A method for global memory protection in MCU chips

Abstract

This invention discloses a method for global memory protection of an MCU chip. The MCU chip has a preset number of host modules and a preset number of memories, as well as a protection module. Each host module is electrically connected to the protection module, and each memory is electrically connected to the protection module via a bus. This method protects the global memory of the MCU chip by placing the protection module between the host module and the bus. Furthermore, it provides multi-dimensional protection logic, thereby improving the protection effect and security. For unauthorized access, the access reaches the protection module after passing through the host module. If the access is deemed unauthorized, the access is immediately abandoned, thus shortening the logical path of unauthorized access, addressing access bottlenecks, and improving access performance.

Description

Technical Field

[0001] This invention belongs to the field of computer protection technology, specifically relating to a method for global protection of the memory of an MCU chip. Background Technology

[0002] As MCU systems become more integrated, more and more modules are integrated on the bus, including the on-chip and off-chip memory of slave devices, the CPU, DMA, debug port, and so on of master devices. In addition to traditional EEPROM (Electrically Erasable Programmable Read-Only Memory) and eflash (Non-Volatile Memory), there are also more and more storage options for running programs, including dedicated memory controller RAM, external eflash connected via QSPI, and so on.

[0003] like Figure 1 As shown, in existing technologies, protection logic is typically tightly coupled to the eFlash storage / controller. A code read protection module (i.e., protection logic) is added inside the MCU, and a read protection security field is set within the code read protection module. If the read protection mode is enabled, illegal read / write operations on FLASH and SRAM in debug mode will be discarded by the code read protection module. If the read protection mode is disabled, the code read protection module will automatically trigger FLASH erasure. In existing technologies, the access path starts from the CPU and follows the path of CPU->bus->protection logic->storage controller->memory. However, this approach can only protect the eFlash storage / controller from illegal read / write access from the bus, failing to protect other storage devices and making it difficult to extend protection to other storage devices. It also lacks global, multi-dimensional protection for storage devices. Furthermore, the illegal access path originates from the CPU, passes through the bus, and reaches the eFLASH storage device. If it is an illegal access, the access path will be very long, which is detrimental to the overall access performance. Summary of the Invention

[0004] The purpose of this invention is to address the problems mentioned in the background art by proposing a method for global protection of the memory in MCU chips.

[0005] To achieve the above objectives, the technical solution adopted by the present invention is as follows:

[0006] The present invention proposes a method for global protection of memory in an MCU chip, wherein the MCU chip is provided with a preset number of host modules and a preset number of memory modules, as well as a protection module. Each host module is electrically connected to the protection module, and each memory module is electrically connected to the protection module via a bus.

[0007] Each memory is pre-divided into different regions, and the protection module configures different protection information for each region and establishes a mapping table between each region and the protection information;

[0008] When an access to memory is initiated through each host module, for each host module:

[0009] The protection module receives access from the current host module and determines the type of the current access;

[0010] When the access type is instruction type, the protection module stores the first information related to the current access in the database, and the protection module transmits the current access to the corresponding memory through the bus to realize the access. For the same host module, the database only stores the first information related to the latest instruction type access.

[0011] When the access type is a data type, the protection module obtains the second information related to the current access.

[0012] Both the first and second information include the host module ID corresponding to the current access and the region where the current access is located;

[0013] The protection module determines whether the area where the memory is located in the second information related to the current access is configured with protection information based on the mapping table. If no protection information is configured, the protection module will pass the current access to the corresponding memory through the bus to realize the access.

[0014] When protection information is configured, the protection module reads the protection information and searches the database for the first information with the same host module ID as the second information related to the current access. It then obtains the protection information corresponding to the found first information based on the mapping table.

[0015] The system determines whether the protection information corresponding to the second information related to the current access belongs to the protection information obtained from the mapping table. If it does, the protection module will pass the current access to the corresponding memory through the bus to realize the access. If it does not belong, the current access is illegal and the current access is abandoned.

[0016] Preferably, for an access initiated by the host module, it is first an access of the instruction type. The host module parses the access of the current instruction type and determines whether the access of the current instruction type is a data processing instruction based on the parsed content.

