Network-on-chip system, access processing method thereof and system-on-chip

Abstract

The embodiment of the invention provides a network-on-chip system, an access processing method of the network-on-chip system and the network-on-chip system. The network-on-chip system includes: a storage device including a plurality of storage regions formed by a storage cell array; the control device comprises a first device interface used for being connected with an external device, a second device interface used for being connected with the storage device and a firewall device, and is provided with a plurality of configuration registers; the firewall device is connected with the first equipment interface and the second equipment interface; the firewall device is used for determining the access authority of the access request received by the first equipment interface according to the configuration information of the configuration register, and controlling the access mode of the storage equipment through the second equipment interface according to the access authority of the access request; wherein the plurality of configuration registers can be dynamically configured according to scene requirements.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of chip technology, and in particular to a network-on-chip system, an access processing method thereof, and a system-on-chip. Background Art

[0002] Network-on-Chip (NoC) is a communication architecture for integrated circuits. It solves the bus architecture problem that arises with the development of semiconductor technology by applying the concept of computer networks to chip design. The core idea of ​​NoC is to implement a multi-processor system based on network communication on a single chip, including computing nodes and communication nodes.

[0003] As a data communication architecture, the security design of the on-chip network is crucial. However, the security mechanism in related technologies is simple, for example, setting permissions for a continuous address area of ​​the memory. However, these security mechanisms can no longer meet the increasingly complex system network architecture and multi-scenario access requirements. Summary of the invention

[0004] In view of this, an embodiment of the present application provides a network-on-chip system, an access processing method thereof, and a system-on-chip.

[0005] On the one hand, an embodiment of the present application provides a network on chip system, including:

[0006] A storage device including a plurality of storage areas formed by a storage cell array;

[0007] Control device, including:

[0008] The first device interface is used to connect an external device.

[0009] A second device interface is connected to the storage device.

[0010] The firewall device is provided with a plurality of configuration registers;

[0011] The firewall device is connected to the first device interface and the second device interface; the firewall device is used to determine the access rights of the access request received by the first device interface according to the configuration information of the configuration register, and control the access mode to the storage device through the second device interface according to the access rights of the access request; wherein the multiple configuration registers can be dynamically configured according to the scene requirements. .

[0012] In some embodiments, the first device interface comprises:

[0013] A first receiving end, used to receive an access address in the access request; the access address is used to indicate that the external device requests to access a storage space in the storage device; the storage space includes one or more storage units;

[0014] A second receiving end is used to receive the identity information in the access request; the identity information is used to indicate the identity of the external device;

[0015] The firewall device is specifically configured to determine the access rights corresponding to the access address and the identity information according to the setting of the configuration register.

[0016] In some embodiments, the configuration register includes:

[0017] one or more storage region registers, for indicating a region type of at least some of the storage regions in the storage device;

[0018] The firewall device is specifically used for:

[0019] Determining the area type of the access address according to the setting of the storage area register;

[0020] The access permission of the access request is determined according to the area type of the access address in the access request and the identity information in the access request.

[0021] In some embodiments, the firewall device further comprises:

[0022] The area determination unit is connected to the storage area register and is used to sequentially compare whether the access address belongs to the storage area indicated by the storage area register and output area hit information; the area hit information is used to indicate the area type of the access address.

[0023] In some embodiments, the configuration register further includes:

[0024] One or more device permission registers, used to indicate access permissions of one or more of the external devices;

[0025] The firewall device is specifically used for:

[0026] Determining, according to the setting of the device permission register, the permission parameter corresponding to the identity information in the access request;

[0027] The access permission of the access request is determined according to the permission parameter of the identity information and the access address in the access request.

[0028] In some embodiments, the firewall device further comprises:

[0029] an access permission determination unit connected to the device permission register; the identity information in the access request includes: security identification information and device identification information;

[0030] The access permission determination unit is used for:

[0031] Determining, based on the security identification information, whether the access of the external device is a security identity access;

[0032] If the access is a security identity access, searching the device permission register corresponding to the device identification information in the security access register group preset in the device permission register; wherein the device identification information is used to indicate the device identity of the external device;

[0033] If the access is a non-secure identity access, searching the device permission register corresponding to the device identification information received by the second receiving end in a non-secure access register group preset in the device permission register;

[0034] The access permission of the access request is determined according to the permission parameter set in the found device permission register and the access address.

[0035] In some embodiments, the device permission registers include: at least one read access register and at least one write access register;

[0036] The first device interface also includes:

[0037] A third receiving end is used to receive access type information in the access request; the access type information at least includes: a read access type or a write access type;

[0038] The firewall device is also specifically used for:

[0039] The permission parameter of the corresponding read access register or write access register is determined according to the identity information and the access type information.

[0040] In some embodiments, the network on chip system further includes:

[0041] The high-level peripheral bus interface is connected to the firewall device and is used to receive configuration information for setting or modifying one or more configuration registers in the firewall device.

