addition to supporting traditional virtual machine memory encryption, this scheme can also support memory encryption of different domain managers under the software system and secure virtual machine managers under the domain, further improving memory integrity and confidentiality.

[0009] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0010] Other features, objectives and advantages of the present disclosure will become more apparent through the following detailed description of non-limiting embodiments in conjunction with the accompanying drawings. In the accompanying drawings:

[0011] Figure 1A structural block diagram showing a RISC-V processor-based software system divided into domains.

[0012] FIG. 2 shows a structural block diagram of a processor system provided in one embodiment of the present disclosure.

[0013] FIG3 shows a structural diagram of an implementation of a processor system provided in one embodiment of the present disclosure.

[0014] FIG. 4 is a schematic diagram showing a three-level page table format supported by the existing MTT in the RICS-V processor.

[0015] FIG5 is a schematic diagram showing an extended MTT page table entry format provided in an embodiment of the present disclosure.

[0016] FIG6 shows a flow chart of a secure memory encryption method provided in one embodiment of the present disclosure.

[0017] FIG. 7 shows a structural block diagram of an electronic device provided in one embodiment of the present disclosure. DETAILED DESCRIPTION

[0018] Hereinafter, exemplary embodiments of the present disclosure will be described in detail with reference to the accompanying drawings so that those skilled in the art can easily implement them. In addition, for the sake of clarity, parts not related to the description of the exemplary embodiments are omitted in the accompanying drawings.

[0019] In the present disclosure, it should be understood that terms such as "include" or "have" are intended to indicate the presence of features, numbers, steps, behaviors, components, parts, or a combination thereof disclosed in the specification, and do not exclude the possibility that one or more other features, numbers, steps, behaviors, components, parts, or a combination thereof exist or are added.

[0020] It should also be noted that, in the absence of conflict, the embodiments and features in the embodiments of the present disclosure may be combined with each other. The present disclosure will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0021] The user information (including but not limited to user device information such as location information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this disclosure are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with the relevant laws, regulations and standards of relevant countries and regions, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0022] At present, a TME (Total Memory Encryption) engine has been added to the TDX confidential computing solution based on the X86 processor. It is plugged into the memory data transmission bus. The TME engine is responsible for encrypting data and writing it to the memory, and decrypting data after reading it from the memory. The key used for encryption and decryption of memory data is specified by KEYID.

[0023] The key specified by KEYID is managed through CPU-specific instructions and control registers, and needs to be regenerated after power off or restart. These keys are located in a special secure memory that cannot be directly accessed by the CPU and can only be used through KEYID. The virtual machine uses the high bits in the MMU PTE as KEYID, and the privileged software is responsible for assigning different KEYIDs to each virtual machine to select the memory encryption key. This solution manages keys through CPU-specific instructions, is strongly bound to the X86 instruction set, and cannot be used on other platforms.

[0024] Another confidential computing solution, the CCA confidential computing solution based on ARM processors, adds an MPE (Memory Protection Engine) to the memory data transmission bus. MPE is responsible for encrypting data and writing it to the memory, and decrypting data after reading it from the memory. The key used for encryption and decryption of memory data is specified by MECID.

[0025] MECID keys need to be regenerated by MPE after power off or restart. These keys are located in the secure memory inside MPE and cannot be directly accessed by the CPU. They can only be used through MECID. Virtual machines use MECID registers to manage private or shared memory. Privileged software is responsible for assigning different MECID registers to each virtual machine to select the memory encryption key.

[0026] This solution manages keys through a proprietary MPE and uses a MECID register to select encryption keys, so that the AMBA bus carries MECID information and tells the MPE to use the corresponding key for encryption and decryption. This involves bus modification and has high maintenance costs.

[0027] To this end, the present disclosure provides a processor system, which is a system based on a RISC-V processor. Figure 1 As shown in the figure, the software system based on RISC-V (reduced instruction set fifth generation) processor is divided into domains, mainly including root areas and other domains. Other domains include host management domain, confidential security domain and extended confidential security domain, among which:

[0028] One or more virtual machines can be created in each domain.

[0029] Each domain has its own virtual machine manager; for example, the VMM (Virtual Machine Manager) in the host management domain, the TSM (TEE Security manager) in the confidential security domain, and the user's own TSM in the extended confidential security domain; for the sake of distinction, the VMM in the host management domain can be called a virtual machine manager, and the TSM in the confidential security domain and the extended confidential security domain can be called other domain managers.

[0030] The root security domain has the highest authority, and its virtual machine manager is the root security domain manager (RDSM).

[0031] Confidential computing security requires that the secure memory allocated to each domain and the secure virtual machine within the domain use different encryption keys to ensure confidentiality and integrity. Therefore, the processor system proposed in the present disclosure can use a unique key to encrypt the secure memory of different domains and the secure memory of secure virtual machines running in different domains.

[0032] The details of the embodiments of the present disclosure are described in detail below through specific examples.

[0033] FIG2 shows a block diagram of a processor system provided by an embodiment of the present disclosure. As shown in FIG2 , the processor system 200 includes: a RISC processor 201 and a memory encryption module 202;

[0034] The RISC processor 201 is provided with a memory tracking module 2021, and the memory tracking module 2021 is used to map the target memory access address corresponding to the secure memory access request to encryption key information, and the encryption key information at least includes a method for obtaining the memory encryption key corresponding to the target memory access address; The memory encryption module 202 obtains the encryption key information from the memory tracking module 2021, obtains the memory encryption key through the acquisition method in the encryption key information, and uses the memory encryption key to encrypt the secure memory corresponding to the target memory access address.

[0035] In some embodiments, the RISC processor is a RISC-V processor.

[0036] In some embodiments, the function of the existing MTT (Memory Tricable Table) in the RISC-V processor can be expanded so that the MTT implements the function of the memory tracking module, so that the extended MTT maps the target memory access address corresponding to the secure memory access request to encryption key information, and the encryption key information may at least include a method for obtaining the memory encryption key corresponding to the target memory access address. Using this acquisition method, the memory encryption key corresponding to the target memory access address can be obtained.

[0037] In some embodiments, a secure memory access request is initiated by a memory access subject under the software system of the internal processing system. Each memory access subject can only access the secure memory corresponding to itself, but cannot access the secure memory of other memory access subjects. The memory access subject under the software system of the processing system may include but is not limited to the root security domain manager, other domain managers, and secure virtual machines managed by other domain managers; other domain managers may include but are not limited to virtual machine managers and confidential security domain managers (including ordinary confidential security domain managers and extended confidential security domain managers). The access address carried in the secure memory access request initiated by the memory access subject is usually a virtual address.

[0038] MTT is a security extension of the RISC-V processor, which can run under the highest system privileges of the processor system and is used to manage the secure memory of virtual machines and virtual machine managers in a virtualized environment. MTT is located at the back end of the processor's memory management unit MMU. MMU converts the virtual address VA in the secure memory access request into a physical address PA and transmits it to MTT. MTT checks the legitimacy of the PA, that is, detects whether the PA is located within the memory access address space of the memory access subject (such as a virtual machine) that sends the secure memory access request. If the PA is within the memory access address space of the memory access subject, MTT transmits the PA and the secure memory access request to the system bus, so that after the DDR controller attached to the system bus obtains the PA and the secure memory access request, if the type of the secure memory access request is a data read request, the memory data under the PA address is read, and if the type of the secure memory access request is a data write request, the write data corresponding to the secure memory access request is written into the memory corresponding to the PA address. It should be noted that the target memory access address mentioned in the embodiment of the present disclosure is the physical address obtained by the MMU after converting the virtual address in the secure memory access request.

