An RSIC-V CPU security chip based on permission management

Abstract

The present invention discloses an RSIC-V CPU security chip based on permission management, belonging to the technical field of secure boot. It includes an embedded RSIC-V CPU core, and the embedded RSIC-V CPU core is connected to a ROM permission management module, a security management system register, and a security permission management module; the ROM permission management module is connected to a secure ROM firmware; the security permission management module is connected to multiple security modules; when users with different identities access the secure ROM firmware, identity recognition is performed, and different levels of security services are provided according to the permissions of the recognized user identities. Only requests that pass signature verification and security permission management authentication are allowed to access the security modules, ensuring the uniqueness of the services of the security modules. Only authorized upper-layer software can specifically access the chip security modules, and this access is not a direct access. Instead, security services are provided through the ROM firmware, and the service results are fed back to the upper-layer software, ensuring the security of the security modules from the circuit level and greatly increasing the difficulty of the chip being attacked.

Description

Technical Field

[0001] The present invention relates to the technical field of secure boot, and particularly to a secure chip for RSIC-V CPU based on permission management. Background Art

[0002] The Internet of Things technology is developing at a high speed. Internet of Things devices are accelerating their implementation in fields such as smart home, smart healthcare, smart city, and wearable devices. The number of end products integrating Internet of Things devices is increasing rapidly. According to the prediction of the Global System for Mobile Communications Association, the total number of Internet of Things devices globally will exceed 5.3 billion by 2030. Internet of Things devices often operate in untrusted physical environments, and an increasing number of Internet of Things devices are being maliciously attacked to obtain sensitive information or data due to the lack of hardware security reinforcement measures. Summary of the Invention

[0003] The purpose of the present invention is to overcome the deficiencies of the prior art and provide a secure chip for RSIC-V CPU based on permission management.

[0004] The purpose of the present invention is achieved through the following technical solutions: A secure chip for RSIC-V CPU based on permission management includes an embedded RSIC-V CPU core, and the embedded RSIC-V CPU core is connected to a ROM permission management module, a security management system register, and a security permission management module; the ROM permission management module is connected to a secure ROM firmware; the security permission management module is connected to multiple security modules; when users with different identities access the secure ROM firmware, identity recognition is performed, and different levels of security services are provided according to the permissions of the recognized user identities.

[0005] Preferably, the security management system register includes a system register component and a security feature management module; the security feature management module includes a security feature comparison module; one end of the security feature comparison module is connected to security feature ID configuration registers and security feature ID request registers with the same quantity, and the other end of the security feature comparison module is connected to the embedded RSIC-V CPU core; during the initialization process of the secure ROM firmware, the system register component is configured, and each security feature ID configuration register and security feature ID request register are initialized; when the upper-layer software needs to access a security feature, its corresponding security feature ID request register is configured through a security interface to request security feature authentication. If the authentication is passed, the security feature service request is accepted and the security feature is executed. If the authentication fails, the secure ROM firmware refuses to provide the security feature service; after the upper-layer software access is completed, the secure ROM firmware clears its corresponding security feature ID request register and closes the access permissions of the secure ROM firmware and the security module.

[0006] Preferably, if the signature verification passes and the security feature authentication passes, the hardware circuit allows reading the ROM data at the requested address; if either the security feature authentication or the signature verification fails, reading the ROM data at the requested address is not allowed, and the hardware circuit returns all-0 ROM data to the embedded RSIC-V CPU core.

[0007] Preferably, if the signature verification passes and the security feature authentication passes, the hardware circuit switch is turned on, allowing the embedded RSIC-V CPU core to read and write the registers of each security module; if either the security feature authentication or the signature verification fails, the hardware circuit switch is turned off, and the embedded RSIC-V CPU core cannot read and write the registers of each security module, and thus cannot access each security module, and all requests for illegal access to the security module are blocked.

[0008] Preferably, the system register component includes a PLL setting register, a GPIO setting register, and a clock configuration register.

