Module security protection system and method, computer equipment and storage medium

Abstract

The invention provides a module safety protection system and method, computer equipment and a storage medium, the system comprises a plurality of main control modules and a plurality of safety gate modules, and each safety gate module corresponds to an internal module; each master control module is used for initiating an access request to the internal module, and the access request carries a hardware identity label and an access security attribute of the master control module; each security gate module is used for receiving the access request and carrying out legality verification on the hardware identity identifier and the access security attribute based on a pre-configured security rule; and each security gate module is also used for allowing access to the corresponding internal module when the hardware identity identifier and the access security attribute pass verification, or blocking the access request. By adopting the scheme, illegal access can be accurately resisted, the data security of the internal module is protected, and the protection capability is improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of security protection hardware, in particular to a module security protection system and method, computer equipment and storage medium. BACKGROUND

[0002] Complex heterogeneous processors have long been the core hardware in the fields of intelligent terminals, industrial control, automotive electronics, etc., which integrate multiple functional modules and access initiation units inside. The security of core data directly determines the trustworthiness of the entire system. How to block illegal access and protect the confidentiality and integrity of data is a core problem that must be solved in processor design.

[0003] The current mainstream security protection scheme is a hardware isolated trusted execution environment scheme. The core idea is to divide an independent security execution area through processor hardware, which is completely separated from the normal execution environment. Only trusted code in the security area can access core functional modules and sensitive data. The scheme relies on the system's built-in hardware trust root to build a secure startup chain, verifying the integrity of firmware and code one by one to ensure that the execution environment in the security area has not been tampered with, thereby protecting sensitive data and critical operations.

[0004] The existing scheme has a fatal security vulnerability: it only relies on whether the access is from the security area to determine whether it is legal or not, and completely depends on the software environment of the security area itself to ensure trustworthiness. Once the security area is cracked and the trust chain is broken, attackers can pretend to be legitimate programs in the security area to initiate access. The internal modules can only identify whether the request is from the security area, and cannot distinguish whether the initiator is a real legitimate program or a disguised attacker. They can only respond normally according to the rules, directly leading to the leakage of core security data, and further causing system function disorder, tampering of critical control logic, even leading to loss of control of the device, serious consequences such as safety accidents in industry scenarios, etc. SUMMARY

[0005] Therefore, the purpose of the present application is to provide a module security protection system and method, computer equipment and storage medium, which can accurately resist illegal access, protect internal module data security and improve protection capability.

[0006] In a first aspect, the present application provides a module security protection system, which includes a plurality of master control modules and a plurality of security gate modules. Each security gate module corresponds to an internal module. Each master control module is configured to initiate an access request to an internal module, and the access request carries a hardware identity of the master control module and an access security attribute. Each security gate module is configured to receive the access request and perform legality verification on the hardware identity and the access security attribute based on a preconfigured security rule. The security gate module is further configured to allow access to the corresponding internal module when the hardware identity and the access security attribute are verified, and otherwise block the access request.

[0007] Optionally, the access request further carries a target address and an operation type. The security gate module is further configured to verify, based on the security rule, whether the target address is within an address range allowed to be accessed and whether the operation type is an allowed operation type. The security gate module is further configured to allow access to the corresponding internal module when the hardware identity, the access security attribute, the target address and the operation type are all verified, and otherwise block the access request.

[0008] Optionally, the operation type includes a read operation and a write operation. The blocking of the access request includes: When the access request is a read operation, no data of the corresponding internal module is returned. When the access request is a write operation, no data write operation to the corresponding internal module is performed.

[0009] Optionally, the security gate module is further configured to trigger an interrupt signal to a master module initiating the access request after blocking the access request. The master module is further configured to record an abnormal access log based on the interrupt signal, wherein the abnormal access log includes a hardware identity of an initiating request, a target address, an operation type, an access time and a blocking result. The master module is further configured to perform security control based on the abnormal access log, including limiting access rights of a specific hardware identity when an abnormal access frequency of the specific hardware identity exceeds a threshold.

[0010] Optionally, the system further includes a bus module. The bus module connects the master modules and the security gate modules, and is configured to forward an access request initiated by a master module to a corresponding security gate module, and transmit interaction data between the master module and an internal module corresponding to the security gate module when the security gate module allows access.

[0011] Optionally, the system further includes a control module. The control module is configured to configure the security rule, and write the security rule into a hardware register of each security gate module through an APB bus interface, an AXI bus interface or other general register configuration bus interface. The configuration of the security rule includes: defining a hardware identity allowed to access; defining a security attribute corresponding to each hardware identity allowed to access; defining an address range allowed to access for each hardware identity; specifying an allowed operation type for each hardware identity in the address range allowed to access.

[0012] Optionally, the bit width of the hardware identity is determined according to the total number of master modules; wherein the bit width N is the smallest positive integer satisfying 2 (N-1) X≤2 N X is the total number of master modules.

[0013] In a second aspect, the embodiments of the present application provide a module security protection method, applied to a module security protection system, the system comprising a plurality of master modules and a plurality of security gate modules, each of the security gate modules corresponding to an internal module, the method comprising: Each master module initiates an access request to the internal module, the access request carrying a hardware identity of the master module and an access security attribute; Each security gate module receives the access request and performs legality verification on the hardware identity and the access security attribute based on a preconfigured security rule; Each security gate module allows access to the internal module corresponding thereto when the hardware identity and the access security attribute are both verified, otherwise blocks the access request.

