A heterogeneous processing system based on RISC-V and independent encryption algorithm module

Abstract

The application provides a heterogeneous processing system based on RISC-V and an independent encryption algorithm module, the system comprising symmetrically arranged RISC-V processors, core controllers, password operation modules and shadow processors, shadow controllers and shadow operation modules; the shadow processor is a backup of the RISC-V processor, synchronously operates with the RISC-V main processor, can detect the current processor state in real time, and the core controller and the shadow controller interact through an encrypted memory; in the application, the core controller receives a custom expansion instruction sent by the RISC-V processor, decodes and executes the custom expansion instruction, configures and calls the password operation unit, thereby uses multiple password algorithms, and completes data encryption or decryption; and the application fully utilizes the performance and power consumption advantages of the independent algorithm module and the flexibility and expansibility of the RISC-V processor.

Description

TECHNICAL FIELD

[0001] The application relates to the field of communication technology, in particular to a heterogeneous processing system based on RISC-V and an independent encryption algorithm module. BACKGROUND

[0002] In recent years, with the continuous rapid growth of Internet of Things devices, a large number of devices interact and control data through the Internet, and the data security brought by this is increasingly serious. As the magnitude and importance of data are growing, once data leakage or tampering occurs, the consequences are increasingly unacceptable.

[0003] There are two solutions for current encryption operations. One is to directly perform encryption and decryption operations using a CPU, which occupies a large amount of CPU resources and is not efficient. The second is to use an independent cryptographic algorithm module, but the separate module requires a large amount of configuration operation, and the switching of various algorithms is not flexible, which causes a huge performance loss.

[0004] RISC-V is a new open-source instruction set that has been widely welcomed in recent years. By eliminating unnecessary instructions, RISC-V processors with a small number of transistors usually consume very low power, so RISC-V processors are more suitable for small edge computing devices. Moreover, RISC-V provides flexible and variable custom extension instructions, which can be freely customized on the basis of the basic instruction set, with high flexibility and expansibility.

[0005] Dual-core lockstep is an important technology to ensure the reliability of processors and is widely used in the field of SOC chips. This technology synchronizes the execution of two processors by adding a shadow processor, and compares the running state in real time during the running process to monitor the stable running of the main processor. This technology greatly improves the detection capability of system errors and improves the stability of system running due to the addition of a shadow processor. SUMMARY

[0006] Therefore, the application aims to provide a heterogeneous processing system based on RISC-V and an independent encryption algorithm module to solve the connection problem between the independent algorithm module and the general CPU, while meeting the requirements of flexibility, performance and power consumption. It can quickly complete configuration and quickly switch different algorithms, and can be used in the fields of network security encryption, confidential file intercommunication and local information preservation.

[0007] To achieve the above purpose, the technical scheme of the application is as follows:

[0008] A heterogeneous processing system based on RISC-V and independent encryption algorithm module, comprising a core controller, a RISC-V processor and a cryptographic operation module connected with the core controller, a shadow controller, a shadow processor and a shadow operation module connected with the shadow controller; and the core controller is connected with the shadow controller, and the RISC-V processor is connected with the shadow processor through an encrypted memory; wherein:

[0009] The RISC-V processor is used for issuing a custom cryptographic operation instruction;

[0010] The shadow processor is a backup of the RISC-V processor, synchronously runs with the RISC-V processor, and can detect the current state of the RISC-V processor in real time;

[0011] The core controller is used for receiving the custom cryptographic operation instruction, and sending the decoded custom cryptographic operation instruction and data to be encrypted and decrypted to the cryptographic operation module;

[0012] The shadow controller is used for receiving the custom cryptographic operation shadow instruction sent by the shadow processor, and sending the decoded custom cryptographic operation shadow instruction and data to be encrypted and decrypted to the shadow operation module;

[0013] The cryptographic operation module is used for controlling a cryptographic calculation unit to complete encryption and decryption operation on the received data to be encrypted and decrypted, and sending the encrypted and decrypted data to the core controller;

[0014] The shadow operation module is used for controlling a cryptographic calculation unit to complete encryption and decryption operation on the received data to be encrypted and decrypted, and sending the encrypted and decrypted data to the shadow controller;

[0015] The encrypted memory is used for data interaction with the core controller and the shadow controller, and buffers data to be encrypted and decrypted and encrypted and decrypted data.