[0042] On the other hand, an embodiment of the present application provides an access processing method based on an on-chip network system, wherein the on-chip network system includes a firewall device and a storage device; the method includes:

[0043] receiving access requests from external devices;

[0044] According to the access request, searching, through the firewall device, configuration information of a configuration register matching the access request;

[0045] Determining access rights of the access request according to the configuration information of the configuration register;

[0046] According to the access rights of the access request, an access mode to a storage device of the on-chip network system is determined; wherein the configuration register can be dynamically configured according to scenario requirements.

[0047] On the other hand, an embodiment of the present application provides a system on chip, the system on chip comprising any one of the above-mentioned network on chip systems;

[0048] A security processor is connected to the high-level peripheral bus interface of the on-chip network system and is used to configure or modify one or more configuration registers in the firewall device through the high-level peripheral bus interface.

[0049] The embodiment of the present application sets up a firewall device in the on-chip network system, and configures the access rights of external devices through the configuration register in the firewall device. In this way, different access rights can be configured for different devices to achieve different access methods, thereby meeting the access requirements in different scenarios and realizing flexible security encryption strategies. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] Figure 1 A structural block diagram of a network-on-chip system provided in an embodiment of the present application;

[0051] Figure 2 The structural framework of the firewall device in the network-on-chip system provided in the embodiment of the present application Figure 1 ;

[0052] Figure 3 The structural framework of the firewall device in the network-on-chip system provided in the embodiment of the present application Figure 2 ;

[0053] Figure 4 A schematic diagram of a firewall device in a network-on-chip system provided in an embodiment of the present application;

[0054] Figure 5 A control principle diagram of a firewall device in a network-on-chip system provided in an embodiment of the present application;

[0055] Figure 6 A flowchart of a firewall device in a network-on-chip system provided in an embodiment of the present application;

[0056] Figure 7 A flowchart of an access processing method based on an on-chip network system provided in an embodiment of the present application;

[0057] Figure 8 A structural block diagram of a system on chip provided in an embodiment of the present application. DETAILED DESCRIPTION

[0058] The following will be combined with the embodiments of the present application and the accompanying drawings to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0059] In the following description, a large number of specific details are given to provide a more thorough understanding of the present application. However, it is obvious to those skilled in the art that the present application can be implemented without one or more of these details. In other examples, in order to avoid confusion with the present application, some technical features known in the art are not described; that is, all features of the actual embodiments are not described here, and well-known functions and structures are not described in detail.

[0060] The purpose of the terms used herein is only to describe specific embodiments and is not intended to be limiting of the present application. When used herein, the singular forms "one", "an" and "said / the" are also intended to include plural forms, unless the context clearly indicates otherwise. It should also be understood that the terms "consisting of" and / or "comprising", when used in this specification, determine the presence of the features, integers, steps, operations, elements and / or parts, but do not exclude the presence or addition of one or more other features, integers, steps, operations, elements, parts and / or groups. When used herein, the term "and / or" includes any and all combinations of the relevant listed items.

[0061] In order to thoroughly understand the present application, detailed steps and detailed structures will be presented in the following description to illustrate the technical solution of the present application. The preferred embodiments of the present application are described in detail below, but in addition to these detailed descriptions, the present application may also have other implementation methods.

[0062] In some embodiments, the security mechanism of NoC uses the value of the Advanced Microcontroller Bus Architecture (AMBA) bus signal to filter access to the target area. This method is a standard security mechanism implementation method, and the implementation process is relatively simple. Specific security restrictions can be imposed on a whole block of continuous address areas. However, the flexibility of this security mechanism is seriously insufficient. The security policy cannot be modified after the hardware code is configured, and it is difficult to customize the design for specific needs. For example, the planning of the size and number of areas that need to be encrypted and protected in DDR (Double Data Rate Synchronous Dynamic Random Access Memory) changes dynamically for different application scenarios. Even for the same encryption space, the permissions that can be obtained by the same peripheral in different application scenarios are also dynamically changing, which are effects that cannot be achieved in the above security mechanisms.

[0063] Based on this, the embodiment of the present application provides a network on chip system, such as Figure 1 As shown, the network-on-chip system 100 includes:

[0064] The storage device 110 includes a plurality of storage areas formed by a storage cell array;

[0065] The control device 120 includes:

[0066] The first device interface 121 is used to connect to an external device.

[0067] The second device interface 122 is connected to the storage device 110.

[0068] The firewall device 123 is provided with a plurality of configuration registers;

[0069] The firewall device 123 connects the first device interface 121 and the second device interface 122; the firewall device 123 is used to determine the access rights of the access request received by the first device interface 121 according to the configuration information of the configuration register, and control the access method to the storage device through the second device interface 122 according to the access rights of the access request; wherein the multiple configuration registers can be dynamically configured according to scenario requirements.