[0017] When processing a data type instruction, an access to the data type related to the current instruction type is initiated, and the current instruction type access includes the accessed object, i.e., memory information.

[0018] When the instruction is not a data processing instruction, there is no need to initiate a data type access.

[0019] Preferably, the protection module includes multiple host sub-units, slave sub-units corresponding one-to-one with each host sub-unit, a safety unit electrically connected to each host sub-unit and slave sub-unit respectively, and a configuration unit electrically connected to the bus, wherein each slave sub-unit is electrically connected to the bus.

[0020] Each host subunit can receive access based on both instruction type and data type, and each host module is electrically connected to a host subunit in a one-to-one correspondence.

[0021] Preferably, the protection information includes two dimensions: mutually independent protection domains and protection levels. The protection domains have multiple categories, represented as {protection domain 1, protection domain 2, ... protection domain n}, where the protection levels of the n categories of protection domains are consistent. For areas where no protection domains are configured, the protection domains of these areas are called common domains, and the protection levels of the common domains are all lower than the protection levels of protection domain 1, protection domain 2, ... and protection domain n.

[0022] There are multiple protection levels, represented as {Protection Level 1, Protection Level 2, ... Protection Level n}. The protection level relationship among the multiple protection levels is: Protection Level 1 < Protection Level 2 < ... < Protection Level n. For areas without configured protection levels, the protection level of the area is called the common level, and the protection level of the common level is lower than the protection level of protection domain 1.

[0023] When configuring protection information for a region, the configuration unit configures it according to the first rule, which is: randomly select a type of protection domain for configuration; and select the corresponding protection level for configuration based on the pre-set importance level of the region.

[0024] Preferably, the protection module configures different protection information for each area, including:

[0025] The configuration unit of the protection module configures different protection information for each region. When configuring each region:

[0026] The configuration unit determines whether protection information exists in the current area. If no protection information exists, it selects the protection domain and protection level as candidate protection information according to the first rule. The configuration unit then determines whether the protection domain in the candidate protection information already exists in other areas. If the protection domain in the candidate protection information already exists in other areas, the configuration unit triggers an exception, prompts a configuration failure, and erases the data in the memory of the current area.

[0027] If the protection domain in the candidate protection information does not exist in other areas, the configuration unit configures according to the candidate protection information to complete the protection information configuration for the current area;

[0028] When protection information exists, the configuration unit determines whether the protection domain category needs to be changed. If it determines that the protection domain category needs to be changed, the configuration unit triggers an exception, prompts a configuration failure, and erases the data in the memory of the current area.

[0029] If it is determined that the protection domain category does not need to be changed, the configuration unit determines whether the protection level needs to be reduced. If it is determined that the protection level needs to be reduced, the configuration unit triggers an exception, prompts a configuration failure, and erases the data in the memory of the current area.

[0030] When it is determined that the protection level does not need to be lowered, the configuration unit determines whether it is permissible to raise the protection level. If it is determined that the protection level is permissible to raise the protection level, the configuration unit configures the protection level according to the permissible level and completes the protection information configuration for the current area.

[0031] If it is determined that the protection level cannot be upgraded, the configuration unit will trigger an exception and indicate that the configuration failed.

[0032] After the protection information configuration for the current area is completed, the configuration unit establishes a mapping relationship between the current area and the configured protection information and stores it in the mapping table.

[0033] Preferably, the protection module receives access from the current host module and determines the type of the current access, including:

[0034] The host subunit in the protection module receives access from the corresponding host module, and the host subunit sends the received access to the security unit. The security unit determines the type of the current access. Since the access carries the type information of the current access, the security unit directly determines the type of the current access based on the information carried in the access.

[0035] Preferably, the security unit in the protection module stores the first information related to the current instruction type access to the database, and during the storage process, updates and replaces the existing first information of the same host module in the database with the first information related to the current instruction type access.

[0036] When the protection module obtains the second information related to the current access, the security unit in the protection module performs the acquisition.

[0037] During the access process, the security unit in the protection module transmits the current access to the corresponding slave sub-unit, which then transmits it to the corresponding memory via the bus to realize the access.