[0014] Optionally, the access request further carries a target address and an operation type, and the method further comprises: Each security gate module verifies whether the target address is within an address range allowed to access and whether the operation type is an allowed operation type based on the security rule; Each security gate module allows access to the internal module corresponding thereto when the hardware identity, the access security attribute, the target address and the operation type are all verified, otherwise blocks the access request.

[0015] Optionally, the operation type comprises a read operation and a write operation; The blocking of the access request comprises: When the access request is a read operation, no data of the internal module corresponding thereto is returned; When the access request is a write operation, no data write operation to the internal module corresponding thereto is performed.

[0016] Optionally, the method further comprises: Each security gate module triggers an interrupt signal to a master module initiating the access request after blocking the access request; Each master module records an abnormal access log based on the interrupt signal, wherein the abnormal access log contains a hardware identity of an initiating request, a target address, an operation type, an access time, and a blocking result; Each master module performs security management based on the abnormal access log, including limiting access rights of a specific hardware identity when the abnormal access frequency of the specific hardware identity exceeds a threshold.

[0017] Optionally, the system further includes a bus module connecting each master module and each security gate module, and the method includes: The bus module forwards an access request initiated by a master module to a corresponding security gate module, and transmits interaction data between the master module and an internal module corresponding to the security gate module when the security gate module allows access.

[0018] Optionally, the system further includes a control module, and the method includes: The control module configures the security rules and writes the security rules into hardware registers of each security gate module through an APB bus interface, an AXI bus interface, or other general register configuration bus interfaces; The configuration of the security rules includes: Defining hardware identities allowed to access; Defining security attributes corresponding to each hardware identity allowed to access; Defining address ranges allowed to access for each hardware identity; Specifying allowed operation types of each hardware identity within the allowed access address range.

[0019] Optionally, the bit width of the hardware identity is determined according to the total number of master modules; Wherein, the bit width N is the smallest positive integer satisfying 2 (N-1) X≤2 N X is the total number of master modules.

[0020] In a third aspect, an embodiment of the present application provides a computer device, including a processor, a memory, and a bus, the memory stores machine readable instructions executable by the processor, when the computer device is running, the processor and the memory communicate through the bus, and the machine readable instructions are executed by the processor to perform the steps of the module security protection method in any one of the optional implementation manners of the second aspect.

[0021] In a fourth aspect, the embodiments of the present application provide a computer readable storage medium, and the computer readable storage medium stores a computer program, and the computer program is run by a processor to perform the steps of the module security protection method in any of the optional implementation manners of the first aspect.

[0022] The technical solutions provided by the present application include but are not limited to the following beneficial effects: The system sets a plurality of master modules and a plurality of security gate modules, and each security gate module corresponds to an internal module. This one-to-one correspondence configuration enables each internal module to be independently accessed and controlled, avoiding the inaccuracy of protection caused by unified strategies in general protection solutions. According to the security level difference of different internal modules, the protection strategy can be customized through the exclusive security gate, which can not only focus on protecting the core module, but also adapt to the protection needs of ordinary modules, improving the pertinence and flexibility of the overall protection of the system.

[0023] When each master module initiates an access request, it carries its own hardware identity and access security attribute. The hardware identity specifies the initiator of the access, and the access security attribute defines the security level of the request. The combination of the two provides a clear basis for subsequent legality verification, avoiding insufficient verification basis or misjudgment caused by incomplete access request information, and laying a foundation for accurate verification.

[0024] The security gate module performs legality verification on the hardware identity and access security attribute in the access request based on the preconfigured security rules, forming a double verification mechanism. The preconfigured rules ensure the uniformity and authority of the verification standard, and the double-dimensional verification can fully investigate the two types of risks of illegal identity and inconsistent attributes. Compared with single-dimensional verification, the rigorousness of access verification is improved, which can effectively filter access requests that do not meet the security rules and reduce the penetration possibility of illegal access.

[0025] The security gate module follows the logic of allowing access only when both verifications are passed, otherwise it is blocked. This realizes strict control of access permissions. This mechanism ensures that any access request that fails one verification cannot access the internal module, cutting off the illegal access path from the source. Even if the access attribute is used, as long as the hardware identity does not meet the rules, the request will be intercepted, avoiding the security vulnerability of releasing the request as long as one condition is met, effectively protecting the data confidentiality and integrity of the internal module.

[0026] The whole system forms a precise, rigorous and efficient internal module security protection system through the closed-loop design of exclusive gate configuration, request information carrying, double rule verification and strict permission control. The one-to-one gate configuration ensures the pertinence of protection, the request information carrying and double verification ensure the accuracy of verification, and the strict blocking mechanism ensures the effectiveness of protection. This design can effectively resist illegal access risk, especially for the access initiated by the disguised legal attribute, which can be accurately identified and blocked through identity verification, thereby improving the security protection capability of the internal module of the complex heterogeneous processor.

[0027] In order to make the above objectives, characteristics and advantages of the present application more apparent, comprehensible and easier to understand, the following preferred embodiments are specifically described below, and the accompanying drawings are referred to for detailed description. BRIEF DESCRIPTION OF DRAWINGS

[0028] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following will briefly introduce the drawings needed to be used in the embodiments, and it should be understood that the following drawings only show some embodiments of the present application, and therefore should not be regarded as a limitation to the scope, and for those skilled in the art, other related drawings can also be obtained without creative labor on the basis of these drawings.