[0016] Further, the RISC-V processor is connected with the shadow processor in sequence through a shift encrypter, an encrypted memory and a shadow shift encrypter; the shift encrypter and the shadow shift encrypter are used for performing shift encryption and decryption operation on the received data according to the source direction.

[0017] Further, the RISC-V processor and the shadow processor both contain a processor core and a general register stack connected with the processor core;

[0018] The shadow processor further comprises a state comparison module, which is configured to compare the register information sent by the RISC-V processor and the shadow processor, if the comparison is consistent, the RISC-V processor and the shadow processor continue to execute; if the comparison is inconsistent, interrupt control information is sent to the RISC-V processor and the shadow processor, so that the RISC-V processor and the shadow processor are interrupted to execute.

[0019] Further, the core controller and the shadow core controller each comprise an instruction decoding unit, an instruction execution unit, a memory control unit and a data processing unit; wherein:

[0020] The instruction decoding unit is configured to receive the custom cryptographic operation instruction from the RISC-V processor / shadow processor and the control information from the cryptographic operation module, and after internal decoding: if the content is a custom reset instruction, the control information is sent to the cryptographic operation module; if the content is an operation return result, the return result is sent back to the RISC-V processor / shadow processor; if the content is a calculation or initialization instruction, the decoding result is sent to the instruction execution unit;

[0021] The instruction execution unit is configured to receive the decoding result sent from the instruction decoding unit, send the required data address to the memory control unit, and send the corresponding operation code to the data processing unit;

[0022] The memory control unit is configured to receive the data address sent by the instruction execution unit, send the address to the encrypted memory, receive the corresponding data sent by the encrypted memory, and send the data to the data processing unit;

[0023] The data processing unit is configured to receive the data sent by the memory control unit and the operation code sent by the instruction execution unit, and send the combination of the operation code and the data to the cryptographic operation module / shadow operation module.

[0024] Further, the instruction decoding unit comprises an instruction decoder, an instruction receiving unit and an instruction returning unit connected thereto; the instruction decoder is configured to receive the custom cryptographic operation instruction from the instruction receiving unit, the return instruction from the cryptographic operation module / shadow operation module, and decode by searching the custom instruction table: if the result needs to be sent to the RISC-V processor / shadow processor, the decoding result is sent to the instruction returning unit; if the result is a control command that needs to be sent to the cryptographic operation module, the control command is sent to the cryptographic operation module / shadow operation module; if the result needs further operation, the decoding result is sent to the instruction execution unit.

[0025] Further, the data processing unit comprises a data receiving unit and a data distribution unit; wherein:

[0026] The data receiving unit is configured to receive data to be processed from the memory control unit and send the data to the data distribution unit;

[0027] The data distribution unit is configured to receive data to be processed from the data receiving unit and an instruction operation code from the instruction execution unit, and select different access addresses according to the instruction operation code, and send the addresses and the data to the encryption operation module / shadow operation module.

[0028] Further, the shift encryptor and the shadow shift encryptor each include a first shifter and a first counter, wherein the first counter is configured to count the number of read and write operations of the encrypted memory, and the first shifter is configured to encrypt the read and write data by shifting, and the number of bits of the shift is determined by the first counter;

[0029] During encryption, the shift encryptor encrypts in a right shift manner, and the number of bits of the shift is equal to the value of the first counter; the shadow shift encryptor encrypts in a left shift manner, and the number of bits of the shift is equal to twice the value of the first counter;

[0030] During decryption, the shift encryptor decrypts in a left shift manner, and the number of bits of the shift is equal to the value of the first counter; the shadow shift encryptor decrypts in a right shift manner, and the number of bits of the shift is equal to twice the value of the first counter.

[0031] Further, the encrypted memory includes a memory, a comparison distribution module, a second shifter and a shadow shifter, a second counter and a shadow counter;

[0032] The memory is configured to store all data to be encrypted and decrypted data;

[0033] The comparison distribution module is configured to send the data read from the memory to the second shifter and the shadow shifter respectively, and compare the data transmitted by the second shifter and the shadow shifter, and if the comparison is correct, write the data into the memory, and if the comparison is incorrect, send an interrupt request to the RISC-V processor / shadow processor;

[0034] The second shifter and the shadow shifter are each divided into two directions of transmission and reception:

[0035] When receiving data, the encrypted data from the upper shift encryptor / shadow shift encryptor is received, the count value from the second counter / shadow counter is read, and the data is decrypted by using the shift operation;