[0038] Preferably, during the process of the protection module determining whether the area where the memory is located in the second information related to the current access is configured with protection information according to the mapping table, the security unit in the protection module searches the mapping table to see if the area where the memory is located in the second information related to the current access is configured with protection information. When protection information is configured, the security unit reads the protection information and calls it the first protection information. It then searches the database for the first information with the same host module ID as the second information related to the current access, obtains the area where the memory is located in the first information, and obtains the protection information corresponding to the area where the memory is located according to the mapping table, which is called the second protection information.

[0039] The security unit determines whether the protection domain in the first protection information is the same as the protection domain in the second protection information, or whether the protection level of the protection domain in the first protection information is lower than the protection level of the protection domain in the second protection information.

[0040] If the conditions are not met, the current access is considered illegal and the current access is abandoned. If the conditions are met, the security unit then determines whether the protection level of the protection level in the first protection information is less than or equal to the protection level of the protection level in the second protection information.

[0041] If the conditions are not met, the current access is considered illegal and is abandoned. If the conditions are met, the security unit passes the current access to the corresponding slave sub-unit, which then passes it to the corresponding memory via the bus to enable access.

[0042] Compared with the prior art, the beneficial effects of the present invention are as follows:

[0043] This MCU chip global memory protection method protects the MCU chip's global memory by integrating a protection module between the host module and the bus. Furthermore, it provides multi-dimensional protection logic, thereby improving protection effectiveness and security. For unauthorized access, the access reaches the protection module after passing through the host module. If the access is deemed unauthorized, it is immediately abandoned, thus shortening the logical path of unauthorized access, addressing access bottlenecks, and improving access performance. Attached Figure Description

[0044] Figure 1 This is a schematic diagram of a module in an existing MCU chip memory protection scheme.

[0045] Figure 2 This is a schematic diagram of the module of the MCU chip global protection memory method of the present invention;

[0046] Figure 3 This is a schematic diagram of the protection module of the present invention;

[0047] Figure 4This is a schematic diagram illustrating the process of configuring protection information for each region by the configuration unit of the present invention;

[0048] Figure 5 This is a schematic diagram illustrating the process by which the protection module implements protection when the memory is accessed, as per the present invention. Detailed Implementation

[0049] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0050] In one embodiment, such as Figures 2-5 As shown, a method for global protection of memory in an MCU chip is provided. The MCU chip has a preset number of host modules and a preset number of memories, as well as a protection module. Each host module is electrically connected to the protection module, and each memory is electrically connected to the protection module through a bus. It should be noted that in this embodiment, the host module can be a CPU, DMA, etc., and the memory can be internal memory (non-volatile memory eFlash, static random access memory SRAM) or external memory (such as random access memory RAM, read-only memory ROM, non-volatile memory NOR FLASH, non-volatile memory NAND FLASH), etc.

[0051] The protection module includes multiple host sub-units, slave sub-units corresponding to each host sub-unit, safety units electrically connected to each host sub-unit and slave sub-unit respectively, and configuration units electrically connected to the bus, and each slave sub-unit is electrically connected to the bus.

[0052] In this embodiment, each host subunit can receive both command-type and data-type accesses, and each host module is electrically connected to a host subunit in a one-to-one correspondence (at this time, each host subunit can receive both command-type and data-type accesses). However, a host module can also determine the number of host subunits it connects to based on the number and attributes of its interfaces. For example, if a host module has two interfaces, one for sending command-type accesses and the other for sending data-type accesses, then each of the host module's two interfaces needs to be connected to a host subunit. The two connected host subunits, for that host, will then be used differently: one for receiving command-type accesses and the other for receiving data-type accesses. In this embodiment, we will illustrate the example of each host module connecting to a host subunit through one interface (which can receive both command-type and data-type accesses).

[0053] The global memory protection method for this MCU chip includes:

[0054] Step 1: Each memory is pre-divided into different regions (where a region can contain multiple memories or one memory, or it can be a part of the storage space containing memories, and different importance levels are pre-set for each region, such as importance level 1 for region 1, importance level 2 for region 2, and so on, with importance level n for region n, and the hierarchy between importance levels is: importance level 1 < importance level 2 < ... < importance level n). The protection module configures different protection information for each region and establishes a mapping table between each region and the protection information.