[0039] If the memory tracking module is implemented by expanding the function of MTT, then in the above process, after MTT receives the physical address corresponding to the secure memory access request from the MMU, that is, the target memory access address, it maps the target memory access address to the encryption key information, so that the memory encryption module can obtain the encryption key information.

[0040] In other embodiments, a memory tracking module can also be separately extended in the RISC-V processor, and the memory tracking module can obtain the secure memory access request and the target memory access address corresponding to the secure memory access request from the MMU, and can map the target memory access address corresponding to the secure memory access request to the encryption key information.

[0041] In some embodiments, different memory access subjects are pre-assigned different secure memories. The target memory access address corresponding to the current secure memory access request needs to be within the memory access address space of the secure memory of the memory access subject that initiated the secure memory access request. If it is not within the memory access address space, the secure memory access request is an illegal request, and the secure memory access request will be rejected. For secure memory access requests initiated by different memory access subjects, the encryption key information mapped to them is different. For secure memory access requests initiated by the same memory access subject, even if the target memory access address is different, as long as the target memory access address is within the memory access address space of the corresponding secure memory, the memory tracking module will map it to the same encryption key information. The memory encryption keys corresponding to different encryption key information are different, so the memory encryption keys corresponding to different memory access subjects are different, that is, the memory encryption key corresponding to each memory access subject is unique.

[0042] In some embodiments, after the memory tracking module maps the target memory access address to the encryption key information, the encryption key information can be transmitted to the memory encryption module together with the target memory access address and the secure memory access request.

[0043] In some embodiments, the memory encryption module can be implemented by an encryption engine with encryption and decryption functions. The RISC processor and the memory encryption module are mounted on the system bus, and a DDR controller is also mounted on the system bus. The memory encryption module can be located at the back end of the RISC processor and at the front end of the DDR controller. In this way, the encryption key information, the target memory access address, and the secure memory access request transmitted to the system bus can be obtained by the memory encryption module first, so that the encryption key information is parsed by the memory encryption module, and the corresponding memory encryption key is obtained based on the memory encryption key acquisition method in the encryption key information, and then the secure memory corresponding to the target memory access address is encrypted.

[0044] Encrypting the secure memory corresponding to the memory access address can be understood as follows: if the secure memory access request is a read request, the corresponding data is read from the memory corresponding to the target memory access address through the DDR controller, and the read data is decrypted using the memory encryption key, and the decrypted plaintext data is returned to the memory access subject; if the secure memory access request is a write request, the write data corresponding to the secure memory access request is encrypted using the memory encryption key, and then written to the memory corresponding to the target memory access address through the DDR controller.

[0045] In this embodiment, for a processor system based on RISC-V, a memory tracking module is set in the RISC processor so that the memory tracking module can map the target memory access address corresponding to the secure memory access request to encryption key information, and the memory encryption key information at least includes a method for obtaining the memory encryption key corresponding to the target memory access address, and after the memory encryption module obtains the encryption key information from the memory tracking module, it uses the method for obtaining the memory encryption key in the encryption key information to obtain the memory encryption key, and uses the memory encryption key to encrypt the secure memory corresponding to the target memory access address, thereby realizing a confidential computing scheme for a processor system based on RISC-V. Since the design of the native processor is not modified, the confidential computing scheme further expands the existing SMMTT specification and complies with the elastic and scalable characteristics of RISC-V; in addition, since the target memory access address and the memory encryption key are associated with each other, different memory encryption keys can be set for different secure memories. Therefore, in addition to supporting traditional virtual machine memory encryption, this scheme can also support memory encryption of different domain managers under the software system and secure virtual machine managers under the domain, further improving memory integrity and confidentiality.

[0046] In an optional implementation of this embodiment, the processor system further includes a key storage module, wherein the key storage module is used to store a memory encryption key and a key index value corresponding to the memory encryption key; The RISC processor is also provided with a key management module, and the key management module is used to manage the memory encryption key in the key storage module.

[0047] In this optional implementation, as described above, different memory access subjects correspond to different memory encryption keys, so multiple memory encryption keys are required to ensure the confidentiality and integrity of the secure memory of different memory access subjects. In order to facilitate the management of multiple memory encryption keys and ensure the security of memory encryption keys, a special key storage module can also be set up to store all memory encryption keys and key index values ​​corresponding to the memory encryption keys.

[0048] In some embodiments, the key storage module may be set in a register inside the RISC processor, or in a secure memory outside the RISC processor. If it is set in a secure memory outside the RISC processor, it needs to be a hardware-protected secure memory to ensure the security of the key storage module.

[0049] In some embodiments, in order to ensure the security of the key storage module, a key management module can be set in the RISC processor, and the key management module can be used to manage the life cycle of all memory encryption keys in the key storage module. The key management module includes a plurality of control registers for implementing the following operations: a key enumeration controller for implementing key enumeration operations, that is, the corresponding information of the memory encryption key in the key storage module can be viewed through the key control register of the key management module, such as how many memory encryption keys there are, the usage status of the memory encryption key, the index value of the memory encryption key, etc.; a key generation register for implementing key generation operations, that is, a new memory encryption key can be generated through the key generation register of the key management module, and the new memory encryption key and its corresponding key index value can be stored in the memory storage module; a key clearing controller for implementing key clearing operations, that is, one or more of the memory encryption keys stored in the key storage module can be cleared through the key clearing register of the key management module. It should be noted that the usage status of the memory encryption key that can be cleared is an unused state; a key selection register for implementing key selection operations, that is, the memory encryption key corresponding to the key index value can be selected from the key storage module through the key selection register of the key management module.

[0050] It can be understood that the memory encryption key in the memory encryption module is only accessible to the key management module, including generating memory encryption keys, storing generated memory encryption keys, revoking (i.e., recycling) memory encryption keys, and using the memory encryption keys, all of which need to be completed through the key management module.

[0051] In some embodiments, the key management module can be implemented in a RISC processor through hardware programming; an implementation structure of a processor system provided with a key management module and a key storage module is shown in Figure 3, in which the memory tracking module is implemented by extending MTT, and the key storage module is set in a secure memory outside the RISC processor.

[0052] In an optional implementation of this embodiment, the software system of the processor system includes a memory allocation subject and a memory access subject; when the memory allocation subject allocates secure memory for the memory access subject that initiates the secure memory access request, the memory allocation subject obtains the key index value corresponding to the memory encryption key from the key storage module through the key management module, and stores the key mapping relationship between the memory access address space corresponding to the secure memory and the encryption key information including the key index value in the memory tracking module; After receiving the target memory access address corresponding to the secure memory access request, the memory tracking module maps the target memory access address to the encryption key information based on the key mapping relationship.

[0053] In this optional implementation, the domain managers of each domain of the software system, the virtual machine managers in each domain, and the secure virtual machines managed by the virtual machine managers all need to be allocated secure memory when they are created and started. For the sake of ease of description, these subjects that need to be allocated secure memory can be referred to as memory access subjects, and the subject used to allocate secure memory to the memory access subject is called the memory allocation subject. For example, the root security domain manager RDSM of the root security domain with the highest system authority, when the processor system is powered on or restarted, the system loader will allocate secure memory to the RDSM. At this time, the memory allocation subject that allocates secure memory is the system loader. After RDSM is started, RDSM can be used as the memory allocation subject of other domain managers, virtual machine managers, and secure virtual machines, etc., and can allocate secure memory to them. It can be understood that the same subject can be used as a memory allocation subject or a memory access subject at different stages; for example, when RDSM is loaded by the system loader, it is used as a memory access subject, and after RDSM is started, it is used as a memory allocation subject when allocating memory to other domain managers, etc.