[0036] When the shifter decrypts, the shift manner is left shift, and the number of bits of the shift is the value of the second counter / shadow counter; when the shadow shifter decrypts, the shift manner is right shift, and the number of bits of the shift is twice the value of the second counter / shadow counter;

[0037] When sending data, the encrypted data to be encrypted from the contrast distribution module is received, the count value from the second counter / shadow counter is read, and data encryption is performed using a shift operation;

[0038] When the shifter decrypts, the shift mode is right shift, and the shift number is the second counter / shadow counter value; when the shadow shifter decrypts, the shift mode is left shift, and the shift number is twice the second counter / shadow counter value.

[0039] Compared with the prior art, the heterogeneous processing system based on RISC-V and independent encryption algorithm module has the following advantages:

[0040] The heterogeneous processing system based on RISC-V and independent encryption algorithm module comprises a RISC-V processor, a shadow processor, a core controller, a memory, and a cryptographic algorithm module. The core controller receives the custom extension instruction sent by the RISC-V processor, decodes and executes, configures and calls the cryptographic operation unit, uses multiple cryptographic algorithms, and completes data encryption or decryption. The application makes full use of the performance and power consumption advantages of the independent algorithm module and the flexibility and expansibility of the RISC-V processor. BRIEF DESCRIPTION OF DRAWINGS

[0041] The accompanying drawings, which form a part of this application, are included to provide a further understanding of the application and are incorporated herein for illustration only. The embodiments of the application and the drawings thereof are used to explain the application and do not constitute an improper limitation on the application. In the drawings:

[0042] Figure 1 The overall framework diagram of the heterogeneous processing system based on RISC-V and independent encryption algorithm module is shown;

[0043] Figure 2 The framework diagram of the RISC-V processor / shadow processor of the heterogeneous processing system based on RISC-V and independent encryption algorithm module is shown;

[0044] Figure 3 The framework diagram of the core controller / shadow controller of the heterogeneous processing system based on RISC-V and independent encryption algorithm module is shown;

[0045] Figure 4 The framework diagram of the instruction decoding unit of the heterogeneous processing system based on RISC-V and independent encryption algorithm module is shown;

[0046] Figure 5A framework diagram of a data processing unit of the heterogeneous processing system based on RISC-V and independent encryption algorithm module is shown according to an embodiment of the present application;

[0047] Figure 6 A framework diagram of a shift encryptor / shadow shift encryptor of the heterogeneous processing system based on RISC-V and independent encryption algorithm module is shown according to an embodiment of the present application.

[0048] Figure 7 A framework diagram of an encryption memory of the heterogeneous processing system based on RISC-V and independent encryption algorithm module is shown according to an embodiment of the present application. DETAILED DESCRIPTION

[0049] It should be noted that the embodiments in the present application and the features in the embodiments can be combined with each other without conflict.

[0050] The present application will be described in detail below with reference to the accompanying drawings and in conjunction with the embodiments.

[0051] Figure 1 A whole framework diagram of the heterogeneous processing system based on RISC-V and independent encryption algorithm module is shown, referring to Figure 1 The heterogeneous processing system based on RISC-V and independent encryption algorithm module provided by the present embodiment mainly includes a RISC-V processor, a shadow processor, a core controller, a shadow controller, an encryption memory and a cryptographic operation module. The parts are introduced as follows:

[0052] RISC-V processor: This part is a self-defined RISC-V processor core, responsible for issuing self-defined cryptographic operation instructions.

[0053] Shadow processor: This part is a backup of the main RISC-V processor, synchronously running with the RISC-V main processor, capable of detecting the current processor state in real time, improving the reliability of the system.

[0054] Core controller: This part is mainly responsible for receiving self-defined instructions from the processor and feedback instructions from the cryptographic operation module, and issuing data read / write requests to the shift encryptor. This part is the core module of the system.

[0055] Shadow core controller: This part is mainly responsible for receiving self-defined instructions from the shadow processor and feedback instructions from the shadow cryptographic operation module, and interacting with the memory. This module issues data read / write requests to the shadow shift encryptor. This part is the core module of the system.

[0056] Shift encryptor: receiving data from the core controller and the memory, performing shift encryption / decryption operation according to the source direction.

[0057] Shadow shift encryptor: receives data from the shadow controller and the memory, and performs shift encryption and decryption operations according to the source direction.

