Dual-core heterogeneous security processing method and chip based on RISC-V architecture

Abstract

The invention discloses a dual-core heterogeneous security processing method and chip based on an RISC-V. The method comprises the steps that when a processing system is in a starting stage, a master core initializes an advanced high-performance bus, completes a first operation through the advanced high-performance bus and notifies a slave core to start and execute a second operation; the master core determines a data integrity verification result of the boot loading process based on the first hash value sent by the slave core; when the processing system is in a running phase, the slave core determines scanning state configuration based on the load of the processing system; the slave core executes a scanning task based on the scanning state configuration; the slave core starts a second cryptographic algorithm to encrypt the user data; the slave core starts the first cryptographic algorithm to obtain a second hash value; and under the condition that the second hash value is different from the dynamic trusted root of the storage system, the slave core sends an exception notification to the master core, so that the master core performs exception handling. According to the method, the data security of the processing system in the starting operation process can be improved.

Description

Technical Field

[0001] The present application relates to the field of computer security and embedded system technology, and in particular to a dual-core heterogeneous security processing method and chip based on the RISC-V architecture. Background Art

[0002] Secure boot is a technology that uses hardware and software to jointly verify the integrity of system startup components. It aims to prevent malware or unauthorized code from executing during the device startup process and ensure that the device starts from a trusted initial state. The efficiency bottlenecks of traditional secure boot are mainly manifested in the following aspects: (1) Serial verification is time-consuming. For example, the hash check implemented by software (such as SM3 calculation of a 10KB file) takes more than 500μs. Combined with the key update delay, the device startup time is generally greater than 300ms, which cannot meet the low latency requirements of industrial control equipment; (2) Power consumption control is extensive, relying on static frequency adjustment. In idle mode, the processor and coprocessor still operate at a high frequency, with power consumption greater than 65mW, making it difficult to adapt to battery-powered IoT nodes (such as sensors with a battery life of more than 1 year); (3) Key management risks. Full key update requires the transmission of a 32-byte hash value, which is time-consuming and does not implement differential updates. It is vulnerable to man-in-the-middle attacks that lead to firmware tampering. In terms of hardware design, the traditional "CPU+encryption chip" solution increases the complexity of hardware design and material costs, and is not suitable for cost-sensitive application scenarios such as the Internet of Things. At the same time, existing solutions mostly rely on foreign patented technologies and lack independent and controllable security boot mechanisms, especially in the fields of industrial control and smart grids. Therefore, the industry urgently needs security enhancement solutions based on the open source RISC-V architecture. Summary of the Invention

[0003] This application provides a dual-core heterogeneous security processing method and chip based on the RISC-V architecture, aiming to improve the data security of the processing system during startup and operation.

[0004] In order to achieve the above objectives, this application provides the following technical solutions:

[0005] A dual-core heterogeneous security processing method based on the RISC-V architecture is applied to a processing system including a master core and a slave core using the RISC-V architecture. The method comprises:

[0006] When the processing system is in a startup phase, the master core initializes an advanced high-performance bus, completes a first operation through the advanced high-performance bus, and notifies the slave core to start and execute a second operation; the advanced high-performance bus is used to implement communication between the master core, the slave core, and the storage system; the first operation is used to implement loading of a boot loader process; the second operation is used to enable a first cryptographic algorithm and obtain a first hash value;

[0007] The master core determines a data integrity verification result of the boot loading process based on the first hash value sent by the slave core; wherein, if the data integrity verification result is passed, the processing system starts running;

[0008] When the processing system is in the running stage, the slave core determines a corresponding scan state configuration based on the load of the processing system;

[0009] The slave core executes a scanning task based on the scanning state configuration; the scanning task is used to obtain user data being processed by the processing system;

[0010] The slave core activates a second cryptographic algorithm to encrypt the user data to protect the privacy of the user data;

[0011] The slave core activates the first cryptographic algorithm to obtain a second hash value;

[0012] In a case where the second hash value is different from the dynamic trusted root in the storage system, the slave core sends a corresponding exception notification to the master core, so that the master core performs exception processing.

[0013] Optionally, the storage system includes an OTP area, an SRAM area, and a SPIFlash area, the SRAM area includes a non-secure area and a secure area, and the SPIFlash area includes a user data area, a dynamic root area, and a Bootloader area;

[0014] The execution step of the first job includes: the main core obtaining metadata of the boot loader process from the user data area, and starting DMA transmission according to the metadata; the DMA transmission is used to load the data of the boot loader process from the bootloader area to the non-secure area;

[0015] The execution steps of the second job include: the slave core obtains the fixed root from the OTP area, stores the fixed root in the secure area, and monitors the progress of the DMA transfer; when the progress reaches a specified percentage, enables the first cryptographic algorithm, and performs hash calculation on the data of the boot loading process in the non-secure area; when the progress reaches 100%, the hash value obtained by the last hash calculation is determined as the first hash value.

[0016] Optionally, the master core and the slave core are both provided with mailbox registers, and the mailbox registers of the master core and the slave core support mutual communication, and the method further includes:

[0017] When the master core detects a key update event, the master core generates a corresponding key update request and loads the key update request into a mailbox register of the master core, so that the mailbox register of the master core sends the key update request to the mailbox register of the slave core; the key update request includes a new trusted root; the new trusted root includes n+m bytes; n and m are both positive integers;

[0018] After receiving the key update request, the slave core obtains a dynamic trusted root from the dynamic root zone; the dynamic trusted root includes n+m bytes;

[0019] The slave core compares the first n bytes of the new trusted root with the first n bytes of the dynamic trusted root to obtain corresponding byte comparison results;

[0020] If the byte comparison result is the same, the slave core uses the last m bytes of the new trusted root to update the last m bytes of the dynamic trusted root in the dynamic root zone;

[0021] If the byte comparison result is different, the slave core uses all bytes of the new trusted root to update all bytes of the dynamic trusted root in the dynamic root zone.

[0022] Optionally, the slave core further includes a cryptographic accelerator, wherein the cryptographic accelerator includes a third cryptographic algorithm for providing signature verification. The method further includes:

[0023] After completing the update of the dynamic trusted root in the dynamic root zone, the slave core uses the cryptographic accelerator to perform signature verification on the updated dynamic trusted root to legitimize the key update event.