[0054] In some embodiments, the process of allocating secure memory can be understood as, after determining a usable memory segment from the memory, associating the memory access address space corresponding to the memory segment and the identifier of the corresponding memory access subject and storing them in the MTT, so that after the MTT receives the target memory access address from the MMU, it checks whether the target memory access address is in the memory access address space corresponding to the memory access subject that initiated the current secure memory access request. If so, it means that the memory access subject has the authority to access the memory corresponding to the target memory access address. If not, it means that the memory access subject does not have the authority to access the memory corresponding to the target memory access address.

[0055] In the disclosed embodiment, the memory tracking module can store the key mapping relationship between the memory access address space of the memory access subject and the encryption key information, and all memory addresses in the memory access address space can be mapped to the encryption key information by the memory tracking module. The memory tracking module can store the key mapping relationship between the memory access address space and the encryption key information corresponding to multiple memory access subjects, and the encryption key information corresponding to different memory access address spaces corresponds to different memory encryption keys.

[0056] In some embodiments, the page table entry of the MTT can be expanded on the basis of the original MTT, so that the encryption key information is stored in the expanded page table entry. In some embodiments, the encryption key information includes a memory encryption key, a key index value of the memory encryption key, a key application algorithm and an encryption mode, etc. When the memory encryption module uses the memory encryption key to encrypt the secure memory corresponding to the target memory access address, it can encrypt based on the key application algorithm and encryption mode in the encryption key information.

[0057] The existing MTT of the RICS-V processor supports three-level page tables, and the format of each level of the page table is shown in Figure 4, where each level of the page table is 64 bits. In the disclosed embodiment, the above three page table entries can be expanded to 128 bits, and the extended high 64 bits can be used to store encryption key information, such as key index value keyIdx, encryption mode mode, etc. For example, as shown in Figure 5, the 32-bit key index value keyIdx and the 8-bit encryption mode mode are expanded.

[0058] In an optional implementation of this embodiment, a control register for enabling the memory tracking module is provided in the memory tracking module.

[0059] In this optional implementation, if the memory tracking module is implemented by extending MTT, a control register can be set to enable the memory tracking module. That is, the user can configure the control register to enable the memory tracking module, thereby realizing the encryption of secure memory. The user can also choose not to enable the memory tracking module, that is, by configuring the control register, the memory function module extended by MTT is not used, so that the memory encryption module will not encrypt the target memory access address when the encryption key information cannot be obtained.

[0060] In an optional implementation of this embodiment, the memory tracking module transmits the encryption key information to the system bus; the memory encryption module reads the encryption key information from the system bus, and obtains the memory encryption key corresponding to the key index value in the encryption key information from the key storage module through the key management module.

[0061] In this optional implementation, after the memory tracking module maps the target memory access address to the encryption key information, the encryption key information, the secure memory access request and the target memory access address are transmitted to the system bus together. After the information is transmitted to the downstream through the system bus, it is first obtained by the memory encryption module arranged at the front end of the DDR controller. After the memory encryption module parses the encryption key information, it uses the encryption key information to obtain the corresponding memory encryption key from the key storage module through the key management module, and then encrypts the memory corresponding to the target memory access address.

[0062] In an optional implementation of this embodiment, after the processor system is powered on or restarted, the system loader generates a memory encryption key and a corresponding key index value, and stores the memory encryption key and the key index value in a key storage module.

[0063] In this optional implementation, after the processor system is powered on or restarted, the system loader running at the highest system authority can generate multiple memory encryption keys and key index values ​​corresponding to each memory encryption key. The system loader can generate memory encryption keys by calling a key generation chip or a key application algorithm, such as calling a random key generation algorithm to generate memory encryption keys. The number of memory encryption keys can be set in advance in the system loader according to actual needs, and the present disclosure does not impose specific restrictions on this.

[0064] Since the system loader has the highest system authority, it can directly store the generated memory encryption key and its corresponding key index value in the key storage module. The system loader can also transmit the generated memory encryption key and its corresponding key index value to the key management module, and the key management module writes the memory encryption key and its corresponding key index value into the key storage module.

[0065] It is understandable that after the virtual machine manager is started, the user can regenerate, update or clear the memory encryption key through the key generation service interface provided to the user. In some embodiments, the key service interface regenerates the memory encryption key based on the user's request by calling the key management module and stores it in the key storage module, or updates the memory encryption key stored in the key storage module, or clears the memory encryption key stored in the key storage module. It should be noted that the cleared memory encryption key is an unused memory encryption key, and the usage status of the memory encryption key is stored in the memory management module. When the memory encryption key is cleared, its corresponding key index value is also cleared.

[0066] In an optional implementation of this embodiment, the software system of the processor system includes a memory allocation subject and a memory access subject; after the memory allocation subject is started, an unused target key is selected from the memory encryption key as the memory encryption key of the secure memory of the memory access subject, so that after the memory access subject is started, the memory encryption module uses the target key to encrypt the secure memory of the memory access subject; wherein, the target keys corresponding to different memory access subjects are different.

[0067] In this optional implementation, the memory allocation subject may include but is not limited to the system loader and root security domain manager under the software system of the processor system; the memory access subject may include but is not limited to the root security domain manager, other domain managers and secure virtual machines under the software system of the processor system; other domain managers may include but are not limited to virtual machine managers and confidential security domain managers, etc., and secure virtual machines include secure virtual machines within the host management domain and secure virtual machines within the confidential security domain.

[0068] In some embodiments, the root security domain manager can be used as a memory allocation subject and a memory access subject at different stages. After the processor system is powered on or restarted, when the system loader records the root security domain manager, the root security domain manager acts as a memory access subject, and the system loader acts as a memory allocation subject that allocates secure memory to the root security domain manager; after the root security domain manager is successfully loaded and started, the root security domain manager can be used to load other domain managers, or allocate secure memory to secure virtual machines created by users. At this time, the root security manager acts as a memory allocation subject, and other domain managers or secure virtual machines act as memory access subjects.

[0069] In this optional implementation, after the memory allocation subject is started, when secure memory needs to be allocated to the memory access subject, the key enumeration function of the key management module can be called to select an unused target key enumerated by the key management module from the memory encryption keys stored in the key storage module as the memory encryption key of the secure memory corresponding to the memory access subject, and after generating encryption key information including the method for obtaining the memory encryption key (such as the key index value of the memory encryption key), the encryption key information and the memory access address space of the secure memory are associated and stored in the memory tracking module, so that after the memory access subject initiates a secure memory access request, the MMU of the RISC processor maps the virtual address in the secure memory access request to a physical address, that is, the target memory access address, and then transmits the target memory access address to the MTT, and the memory tracking As an extension of MTT, the tracking module can obtain the target memory access address. After MTT checks that the target memory access address is legal (that is, the target memory access address is within the memory access address space of the secure memory corresponding to the memory access subject), the memory tracking module maps the target memory access address to the encryption key information corresponding to the memory access address space where the target memory access address is located, thereby transmitting the encryption key information, the target memory access address and the secure memory access request to the system bus, so that the memory encryption module can read the encryption key information, the target memory access address and the secure memory access request from the system bus. After the memory encryption module parses the encryption key information, it selects the target key corresponding to the key index value in the encryption key information by calling the key management module, and encrypts the secure memory requested to be accessed by the secure memory access request.

[0070] The following is a detailed description of various different embodiments in which the memory access subjects are the root security domain manager, other domain managers, and secure virtual machines.