[0058] Encryption memory: This part is a storage space specially designed for cryptographic operations, responsible for caching data required for cryptographic operations, and will perform different shift operations according to the read and write direction.

[0059] Cryptographic operation module: This part mainly receives instructions and data from the core controller, and after distribution, controls the cryptographic calculation unit to complete the corresponding encryption or decryption operation.

[0060] Shadow operation module: This part mainly receives instructions and data from the shadow controller, and after distribution, controls the shadow calculation unit to complete the corresponding encryption or decryption operation.

[0061] Figure 2 The framework diagram of the RISC-V processor and the shadow processor is shown, as shown in Figure 2 The architecture of the RISC-V processor and the shadow processor is the same, mainly including the processor core of the RISC-V processor, the general register stack; the processor core of the shadow processor, the general register stack and the state comparison module.

[0062] Among them, the RISC-V processor and the shadow processor both include the processor core, the processor core of the RISC-V processor is responsible for executing the main program and interacting with the external cryptographic module; the processor core of the shadow processor executes the same program as the RISC-V processor, as a backup of the main processor, to ensure the execution reliability of the main processor.

[0063] The RISC-V processor and the shadow processor both include the general register stack, and the two general register stacks save the general register information of the current processor, mainly used to control the normal execution of the two processors, and as the input information of the state comparison module.

[0064] The shadow processor also includes a state comparison module, which is mainly responsible for receiving register information from the RISC-V processor and the shadow processor, comparing the corresponding register data of the two processors, and if the comparison is correct, it means that both processors are executing correctly; if the comparison is wrong, it will propose interrupt control information to both processors, so that both processors trigger an interrupt, ensuring the reliability of the processor running.

[0065] Figure 3 The framework diagram of the core controller and the shadow controller is shown, as shown in Figure 3 The architecture of the core controller and the shadow controller is the same, mainly including the instruction decoding unit, the instruction execution unit, the memory control unit and the data processing unit.

[0066] Take the core controller as an example, wherein the instruction decoding unit is responsible for receiving the custom cryptographic operation instruction from the RISC-V processor and the control information from the cryptographic operation module. After internal decoding, if the content is a custom reset instruction, the control information is sent to the cryptographic operation module; if the content is an operation return result, the return result is sent back to the RISC-V processor; if the content is a calculation or initialization instruction, the decoding result is sent to the instruction execution unit.

[0067] The instruction execution unit is responsible for receiving the decoding result sent from the instruction decoding unit, sending the required data address to the memory control unit, and sending the corresponding operation code to the data processing unit

[0068] The memory control unit is responsible for receiving the data address sent by the instruction execution unit, sending the address to the encrypted memory, receiving the corresponding data sent by the encrypted memory, and sending the data to the data processing unit.

[0069] The data processing unit is responsible for receiving the data sent by the memory control unit and the operation code sent by the instruction execution unit, combining the operation code and the data, and sending them to the cryptographic operation module.

[0070] Compared with the core controller, the interaction object of the shadow controller is replaced by the RISC-V processor by the shadow processor, and the interaction process is the same as that of the core controller.

[0071] Figure 4 The overall framework diagram of the instruction decoding unit in the core controller / shadow controller is shown, referring to Figure 4 As shown in the figure, the instruction decoding unit includes an instruction receiving unit, an instruction returning unit, and an instruction decoder.

[0072] Take the instruction decoding unit in the core controller as an example, the instruction receiving unit is responsible for receiving the custom instruction from the RISC-V processor and sending the received instruction to the instruction decoder.

[0073] The instruction returning unit is responsible for receiving the return data sent by the instruction decoder and sending the received instruction to the RISC-V processor.

[0074] The instruction decoder is responsible for receiving the custom instruction sent by the instruction receiving unit and the return instruction from the cryptographic operation module, and decoding by looking up the custom instruction table. If the result needs to be sent to the RISC-V processor, the decoding result is sent to the instruction returning unit; if the result is a control command that needs to be sent to the cryptographic operation module, the control command is sent to the cryptographic operation module; if the result needs further operation, the decoding result is sent to the instruction execution unit.

[0075] Compared with the instruction decoding unit in the core controller, the interactive object of the instruction decoding unit in the shadow controller is replaced by the shadow processor from the RISC-V processor and by the shadow operation module from the cryptographic operation module, and the interactive process is the same as that of the instruction decoding unit in the core controller.