[0055] The protection information includes two independent dimensions: protection domains and protection levels (i.e., protection domains and protection levels do not interfere with each other; when configuring protection information for a certain area, only the protection domain can be configured without configuring the protection level, or only the protection level can be configured without configuring the protection domain). There are multiple categories of protection domains, represented as {protection domain 1, protection domain 2, ... protection domain n}, where the protection levels of the n categories of protection domains are consistent. For areas where no protection domains are configured, the protection domains of that area are called common domains, and the protection levels of common domains are all lower than the protection levels of protection domain 1, protection domain 2, ... and protection domain n.

[0056] There are multiple protection levels, represented as {Protection Level 1, Protection Level 2, ... Protection Level n}. The protection level relationship among the multiple protection levels is: Protection Level 1 < Protection Level 2 < ... < Protection Level n. For areas without configured protection levels, the protection level of the area is called the common level, and the protection level of the common level is lower than the protection level of protection domain 1.

[0057] It should be noted that the protection areas (excluding public domains) in the protection information configured in different regions cannot be duplicated, but the protection levels can be duplicated.

[0058] When configuring protection information for a region, the configuration unit configures it according to the first rule, which is: randomly select a type of protection domain for configuration; and select the corresponding protection level for configuration based on the pre-set importance level of the region.

[0059] The protection module configures different protection information for each area, including:

[0060] like Figure 4 As shown, the configuration unit of the protection module configures different protection information for each area. When configuring each area:

[0061] The configuration unit determines whether protection information exists in the current area. If no protection information exists, it selects the protection domain and protection level as candidate protection information according to the first rule. The configuration unit then determines whether the protection domain in the candidate protection information already exists in other areas. If the protection domain in the candidate protection information already exists in other areas, the configuration unit triggers an exception, prompts a configuration failure, and erases the data in the memory of the current area (to prevent information leakage). That is, the protection domain categories configured in all areas are different from each other.

[0062] If the protection domain in the candidate protection information does not exist in other areas, the configuration unit configures according to the candidate protection information to complete the protection information configuration for the current area;

[0063] When protection information exists, the configuration unit determines whether the protection domain category needs to be changed. If it determines that the protection domain category needs to be changed, the configuration unit triggers an exception, prompts a configuration failure, and erases the data in the memory of the current area.

[0064] If it is determined that the protection domain category does not need to be changed, the configuration unit determines whether the protection level needs to be reduced. If it is determined that the protection level needs to be reduced, the configuration unit triggers an exception, prompts a configuration failure, and erases the data in the memory of the current area.

[0065] When it is determined that the protection level does not need to be lowered, the configuration unit determines whether it is permissible to raise the protection level. If it is determined that the protection level is permissible to raise the protection level, the configuration unit configures the protection level according to the permissible level and completes the protection information configuration for the current area.

[0066] If it is determined that the protection level cannot be upgraded, the configuration unit will trigger an exception and indicate that the configuration failed.

[0067] After the protection information configuration for the current area is completed, the configuration unit establishes a mapping relationship between the current area and the configured protection information and stores it in the mapping table.

[0068] Step 2: When each host module initiates access to the memory, steps 2.1-2.6 are performed for each host module to protect the corresponding memory.

[0069] It should be noted that for an access initiated through the host module, it is first an access of the command type. The host module parses the access of the current command type and determines whether the access of the current command type is a data processing command based on the parsed content.

[0070] When processing a data type instruction, an access to the data type related to the current instruction type is initiated (and this access is to the same host module as the current instruction type access). The current instruction type access includes the accessed object, i.e., memory information (indicating which memory the data type access is targeting). Regardless of whether it's an instruction type access or a data type access, the process is judged according to steps 2.1-2.6 (e.g., ...). Figure 5 (as shown)

[0071] When the instruction is not a data-processing instruction, there is no need to initiate a data type access again; preparation will proceed for the next access.