[0024] Optionally, the master core determines, based on the first hash value sent by the slave core, a data integrity verification result of the boot loading process, including:

[0025] After obtaining the first hash value sent by the slave core, the master core obtains the fixed root from the security zone and obtains the preset encryption value from the OTP area;

[0026] The main core performs an XOR operation on the first hash value and the fixed root to obtain a corresponding target encrypted value;

[0027] If the target encryption value is the same as the preset encryption value, the main core determines that the data integrity verification result of the boot loading process is passed;

[0028] If the target encryption value is different from the preset encryption value, the main core determines that the data integrity verification result of the boot loading process is failed.

[0029] Optionally, the scanning state configuration includes a scanning interval and a scanning range; the lower the load, the longer the scanning interval and the smaller the scanning range; the higher the load, the shorter the scanning interval and the larger the scanning range.

[0030] Optionally, the slave core enabling the first cryptographic algorithm to obtain a second hash value includes:

[0031] The slave core enables the first cryptographic algorithm and performs hash calculation on the data in the security zone to obtain a second hash value; the data in the security zone includes key measurement values in the operation of the storage system, and the key measurement values are associated with the security status of the storage system.

[0032] Optionally, the main core includes a security instruction set, which includes at least a SECURE_HASH instruction, a SECURE_ENCRYPT instruction and a TRUST_SWITC instruction; wherein the SECURE_HASH instruction is used to trigger the slave core to enable the first cryptographic algorithm and perform a hash calculation on the data within a first specified address, and the first specified address is the first address that the master core has written in advance to the mailbox register of the main core; the SECURE_ENCRYPT instruction is used to trigger the slave core to enable the second cryptographic algorithm and perform a hash calculation on the data within a second specified address, and the first specified address is the second address that the master core has written in advance to the mailbox register of the main core; the TRUST_SWITC instruction is used to trigger the main core to switch to supervisor mode to limit the main core's access to the data within the security.

[0033] Optionally, the advanced high-performance bus is provided with an arbitration mechanism, which includes a priority policy and a security isolation policy; the priority policy is used to limit the priority of the master core and the slave core's respective access operations to the storage system; the security isolation policy is used to limit the master core and the slave core's respective access rights to various areas in the storage system.

[0034] A chip, wherein the processing system of the chip adopts a master core and a slave core of the RISC-V architecture, and when the processing system starts running, it is used to execute the dual-core heterogeneous security processing method based on the RISC-V architecture.

[0035] The technical solution provided by the present application is that when the processing system is in the startup phase, the main core initializes the advanced high-performance bus and completes the first job through the advanced high-performance bus, and notifies the slave core to start and execute the second job; the main core determines the data integrity verification result of the boot loading process based on the first hash value sent by the slave core; when the processing system is in the operation phase, the slave core determines the scan status configuration based on the load of the processing system; the slave core performs the scan task based on the scan status configuration; the slave core enables the second cryptographic algorithm to encrypt the user data; the slave core enables the first cryptographic algorithm to obtain the second hash value; when the second hash value is different from the dynamic trusted root of the storage system, the slave core sends an exception notification to the main core so that the main core performs exception handling. In the startup phase of the processing system, the main core executes the first job while the slave core executes the second job in parallel to ensure the security and data integrity of the boot loading process loading; in the operation phase of the processing system, the slave core executes the scan task to obtain user data and encrypts the user data to protect the privacy of the user data, and monitors whether the processing system has an abnormality through the dynamic trusted root, thereby effectively improving the data security of the processing system during the startup and operation process. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0037] Figure 1 A schematic diagram of a dual-core heterogeneous security processing method based on the RISC-V architecture provided in an embodiment of the present application;

[0038] Figure 2 A flowchart of another dual-core heterogeneous security processing method based on the RISC-V architecture provided in an embodiment of the present application;

[0039] Figure 3 A flowchart of another dual-core heterogeneous security processing method based on the RISC-V architecture provided in an embodiment of the present application;

[0040] Figure 4 A schematic diagram illustrating the architectural association of a processing system, AHB, and storage system provided in an embodiment of the present application;

[0041] Figure 5 A schematic diagram of the architecture of a chip provided in an embodiment of the present application. DETAILED DESCRIPTION

[0042] The following will be combined with the drawings in the embodiments of this application to clearly and completely describe the technical solutions in the embodiments of this application. Obviously, the embodiments described are only part of the embodiments of this application, not all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of this application.

[0043] In this application, relational terms such as first and second are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations. The terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or apparatus comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or elements inherent to such process, method, article or apparatus. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of other identical elements in the process, method, article or apparatus comprising the element.

[0044] like Figure 1 As shown, it is a flow chart of a dual-core heterogeneous security processing method based on the RISC-V architecture provided in an embodiment of the present application. The method is applied to a processing system, and the processing system includes a master core and a slave core using the RISC-V architecture, including the steps shown below.

[0045] S101: When the processing system is in the startup phase, the master core initializes the advanced high-performance bus, completes a first task via the advanced high-performance bus, and notifies the slave core to start and execute a second task.

[0046] The advanced high-performance bus is used to implement communication between the master core, the slave core, and the storage system. The first operation is used to implement loading of the boot loader process, and the second operation is used to enable the first cryptographic algorithm and obtain the first hash value.

[0047] In some cases, the RISC-V architecture is an open-source instruction set architecture designed based on reduced instruction set principles. The processing system is built on a heterogeneous architecture with dual RISC-V cores, designed to enable different cores (including master and slave cores) to work together to efficiently achieve the coordinated operation of system control and security co-processing.

[0048] In some examples, the main core can use the open source RV32IMAC architecture core. Based on the 32-bit processing power provided by the RV32IMAC architecture core, the main core can handle a variety of computing tasks. The main core can support the basic integer instruction set (capable of performing various basic arithmetic and logical operations), multiplication instruction set (accelerated multiplication-related operations), atomic operation instruction set (ensure the atomicity of specific operations) and compressed instruction set (effectively saving code storage space).