[0070] Here, the on-chip network system is the system where the above-mentioned NoC is located. The on-chip network system can be applied to the system-on-chip (SoC), as a part of the SoC, or as a complete system-on-chip. SoC refers to a complete system integrated on a single chip. This system can include a processor core, such as a central processing unit (CPU) or a graphics processing unit (GPU), memory, input / output interface and other necessary peripherals. The goal of SoC is to integrate most or all functions of the entire electronic system into one chip. NoC is a communication architecture used to connect the various components inside the SoC. It provides a networked communication method that enables different components inside the SoC (such as processor cores, memory and peripherals) to exchange data efficiently.

[0071] In the embodiment of the present application, the network-on-chip system 100 includes a storage device 110, which can be a random access memory, such as a dynamic random access memory (DRAM) or a static random access memory (SRAM), and specifically, can be the above-mentioned DDR. In other embodiments, the storage device 110 can also be a read-only memory (ROM), a flash memory (NAND Flash), or a solid state drive (SSD), and the like.

[0072] The on-chip network system also includes a control device 120, which performs the functions of data transmission and security settings between the peripheral device and the above-mentioned storage device 110. Specifically, it includes a first device interface 121 connected to the external device and a second device interface 122 connected to the storage device 110, and also includes a firewall device 123 connected between the first device interface 121 and the second device interface 122. It can be understood that when an external device needs to access the storage device 110 to read, write or erase data, it needs to pass through the firewall device 123 of the control device 120. Therefore, the setting of the firewall device 123 can be used to configure the access rights of the external device, thereby achieving access with different security levels.

[0073] Specifically, the firewall device 123 includes a configuration register, and the access rights or access levels of different external devices are determined by setting each register in the configuration register. Exemplarily, the configuration register can be implemented by a custom register transfer level (RTL) design, and the function of the configuration register can be defined by writing a specific hardware description language (HDL) code through software, and then the code is converted to a physical circuit for implementation. The custom RTL design allows for higher design flexibility and optimization. In other words, the configuration registers in the firewall device 123 can be written by software, thereby realizing flexible configuration of the on-chip network security policy.

[0074] In the embodiment of the present application, the configuration information of the configuration register includes information such as the value and function of each register, which is used to indicate the access rights of different access requests. When the firewall device 123 receives an access request through the first device interface 121, it can match the configuration information of the configuration register with the relevant information in the access request to determine the access right corresponding to the access request, and then control the access method of the access request to the storage device through the second device interface 122.

[0075] It should be noted that the access request may carry information such as identity information for identifying the external device, the type of access, and the address of the access. The firewall device 123 uses this information to match the corresponding configuration register to determine the access rights of the access request.

[0076] In one embodiment, the access permission may include allowing access and prohibiting access. If the firewall device 123 determines that the access permission of the current access request is allowing access, the access required in the access request to the storage device may be controlled through the second device interface 122. If the firewall device 123 determines that the current access request is prohibiting access, the second device interface 122 may be controlled to feedback a prohibiting access response, and the access request may be stopped from being transmitted to the storage device 110 through the second device interface 122.

[0077] In another embodiment, the access rights may also include specific access rights such as read-only access, write-only access, or prohibition of erasure. Exemplarily, if the firewall device 123 determines that the access right in the current access request is read-only access, the second device interface 122 may be controlled to transmit the read request in the access request to the storage device 110, and the second device interface 122 may be prohibited from transmitting the write request or other requests in the access request to the storage device 110.

[0078] In some embodiments, the network on chip system further includes:

[0079] The high-level peripheral bus interface 130 is connected to the firewall device 123 and is used to receive configuration information for setting or modifying one or more configuration registers in the firewall device 123 .

[0080] The Advanced Peripheral Bus (APB) is mainly used for low-speed and low-power peripheral devices. It is a simple, non-pipelined synchronous interface protocol, and each transmission requires at least two clock cycles to complete. The APB bus has the characteristics of low cost and low power consumption, a simple interface structure, and a transmission rule that uses clock edge triggering. In the embodiment of the present application, a computer or other external device can be connected to the advanced peripheral bus interface 130, and the configuration information of the firewall device 123 can be modified or set through software. In this way, the firewall device 123 can be flexibly configured at any time to modify various security policies.

[0081] In some embodiments, Figure 2 As shown, the first device interface 121 includes:

[0082] The first receiving end 121a is used to receive the access address in the access request; the access address is used to indicate that the external device requests to access the storage space in the storage device; the storage space includes one or more storage units;

[0083] The second receiving end 121b is used to receive the identity information in the access request; the identity information is used to indicate the identity of the external device;

[0084] The firewall device is specifically configured to determine the access rights corresponding to the access address and the identity information according to the setting of the configuration register.

[0085] In the embodiment of the present application, for the same external device, different access addresses can be set with different access permissions. For example, different areas can be set for the storage space in the storage device, including encrypted areas, non-encrypted areas, etc., and read-only areas and read-write areas can be set. For external devices with different identities, the access permissions for the above different areas can be different.