[0029] Figure 1 Fig. 1 shows a structural schematic diagram of a module security protection system provided by the embodiment one of the present application; Figure 2 Fig. 2 shows a structural schematic diagram of a second module security protection system provided by the embodiment one of the present application; Figure 3 Fig. 3 shows a flow chart of a module security protection method provided by the embodiment two of the present application; Figure 4 Fig. 4 shows a flow chart of a second module security protection method provided by the embodiment two of the present application; Figure 5 Fig. 5 shows a flow chart of a security control method provided by the embodiment two of the present application; Figure 6 Fig. 6 shows a structural schematic diagram of a computer device provided by the embodiment three of the present application. DETAILED DESCRIPTION

[0030] In order to make the purposes, technical solutions and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only some but not all of the embodiments of the present application. The components of the embodiments of the present application described and shown in the drawings can be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of the present application provided in the drawings is not intended to limit the scope of the claimed present application, but only represents selected embodiments of the present application. Based on the embodiments of the present application, all other embodiments obtained by those skilled in the art without creative work fall within the scope of the present application.

[0031] Embodiment one In order to facilitate the understanding of the present application, the following describes the embodiments of the present application in detail with reference to the drawings. Figure 1 The structure diagram of the module security protection system provided by the embodiment one of the present application is shown.

[0032] Referring to Figure 1 shown, Figure 1 The structure diagram of the module security protection system provided by the embodiment one of the present application is shown, wherein the system includes a plurality of master control modules and a plurality of security gate modules, each of the security gate modules corresponds to an internal module.

[0033] Specifically, the plurality of master control modules include a micro control unit (responsible for the safety control of the whole system, not accessible to users, and having the highest security level) as a system security root and a central processing unit (CPU) supporting a secure execution environment (TEE, Trusted Execution Environment) and a non-secure execution environment (REE, Rich Execution Environment), both of which can initiate an access request to the internal module.

[0034] The security gate module is a newly added logical hardware module, and the core function thereof needs to be realized by programming. Each module is arranged in front of a corresponding internal module and specially intercepts all access requests directed to the internal module, which is used to solve the problem that, in the existing ARM Trust Zone architecture, after the TEE is cracked, the non-secure software initiates an access by pretending to be the secure software, resulting in the security data leakage of the internal module.

[0035] The scheme builds a pre-interception protection system by adding a hardware-level security gate module, changing the single protection mode of the existing technology which only relies on the PROT domain of the bus. The independent design of the secure root micro control unit ensures the non-tamperability of the security policy source, and the one-to-one gate deployment method realizes precise protection of internal modules. Even if the TEE is cracked, the unauthorized access of non-secure software can be directly intercepted, which improves the system security protection from the software level to the hardware level, greatly reducing the risk of core data leakage.

[0036] Each master module is configured to initiate an access request to an internal module, wherein the access request carries a hardware identity of the master module and an access security attribute.

[0037] Specifically, the hardware identity is unique and fixed for each master module in the system, and is in the form of a simple label (such as 0 to X-1, X being the total number of master modules), without complex formats, and only needs to realize the unique distinction of different master modules.

[0038] The identity is transmitted with the access request through the User domain of the AMBA bus (Advanced Microcontroller Bus Architecture), and is delivered to the accessed internal module at the end by the bus system. The access security attribute is distinguished by the PROT domain of the AMBA bus, corresponding to the execution environment type of the master module, i.e. the security attribute of TEE and the non-secure attribute of REE, supplementing the deficiency of the existing technology which only relies on the PROT domain to distinguish secure access.

[0039] The introduction of the hardware identity realizes the unique identity authentication of the master module, solving the defect that the security attribute in the existing technology is easily imitated. The transmission of the User domain ensures the reliable transmission of the identity information throughout the process, and the security attribute of the PROT domain forms a "double identity verification dimension, so that the source of the access request can be accurately traced. The simple label design ensures uniqueness while reducing hardware resource occupation, and the AMBA bus compatible design improves the engineering realizability of the scheme.

[0040] Each security gate module is configured to receive the access request and perform legality verification on the hardware identity and the access security attribute based on preconfigured security rules.

[0041] Specifically, the preconfigured security rules are configured by a micro control unit as a system security root or other modules with control functions. The rule content includes the allowed access permission corresponding to each hardware identity and the matching access security attribute, ensuring the security and credibility of the rule source.

[0042] The legality verification needs to complete two checks: one is to confirm whether the hardware identity of the master module initiating the request is in the access list allowed by the security gateway module; the second is to verify whether the access security attribute meets the preset rules of the internal module to be accessed, both of which meet the verification.

[0043] The exclusive configuration permission of the micro control unit of the security root or other modules with control function ensures the source credibility of the security rules, avoiding the risk of illegal tampering of the rules. The dual verification mechanism builds a basic protection line of identity combined with attributes, which greatly improves the accuracy of access verification compared with the single attribute verification of the prior art. This verification logic can quickly filter out access requests with illegal identity or unmatched attributes, reducing the occupation of system resources by invalid access from the source, and improving the security verification efficiency.

[0044] The security gateway module is further configured to allow access to the corresponding internal module when the hardware identity and the access security attribute are both verified, and otherwise block the access request.

[0045] Specifically, if the hardware identity and the access security attribute are both verified, the security gateway module releases the access request, allowing the master module and the corresponding internal module to interact with data (such as reading data, writing configuration parameters).

[0046] If any one of the verifications fails, the access request will be directly intercepted, and the master module and the internal module are not allowed to establish a data connection. For example, a certain internal module stores high-security level data, and only the micro control unit of the system security root is allowed to access. When the CPU initiates access, the security gateway module will block the request because the hardware identity of the CPU is not in the allowed list.

[0047] The interception logic of passing all through ensures the strictness of protection, avoiding security vulnerabilities caused by the failure of single verification dimension. Through the permission isolation of specific modules (such as high-security data only for the security root), the principle of least privilege is realized. The direct blocking method at the hardware level is faster than the software interception, which can complete the interception before the illegal access establishes a data connection, effectively avoiding the risk of data leakage or tampering.