[0049] In some examples, the main core can be set to a frequency of 500MHz. It is fully responsible for logical scheduling, properly arranging the execution order of various tasks, performing task management (including task creation, destruction, and scheduling), and handling routine communication with external devices. During the initial startup of the processing system, the main core can set the clock frequency to ensure that each hardware module runs at an appropriate clock rate. It can also configure the memory map and clarify the purpose and access rights of each memory area (referred to as a zone) in different storage systems, laying a solid foundation for subsequent storage system operation.

[0050] In a possible implementation, the master core (RISC-V Core0) can be considered as the main processor of the processing system, and the slave core (RISC-V Core1) can be considered as the cryptographic coprocessor of the processing system.

[0051] In some examples, the slave core can be built on an open-source RISC-V core and integrate a national cryptographic acceleration module, focusing on hardware acceleration for national cryptographic algorithms such as SM3 (the first cryptographic algorithm) and SM4 (the second cryptographic algorithm). The slave core is a single 32-bit core with a main frequency of 400MHz. The slave core is responsible for cryptographic operations. For example, during the system startup phase, the slave core uses the SM3 algorithm to hash bootloader data (specifically, data from the boot loader process) to verify data integrity. During the system's operation phase, the slave core uses the SM4 algorithm to encrypt critical data (specifically, key metrics during storage system operation) to ensure data transmission and storage security. The slave core also handles storage control, managing access to the storage system by the processing system to ensure that sensitive data within the storage system is not illegally read or tampered with.

[0052] In some examples, a boot loader is a process that runs before the operating system kernel runs. It can initialize hardware devices and establish a memory space mapping map, thereby bringing the operating system's hardware and software environment to a suitable state to prepare the correct environment for the final call to the operating system kernel.

[0053] Optionally, the storage system includes an OTP area, an SRAM area, and a SPIFlash area, the SRAM area includes a non-secure area and a secure area, and the SPIFlash area includes a user data area, a dynamic root area, and a Bootloader area.

[0054] It is understandable that the storage area of the storage system is divided into the OTP area, the SRAM area and the SPIFlash area. Each area has different access control and security features, which can ensure data security and integrity.

[0055] In some examples, the OTP area has a capacity of 128KB and stores the initial root of trust (i.e., fixed root, identifiable as Hash0). The OTP area is exclusively accessible to slave cores via a hardwired connection and cannot be accessed by the master core via the AHB. This fundamentally eliminates the risk of illegal tampering with the fixed root and ensures the security of the initial link of the trust chain of the processing system.

[0056] In some examples, the root key (fixed root) stored in the OTP area can be decentralized, splitting the root key into N parts, and storing the N root key blocks in multiple addresses in the OTP area.

[0057] In some examples, the SRAM area can be designed to have an 8MB capacity, with the secure area set to 2MB and the non-secure area set to 6MB. Generally speaking, the slave cores can access the secure area, which is used to store key metrics during system operation. These metrics provide a reference for determining the security status of the storage system. The master core can only access the non-secure area, which is used to store user data and regular system data. This effectively isolates secure data (i.e., key metrics) from regular data (i.e., user data and regular system data) in the SRAM area.

[0058] In some examples, the SPIFlash area can be set to 256MB of storage space. The master core is granted access only to the user data area, while the slave cores can access all partitions in the SPIFlash area. The dynamic root area can utilize SM4 encryption technology to ensure that data is encrypted in ciphertext during transmission and storage, making it difficult to decrypt even if the data is stolen. Furthermore, the bootloader area utilizes SM3 verification technology to hash the bootloader data (i.e., the data of the bootloader process) to obtain a first hash value. This first hash value can then be used to determine whether the bootloader data has been tampered with, thereby ensuring the reliability of the processing system's startup code.

[0059] In some examples, a dynamic address mapping table for the SPIFlash area can be created to dynamically bind logical addresses to physical addresses, spread write operations across different physical blocks, and extend the life of the SPIFlash area.

[0060] In some examples, the dynamic trusted root in the dynamic root zone may also adopt a differential update mechanism to improve the update efficiency of the dynamic trusted root.

[0061] It should be emphasized that the master core executes the first operation, and the slave core executes the second operation, and the two operation execution processes occur in parallel to ensure that the processing system can be safely started.

[0062] Optionally, the execution steps of the first job include: the main core obtains metadata of the boot loader process from the user data area, and starts DMA transmission based on the metadata; DMA transmission is used to load data of the boot loader process from the Bootloader area to the non-secure area.

[0063] In some examples, the metadata is used to characterize the address and memory size of the data of the boot loader process. Based on the metadata, a DMA transfer is initiated to obtain the data of the boot loader process from the storage system.

[0064] The so-called DMA transmission can be understood as: DMA (Direct Memory Access) is a technology that allows hardware devices to directly access system memory without the intervention of the processor. This technology is mainly used for high-speed data transmission, especially in situations where large amounts of data need to be transmitted.

[0065] In a possible implementation manner, the command for the main core to start DMA transfer may be: DMA_LOAD src=0x0001_0000, dst=0x2000_0000, size=0x8000.

[0066] Optionally, the execution steps of the second job include: obtaining a fixed root from the OTP area from the core, storing the fixed root in the secure area, and monitoring the progress of the DMA transfer. When the progress reaches a specified percentage (for example, 50%), enabling the first cryptographic algorithm, and performing hash calculation on the data of the boot loading process in the non-secure area until the progress reaches 100%, and determining the hash value obtained by the last hash calculation as the first hash value.

[0067] In some examples, the slave core may monitor whether the progress of the DMA transfer reaches 50% by executing a first command (DMA_STATUS_REG[50%]).

[0068] In a possible implementation, assuming that the address range of the data of the boot loading process is 0x2000_0000-0x2000_1000, the slave core may enable the SM3 algorithm to perform hash calculation on the data in the range of 0x2000_0000-0x2000_1000 to obtain a first hash value (which may be identified as Hash1).

[0069] In some examples, AHB (Advanced High-performance Bus) is a high-performance bus standard that is primarily used for efficient connections between processors (ie, processor systems), memories (ie, storage systems), and peripheral devices in embedded systems.