[0086] Specifically, for devices with higher access rights, such as external devices with administrator identities, which can access all storage areas, the firewall device determines the administrator identity based on the access request and determines that it has access rights to different storage areas. For ordinary external devices, the firewall device can determine that it only has access rights to non-encrypted areas, or has read and write rights to read and write areas; it has no access rights to encrypted areas, or can read read-only areas but not other accesses. In addition, access prohibition can be set for certain external devices, that is, external devices with specific identities are prohibited from any access. In actual applications, various device identities and access rights to different areas can be flexibly set, not limited to the above examples, and no specific limitations are made here.

[0087] In some embodiments, Figure 2 As shown, the above configuration registers include:

[0088] One or more storage area registers 201, used to indicate the area type of at least part of the storage area in the storage device 110;

[0089] The firewall device is specifically used for:

[0090] Determining the area type of the access address according to the setting of the storage area register 201;

[0091] The access permission of the access request is determined according to the area type of the access address in the access request and the identity information in the access request.

[0092] That is, in the configuration register, at least part of the storage space in the storage device 110 can be divided into one or more storage areas through the configuration of the storage area register 201, and different areas are marked respectively. Different storage areas can have different area types. Here, the area type can only represent the storage space partition indicated by different addresses, and can also be used to define the area type with a specific encryption level.

[0093] Exemplarily, within the storage area range indicated by the above-mentioned storage area register 201, it belongs to the encryption protection area. If the access address falls within the area range indicated by the storage area register 201, it indicates that the area accessed by the access request requires specific encryption protection, and the access rights of the access request can be further determined by the identity information. If the access address does not fall within the area range indicated by the storage area register 201, there is no need to further determine the access rights based on the identity information, and the permission can be directly determined as allowing access. For another example, different storage areas divided by the storage area register 201 have different encryption protection rules, and the access rights can be determined based on the specific area where the access address falls and the identity information.

[0094] In some embodiments, Figure 2 As shown, the firewall device 123 also includes:

[0095] The area determination unit 202, the storage area register 201, and can be connected to the first receiving end 121a, is used to sequentially compare whether the access address belongs to the storage area indicated by the storage area register 201, and output area hit information; the area hit information is used to indicate the area type of the access address.

[0096] That is to say, the area judgment unit 202 determines whether the access address belongs to these storage areas by comparing the access address with the storage areas defined by the storage area register 201 in sequence. If so, it outputs area hit information indicating that the access address belongs to the area type indicated by the storage area register 201. If not, it outputs area hit information indicating that the access address does not belong to the above-mentioned area type.

[0097] In an embodiment of the present application, the storage area register 201 can delimit the area by recording the starting address and the ending address of each storage area, that is, each two groups of registers define a storage area. Exemplarily, the configuration register may include 64 groups of storage area registers 201, that is, for defining 32 storage areas. The area determination unit 202 can determine whether the access address falls within the range of the storage area by comparing the size of the access address with the starting address and the ending address of each storage area, and compare each storage area in turn until the storage area range to which it belongs is found. Of course, if no matching storage area is found after comparing all the storage area registers 201, it means that the access address does not belong to the range defined by the storage area register 201, and its access rights are further determined according to the area type of the undefined area.

[0098] In some embodiments, Figure 2 As shown, the above configuration register also includes:

[0099] One or more device permission registers 203, used to indicate access permissions of one or more external devices;

[0100] The above-mentioned firewall device is specifically used for:

[0101] Determine the permission parameter corresponding to the identity information according to the setting of the device permission register 203;

[0102] The access permission of the access request is determined according to the permission parameter of the identity information in the access request and the access address.

[0103] In an embodiment of the present application, the firewall device also divides the access rights of devices with different identities through the device permission register 203. Different device permission registers 203 can represent different external devices, and the information recorded in the device permission register 203, namely the above-mentioned permission parameters, is used to indicate the access rights of the external device. In an exemplary embodiment, multiple groups of peripheral device identifiers with secure access rights and multiple groups of peripheral device identifiers with non-secure access rights can be set through the device permission register 203. By comparing the identity information in the access request with the corresponding peripheral identifiers in the device permission register 203, it is determined whether the identity information corresponding to the access request belongs to the range of secure access rights or the range of non-secure access rights.

[0104] In another exemplary embodiment, the read / write permissions corresponding to different peripheral device identifiers may be set respectively through the device permission register 203. For example, read access permissions corresponding to multiple groups of peripheral device identifiers may be set, and write access permissions corresponding to multiple groups of peripheral device identifiers may be set.

[0105] In addition, the read access permission and the write access permission of the above peripheral identification with secure access permission and the read access permission and the write access permission of the peripheral identification with non-secure access permission may be set respectively.