[0009] Preferably, it further includes a PLL phase-locked loop component, a CRG clock reset generation component, a POR power-on reset component, a VDT voltage detection component, an OCB on-chip cache component, an OTP one-time programming device component, an OTP controller component, and multiple peripheral modules; the PLL phase-locked loop component is used to provide a clock; the CRG clock reset generation component is used to provide the clocks and resets required by each component of the chip; the POR power-on reset component is used to provide a power-on reset; the VDT voltage detection component is used to monitor the power states of each power supply of the chip; the OCB on-chip cache component is used as a shared on-chip data cache resource pool; the OTP one-time programming device component is used to store the chip key, chip ID, and analog IP check value; the OTP controller component is used to control the OTP one-time programming device component, providing read / write control timing and power-on information reading for the OTP one-time programming device component.

[0010] Preferably, the peripheral modules include a UART module, an I2C module, an SPI module, and a JTAG module.

[0011] Preferably, the security module includes an SM2 component, an SM3 component, an SM4 component integrating national cryptographic algorithms, and a TRNG true random number component.

[0012] Preferably, it further includes a high-speed interface component, an image processing component, and an AI component.

[0013] Preferably, the high-speed interface component includes a PCIe component, an NVMe component, a DDR component, and a USB component.

[0014] The beneficial effects of the present invention are:

[0015] 1) Manage the security feature permissions for several different security feature ID registers. Through security stratification and feature differentiation, implement differential and proactive security management, reasonably authorize and timely recycle permissions, achieving security management from the source, and manage the hardware security features and security modules.

[0016] 2) All security features are initialized and managed by the ROM firmware and provide security services to the upper-layer software. The ROM firmware cannot be tampered with, ensuring the non-tamperability of the security firmware from the chip circuit.

[0017] 3) Only allow requests that pass signature verification and authentication through security feature ID matching to access ROM data, ensuring the security of ROM data acquisition.

[0018] 4) Only allow requests that pass signature verification and security permission management authentication to access security modules such as SM2, SM3, SM4, true random number module, etc., ensuring the uniqueness of the security module services. Only authorized upper-layer software can access the chip security module specifically, and this access is not a direct access but through the ROM firmware to provide security services and feedback the service results to the upper-layer software, ensuring the security of the security module from the circuit and greatly increasing the difficulty of the chip being attacked. Brief Description of the Drawings

[0019] Figure 1 It is a principle block diagram of an RSIC-V CPU security chip based on permission management;

[0020] Figure 2 It is a principle block diagram of the security management system register. Specific Embodiments

[0021] Next, the technical solutions of the present invention will be clearly and completely described in conjunction with the embodiments. Obviously, the described embodiments are only a part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative efforts fall within the protection scope of the present invention.

[0022] The present invention provides a complete and secure hardware startup scheme based on permission management and a national cryptography security algorithm service scheme for the chip hardware-level security startup technology. Access requests that do not pass signature verification and security permission management authentication cannot access ROM data, thus maximizing the physical security of ROM data. Access requests that do not pass signature verification and security permission management authentication cannot access security modules. Thus, even if a certain CPU is exploited by an attacker due to a security vulnerability, the attacker cannot perform key cracking or data decryption because they cannot obtain security services, greatly increasing the difficulty of the chip being attacked.

[0023] Refer to Figure 1 - Figure 2 , the present invention provides a technical solution: a RSIC-V CPU security chip based on permission management, including an embedded RSIC-V CPU core, the embedded RSIC-V CPU core is connected to a ROM permission management module, a security management system register, and a security permission management module; the ROM permission management module is connected to a secure ROM firmware; the security permission management module is connected to multiple security modules; when users with different identities access the secure ROM firmware, identity recognition is performed, and different levels of security services are provided according to the permissions of the recognized user identities.

[0024] In this embodiment, the chip security firmware function is carried by the secure ROM firmware, and a circuit-level hardware security reinforcement solution based on permission management is proposed. When users with different identities access the secure ROM firmware, identity recognition is performed, and different levels of security services are provided according to the permissions of the recognized user identities.