[0070] In some examples, a customized 64-bit AHB can be used as the key communication channel between the master core, slave cores, and storage system. The AHB can include an arbitration mechanism. Given the master core's more critical system control tasks, access operations from the master core can be given priority over those from slave cores. For example, when the master core initiates a critical operation such as a security instruction call, it can take priority over the AHB bus resources, ensuring that critical tasks in the processing system are not hindered and can be executed efficiently.

[0071] Optionally, the advanced high-performance bus is provided with an arbitration mechanism, which includes a priority policy and a security isolation policy. The priority policy is used to limit the priority of the master core and the slave core's respective access operations to the storage system, and the security isolation policy is used to limit the master core and the slave core's respective access rights to various areas in the storage system.

[0072] It is understandable that the advanced high-performance bus has an arbitration mechanism that can ensure orderly communication and storage access operations (i.e., access operations to the storage system) between the master core and the slave core on the AHB.

[0073] In some examples, the arbitration mechanism demonstrates a priority strategy whereby security instructions initiated by the master core (e.g., the SECURE_HASH instruction) are given the highest priority. When the master core invokes such a security instruction, it can immediately preempt the memory access operations of the slave cores. Specifically, if the processing system detects a security risk and urgently needs to calculate the hash value of critical data for verification, the master core's security instructions can be executed first, quickly producing the corresponding verification results and ensuring the security of the processing system.

[0074] In some examples, the priority strategy shown in the arbitration mechanism is that the cryptographic operation request of the slave core (such as the SM3 calculation request) has the second highest priority. Although the priority of the cryptographic operation request is lower than the main core security instruction, it can still ensure orderly execution without blocking the key operations of the main core, thereby maintaining the normal operation of the processing system security function.

[0075] In some examples, the arbitration mechanism demonstrates a secure isolation strategy that strictly restricts the master core's memory access (i.e., limits its access rights) through the Bus Address Mapping Table (BAT). Specifically, when the master core attempts to access the dynamic root area of the SPIFlash region (address range 0x0200_0000-0x02FF_FFFF), the AHB returns a permission denied response message, blocking the master core's unauthorized access to sensitive data at the hardware level. Furthermore, slave cores can directly access the OTP region through internal interfaces, while the master core cannot read data within the OTP region using the AHB, thus enhancing storage system security in multiple dimensions.

[0076] In some examples, both the master core and the slave core are provided with shared registers. The master core communicates with the AHB through its own shared registers to enable the master core to access the storage system. The slave core also communicates with the AHB through its own shared registers to enable the slave core to access the storage system. The shared registers of the master core and the slave core also support direct communication.

[0077] S102: The master core determines a data integrity verification result of the boot loading process based on the first hash value sent by the slave core.

[0078] If the data integrity verification result is passed, the processing system starts running.

[0079] In some examples, if the data integrity verification result is passed, the main core can also switch to supervisor mode and load the OS image (ie, regular system data) of the user data area into the non-secure area to enable the processing system to start running.

[0080] In some examples, Supervisor Mode is a privileged mode used primarily for handling interrupts, exceptions, and accessing protected system resources.

[0081] Optionally, the master core determines the data integrity verification result of the boot loading process based on the first hash value sent by the slave core, which can be found in Figure 2 The steps are shown and the corresponding explanations.

[0082] S103: When the processing system is in the running stage, the slave core determines a corresponding scan state configuration based on the load of the processing system.

[0083] The load of the processing system can be expressed as CPU utilization. The master core and the slave core each share system load information (including CPU utilization) in their shared registers. Therefore, the slave core can obtain the CPU utilization from its own shared register.

[0084] Optionally, the scanning state configuration includes a scanning interval and a scanning range. The lower the load, the longer the scanning interval and the smaller the scanning range. The higher the load, the shorter the scanning interval and the larger the scanning range.

[0085] In some examples, when the load is low, the scanning interval is appropriately extended to 100 milliseconds and the scanning range is narrowed to 1024 bytes to reduce power consumption and improve the energy efficiency of the processing system. When the load is high, the scanning interval is shortened to 10 milliseconds and the scanning range is expanded to 2MB to ensure the security of the processing system.

[0086] In some examples, based on the CPU utilization of the processing system, the slave core can determine whether the processing system has entered idle mode. Specifically, if the CPU utilization meets a specified threshold, the processing system is determined to have entered idle mode. Generally speaking, after determining that the processing system has entered idle mode, the master core and the slave core can be frequency-reduced. By updating the scan state configuration, the frequency reduction settings of the master core and the slave core are implemented. The master core and the slave core will then operate according to the frequency and parameters indicated by the frequency reduction settings.

[0087] S104: The slave core executes the scanning task based on the scanning status configuration.

[0088] The scanning task is used to obtain user data being processed by the processing system.

[0089] It should be noted that during the operational phase of the processing system, the slave cores, based on the scan state configuration, undertake dynamic scanning tasks, effectively safeguarding the security of the processing system. The so-called dynamic means that the scan state configuration is changing.

[0090] S105: The slave core activates a second cryptographic algorithm to encrypt the user data to protect the privacy of the user data.

[0091] Among them, the SM4 algorithm can be enabled from the core to encrypt user data to protect the privacy of user data.

[0092] S106: The slave core activates the first cryptographic algorithm and obtains a second hash value.

[0093] Among them, the SM3 algorithm can be enabled from the core to obtain the second hash value.

[0094] Optionally, the implementation process of enabling the first cryptographic algorithm from the core and obtaining the second hash value can be: enabling the first cryptographic algorithm from the core, performing hash calculation on the data in the security zone to obtain the second hash value; the data in the security zone includes key measurement values in the operation of the storage system, and the key measurement values are associated with the security status of the storage system.

[0095] S107: When the second hash value is different from the dynamic trusted root in the storage system, the slave core sends a corresponding exception notification to the master core, so that the master core performs exception processing.

[0096] Among them, after obtaining the second hash value, the slave core obtains the dynamic trusted root from the dynamic root area, and compares the second hash value with the dynamic trusted root. If the second hash value is the same as the dynamic trusted root, the slave core does not perform any processing, and the processing system maintains normal operation. If the second hash value is different from the dynamic trusted root, the slave core generates a corresponding exception notification (used to notify the processing system that there is an abnormality in the user data currently being processed), and sends the exception notification to the main core, so that the main core performs exception processing (that is, processes the abnormal user data) and promptly blocks potential security risks, thereby effectively improving the security of the processing system during its operation phase.