[0076] Figure 5 The overall block diagram of the data processing unit in the core controller / shadow controller is shown in FIG. 4, and the data processing unit is divided into a data receiving unit and a data distribution unit. Figure 5 As shown in FIG. 4, the data processing unit includes a data receiving unit and a data distribution unit.

[0077] Taking the data processing unit in the core controller as an example, the data receiving unit is responsible for receiving the data to be processed from the memory control unit and sending the data to the data distribution unit.

[0078] The data distribution unit receives the data to be processed from the data receiving unit and the instruction operation code from the instruction execution unit, and selects different access addresses through the instruction operation code, and sends the addresses and data to the cryptographic operation module.

[0079] Compared with the data distribution unit in the core controller, the interactive object of the data distribution unit in the shadow controller is replaced by the shadow operation module from the cryptographic operation module, and the interactive process is the same as that of the data distribution unit in the core controller.

[0080] Figure 6 The structural block diagram of the shift encryptor and the shadow shift encryptor is shown in FIG. 5, and the shift encryptor and the shadow shift encryptor have the same architecture, including a shifter and a counter. Figure 6 As shown in FIG. 5, the shift encryptor and the shadow shift encryptor have the same architecture, including a shifter and a counter, wherein the counter is used to count the number of memory read / write operations, and the shifter is used to encrypt the read / write data, and the number of bits of the shift is determined by the counter.

[0081] During encryption, the shift encryptor uses the right shift encryption mode, and the number of shift bits is equal to the counter value; the shadow shift encryptor uses the left shift encryption mode, and the number of shift bits is equal to twice the counter value. During decryption, it is completely opposite to the encryption, wherein the shift encryptor uses the left shift decryption mode, and the number of shift bits is equal to the counter value; the shadow shift encryptor uses the right shift decryption mode, and the number of shift bits is equal to twice the counter value.

[0082] Figure 7 The structural block diagram of the encrypted memory is shown in FIG. 6, and the encrypted memory is the main storage unit of the system. Figure 6 As shown in FIG. 6, the encrypted memory is the main storage unit of the system, including a memory, a comparison distribution module, a shifter and a shadow shifter, a counter and a shadow counter.

[0083] The memory is the storage core of the system, including all the data to be encrypted and the decrypted data.

[0084] The comparison distribution module has two functions, one is a read distribution operation, and the read data from the memory is respectively sent to the shifter and the shadow shifter; the other is a write comparison distribution operation, and the data transmitted from the shifter and the shadow shifter are compared, if the comparison is correct, the data is written into the memory, and if the comparison is wrong, an interrupt request is sent to the processor.

[0085] The shifter and the shadow shifter are similar in function and are divided into two directions of receiving and sending.

[0086] Taking the shifter as an example, when receiving data, encrypted data from the upper shifter encrypter is received, and the count value from the counter is read, and the data is decrypted by using the shift operation. When the shifter decrypts, the shift mode is left shift, and the shift bit number is the counter value, and when the shadow shifter decrypts, the shift mode is right shift, and the shift bit number is twice the counter value.

[0087] When sending data, the encrypted data to be encrypted from the comparison distribution module is received, the count value from the counter is read, and the data is encrypted by using the shift operation. When the shifter decrypts, the shift mode is right shift, and the shift bit number is the counter value, and when the shadow shifter decrypts, the shift mode is left shift, and the shift bit number is twice the counter value.

[0088] Compared with the shifter, the interactive object of the shadow shifter is replaced by the counter with the shadow counter, and the interactive process is the same as that of the shifter.

[0089] The self-defined password operation instruction designed in the application, that is, the self-defined extension instruction is shown in Table 1, including a reset instruction for resetting the algorithm operation module, an initialization instruction for initializing the algorithm calculation unit, a calculation instruction for starting the algorithm calculation unit, and a result return instruction for returning the operation result to the CPU.

[0090] The reset instruction described above refers to resetting the specified password calculation unit, and is defined as S.REST instruction.

[0091] The initialization instruction described above includes configuring the password operation code entry address, which is defined as S.SETO instruction; configuring the password operation data address, which is defined as S.SETS instruction; and configuring the password operation result address, which is defined as S.SETR instruction.

[0092] The calculation instruction described above includes setting the encryption or decryption quantity, which is defined as S.ADD instruction; and starting the password calculation unit for calculation, which is defined as S.COTE instruction.