[0071] In an optional implementation of this embodiment, the system loader selects an unused first key from the key storage module as the memory encryption key for the secure memory allocated to the root security domain manager, so that after the root security domain manager is started, the memory encryption module uses the first key to encrypt the secure memory of the root security domain manager.

[0072] In this optional implementation, as described above, the software system of the processor system includes a root security domain, and a root security domain manager RDSM for managing the root security domain can be loaded by a system loader. The root security domain manager can also have the highest system authority.

[0073] It can be understood that the first key can be any key in the key storage module, because after the processor system is powered on or restarted, all memory encryption keys in the key storage module are newly generated and have not been used. The key management module can enumerate all memory encryption keys in the key storage module for selection by the system loader, and the selected memory encryption key is the first key. The first key is used as the memory encryption key for the secure memory of the root security domain manager, and is associated with the encryption key information including the key index value corresponding to the first key, and the memory access address space of the secure memory allocated by the system loader to the root security domain manager and stored in the memory tracking module, and the system loader loads the root security domain manager into the secure memory. If the root security domain manager is loaded successfully, and during operation, it can initiate the secure memory access request mentioned above when necessary, so that according to the process described above, the memory encryption module can finally use the first key to encrypt the secure memory corresponding to the target memory access address corresponding to the secure memory access request initiated by the root security domain manager.

[0074] In an optional implementation of this embodiment, after the root security domain manager is started, an unused second key is selected from the key storage module as the memory encryption key for the secure memory allocated to the other domain managers, so that after the other domain managers are started, the memory encryption module uses the second key to encrypt the secure memory of the other domain managers; wherein the second keys corresponding to different other domain managers are different.

[0075] In this optional implementation, as described above, the software system of the processor system includes other domains in addition to the root security domain, and the other domain managers for managing other domains can be allocated secure memory by the root security domain manager. And when allocating secure memory, a second key for encrypting its secure memory can be specified for other domain managers, that is, the root security domain manager selects an unused second key from the key storage module as the current memory encryption key of other domain managers through the key management module, and associates and stores the memory access address space of the secure memory allocated to the other domain manager and the encryption key information including the second key in the memory tracking module. After the root security domain manager loads the image software of the other domain manager into the secure memory, the other domain manager will be started. During the operation of the other domain manager, the secure memory access request mentioned above can be initiated when necessary, so that according to the process described above, the memory encryption module can finally use the second key to encrypt the secure memory corresponding to the target memory access address of the secure memory access request initiated by the other domain manager.

[0076] It should be noted that there may be multiple other domain managers, such as a virtual machine manager, a confidentiality security domain manager, etc. For different other domain managers, secure memory and memory encryption keys corresponding to the secure memory may be allocated in the above manner respectively.

[0077] In an optional implementation of this embodiment, the other domain managers include a virtual machine manager. In response to a request to create a secure virtual machine, the root security domain manager allocates secure memory to the secure virtual machine, and the root security domain manager selects an unused third key from the key storage module as a memory encryption key for the secure memory allocated to the secure virtual machine, so that after the secure virtual machine is started, the memory encryption module uses the third key to encrypt the secure memory of the secure virtual machine.

[0078] In this optional implementation, the other domain manager is a virtual machine manager, and a user with corresponding permissions, such as a user with administrator permissions, can initiate a request to create a secure virtual machine. After receiving the request, the virtual machine manager allocates initial memory to the secure virtual machine when creating the secure virtual machine, and then the root security domain manager converts the initial memory into secure memory, that is, the root security domain manager stores the secure memory address space corresponding to the initially allocated memory in the MTT so that the security of the memory can be protected by the MTT management mechanism, and the root security domain manager can also obtain the memory encryption key with an unused status through the key management module, and select one of them as the memory encryption key of the secure memory of the secure virtual machine, that is, the selected memory encryption key is the third key. After the secure virtual machine is started, if the secure virtual machine initiates the secure memory access request mentioned above, the secure memory corresponding to the target memory access address corresponding to the secure memory access request initiated by the secure virtual machine can be encrypted by the memory encryption module using the third key according to the process described above.

[0079] In an optional implementation of the present embodiment, in response to a request to replace the memory encryption key of the secure memory of a created secure virtual machine, a fourth key is added to the key storage module, the created secure virtual machine is revoked, and a new secure virtual machine is created. When creating the new secure virtual machine, the fourth key is designated as the memory encryption key of the secure memory allocated to the new secure virtual machine, so that after starting the new secure virtual machine, the memory encryption module uses the fourth key to encrypt the secure memory of the new secure virtual machine.

[0080] In this optional implementation, a user with corresponding permissions, such as a user with administrator permissions, can initiate a request to revoke a secure virtual machine. Revoking a secure virtual machine includes: the virtual machine manager reclaims the secure memory allocated for the secure virtual machine, etc., so that the virtual machine manager recreates a new secure virtual machine. In addition, the key status used by the revoked secure virtual machine can be modified to unused through a pre-created and run key generation service interface, and a request is made to regenerate a new fourth key. The key generation service interface can modify the key status used by the revoked secure virtual machine to unused by calling a key management module, and can also call a key management module to regenerate a new fourth key. The generated fourth key and its corresponding key index value can be stored by the key management module to the key storage module. It should be noted that when the virtual machine manager creates a secure virtual machine, the initially allocated memory needs to be converted into secure memory by the root security domain manager, that is, the root security domain manager stores the secure memory address space corresponding to the initially allocated memory in the MTT so that the security of the memory is protected by the MTT management mechanism. In addition, the root security domain manager also stores the encrypted key information including the fourth key in association with the secure memory address space in the memory tracking module. After the new secure virtual machine is started, if a secure memory access request is initiated, the process described above can be followed, and the memory encryption module can ultimately use the fourth key to encrypt the secure memory corresponding to the target memory access address corresponding to the secure memory access request initiated by the new secure virtual machine.

[0081] FIG6 shows a flow chart of a secure memory encryption method provided by an embodiment of the present disclosure. As shown in FIG6 , the secure memory encryption method includes the following steps:

[0082] In step S601, after receiving a target memory access address corresponding to a secure memory access request, a memory tracking module provided in the RISC processor maps the target memory access address to encryption key information, wherein the encryption key information at least includes a method for obtaining a memory encryption key corresponding to the target memory access address; In step S602, the memory encryption module obtains the encryption key information from the memory tracking module; In step S603, the memory encryption module obtains the memory encryption key through the acquisition method in the encryption key information; In step S604, the memory encryption module uses the memory encryption key to encrypt the secure memory corresponding to the target memory access address.

[0083] The structure of the processor system that executes the secure memory encryption method is first described below.

[0084] In some embodiments, the RISC processor is a RISC-V processor.

[0085] In some embodiments, the function of the existing MTT (Memory Tricable Table) in the RISC-V processor can be expanded so that the MTT implements the function of the memory tracking module, so that the extended MTT maps the target memory access address corresponding to the secure memory access request to encryption key information, and the encryption key information may at least include a method for obtaining the memory encryption key corresponding to the target memory access address. Using this acquisition method, the memory encryption key corresponding to the target memory access address can be obtained.

[0086] In some embodiments, a secure memory access request is initiated by a memory access subject under the software system of the internal processing system. Each memory access subject can only access the secure memory corresponding to itself, but cannot access the secure memory of other memory access subjects. The memory access subject under the software system of the processing system may include but is not limited to the root security domain manager, other domain managers, and secure virtual machines managed by other domain managers; other domain managers may include but are not limited to virtual machine managers and confidential security domain managers (including ordinary confidential security domain managers and extended confidential security domain managers). The access address carried in the secure memory access request initiated by the memory access subject is usually a virtual address.