[0097] In some examples, comparing the second hash value with the dynamic trusted root can be regarded as dynamic trusted root verification. Specifically, if the dynamic trusted root verification succeeds, it means that the second hash value is the same as the dynamic trusted root, and if the dynamic trusted root verification fails, it means that the second hash value is different from the dynamic trusted root.

[0098] In some examples, in order to ensure the reliability of the processing system, a three-level exception response mechanism is designed for the processing system: (1) Temporary freeze: When the dynamic root of trust verification fails for the first time, the AHB is frozen for 10ms, the first cryptographic algorithm is re-enabled from the core, and the second hash value is obtained; (2) Isolated restart: When the dynamic root of trust verification fails for three consecutive times, the data in the non-secure area is cleared and the pure OS image is reloaded from the SPIFlash area; (3) Remote alarm: When the dynamic root of trust verification fails, a corresponding encrypted alarm and failure record log are generated, and the encrypted alarm (including the exception address and timestamp) is sent to the designated terminal through the serial port, and the failure record log is stored in the secure area.

[0099] In some examples, the processing system and the storage system together form an embedded system (or system on chip), which is applicable to the chip. Improving the security of the processing system can improve the security of the chip.

[0100] It should be noted that in order to achieve efficient communication and collaboration between the master core and the slave core, the processing system specifically expands the security instruction set to form a dual-core communication protocol.

[0101] Optionally, the main core includes a security instruction set, which includes at least a SECURE_HASH instruction, a SECURE_ENCRYPT instruction and a TRUST_SWITC instruction; wherein the SECURE_HASH instruction is used to trigger the slave core to enable a first cryptographic algorithm and perform a hash calculation on the data within a first specified address, where the first specified address is a first address that the master core has written in advance to the mailbox register of the main core; the SECURE_ENCRYPT instruction is used to trigger the slave core to enable a second cryptographic algorithm and perform a hash calculation on the data within a second specified address, where the first specified address is a second address that the master core has written in advance to the mailbox register of the main core; the TRUST_SWITC instruction is used to trigger the main core to switch to supervisor mode to limit the main core's access to data within the security zone.

[0102] In some examples, the first address can be CMD = 0x01. The master core sends a SECURE_HASH instruction to the slave core by writing CMD = 0x01 to the mailbox register. After receiving the SECURE_HASH instruction, the slave core uses the SM3 algorithm to perform a hash calculation on the data at address 0x01 and stores the corresponding calculation result (including the first hash value) in a shared register for subsequent reading by the master core, meeting the processing system's requirement for bootloader data integrity verification.

[0103] In some examples, the second address can be CMD = 0x02. When the master core calls the SECURE_ENCRYPT instruction, it sends the SECURE_ENCRYPT instruction to the slave core by writing CMD = 0x02 to the mailbox register. Upon receiving the SECURE_ENCRYPT instruction, the slave core uses the SM4 algorithm to encrypt the data at address 0x02. The encryption key used is the dynamic root of trust obtained by the slave core from the OTP area, ensuring key security and providing security support for system data encryption.

[0104] In some examples, the master core writes to a privileged mode register, triggering it to send a TRUST_SWITCH instruction to a slave core. The slave core responds to the TRUST_SWITCH instruction by switching the master core to supervisor mode, restricting the master core's access to the secure enclave. In certain scenarios, this effectively protects data within the secure enclave from unauthorized access by the master core, improving the overall security of the processing system.

[0105] In some examples, the secure instruction set also includes a SECURE_STATUS instruction, which is used to query the status of the slave core.

[0106] Optionally, both the master core and the slave core are provided with mailbox registers, and the mailbox registers of the master core and the slave core support mutual communication. In addition, the slave core also includes a cryptographic accelerator, which includes a third cryptographic algorithm (such as the SM2 algorithm) for providing signature verification. The master core and the slave core can update the dynamic trusted root pre-stored in the dynamic root zone through the mailbox register. The implementation process of the update process can be found in Figure 3 The steps are shown and the corresponding explanations.

[0107] In some examples, the architectural relationships between the master core, slave core, AHB, and various storage areas in the storage system can be seen in Figure 4 shown. Figure 4 The architecture shown has the following advantages: (1) Enhanced programmability: The slave core based on the open source RISC-V architecture has extremely high programming flexibility. R&D personnel can support new third-party cryptographic algorithms, such as the SM9 algorithm, or add new security protocols by writing new software code. This enables the processing system to flexibly adapt to future changes in security standards and quickly adjust security protection strategies in the face of constantly updated security threats, thereby extending the service life of the processing system and reducing the risk of system obsolescence due to lagging security functions; (2) Lowered design threshold: The processing system adopts the open source RISC-V core, avoiding the complex process of customizing ASIC. By using the ready-made RISC-V core, the development team can quickly build the system framework and shorten the R&D cycle; (3) System scalability: The dual RISC-V core architecture supports dynamic task allocation. The slave core can not only focus on security processing, but also take into account tasks such as communication protocol processing. The processing system can flexibly allocate the resources of the master core and the slave core according to actual business needs, and reasonably allocate different tasks to the corresponding cores for execution, fully tapping the hardware computing power, improving the overall computing power utilization, and responding to the diverse task requirements in different application scenarios.

[0108] As you can understand, the slave core utilizes a single-core RISC-V architecture processor with integrated SM3 / SM4 hardware cores. It communicates with the master core via an AHB slave interface and supports hardware interrupts (via the CALCULATE_DONE instruction) to notify the master core of computation completion. The OTP area of the storage system provides an unalterable, fixed root of trust for the core processing layer. This serves as a verification starting point, ensuring the initial trust consistency between the slave and master cores. This area is one-time programmable, unalterable, and read-only within the slave core. The dynamic root of trust in the SPIFLASH area stores the dynamic root of trust encrypted by the slave core with SM4 enabled. The master core must decrypt the area before use to prevent the dynamic root of trust from being compromised and supports differential data upgrades. The SRAM area provides a secure data scratchpad (key metrics) for the core processing layer. Unauthorized access is prevented by hardware address filtering (e.g., the highest bit identifies the secure zone). Both the master core and the slave core are readable and writable in machine mode. The master core can directly read and write to the user data area and the non-secure area.