[0093] The result return instruction described above refers to returning the operation result, and is defined as S.RET instruction.

[0094] Table 1 is a self-defined instruction table

[0095]

[0096] Full password operation coprocessor workflow:

[0097] 1. The RISC-V processor and the shadow processor receive an encryption or decryption operation request.

[0098] 2. The RISC-V processor and the shadow processor issue a self-defined initialization instruction.

[0099] 3. The self-defined initialization instruction is sent to the password operation module (shadow operation module) through the core controller (shadow controller), and the operation execution result is returned to the core controller (shadow controller).

[0100] 4. If the initialization operation is not completed correctly, an error command needs to be returned to the RISC-V processor (shadow processor), and the processor reissues the initialization instruction.

[0101] 5. If the initialization is completed correctly, the RISC-V processor (shadow processor) issues a calculation instruction, the core controller issues a read data instruction to the shift adder (shadow shift adder), and then saves the instruction code of the current calculation instruction.

[0102] 6. After receiving the read data instruction from the core controller, the shift adder reads the current counter value, encrypts the address (right shifts the current counter value by bits), and sends it to the memory; after receiving the read data instruction from the shadow controller, the shadow shift adder reads the current counter value, encrypts the address (left shifts the current counter value by bits), and sends it to the memory, while the two counters are incremented by 1.

[0103] 7. The memory receives the encrypted addresses from the shift encrypter and the shadow shift encrypter, reads the values of the counters and the shadow counters, respectively, left shifts the encrypted address from the shift encrypter by a number of bits (the shift number of bits is equal to the value of the counter), right shifts the encrypted address from the shadow shift encrypter by a number of bits (the shift number of bits is equal to the value of the shadow counter), decrypts, sends the decrypted two-part address to the comparison and distribution module, and increments the two counters by 1.

[0104] 8. After receiving the two-part decrypted addresses, the comparison and distribution module compares them, and if the comparison is incorrect, it issues an error request to the RISC-V processor and the shadow processor, and resets the two processors; if the comparison is correct, it sends any one of the addresses to the memory.

[0105] 9. The memory receives the address and sends the read data to the comparison and distribution module.

[0106] 10. The contrast distribution module sends data to the shifter and the shadow shifter respectively, the shifter reads the value of the counter, left shifts the data by a number of bits (the shift value is equal to the counter value) for encryption, and sends the encrypted data to the shift encryptor; the shadow shifter reads the value of the shadow counter, right shifts the data by a number of bits (the shift value is equal to the shadow counter value) for encryption, and sends the encrypted data to the shadow shift encryptor. At the same time, the two counters are incremented by 1;

[0107] 11. The shift encryptor reads the value of the counter, right shifts the received encrypted data by a number of bits (the shift value is equal to the counter value) for decryption, and sends the decrypted data to the core controller; the shadow shift encryptor reads the value of the counter, left shifts the received encrypted data by a number of bits (the shift value is equal to the counter value) for decryption, and sends the decrypted data to the shadow core controller; at the same time, the counter is incremented by 1;

[0108] 12. After receiving the decrypted data, the core controller (shadow core controller) combines the data with the instruction code saved in the previous step (step 5), and sends the combined data to the cryptographic operation module (shadow operation module).

[0109] 13. After receiving the data and the instruction code, the cryptographic operation module (shadow operation module) decodes the instruction and sends the data to the cryptographic calculation unit as required, and returns the operation result of the instruction to the core controller (shadow controller).

[0110] 14. The core controller (shadow controller) sends the returned instruction result back to the RISC-V processor (shadow processor), and sends the encrypted data to the shift encryptor (shadow shift encryptor).

[0111] 15. After receiving the encrypted data, the shift encryptor reads the current counter value, right shifts the encrypted data by a number of bits (the shift value is equal to the counter value) for secondary encryption, then increments the counter value by 1, and sends the secondary encrypted data to the memory; after receiving the encrypted data, the shadow shift encryptor reads the current counter value, left shifts the encrypted data by a number of bits (the shift value is equal to the counter value) for secondary encryption, then increments the counter value by 1, and sends the secondary encrypted data to the memory.

[0112] 16. The memory receives the secondary encrypted data from the shift encryptor and the shadow shift encryptor, reads the values of the counter and the shadow counter respectively, left shifts the secondary encrypted data from the shift encryptor by a number of bits (the shift value is equal to the counter value), right shifts the secondary encrypted data from the shadow shift encryptor by a number of bits (the shift value is equal to the shadow counter value), decrypts the two parts of encrypted data, and sends the decrypted data to the contrast distribution module, while incrementing the two counters by 1.