[0025] In some embodiments, the security management system register includes a system register component and a security feature management module; the security feature management module includes a security feature comparison module; one end of the security feature comparison module is connected to a same number of security feature ID configuration registers and security feature ID request registers, and the other end of the security feature comparison module is connected to the embedded RSIC-V CPU core; during the initialization process of the secure ROM firmware, the system register component is configured, and each security feature ID configuration register and security feature ID request register are initialized and configured; when the upper-layer software needs to access a security feature, its corresponding security feature ID request register is configured through a security interface to request security feature authentication. If the authentication passes, the security feature service request is accepted and the security feature is executed. If the authentication fails, the secure ROM firmware refuses to provide the security feature service; after the upper-layer software access is completed, the secure ROM firmware clears its corresponding security feature ID request register and closes the access permissions of the secure ROM firmware and the security module.

[0026] In this embodiment, the security feature management module includes three parts: several groups of security feature ID configuration registers, corresponding several groups of security feature ID request registers, and a security feature comparison module. The security feature ID configuration registers are defined as shown in Table 1. This register is only reset to all 0 by POR hard reset when powered on, and can only be written when the sec_init_done register is 0. The active signal is 1 to indicate activation of this security feature ID. The security feature ID comparison module will initiate a comparison based on this group of security feature ID configuration registers. The sec_init_done register can only be reset by POR reset and can only be configured as 1 by the CPU.

[0027] Table 1

[0028]

[0029] The security feature ID request register is defined as in Table 2. Bit 31 represents the authentication result status bit. A value of 1 indicates successful authentication and access to the security feature is allowed. A value of 0 indicates failed authentication and access to the security feature is not allowed. Bit 30 represents the authentication request initiation bit. A value of 1 for this bit indicates an authentication request is initiated, and the ID to be authenticated is bits 29 to 0.

[0030] Table 2

[0031]

[0032] The security features are carried and managed by the secure ROM firmware. During the initialization of the secure ROM, the system register components are configured, and each security feature ID register is initialized. After the configuration is complete, writing the rom_sec_init_done register as 1 indicates the completion of the secure firmware initialization. When the service permission process is in progress and the upper-layer software needs to access the security features, it configures its own security access ID request register through the security interface and sets the req bit to 1 to indicate a request for security feature authentication. The security interface writes the configured value into the security feature ID request register and initiates a security feature authentication request, and checks the authentication request status bit of the security feature ID request register. A value of 1 for this bit indicates successful authentication, the sec_acc_en signal is pulled high, the security feature service request is accepted and the security feature is executed. A value of 0 for this status bit causes the ROM firmware to reject the security service. After the upper-layer software access is completed, the secure ROM firmware clears the security feature ID request register, closes the access permissions of the ROM and the security module. The next time access is required, authentication is needed again, thus realizing the access permission management of the security features.

[0033] In some embodiments, if the signature verification passes and the security feature authentication passes, the hardware circuit allows reading the ROM data at the requested address; if either the security feature authentication or the signature verification fails, reading the ROM data at the requested address is not allowed, and the hardware circuit returns all-0 ROM data to the embedded RSIC-V CPU core.

[0034] In this embodiment, after authentication, the sec_acc_en signal is pulled high, indicating that reading ROM data is allowed. At this time, the circuit allows reading the ROM data at the corresponding address. If the sec_acc_en signal is pulled low, it indicates that the current ROM reading is not authorized and reading the ROM data at the corresponding address is not allowed, and the hardware circuit returns all-0 ROM data to the CPU. Thus, through the security reinforcement of the hardware circuit, only trusted requests that pass security authentication can access ROM data, realizing the hardware circuit security reinforcement technology of the ROM.

[0035] In some embodiments, if the signature verification and signature authentication are passed and the security feature authentication is passed, the hardware circuit switch is turned on, allowing the embedded RSIC-V CPU core to read and write the registers of each security module; if either the security feature authentication or the signature verification and signature authentication fails, the hardware circuit switch is turned off, and the embedded RSIC-V CPU core cannot read and write the registers of each security module, and thus cannot access each security module, and all requests for illegal access to the security module are blocked.