[0087] MTT is a security extension of the RISC-V processor, which can run under the highest system privileges of the processor system and is used to manage the secure memory of virtual machines and virtual machine managers in a virtualized environment. MTT is located at the back end of the processor's memory management unit MMU. MMU converts the virtual address VA in the secure memory access request into a physical address PA and transmits it to MTT. MTT checks the legitimacy of the PA, that is, detects whether the PA is located within the memory access address space of the memory access subject (such as a virtual machine) that sends the secure memory access request. If the PA is within the memory access address space of the memory access subject, MTT transmits the PA and the secure memory access request to the system bus, so that after the DDR controller attached to the system bus obtains the PA and the secure memory access request, if the type of the secure memory access request is a data read request, the memory data under the PA address is read, and if the type of the secure memory access request is a data write request, the write data corresponding to the secure memory access request is written into the memory corresponding to the PA address. It should be noted that the target memory access address mentioned in the embodiment of the present disclosure is the physical address obtained by the MMU after converting the virtual address in the secure memory access request.

[0088] If the memory tracking module is implemented by expanding the function of MTT, then in the above process, after MTT receives the physical address corresponding to the secure memory access request from the MMU, that is, the target memory access address, it maps the target memory access address to the encryption key information, so that the memory encryption module can obtain the encryption key information.

[0089] In other embodiments, a memory tracking module can also be separately extended in the RISC-V processor, and the memory tracking module can obtain the secure memory access request and the target memory access address corresponding to the secure memory access request from the MMU, and can map the target memory access address corresponding to the secure memory access request to the encryption key information.

[0090] In some embodiments, different memory access subjects are pre-assigned different secure memories. The target memory access address corresponding to the current secure memory access request needs to be within the memory access address space of the secure memory of the memory access subject that initiated the secure memory access request. If it is not within the memory access address space, the secure memory access request is an illegal request, and the secure memory access request will be rejected. For secure memory access requests initiated by different memory access subjects, the encryption key information mapped to them is different. For secure memory access requests initiated by the same memory access subject, even if the target memory access address is different, as long as the target memory access address is within the memory access address space of the corresponding secure memory, the memory tracking module will map it to the same encryption key information. The memory encryption keys corresponding to different encryption key information are different, so the memory encryption keys corresponding to different memory access subjects are different, that is, the memory encryption key corresponding to each memory access subject is unique.

[0091] In some embodiments, after the memory tracking module receives the target memory access address corresponding to the secure memory access request from the MMU and maps the target memory access address to encryption key information, the encryption key information can be transmitted to the memory encryption module together with the target memory access address and the secure memory access request.

[0092] In some embodiments, the memory encryption module can be implemented by an encryption engine with encryption and decryption functions. The RISC processor and the memory encryption module are mounted on the system bus, and a DDR controller is also mounted on the system bus. The memory encryption module can be located at the back end of the RISC processor and at the front end of the DDR controller. In this way, the encryption key information, the target memory access address, and the secure memory access request transmitted to the system bus can be obtained by the memory encryption module first, so that the encryption key information is parsed by the memory encryption module, and the corresponding memory encryption key is obtained based on the memory encryption key acquisition method in the encryption key information, and then the secure memory corresponding to the target memory access address is encrypted.

[0093] Encrypting the secure memory corresponding to the memory access address can be understood as follows: if the secure memory access request is a read request, the corresponding data is read from the memory corresponding to the target memory access address through the DDR controller, and the read data is decrypted using the memory encryption key, and the decrypted plaintext data is returned to the memory access subject; if the secure memory access request is a write request, the write data corresponding to the secure memory access request is encrypted using the memory encryption key, and then written to the memory corresponding to the target memory access address through the DDR controller.

[0094] In this embodiment, for a processor system based on RISC-V, a memory tracking module is set in the RISC processor so that the memory tracking module can map the target memory access address corresponding to the secure memory access request to encryption key information, and the memory encryption key information at least includes a method for obtaining the memory encryption key corresponding to the target memory access address, and after the memory encryption module obtains the encryption key information from the memory tracking module, it uses the method for obtaining the memory encryption key in the encryption key information to obtain the memory encryption key, and uses the memory encryption key to encrypt the secure memory corresponding to the target memory access address, thereby realizing a confidential computing scheme for a processor system based on RISC-V. Since the design of the native processor is not modified, the confidential computing scheme further expands the existing SMMTT specification and complies with the elastic and scalable characteristics of RISC-V; in addition, since the target memory access address and the memory encryption key are associated with each other, different memory encryption keys can be set for different secure memories. Therefore, in addition to supporting traditional virtual machine memory encryption, this scheme can also support memory encryption of different domain managers under the software system and secure virtual machine managers under the domain, further improving memory integrity and confidentiality.

[0095] In an optional implementation of this embodiment, the processor system further includes a key storage module, wherein the key storage module is used to store a memory encryption key and a key index value corresponding to the memory encryption key; The RISC processor is also provided with a key management module, and the key management module is used to manage the memory encryption key in the key storage module.

[0096] In this optional implementation, as described above, different memory access subjects correspond to different memory encryption keys, so multiple memory encryption keys are required to ensure the confidentiality and integrity of the secure memory of different memory access subjects. In order to facilitate the management of multiple memory encryption keys and ensure the security of memory encryption keys, a special key storage module can also be set up to store all memory encryption keys and key index values ​​corresponding to the memory encryption keys.

[0097] In some embodiments, the key storage module may be set in a register inside the RISC processor, or in a secure memory outside the RISC processor. If it is set in a secure memory outside the RISC processor, it needs to be a hardware-protected secure memory to ensure the security of the key storage module.

[0098] In some embodiments, in order to ensure the security of the key storage module, a key management module can be set in the RISC processor, and the key management module can be used to manage the life cycle of all memory encryption keys in the key storage module. The key management module includes a plurality of control registers for implementing the following operations: a key enumeration controller for implementing key enumeration operations, that is, the corresponding information of the memory encryption key in the key storage module can be viewed through the key control register of the key management module, such as how many memory encryption keys there are, the usage status of the memory encryption key, the index value of the memory encryption key, etc.; a key generation register for implementing key generation operations, that is, a new memory encryption key can be generated through the key generation register of the key management module, and the new memory encryption key and its corresponding key index value can be stored in the memory storage module; a key clearing controller for implementing key clearing operations, that is, one or more of the memory encryption keys stored in the key storage module can be cleared through the key clearing register of the key management module. It should be noted that the usage status of the memory encryption key that can be cleared is an unused state; a key selection register for implementing key selection operations, that is, the memory encryption key corresponding to the key index value can be selected from the key storage module through the key selection register of the key management module.

[0099] It can be understood that the memory encryption key in the memory encryption module is only accessible to the key management module, including generating memory encryption keys, storing generated memory encryption keys, revoking (i.e., recycling) memory encryption keys, and using the memory encryption keys, all of which need to be completed through the key management module.

[0100] In some embodiments, the key management module can be implemented in a RISC processor through hardware programming; an implementation structure of a processor system provided with a key management module and a key storage module is shown in Figure 3, in which the memory tracking module is implemented by extending MTT, and the key storage module is set in a secure memory outside the RISC processor.