[0113] 17. After the comparison distribution module receives two parts of the decrypted data, it performs comparison. If the comparison is wrong, it sends an error request to the RISC-V processor and the shadow processor, and resets the two processors. If the comparison is correct, it sends the encrypted data from the shadow shift encryptor to the memory.

[0114] 18. A complete encryption operation is successfully completed.

[0115] Those skilled in the art can appreciate that the units and method steps of the examples described in conjunction with the embodiments disclosed herein can be realized in electronic hardware, computer software or a combination of both. In order to clearly illustrate the interchangeability of hardware and software, the components and steps of the examples have been described in the above description in general terms. Whether the functions are realized in hardware or software depends on the specific application and design constraints of the technical solution. A person skilled in the art can use different methods to realize the described functions for each specific application, but such implementation should not be considered beyond the scope of the present application.

[0116] In several embodiments provided in the present application, it should be understood that the disclosed method and system can be realized in other ways. For example, the division of the above-mentioned units is only a logical function division, and actual implementation can have another division manner, for example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. The above-mentioned units can be or can not be physically separated, and the components displayed as units can be or can not be physical units, i.e. they can be located in one place or distributed on multiple network units. According to actual needs, part or all of the units can be selected to realize the purpose of the embodiment of the present application.

[0117] Finally, it should be noted that: the above embodiments are only used to illustrate the technical solutions of the present application, and not to limit them; although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that: it can still modify the technical solutions recorded in the foregoing embodiments, or make equivalent replacement for part or all of the technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the scope of the technical solutions of the embodiments of the present application, and they should be covered in the scope of the claims and description of the present application.

[0118] The above description is only the preferred embodiment of the present application, and does not limit the present application. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application should be included in the protection scope of the present application.

Claims

1. A heterogeneous processing system based on RISC-V and an independent encryption algorithm module, characterized in that, The system includes a core controller and a connected RISC-V processor and cryptographic operation module, as well as a shadow controller and a connected shadow processor and shadow operation module. The core controller is connected to the shadow controller, and the RISC-V processor and the shadow processor are connected via an encrypted memory. The RISC-V processor issues custom cryptographic operation instructions. The shadow processor is a backup of the RISC-V processor, runs synchronously with it, and can monitor the current state of the RISC-V processor in real time. The core controller receives the custom cryptographic operation instructions and sends the decoded instructions and the data to be encrypted / decrypted to the system. The cryptographic operation module; the shadow controller is used to receive custom cryptographic operation shadow instructions sent by the shadow processor, and send the decoded custom cryptographic operation shadow instructions and the data to be encrypted / decrypted to the shadow operation module; the cryptographic operation module is used to control the cryptographic calculation unit to complete the encryption / decryption operation on the received data to be encrypted / decrypted, and send the encrypted / decrypted data to the core controller; the shadow operation module is used to control the cryptographic calculation unit to complete the encryption / decryption operation on the received data to be encrypted / decrypted, and send the encrypted / decrypted data to the shadow controller; the encrypted memory is used to interact with the core controller and the shadow controller, and cache the data to be encrypted / decrypted and the encrypted / decrypted data.

2. The heterogeneous processing system based on RISC-V and an independent encryption algorithm module according to claim 1, characterized in that, The RISC-V processor is connected to the shadow processor in sequence via a shift encryptor, an encrypted memory, and a shadow shift encryptor; both the shift encryptor and the shadow shift encryptor are used to perform shift encryption and decryption operations on the received data according to the source direction.

3. The heterogeneous processing system based on RISC-V and an independent encryption algorithm module according to claim 1, characterized in that, Both the RISC-V processor and the shadow processor include a processor core and a general-purpose register file connected to the processor core. The shadow processor also includes a status comparison module, which compares the register information sent by the RISC-V processor and the shadow processor. If the comparison is consistent, both the RISC-V processor and the shadow processor continue to execute. If the comparison is inconsistent, interrupt control information is sent to both the RISC-V processor and the shadow processor, causing both the RISC-V processor and the shadow processor to interrupt execution.