[0036] In this embodiment, the sec_acc_en signal is logically operated with the chip select signals of the CPU register configuration buses of each security module such as SM2, SM3, SM4, TRNG, etc., so that when sec_acc_en is high, the hardware circuit switch is turned on, allowing the CPU to read and write the registers of each security module, and when sec_acc_en is low, the hardware circuit switch is turned off, and the CPU cannot read and write the registers of each security module, and thus cannot access each security module. Thus, the hardware circuit security reinforcement technology for the security module is realized, and all requests for illegal access to the security module are blocked, and only service requests that pass the signature verification and pass the security feature ID authentication can be authorized to access the security module. In addition, while meeting the security features, the circuit of this invention also has the advantage of convenient circuit design transplantation, and the security module can be integrated among different SoC projects.

[0037] In some embodiments, the system register component includes a PLL setting register, a GPIO setting register, and a clock configuration register.

[0038] In this embodiment, as Figure 2 shown, the security management system register component includes a system register component and a security feature management component. The system register component includes registers such as a PLL setting register, a GPIO setting register, and a clock configuration register (the system register component may also include other registers according to the actual design). Such registers are related to the realization and stability of the basic functions of the SoC. To ensure security, this design only allows CPU Core0 to perform initialization configuration and modify the configuration during dynamic operation in the machine mode. Other CPU cores and other modes cannot perform configuration to ensure the security of the system registers.

[0039] In some embodiments, it further includes a PLL (Phase-Locked Loop) component, a CRG (Clock Reset Generator) component, a POR (Power-On Reset) component, a VDT (Voltage Detector) component, an OCB (On-Chip Buffer) component, an OTP (One-Time Programmable) device component, an OTP controller component, and multiple peripheral modules; the PLL component is used to provide a clock; the CRG component is used to provide the clock and reset required by each component of the chip; the POR component is used to provide a power-on reset; the VDT component is used to monitor the power status of each power supply of the chip; the OCB component is used as a shared on-chip data cache resource pool; the OTP device component is used to store chip keys, chip IDs, and analog IP check values; the OTP controller component is used to control the OTP device component and provide read / write control timing for the OTP device component and power-on information reading.

[0040] In this embodiment, the PLL component is used to provide a clock, the POR (Power On Reset) component is used to provide a power-on reset, the (Clock Reset Generator, CRG) component is used to provide the clock and reset required by each component of the chip, the voltage detection component (Voltage Detector, VDT) is used to monitor the power status of each power supply of the chip, the ROM component is used to load the on-chip CPU firmware after power-on, the DMA is used for data transfer, the one-time programmable device component (One Time Programmable, OTP) is used to store information such as chip keys, chip IDs, and analog IP check values (other information can also be stored in addition), and the OTP controller component is used to control the OTP component and provide functions such as read / write control timing for the OTP and power-on information reading. The on-chip buffer (OnChip Buffer, OCB) component is used as a shared on-chip data cache resource pool. Several peripheral modules such as UART, I2S, SPI, I2S, and so on.

[0041] In some embodiments, the peripheral modules include a UART module, an I2C module, an SPI module, and a JTAG module.

[0042] In some embodiments, the security module includes an SM2 component, an SM3 component, an SM4 component integrating national cryptographic algorithms, and a TRNG (True Random Number Generator) component.

[0043] In some embodiments, it further includes a high-speed interface component, an image processing component, and an AI component.

[0044] In some embodiments, the high-speed interface component includes a PCIe component, an NVMe component, a DDR component, and a USB component.

[0045] In this embodiment, according to the requirements of customized SoC functions, the SoC chip may also include high-speed interface components such as PCIe, NVMe, DDR, USB, etc., as well as image processing components, AI components, components such as SM2, SM3, SM4 of national cryptographic algorithms, true random numbers, and so on.