[0109] Based on the method shown in the embodiment of the present application, the following beneficial effects can be achieved: (1) the data verification and data loading of the boot loading process are implemented in parallel by using the master core and the slave core, thereby compressing the startup time of the processing system; (2) the scanning state configuration of the slave core is dynamically adjusted to reduce the idle power consumption of the master core and the slave core; (3) the slave core integrates the SM3 algorithm and SM4 to support the custom security instruction extension of the slave core.

[0110] In the process shown in S101-S107 above, during the startup phase of the processing system, the main core executes the first job while the slave core executes the second job in parallel, ensuring the security and data integrity of the boot loading process. During the operation phase of the processing system, the slave core executes a scanning task to obtain user data and encrypts the user data to protect the privacy of the user data. The dynamic trusted root is used to monitor whether the processing system has any abnormalities, thereby effectively improving the data security of the processing system during startup and operation.

[0111] like Figure 2 As shown, it is a flow chart of another dual-core heterogeneous security processing method based on RISC-V architecture provided in an embodiment of the present application, including the following steps.

[0112] S201: After obtaining the first hash value sent by the slave core, the master core obtains the fixed root from the secure area and obtains the preset encryption value from the OTP area.

[0113] The value type of the fixed root is a hash value, and the value type of the preset encryption value is also a hash value.

[0114] S202: The main core performs an XOR operation on the first hash value and the fixed root to obtain a corresponding target encryption value.

[0115] The XOR operation of the first hash value and the fixed root can be expressed as Hash0⊕Hash1.

[0116] S203: The main core determines whether the target encryption value is the same as the preset encryption value.

[0117] If the target encryption value is the same as the preset encryption value, then S204 is executed; if the target encryption value is different from the preset encryption value, then S205 is executed.

[0118] S204: The main core determines that the data integrity verification result of the boot loading process is passed.

[0119] The result of the data integrity verification of the boot loading process is determined to be passed, which means that the data loading process of the boot loading process is reliable and safe, and no abnormality occurs in the processing system.

[0120] S205: The main core determines that the data integrity verification result of the boot loading process is failed.

[0121] The data integrity verification result of the boot loading process fails, which means that the data loading process of the boot loading process is unreliable and unsafe, and an abnormality occurs in the processing system.

[0122] In some examples, if the main core determines that the data integrity verification result of the boot loading process fails, the main core triggers a safe restart mechanism to restart the processing system to ensure the security of the processing system.

[0123] The process shown in S201-S205 above can use the first hash value to detect whether the data loading process of the boot loading process is reliable and safe, thereby effectively improving the security of the startup phase of the processing system.

[0124] like Figure 3 As shown, it is a flow chart of another dual-core heterogeneous security processing method based on RISC-V architecture provided in an embodiment of the present application, including the following steps.

[0125] S301: When the master core detects a key update event, the master core generates a corresponding key update request and loads the key update request into a mailbox register of the master core, so that the mailbox register of the master core sends the key update request to the mailbox register of the slave core.

[0126] The key update request includes a new trusted root, which contains n+m bytes, where n and m are both positive integers.

[0127] In some examples, the value type of the new root of trust is a hash value.

[0128] In some examples, n may be set to 16 and m may be set to 16.

[0129] It can be understood that the master core generates a corresponding key update request and loads the key update request into the mailbox register of the master core, so that the mailbox register of the master core sends the key update request to the mailbox register of the slave core, triggering the slave core to update the dynamic root of trust, thereby realizing key update collaboration. Key update is of great significance to the security of the processing system. The master core and the slave core work together to realize key update, which can effectively ensure the execution of key update.

[0130] S302: After receiving the key update request, the slave core obtains the dynamic trusted root from the dynamic root zone.

[0131] The dynamic root of trust contains n+m bytes.

[0132] In some examples, the value type of the dynamic root of trust is a hash value.

[0133] S303: The slave core compares the first n bytes of the new trusted root with the first n bytes of the dynamic trusted root to obtain a corresponding byte comparison result.

[0134] The first 16 bytes of the new trusted root can be compared with the first 16 bytes of the dynamic trusted root in a one-to-one correspondence to obtain corresponding byte comparison results.

[0135] S304: If the byte comparison result is the same, the slave core uses the last m bytes of the new trusted root to update the last m bytes of the dynamic trusted root in the dynamic root zone.

[0136] Among them, if the byte comparison results are the same, the slave core only needs to update the last m bytes of the dynamic trusted root, effectively reducing the amount of data written and shortening the update time of the dynamic trusted root.

[0137] S305: If the byte comparison result is different, the slave core uses all bytes of the new trusted root to update all bytes of the dynamic trusted root in the dynamic root zone.

[0138] Among them, if the byte comparison result is different, the slave core needs to fully update the dynamic trusted root, that is, use all bytes of the new trusted root to update all bytes of the dynamic trusted root in the dynamic root area.

[0139] S306: After completing the update of the dynamic trusted root in the dynamic root zone, the slave core uses the cryptographic accelerator to perform signature verification on the updated dynamic trusted root to legitimize the key update event.

[0140] Among them, the core uses a cryptographic accelerator to perform signature verification on the updated dynamic trusted root to legalize the key update event and avoid the security risks caused by illegal key updates.

[0141] The process shown in S301-S306 above can achieve key update collaboration between the master core and the slave core, thereby improving the security of the dynamic root of trust, and further providing improved reliability of data encryption in the processing system and ensuring the security of user data.

[0142] like Figure 5 FIG. 1 is a schematic diagram of the architecture of a chip provided in an embodiment of the present application, including the modules shown below.

[0143] The chip's processing system uses a master core 100 and a slave core 200 based on the RISC-V architecture.