[0072] Step 2.1: The protection module receives access from the current host module and determines the type of access, specifically including:

[0073] The host subunit in the protection module receives access from the corresponding host module, and the host subunit sends the received access to the security unit. The security unit determines the type of the current access. Since the access carries the type information of the current access, the security unit directly determines the type of the current access based on the information carried in the access.

[0074] Step 2.2: When the access type is instruction type, the protection module (the security unit in it) stores the first information related to the current access in the database (the first information includes the host module ID corresponding to the current access and the area where the memory corresponding to the current access is located), and the protection module (the security unit in it) transmits the current access to the corresponding memory through the bus to realize the access (the security unit transmits the current access to the corresponding slave sub-unit, and the slave sub-unit then transmits it to the corresponding memory through the bus to realize the access). For the same host module, the database only stores the first information related to the latest instruction type access (that is, in the process of storing to the database, the first information related to the current instruction type access is used to update and replace the existing first information of the same host module in the database).

[0075] Step 2.3: When the access type is a data type, the protection module (the security unit in it) obtains the second information related to the current access (the second information includes the host module ID corresponding to the current access and the area where the memory corresponding to the current access is located).

[0076] Step 2.4: The protection module (security unit) determines whether the area where the memory is located in the second information related to the current access is configured with protection information according to the mapping table. If no protection information is configured, the protection module (security unit) will pass the current access to the corresponding memory through the bus to realize the access (the security unit passes the current access to the corresponding slave sub-unit, and the slave sub-unit then passes it to the corresponding memory through the bus to realize the access).

[0077] Step 2.5: When protection information is configured, read the protection information and the protection module (security unit in it) searches the database for the first information that is the same as the host module ID in the second information related to the current access, and obtains the protection information corresponding to the found first information according to the mapping table;

[0078] Step 2.6: Determine whether the protection information corresponding to the second information related to the current access belongs to the protection information obtained from the mapping table. If it belongs, the protection module (security unit in it) will pass the current access to the corresponding memory through the bus to realize the access. If it does not belong, the current access is illegal and the current access is abandoned.

[0079] It should be noted that during the process of the protection module determining whether the area where the memory is located in the second information related to the current access is configured with protection information according to the mapping table, the security unit in the protection module searches the mapping table to see if the area where the memory is located in the second information related to the current access is configured with protection information. When protection information is configured, the security unit reads the protection information and calls it the first protection information. It then searches the database for the first information with the same host module ID as the second information related to the current access, obtains the area where the memory is located in the first information, and obtains the protection information corresponding to the area where the memory is located according to the mapping table, which is called the second protection information.

[0080] The process by which the security unit determines whether the protection information corresponding to the second information related to the current access belongs to the protection information obtained from the mapping table is as follows:

[0081] The security unit determines whether the protection domain in the first protection information is the same as the protection domain in the second protection information (both can be protection domain 1, protection domain 2, ..., or protection domain n, or both can be common domains), or whether the protection level of the protection domain in the first protection information is lower than the protection level of the protection domain in the second protection information (i.e., in this case, the protection domain in the first protection information is a common domain, and the protection domain in the second protection information is protection domain 1, protection domain 2, ..., or protection domain n; if both of these conditions are negative, the condition is not satisfied; if one of these conditions is positive, the condition is satisfied).

[0082] If the conditions are not met, the current access is considered illegal and the current access is abandoned. If the conditions are met, the security unit then determines whether the protection level of the protection level in the first protection information is less than or equal to the protection level of the protection level in the second protection information.

[0083] If the conditions are not met, the current access is considered illegal and is abandoned. If the conditions are met, the security unit passes the current access to the corresponding slave sub-unit, which then passes it to the corresponding memory via the bus to enable access.

[0084] Specifically, if the current access is determined to be illegal, the security unit interrupts the access to protect the memory and returns the illegal access message to the host module.

[0085] In this embodiment, each memory is electrically connected to the bus through a memory controller (e.g., the memory controller for external memory is QSPI, FMC, or FSMC, the memory controller for internal memory is an eFLASH memory controller, and the SRAM memory is directly connected to the bus). In the process of the slave unit transmitting the current access to the corresponding memory through the bus, the slave unit first transmits the current access to the corresponding memory controller through the bus, and then the memory controller transmits the current access to the memory to realize the access.