4. The heterogeneous processing system based on RISC-V and an independent encryption algorithm module according to claim 1, characterized in that: Both the core controller and the shadow controller include an instruction decoding unit, an instruction execution unit, a memory control unit, and a data processing unit. Specifically: the instruction decoding unit receives custom cryptographic operation instructions from the RISC-V processor and the shadow processor, and control information from the cryptographic operation module. After internal decoding: if the content is a custom reset instruction, the control information is sent to the cryptographic operation module; if the content is a calculation return result, the return result is sent back to the RISC-V processor and the shadow processor; if the content is a calculation or initialization instruction, the decoding result is sent to the instruction execution unit. The instruction execution unit receives the decoding result from the instruction decoding unit, sends the required data address to the memory control unit, and sends the corresponding opcode to the data processing unit. The memory control unit receives the data address from the instruction execution unit, sends the address to the encrypted memory, receives the corresponding data from the encrypted memory, and sends the data to the data processing unit. The data processing unit receives the data from the memory control unit and the opcode from the instruction execution unit, combines the opcode and data, and sends them to the cryptographic operation module and the shadow operation module.

5. The heterogeneous processing system based on RISC-V and an independent encryption algorithm module according to claim 4, characterized in that: The instruction decoding unit includes an instruction decoder, and an instruction receiving unit and an instruction return unit connected thereto. The instruction decoder is used to receive custom cryptographic operation instructions from the instruction receiving unit and return instructions from the cryptographic operation module and the shadow operation module, and to decode them by looking up a custom instruction table. If the result needs to be sent to the RISC-V processor and the shadow processor, the decoding result is sent to the instruction return unit. If the result is a control command that needs to be sent to the cryptographic operation module, the control command is sent to the cryptographic operation module and the shadow operation module. If the result needs further operation, the decoding result is sent to the instruction execution unit.

6. The heterogeneous processing system based on RISC-V and independent encryption algorithm modules according to claim 4, characterized in that: The data processing unit includes a data receiving unit and a data distribution unit; wherein: the data receiving unit is used to receive data to be processed from the memory control unit and send the data to the data distribution unit; the data distribution unit is used to receive the data to be processed from the data receiving unit and the instruction opcode from the instruction execution unit, and the data distribution unit selects different access addresses through the instruction opcode and sends the addresses and data to the cryptographic operation module and the shadow operation module.

7. The heterogeneous processing system based on RISC-V and independent encryption algorithm modules according to claim 2, characterized in that: Both the shift encryptor and the shadow shift encryptor include a first shifter and a first counter. The first counter is used to count the number of read and write operations of the encrypted memory, and the first shifter is used to encrypt the read and write data. The number of bits shifted is determined by the first counter. During encryption, the shift encryptor uses a right shift, and the number of bits shifted is equal to the value of the first counter. The shadow shift encryptor uses a left shift, and the number of bits shifted is twice the value of the first counter. During decryption, the shift encryptor uses a left shift, and the number of bits shifted is equal to the value of the first counter. The shadow shift encryptor uses a right shift, and the number of bits shifted is twice the value of the first counter.

8. The heterogeneous processing system based on RISC-V and independent encryption algorithm modules according to claim 1, characterized in that: The encrypted memory includes a memory, a comparison and distribution module, a second shifter and a shadow shifter, a second counter and a shadow counter; it is used to store all data to be encrypted and decrypted data; the comparison and distribution module is used to send data read from the memory to the second shifter and the shadow shifter respectively; and to compare the data from the second shifter and the shadow shifter. If the comparison is correct, the data is written to the memory; if the comparison fails, an interrupt request is sent to the RISC-V processor and the shadow processor; the second shifter and the shadow shifter are both divided into two directions: when receiving data, they receive encrypted data from the upper-level shift encryptor and the shadow shift encryptor respectively. The system reads the count values ​​from the second counter and the shadow counter respectively, and decrypts the data using a shift operation. Specifically, when decrypting with the shifter, the shift method is left shift, and the shift number is the value of the second counter; when decrypting with the shadow shifter, the shift method is right shift, and the shift number is twice the value of the shadow counter. When sending data, the system receives the encrypted data to be encrypted from the comparison and distribution module, reads the count values ​​from the second counter and the shadow counter respectively, and encrypts the data using a shift operation. Specifically, when decrypting with the shifter, the shift method is right shift, and the shift number is the value of the second counter; when decrypting with the shadow shifter, the shift method is left shift, and the shift number is twice the value of the shadow counter.

Images