[0048] In an optional embodiment, the access request further carries a target address and an operation type.

[0049] Specifically, the target address is the specific storage address or register address of the internal module to be accessed, which needs to fall within the address space allocated to the internal module in the system, to realize fine-grained control of the internal module address, avoiding the shortcomings of the prior art that only the whole module is distinguished for security and cannot limit the access of specific addresses.

[0050] The operation type only includes a read operation and a write operation, the read operation refers to an action of the master module obtaining data or register state stored by the internal module, and the write operation refers to an action of the master module writing data or a configuration parameter to the internal module, and the explicit operation type can further refine the access permission, and realize the control logic that only allows a specific module to perform a specific operation on a specific address.

[0051] The introduction of the target address and the operation type promotes the access control from the module level to the address-operation level, solves the problem of lack of address control in the internal module in the prior art, and through accurate positioning of the access object and the operation behavior, directional protection of sensitive addresses can be realized, for example, only the read permission of a specific address is opened and the write permission is limited, business access demand is met, security risk is maximally reduced, and flexibility and accuracy of permission control are improved.

[0052] The security gate module is further configured to verify, based on the security rule, whether the target address is within an address range allowed to be accessed and whether the operation type is an operation type allowed.

[0053] Specifically, for verification of the target address: the security rule defines a corresponding allowed address range for each allowed hardware identity, the range supports segmented control, the minimum granularity of each address segment is 4 bytes, the maximum number of segments is 16 or 32 (the specific number is determined by the hardware logic resource of the security gate module), and the specific interval of each address segment can be independently configured. During verification, it is necessary to confirm whether the target address falls within the allowed address segment of the corresponding hardware identity.

[0054] For verification of the operation type: the security rule specifies executable operation types (such as only read operation, only write operation, or both) within the corresponding allowed address range for each allowed hardware identity. During verification, it is necessary to check whether the operation type of the current access request is consistent with the preset rule.

[0055] The minimum address granularity of 4 bytes realizes accurate control of the register level address, the segmented configuration capability of 16 / 32 segments meets the multi-region permission division demand in a complex scenario, so that different master modules can obtain differentiated address access ranges. The binding verification of the operation type and the address range constructs double-precise protection of address combined operation, effectively prevents misoperation or malicious operation on sensitive addresses, and the adaptive design of the hardware logic resource takes into account the security and engineering implementation cost.

[0056] The security gate module is further configured to allow access to the corresponding internal module when the hardware identity, the access security attribute, the target address, and the operation type verification all pass, and otherwise block the access request.

[0057] Specifically, the access control of the security gate module needs to meet four verifications, and any one not passing will block the access request. Even if the hardware identity of the master module is legal and the access security attribute is correct, if the target address exceeds the allowed range or the operation type does not comply with the rules of the corresponding address segment, it will still be intercepted.

[0058] For example, after the TEE is cracked, non-secure software uses security attributes to initiate access, but if its hardware identity is not on the allowed list, or the target address and operation type do not comply with the rules, the access will still be blocked, completely solving the security vulnerabilities of existing architectures.

[0059] The four full-quantity verification mechanisms form a multi-dimensional security check closed loop. Even if a certain verification dimension is broken (such as the security attribute is used), other dimensions can still effectively intercept illegal access, achieving the effect of one failure and multiple backups. This design enables the system to maintain protection capabilities when facing advanced attacks such as TEE cracking, significantly improving the system's attack resistance.

[0060] In an optional embodiment, the operation type includes a read operation and a write operation.

[0061] Specifically, the read operation is mainly used for the master module to obtain the key data of the internal module (such as sensor collected data, current state of configuration register), and the write operation is mainly used for the master module to write control instructions or update data to the internal module (such as writing parameters to the control register, updating the content of the storage unit).

[0062] The security risks of the two types of operations are different. Read operation may cause data leakage, and write operation may cause data tampering, so it is necessary to design blocking strategies for the two types of operations to improve the pertinence of security protection.

[0063] The classification definition and risk differentiation of read and write operations achieve differentiated protection strategies that adapt to risks. The anti-leakage design for read operations and the anti-tampering design for write operations make security protection more targeted, avoiding resource waste or insufficient protection caused by one-size-fits-all protection. This classification processing method also provides a clear behavior dimension for subsequent log analysis and attack tracing, facilitating quick identification of attack intentions (such as frequent read operations may indicate data theft).

[0064] The blocking of the access request includes: when the access request is a read operation, not returning any data of the corresponding internal module.

[0065] Specifically, if the read operation request is blocked due to not complying with the security rules, the security gate module will directly intercept the response data of the internal module to the request and not return any information (including original data of the internal module, error prompt code, etc.) to the master module that initiated the request.

[0066] This processing method can ensure that the security data of the internal module is not stolen by illegal read operations, and even if there are multiple illegal attempts, no valid data can be obtained, avoiding the risk of data leakage.

[0067] The blocking strategy of zero return completely cuts off the data leakage path of illegal read operations, compared with the traditional way of returning error prompts, avoiding the risk that attackers can infer the system structure or address distribution through error information. This design keeps sensitive data in an unprovable protected state at all times, even in the face of persistent brute-force detection attacks, ensuring data integrity and confidentiality, and significantly improving data leak prevention capabilities.

[0068] When the access request is a write operation, no data write operation is performed to the corresponding internal module thereof.