[0144] The main core 100 is used to: when the processing system is in the startup phase, initialize the advanced high-performance bus, complete the first job through the advanced high-performance bus, and notify the slave core 200 to start and execute the second job; the advanced high-performance bus is used to realize communication between the main core 100, the slave core 200 and the storage system; the first job is used to realize the loading of the boot loading process; the second job is used to enable the first cryptographic algorithm and obtain the first hash value; based on the first hash value sent by the slave core 200, determine the data integrity verification result of the boot loading process; wherein, if the data integrity verification result is passed, the processing system starts to run; respond to the exception notification and perform exception handling.

[0145] The slave core 200 is used to: execute the second job; when the processing system is in the running stage, determine the corresponding scan status configuration based on the load of the processing system; execute the scan task based on the scan status configuration; the scan task is used to obtain user data being processed by the processing system; enable the second cryptographic algorithm to encrypt the user data to protect the privacy of the user data; enable the first cryptographic algorithm to obtain a second hash value; when the second hash value is different from the dynamic trusted root in the storage system, the slave core 200 sends a corresponding exception notification to the main core 100, so that the main core 100 performs exception processing.

[0146] Optionally, the storage system includes an OTP area, an SRAM area, and a SPIFlash area, the SRAM area includes a non-secure area and a secure area, and the SPIFlash area includes a user data area, a dynamic root area, and a Bootloader area.

[0147] The execution steps of the first operation include: the main core 100 obtains metadata of the boot loader process from the user data area, and starts DMA transmission according to the metadata; the DMA transmission is used to load the data of the boot loader process from the Bootloader area to the non-secure area.

[0148] The execution steps of the second job include: obtaining the fixed root from the OTP area from the core 200, storing the fixed root in the secure area, and monitoring the progress of the DMA transfer. When the progress reaches a specified percentage, the first cryptographic algorithm is enabled to perform hash calculation on the data of the boot loading process in the non-secure area until the progress reaches 100%. The hash value obtained by the last hash calculation is determined as the first hash value.

[0149] Optionally, both the master core 100 and the slave core 200 are provided with mailbox registers, and the mailbox registers of the master core 100 and the slave core 200 support mutual communication.

[0150] The main core 100 is also used to: when a key update event is detected, generate a corresponding key update request, and load the key update request into the mailbox register of the main core 100, so that the mailbox register of the main core 100 sends the key update request to the mailbox register of the slave core 200; the key update request includes a new trusted root; the new trusted root contains n+m bytes; n and m are both positive integers.

[0151] The slave core 200 is also used to: obtain a dynamic trusted root from the dynamic root zone after obtaining a key update request; the dynamic trusted root contains n+m bytes; compare the first n bytes of the new trusted root with the first n bytes of the dynamic trusted root to obtain a corresponding byte comparison result; if the byte comparison result is the same, use the last m bytes of the new trusted root to update the last m bytes of the dynamic trusted root in the dynamic root zone; if the byte comparison result is different, use all bytes of the new trusted root to update all bytes of the dynamic trusted root in the dynamic root zone.

[0152] Optionally, the slave core 200 further includes a cryptographic accelerator comprising a third cryptographic algorithm for providing signature verification.

[0153] The slave core 200 is further configured to: after completing the update of the dynamic trusted root in the dynamic root zone, use the cryptographic accelerator to perform signature verification on the updated dynamic trusted root to legitimize the key update event.

[0154] Optionally, the main core 100 is specifically used to: perform an XOR operation on the first hash value and the fixed root to obtain a corresponding target encryption value; if the target encryption value is the same as the preset encryption value, determine that the data integrity verification result of the boot loading process is passed; if the target encryption value is not the same as the preset encryption value, determine that the data integrity verification result of the boot loading process is failed.

[0155] Optionally, the scanning state configuration includes a scanning interval and a scanning range; the lower the load, the longer the scanning interval and the smaller the scanning range; the higher the load, the shorter the scanning interval and the larger the scanning range.

[0156] Optionally, the slave core 200 is specifically used to: enable a first cryptographic algorithm, perform hash calculation on the data in the security zone to obtain a second hash value; the data in the security zone includes key measurement values in the operation of the storage system, and the key measurement values are associated with the security status of the storage system.

[0157] Optionally, the main core 100 includes a security instruction set, which includes at least a SECURE_HASH instruction, a SECURE_ENCRYPT instruction and a TRUST_SWITC instruction; wherein the SECURE_HASH instruction is used to trigger the slave core 200 to enable a first cryptographic algorithm and perform a hash calculation on the data within a first specified address, and the first specified address is the first address that the main core 100 pre-writes to the mailbox register of the main core 100; the SECURE_ENCRYPT instruction is used to trigger the slave core 200 to enable a second cryptographic algorithm and perform a hash calculation on the data within a second specified address, and the first specified address is the second address that the main core 100 pre-writes to the mailbox register of the main core 100; the TRUST_SWITC instruction is used to trigger the main core 100 to switch to supervisor mode to limit the main core 100's access to data within the security.

[0158] Optionally, the advanced high-performance bus is provided with an arbitration mechanism, which includes a priority policy and a security isolation policy; the priority policy is used to limit the priority of the master core 100 and the slave core 200's respective access operations to the storage system; the security isolation policy is used to limit the master core 100 and the slave core 200's respective access rights to various areas in the storage system.

[0159] Based on the architecture of the chip shown above, during the startup phase of the processing system, the main core executes the first job while the slave core executes the second job in parallel, ensuring the security and data integrity of the boot loader process. During the operation phase of the processing system, the slave core performs scanning tasks to obtain user data and encrypts the user data to protect the privacy of the user data. The dynamic trusted root is used to monitor whether the processing system has any abnormalities, thereby effectively improving the data security of the processing system during startup and operation.

[0160] Although several specific implementation details are included in the above discussion, these should not be construed as limiting the scope of this application. Certain features described in the context of separate embodiments may also be implemented in combination in a single embodiment. Conversely, various features described in the context of a single embodiment may also be implemented in multiple embodiments individually or in any suitable sub-combination.