[0106] For the same external device, secure access and non-secure access can also be performed separately. Therefore, the above-mentioned device permission register 203 can also configure the secure access permissions and non-secure access permissions of each external device separately. Exemplarily, it can include read access permissions and write access permissions for secure access and read access permissions and write access permissions for non-secure access. It should be noted that the access request can carry an identifier of secure access or non-secure access. The firewall device can determine the access type based on the identifier, and then compare the corresponding device permission register 203 to determine the access permissions of the current access of the current external device. Exemplarily, the security identification information received by the second receiving end 121b can be used as the above-mentioned identifier to determine whether the access type of the current access request is secure access.

[0107] In some embodiments, Figure 2 As shown, the firewall device 123 further includes:

[0108] The access permission determination unit 204 is connected to the device permission register 203; the identity information in the access request includes: security identification information and device identification information, which can be received by the second receiving end 121b;

[0109] The access permission determination unit is used to: determine whether the access of the external device is a security identity access according to the security identification information;

[0110] If the access is a security identity access, the security access register group 203a (such as Figure 3 As shown) searching for a device authority register 203 corresponding to the device identification information; wherein the device identification information is used to indicate the device identity of the external device;

[0111] If the access is a non-secure identity access, the non-secure access register group 203b (such as Figure 3 ) searching the device authority register 203 corresponding to the device identification information received by the second receiving end 121b;

[0112] The access permission of the access request is determined according to the permission parameters set in the found device permission register 203 and the access address.

[0113] Specifically, the second receiving terminal 121b may include a first sub-receiving terminal 301 and a second sub-receiving terminal 302. The first sub-receiving terminal 301 is used to receive security identification information, which can be carried in the access request to indicate whether the access of the external device is a secure access. Exemplarily, the security identification information can be a 1-bit binary number. For example, when its value is "0", it indicates that the current access request is a secure access, and when its value is "1", it indicates that the current access request is a non-secure access. The second sub-receiving terminal 302 can be used to receive device identification information to determine the identity of the device. The firewall device 123 can determine to search for the corresponding device permission register 203 based on the device identification information and the security identification information, and determine the access rights of the current access request based on the permission parameters of the device permission register 203.

[0114] The above-mentioned device permission register 203 can be divided into a secure access register group 203a and a non-secure access register group 203b, wherein the secure access register group 203a includes device permission registers corresponding to device identities indicated by multiple device identification information, and the permission parameters of these registers are used to indicate the access rights of the corresponding device identities under secure access.

[0115] In some embodiments, Figure 3 As shown, the device permission register 203 includes: at least one read access register and at least one write access register;

[0116] The first device interface 121 also includes:

[0117] The third receiving end 121c is used to receive access type information in the access request; the access type information at least includes: a read access type or a write access type;

[0118] The firewall device 123 is also specifically used for:

[0119] According to the identity information and the access type information, the permission parameters of the corresponding read access register or write access register are determined.

[0120] Specifically, the device permission register 203 can also be divided into a read access register for configuring the read access rights of each device identification information (device ID), and a write access register for configuring the write access rights. Exemplarily, the security access register group 203a includes n groups of registers, each group corresponds to a device ID, and each group can have two registers, that is, the read access register rd_i and the write access register wr_i (0≤i<n) correspond to the read access rights and the write access rights, respectively. In addition, the non-security access register group 203b can also include n groups of registers, each group includes two registers and corresponds to a device ID, corresponding to the read access rights and the write access rights, respectively.

[0121] In this way, when an access request is received, the secure access register group 203a or the non-secure access register group 203b can be selected according to the security identification information in the access request, and then the corresponding register is further selected according to the device identification information and the access type (read or write) of the access request. Determine whether access is allowed based on the permission parameter configured by the register finally selected. For example, the permission parameter of the register is a 1-bit binary number. If it is "1", access is allowed, and if it is "0", access is prohibited.

[0122] In this way, by classifying the grouped registers, permission configuration for various types of devices and different access requests can be implemented.

[0123] The present application also provides the following examples:

[0124] The embodiment of the present application provides a highly customized firewall device, which supports online configuration, implements flexible control of access rights to DDR encryption areas in NoC, and meets SoC security encryption strategies in multiple scenarios.

[0125] Figure 4 The working principle diagram of the firewall device is shown in Figure 1. The firewall device is located in the request path of the internal data path of the NoC, and uses the packet header information of the data packet to make access rights judgments. After the data packet with access rights passes through the firewall device, it enters the slave device from the slave device interface of the NoC. Before entering the slave device, the data packet without access rights will be directly returned to the master device with an error response on the slave device interface. In addition, the firewall device supports two-level pipeline operation and supports software to modify internal custom registers through the APB interface.