[0101] In an optional implementation of this embodiment, the method further includes: When the memory allocation subject allocates secure memory to the memory access subject that initiates the secure memory access request, the memory allocation subject obtains the key index value corresponding to the memory encryption key; The memory allocation entity stores the key mapping relationship between the memory access address space corresponding to the secure memory and the encryption key information including the key index value in the memory tracking module; Step S601, i.e., the memory tracking module set in the RISC processor, after receiving the target memory access address corresponding to the secure memory access request, maps the target memory access address to the encryption key information, comprises: After receiving the target memory access address, the memory tracking module maps the target memory access address to the encryption key information based on the key mapping relationship.

[0102] In this optional implementation, the domain managers of each domain of the software system, the virtual machine managers in each domain, and the secure virtual machines managed by the virtual machine managers all need to be allocated secure memory when they are created and started. For the sake of ease of description, these subjects that need to be allocated secure memory can be referred to as memory access subjects, and the subject used to allocate secure memory to the memory access subject is called the memory allocation subject. For example, the root security domain manager RDSM of the root security domain with the highest system authority, when the processor system is powered on or restarted, the system loader will allocate secure memory to the RDSM. At this time, the memory allocation subject that allocates secure memory is the system loader. After RDSM is started, RDSM can be used as the memory allocation subject of other domain managers, virtual machine managers, and secure virtual machines, etc., and can allocate secure memory to them. It can be understood that the same subject can be used as a memory allocation subject or a memory access subject at different stages; for example, when RDSM is loaded by the system loader, it is used as a memory access subject, and after RDSM is started, it is used as a memory allocation subject when allocating memory to other domain managers, etc.

[0103] In some embodiments, the process of allocating secure memory can be understood as, after determining a usable memory segment from the memory, associating the memory access address space corresponding to the memory segment and the identifier of the corresponding memory access subject and storing them in the MTT, so that after the MTT receives the target memory access address from the MMU, it checks whether the target memory access address is in the memory access address space corresponding to the memory access subject that initiated the current secure memory access request. If so, it means that the memory access subject has the authority to access the memory corresponding to the target memory access address. If not, it means that the memory access subject does not have the authority to access the memory corresponding to the target memory access address.

[0104] In the disclosed embodiment, the memory tracking module can store the key mapping relationship between the memory access address space of the memory access subject and the encryption key information, and all memory addresses in the memory access address space can be mapped to the encryption key information by the memory tracking module. The memory tracking module can store the key mapping relationship between the memory access address space and the encryption key information corresponding to multiple memory access subjects, and the encryption key information corresponding to different memory access address spaces corresponds to different memory encryption keys.

[0105] In some embodiments, the page table entry of the MTT can be expanded on the basis of the original MTT, so that the encryption key information is stored in the expanded page table entry. In some embodiments, the encryption key information includes a memory encryption key, a key index value of the memory encryption key, a key application algorithm and an encryption mode, etc. When the memory encryption module uses the memory encryption key to encrypt the secure memory corresponding to the target memory access address, it can encrypt based on the key application algorithm and encryption mode in the encryption key information.

[0106] The existing MTT of the RICS-V processor supports three-level page tables, and the format of each level of the page table is shown in Figure 4, where each level of the page table is 64 bits. In the disclosed embodiment, the above three page table entries can be expanded to 128 bits, and the extended high 64 bits can be used to store encryption key information, such as key index value keyIdx, encryption mode mode, etc. For example, as shown in Figure 5, the 32-bit key index value keyIdx and the 8-bit encryption mode mode are expanded.

[0107] In an optional implementation of this embodiment, a control register for enabling the memory tracking module is provided in the memory tracking module.

[0108] In this optional implementation, if the memory tracking module is implemented by extending MTT, a control register can be set to enable the memory tracking module. That is, the user can configure the control register to enable the memory tracking module, thereby realizing the encryption of secure memory. The user can also choose not to enable the memory tracking module, that is, by configuring the control register, the memory function module extended by MTT is not used, so that the memory encryption module will not encrypt the target memory access address when the encryption key information cannot be obtained.

[0109] In an optional implementation of this embodiment, the memory encryption module obtains the encryption key information from the memory tracking module, including: The memory encryption module reads the encryption key information from the system bus; Step S603, i.e. the step of the memory encryption module acquiring the memory encryption key through the acquisition method in the encryption key information, includes: The memory encryption module obtains the memory encryption key corresponding to the key index value in the encryption key information from the key storage module through the key management module set in the RISC processor; the key storage module is used to store the memory encryption key and the key index value corresponding to the memory encryption key.

[0110] In this optional implementation, after the memory tracking module maps the target memory access address to the encryption key information, the encryption key information, the secure memory access request and the target memory access address are transmitted to the system bus together. After the information is transmitted to the downstream through the system bus, it is first obtained by the memory encryption module arranged at the front end of the DDR controller. After the memory encryption module parses the encryption key information, it uses the encryption key information to obtain the corresponding memory encryption key from the key storage module through the key management module, and then encrypts the memory corresponding to the target memory access address.

[0111] In an optional implementation of this embodiment, the method further includes: In response to a power-on start signal or a restart signal of the processor system, starting the system loader; The system loader generates a memory encryption key and a corresponding key index value; The system loader stores the memory encryption key and the key index value in a key storage module.

[0112] In this optional implementation, after the processor system is powered on or restarted, the system loader running at the highest system authority can generate multiple memory encryption keys and key index values ​​corresponding to each memory encryption key. The system loader can generate memory encryption keys by calling a key generation chip or a key application algorithm, such as calling a random key generation algorithm to generate memory encryption keys. The number of memory encryption keys can be set in advance in the system loader according to actual needs, and the present disclosure does not impose specific restrictions on this.

[0113] Since the system loader has the highest system authority, it can directly store the generated memory encryption key and its corresponding key index value in the key storage module. The system loader can also transmit the generated memory encryption key and its corresponding key index value to the key management module, and the key management module writes the memory encryption key and its corresponding key index value into the key storage module.

[0114] It is understandable that after the virtual machine manager is started, the user can regenerate, update or clear the memory encryption key through the key generation service interface provided to the user. In some embodiments, the key service interface regenerates the memory encryption key based on the user's request by calling the key management module and stores it in the key storage module, or updates the memory encryption key stored in the key storage module, or clears the memory encryption key stored in the key storage module. It should be noted that the cleared memory encryption key is an unused memory encryption key, and the usage status of the memory encryption key is stored in the memory management module. When the memory encryption key is cleared, its corresponding key index value is also cleared.

[0115] In an optional implementation of this embodiment, the method further includes: The system loader selects an unused first key from the key storage module as a memory encryption key of the secure memory allocated for the root security domain manager, and then loads the root security domain manager; After the root security domain manager is loaded successfully, the secure memory access request is initiated; Step S601, i.e., the memory tracking module set in the RISC processor, after receiving the target memory access address corresponding to the secure memory access request, maps the target memory access address to the encryption key information, comprises: The memory tracking module maps the target memory access address corresponding to the secure memory access request initiated by the root security domain manager to encryption key information including the method for obtaining the first key.

[0116] In this optional implementation, as described above, the software system of the processor system includes a root security domain, and a root security domain manager RDSM for managing the root security domain can be loaded by a system loader. The root security domain manager can also have the highest system authority.

[0117] It can be understood that the first key can be any key in the key storage module, because after the processor system is powered on or restarted, all memory encryption keys in the key storage module are newly generated and have not been used. The key management module can enumerate all memory encryption keys in the key storage module for selection by the system loader, and the selected memory encryption key is the first key. The first key is used as the memory encryption key for the secure memory of the root security domain manager, and is associated with the encryption key information including the key index value corresponding to the first key, and the memory access address space of the secure memory allocated by the system loader to the root security domain manager and stored in the memory tracking module, and the system loader loads the root security domain manager into the secure memory. If the root security domain manager is loaded successfully, and during operation, it can initiate the secure memory access request mentioned above when necessary, so that according to the process described above, the memory encryption module can finally use the first key to encrypt the secure memory corresponding to the target memory access address corresponding to the secure memory access request initiated by the root security domain manager.