[0069] Specifically, if the write operation request is blocked due to not meeting the security rules, the security gate module will discard the data to be written sent by the master control module, and will not transmit the data to the corresponding internal module, nor trigger any write action of the internal module.

[0070] This processing can ensure that the storage data and register configuration of the internal module remain in their original state and are not tampered with by illegal write operations, avoiding system failure or security risks caused by data or configuration abnormalities.

[0071] The dual processing mechanism of data discarding combined with action blocking ensures the configuration and data integrity of the internal module, preventing system parameter tampering, functional abnormalities, and other problems caused by illegal write operations. The write interception response speed at the hardware level is faster than the verification at the software level, which can complete the interception before the data reaches the internal module, avoiding the risk of writing first and then rolling back. This design is crucial to ensuring the normal operation of critical modules, and is particularly suitable for industrial control, automotive electronics, and other scenarios that require high system stability.

[0072] In an optional embodiment, each security gate module is also configured to trigger an interrupt signal to the master control module that initiates the access request after blocking the access request.

[0073] Specifically, the interrupt signal is transmitted through a hardware interrupt line, ensuring the stability of signal transmission and the response speed at the hardware level, avoiding the delay or unreliability of transmission at the software level.

[0074] The specific types that do not pass the verification include illegal hardware identity, inconsistent access security attributes, out-of-bounds target address, and disallowed operation type, which can directly locate the cause of the verification failure, providing clear evidence for subsequent exception handling, and avoiding the situation where the access is only blocked but the problem cannot be traced.

[0075] The transmission mode of the hardware interrupt line ensures the real-time and reliability of the interrupt signal, avoiding the delay or loss problems that may occur in software transmission. The fine information carried by the interrupt signal realizes accurate tracing, enabling operation and maintenance personnel to quickly locate the subject, target and failure reason of illegal access, greatly reducing the troubleshooting time. This blocking combined with the linkage mechanism of the alarm upgrades the system from passive protection to active monitoring, providing technical support for rapid response to security incidents.

[0076] The master control module is further configured to record an abnormal access log based on the interrupt signal, wherein the abnormal access log includes a hardware identity of an initiating request, a target address, an operation type, an access time, and a blocking result.

[0077] Specifically, the access time is a timestamp when the interrupt signal is triggered, used to accurately record the specific time when illegal access occurs; the blocking result explicitly marks that the access request has been intercepted by the security gate module and has not affected the internal module.

[0078] The recorded log information can completely retain the key characteristics of illegal access, providing data support for subsequent security analysis (such as locating modules frequently initiating illegal access and identifying potential attack patterns) and responsibility determination, forming a tracing mechanism for illegal access.

[0079] The complete log information builds a full-link tracing system for illegal access, and the accurate recording of the timestamp provides a basis for timing analysis of attack behavior. Log data not only supports single-event tracing, but also can identify potential attack chains or high-frequency attack sources through multi-log correlation analysis, providing data-driven decision support for security rule optimization. This record-analysis-optimization closed-loop mechanism enables the system security protection to have the ability of continuous iteration.

[0080] The master control module is further configured to perform security management and control based on the abnormal access log, including: when the abnormal access frequency of a specific hardware identity exceeds a threshold, limiting its access permission.

[0081] Specifically, in addition to limiting the access permission of the hardware identity whose abnormal access frequency exceeds the threshold (such as prohibiting the module from accessing a specific internal module or shortening the time length of its allowed access), the high-frequency violation dimension can also be analyzed based on the log.

[0082] For example, identifying that a certain address segment is frequently illegally accessed by multiple hardware identities, and then optimizing the pre-configured security rules (such as narrowing the allowed access range of the address segment or adding additional access verification conditions); multiple log entries can also be associated to identify potential attack chains (such as multiple hardware identities initiating coordinated illegal access to associated address segments within the same time period), realizing the upgrade of security management and control from passive blocking to active optimization.

[0083] The scheme realizes the upgrade of security control from passive response to active defense, and the frequency control based on logs can quickly limit the attack behavior of malicious modules and prevent the success of attack means such as brute force cracking. Through the mechanism of log analysis and optimization of security rules, the system can adapt to new attack modes, and the forward-looking of the protection is improved. The identification ability of the attack chain enhances the system's ability to respond to complex coordinated attacks, further improving the overall security level of the system.

[0084] In an optional embodiment, referring to Figure 2 illustrated, Figure 2 The structure of the second module security protection system provided by the embodiment one of the application is shown, wherein the system further comprises a bus module. The bus module connects each master module and each security gate module, and is configured to forward an access request initiated by the master module to the corresponding security gate module, and transmit interaction data between the master module and an internal module corresponding to the security gate module when the security gate module allows access.

[0085] Specifically, the bus module constructs a core transmission architecture based on an AMBA bus under an ARM architecture, supports general register configuration bus interfaces such as an APB bus interface (Advanced Peripheral Bus) and an AXI bus interface (Advanced eXtensible Interface), and can adapt to different interface requirements of the master module and the security gate module to realize compatible connection between the modules.

[0086] When forwarding the access request, the bus module strictly follows the AMBA bus protocol format, transmits the hardware identity carried in the access request initiated by the master module through the User domain of the AMBA bus, transmits the access security attribute through the PROT domain of the AMBA bus, and synchronously transmits the target address and the operation type (read operation / write operation) in the request, so that the security gate module can completely obtain all the information required for verification and meet the legality verification requirement.

[0087] After the security gate module allows access, the bus module transmits the interaction data between the master module and the target internal module through the corresponding APB or AXI interface, relies on the transmission mechanism of the AMBA bus to guarantee the stability and integrity of data transmission, and avoids data loss or tampering in the transmission link.