[0126] like Figure 4As shown, the firewall device includes a firewall unit 401, whose input end is connected to the first network interface unit NIU1, and whose output end is connected to the second network interface unit NIU2. The access request of the external device is input to the firewall unit 401 and the custom register transfer stage 402 through the first network interface unit NIU1. The custom register transfer stage 402, as the core part of the firewall device, processes the access permission determination of each access request in sequence through pipeline technology according to the relevant identifier of the packet header information in the access request, and transmits the result to the second network interface unit NIU2 through the firewall unit 401 for feedback. If the access permission of the current access request is to prohibit access, the second network interface unit NIU2 will not perform further transmission, but feedback a response of prohibiting access to the first network interface unit NIU1.

[0127] Here, the custom register transfer stage 402 processes each access request in sequence through pipeline technology, so that multiple access requests can be processed in the firewall device at the same time, thereby effectively improving the processing efficiency.

[0128] The control principle of the firewall device is as follows Figure 5 As shown, the internal operation is in the form of a two-stage pipeline.

[0129] The first-level pipeline performs region hit judgment, and the region judgment unit 501 receives address information through the address port Rx_0, and compares the address information with each register in the storage region register 502 to determine whether the address hits the set region. Then, the region hit information Hit_region is sent to the access permission judgment unit 503.

[0130] The division of the storage area is determined by the software using the secure CPU configuration. For example, the storage area register 502 can support 32 encryption protection areas, such as Figure 5 As shown in the figure, the register region[31:0]_headaddr is used to set the starting address of the 32 encryption protection regions, and the register region[31:0]_tailaddr is used to set the ending address of the 32 encryption protection regions. The unconfigured address range can be regarded as the common address area of ​​DDR. The first level obtains the region hit information Hit_region according to the access address and passes it to the next level.

[0131] The second-level pipeline determines the access rights, specifically determining whether the current peripheral has read and write access rights to the current access address. The read and write permission register 504 of the current peripheral for the specified storage area is determined according to the region hit information Hit_region of the first-level pipeline, the security identification information of the peripheral received through the interface Rx_1, the device identification information (i.e., device ID) received through the interface Rx_2, and the access type information received through the interface Rx_3. Exemplarily, the read and write permission register can support the read and write permission settings of 52 device IDs, and the read and write permission register 504 is divided into a security access register group and a non-security access register group. Specifically, in the security access register group, the value of the register sec_mst_wr_en[n] (n = [51:0]) indicates whether the write access request is allowed when the external device with device ID 0 to 51 performs security access; the value of the register sec_mst_rd_en[n] indicates whether the read access request is allowed when the external device with device ID 0 to 51 performs security access. In the non-secure access register group, the value of register nsec_mst_wr_en[n] indicates whether a write access request is allowed when an external device with a device ID of 0 to 51 performs non-secure access; the value of register nsec_mst_rd_en[n] indicates whether a write access request is allowed when an external device with a device ID of 0 to 51 performs secure access. Exemplarily, the value of the above register can be a 1-bit binary number. When the value is "1", it indicates that access is allowed, and when the value is "0", it indicates that access is prohibited. Of course, the value of the above register can also be a 2-bit or more binary number or other numerical value, which is used to indicate different access permission settings. The second-level permission judgment result acc_allow is output by the access permission judgment unit 503. After receiving the permission judgment result, the second network interface unit determines whether to intercept this access. If the access is intercepted, an error response is generated and fed back to the first network interface unit.

[0132] For example, after the system is reset, the security CPU configures multiple storage areas built into the firewall device through the APB bus, such as the address head and tail registers of 32 pairs of encryption partitions and the access permission registers of various peripherals with different security identities for the DDR area. Then, the access permission judgment is performed in a two-stage pipeline form, such as Figure 6 The details are as follows:

[0133] Step 601, Region hit determination of the first-level pipeline. Use the access address in the packet header information for determination. If the access address is between the start and end addresses of a pair of encrypted regions, that is, region_headaddr[n] (start address of partition n) <= Rx_0 (access address) < region_tailaddr[n] (end address of partition n), it is considered a hit in encrypted region n, indicating that the peripheral is currently accessing DDR encrypted partition n. If none of the 32 address partition determinations in the loop result in a hit, it indicates that the peripheral is currently accessing the DDR normal region. The first-level pipeline divides the region access into two major categories according to whether there is a hit in the DDR encrypted region and passes it to the second-level pipeline.

[0134] Step 602, Access permission determination of the second-level pipeline. Determine the security identity of the current peripheral according to the security identification information received by interface Rx_1, and combine it with the first-level region hit result, and then divide it into four access behaviors: non-secure peripheral accessing the DDR encrypted region, secure peripheral accessing the DDR encrypted region, non-secure peripheral accessing the DDR normal region, and secure peripheral accessing the DDR normal region.

[0135] For the first two cases of accessing the DDR encrypted region, when the peripheral n has a secure identity, the read and write permissions are controlled by sec_mst_rd_en[n] (secure master device read enable register) and sec_mst_wr_en[n] (secure master device write enable register) respectively. When it has a non-secure identity, they are controlled by nsec_mst_rd_en[n] (non-secure master device read enable register) and nsec_mst_wr_en[n] (non-secure master device write enable register) respectively.