[0118] In an optional implementation of this embodiment, the method further includes: After the root security domain manager is started, the root security domain manager selects an unused second key from the key storage module as a memory encryption key of the secure memory allocated to other domain managers, and then loads the other domain managers; After the other domain managers are successfully loaded, the secure memory access request is initiated; Step S601, i.e., the memory tracking module set in the RISC processor, after receiving the target memory access address corresponding to the secure memory access request, maps the target memory access address to the encryption key information, comprises: The memory tracking module maps the target memory access address corresponding to the secure memory access request initiated by the other domain managers to encryption key information including a method for obtaining the second key; wherein the second keys corresponding to different other domain managers are different.

[0119] In this optional implementation, as described above, the software system of the processor system includes other domains in addition to the root security domain, and the other domain managers for managing other domains can be allocated secure memory by the root security domain manager. And when allocating secure memory, a second key for encrypting its secure memory can be specified for other domain managers, that is, the root security domain manager selects an unused second key from the key storage module as the current memory encryption key of other domain managers through the key management module, and associates and stores the memory access address space of the secure memory allocated to the other domain manager and the encryption key information including the second key in the memory tracking module. After the root security domain manager loads the image software of the other domain manager into the secure memory, the other domain manager will be started. During the operation of the other domain manager, the secure memory access request mentioned above can be initiated when necessary, so that according to the process described above, the memory encryption module can finally use the second key to encrypt the secure memory corresponding to the target memory access address of the secure memory access request initiated by the other domain manager.

[0120] It should be noted that there may be multiple other domain managers, such as a virtual machine manager, a confidentiality security domain manager, etc. For different other domain managers, secure memory and memory encryption keys corresponding to the secure memory may be allocated in the above manner respectively.

[0121] In an optional implementation of this embodiment, the other domain manager includes a virtual machine manager, and the method further includes: In response to a request to create a secure virtual machine, the root security domain manager allocates secure memory to the secure virtual machine; The root security domain manager selects an unused third key from the key storage module as a memory encryption key for the secure memory allocated to the secure virtual machine; Step S601, i.e., the memory tracking module set in the RISC processor, after receiving the target memory access address corresponding to the secure memory access request, maps the target memory access address to the encryption key information, comprises: The memory tracking module maps a target memory access address corresponding to the secure memory access request initiated by the secure virtual machine to encryption key information including a method for obtaining the third key.

[0122] In this optional implementation, the other domain manager is a virtual machine manager. A user with corresponding permissions, such as a user with administrator permissions, can initiate a request to create a secure virtual machine. After receiving the request to create a secure virtual machine, the virtual machine manager creates a secure virtual machine, and the virtual machine manager allocates initial memory to the secure virtual machine. The root security domain manager then converts the initial memory into secure memory, that is, the root security domain manager stores the secure memory address space corresponding to the initially allocated memory in the MTT so that the security of the memory can be protected by the MTT management mechanism. The root security domain manager can also obtain the memory encryption key that is in the unused state through the key management module, and select one of them as the memory encryption key of the secure memory of the secure virtual machine, that is, the selected memory encryption key is the third key. After the secure virtual machine is started, if the secure virtual machine initiates the secure memory access request mentioned above, the process described above can be followed, and the memory encryption module can finally use the third key to encrypt the secure memory corresponding to the target memory access address corresponding to the secure memory access request initiated by the secure virtual machine.

[0123] In an optional implementation of this embodiment, the method further includes: In response to a request to replace a memory encryption key of a secure memory of a created secure virtual machine, adding a fourth key in a key storage module; Revoking the created secure virtual machine; Creating a new secure virtual machine, and when creating the new secure virtual machine, specifying the fourth key as a memory encryption key for the secure memory allocated to the new secure virtual machine; Step S601, i.e., the memory tracking module set in the RISC processor, after receiving the target memory access address corresponding to the secure memory access request, maps the target memory access address to the encryption key information, comprises: The memory tracking module maps a target memory access address corresponding to the secure memory access request initiated by the new secure virtual machine to encryption key information including a method for obtaining the fourth key.

[0124] In this optional implementation, a user with corresponding permissions, such as a user with administrator permissions, can initiate a request to revoke a secure virtual machine. Revoking a secure virtual machine includes: the virtual machine manager reclaims the secure memory allocated for the secure virtual machine, etc., so that the virtual machine manager recreates a new secure virtual machine. In addition, the key status used by the revoked secure virtual machine can be modified to unused through a pre-created and run key generation service interface, and a request is made to regenerate a new fourth key. The key generation service interface can modify the key status used by the revoked secure virtual machine to unused by calling a key management module, and can also call a key management module to regenerate a new fourth key. The generated fourth key and its corresponding key index value can be stored by the key management module to the key storage module. It should be noted that when the virtual machine manager creates a secure virtual machine, the initially allocated memory needs to be converted into secure memory by the root security domain manager, that is, the root security domain manager stores the secure memory address space corresponding to the initially allocated memory in the MTT so that the security of the memory is protected by the MTT management mechanism. In addition, the root security domain manager also stores the encrypted key information including the fourth key in association with the secure memory address space in the memory tracking module. After the new secure virtual machine is started, if a secure memory access request is initiated, the process described above can be followed, and the memory encryption module can ultimately use the fourth key to encrypt the secure memory corresponding to the target memory access address corresponding to the secure memory access request initiated by the new secure virtual machine.

[0125] The present disclosure also discloses a system on chip, including: a processor system according to any one of the above embodiments.

[0126] The present disclosure also discloses an electronic device. FIG. 7 shows a structural block diagram of an electronic device provided by an embodiment of the present disclosure. As shown in FIG. 7 , the electronic device 700 includes a memory 701 and a processor 702; wherein, The memory 701 is used to store one or more computer instructions, wherein the one or more computer instructions are executed by the processor 702 to implement the above method steps.

[0127] The flow charts and block diagrams in the accompanying drawings illustrate the possible architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, a program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flow chart, and the combination of the boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0128] The units or modules involved in the embodiments described in the present disclosure may be implemented by software or hardware. The units or modules described may also be arranged in a processor, and the names of these units or modules do not constitute limitations on the units or modules themselves in some cases.

[0129] As another aspect, the present disclosure further provides a computer-readable storage medium, which may be a computer-readable storage medium included in the device described in the above embodiment; or a computer-readable storage medium that exists independently and is not assembled into the device. The computer-readable storage medium stores one or more programs, and the programs are used by one or more processors to execute the method described in the present disclosure.

[0130] The above description is only a preferred embodiment of the present disclosure and an explanation of the technical principles used. Those skilled in the art should understand that the scope of the invention involved in the present disclosure is not limited to the technical solution formed by a specific combination of the above technical features, but should also cover other technical solutions formed by any combination of the above technical features or their equivalent features without departing from the inventive concept. For example, the above features are replaced with the technical features with similar functions disclosed in the present disclosure (but not limited to) by each other.

Claims

1. A processor system, comprising: RISC processor and memory encryption module; wherein, The RISC processor is provided with a memory tracking module, and the memory tracking module is used to map a target memory access address corresponding to a secure memory access request to encryption key information, and the encryption key information at least includes a method for obtaining a memory encryption key corresponding to the target memory access address; The memory encryption module obtains the encryption key information from the memory tracking module, obtains the memory encryption key through the acquisition method in the encryption key information, and uses the memory encryption key to encrypt the secure memory corresponding to the target memory access address.