[0088] In an optional embodiment, the system further comprises a control module.

[0089] Specifically, the control module is a micro control unit of a system security root or other module with a control function, and is the only module in the system that has a security rule configuration permission, thereby ensuring the uniqueness and security of rule configuration.

[0090] The control module is configured to configure the security rules and write the security rules into hardware registers of each security gate module through an APB bus interface, an AXI bus interface or other general register configuration bus interfaces.

[0091] Specifically, the control module is the only module in the system that has a security rule configuration permission, thereby ensuring the uniqueness and security of rule configuration.

[0092] When the security rules are configured, the control module transmits rule data through an APB bus interface, an AXI bus interface or other general register configuration bus interfaces in the AMBA bus system, adapts to the common bus standard of the ARM architecture, and ensures the compatibility and stability of the configuration process.

[0093] The security rules are finally written into the hardware registers of the security gate module, and the hardware-level storage can prevent the rules from being illegally tampered with, and the security gate module can directly read the rules from the hardware registers for verification without relying on the software level loading, thereby improving the security and efficiency of rule use.

[0094] The exclusive configuration permission of the control module ensures that the source of rule configuration is controllable, thereby avoiding the risk of illegal tampering. The storage mode of the hardware registers enables the rules to have the ability to resist software attacks, and the direct reading mode saves the software loading link, thereby improving the verification response speed. The adaptive design of the multiple bus interfaces enhances the universality of the scheme, can be compatible with systems of different ARM architectures, reduces the transplantation cost of the scheme, and improves the engineering application value.

[0095] The configuration of the security rules includes defining allowed hardware identity.

[0096] Specifically, defining the allowed hardware identity is a basic step of security rule configuration, and a list of hardware identities that can legally access each internal module corresponding to a security gate module needs to be set.

[0097] The list needs to cover all legal master modules in the system that need to access the internal module, for example, if a certain internal module only allows the micro control unit of the system security root to access, the allowed list only contains the hardware identity of the micro control unit, thereby limiting the access permission of illegal modules from the source.

[0098] The configuration of the access-allowed list realizes the whitelist management of the master module, and eliminates the access possibility of unauthorized modules from the source, in line with the security design principle of least privilege. The ability to configure different lists for different internal modules enables high-security-level modules to achieve exclusive access rights, further strengthening the privilege isolation. This basic configuration provides reliable identity access basis for subsequent multi-level verification, improving the root security of the overall protection system.

[0099] Define the access-allowed security attributes corresponding to each hardware identity.

[0100] Specifically, when configuring the corresponding access-allowed security attributes for each access-allowed hardware identity, it needs to be matched with the execution environment of the master module to which the hardware identity belongs.

[0101] For example, the hardware identity corresponding to the micro control unit of the system security root and the TEE of the CPU is only allowed to configure security attributes; the hardware identity corresponding to the REE of the CPU is only allowed to configure non-security attributes, ensuring that the access attributes are consistent with the module security level and avoiding security risks caused by attribute mismatch.

[0102] The binding configuration of identity and security attributes ensures the consistency of identity and attributes, preventing the risk of legitimate modules misusing other security attributes to initiate access. This binding relationship makes the security attribute an attached feature of the identity, improving the credibility of the attribute. Through precise matching with the execution environment, differential access control of modules with different security levels is realized, ensuring that high-security-level operations can only be executed in a secure environment, and improving the rigor of the security policy.

[0103] Define the address range that each hardware identity is allowed to access.

[0104] Specifically, when defining the access-allowed address range for each access-allowed hardware identity, it needs to be based on the address space planning of the accessed internal module, supporting independent configuration of multiple address segments.

[0105] The minimum granularity of each address segment is 4 bytes, which can realize precise control of a single register or small-capacity storage unit; the maximum number of segments is determined by the hardware logic resources of the security gate module (such as 16 segments or 32 segments), for example, a hardware identity can be allowed to access two non-continuous address ranges of 0-4K and 8-12K, meeting the fine-grained address management needs in different scenarios.

[0106] The independent configuration capability of the multi-segment address meets the differentiated permission requirement in a complex business scenario, and the minimum granularity of 4 bytes realizes the precise control at the register level, so that the sensitive addresses in the module can be individually isolated and protected. The support capability of the non-continuous address range improves the flexibility of the permission configuration, and different modules can be allocated with non-continuous authorized address segments according to the business requirement, so as to avoid the risk of permission redundancy caused by the excessively large address range, and to maximize the compression of the security exposure surface while meeting the business access requirement.

[0107] The allowed operation types of each hardware identity in the allowed access address range are specified.

[0108] Specifically, when the allowed operation types of each hardware identity in the allowed access address range are specified, the function requirement of the address segment needs to be set.

[0109] For example, a certain address segment stores read-only security data, and only the read operation is allowed for the corresponding hardware identity; a certain address segment is used to store updateable configuration parameters, and the write operation or the read-write operation is allowed.

[0110] The binding configuration of the address segment and the operation type realizes the fine-grained granular control of the permission, so that different address segments in the same module can be configured with differentiated operation permissions, and the problem of the traditional module-level permission control roughness is solved. The read permission limitation of the read-only data segment and the read-write permission distinction of the configuration segment accurately match the function requirement of different address segments, which not only guarantees the anti-tampering security of sensitive data, but also supports the configuration update required by the business, and realizes the balance between security and availability.

[0111] In an optional embodiment, the bit width of the hardware identity is determined according to the total number of the master modules; wherein the bit width N is the smallest positive integer satisfying 2 (N-1) < X≤2 N X is the total number of the master modules.