[0161] The above description is merely a preferred embodiment of the present application and an illustration of the technical principles employed. Those skilled in the art should understand that the scope of the disclosure herein is not limited to technical solutions formed by specific combinations of the aforementioned technical features. It also encompasses other technical solutions formed by any combination of the aforementioned technical features or their equivalents, without departing from the aforementioned disclosure. For example, a technical solution formed by replacing the aforementioned features with (but not limited to) technical features with similar functions disclosed in this application.

Claims

1. A dual-core heterogeneous security processing method based on RISC-V architecture, characterized in that: Applied to a processing system comprising a master core and a slave core using a RISC-V architecture, the method comprises: When the processing system is in a startup phase, the master core initializes an advanced high-performance bus, completes a first operation through the advanced high-performance bus, and notifies the slave core to start and execute a second operation; the advanced high-performance bus is used to implement communication between the master core, the slave core, and the storage system; the first operation is used to implement loading of a boot loader process; the second operation is used to enable a first cryptographic algorithm and obtain a first hash value; The master core determines a data integrity verification result of the boot loading process based on the first hash value sent by the slave core; wherein, if the data integrity verification result is passed, the processing system starts running; When the processing system is in the running stage, the slave core determines a corresponding scan state configuration based on the load of the processing system; The slave core executes a scanning task based on the scanning state configuration; the scanning task is used to obtain user data being processed by the processing system; The slave core activates a second cryptographic algorithm to encrypt the user data to protect the privacy of the user data; The slave core activates the first cryptographic algorithm to obtain a second hash value; In a case where the second hash value is different from the dynamic trusted root in the storage system, the slave core sends a corresponding exception notification to the master core, so that the master core performs exception processing.

2. The method according to claim 1, characterized in that The storage system includes an OTP area, an SRAM area and a SPIFlash area, the SRAM area includes a non-secure area and a secure area, and the SPIFlash area includes a user data area, a dynamic root area and a Bootloader area; The execution step of the first job includes: the main core obtaining metadata of the boot loader process from the user data area, and starting DMA transmission according to the metadata; the DMA transmission is used to load the data of the boot loader process from the bootloader area to the non-secure area; The execution steps of the second job include: the slave core obtains the fixed root from the OTP area, stores the fixed root in the secure area, and monitors the progress of the DMA transfer; when the progress reaches a specified percentage, enables the first cryptographic algorithm, and performs hash calculation on the data of the boot loading process in the non-secure area; when the progress reaches 100%, the hash value obtained by the last hash calculation is determined as the first hash value.

3. The method according to claim 2, characterized in that The master core and the slave core are both provided with mailbox registers, and the mailbox registers of the master core and the slave core support mutual communication, and the method further includes: When the master core detects a key update event, the master core generates a corresponding key update request and loads the key update request into a mailbox register of the master core, so that the mailbox register of the master core sends the key update request to the mailbox register of the slave core; the key update request includes a new trusted root; the new trusted root includes n+m bytes; n and m are both positive integers; After receiving the key update request, the slave core obtains a dynamic trusted root from the dynamic root zone; the dynamic trusted root includes n+m bytes; The slave core compares the first n bytes of the new trusted root with the first n bytes of the dynamic trusted root to obtain corresponding byte comparison results; If the byte comparison result is the same, the slave core uses the last m bytes of the new trusted root to update the last m bytes of the dynamic trusted root in the dynamic root zone; If the byte comparison result is different, the slave core uses all bytes of the new trusted root to update all bytes of the dynamic trusted root in the dynamic root zone.

4. The method according to claim 3, characterized in that The slave core further includes a cryptographic accelerator, the cryptographic accelerator including a third cryptographic algorithm for providing signature verification, and the method further includes: After completing the update of the dynamic trusted root in the dynamic root zone, the slave core uses the cryptographic accelerator to perform signature verification on the updated dynamic trusted root to legitimize the key update event.

5. The method according to claim 2, characterized in that The master core determines, based on the first hash value sent by the slave core, a data integrity verification result of the boot loading process, including: After obtaining the first hash value sent by the slave core, the master core obtains the fixed root from the security zone and obtains the preset encryption value from the OTP area; The main core performs an XOR operation on the first hash value and the fixed root to obtain a corresponding target encrypted value; If the target encryption value is the same as the preset encryption value, the main core determines that the data integrity verification result of the boot loading process is passed; If the target encryption value is different from the preset encryption value, the main core determines that the data integrity verification result of the boot loading process is failed.

6. The method according to claim 1, characterized in that The scanning state configuration includes a scanning interval and a scanning range; the lower the load, the longer the scanning interval and the smaller the scanning range; the higher the load, the shorter the scanning interval and the larger the scanning range.

7. The method according to claim 2, characterized in that The slave core enabling the first cryptographic algorithm to obtain a second hash value includes: The slave core enables the first cryptographic algorithm and performs hash calculation on the data in the security zone to obtain a second hash value; the data in the security zone includes key measurement values in the operation of the storage system, and the key measurement values are associated with the security status of the storage system.

8. The method according to claim 3, characterized in that The main core includes a security instruction set, which includes at least a SECURE_HASH instruction, a SECURE_ENCRYPT instruction and a TRUST_SWITC instruction; wherein the SECURE_HASH instruction is used to trigger the slave core to enable the first cryptographic algorithm and perform a hash calculation on the data within a first specified address, where the first specified address is the first address written in advance by the master core to the mailbox register of the main core; the SECURE_ENCRYPT instruction is used to trigger the slave core to enable the second cryptographic algorithm and perform a hash calculation on the data within a second specified address, where the first specified address is the second address written in advance by the master core to the mailbox register of the main core; the TRUST_SWITC instruction is used to trigger the master core to switch to supervisor mode to limit the master core's access to the data within the security.

9. The method according to claim 1, characterized in that The advanced high-performance bus is provided with an arbitration mechanism, which includes a priority policy and a security isolation policy; the priority policy is used to limit the priority of the master core and the slave core's respective access operations to the storage system; the security isolation policy is used to limit the master core and the slave core's respective access rights to various areas in the storage system.

10. A chip, characterized in that: The processing system of the chip adopts a master core and a slave core of a RISC-V architecture. When the processing system starts running, it is used to execute the dual-core heterogeneous security processing method based on the RISC-V architecture described in any one of claims 1 to 9.

Images