[0046] The above are only the preferred embodiments of the present invention. It should be understood that the present invention is not limited to the form disclosed herein, and should not be regarded as excluding other embodiments, but can be used in various other combinations, modifications, and environments, and can be changed within the scope of the concept described herein through the above teachings or the technology or knowledge in related fields. And the changes and alterations made by those skilled in the art without departing from the spirit and scope of the present invention shall fall within the protection scope of the appended claims of the present invention.

Claims

1. A RSIC-V CPU security chip based on permission management, characterized in that: It includes an embedded RSIC-V CPU core, and the embedded RSIC-V CPU core is connected to a ROM permission management module, a security management system register, and a security permission management module; The ROM permission management module is connected to a secure ROM firmware; The security permission management module is connected to multiple security modules; when users with different identities access the secure ROM firmware, identity recognition is performed, and different levels of security services are provided according to the permissions of the recognized user identities; The security management system register includes a system register component and a security feature management module; The security feature management module includes a security feature comparison module; One end of the security feature comparison module is connected to security feature ID configuration registers and security feature ID request registers with the same quantity, and the other end of the security feature comparison module is connected to the embedded RSIC-V CPU core; during the initialization process of the secure ROM firmware, the system register component is configured, and each security feature ID configuration register and security feature ID request register are initialized; when upper-layer software needs to access a security feature, its corresponding security feature ID request register is configured through a security interface to request security feature authentication. If the authentication passes, the security feature service request is accepted and the security feature is executed. If the authentication fails, the secure ROM firmware refuses to provide the security feature service; after the upper-layer software access is completed, the secure ROM firmware clears its corresponding security feature ID request register and closes the access permissions of the secure ROM firmware and the security modules; If the signature verification passes and the security feature authentication passes, the hardware circuit switch is turned on, allowing the embedded RSIC-V CPU core to read and write the registers of each security module; if either the security feature authentication or the signature verification fails, the hardware circuit switch is turned off, and the embedded RSIC-V CPU core cannot read and write the registers of each security module, and thus cannot access each security module, and all requests for illegal access to the security modules are blocked.

2. The RSIC-V CPU security chip based on permission management according to claim 1, characterized in that: If the signature verification passes and the security feature authentication passes, the hardware circuit allows reading the ROM data at the requested address; if either the security feature authentication or the signature verification fails, reading the ROM data at the requested address is not allowed, and the hardware circuit returns all-0 ROM data to the embedded RSIC-V CPU core.

3. The RSIC-V CPU security chip based on permission management according to claim 1, characterized in that: The system register component includes a PLL setting register, a GPIO setting register, and a clock configuration register.

4. The RSIC-V CPU security chip based on permission management according to any one of claims 1-3, characterized in that: It further includes a PLL phase-locked loop component, a CRG clock reset generation component, a POR power-on reset component, a VDT voltage detection component, an OCB on-chip cache component, an OTP one-time programmable device component, an OTP controller component, and multiple peripheral modules; the PLL phase-locked loop component is used to provide a clock; the CRG clock reset generation component is used to provide the clocks and resets required by each component of the chip; the POR power-on reset component is used to provide a power-on reset; the VDT voltage detection component is used to monitor the power supply states of each component of the chip; the OCB on-chip cache component is used as a shared on-chip data cache resource pool; the OTP one-time programmable device component is used to store chip keys, chip IDs, and analog IP check values; the OTP controller component is used to control the OTP one-time programmable device component, providing read / write control timing for the OTP one-time programmable device component and power-on information reading.

5. The RSIC-V CPU security chip based on permission management according to claim 4, characterized in that: The peripheral modules include a UART module, an I2C module, an SPI module, and a JTAG module.

6. The RSIC-V CPU security chip based on permission management according to any one of claims 1-3, characterized in that: The security module includes an SM2 component, an SM3 component, an SM4 component integrating national cryptographic algorithms, and a TRNG true random number component.

7. The RSIC-V CPU security chip based on permission management according to any one of claims 1-3, characterized in that: It further includes a high-speed interface component, an image processing component, and an AI component.

8. The RSIC-V CPU security chip based on permission management according to claim 7, characterized in that: The high-speed interface component includes a PCIe component, an NVMe component, a DDR component, and a USB component.

Images