[0112] Specifically, the bit width design of the hardware identity needs to ensure that all master modules in the system can be uniquely identified, while avoiding the waste of hardware resources caused by excessively large bit width.

[0113] For example, when there are 2 master modules (X=2) in the system, 2 (1-1) < 2≤2 1 At this time, the bit width N=1 (1 bit can identify 0 and 1, which covers 2 modules); when there are 3 master modules (X=3) in the system, 2 (2-1) < 3≤2 2 At this time, the bit width N=2 (2 bits can identify 0-3, which is enough to cover 3 modules), which meets the efficiency principle of hardware design.

[0114] This bit-width design achieves a balance between precise adaptation and resource optimization. It satisfies the unique identification requirements of all main control modules with a minimum bit width while avoiding the waste of hardware logic resources caused by bit-width redundancy. This standardized calculation method improves the scalability of the solution. When the number of main control modules in the system increases or decreases, the appropriate bit width can be quickly calculated, reducing the cost of system upgrades or reconstruction and enhancing the engineering practicality of the solution.

[0115] Example 2 See Figure 3 As shown, Figure 3 The flowchart of a module security protection method provided in Embodiment 2 of the present invention is shown. The method is applied to a module security protection system, which includes several main control modules and several security gate modules. Each security gate module corresponds to an internal module. The method includes steps S301-S303: S301: Each main control module initiates an access request to an internal module, the access request carrying the hardware identity and access security attributes of the main control module; S302: Each security gate module receives the access request and verifies the legality of the hardware identity and the access security attributes based on pre-configured security rules; S303: Each security gate module allows access to its corresponding internal module when both the hardware identity and the access security attribute are verified; otherwise, the access request is blocked.

[0116] In an optional implementation, see Figure 4 As shown, Figure 4 A flowchart of the second module security protection method provided in Embodiment 2 of the present invention is shown, wherein the access request also carries the target address and operation type, and the method further includes steps S401 to S402; S401: Each security gate module verifies whether the target address is within the allowed access address range and whether the operation type is an allowed operation type based on the security rules; S402: Each security gate module allows access to its corresponding internal module when the hardware identity, access security attribute, target address and operation type verifications are all passed; otherwise, the access request is blocked.

[0117] In one optional implementation, the operation type includes read operations and write operations; The blocking of the access request includes: When the access request is a read operation, no data is returned to its corresponding internal module; When the access request is a write operation, no data write operation to its corresponding internal module is performed.

[0118] In an optional embodiment, referring to Figure 5 shown, Figure 5 a flow chart of a security management method provided by the second embodiment of the present application is shown, wherein the method further comprises steps S501-S503: S501: each security gateway module triggers an interrupt signal to the master module initiating the access request after blocking the access request; S502: each master module records an abnormal access log based on the interrupt signal, wherein the abnormal access log contains the hardware identity of the initiating request, the target address, the operation type, the access time and the blocking result; S503: each master module performs security management based on the abnormal access log, including limiting the access permission of a specific hardware identity when the abnormal access frequency of the specific hardware identity exceeds a threshold.

[0119] In an optional embodiment, the system further comprises a bus module connecting each master module and each security gateway module, and the method comprises: the bus module forwards the access request initiated by the master module to the corresponding security gateway module, and transmits the interaction data between the master module and the internal module corresponding to the security gateway module when the security gateway module allows access.

[0120] In an optional embodiment, the system further comprises a control module, and the method comprises: the control module configures the security rules and writes the security rules into the hardware registers of each security gateway module through an APB bus interface, an AXI bus interface or other general register configuration bus interface; the configuration of the security rules comprises: defining the hardware identities allowed to access; defining the security attributes corresponding to each hardware identity allowed to access; delimiting the address range allowed to access for each hardware identity; specifying the allowed operation types of each hardware identity within the allowed access address range.

[0121] In an optional embodiment, the bit width of the hardware identity is determined according to the total number of master modules; wherein the bit width N is the smallest positive integer satisfying 2(N-1)<X≤2N, and X is the total number of master modules.

[0122] Embodiment three Based on the same application concept, referring to Figure 6 shown, Figure 6A structural schematic diagram of a computer device provided by the embodiment three of the present application is shown, wherein, as shown in Figure 6 The computer device 600 provided by the embodiment three of the present application includes: The processor 601, the memory 602 and the bus 603, the memory 602 stores machine readable instructions executable by the processor 601, when the computer device 600 runs, the processor 601 and the memory 602 communicate through the bus 603, the machine readable instructions are executed by the processor 601 to perform the steps of the module security protection method shown in the above-mentioned embodiment two.

[0123] Embodiment four Based on the same application concept, the embodiment of the present application further provides a computer readable storage medium, the computer readable storage medium stores a computer program, the computer program is executed by the processor to perform the steps of the module security protection method described in any one of the above embodiments.

[0124] Those skilled in the art can clearly understand that, for the convenience and brevity of the description, the specific process of the above-mentioned method can refer to the corresponding process in the foregoing system embodiment, which will not be repeated here.

[0125] The computer program product for performing the module security protection provided by the embodiment of the present application includes a computer readable storage medium storing program codes, the instructions included in the program codes can be used to execute the method described in the foregoing method embodiment, and the specific implementation can be referred to the method embodiment, which will not be repeated here.

[0126] The module security protection system provided by the embodiment of the present application can be specific hardware on the device or software or firmware installed on the device, etc. The system provided by the embodiment of the present application has the same implementation principle and technical effects as the foregoing method embodiment, and for brief description, the part not mentioned in the system embodiment can refer to the corresponding content in the foregoing method embodiment. Those skilled in the art can clearly understand that, for the convenience and brevity of the description, the specific working process of the foregoing described system, device and unit can refer to the corresponding process in the foregoing method embodiment, which will not be repeated here.