[0086] This MCU chip global memory protection method protects the MCU chip's global memory by integrating a protection module between the host module and the bus. Furthermore, it provides multi-dimensional protection logic, thereby improving protection effectiveness and security. For unauthorized access, the access reaches the protection module after passing through the host module. If the access is deemed unauthorized, it is immediately abandoned, thus shortening the logical path of unauthorized access, addressing access bottlenecks, and improving access performance.

[0087] In another embodiment, this application also provides a global protection memory device for an MCU chip, including a processor and a memory storing a plurality of computer instructions, wherein the computer instructions, when executed by the processor, implement the steps of the method in steps 1-2.6. Specific limitations regarding the global protection memory device for an MCU chip can be found in the limitations of the global protection memory method for an MCU chip described above, and will not be repeated here.

[0088] It should be understood that, although Figures 4-5 The steps in the flowchart are shown sequentially as indicated by the arrows, but these steps are not necessarily executed in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order in which these steps are executed, and they can be performed in other orders. Figures 4-5 At least some of the steps in the process may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these sub-steps or stages is not necessarily sequential, but can be executed in turn or alternately with other steps or at least some of the sub-steps or stages of other steps.

[0089] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the invention patent. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this patent application should be determined by the appended claims.

Claims

1. A method for global memory protection of an MCU chip, characterized in that: The MCU chip is provided with a preset number of host modules and a preset number of memories, as well as a protection module. Each host module is electrically connected to the protection module, and each memory is electrically connected to the protection module through a bus. Each memory is pre-divided into different regions, and the protection module configures different protection information for each region and establishes a mapping table between each region and the protection information; When an access to memory is initiated through each host module, for each host module: The protection module receives access from the current host module and determines the type of the current access; When the access type is instruction type, the protection module stores the first information related to the current access in the database, and the protection module transmits the current access to the corresponding memory through the bus to realize the access. For the same host module, the database only stores the first information related to the latest instruction type access. When the access type is a data type, the protection module obtains the second information related to the current access. Both the first and second information include the host module ID corresponding to the current access and the region where the current access is located; The protection module determines whether the area where the memory is located in the second information related to the current access is configured with protection information based on the mapping table. If no protection information is configured, the protection module will pass the current access to the corresponding memory through the bus to realize the access. When protection information is configured, the protection module reads the protection information and searches the database for the first information with the same host module ID as the second information related to the current access. It then obtains the protection information corresponding to the found first information based on the mapping table. The system determines whether the protection information corresponding to the second information related to the current access belongs to the protection information obtained from the mapping table. If it does, the protection module will pass the current access to the corresponding memory through the bus to realize the access. If it does not belong, the current access is illegal and the current access is abandoned.

2. The MCU chip global memory protection method as described in claim 1, characterized in that: For an access initiated through the host module, the first type is the command type access. The host module parses the current command type access and determines whether the current command type access is a data processing command based on the parsed content. When processing a data type instruction, an access to the data type related to the current instruction type is initiated, and the current instruction type access includes the accessed object, i.e., memory information. When the instruction is not a data-processing instruction, there is no need to initiate a data type access.

3. The MCU chip global memory protection method as described in claim 1, characterized in that: The protection module includes multiple host sub-units, slave sub-units corresponding one-to-one with each host sub-unit, a security unit electrically connected to each host sub-unit and slave sub-unit respectively, and a configuration unit electrically connected to the bus, wherein each slave sub-unit is electrically connected to the bus. Each host subunit can receive access based on both instruction type and data type, and each host module is electrically connected to a host subunit in a one-to-one correspondence.

4. The MCU chip global memory protection method as described in claim 3, characterized in that: The protection information includes two independent dimensions: protection domains and protection levels. There are multiple categories of protection domains, represented as {protection domain 1, protection domain 2, ..., protection domain n}. The protection levels of the n categories of protection domains are consistent. For areas where no protection domains are configured, the protection domains of these areas are called common domains, and the protection levels of common domains are all lower than the protection levels of protection domain 1, protection domain 2, ..., and protection domain n. There are multiple protection levels, represented as {Protection Level 1, Protection Level 2, ... Protection Level n}. The protection level relationship among the multiple protection levels is: Protection Level 1 < Protection Level 2 < ... < Protection Level n. For areas without configured protection levels, the protection level of the area is called the common level, and the protection level of the common level is lower than the protection level of protection domain 1. When configuring protection information for a region, the configuration unit configures it according to the first rule, which is: randomly select a type of protection domain for configuration; and select the corresponding protection level for configuration based on the pre-set importance level of the region.