[0136] It should be noted that the above device permission registers can also include permissions for setting secure and non-secure access to the normal region not divided by the storage area register, and specifically set the read and write permissions. Exemplarily, for the latter two cases of accessing the DDR normal region, when the peripheral n has a secure identity, the read and write permissions are controlled by sec_mst_groupn_rd_en (secure master device group read enable register) and sec_mst_groupn_wr_en (secure master device group write enable register) respectively. When it has a non-secure identity, the read and write permissions are controlled by nsec_mst_groupn_rd_en (non-secure master device group read enable register) and nsec_mst_groupn_wr_en (non-secure master device group write enable register) respectively.

[0137] The access rights are matched to eight kinds of permission registers according to the above four access categories combined with the read and write behaviors, and the value of the corresponding bit of the permission register is assigned to the second-level permission judgment result acc_allow. Specifically, if the corresponding bit of the permission register read and write enable is "1", it means that the read or write access to this area under this security identity of this peripheral is granted access rights, and if it is "0", it is not granted. Finally, the access is allowed based on the value of acc_allow, and a response (Error=0) or access is prohibited, and an error response (Error=1) can be fed back. Therefore, for different peripherals under different security identities, when accessing different areas of DDR for read or write access, there is a unique corresponding register bit to control the access rights, providing secure and trusted software with great freedom to formulate and design various security strategies.

[0138] Based on the same inventive concept, Figure 7 As shown, an embodiment of the present application provides an access processing method based on an on-chip network system, wherein the on-chip network system includes a firewall device and a storage device; the method includes:

[0139] Step S701, receiving an access request from an external device;

[0140] Step S702: searching, through the firewall device, for configuration information of a configuration register matching the access request according to the access request;

[0141] Step S703: Determine the access rights of the access request according to the configuration information of the configuration register;

[0142] Step S704: Determine an access mode to a storage device of the network on chip system according to the access rights of the access request; wherein the configuration register can be dynamically configured according to scenario requirements.

[0143] In some embodiments, the access request includes: an access address and identity information; wherein the access address is used to indicate the address of one or more storage units in the storage device; and the identity information is used to indicate the identity of the external device;

[0144] Determining the access rights of the access request according to the setting of the register includes:

[0145] The access rights corresponding to the access address and the identity information are determined according to the setting of the register.

[0146] In some embodiments, the register includes: one or more storage area registers; and determining the access rights corresponding to the access address and the identity information according to the settings of the registers includes:

[0147] Determining the area type of the access address according to the setting of the storage area register;

[0148] The access permission of the access request is determined according to the area type of the access address and the identity information.

[0149] In some embodiments, the register includes: one or more device permission registers; and determining the access permission of the access request according to the setting of the register includes:

[0150] Determining the permission parameter corresponding to the identity information according to the setting of the device permission register;

[0151] The access permission of the access request is determined according to the permission parameter of the identity information and the access address.

[0152] In some embodiments, the identity information includes: security identification information and device identification information; the device authority register includes: a security identity register group and a non-security identity register group;

[0153] Determining the permission parameter corresponding to the identity information according to the setting of the device permission register includes:

[0154] Determining, based on the security identification information, whether the access of the external device is a security identity access;

[0155] If the access is a security identity access, searching the security identity register group for the device authority register corresponding to the device identification information;

[0156] If the access is a non-secure identity access, searching the non-secure identity register group for the device permission register corresponding to the device identification information;

[0157] According to the found setting of the device permission register, the permission parameter corresponding to the identity information is determined.

[0158] In some embodiments, the device permission register includes: at least one read access register and at least one write access register; the access request also includes: access type information; wherein the access type information includes at least: a read access type or a write access type;

[0159] Determining the permission parameter corresponding to the identity information according to the setting of the device permission register includes:

[0160] The permission parameter of the corresponding read access register or write access register is determined according to the identity information and the access type information.

[0161] Through the access processing method based on the on-chip network system in any of the above-mentioned embodiments of the present application, the configuration of the access rights of the external device is realized by utilizing the configuration register in any of the firewall devices provided in the embodiments of the present application, and through the pipeline judgment of the access request, the access rights of different devices and different access requests are determined to realize different modes of access, which can meet the access requirements in various scenarios and realize flexible security encryption strategies.

[0162] The above method embodiment of the present application has the same inventive concept as any of the above network-on-chip embodiments, and its specific implementation method can refer to the description in the above network-on-chip embodiments, which will not be repeated here. Based on the same inventive concept, the present application embodiment provides a system on chip, such as Figure 8 As shown, the system on chip 800 includes any one of the network on chip systems 100 described above;

[0163] The security processor 801 may be the security CPU mentioned above, connected to the high-level peripheral bus interface of the network-on-chip system 100, and configured to configure or modify one or more configuration registers in the firewall device through the high-level peripheral bus interface.