[0127] In the embodiments of the present application, it should be understood that the disclosed system and method can be implemented in other manners. The embodiments described above are merely exemplary, for example, the division of the units is only a logical function division, and there can be another division manner in actual implementation; for example, a plurality of units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the displayed or discussed mutual couplings or direct couplings or communication connections can be indirect couplings or communication connections through some interfaces, devices or units, and can be in electrical, mechanical or other forms.

[0128] The units described as separate components can or can not be physically separate, and the components displayed as units can or can not be physical units, i.e., can be located in one place, or can be distributed on a plurality of network units. Some or all of the units can be selected according to actual needs to achieve the purposes of the embodiments.

[0129] In addition, each functional unit in the embodiments provided by the present application can be integrated into one processing unit, or each unit can exist physically as a separate unit, or two or more units can be integrated into one unit.

[0130] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer readable storage medium. Based on this understanding, the technical solutions of the present application essentially or the parts that make contributions to the prior art or parts of the technical solutions can be embodied in the form of a software product. The computer software product is stored in a storage medium, and includes several instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), magnetic disk or optical disk, and various media that can store program codes.

[0131] It should be noted that: similar reference numerals and letters in the following drawings represent similar items, and therefore, once an item is defined in one drawing, it does not need to be further defined and explained in subsequent drawings. In addition, the terms "first", "second", "third" and the like are used only to distinguish descriptions, and cannot be understood as indicating or implying relative importance.

[0132] Finally, it should be noted that the above-described embodiments are merely specific embodiments of the present application, which are used to illustrate the technical solutions of the present application, but not to limit the present application, and the protection scope of the present application is not limited thereto. Although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that any person skilled in the art can still modify or easily think of changes to the technical solutions recorded in the foregoing embodiments, or make equivalent replacements to some technical features therein, within the technical scope disclosed by the present application, and these modifications, changes or replacements do not cause the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present application. All should be covered within the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.

Claims

1. A modular safety protection system, characterized in that, The system includes several main control modules and several safety gate modules, with each safety gate module corresponding to an internal module. Each main control module is used to initiate access requests to internal modules, and the access requests carry the hardware identity identifier and access security attributes of the main control module. Each security gate module is used to receive the access request and verify the legality of the hardware identity and the access security attributes based on pre-configured security rules; Each security gate module is also used to allow access to its corresponding internal module when both the hardware identity and the access security attributes are verified, otherwise to block the access request.

2. The system according to claim 1, characterized in that, The access request also carries the target address and operation type; Each security gate module is also used to verify, based on the security rules, whether the target address is within the allowed address range and whether the operation type is an allowed operation type; Each security gate module is also configured to allow access to its corresponding internal module when the hardware identity, access security attributes, target address, and operation type verifications are all passed; otherwise, the access request is blocked.

3. The system according to claim 2, characterized in that, The operation types include read operations and write operations; The blocking of the access request includes: When the access request is a read operation, no data is returned to its corresponding internal module; When the access request is a write operation, no data write operation to its corresponding internal module is performed.

4. The system according to claim 1, characterized in that, Each security gate module is also used to trigger an interrupt signal to the main control module that initiated the access request after blocking the access request; Each main control module is also used to record abnormal access logs based on the interrupt signal, wherein the abnormal access logs include the hardware identity of the requester, the target address, the operation type, the access time, and the blocking result; Each main control module is also used to perform security control based on the abnormal access log, including: restricting access permissions when the frequency of abnormal access of a specific hardware identity exceeds a threshold.

5. The system according to claim 1, characterized in that, The system also includes a bus module; The bus module connects each main control module and each security gate module, and is used to forward access requests initiated by the main control module to the corresponding security gate module. When the safety gate module allows access, it transmits interactive data between the main control module and the internal module corresponding to the safety gate module.

6. The system according to claim 1, characterized in that, The system also includes a control module; The control module is used to configure the security rules and write the security rules into the hardware registers of each security gate module through the APB bus interface, AXI bus interface or other general-purpose register configuration bus interface. The configuration of the security rules includes: Define the hardware identifiers that are allowed to be accessed; Define the allowed access security attributes corresponding to each hardware identity; Define the address range that each hardware identifier is allowed to access; Specify the allowed operation types for each hardware identity within the allowed access address range.

7. The system according to claim 1, characterized in that, The bit width of the hardware identity identifier is determined based on the total number of main control modules; Wherein, the bit width N satisfies 2 (N-1) <X≤2 N The smallest positive integer is X, and X is the total number of main control modules.

8. A module security protection method, characterized in that, The method is applied to a module safety protection system, the system comprising several main control modules and several safety gate modules, each safety gate module corresponding to an internal module, the method comprising: Each main control module initiates an access request to an internal module, and the access request carries the hardware identity and access security attributes of the main control module. Each security gate module receives the access request and verifies the legality of the hardware identity and the access security attributes based on pre-configured security rules; Each security gate module allows access to its corresponding internal module when both the hardware identity and the access security attributes are verified; otherwise, the access request is blocked.

9. A computer device, characterized in that, include: The computer device includes a processor, a memory, and a bus. The memory stores machine-readable instructions executable by the processor. When the computer device is running, the processor communicates with the memory via the bus. When the machine-readable instructions are executed by the processor, the steps of the module security protection method as described in claim 8 are performed.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, performs the steps of the module security protection method as described in claim 8.

Images