5. The MCU chip global memory protection method as described in claim 4, characterized in that: The protection module configures different protection information for each area, including: The configuration unit of the protection module configures different protection information for each region. When configuring each region: The configuration unit determines whether protection information exists in the current area. If no protection information exists, it selects the protection domain and protection level as candidate protection information according to the first rule. The configuration unit then determines whether the protection domain in the candidate protection information already exists in other areas. If the protection domain in the candidate protection information already exists in other areas, the configuration unit triggers an exception, prompts a configuration failure, and erases the data in the memory of the current area. If the protection domain in the candidate protection information does not exist in other areas, the configuration unit configures according to the candidate protection information to complete the protection information configuration for the current area; When protection information exists, the configuration unit determines whether the protection domain category needs to be changed. If it determines that the protection domain category needs to be changed, the configuration unit triggers an exception, prompts a configuration failure, and erases the data in the memory of the current area. If it is determined that the protection domain category does not need to be changed, the configuration unit determines whether the protection level needs to be reduced. If it is determined that the protection level needs to be reduced, the configuration unit triggers an exception, prompts a configuration failure, and erases the data in the memory of the current area. When it is determined that the protection level does not need to be lowered, the configuration unit determines whether it is permissible to raise the protection level. If it is determined that the protection level is permissible to raise the protection level, the configuration unit configures the protection level according to the permissible level and completes the protection information configuration for the current area. If it is determined that the protection level cannot be upgraded, the configuration unit will trigger an exception and indicate that the configuration failed. After the protection information configuration for the current area is completed, the configuration unit establishes a mapping relationship between the current area and the configured protection information and stores it in the mapping table.

6. The MCU chip global memory protection method as described in claim 3, characterized in that: The protection module receives access from the current host module and determines the type of the current access, including: The host subunit in the protection module receives access from the corresponding host module, and the host subunit sends the received access to the security unit. The security unit determines the type of the current access. Since the access carries the type information of the current access, the security unit directly determines the type of the current access based on the information carried in the access.

7. The MCU chip global memory protection method as described in claim 3, characterized in that: The security unit in the protection module stores the first information related to the current instruction type access to the database, and during the storage process, updates and replaces the existing first information of the same host module in the database with the first information related to the current instruction type access. When the protection module obtains the second information related to the current access, the security unit in the protection module performs the acquisition. During the access process, the security unit in the protection module transmits the current access to the corresponding slave sub-unit, which then transmits it to the corresponding memory via the bus to realize the access.

8. The MCU chip global memory protection method as described in claim 1, characterized in that: During the process of the protection module determining whether the area where the memory is located in the second information related to the current access is configured with protection information according to the mapping table, the security unit in the protection module searches the mapping table to see if the area where the memory is located in the second information related to the current access is configured with protection information. When protection information is configured, the security unit reads the protection information and calls it the first protection information. It then searches the database for the first information with the same host module ID as the second information related to the current access, obtains the area where the memory is located in the first information, and obtains the protection information corresponding to the area where the memory is located according to the mapping table, which is called the second protection information. The security unit determines whether the protection domain in the first protection information is the same as the protection domain in the second protection information, or whether the protection level of the protection domain in the first protection information is lower than the protection level of the protection domain in the second protection information; If the conditions are not met, the current access is considered illegal and the current access is abandoned. If the conditions are met, the security unit then determines whether the protection level of the protection level in the first protection information is less than or equal to the protection level of the protection level in the second protection information. If the conditions are not met, the current access is considered illegal and is abandoned. If the conditions are met, the security unit passes the current access to the corresponding slave sub-unit, which then passes it to the corresponding memory via the bus to enable access.

Images