[0164] A person skilled in the art can understand that all or part of the steps of implementing the above method embodiment can be completed by hardware related to program instructions, and the aforementioned program can be stored in a computer-readable storage medium. When the program is executed, it executes the steps of the above method embodiment; and the aforementioned storage medium includes: mobile storage devices, read-only memories (ROM), magnetic disks or optical disks, etc., various media that can store program codes.

[0165] Alternatively, if the above-mentioned integrated unit of the present application is implemented in the form of a software function module and sold or used as an independent product, it can also be stored in a computer-readable storage medium. The storage medium includes: a mobile storage device, ROM, a disk or an optical disk, and other media that can store program codes.

[0166] The various embodiments / implementations provided in this application can be combined with each other without causing any contradiction.

[0167] The above description is only a preferred embodiment of the present application and is not intended to limit the present application. For those skilled in the art, the present application may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application.

Claims

1. A network-on-chip system, characterized in that: include: A storage device including a plurality of storage areas formed by a storage cell array; Control device, including: The first device interface is used to connect an external device. A second device interface is connected to the storage device. The firewall device is provided with a plurality of configuration registers; The firewall device is connected to the first device interface and the second device interface; the firewall device is used to determine the access rights of the access request received by the first device interface according to the configuration information of the configuration register, and control the access method to the storage device through the second device interface according to the access rights of the access request; wherein the multiple configuration registers can be dynamically configured according to scenario requirements.

2. The network-on-chip system according to claim 1, characterized in that: The first device interface comprises: A first receiving end, used to receive an access address in the access request; the access address is used to indicate that the external device requests to access a storage space in the storage device; the storage space includes one or more storage units; A second receiving end is used to receive the identity information in the access request; the identity information is used to indicate the identity of the external device; The firewall device is specifically configured to determine the access rights corresponding to the access address and the identity information according to the setting of the configuration register.

3. The network-on-chip system according to claim 1, characterized in that: The configuration register includes: one or more storage region registers, for indicating a region type of at least some of the storage regions in the storage device; The firewall device is specifically used for: Determining the area type of the access address according to the setting of the storage area register; The access permission of the access request is determined according to the area type of the access address in the access request and the identity information in the access request.

4. The network-on-chip system according to claim 3, characterized in that: The firewall device also includes: The area determination unit is connected to the storage area register and is used to sequentially compare whether the access address belongs to the storage area indicated by the storage area register and output area hit information; the area hit information is used to indicate the area type of the access address.

5. The network-on-chip system according to claim 1, characterized in that: The configuration register also includes: One or more device permission registers, used to indicate access permissions of one or more of the external devices; The firewall device is specifically used for: Determining, according to the setting of the device permission register, the permission parameter corresponding to the identity information in the access request; The access permission of the access request is determined according to the permission parameter of the identity information and the access address in the access request.

6. The network-on-chip system according to claim 5, characterized in that: The firewall device also includes: an access permission determination unit connected to the device permission register; the identity information in the access request includes: security identification information and device identification information; The access permission determination unit is used for: Determining, based on the security identification information, whether the access to the external device is a security identity access; If the access is a security identity access, searching the device permission register corresponding to the device identification information in the security access register group preset in the device permission register; wherein the device identification information is used to indicate the device identity of the external device; If the access is a non-secure identity access, searching the device permission register corresponding to the device identification information in a non-secure access register group preset in the device permission register; The access permission of the access request is determined according to the permission parameter set in the found device permission register and the access address.

7. The network-on-chip system according to claim 5, characterized in that: The device permission register includes: at least one read access register and at least one write access register; The first device interface also includes: A third receiving end is used to receive access type information in the access request; the access type information at least includes: a read access type or a write access type; The firewall device is also specifically used for: The permission parameter of the corresponding read access register or write access register is determined according to the identity information and the access type information.

8. The network-on-chip system according to any one of claims 1 to 7, characterized in that: The network-on-chip system further comprises: The high-level peripheral bus interface is connected to the firewall device and is used to receive configuration information for setting or modifying one or more configuration registers in the firewall device.

9. An access processing method based on an on-chip network system, characterized in that: The network-on-chip system comprises a firewall device and a storage device; the method comprises: receiving access requests from external devices; According to the access request, searching, through the firewall device, configuration information of a configuration register matching the access request; Determining access rights of the access request according to the configuration information of the configuration register; According to the access rights of the access request, an access mode to a storage device of the on-chip network system is determined; wherein the configuration register can be dynamically configured according to scenario requirements.

10. A system on chip, characterized in that: The system on chip comprises a network on chip system as claimed in any one of claims 1 to 8; The security processor is connected to the high-level peripheral bus interface of the on-chip network system and is used to configure or modify one or more configuration registers in the firewall device through the high-level peripheral bus interface.

Images