2. The processor system according to claim 1, wherein: The processor system further includes a key storage module, wherein the key storage module is used to store a memory encryption key and a key index value corresponding to the memory encryption key; The RISC processor is also provided with a key management module, and the key management module is used to manage the memory encryption key in the key storage module.

3. The processor system according to claim 2, wherein: The software system of the processor system includes a memory allocation subject and a memory access subject; when the memory allocation subject allocates secure memory to the memory access subject that initiates the secure memory access request, the memory allocation subject obtains the key index value corresponding to the memory encryption key from the key storage module through the key management module, and stores the key mapping relationship between the memory access address space corresponding to the secure memory and the encryption key information including the key index value in the memory tracking module; After receiving the target memory access address corresponding to the secure memory access request, the memory tracking module maps the target memory access address to the encryption key information based on the key mapping relationship.

4. The processor system according to claim 2, wherein: The memory tracking module transmits the encryption key information to the system bus; The memory encryption module reads the encryption key information from the system bus, and obtains the memory encryption key corresponding to the key index value in the encryption key information from the key storage module through the key management module.

5. The processor system according to any one of claims 1 to 3, wherein: After the processor system is powered on or restarted, the system loader generates a memory encryption key and a corresponding key index value, and stores the memory encryption key and the key index value in a key storage module.

6. The processor system according to claim 3, wherein: The software system of the processor system includes a root security domain manager, other domain managers and secure virtual machines managed by the other domain managers; when the memory access subject is the root security domain manager, the memory allocation subject is the system loader; When the memory access subject is the other domain manager or the secure virtual machine, the memory allocation subject is the root security domain manager.

7. The processor system of claim 6, wherein: The system loader selects an unused first key from the key storage module as a memory encryption key for the secure memory allocated to the root security domain manager, so that after the root security domain manager is started, the memory encryption module uses the first key to encrypt the secure memory of the root security domain manager.

8. The processor system of claim 6, wherein: After the root security domain manager is started, an unused second key is selected from the key storage module as the memory encryption key for the secure memory allocated to the other domain managers, so that after the other domain managers are started, the memory encryption module uses the second key to encrypt the secure memory of the other domain managers; wherein the second keys corresponding to different other domain managers are different.

9. The processor system of claim 6, wherein: The other domain managers include a virtual machine manager. For a request to create a secure virtual machine, the root security domain manager allocates secure memory to the secure virtual machine, and the root security domain manager selects an unused third key from the key storage module as a memory encryption key for the secure memory allocated to the secure virtual machine, so that after the secure virtual machine is started, the memory encryption module uses the third key to encrypt the secure memory of the secure virtual machine.

10. The processor system according to any one of claims 2 to 4 and 6 to 9, wherein: In response to a request to replace the memory encryption key of the secure memory of a created secure virtual machine, a fourth key is added to the key storage module, the created secure virtual machine is revoked, a new secure virtual machine is created, and when the new secure virtual machine is created, the fourth key is designated as the memory encryption key of the secure memory allocated to the new secure virtual machine, so that after the new secure virtual machine is started, the memory encryption module uses the fourth key to encrypt the secure memory of the new secure virtual machine.

11. A secure memory encryption method, wherein: include: A memory tracking module provided in the RISC processor maps the target memory access address to encryption key information after receiving the target memory access address corresponding to the secure memory access request, wherein the encryption key information at least includes a method for obtaining the memory encryption key corresponding to the target memory access address; The memory encryption module obtains the encryption key information from the memory tracking module; The memory encryption module obtains the memory encryption key through the acquisition method in the encryption key information; The memory encryption module uses the memory encryption key to encrypt the secure memory corresponding to the target memory access address.

12. The method according to claim 11, wherein: The method further comprises: When the memory allocation subject allocates secure memory to the memory access subject that initiates the secure memory access request, the memory allocation subject obtains the key index value corresponding to the memory encryption key; The memory allocation entity stores the key mapping relationship between the memory access address space corresponding to the secure memory and the encryption key information including the key index value in the memory tracking module; The memory tracking module provided in the RISC processor maps the target memory access address to the encryption key information after receiving the target memory access address corresponding to the secure memory access request, including: After receiving the target memory access address, the memory tracking module maps the target memory access address to the encryption key information based on the key mapping relationship.

13. The method according to claim 11, wherein: The memory encryption module obtains the encryption key information from the memory tracking module, including: The memory encryption module reads the encryption key information from the system bus; The memory encryption module obtains the memory encryption key by using the acquisition method in the encryption key information, including: The memory encryption module obtains the memory encryption key corresponding to the key index value in the encryption key information from the key storage module through the key management module set in the RISC processor; the key storage module is used to store the memory encryption key and the key index value corresponding to the memory encryption key.

14. The method according to any one of claims 11 to 13, wherein: The method further comprises: In response to a power-on start signal or a restart signal of the processor system, starting the system loader; The system loader generates a memory encryption key and a corresponding key index value; The system loader stores the memory encryption key and the key index value in a key storage module.

15. The method according to any one of claims 11 to 13, wherein: The method further comprises: The system loader selects an unused first key from the key storage module as a memory encryption key of the secure memory allocated for the root security domain manager, and then loads the root security domain manager; After the root security domain manager is loaded successfully, the secure memory access request is initiated; The memory tracking module provided in the RISC processor maps the target memory access address to the encryption key information after receiving the target memory access address corresponding to the secure memory access request, including: The memory tracking module maps the target memory access address corresponding to the secure memory access request initiated by the root security domain manager to encryption key information including the method for obtaining the first key.

16. The method according to claim 15, wherein: The method further comprises: After the root security domain manager is started, the root security domain manager selects an unused second key from the key storage module as a memory encryption key of the secure memory allocated to other domain managers, and then loads the other domain managers; After the other domain managers are successfully loaded, the secure memory access request is initiated; The memory tracking module provided in the RISC processor maps the target memory access address to the encryption key information after receiving the target memory access address corresponding to the secure memory access request, including: The memory tracking module maps the target memory access address corresponding to the secure memory access request initiated by the other domain managers to encryption key information including a method for obtaining the second key; wherein the second keys corresponding to different other domain managers are different.

17. The method according to claim 15, wherein: The method further comprises: In response to a request to create a secure virtual machine, the root security domain manager allocates secure memory to the secure virtual machine; The root security domain manager selects an unused third key from the key storage module as a memory encryption key for the secure memory allocated to the secure virtual machine; The memory tracking module provided in the RISC processor maps the target memory access address to the encryption key information after receiving the target memory access address corresponding to the secure memory access request, including: The memory tracking module maps a target memory access address corresponding to the secure memory access request initiated by the secure virtual machine to encryption key information including a method for obtaining the third key.

18. The method according to any one of claims 11-13, 15-17, wherein: The method further comprises: In response to a request to replace a memory encryption key of a secure memory of a created secure virtual machine, adding a fourth key in a key storage module; Revoking the created secure virtual machine; Creating a new secure virtual machine, and when creating the new secure virtual machine, specifying the fourth key as a memory encryption key for the secure memory allocated to the new secure virtual machine; The memory tracking module provided in the RISC processor maps the target memory access address to the encryption key information after receiving the target memory access address corresponding to the secure memory access request, including: The memory tracking module maps a target memory access address corresponding to the secure memory access request initiated by the new secure virtual machine to encryption key information including a method for obtaining the fourth key.

19. A system on a chip, wherein: include: A processor system as claimed in any one of claims 1 to 10.

Images